Text

Enclosure 5 - Surry Power Station EAL Technical Bases Document Final (Updated)
	ML19249B774
Person / Time
Site:	Millstone, Surry, North Anna, 07200002, 07200055
Issue date:	08/29/2019
From:	; Dominion Energy Nuclear Connecticut, Virginia Electric & Power Co (VEPCO)
To:	; Office of Nuclear Material Safety and Safeguards, Office of Nuclear Reactor Regulation
References
	19-296
	Download: ML19249B774 (252)
	v • d • e

Serial No.: 19-296 Docket Nos.: 50-280/281 72-2/55 ENCLOSURE 5 SPS EAL TECHNICAL BASES DOCUMENT FINAL (UPDATED)

Virginia Electric and Power Company (Dominion Energy Virginia)

Surry Power Station Units 1 and 2 and ISFSls

Serial No.19-296 Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 1 of 251 Emergency Action Level Technical Bases Document Surry Power Station FINAL (UPDATED)

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 2 of 251 Table of Contents

1.0 INTRODUCTION

....................................................................................................... 3 2.0 DISCUSSION ............................................................................................................. 3 2.1 Background ...................................................................................................... 3 2.2 Fission Product Barriers ................................................................................... 4 2.3 Fission Product Barrier Classification Criteria .................................................. 4 2.4 EAL Organization ............................................................................................. 4 2.5 Technical Bases Information ............................................................................ 7 2.6 Operational Mode Applicability ......................................................................... 8 3.0 GUIDANCE ON MAKING EMERGENCY CLASSIFICATIONS .................................. 9 3.1 General Considerations .................................................................................... 9 3.2 Classification Methodology ............................................................................. 10

4.0 REFERENCES

........................................................................................................ 14 4.1 Developmental. ............................................................................................... 14 4.2 Implementing .................................................................................................. 14 5.0 DEFINITIONS, ACRONYMS & ABBREVIATIONS .................................................. 15 5.1 Definitions ....................................................................................................... 15 5.2 Abbreviations/Acronyms ................................................................................. 19 6.0 SPS-TO-NEI 99-01, Rev. 6 EAL CROSS-REFERENCE ......................................... 22 7.0 ATTACHMENTS ...................................................................................................... 26 7.1

Attachment 1, Emergency Action Level Technical Bases ............................... 26 7.2 Attachment 2, Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases .. 26 Category R - Abnormal Rad Release / Rad Effluent.. ........................................................ 27 Category C - Cold Shutdown / Refueling System Malfunction ........................................... 67 Category E - Independent Spent Fuel Storage Installation (ISFSI) .................................. 111 Category F - Fission Product Barrier Degradation ........................................................... 114 Category H - Hazards and Other Conditions Affecting Plant Safety ................................ 171 Category M - System Malfunction .................................................................................... 205

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 3 of 251

1.0 INTRODUCTION

This document provides an explanation and rationale for each Emergency Action Level (EAL) included in the NEI 99-01, Rev. 6, EAL Upgrade Project for Surry Power Station (SPS). It should be used to facilitate review of the SPS EALs and provide historical documentation for future reference. Decision-makers responsible for implementation of EPIP-1.01, Emergency Manager Controlling Procedure, may use this document as a technical reference in support of EAL interpretation. This information may assist the Station Emergency Manager (SEM) in making classifications, particularly those involving judgment or multiple events. The basis information may also be useful in training and for explaining event classifications to off-site officials.

The expectation is that emergency classifications are to be made as soon as conditions are present and recognizable for the classification, but within 15 minutes or less in all cases of conditions present. Use of this document for assistance is not intended to delay the emergency classification.

Since the information in a basis document can affect emergency classification decision-making (e.g., the SEM refers to it during an event), the NRC staff expects that changes to the basis document will be evaluated in accordance with the provisions of 10 CFR 50.54(q). For Dominion Energy sites, a 10 CFR 50.54(q)(3) screening/evaluation will be performed to evaluate changes to this document.

Dominion Energy fleet procedure CM-AA-400, "10 CFR 50.59 and 10 CFR 72.48 - Changes, Tests and Experiments," provides a method to determine the impacts to licensing basis documents when changes are proposed to procedures, including changes to Abnormal Operating Procedures (AOPs) and Emergency Operating Procedures (EOPs). The 50.59/72.48 applicability review form specifically requires that the effect of a proposed procedure change on the Emergency Plan (and associated EALs) be reviewed/assessed.

When impacts to the Emergency Plan are identified, a separate review in accordance to 10 CFR 50.54(q) will be performed to determine the acceptability of the proposed procedure change.

2.0 DISCUSSION 2.1 Background EALs are the plant-specific indications, conditions or instrument readings that are utilized to classify emergency conditions defined in the Surry Power Station (SPS) Emergency Plan.

In 1992, the NRC endorsed NUMARC/NESP-007, "Methodology for Development of Emergency Action Levels" as an alternative guidance to the original Standard Review Plan and NUREG-0654 EAL schemes.

NEI 99-01 (NUMARC/NESP-007), Revisions 4 and 5 were subsequently issued for industry implementation. Enhancements over earlier revisions included:

Consolidating the system malfunction initiating conditions and example emergency action levels which address conditions that may be postulated to occur during plant shutdown conditions.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 4 of 251

Initiating conditions and example emergency action levels that fully address conditions that may be postulated to occur at permanently Defueled Stations and Independent Spent Fuel Storage Installations (ISFSls).

Simplifying the fission product barrier EAL threshold for a Site Area Emergency:

Subsequently, Revision 6 of NEI 99-01 has been issued which incorporates resolutions to numerous implementation issues including the NRC EAL Frequently Asked Questions (FAQs).

Using NEI 99-01, Rev. 6, "Methodology for the Development of Emergency Action Levels for Non-Passive Reactors," November 2012 (ref. 4.1.1 ), SPS conducted an EAL implementation upgrade project that produced the EALs discussed herein.

2.2 Fission Product Barriers Fission product barrier thresholds represent threats to the defense in depth design concept that precludes the release of radioactive fission products to the environment. This concept relies on multiple physical barriers, any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment.

Many of the EALs derived from the NEI methodology are fission product barrier threshold based. That is, the conditions that define the EALs are based upon thresholds that represent the loss or potential loss of one or more of the three fission product barriers. "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. A "Loss" threshold means the barrier no longer assures containment of radioactive materials. A "Potential Loss" threshold implies a greater probability of barrier loss and reduced certainty of maintaining the barrier.

The primary fission product barriers are:

A. Fuel Clad Barrier (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.

B. Reactor Coolant System Barrier (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves.

C. Containment Barrier (CTMT): The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the Emergency Classification Level (ECL) from an Alert to a Site Area Emergency or a General Emergency.

2.3 Fission Product Barrier Classification Criteria The following criteria are the bases for event classification related to fission product barrier loss or potential loss:

Alert:

Any loss or any potential loss of either Fuel Clad or RCS Barrier

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 5 of 251 Site Area Emergency:

Loss or potential loss of any two barriers General Emergency:

Loss of any two barriers and loss or potential loss of the third barrier 2.4 EAL Organization The SPS EAL scheme includes the following features:

Division of the EAL set into three broad groups:

o EALs applicable under any plant operational modes - This group would be reviewed by the EAL-user any time emergency classification is considered.

o EALs applicable only under hot operational modes - This group would only be reviewed by the EAL-user when the plant is in Hot Shutdown, Intermediate Shutdown, Reactor Critical, or Power Operation mode.

o EALs applicable only under cold operating modes - This group would only be reviewed by the EAL-user when the plant is in Cold Shutdown, Refueling or Defueled mode.

The purpose of the groups is to avoid review of hot condition EALs when the plant is in a cold condition and avoid review of cold condition EALs when the plant is in a hot condition. This approach significantly minimizes the total number of EALs that must be reviewed by the EAL-user for a given plant condition, reduces EAL-user reading burden and, thereby, speeds identification of the EAL that applies to the emergency.

Within each group, assignment of EALs to categories and subcategories:

Category and subcategory titles are selected to represent conditions that are operationally significant to the EAL-user. The SPS EAL categories are aligned to and represent the NEI 99-01 "Recognition Categories." Subcategories are used in the SPS scheme as necessary to further divide the EALs of a category into logical sets of possible emergency classification thresholds. The SPS EAL categories and subcategories are listed below.

The EALs are pre-determined, site-specific, observable thresholds for determining whether an Initiating Condition (IC) has occurred and that an EAL threshold was met or exceeded. Thus failure to evaluate the IC and EAL together could result in an incorrect declaration.

The primary tool for determining the emergency classification level is the EAL Classification Matrix. The user of the EAL Classification Matrix may (but is not required to) consult the EAL technical bases in order to obtain additional information concerning the EALs under classification consideration. The user should consult Section 3.0 and Attachment 1 of this document for such information.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 6 of 251 EAL Groups, Categories and Subcategories EAL Group/Category EAL Subcategory I

Any Operating Mode:

R - Abnormal Rad Levels / Rad Effluent 1 - Radiological Effluent 2 - Irradiated Fuel Event 3 -Area Radiation Levels H - Hazards and Other Conditions 1 - Security Affecting Plant Safety 2-Seismic Event 3 - Natural or Technological Hazard 4-Fire 5 - Hazardous Gas 6 - Control Room Evacuation 7 - SEM Judgment E - Independent Spent Fuel Storage 1 - Confinement Boundary Installation (ISFSI)

Hot Conditions:

M - System Malfunction 1- Loss of Emergency AC Power 2- Loss of Vital DC Power 3- Loss of Control Room Indications 4- RCS Activity 5- RCS Leakage 6- RPS Failure 7- Loss of Communications 8- Containment Failure 9- Hazardous Event Affecting Safety Systems F - Fission Product Barrier Degradation None Cold Conditions:

C - Cold Shutdown / Refueling System 1-RCS Level Malfunction 2 - Loss of Emergency AC Power 3 - RCS Temperature 4 - Loss of Vital DC Power 5 - Loss of Communications 6 - Hazardous Event Affecting Safety Systems

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 7 of 251 2.5 Technical Bases Information EAL technical bases are provided in Attachment 1 for each EAL according to EAL group (Any, Hot, Cold), EAL category (R, C, E, F, Hand M) and EAL subcategory. A summary is given at the beginning of each group, which provides a brief description of the category.

For each EAL, the following information is provided:

Category Letter & Title Subcategory Number & Title Initiating Condition (IC)

Site-specific description of the generic IC given in NEI 99-01, Rev. 6.

EAL identifier (enclosed in rectangle)

Each EAL is assigned a unique identifier to support accurate communication of the emergency classification to onsite and offsite personnel. Four characters define each EAL identifier as indicated below:

1. First character (letter): Corresponds to the EAL category as described above (R, C, E, F, Hor M)

2. Second character (letter): The emergency classification (G, S, A or U)

G = General Emergency S = Site Area Emergency A= Alert U = Notification of Unusual Event (NOUE)

3. Third character (number): Subcategory number within the given category.

Subcategories are sequentially numbered beginning with the number one (1 ). If a category does not have a subcategory, this character is assigned the number one (1 ).

4. Fourth character (number): The numerical sequence of the EAL within the EAL subcategory. If the subcategory has only one EAL, it is given the number one (1 ).

Classification (enclosed in rectangle):

General Emergency (G), Site Area Emergency (S), Alert (A) or NOUE (U).

EAL Wording (enclosed in rectangle)

Exact wording of the EAL as it appears in the EAL Classification Matrix.

Mode Applicability One or more of the following plant operating conditions comprise the mode to which each EAL is applicable: 1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 -

Intermediate Shutdown, 5 - Cold Shutdown, 6 - Refueling, D - Defueled, All - All modes (See Section 2.6 for operating mode definitions).

Notes (as applicable)

Definitions:

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 8 of 251 If the EAL wording contains a defined term, the definition of the term is included in this section. These definitions can also be found in Section 5.1.

Basis:

An EAL basis section that provides SPS-relevant information concerning the EAL as well as a description of the rationale for the EAL as provided in NEI 99-01, Rev. 6.

Reference(s):

Source documentation from which the EAL is derived.

2.6 Operational Mode Applicability Technical Specifications, definition 1.C, assigns the following reactor operating modes for Power Operation through Refueling:

1 Power Operation When the reactor is critical and the neutron flux power range instrumentation indicates greater than 2% of rated power 2 Reactor Critical When the neutron chain reaction is self-sustaining and keff = 1 .0 3 Hot Shutdown When the reactor is subcritical by at least 1.77% 8k/k and Tavg is~ 547°F 4 Intermediate Shutdown When the reactor is subcritical by at least 1.77% 8k/k and 200°F < Tavg < 547°F 5 Cold Shutdown When the reactor is subcritical by at least 1% 8k/k and T avg is s 200°F 6 Refueling When the reactor is subcritical by at least 5% 8k/k and Tavg is s 140°F and fuel is scheduled to be moved to or from the reactor core (Refueling Shutdown), or any operation involving movement of core components when the vessel' head is unbolted or removed (Refueling Operation)

D Defueled All fuel assemblies have been removed from Containment The plant operating mode that exists at the time that the event occurs (prior to any protective system or operator action being initiated in response to the condition) should be compared to the mode applicability of the EALs. If a lower or higher plant operating mode is reached before the emergency classification is made, the declaration shall be based on the mode that existed at the time the event occurred.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 9 of 251 3.0 GUIDANCE ON MAKING EMERGENCY CLASSIFICATIONS 3.1 General Considerations When making an emergency classification, the SEM must consider all information having a bearing on the proper assessment of an Initiating Condition (IC). This includes the EAL plus the associated Operational Mode Applicability, Notes, and the informing basis information. In the Category F matrices, EALs are based on loss or potential loss of Fission Product Barrier thresholds.

3.1.1 Classification Timeliness NRC regulations require the licensee to establish and maintain the capability to assess, classify, and declare an emergency condition within 15 minutes after the availability of indications to plant operators that an emergency action level has been exceeded and to promptly declare the emergency condition as soon as possible following identification of the appropriate emergency classification level. The NRC staff has provided guidance on implementing this requirement in NSIR/DPR-ISG-01, "Interim Staff Guidance, Emergency Planning for Nuclear Power Plants" (ref. 4.1.8).

3.1.2 Valid Indications All emergency classification assessments shall be based upon valid indications, reports or conditions. A valid indication, report, or condition, is one that has been verified through appropriate means such that there is no doubt regarding the indicator's operability, the condition's existence, or the report's accuracy. For example, verification could be accomplished ttirough an instrument channel check, response on related or redundant indicators, or direct observation by plant personnel.

An indication, report, or condition is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

3.1.3 Imminent Conditions For ICs and EALs that have a stipulated time duration (e.g., 15 minutes, 30 minutes, etc.), the SEM should not wait until the applicable time has elapsed, but should declare the event as soon as it is determined that the condition has exceeded, or will likely exceed, the applicable time. If an ongoing radiological release is detected and the release start time is unknown, it should be assumed that the release duration specified in the IC/EAL has been exceeded, absent data to the contrary.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 1O of 251 3.1.4 Planned vs. Unplanned Events A planned work activity that results in an expected event or condition which meets or exceeds an EAL does not warrant an emergency declaration provided that: 1) the activity proceeds as planned, and 2) the plant remains within the limits imposed by the operating license. Such activities include planned work to test, manipulate, repair, maintain or modify a system or component. In these cases, the controls associated with the planning, preparation and execution of the work will ensure that compliance is maintained with all aspects of the operating license provided that the activity proceeds and concludes as expected. Events or conditions of this type may be subject to the reporting requirements of 10CFR 50.72 (ref.

4.1.4).

3.1.5 Classification Based on Analysis The assessment of some EALs is based on the results of analyses that are necessary to ascertain whether a specific EAL threshold has been exceeded (e.g., dose assessments, chemistry sampling, RCS leak rate calculation, etc.). For these EALs, the wording of the EAL or associated basis discussion will identify the necessary analysis. In these cases, the 15-minute declaration period starts with the availability of the analysis results that show the threshold to be exceeded (i.e., this is the time that the EAL information is first available). The NRG expects licensees to establish the capability to initiate and complete EAL-related analyses within a reasonable period of time (e.g., maintain the necessary expertise on-shift).

3.1.6 SEM Judgment While the EALs have been developed to address a full spectrum of possible events and conditions which may warrant emergency classification, a provision for classification based on operator/management experience and judgment is still necessary. The NEI 99-01 EAL scheme provides the SEM with the ability to classify events and conditions based upon judgment using EALs that are consistent with the Emergency Classification Level (EGL) definitions (refer to Category H). The SEM will need to determine if the effects or consequences of the event or condition reasonably meet or exceed a particular EGL definition. A similar provision is incorporated in the Fission Product Barrier Tables; judgment may be used to determine the status of a fission product barrier.

3.2 Classification Methodology To make an emergency classification, the user will compare an event or condition (i.e., the relevant plant indications and reports) to an EAL(s) and determine if the EAL has been met or exceeded. The evaluation of an EAL must be consistent with the related Operating Mode Applicability and Notes. If an EAL has been met or exceeded, the associated IC is likewise met, the emergency classification process "clock" starts, and the EGL must be declared in accordance with plant procedures no later than 15 minutes after the process "clock" started.

When assessing an EAL that specifies a time duration for the potentially classifiable condition, the "clock" for the EAL time duration runs concurrently with the emergency classification process "clock." For a fµII discussion of this timing requirement, refer to NSIR/DPR-ISG-01 (ref.

4.1.8).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 11 of 251 3.2.1 Classification of Multiple Events and Conditions When multiple emergency events or conditions are present, the user will identify all met or exceeded EALs. The highest applicable ECL identified during this review is declared. For example:

If an Alert EAL and a Site Area Emergency EAL are met, whether at one unit or at two units, a Site Area Emergency should be declared.

There is no "additive" effect from multiple EALs meeting the same ECL. For example:

If two Alert EALs are met, whether at one unit or at two units, an Alert should be declared.

Related guidance concerning classification of rapidly escalating events or conditions is provided in Regulatory Issue Summary (RIS) 2007-02, Clarification of NRG Guidance for Emergency Notifications During Quickly Changing Events (ref. 4.1.2).

3.2.2 Consideration of Mode Changes During Classification The mode in effect at the time that an event or condition occurred, and prior to any plant or operator response, is the mode that determines whether or not an IC is applicable. If an event or condition occurs, and results in a mode change before the emergency is declared, the emergency classification level is still based on the mode that existed at the time that the event or condition was initiated (and not when it was declared). Once a different mode is reached, any new event or condition, not related to the original event or condition, requiring emergency classification should be evaluated against the ICs and EALs applicable to the operating mode at the time of the new event or condition.

For events that occur in Cold Shutdown or Refueling, escalation is via EALs that are applicable in the Cold Shutdown or Refueling modes, even if Hot Shutdown (or a higher mode) is entered during the subsequent plant response. In particular, the fission product barrier EALs are applicable only to events that initiate in the Hot Shutdown mode or higher.

3.2.3 Classification of Imminent Conditions Although EALs provide specific thresholds, the SEM must remain alert to events or conditions that could lead to meeting or exceeding an EAL within a relatively short period of time (i.e., a change in the ECL is IMMINENT). If, in the judgment of the SEM, meeting an EAL is IMMINENT, the emergency classification should be made as if the EAL has been met. While applicable to all emergency classification levels, this approach is particularly important at the higher emergency classification levels since it provides additional time for implementation of protective measures.

3.2.4 Emergency Classification Level Upgrading and Downgrading An ECL may be downgraded when the event or condition that meets the highest IC and EAL no longer exists, and other site-specific downgrading requirements are met. If downgrading the ECL is deemed appropriate, the new ECL would then be based on a lower applicable IC(s) and EAL(s). The ECL may also simply be terminated.

As noted above, guidance concerning classification of rapidly escalating events or conditions is provided in RIS 2007-02 (ref. 4.1.2).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 12 of 251 3.2.5 Classification of Short-Lived Events Event-based ICs and EALs define a variety of specific occurrences that have potential or actual safety significance. By their nature, some of these events may be short-lived and, thus, over before the emergency classification assessment can be completed. If an event occurs that meets or exceeds an EAL, the associated ECL must be declared regardless of its continued presence at the time of declaration. Examples of such events include an earthquake or a failure of the reactor protection system to automatically scram the reactor followed by a successful manual scram.

3.2.6 Classification of Transient Conditions Many of the ICs and/or EALs employ time-based criteria. These criteria will require that the IC/EAL conditions be present for a defined period of time before an emergency declaration is warranted. In cases where no time-based criterion is specified, it is recognized that some transient conditions may cause an EAL to be met for a brief period of time (e.g., a few seconds to a few minutes). The following guidance should be applied to the classification of these conditions.

EAL momentarily met during expected plant response - In instances in which an EAL is briefly met during an expected (normal) plant response, an emergency declaration is not warranted provided that associated systems and components are operating as expected, and operator actions are performed in accordance with procedures.

EAL momentarily met but the condition is corrected prior to an emergency declaration - If an operator takes prompt manual action to address a condition, and the action is successful in

correcting the condition prior to the emergency declaration, then the applicable EAL is not considered met and the associated emergency declaration is not required. For illustrative purposes, consider the following example:

An ATWS occurs and the high pressure ECCS systems fail to automatically start. The plant enters an inadequate core cooling condition (a potential loss of both the Fuel Clad and RCS Barriers). If an operator manually starts a high pressure ECCS system in accordance with an EOP step and clears the inadequate core cooling condition prior to an emergency declaration, then the classification should be based on the ATWS only.

It is important to stress that the 15-minute emergency classification assessment period (process clock) is not a "grace period" during which a classification may be delayed to allow the performance of a corrective action that would obviate the need to classify the event.

Emergency classification assessments must be deliberate and timely, with no undue delays.

The provision discussed above addresses only those rapidly evolving situations when an operator is able to take a successful corrective action prior to the SEM completing the review and steps necessary to make the emergency declaration. This provision is included to ensure that any public protective actions resulting from the emergency classification are truly warranted by the plant conditions.

3.2.7 After-the-Fact Discovery of an Emergency Event or Condition In some cases, an EAL may be met but the emergency classification was not made at the time of the event or condition. This situation can occur when personnel discover that an event or condition existed which met an EAL, but no emergency was declared, and the event or

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 13 of 251 condition no longer exists at the time of discovery. This may be due to the event or condition not being recognized at the time or an error that was made in the emergency classification process.

In these cases, no emergency declaration is warranted; however, the guidance contained in NUREG-1022 (ref. 4.1.3) is applicable. Specifically, the event should be reported to the NRC in accordance with 10CFR 50.72 (ref. 4.1.4) within one hour of the discovery of the undeclared event or condition. The licensee should also notify appropriate State and local agencies in accordance with the agreed upon arrangements.

3.2.8 Retraction of an Emergency Declaration Guidance on the retraction of an emergency declaration reported to the NRC is discussed in NUREG-1022 (ref. 4.1.3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 14 of 251

4.0 REFERENCES

4.1 Developmental 4.1.1 NEI 99-01, Revision 6, "Methodology for the Development of Emergency Action Levels for Non-Passive Reactors", (ADAMS Accession No. ML12326A805) 4.1.2 RIS 2007-02, "Clarification of NRC Guidance for Emergency Notifications During Quickly Changing Events", February 2, 2007.

4.1.3 NUREG-1022, "Event Reporting Guidelines: 10CFR50.72 and 50.73" 4.1.4 10 CFR 50. 72, "Immediate Notification Requirements for Operating Nuclear Power Reactors" 4.1.5 10 CFR 50. 73, "Licensee Event Report System" 4.1.6 Technical Specifications for Surry Units 1 and 2 4.1.7 VPAP-2103S, "Offsite Dose Calculation Manual (Surry)"

4.1.8 NSIR/DPR-ISG-01, "Interim Staff Guidance, Emergency Planning for Nuclear Power Plants" 4.1.9 SPS Emergency Plan 4.1.10 Surry Power Station Units 1 & 2 ISFSI SAR 4.1.11 OU-AA-200, "Shutdown Risk Management" 4.1.12 SY-AA-101, "Security and Access Control" 4.1.13 SPS UFSAR Section 9.12.3, "Fuel-Handling Structures" 4.1.14 RIS 2003-18 Use of NEI 99-01, "Methodology for Development of Emergency Action Levels" and related Supplements 1 and 2" 4.2 Implementing 4.2.1 EPIP-1.01, "Emergency Manager Controlling Procedure" 4.2.2 NEI 99-01, Rev. 6 to SPS EAL Comparison Matrix 4.2.3 SPS EAL Matrix

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 15 of 251 5.0 DEFINITIONS, ACRONYMS & ABBREVIATIONS 5.1 Definitions (ref. 4.1.1 except as noted)

Selected terms used in Initiating Condition, EAL statements and EAL bases are set in all capital letters (e.g., ALL CAPS). These are defined terms that have specific meanings as used in this document. The definitions of these terms are provided below.

ALERT Events are in progress, or have occurred, which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION.

Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.

CONFINEMENT BOUNDARY The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the SPS ISFSI, Confinement Boundary is defined as the Sealed Surface Storage Cask (SSSC) or NU HOMS Dry Storage Canister (DSC) (ref. 4.1.10).

CONTAl NM ENT CLOSURE The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken (ref. 4.1.11 ).

EMERGENCY ACTION LEVEL (EAL)

A pre-determined, site-specific, observable threshold for an INITIATING CONDITION that, when met or exceeded, places the plant in a given emergency classification level.

EMERGENCY CLASSIFICATION LEVEL (ECL)

One of a set of names or titles established by the US Nuclear Regulatory Commission (NRC) for grouping off-normal events or conditions according to (1) potential or actual effects or consequences, and (2) resulting onsite and offsite response actions. The emergency classification levels, in ascending order of severity, are:

Notification of Unusual Event (NOUE)

Alert

Site Area Emergency (SAE)

General Emergency (GE)

EXPLOSION A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 16 of 251 FAULTED The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized.

FIRE Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large quantities of smoke and heat are observed.

FISSION PRODUCT BARRIER THRESHOLD A pre-determined, site-specific, observable threshold indicating the loss or potential loss of a fission product barrier.

FLOODING A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

GENERAL EMERGENCY Events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area.

HOSTAGE A person(s) held as leverage against the station to ensure that demands will be met by the station.

HOSTILE ACTION An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILEs, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

HOSTILE FORCE One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.

IMMINENT The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 17 of 251 IMPEDE(D)

Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

INDEPENDENT SPENT FUEL STORAGE INSTALLATION (ISFSI)

A complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage.

INITIATING CONDITION (IC)

An event or condition that aligns with the definition of one of the four emergency classification levels by virtue of the potential or actual effects or consequences.

NOTIFICATION of UNUSUAL EVENT Events are in progress or have occurred which indicate a potential degradation in the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of safety systems occurs.

OWNER CONTROLLED AREA (OCA)

The entire area contiguous to the PLANT PROTECTED AREA, owned by the Company and designated to be controlled for security reasons (ref. 4.1.12).

PLANT PROTECTED AREA An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force (ref. 4.1.12).

PROJECTILE An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

REFUELING PATHWAY Refueling cavity, fuel transfer canal, and spent fuel pit (SFP), but not including the reactor vessel, comprise the refueling pathway (ref. 4.1.13).

RUPTURED The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

SAFETY SYSTEM A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 18 of 251 (1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

SECURITY CONDITION Any security event as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A Security Condition does not involve a HOSTILE ACTION.

SITE AREA EMERGENCY Events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts; (1) toward site personnel or equipment that could lead to the likely failure of or; (2) that prevent effective access to equipment needed for the protection of the public. Any releases are not expected to result in exposure levels which exceed EPA PAG exposure levels beyond the SITE BOUNDARY.

SITE BOUNDARY The company-owned area within 1650 feet of Surry Unit 1 containment (ref. 4.1.9).

UNISOLABLE An open or breached system line that cannot be isolated, remotely or locally.

UNPLANNED A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

VALID An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

VISIBLE DAMAGE Damage to a SAFETY SYSTEM train that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected SAFETY SYSTEM train.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 19 of 251 5.2 Abbreviations/Acronyms

~F ................................................... :................................................... Degrees Fahrenheit 0

- - - - Degrees

µCi ....................................................................................................................Micro Curie AC ....................................................................................................... Alternating Current AFW ....................................................................................................Auxiliary Feedwater AP ..................................................................................................... Abnormal Procedure ARM .............................................................................................. Area Radiation Monitor A TWS ...................................................................... Anticipated Transient Without Scram COE .......................................................................................Committed Dose Equivalent CET ............................................................................................ Core Exit Thermocouple CFR ..................................................................................... Code of Federal Regulations CPM ..................................................................................................... Counts Per Minute CR ...............................................................................................................

Control Room CSFST ....................................................................... Critical Safety Function Status Tree CTMT .............................................................................................................Containment OBA ............................................................................................... Design Basis Accident DEF .....................................................................................................................Defueled DC .................. :............................................................................................ Direct Current DE ........................................................................................................... Dose Equivalent DEl-131 .......................................................................................... Dose Equivalent 1-131 DIG ......................................................................................................... Diesel Generator DSC ..................................................................................................Dry Storage Canister EAL ............................................................................................. Emergency Action Level ECCS ............................................................................ Emergency Core Cooling System ECL ................................................................................. Emergency Classification Level EOG ..................................................................................... Emergency Diesel Generator EOF ............. :.................................................................... Emergency Operations Facility EOP ............................................................................... Emergency Operating Procedure EPA .............................................................................. Environmental Protection Agency FAA .................................................................................. Federal Aviation Administration FBI ................................................................................... Federal Bureau of Investigation FC ........................................................................................................... Fuel Clad Barrier FEMA. .............................................................. Federal Emergency Management Agency GE ..................................................................................................... General Emergency GPM .......... :.........................................................................................Gallons Per Minute Hr............................................................................................................................... Hour

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 20 of 251 IC ............................................................................................. ~ ........... Initiating Condition ISFSI. ........................................................... Independent Spent Fuel Storage Installation Ketr ......................................................................... Effective Neutron Multiplication Factor LCO .................................................................................. Limiting Condition of Operation LOCA ......................................................................................... Loss of Coolant Accident LRW ........................................................................................................ Liquid Radwaste LWR ................................................................................................... Light Water Reactor MCB .................................................................................................... Main Control Board Min .......................................................................................................................... Minute MPH ........................................................................................................... Miles Per Hour mR, mRem, mrem, mREM .............................................. milli-Roentgen Equivalent Man MW .................................................................................................................... Megawatt NEI .............................................................................................. Nuclear Energy Institute NPP .................................................................................................. Nuclear Power Plant NRC ................................................................................ Nuclear Regulatory Commission NSSS ................................................................................ Nuclear Steam Supply System NORAD ................................................... North American Aerospace Defense Command NOLIE .................................................................................. Notification of Unusual Event QBE ...................................................................................... Operating Basis Earthquake OCA ...............................................................................................Owner Controlled Area ODCM ............................................................................ Off-site Dose Calculation Manual PAG ........................................................................................ Protective Action Guideline PSIG ................................................................................ Pounds per Square Inch Gauge R ........................................................................................................................ Roentgen RCS ............................................................................................ Reactor Coolant System Rem, rem, REM ....................................................................... Roentgen Equivalent Man RPS ........................................................................................ Reactor Protection System RVLIS ........................................................ Reactor Vessel Level Instrumentation System SBO ......................................................................................................... Station Blackout SCBA ....................................................................... Self-Contained Breathing Apparatus SEM ......................................................................................Station Emergency Manager SSSC .................................................................................. Sealed Surface Storage Cask SFP ................................................................................................... Spent Fuel Pool (Pit)

SG ......................................................................................................... Steam Generator SI .............................................................................................................. Safety Injection SM ...............................................................................................................Shift Manager SPDS ........................................................................... Safety Parameter Display System SRO ............................................................................................ Senior Reactor Operator

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 21 of 251 TC (T/C) ...................................................................................................... Thermocouple TEDE ............................................................................... Total Effective Dose Equivalent TAF ....................................................................................................... Top of Active Fuel TS ................................................................................................Technical Specifications TSC .......................................................................................... Technical Support Center UFSAR ................................................................... Updated Final Safety Analysis Report USGS ............................................................................ United States Geological Survey

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 22 of 251 6.0 SPS-TO-NEI 99-01, Rev. 6 EAL CROSS-REFERENCE This cross-reference is provided to facilitate association and location of a SPS EAL within the NEI 99-01 IC/EAL identification scheme. Further information regarding the development of the SPS EALs based on the NEI guidance can be found in the EAL Comparison Matrix.

SPS NEI 99-01, Rev. 6 Example EAL IC EAL RU1.1 AU1 1 RU1.2 AU1 3 RU1.3 AU1 1 RU2.1 AU2 1 RA1.1 AA1 1 RA1.2 AA1 2 RA1.3 AA1 3 RA1.4 AA1 4 RA2.1 AA2 1 RA2.2 AA2 2 RA2.3 AA2 3 RA3.1 AA3 1 RA3.2 AA3 2 RS1.1 AS1 1 RS1.2 AS1 2 RS1.3 AS1 3 RS2.1 AS2 1 RG1.1 AG1 1 RG1.2 AG1 2 RG1.3 AG1 3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 23 of 251 SPS NEI 99-01, Rev. 6 Example EAL IC EAL RG2.1 AG2 1 CU1.1 CU1 1 CU1.2 CU1 2 CU2.1 CU2 1 CU3.1 CU3 1 CU3.2 CU3 2 CU4.1 CU4 1 CU5.1 CU5 1,2,3 CA1.1 CA1 1 CA1.2 CA1 2 CA2.1 CA2 1 CA3.1 CA3 1, 2 CA6.1 CA6 1 CS1.1 CS1 1 CS1.2 CS1 2 CS1.3 CS1 3 CG1.1 CG1 1 CG1.2 CG1 2 EU1 .1 EU1 1 FA1.1 FA1 1 FS1 .1 FS1 1 FG1.1 FG1 1 HU1.1 HU1 1, 2, 3 HU2.1 HU2 1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 24 of 251 SPS NEI 99-01, Rev. 6 Example EAL IC EAL HU3.1 HU3 1 HU3.2 HU3 2 HU3.3 HU3 3 HU3.4 HU3 4 HU4.1 HU4 1 HU4.2 HU4 2 HU4.3 HU4 3 HU4.4 HU4 4 HU7.1 HU? 1 HA1.1 HA1 1, 2 HAS.1 HAS 1 HA6.1 HA6 1 HA7.1 HA? 1 HS1.1 HS1 1 HS6.1 HS6 1 HS7.1 HS? 1 HG7.1 HG? 1 MU1.1 SU1 1 MU3.1 SU2 1 MU4.1 SU3 1 MU4.2 SU3 1 MU4.3 SU3 2 MUS.1 SU4 1,2,3 MU6.1 SUS 1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 25 of 251 SPS NEI 99-01, Rev. S Example EAL IC EAL MU6.2 SUS 2 MU7.1 SU6 1, 2, 3 MU8.1 SU? 1, 2 MA1.1 SA1 1 MA3.1 SA2 1 MA6.1 SAS 1 MA9.1 SA9 1 MS1.1 SS1 1 MS2.1 SS8 1 MS6.1 SSS 1 MG1.1 SG1 1 MG2.1 SGS 1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 26 of 251 7.0 ATTACHMENTS 7 .1 Attachment 1, Emergency Action Level Technical Bases 7.2 Attachment 2, Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 27 of 251 Attachment 1: Emergency Action Level Technical Bases Category R-Abnormal Rad Release/ Rad Effluent EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.)

Many EALs are based on actual or potential degradation of fission product barriers because of the elevated potential for offsiteradioactivity release. Degradation of fission product barriers though is not always apparent via non-radiological symptoms. Therefore, direct indication of elevated radiological effluents or area radiation levels are appropriate symptoms for emergency classification.

At lower levels, abnormal radioactivity releases may be indicative of a failure of containment systems or precursors to more significant releases. At higher release rates, offsite radiological conditions may result which require offsite protective actions. Elevated area radiation levels in plant may also be indicative of the failure of containment systems or preclude access to plant vital equipment necessary to ensure plant safety.

Events of this category pertain to the following subcategories:

1. Radiological Effluent Direct indication of effluent radiation monitoring systems provides a rapid assessment mechanism to determine releases in excess of classifiable limits. Projected offsite doses, actual offsite field measurements or measured release rates via sampling indicate doses or dose rates above classifiable limits.

2. Irradiated Fuel Event Conditions indicative of a loss of adequate shielding or damage to irradiated fuel may preclude access to vital plant areas or result in radiological releases that warrant emergency classification.

3. Area Radiation Levels Sustained general area radiation levels which may preclude access to areas required to safely operate and shutdown the plant also warrant emergency classification.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 28 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity greater than 2 times the allocated ODCM limits for 60 minutes or longer EAL:

RU1.1 NOUE Reading on SW-Rl-120(220) CW Discharge Tunnel radiation monitor> 2 x the "high" setpoint for 2:: 60 min.

(Notes 1, 2, 3)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Mode Applicability:

All Definition(s):

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This IC addresses a potential decrease in the level of safety of the plant as indicated by a low-level radiological release that exceeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un-monitored, including those for which a radioactivity discharge permit is normally prepared.

Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 29 of 251 Attachment 1: Emergency Action Level Technical Bases Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL.

This EAL addresses normally occurring continuous radioactivity releases from monitored liquid effluent pathways (ref. 1).

Escalation of the emergency classification level would be via IC RA 1.

Reference(s):

1. VPAP-2103S, "Offsite Dose Calculation Manual (Surry)"

2. NEI 99-01 AU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 30 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity greater than 2 times the allocated ODCM limits for 60 minutes or longer EAL:

RU1.2 NOUE Sample analysis for a gaseous or liquid release indicates a concentration or release rate

> 2 x the allocated ODCM limits for ~ 60 min.

(Notes 1, 2)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Mode Applicability:

All Definition(s):

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is.the need for timely assessment.

Basis:

This IC addresses a potential decrease in the level of safety of the plant as indicated by a low-level radiological release that exceeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un-monitored, including those for which a radioactivity discharge permit is normally prepared.

Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 31 of 251 Attachment 1: Emergency Action Level Technical Bases This EAL addresses uncontrolled gaseous or liquid releases that are detected by sample analyses or environmental surveys, particularly on unmonitored pathways (e.g., spills of radioactive liquids into storm drains, heat exchanger leakage in river water systems, etc.).

Escalation of the emergency classification level would be via IC RA1.

Reference(s):

1. VPAP-2103S, "Offsite Dose Calculation Manual (Surry)"

2. NEI 99-01 AU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 32 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity greater than 2 times the allocated ODCM limits for 60 minutes or longer EAL:

RU1.3 NOUE Reading on any Table R-1 effluent radiation monitor> column "NOLIE" for~ 60 min.

(Notes 1, 2, 3)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Table R-1 Gaseous Effluent Monitor Classification Thresholds Release Point & Monitor GE SAE Alert NOUE Vent#2 7.2E+07 µCi/sec 7.2E+06 µCi/sec 7.2E+05 µCi/sec 7.2E+04 µCi/sec 1-VG-Rl-131 B or C Process Vent 2.BE+OB µCi/sec 2.8E+07 µCi/sec 2.8E+06 µCi/sec 2.8E+05 µCi/sec 1-GW-Rl-130 B or C Mode Applicability:

All Definition(s):

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 33 of 251 Attachment 1: Emergency Action Level Technical Bases Basis:

This IC addresses a potential decrease in the level of safety of the plant as indicated by a low-level radiological release that exceeds regulatory commitments for an extended period of time (e.g., an uncontrolled release). It includes any gaseous or liquid radiological release, monitored or un-monitored, including those for which a radioactivity discharge permit is normally prepared.

Nuclear power plants incorporate design features intended to control the release of radioactive effluents to the environment. Further, there are administrative controls established to prevent unintentional releases, and to control and monitor intentional releases. The occurrence of an extended, uncontrolled radioactive release to the environment is indicative of degradation in these features and/or controls.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent' monitor reading is no longer VALID for classification purposes.

Releases should not be prorated or averaged. For example, a release exceeding 4 times release limits for 30 minutes does not meet the EAL.

This EAL addresses normally occurring continuous radioactivity releases from monitored gaseous effluent pathways (ref. 1, 2, 3).

The basis for the NOUE values corresponds to any unplanned release of gaseous effluent radioactivity to the environment that will result in a value 2 times the allocated ODCM limits for 60 minutes or longer. This NOUE gaseous release criterion is being used consistently across operating nuclear units at Dominion Energy. The reason an allocation of ODCM limits is required is due to the fact that for some effluent gaseous release pathways, using ODCM methods and limits to determine the UE EALs, the UE values calculated were greater than ALERT EAL threshold values or did not provide a factor of 10 separation from the ALERT EAL threshold. When necessary, allocation fractions are applied to maintain the NOUE limit to at least a factor of 10 lower than the ALERT EAL limit. This method provides a justifiable basis for NOUE thresholds based on established methods and setpoints provided in the facility ODCM. The proposed NOUE values will classify events based ori degradation in the level of safety of the plant and will maintain a near linear escalation between all four classification levels (i.e., NOUE, ALERT, Site Area Emergency (SAE) and General Emergency (GE)). (ref.

2).

Classification thresholds within Table R-1 were generated using the MIDAS dose assessment code. Inputs to MIDAS use most prevalent meteorological data and expected release point parameters. An assumed one-hour decay since shutdown and a one-hour release duration are applied. Mitigating reduction mechanisms (e.g., decay, sprays, filters) input into MIDAS for

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 34 of 251 Attachment 1: Emergency Action Level Technical Bases each accident type determined the radiological release source term consistent with the guidance provided in NUREG-1228.

The MGPI radiation monitors for 1-GW-Rl-130B & C and 1-VG-Rl-131 B & C consist of a "normal" (or low) and an "accident" (or high) range device. The "normal" range radiation monitor flowpath is isolated at a predetermined value at which time the "accident" range radiation monitor is automatically aligned for operation. The "normal" range radiation monitor must be manually put back in service when flowpath activity trends down.

Due to the fact that there are no ODCM limits on steam safeties or auxiliary feedwater exhausts, those respective radiation monitors are not utilized within the EALs.

Escalation of the emergency classification level would be via IC RA 1.

Reference(s):

1. VPAP-2103S, "Offsite Dose Calculation Manual (Surry)"

2. RP-18-01, "Surry Abnormal Rad Release Gaseous EAL Thresholds based on NEI 99-01, Rev. 6"

3. HP-3010.040, "Radiation Monitoring Setpoint Determination"

4. NEI 99-01 AU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 35 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous_ or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem adult thyroid COE EAL:

RA1.1 Alert Reading on any Table R-1 effluent radiation monitor> column "ALERT" for 2: 15 min.

(Notes 1, 2, 3, 4)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Note 4: The pre-calculated effluent monitor values presented in EALs RA1 .1, RS1 .1 and RG1 .1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

Table R-1 Gaseous Effluent Monitor Classification Thresholds Release Point & Monitor GE SAE Alert NOUE Vent#2 7.2E+07 µCi/sec 7.2E+06 µCi/sec 7.2E+05 µCi/sec 7.2E+04 µCi/sec 1-VG-Rl-131 B or C Process Vent 2.8E+08 µCi/sec 2.8E+07 µCi/sec 2.8E+06 µCi/sec 2.8E+05 µCi/sec 1-GW-Rl-130 B or C Mode Applicability:

All Definition(s ):

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 36 of 251 Attachment 1: Emergency Action Level Technical Bases actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release).

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Since dose assessment is based on actual meteorology whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted, or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor readings listed in Table R-1.

Classification thresholds within Table R-1 were generated using the MIDAS dose assessment code. Inputs to MIDAS use most prevalent meteorological data and expected release point parameters. An assumed one-hour decay since shutdown and a one-hour release duration are applied. Mitigating reduction mechanisms (e.g., decay, sprays, filters) input into MIDAS for each accident type determined the radiological release source term consistent with the guidance provided in NUREG-1228.

The MGPI radiation monitors for 1-GW-Rl-1308 & C and 1-VG-Rl-131 B & C consist of a "normal" (or low) and an "accident" (or high) range device. The "normal" range radiation monitor flowpath is isolated at a predetermined value at which time the "accident" range radiation monitor is automatically aligned for operation. The "normal" range radiation monitor must be manually put back in service when flowpath activity trends down.

Escalation of the emergency classification level would be via IC RS1.

Reference(s):

1. RP 18-01, "Surry Abnormal Rad Release Gaseous EAL Thresholds based on NEI 99-01",

Rev.6

2. NEI 99-01 AA 1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 37 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting .

in offsite

- dose greater than 10 mrem TEDE or 50 mrem adult thyroid COE EAL:

RA1.2 Alert Dose assessment using actual meteorology indicates doses > 10 mrem TEDE or 50 mrem adult thyroid COE at or beyond the SITE BOUNDARY (Note 4)

Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

Mode Applicability:

All Definition(s):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA Protective Action Guides (PAGs). It includes _both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release).

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem adult thyroid*

COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Since dose assessment is based on actual meteorology whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted, or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor readings listed in Table R-1.

Actual meteorology (including forecasts) should be used whenever possible.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 38 of 251 Attachment 1: Emergency Action Level Technical Bases Escalation of the emergency classification level would be via IC RS1.

Reference(s):

1. EPIP-4.01, "Radiological Assessment Director Controlling Procedure"

2. EPIP-4.03, "Dose Assessment Team Controlling Procedure"

3. NEI 99-01 AA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 39 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem adult thyroid COE EAL:

RA1.3 Alert Analysis of a liquid effluent sample indicates a concentration or release rate that would result in doses > 10 mrem TEDE or 50 mrem adult thyroid COE at or beyond the SITE BOUNDARY for 60 min. of exposure (Notes 1, 2)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Mode Applicability:

All Definition(s):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release).

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

This EAL is assessed per the ODCM (ref. 1). ODCM software can be used to produce a dose to the maximum individual.

Escalation of the emergency classification level would be via IC RS1.

Reference(s):

1. VPAP-2103S, "Offsite Dose Calculation Manual (Surry)"

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 40 of 251 Attachment 1: Emergency Action Level Technical Bases

2. NEI 99-01 AA 1

i Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 41 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous or liquid radioactivity resulting in offsite dose greater than 10 mrem TEDE or 50 mrem adult thyroid C_DE EAL:

RA1.4 Alert Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

Closed window dose rates > 10 mR/hr expected to continue for;:: 60 min.

Analyses of field survey samples indicate adult thyroid COE> 50 mrem for 60 min. of inhalation.

(Notes 1, 2)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Mode Applicability:

All Definition(s):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous or liquid radioactivity that results in projected or actual offsite doses greater than or equal to 1% of the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude represent an actual or potential substantial degradation of the level of safety of the plant as indicated by a radiological release that significantly exceeds regulatory limits (e.g., a significant uncontrolled release).

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 1% of the EPA PAG of 1,000 mrem while the 50 mrem adult thyroid COE was established in consideration of the 1 :5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Escalation of the emergency classification level would be via IC RS1.

Reference(s):

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 42 of 251 Attachment 1: Emergency Action Level Technical Bases

1. EPIP-4.16, "Offsite Monitoring"

2. EPIP-4.01, "Radiological Assessment Director Controlling Procedure"

3. EPIP-4.03, "Dose Assessment Team Controlling Procedure"

4. EPIP 4.34, "Field Team Radio Operator Instructions"

5. NEI 99-01 AA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency .Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 43 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem adult thyroid COE EAL:

RS1.1 Site Area Emergency Reading on any Table R-1 effluent radiation monitor> column "SAE" for ~ 15 min.

(Notes 1, 2, 3, 4)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available Table R-1 Gaseous Effluent Monitor Classification Thresholds Release Point & Monitor GE SAE Alert NOUE Vent#2 7.2E+07 µCi/sec 7.2E+06 µCi/sec 7.2E+05 µCi/sec 7 .2E+04 µCi/sec 1-VG-Rl-131 B or C Process Vent 2.8E+08 µCi/sec 2.8E+07 µCi/sec 2.8E+06 µCi/sec 2.8E+05 µCi/sec 1-GW-Rl-130 B or C Mode Applicability:

All Definition(s ):

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with

-~-

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 44 of 251 Attachment 1: Emergency Action Level Technical Bases the failure of plant systems needed for the protection of the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem adult thyroid CDE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid CDE.

Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Since dose assessment is based on actual meteorology whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted, or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor readings listed in Table R-1.

Classification thresholds within Table R-1 were generated using the MIDAS dose assessment code. Inputs to MIDAS use most prevalent meteorological data and expected release point parameters. An assumed one-hour decay since shutdown and a one-hour release duration are applied. Mitigating reduction mechanisms (e.g., decay, sprays, filters) input into MIDAS for each accident type determined the radiological release source term consistent with the guidance provided in NUREG-1228.

The MGPI radiation monitors for 1-GW-Rl-1308 & C and 1-VG-Rl-131 B & C consist of a "normal" (or low) and an "accident" (or high) range device. The "normal" range radiation monitor flowpath is isolated at a predetermined value at which time the "accident" range radiation monitor is automatically aligned for operation. The "normal" range radiation monitor must be manually put back in service when flowpath activity trends down.

Escalation of the emergency classification level would be via IC RG1.

Reference(s):

1. RP 18-01, "Surry Abnormal Rad Release Gaseous EAL Thresholds based on NEI 99-01 ",

Rev. 6

2. NEI 99-01 AS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 45 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem adult thyroid COE EAL:

RS1.2 Site Area Emergency Dose assessment using actual meteorology indicates doses > 100 mrem TEDE or 500 mrem adult thyroid COE at or beyond the SITE BOUNDARY (Note 4)

Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

Mode Applicability:

All Definition(s):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Since dose assessment is based on actual meteorology whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor readings listed in Table R-1. Actual meteorology is specifically identified since it gives the most accurate dose assessment.

Actual meteorology (including forecasts) should be used whenever possible.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 46 of 251 Attachment 1: Emergency Action Level Technical Bases Escalation of the emergency classification level would be via IC AG1.

Reference(s):

1. EPIP-4.01, "Radiological Assessment Director Controlling Procedure"

2. EPIP-4.03, "Dose Assessment Team Controlling Procedure"

3. NEI 99-01 AS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 47 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 100 mrem TEDE or 500 mrem adult thyroid COE EAL:

RS1 .3 Site Area Emergency Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

Closed window dose rates > 100 mR/hr expected to continue for~ 60 min.

Analyses of field survey samples indicate adult thyroid COE > 500 mrem for 60 min.

of inhalation.

(Notes 1, 2)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Mode Applicability:

All Definition(s):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to 10% of the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude are associated with the failure of plant systems needed for the protection of the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at 10% of the EPA PAG of 1,000 mrem while the 500 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Escalation of the emergency classification level would be via IC RG1.

Reference(s):

1. EPIP-4.16, "Offsite Monitoring"

2. EPIP-4.01, "Radiological Assessment Director Controlling Procedure"

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 48 of 251 Attachment 1: Emergency Action Level Technical Bases

3. EPIP-4.03, "Dose Assessment Team Controlling Procedure"

4. EPIP 4.34, "Field Team Radio Operator Instructions"

5. NEI 99-01 AS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 49 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem adult thyroid CDE EAL:

RG1.1 General Emergency Reading on any Table R-1 effluent radiation monitor> column "GE" for 2: 15 min.

(Notes 1, 2, 3, 4)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Note 3: If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Note 4: The pre-calculated effluent monitor values presented in EALs RA1 .1, RS1 .1 and RG1 .1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

Table R-1 Gaseous Effluent Monitor Classification Thresholds Release Point & Monitor GE SAE Alert NOUE Vent#2 7.2E+07 µCi/sec 7.2E+06 µCi/sec 7.2E+05 µCi/sec 7.2E+04 µCi/sec 1-VG-Rl-131 B or C Process Vent 2.8E+08 µCi/sec 2.8E+07 µCi/sec 2.8E+06 µCi/sec 2.8E+05 µCi/sec 1-GW-Rl-130 B or C Mode Applicability:

All Definition(s):

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA Protective Action Guides (PAGs). It includes both

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 50 of 251 Attachment 1: Emergency Action Level Technical Bases monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Classification based on effluent monitor readings assumes that a release path to the environment is established. If the effluent flow past an effluent monitor is known to have stopped due to actions to isolate the release path, then the effluent monitor reading is no longer VALID for classification purposes.

Since dose assessment is based on actual meteorology whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted, or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor readings listed in Table R-1. Actual meteorology is specifically identified since it gives the most accurate dose assessment.

Classification thresholds within Table R:*1 were generated using the MIDAS dose assessment code. Inputs to MIDAS use most prevalent meteorological data and expected release point parameters. An assumed one-hour decay since shutdown and a one-hour release duration are applied. Mitigating reduction mechanisms (e.g., decay, sprays, filters) input into MIDAS for each accident type determined the radiological release source term consistent with the guidance provided in NUREG-1228.

The MGPI radiation monitors for 1-GW-Rl-130B & C and 1-VG-Rl-131 B & C consist of a "normal" (or low) and an "accident" (or high) range device. The "normal" range radiation monitor flowpath is isolated at a predetermined value at which time the "accident" range radiation monitor is automatically aligned for operation. The "normal" range radiation monitor must be manually put back in service when flowpath activity trends down.

Reference(s):

1. RP 18-01, "Surry Abnormal Rad Release Gaseous EAL Thresholds based on NEI 99-01 ",

Rev. 6

2. NEI 99-01 AG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 51 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem adult thyroid COE EAL:

RG1.2 General Emergency Dose assessment using actual meteorology indicates doses > 1,000 mrem TEDE or 5,000 mrem adult thyroid COE at or beyond the SITE BOUNDARY (Note 4)

Note 4: The pre-calculated effluent monitor values presented in EALs RA 1.1, RS1 .1 and RG1 .1 should be used for emergency classification assessments until the results from a dose assessment using actual meteorology are available.

Mode Applicability:

All Definition(s ):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Since dose assessment is based on actual meteorology whereas the monitor reading EALs are not, the results from these assessments may indicate that the classification is not warranted or may indicate that a higher classification is warranted. For this reason, emergency implementing procedures call for the timely performance of dose assessments using actual meteorology and release information. If the results of these dose assessments are available when the classification is made (e.g., initiated at a lower classification level), the dose assessment results override the monitor readings listed in Table R-1.

Actual meteorology (including forecasts) should be used whenever possible.

Reference(s):

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 52 of 251 Attachment 1: Emergency Action Level Technical Bases

1. EPIP-4.01, "Radiological Assessment Director Controlling Procedure"

2. EPIP-4.03, "Dose Assessment Team Controlling Procedure"

3. NEI 99-01 AG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 53 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 1 - Radiological Effluent Initiating Condition: Release of gaseous radioactivity resulting in offsite dose greater than 1,000 mrem TEDE or 5,000 mrem adult thyroid COE EAL:

RG1 .3 General Emergency Field survey results indicate EITHER of the following at or beyond the SITE BOUNDARY:

Closed window dose rates > 1,000 mR/hr expected to continue for;:; 60 min.

Analyses of field survey samples indicate adult thyroid COE > 5,000 mrem for 60 min. of inhalation.

(Notes 1, 2)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 2: If an ongoing release is detected and the release start time is unknown, assume that the release duration has exceeded the specified time limit.

Mode Applicability:

All Definition(s):

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses a release of gaseous radioactivity that results in projected or actual offsite doses greater than or equal to the EPA Protective Action Guides (PAGs). It includes both monitored and un-monitored releases. Releases of this magnitude will require implementation of protective actions for the public.

Radiological effluent EALs are also included to provide a basis for classifying events and conditions that cannot be readily or appropriately classified on the basis of plant conditions alone. The inclusion of both plant condition and radiological effluent EALs more fully addresses the spectrum of possible accident events and conditions.

The TEDE dose is set at the EPA PAG of 1,000 mrem while the 5,000 mrem adult thyroid COE was established in consideration of the 1:5 ratio of the 1992 EPA PAG for TEDE and thyroid COE.

Reference(s):

1. EPIP-4.16, "Offsite Monitoring"

2. EPIP-4.01, "Radiological Assessment Director Controlling Procedure"

3. EPIP-4.03, "Dose Assessment Team Controlling Procedure"

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 54 of 251 Attachment 1: Emergency Action Level Technical Bases

4. EPIP 4.34, "Field Team Radio Operator Instructions"

5. NEI 99-01 AG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 55 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: UNPLANNED loss of water level above irradiated fuel EAL:

RU2.1 NOUE UNPLANNED water level drop in the REFUELING PATHWAY as indicated by any of the following:

O-VSP-C4 SPENT FUEL PIT LO LVL

Report of dropping level in refueling cavity or SFP

Loss of SFP Cooling suction flow AND UNPLANNED rise in corresponding area radiation levels as indicated by any of the following radiation monitors:

RM-Rl-152 New Fuel Storage Area

RM-Rl-153 Fuel Pit Bridge

RM-RI-( )62 Manipulator Crane

RM-RI-( )63 Reactor Containment Mode Applicability:

All Definition(s ):

UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

REFUELING PATHWAY- Refueling cavity, fuel transfer canal, and spent fuel pit (SFP), but not including the reactor vessel, comprise the refueling pathway.

Basis:

This IC addresses a decrease in water level above irradiated fuel sufficient to cause elevated radiation levels. This condition could be a precursor to a more serious event and is also indicative of a minor loss in the ability to control radiation levels within the plant. It is therefore a potential degradation in the level of safety of the plant.

A water level decrease will be primarily determined by indications from available level instrumentation. Other sources of level indications may include reports from plant personnel (e.g., from a refueling crew) or video camera observations (if available). A significant drop in

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 56 of 251 Attachment 1: Emergency Action Level Technical Bases the water level may also cause a loss of SFP Cooling suction flow and an increase in the radiation levels of adjacent areas that can be detected by monitors in those locations.

The SFP low water level alarm (Annunciator VSP-C4) actuates when 1-FC-LIS-104 senses level in Spent Fuel Pit less than or equal to 5 inches below normal. This corresponds to an indication of 19 inches on the level detector local digital readout (ref. 1, 2).

The specified radiation monitors are those expected to see increase area radiation levels as a result of a loss of REFUELING PATHWAY inventory (ref. 3, 4). Increasing radiation indications on these monitors in the absence of indications of decreasing REFUELING PATHWAY level are not classifiable under this EAL.

In addition, the Spent Fuel Pool (SFP) wide-range level indication system is available to monitor water level. Two (2) level instruments are installed in the SFP with indicators, 1-FC-Ll-105-1 & 2 provided in the Cable Spreading Rooms. The level instruments will provide level indication over the entire span of the SFP from the top of the fuel racks to 10 inches above the normal operating level (ref. 5).

The effects of planned evolutions should be considered. For example, a refueling bridge area radiation monitor reading may increase due to planned evolutions such as lifting of the reactor vessel head or movement of a fuel assembly. Note that this EAL is applicable only in cases where the elevated reading is due to an unplanned loss of water level.

A drop in water level above irradiated fuel within the reactor vessel may be classified in accordance Category C during the Cold Shutdown and Refueling modes.

Escalation of the emergency classification level would be via IC RA2.

Reference(s):

1. ( )-OP-FH-001, "Controlling Procedure for Refueling"

2. O-VSP-C4, "Spent Fuel Pit Lo Lvl"

3. O-AP-22.02, "Malfunction of Spent Fuel Pit Systems"

4. UFSAR Table 11.3-7, "Area Radiation Monitoring Locations, Number and Range"

5. Design Change SU-13-01042, "BOB Spent Fuel Pool Level Instrumentation Installation -

Units 1 & 2"

6. NEI 99-01 AU2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 57 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damag!3 to, irradiated fuel EAL:

RA2.1 Alert IMMINENT uncovery of irradiated fuel in the REFUELING PATHWAY Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY- The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the SPS ISFSI, Confinement Boundary is defined as the Sealed Surface Storage Cask (SSSC) or NUHOMS Dry Storage Canister (DSC).

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

REFUELING PATHWAY- Refueling cavity, fuel transfer canal, and spent fuel pit (SFP), but not including the reactor vessel, comprise the refueling pathway.

Basis:

This IC addresses events that have caused IMMINENT or actual damage to an irradiated fuel assembly, or a significant lowering of water level within the REFUELING PATHWAY. These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant.

This EAL applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. Once sealed, damage to a loaded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance with IC EU1.

Escalation of the emergency would be based on either Category R or C EALs.

This EAL escalates from RU2.1 in that the loss of level, in the affected portion of the REFUELING PATHWAY, is of sufficient magnitude to have resulted in uncovery of irradiated fuel. Indications of irradiated fuel uncovery may include direct or indirect visual observation (e.g., reports from personnel or camera images), as well as significant changes in water and radiation levels, or other plant parameters. Computational aids may also be used (e.g., a boil-off curve). Classification of an event using this EAL should be based on the totality of available indications, reports and observations.

While an area radiation monitor could detect an increase in a dose rate due to a lowering of water level in some portion of the REFUELING PATHWAY, the reading may not be a reliable indication of whether or not the fuel is actually uncovered. To the degree possible, readings

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 58 of 251 Attachment 1: Emergency Action Level Technical Bases should be considered in combination with other available indications of inventory loss.

A drop in water level above irradiated fuel within the reactor vessel may be classified in accordance with Category C during the Cold Shutdown and Refueling modes.

Reference(s):

1. NEI 99-01 AA2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 59 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel EAL:

RA2.2 Alert Damage to irradiated fuel resulting in a release of radioactivity AND VALID high alarm on any of the following radiation monitors:

RM-Rl-152 New Fuel Storage Area

RM-Rl-153 Fuel Pit Bridge

RM-RI-( )62 Manipulator Crane

RM-RI-( )63 Reactor Containment

RM-RI-( )60 Containment Gas

RM-RI-( )59 Containment Particulate

VG-Rl-131- (A,B,C) Vent#2 Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY- The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the SPS ISFSI, Confinement Boundary is defined as the Sealed Surface Storage Cask (SSSC) or NUHOMS Dry Storage Canister (DSC).

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

The specified radiation monitors are those expected to see increased area radiation levels as a result of damage to irradiated fuel (ref. 1, 2, 3, 4. 5).

This EAL addresses events that have caused actual damage to an irradiated fuel assembly.

These events present radiological safety challenges to plant personnel and are precursors to a

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 60 of 251 Attachment 1: Emergency Action Level Technical Bases release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant.

This EAL applies to irradiated fuel that is licensed for dry storage up to the point that the loaded storage cask is sealed. Once sealed, damage to a loaded cask causing loss of the CONFINEMENT BOUNDARY is classified in accordance with IC EU1.

This EAL addresses a release of radioactive material caused by mechanical damage to irradiated fuel. Damaging events may include the dropping, bumping or binding of an assembly, or dropping a heavy load onto an assembly. A rise in readings on radiation monitors should be considered in conjunction with in-plant reports or observations of a potential fuel damaging event (e.g., a fuel handling accident).

Escalation of the emergency would be based on either Category R or C ICs. Reference(s):

1. O-VSP-C4, "Spent Fuel Pit Lo Lvl"

2. O-AP-22.02, "Malfunction of Spent Fuel Pit Systems"

3. O-AP-22.00, "Fuel Handling Abnormal Conditions"

4. UFSAR Table 11.3-7, "Area Radiation Monitoring Locations, Number and Range"

5. UFSAR Table 11.3-57, "Process Radiation Monitoring System"

6. NEI 99-01 AA2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 61 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Significant lowering of water level above, or damage to, irradiated fuel EAL:

RA2.3 Alert Lowering of spent fuel pool level to 10 ft. (Level 2) on 1-FC-Ll-105-1, 2 or 1A Spent Fuel Pool Wide Range Level Mode Applicability:

All Definition(s):

None Basis:

This EAL addresses events that have caused a significant lowering of water level within the spent fuel pool. These events present radiological safety challenges to plant personnel and are precursors to a release of radioactivity to the environment. As such, they represent an actual or potential substantial degradation of the level of safety of the plant.

Spent fuel pool water level at this value is within the lower end of the level range necessary to prevent significant dose consequences from direct gamma radiation to personnel performing operations in the vicinity of the spent fuel pool. This condition reflects a significant loss of spent fuel pool water inventory and thus it is also a precursor to a loss of the ability to adequately cool the irradiated fuel assembles stored in the pool.

Escalation of the emergency classification level would be via ICs RS1 or RS2.

Post-Fukushima order EA-12-051 required the installation of reliable SFP level indication (1-FC-Ll-105-1 and 1-FC-Ll-105-2) capable of identifying normal level (Level 1 -EL 45 ft. 4 in.),

SFP level 10 ft. above the top of the fuel racks (Level 2 -EL 31 ft. 4 in.) and SFP level at 1 ft.

above the top of the fuel racks (Level 3 -EL 22 ft. 4 in.) (ref. 1).

Reference(s):

1. ETE-CPR-2012-0011, "Surry Units 1 & 2 - Beyond Design Basis FLEX Strategy Basis Documentation and Final Integrated Plan"

2. DC SU-13-01042, "BOB Spent Fuel Pool Level Instrumentation Installation - Surry Units 1

& 2"

3. NEI 99-01 AA2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 62 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Spent fuel pool level at the top of the fuel racks EAL:

RS2.1 Site Area Emergency Lowering of spent fuel pool level to 1 ft. (Level 3) on 1-FC-Ll-105-1, 2 or 1A Spent Fuel Pool Wide Range Level Mode Applicability:

All Definition(s):

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Basis:

This EAL addresses a significant loss of spent fuel pool inventory control and makeup capability leading to IMMINENT fuel damage. This condition entails major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration.

It is recognized that this IC would likely not be met until well after another Site Area Emergency IC was met; however, it is included to provide classification diversity.

Escalation of the emergency classification level would be via IC RG1 or RG2.

Post-Fukushima order EA-12-051 required the installation of reliable SFP level indication (1-FC-Ll-105-1 and 1-FC-Ll-105-2) capable of identifying normal level (Level 1 -EL 45 ft. 4 in.),

SFP level 10 ft. above the top of the fuel racks (Level 2 -EL 31 ft. 4 in.) and SFP level at 1 ft.

above the top of the fuel racks (Level 3 -EL 22 ft. 4 in.) (ref. 1).

Reference(s):

1. ETE-CPR-2012-0011, "Surry Units 1 & 2 - Beyond Design Basis FLEX Strategy Basis Documentation and Final Integrated Plan"

2. DC SU-13-01042, "BOB Spent Fuel Pool Level Instrumentation Installation - Surry Units 1

& 2"

3. NEI 99-01 AS2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 63 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 2 - Irradiated Fuel Event Initiating Condition: Spent fuel pool level cannot be restored to at least the top of the fuel racks for 60 minutes or longer EAL:

RG2.1 General Emergency Spent fuel pool level cannot be restored to at least 1 ft. (Level 3) on 1-FC-Ll-105-1, 2 or 1A Spent Fuel Pool Wide Range Level for~ 60 min.

(Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

All Definition(s):

None Basis:

This EAL addresses a significant loss of spent fuel pool inventory control and makeup capability leading to a prolonged uncovery of spent fuel. This condition will lead to fuel damage and a radiological release to the environment.

It is recognized that this EAL would likely not be met until well after another General Emergency EAL was met; however, it is included to provide classification diversity.

Post-Fukushima order EA-12-051 required the installation of reliable SFP level indication (1-FC-Ll-105-1 and 1-FC-Ll-105-2) capable of identifying normal level (Level 1 -EL 45 ft. 4 in.),

SFP level 10 ft. above the top of the fuel racks (Level 2 -EL 31 ft. 4 in.) and SFP level at 1 ft.

above the top of the fuel racks (Level 3 -EL 22 ft. 4 in.) (ref. 1).

Reference(s ):

1. ETE-CPR-2012-0011, "Surry Units 1 & 2 - Beyond Design Basis FLEX Strategy Basis Documentation and Final Integrated Plan"

2. DC SU-13-01042, "BOB Spent Fuel Pool Level Instrumentation Installation - Surry Units 1

& 2"

3. NEI 99-01 AG2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 64 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 3 -Area Radiation Levels Initiating Condition: Radiation levels that IMPEDE access to equipment necessary for normal plant operations, cooldown or shutdown EAL:

RA3.1 Alert Dose rate > 15 mR/hr in EITHER of the following areas:

Control Room

Central Alarm Station (by survey)

Mode Applicability:

All Definition(s):

IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

Basis:

This IC addresses elevated radiation levels in certain plant rooms/areas sufficient to preclude or impede personnel from performing actions necessary to maintain normal plant operation, or to perform a normal plant cooldown and shutdown. As such, it represents an actual or potential substantial degradation of the level of safety of the plant. The SEM should consider the cause of the increased radiation levels and determine if another IC may be applicable.

Areas that meet this threshold include the Control Room (CR) and the Central Alarm Station (GAS). The Control Room is monitored for excessive radiation by one detector, RM-Rl-157 (ref. 1). The GAS is included in this EAL because of its importance to permitting access to areas required to assure safe plant operations. There are no permanently installed area radiation monitors in GAS that may be used to assess this EAL threshold. Therefore, this threshold is evaluated using local radiation survey for this area.

Reference(s ):

1. O-RM-H3, "RM-Rl-157 High"

2. NEI 99-01 AA3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 65 of 251 Attachment 1: Emergency Action Level Technical Bases Category: R - Abnormal Rad Levels / Rad Effluent Subcategory: 3 -Area Radiation Levels Initiating Condition: Radiation levels that IMPEDE access to equipment necessary for normal plant operations, cooldown or shutdown EAL:

RA3.2 Alert An UNPLANNED event results in radiation levels that prohibit or IMPEDE access to any Table R-2 room or area (Note 5)

Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted.

Table R-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode Auxiliary Building El 13' 3 Auxiliary Building El 27' 3,4 ESGR 3 Mode Applicability:

3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s ):

IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

This IC addresses elevated radiation levels in certain plant rooms/areas sufficient to preclude or impede personnel from performing actions necessary to maintain normal plant operation, or to perform a normal plant cooldown and shutdown. As such, it represents an actual or potential substantial degradation of the level of safety of the plant. The SEM should consider the cause of the increased radiation levels and determine if another IC may be applicable.

For RA3.2, an Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the elevated radiation levels. The emergency classification is not contingent upon whether entry is actually necessary at the time of the increased radiation levels. Access should be considered as impeded if extraordinary measures are necessary to facilitate entry of personnel into the

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 66 of 251 Attachment 1: Emergency Action Level Technical Bases affected room/area (e.g., installing temporary shielding, requiring use of non-routine protective equipment, requesting an extension in dose limits beyond normal administrative limits).

If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event.

The list of plant rooms or areas with entry-related mode applicability identified specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, cooldown and shutdown. Rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations) are not included. In addition, the list specifies the plant mode(s) during which entry would be required for each room or area (ref. 1).

An emergency declaration is not warranted if any of the following conditions apply:

The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the elevated radiation levels). For example, the plant is in Mode 1 when the radiation increase occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4.

The increased radiation levels are a result of a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., radiography, spent filter or resin transfer, etc.).

The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

The access control measures are of a conservative or precautionary nature, and would not actually prevent or impede a required action.

Reference(s):

1. Attachment 2, "Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases"

2. NEI 99-01 AA3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 67 of 251 Attachment 1: Emergency Action Level Technical Bases Category C - Cold Shutdown I Refueling System Malfunction EAL Group: Cold Conditions (RCS temperature :s; 200°F); EALs in this category are applicable only in one or more cold operating modes.

Category C EALs are directly associated with cold shutdown or refueling system safety functions. Given the variability of plant configurations (e.g., systems out-of-service for maintenance, containment open, reduced AC power redundancy, time since shutdown) during these periods, the consequences of any given initiating event can vary greatly. For example, a loss of decay heat removal capability that occurs at the end of an extended outage has less significance than a similar loss occurring during the first week after shutdown. Compounding these events is the likelihood that instrumentation necessary for assessment may also be inoperable. The cold shutdown and refueling system malfunction EALs are based on performance capability to the extent possible with consideration given to RCS integrity, CONTAINMENT CLOSURE, and fuel clad integrity for the applicable operating modes (5 -

Cold Shutdown, 6 - Refueling, DEF - Defueled).

The events of this category pertain to the following subcategories:

1. RCS Level RCS water level is directly related to the status of adequate core cooling and, therefore, fuel clad integrity.

2. Loss of Emergency AC Power Loss of vital plant electrical power can compromise plant safety system operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of onsite and offsite power sources for 4160V AC emergency buses.

3. RCS Temperature Uncontrolled or inadvertent temperature or pressure increases are indicative of a potential loss of safety functions.

4. Loss of Vital DC Power Loss of emergency plant electrical power can compromise plant safety system operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of power to or degraded voltage on the 125V DC vital buses.

5. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 68 of 251 Attachment 1: Emergency Action Level Technical Bases

6. Hazardous Event Affecting Safety Systems C~rtain hazardous natural and technological events may result in VISIBLE DAMAGE to or degraded performance of safety systems warranting classification.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 69 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: UNPLANNED loss of RCS inventory EAL:

CU1.1 NOUE UNPLANNED loss of reactor coolant results in RCS water level less than a required lower limit for ~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

RCS water level less than a required lower limit is meant to be less than the lower end of the level control band being procedurally maintained for the current condition or evolution.

With the plant in Cold Shutdown, RCS water level is normally maintained within a pressurizer level control band (ref. 1). However, if RCS level is being controlled below the normal pressurizer level control band, or if level is being maintained in a designated band in the reactor vessel it is the inability to maintain level above the low end of the designated control band due to a loss of inventory resulting from a leak in the RCS that is the concern.

With the plant in Refueling mode, RCS water level is normally maintained at or above the reactor vessel flange (ref. 2).

This IC addresses the inability to restore and maintain water level to a required minimum level (or the lower limit of a level band), or a loss of the ability to monitor RCS level concurrent with indications of coolant leakage. Either of these conditions is considered to be a potential degradation of the level of safety of the plant.

Refueling evolutions that decrease RCS water inventory are carefully planned and controlled.

An UNPLANNED event that results in water level decreasing below a procedurally required limit warrants the declaration of an NOUE due to the reduced water inventory that is available to keep the core covered.

This EAL recognizes that the minimum required RCS level can change several times during the course of a refueling outage as different plant configurations and system lineups are implemented. This EAL is met if the minimum level, specified for the current plant conditions,

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 70 of 251 Attachment 1: Emergency Action Level Technical Bases cannot be maintained for 15 minutes or longer. The minimum level is typically specified in the applicable operating procedure but may be specified in another controlling document.

The 15-minute threshold duration allows sufficient time for prompt operator actions to restore and maintain the expected water level. This criterion excludes transient conditions causing a brief lowering of water level.

Continued loss of RCS inventory may result in escalation to the Alert emergency classification level via either IC CA 1 or CA3.

Reference(s):

1. OU-SU-201, "Shutdown Safety Assessment Checklist"

2. ( )-OP-RC-004, "Draining the RCS to Reactor Flange Level"

3. NEI 99-01 CU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 71 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown/ Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: UNPLANNED loss of RCS inventory EAL:

CU1.2 NOUE RCS water level cannot be monitored AND EITHER:

UNPLANNED increase in any Table C-1 sump or tank level due to a loss of RCS inventory

Visual observation of UNISOLABLE RCS leakage Table C-1 Sumps/Tanks

Reactor Containment Sump

Pressurizer Relief Tank (PRT)

Primary Drain Transfer Tank (POTT)

Component Cooling (CC) Surge Tank

Refueling Water Storage Tank (RWST)

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s ):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

UNPLANNED-. A parameter changes or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

This IC addresses the inability to restore and maintain water level to a required minimum level (or the lower limit of a level band), or a loss of the ability to monitor RCS level concurrent with indications of coolant leakage. Either of these conditions is considered to be a potential degradation of the level of safety of the plant.

Refueling evolutions that decrease RCS water inventory are carefully planned and controlled.

An UNPLANNED event that results in water level decreasing below a procedurally required limit warrants the declaration of an NOUE due to the reduced water inventory that is available to keep the core covered.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 72 of 251 Attachment 1: Emergency Action Level Technical Bases This EAL addresses a condition where all means to determine RCS level have been lost. In this condition, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels (Table C-1) (ref. 1, 2). Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS.

In Cold Shutdown mode, the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the Refueling mode, the RCS is not intact and Reactor Vessel level and inventory are monitored by different means. In the Refueling mode, normal means of RCS level indication may not be available. Redundant means of Reactor Vessel level indication will normally be installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted.

Continued loss of RCS inventory may result in escalation to the Alert emergency classification level via either IC CA1 or CA3.

Reference(s):

1. ( )-AP-16.00, "Excessive RCS Leakage"

2. ( )-AP-27.00, "Loss of Decay Heat Removal Capability"

3. NEI 99-01 CU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 73 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Significant Loss of RCS inventory EAL:

CA1.1 Alert RCS level < minimum required for continued RHR pump operation Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

None Basis:

This IC addresses conditions that are precursors to a loss of the ability to adequately cool irradiated fuel (i.e., a precursor to a challenge to the fuel clad barrier). This condition represents a potential substantial reduction in the level of plant safety.

For this EAL, a lowering of RCS water level below the specified value(s) indicates that operator actions have not been successful in restoring and maintaining RCS water level. The heat-up rate of the coolant will increase as the available water inventory is reduced. A continuing decrease in water level will lead to core uncovery. The classification threshold is based on the lowest RCS level that supports continued decay heat removal pump (RHR) operations per procedure (ref. 1, 2).

Although related, this EAL is concerned with the loss of RCS inventory and not the potential concurrent effects on systems needed for decay heat removal (e.g., loss of a Residual Heat Removal suction point). An increase in RCS temperature caused by a loss of decay heat removal capability is evaluate.d under IC CA3.

If RCS water level continues to lower, then escalation to Site Area Emergency would be via IC CS1.

Reference(s):

1. ( )-AP-27 .00, "Loss of Decay Heat Removal Capability"

2. UFSAR Section 7.11, "Level Instrumentation to Prevent Loss of Shutdown Cooling"

3. NEI 99-01 CA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 74 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Significant Loss of RCS inventory EAL:

CA1.2 Alert RCS water level cannot be monitored for~ 15 min. (Note 1)

AND EITHER

UNPLANNED increase in any Table C-1 sump or tank level due to a loss of RCS inventory

Visual observation of UNISOLABLE RCS leakage Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table C-1 Sumps/Tanks

Reactor Containment Sump

Pressurizer Relief Tank (PRT)

Primary Drain Transfer Tank (POTT)

Component Cooling (CC) Surge Tank

Refueling Water Storage Tank (RWST)

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s ):

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally.

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

This IC addresses conditions that are precursors to a loss of the ability to adequately cool irradiated fuel (i.e., a precursor to a challenge to the fuel clad barrier). This condition represents a potential substantial reduction in the level of plant safety.

For this EAL, the inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 75 of 251 Attachment 1: Emergency Action Level Technical Bases observing changes in sump and/or tank levels. Sump and/or tank level (Table C-1) changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS (ref 1, 2).

In Cold Shutdown mode, the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the Refueling mode, the RCS is not intact and Reactor Vessel level and inventory are monitored by different means. In the Refueling mode, normal means of RCS level indication may not be available. Redundant means of Reactor Vessel level indication will normally be installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted.

The 15-minute duration for the loss of level indication was chosen because it is half of the EAL duration specified in IC CS1.

If the RCS inventory level continues to lower, then escalation to Site Area Emergency would be via IC CS1.

Reference(s ):

1. ( )-AP-16.00, "Excessive RCS Leakage"

2. ( )-AP-27.00, "Loss of Decay Heat Removal Capability"

3. NEI 99-01 CA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 76 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability EAL:

CS1 .1 Site Area Emergency With CONTAINMENT CLOSURE not established, any confirmed loss of inventory indication, Table C-2, with RVLIS full range < 63%

Table C-2 Inventory Loss Confirmatory Indications

In service Standpipe and Ultrasonic level bottomed out

Decreasing RVLIS level trend

RHR pump amp fluctuations Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Basis:

This IC addresses a significant and prolonged loss of RCS inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant.

These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration.

Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in RCS level. If RCS level cannot be restored, fuel damage is probable.

Outage/shutdown contingency plans typically provide for re-establishing or verifying CONTAINMENT CLOSURE following a loss of heat removal or RCS inventory control functions. The difference in the specified RCS/reactor vessel levels of EALs CS1 .1 and CS1 .2 reflect the fact that with CONTAINMENT CLOSURE established, there is a lower probability of a fission product release to the environment (ref. 1).

This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 77 of 251 Attachment 1: Emergency Action Level Technical Bases and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

Six inches below the elevation of the bottom of the RCS hot leg penetration can be monitored only by RVLIS full range (62.3%). Other level monitoring instruments are offscale low when level is below the elevation of the RCS loop hot leg penetration.

Table C-2 provides a list of confirmatory indicators for RCS inventory loss. Due to the variability of accuracy and usability of RVLIS while in Cold Shutdown or Refueling Mode, the use of RVLIS for emergency classification purposes is contingent on one or more of the listed confirmatory indications.

The RVLIS full range threshold has been determined as follows (ref. 2, 3, 4):

Component Dimensions RVLIS Full Range (%) .

Height of vessel* (ft) 38.794 100.0 Bottom of vessel (ft) 0 0.0 RCS hot leg centerline above vessel bottom (ft) 25.885 NA RCS hot leg penetration diameter

,._ \

28.769 NA Bottom of RCS hot leg (ft) 24.686 A 6 in. below bottom of hot leg (ft) 24.186 B Top offuel above vessel bottom (ft) 21.830 C RVLIS span %/ft = 2.57771 A = 0.0% + (Bottom of RCS hot leg - Bottom of vessel) x RVLIS span 63.6%

B = 0.0% + (6 in. below bottom of hot leg - Bottom of vessel) x RVLIS span 62.3%

C = 0.0% + (Top of fuel - Bottom of vessel) x RVLIS span 56.3%

Height of Unit 1 vessel head is 72.47 in., Unit 2 is 80.12 in. Unit 2 dimensions are more limiting and used for these thresholds.

EAL RVLIS values have been rounded up to the nearest whole percentage point.

Escalation of the emergency classification level would be via ICs CG1 or RG1.

Reference(s):

1. OU-AA-200, "Shutdown Risk Management"

2. ( )-OP-RC-004, "Draining the RCS to Reactor Flange Level"

3. UFSAR Figure 4.2-2

4. UFSAR Figure 4.2-3

5. NEI 99-01 CS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 78 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability EAL:

CS1 .2 Site Area Emergency With CONTAINMENT CLOSURE established, any confirmed loss of inventory indication, Table C-2, with RVLIS full range < 57%

Table C-2 Inventory Loss Confirmatory Indications

In service Standpipe and Ultrasonic level bottomed out

Decreasing RVLIS level trend

RHR pump amp fluctuations Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Basis:

This IC addresses a significant and prolonged loss of RCS inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant.

These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration.

Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in RCS level. If RCS level cannot be restored, fuel damage is probable.

Outage/shutdown contingency plans typically provide for re-establishing or verifying CONTAINMENT CLOSURE following a loss of heat removal or RCS inventory control functions. The difference in the specified RCS/reactor vessel levels of EALs CS1 .1 and CS1 .2 reflect the fact that with CONTAINMENT CLOSURE established, there is a lower probability of a fission product release to the environment (ref. 1).

This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 79 of 251 Attachment 1: Emergency Action Level Technical Bases and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

This level drop can only be remotely monitored by Reactor Vessel Level Instrumentation System (RVLIS). When Reactor Vessel water level drops below RVLIS full range setpoint of 56.3% (ref. 2), core uncovery is about to occur.

Table C-2 provides a list of confirmatory indicators for RCS inventory loss. Due to the variability of accuracy and usability of RVLIS while in Cold Shutdown or Refueling Mode, the use of RVLIS for emergency classification purposes is contingent on one or more of the listed confirmatory indications.

The RVLIS full range threshold has been determined as follows (ref. 2, 3, 4):

Component Dimensions RVLIS Full Range(%)

Height of vessel* (ft) 38.794 100.0 Bottom of vessel (ft) 0 0.0 RCS hot leg centerline above vessel bottom (ft) 25.885 NA RCS hot leg penetration diameter 28.769 NA Bottom of RCS hot leg (ft) 24.686 A 6 in. below bottom of hot leg (ft) 24.186 B Top offuel above vessel bottom (ft) 21.830 C RVLIS span %/ft = 2.57771 A = 0.0% + (Bottom of RCS hot leg - Bottom of vessel) x RVLIS span 63.6%

B = 0.0% + (6 in. below bottom of hot leg - Bottom of vessel) x RVLIS span 62.3%

C = 0.0% + (Top of fuel - Bottom of vessel) x RVLIS span 56.3%

Height of Unit 1 vessel head is 72.47 in., Unit 2 is 80.12 in. Unit 2 dimensions are more limiting and used for these thresholds.

EAL RVLIS values have been rounded up to the nearest whole percentage point.

Escalation of the emergency classification level would be via ICs CG1 or RG1.

Reference(s):

1. OU-AA-200, "Shutdown Risk Management"

2. ( )-OP-RC-004, "Draining the RCS to Reactor Flange Level"

3. UFSAR Figure 4.2-2

4. UFSAR Figure 4.2-3

5. NEI 99-01 CS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 80 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting core decay heat removal capability EAL:

CS1 .3 Site Area Emergency RCS level cannot be monitored for~ 30 min. (Note 1)

AND Core uncovery is indicated by any of the following:

UNPLANNED increase in any Table C-1 sump or tank level of sufficient magnitude to indicate core uncovery

Visual observation of UNISOLABLE RCS leakage of sufficient magnitude to indicate core uncovery

Any containment area radiation monitor reading> 3 R/hr (Refueling Mode)

Erratic source range monitor indications Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table C-1 Sumps/Tanks

Reactor Containment Sump

Pressurizer Relief Tank (PRT)

Primary Drain Transfer Tank (POTT)

Component Cooling (CC) Surge Tank

Refueling Water Storage Tank (RWST)

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 81 of 251 Attachment 1: Emergency Action Level Technical Bases Basis:

This IC addresses a significant and prolonged loss of RCS inventory control and makeup capability leading to IMMINENT fuel damage. The lost inventory may be due to a RCS component failure, a loss of configuration control or prolonged boiling of reactor coolant.

These conditions entail major failures of plant functions needed for protection of the public and thus warrant a Site Area Emergency declaration.

Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable.

In this EAL, the 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring.

The inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels (Table C-1). Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS (ref. 1, 2).

In Cold Shutdown mode, the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the Refueling mode, the RCS is not intact and Reactor Vessel level and inventory are monitored by different means. In the Refueling mode, normal means of RCS level indication may not be available. Redundant means of Reactor Vessel level indication will normally be installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted.

If the make-up rate to the RCS unexplainably rises above the pre-established rate, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. Visual observation of leakage from systems connected to the RCS that cannot be isolated could also be indicative of a loss of RCS inventory.

Dose rates above the core will rise as water level in the reactor vessel lowers in the Refueling mode. The dose rate due to this core shine should result in on-scale indications of> 3 R/hr on containment area radiation monitors (ref. 3).

Post-TMI accident studies indicated that the installed PWR nuclear instrumentation will operate erratically when the core is uncovered and that this should be used as a tool for making such determinations.

This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 82 of 251 Attachment 1: Emergency Action Level Technical Bases Escalation of the emergency classification level would be via ICs CG1 or RG1 Reference(s):

1. ( )-AP-16.00, "Excessive RCS Leakage"

2. ( )-AP-27 .00, "Loss of Decay Heat Removal Capability"

3. RA-0078, "Verification of Radiation Monitor Response to Core Uncovery"

4. NEI 99-01 CS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 83 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting fuel clad integrity with containment challenged EAL:

CG1 .1 General Emergency Any confirmed loss of inventory indication, Table C-2, with RVLIS full range < 57% for 2: 30 min. (Note 1)

AND Any Containment Challenge indication, Table C-3 Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 6: If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, declaration of a General Emergency is not required.

11 ,u

.... !:Ible C-2 Inventory Loss Confirmatory Indications

In service Standpipe and Ultrasonic level bottomed out

Decreasing RVLIS level trend

RHR pump amp fluctuations Table C-3 Containment Challenge Indications

CONTAINMENT CLOSURE not established (Note 6)

CTMT hydrogen concentration 2: 4%

UNPLANNED increase in CTMT pressure Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 84 of 251 Attachment 1: Emergency Action Level Technical Bases UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

This IC_addresses the inability to restore and maintain RCS level above the top of active fuel with containment challenged. This condition represents actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area.

Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable.

Three conditions are associated with a challenge to containment's capability to serve as an effective barrier to fission product release (Table C-3):

1. With CONTAINMENT CLOSURE not established, there is a high potential for a direct and unmonitored release of radioactivity to the environment (ref. 1). If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required.

2. The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit of 4%). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a challenge to containment integrity.

In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive gas mixture in containment. However, containment monitoring and/or sampling should be performed to verify this assumption and a General Emergency declared if it is determined that hydrogen concentration has exceeded the minimum necessary to support a hydrogen burn (4%) (ref. 2). If all installed hydrogen gas monitors are out-of-service during an event leading to fuel cladding damage, it may not be possible to obtain a containment hydrogen gas concentration reading as ambient conditions within the containment will preclude personnel access. During periods when installed containment hydrogen gas monitors are out-of-service, operators may use the other listed indications to assess whether or not containment is challenged.

3. Any UNPLANNED rise in containment pressure in the Cold Shutdown or Refueling mode indicates a potential challenge of CONTAINMENT CLOSURE capability. This is due to the potential use of temporary penetration seals, water seals or other closure mechanisms used to support maintenance that are not suitable to withstand a rise in containment pressure. UNPLANNED containment pressure rise indicates CONTAINMENT CLOSURE cannot be assured and the containment cannot be relied upon as a barrier to fission product release.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5

,,. _Page 85 of 251 Attachment 1: Emergency Action Level Technical Bases This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

This level drop can only be remotely monitored by Reactor Vessel Level Instrumentation System (RVLIS). When Reactor Vessel water level drops below RVLIS full range setpoint of 56.3%, core uncovery is about to occur.

Table C-2 provides a list of confirmatory indicators for RCS inventory loss. Due to the variability of accuracy and usability of RVUS while in Cold Shutdown or Refueling Mode, the use of RVLIS for emergency classification purposes is contingent on one or more of the listed confirmatory indications.

The RVLIS full range threshold has been determined as follows (ref. 3, 4, 5):

Component Dimensions RVLIS Full Range (%)

Height of vessel* (ft) 38.794 100.0 Bottom of vessel (ft) 0 0.0 RCS hot leg centerline above vessel bottom (ft) 25.885 NA RCS hot leg penetration diameter 28.769 NA

'~-- \

Bottom of RCS hot leg (ft) 24.686 A 6 in. below bottom of hot leg (ft) 24.186 B Top offuel above vessel bottom (ft) 21.830 C RVLIS span %/ft = 2.57771 A = 0.0% + (Bottom of RCS hot leg - Bottom of vessel) x RVLIS span 63.6%

B = 0.0% + (6 in. below bottom of hot leg - Bottom of vessel) x RVLIS span 62.3%

C = 0.0% + (Top of fuel - Bottom of vessel) x RVLIS span 56.3%

Height of Unit 1 vessel head is 72.47 in., Unit 2 is 80.12 in. Unit 2 dimensions are more limiting and used for these thresholds.

EAL RVLIS values have been rounded up to the nearest whole percentage point.

Reference(s):

1. OU-AA-200, "Shutdown Risk Management"

2. ( )-FR-C.1, "Response to Inadequate Core Cooling"

3. ( )-OP-RC-004, "Draining the RCS to Reactor Flange Level"

4. UFSAR Figure 4.2-2

5. UFSAR Figure 4.2-3

6. NEI 99-01 CG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 86 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 1 - RCS Level Initiating Condition: Loss of RCS inventory affecting fuel clad integrity with containment challenged EAL:

CG1 .2 General Emergency RCS level cannot be monitored for~ 30 min. (Note 1)

AND Core uncovery is indicated by any of the following:

UNPLANNED increase in any Table C-1 sump or tank level of sufficient magnitude to indicate core uncovery

Visual observation of UNISOLABLE RCS leakage of sufficient magnitude to indicate core uncovery

Any containment area radiation monitor reading> 3 R/hr (Refueling Mode)

Erratic source range monitor indications AND Any Containment Challenge indication, Table C-3 Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 6: If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, declaration of a General Emergency is not required.

Table C-1 Sumps/Tanks

Reactor Containment Sump

Pressurizer Relief Tank (PRT)

Primary Drain Transfer Tank (POTT)

Component Cooling (CC) Surge Tank

Refueling Water Storage Tank (RWST)

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 87 of 251 Attachment 1: Emergency Action Level Technical Bases Table C-3 Containment Challenge Indications

CONTAINMENT CLOSURE not established (Note 6)

CTMT hydrogen concentration;:: 4%

UNPLANNED increase in CTMT pressure Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s ):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

This IC addresses the inability to restore and maintain RCS level above the top of active fuel with containment challenged. This condition represents actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity. Releases can be reasonably expected to exceed EPA PAG exposure levels offsite for more than the immediate site area.

Following an extended loss of core decay heat removal and inventory makeup, decay heat will cause reactor coolant boiling and a further reduction in reactor vessel level. If RCS level cannot be restored, fuel damage is probable.

The inability to monitor RCS level may be caused by instrumentation and/or power failures, or water level dropping below the range of available instrumentation. If water level cannot be monitored, operators may determine that an inventory loss is occurring by observing changes in sump and/or tank levels (Table C-1). Sump and/or tank level changes must be evaluated against other potential sources of water flow to ensure they are indicative of leakage from the RCS (ref. 2, 3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 88 of 251 Attachment 1: Emergency Action Level Technical Bases In Cold Shutdown mode, the RCS will normally be intact and standard RCS inventory and level monitoring means are available. In the Refueling mode, the RCS is not intact and Reactor Vessel level and inventory are monitored by different means. In the Refueling mode, normal means of RCS level indication may not be available. Redundant means of Reactor Vessel level indication will normally be installed (including the ability to monitor level visually) to assure that the ability to monitor level will not be interrupted.

If the make-up rate to the RCS unexplainably rises above the pre-established rate, a loss of RCS inventory may be occurring even if the source of the leakage cannot be immediately identified. Visual observation of leakage from systems connected to the RCS that cannot be isolated could also be indicative of a loss of RCS inventory.

In the Refueling mode, as water level in the reactor vessel lowers, the dose rate above the core will rise. The dose rate due to this core shine should result in on-scale indications of> 3 R/hr on containment area radiation monitors (ref. 4).

Post-TMI accident studies indicated that the installed PWR nuclear instrumentation will operate erratically when the core is uncovered and that this should be used as a tool for making such determinations.

The 30-minute criterion is tied to a readily recognizable event start time (i.e., the total loss of ability to monitor level), and allows sufficient time to monitor, assess and correlate reactor and plant conditions to determine if core uncovery has actually occurred (i.e., to account for various accident progression and instrumentation uncertainties). It also allows sufficient time for performance of actions to terminate leakage, recover inventory control/makeup equipment and/or restore level monitoring.

Three conditions are associated with a challenge to containment's capability to serve as an effective barrier to fission product release:

1. With CONTAINMENT CLOSURE not established, there is a high potential for a direct and unmonitored release of radioactivity to the environment (ref. 1). If CONTAINMENT CLOSURE is re-established prior to exceeding the 30-minute time limit, then declaration of a General Emergency is not required.

2. The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit of 4%). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a challenge to containment integrity.

In the early stages of a core uncovery event, it is unlikely that hydrogen buildup due to a core uncovery could result in an explosive gas mixture in containment. However, containment monitoring and/or sampling should be performed to verify this assumption and a General Emergency declared if it is determined that hydrogen concentration has exceeded the minimum necessary to support a hydrogen burn (4%) (ref. 5). If all installed hydrogen gas monitors are out-of-service during an event leading to fuel cladding damage, it may not be possible to obtain a containment hydrogen gas concentration reading as ambient conditions within the containment will preclude

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 89 of 251 Attachment 1: Emergency Action Level Technical Bases personnel access. During periods when installed containment hydrogen gas monitors are out-of-service, operators may use the other listed indications to assess whether or not containment is challenged.

3. Any UNPLANNED rise in containment pressure in the Cold Shutdown or Refueling mode indicates a potential challenge of CONTAINMENT CLOSURE capability.

UNPLANNED containment pressure rise indicates CONTAINMENT CLOSURE cannot be assured and the containment cannot be relied upon as a barrier to fission product release.

This EAL addresses concerns raised by Generic Letter 88-17, Loss of Decay Heat Removal; SECY 91-283, Evaluation of Shutdown and Low Power Risk Issues; NUREG-1449, Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States; and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

Reference(s):

1. OU-AA-20,0 "Shutdown Risk Management"

2. ( )-AP-16.00, "Excessive RCS Leakage"

3. ( )-AP-27.00, "Loss of Decay Heat Removal Capability"

4. RA-0078, "Verification of Radiation Monitor Response to Core Uncovery"

5. ( )-FR-C.1, "Response to Inadequate Core Cooling"

6. NEI 99-01 CG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 90 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 2 - Loss of Emergency AC Power Initiating Condition: . Loss of all but one AC power source to emergency buses for 15 minutes or longer EAL:

CU2.1 NOUE AC power capability, Table C-4, to Unit () 4160V emergency buses Hand J reduced to a single power source for 2: 15 min. (Note 1)

AND Any additional single power source failure will result in loss of all AC power to SAFETY SYSTEMS Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table C-4 AC Power Sources Offsite:

Unit 1

Reserve Station Service Transformer A

Reserve Station Service Transformer C

Station Service Buses back-fed via Main Transformer (if already aligned)

Unit 2

Reserve Station Service Transformer B

Reserve Station Service Transformer C

Station Service Buses back-fed via Main Transformer (if already aligned)

Onsite:

EOG 1

EOG 2

EOG 3

AAC (SBO) Diesel Generator Mode Applicability:

5 - Cold Shutdown, 6 - Refueling, DEF - Defueled

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 91 of 251 Attachment 1: Emergency Action Level Technical Bases Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

Table C-4 provides a list of offsite and onsite AC electrical power sources credited for this EAL.

The AC power sources annotated "(if already aligned)" require more than 15 minutes to establish and therefore are only credited if the source was already aligned at the time of AC power loss.

Unit () 4160V emergency buses H and J are the emergency buses (ref. 1).

This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equipment.

When in the cold shutdown, refueling, or defueled mode, this condition is not classified as an Alert because of the increased time available to restore another power source to service.

Additional time is available due to the reduced core decay heat load, and the lower temperatures and pressures in various plant systems. Thus, when in these modes, this condition is considered to be a potential degradation of the level of safety of the plant.

An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.

A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).

A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being back-fed from the unit main transformer.

A loss of emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being fed from an offsite power source.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.

The subsequent loss of the remaining single power source would escalate the event to an Alert in accordance with IC CA2.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 92 of 251 Attachment 1: Emergency Action Level Technical Bases Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.) However, since it takes longer than 15 minutes to align the station service bus backfeed, the backfeed must be "already aligned" to credit it as an AC power source.

The normal or preferred source of power to the Unit ( ) 4160V emergency buses H and J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EDG 1, EDG 2 and EDG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1, 2).

The Unit () 4160V emergency buses are powered from transfer buses as follows:

Transfer bus D provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1 Hand Unit 2 emergency bus 2J.

4160V emergency bus 1H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EDG 1 (EDG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus D (F)

AAC diesel (1 J only) via transfer bus D

EDG 3

4160V emergency bus 1H (2H) via the crosstie breaker The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1 J and 2H) via the D and E transfer buses during a station blackout. The AAC diesel generator automatically starts following the

loss of either transfer bus D or E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power. This cold condition EAL is equivalent to the hot condition EAL MA1.1.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 93 of 251 Attachment 1: Emergency Action Level Technical Bases Reference(s):

1. UFSAR Figure 8.3-1

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator - Emergency Operations"

4. NEI 99-01 CU2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 94 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 2 - Loss of Emergency AC Power Initiating Condition: Loss of all offsite and all onsite AC power to emergency buses for 15 minutes or longer EAL:

CA2.1 Alert Loss of all offsite and all onsite AC power to Unit () 4160V emergency buses Hand J for

~ 15 min. (Notes 1, 15)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 15: For this EAL credit can be taken for any AC power source that has sufficient capability to operate equipment necessary to maintain a safe shutdown condition provided it can be aligned within the 15 minute classification criteria.

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling, DEF - Defueled Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

For this EAL credit can be taken for any AC power source that has sufficient capability to operate equipment necessary to maintain a safe shutdown condition, such as FLEX generators, provided it can be aligned within the 15 minute classification criteria.

Unit () 4160V emergency buses H and J are the emergency buses (ref. 1).

This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink.

When in the cold shutdown, refueling, or defueled mode, this condition is not classified as a Site Area Emergency because of the increased time available to restore an emergency bus to service. Additional time is available due to the reduced core decay heat load, and the lower

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 95 of 251 Attachment 1: Emergency Action Level Technical Bases temperatures and pressures in various plant systems. Thus, when in these modes, this condition represents an actual or potential substantial degradation of the level of safety of the plant.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Escalation of the emergency classification level would be via ICs CS1 or RS1.

Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off the line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.)

The normal or preferred source of power to the Unit ( ) 4160V emergency buses H and J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EOG 1, EOG 2 and EOG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1, 2).

The Unit ( ) 4160V emergency buses are powered from transfer buses as follows:

Transfer bus O provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1H and Unit 2 emergency bus 2J.

4160V emergency bus 1H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EOG 1 (EOG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus O (F)

AAC diesel (1 J only) via transfer bus 0

EOG 3

4160V emergency bus 1 H (2H) via the crosstie breaker

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 96 of 251 Attachment 1: Emergency Action Level Technical Bases The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1 J and 2H) via the D and E transfer buses during a station blackout. See Figure C-3. The AAC diesel generator automatically starts following the loss of either transfer bus D or E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power.

This cold condition EAL is equivalent to the hot condition EAL MS1 .1.

Reference(s ):

1. UFSAR Figure 8.3-1

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator- Emergency Operations"

4. NEI 99-01 CU2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 97 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: UNPLANNED increase in RCS temperature EAL:

CU3.1 NOLIE UNPLANNED increase in RCS temperature to> 200°F Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s ):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

In the absence of reliable RCS temperature indication caused by the loss of decay heat removal capability, classification should be based on time of boil data when in Mode 6 or the RCS is not intact in Mode 5 (ref. 1). If the RCS is intact, classification should be based on the RCS pressure increase criteria of CA3.1. Guidance for calculating RCS time to 200°F is provided on the Shutdown Safety Assessment Checklist Attachment 7 (ref. 2).

This EAL addresses an UNPLANNED increase in RCS temperature above the Technical Specification cold shutdown temperature limit and represents a potential degradation of the level of safety of the plant (ref. 1). If the RCS is not intact and CONTAINMENT CLOSURE is not established during this event, the SEM should also refer to EAL CA3.1.

A momentary UNPLANNED excursion above the Technical Specification cold shutdown temperature limit when the heat removal function is available does not warrant a classification.

This EAL involves a loss of decay heat removal capability, or an addition of heat to the RCS in excess of that which can currently be removed, such that reactor coolant temperature cannot be maintained below the cold shutdown temperature limit specified in Technical Specifications.

During this condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation.

During an outage, the level in the reactor vessel will normally be maintained at or above the reactor vessel flange. Refueling evolutions that lower water level below the reactor vessel flange are carefully planned and controlled. A loss of forced decay heat removal at reduced inventory may result in a rapid increase in reactor coolant temperature depending on the time after shutdown (ref. 3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 98 of 251 Attachment 1: Emergency Action Level Technical Bases Escalation to Alert would be via IC CA 1 based on an inventory loss or IC CA3 based on exceeding plant configuration-specific time criteria.

Reference(s):

1. Technical Specifications 1.0.C.2, "Definition for Cold Shutdown"

2. OU-SU-201, "Shutdown Safety Assessment Checklist"

3. NEI 99-01 CU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 99 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: UNPLANNED increase in RCS temperature EAL:

CU3.2 NOUE Loss of all RCS temperature and RCS water level indication for~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

5 - Cold Shutdown, 6- Refueling Definition(s):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

Basis:

This EAL addresses the inability to determine RCS temperature and level, and represents a potential degradation of the level of safety of the plant. If the RCS is not intact and CONTAINMENT CLOSURE is not established during this event, the SEM should also refer to EAL CA3.1.

This EAL reflects a condition where there has been a significant loss of instrumentation capability necessary to monitor RCS conditions and operators would be unable to monitor key parameters necessary to assure core decay heat removal. During this condition, there is no immediate threat of fuel damage because the core decay heat load has been reduced since the cessation of power operation.

RCS level indications include (ref. 2):

Standpipe level indication RC-LI-( )ODA

RCS Narrow Range Level indication RC-LR-( )05

RVLIS Upper Range Train A

RVLIS Upper Range Train B

RVLIS Full Range Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation to Alert would be via IC CA 1 based on an inventory loss or IC CA3 based on exceeding plant configuration-specific time criteria.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 100 of 251 Attachment 1: Emergency Action Level Technical Bases Reference(s):

1. Technical Specifications 1.0.C.2, "Definition for Cold Shutdown"

2. ( )-OP-RC-004, "Draining the RCS to Reactor Flange Level"

3. NEI 99-01 CU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 101 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 3 - RCS Temperature Initiating Condition: Inability to maintain plant in cold shutdown EAL:

CA3.1 Alert UNPLANNED increase in RCS temperature to> 200°F for> Table C-5 duration (Notes 1, 12)

OR UNPLANNED RCS pressure increase > 10 psi (does not apply to solid plant conditions)

Note 1: The SEM should declare the event promptly upon determining that the applicable time has been exceeded, or will likely be exceeded.

Note 12: If an RCS heat removal system is in operation within the applicable Table C-5 heat-up duration and RCS temperature is being reduced, the EAL is not applicable.

Table C-5 RCS Heat-up Duration Thresholds CONTAINMENT RCS Status Heat-up Duration CLOSURE Status Intact AND not reduced/decreased 60 min.

inventory Not intact OR Established 20 min.

reduced/decreased inventory Not established 0 min.

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

CONTAINMENT CLOSURE - The action to isolate containment to achieve a functional barrier to fission product release during plant shutdown conditions. Closure is ensured before Time to Core Boiling or compensatory actions are taken.

UNPLANNED-. A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

In the absence of reliable RCS temperature indication caused by the loss of decay heat removal capability, classification should be based on time of boil data when in Mode 6 or the

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 102 of 251 Attachment 1: Emergency Action Level Technical Bases RCS is not intact in Mode 5 (ref. 1). If the RCS is intact, classification should be based on the RCS pressure increase criteria of this EAL. Guidance for calculating RCS time to 200F is provided on the Shutdown Safety Assessment Checklist Attachment 7 (ref. 2).

Decreased Inventory is defined as a condition with fuel in the Reactor Vessel and any RCS Loop Stop Valve closed, or RCS water level less than five percent (5%) in the pressurizer.

(With the Reactor Vessel Head removed and the Reactor Cavity filled to at least 23 feet above the Reactor Vessel Flange, the RCS is not considered to be in a decreased inventory condition.) (ref. 3).

Reduced Inventory is defined as a condition with fuel in the Reactor Vessel and water level lower than three feet below the Reactor Vessel flange. This corresponds to a plant elevation of 15.7 ft. If reading RCS Level from the MGR on RC-Ll-()OOA, RCS STANDPIPE, Reduced Inventory corresponds to an indicated level of 16.25 ft due to instrument uncertainties (ref. 3, 4).

This EAL addresses conditions involving a loss of decay heat removal capability or an addition of heat to the RCS in excess of that which can currently be removed. Either condition represents an actual or potential substantial degradation of the level of safety of the plant.

A momentary UNPLANNED excursion above the Technical Specification cold shutdown temperature limit when the heat removal function is available does not warrant a classification.

The RCS Heat-up Duration Thresholds table addresses an increase in RCS temperature when CONTAINMENT CLOSURE is established but the RCS is not intact, or RCS inventory is reduced (e.g., mid-loop operation in PWRs). The 20-minute criterion was included to allow time for operator action to address the temperature increase.

The RCS Heat-up Duration Thresholds table also addresses an increase in RCS temperature with the RCS intact. The status of CONTAINMENT CLOSURE is not crucial in this condition since the intact RCS is providing a high pressure barrier to a fission product release. The 60-minute time frame should allow sufficient time to address the temperature increase without a substantial degradation in plant safety.

Finally, in the case where there is an increase in RCS temperature, the RCS is not intact or is at reduced inventory, and CONTAINMENT CLOSURE is not established, no heat-up duration is allowed (i.e., 0 minutes). This is because 1) the evaporated reactor coolant may be released directly into the containment atmosphere and subsequently to the environment, and

2) there is reduced reactor coolant inventory above the top of irradiated fuel.

The RCS should be assumed to be intact when the RCS pressure boundary is in its normal condition for the Cold Shutdown mode of operation (e.g., no freeze seals). With the Pressurizer PORV(s) blocked open, the RCS is considered not intact.

The RCS pressure increase threshold provides a pressure-based indication of RCS heat-up in the absence of RCS temperature monitoring capability. P-()-458 and P-()-403 provide RCS narrow range pressure indication (ref. 5, 6).

Escalation of the emergency classification level would be via IC CS1 or RS1.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 103 of 251 Attachment 1: Emergency Action Level Technical Bases Reference(s):

1. Technical Specifications 1.0.C.2, "Definition for Cold Shutdown"

2. OU-SU-201, "Shutdown Safety Assessment Checklist"

3. OU-AA-200, "Shutdown Risk Management"

4. ( )-OSP-ZZ-004, "Unit ( ) Safety Systems Status List for Cold Shutdown/Refueling Conditions"

5. 1-IPT-CC-RC-P-458, "Reactor Coolant System Pressure Loop P-( )-458 Channel Calibration"

6. 2-IPT-CC-RC-P-403, "Reactor Coolant System Pressure Loop P-( )-403 Channel Calibration"

7. NEI 99-01 CA3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 104 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 4 - Loss of Vital DC Power Initiating Condition: Loss of vital DC power for 15 minutes or longer EAL:

CU4.1 NOUE Indicated voltage is < 105 VDC on required vital 125 voe battery buses ( )A OR ( )B for

~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

5 - Cold Shutdown, 6 - Refueling Definition(s):

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis There are two independent 125 volt DC systems for each unit.

Each system consists of 125 volt DC distribution panels and its respective battery and a battery charger which is part of the vital bus Uninterruptible Power Supply (UPS). Each unit has four UPSs and, therefore, four battery chargers. The batteries 1A, 1B, 2A, and 28 supply power only if the battery chargers fail or if the demand exceeds the capacity of the chargers.

The batteries are rated for a minimum of two hours. A battery terminal voltage of 105 volts DC is the minimum voltage required to ensure proper operation of equipment connected to the DC bus (ref. 1, 2).

This IC addresses a loss of vital DC power which compromises the ability to monitor and control operable SAFETY SYSTEMS when the plant is in the cold shutdown or refueling mode.

In these modes, the core decay heat load has been significantly reduced, and coolant system temperatures and pressures are lower; these conditions increase the time available to restore a vital DC bus to service. Thus, this condition is considered to be a potential degradation of the level of safety of the plant.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 105 of 251 Attachment 1: Emergency Action Level Technical Bases As used in this EAL, "required" means the vital DC buses necessary to support operation of the in-service, or operable, train or trains of SAFETY SYSTEM equipment. For example, if Train A is out-of-service (inoperable) for scheduled outage maintenance work and Train B is in-service (operable), then a loss of vital DC power affecting Train B would require the declaration of an NOUE. A loss of vital DC power to Train A would not warrant an emergency classification.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Depending upon the event, escalation of the emergency classification level would be via IC CA 1 or CA3, or an IC in Category M.

This cold condition EAL is equivalent to the hot condition EAL MS2.1.

Reference(s):

1. ( )-AP-10.06, "Loss of DC Power"

2. UFSAR Section 8.4.4

3. NEI 99-01 CU4

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 106 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown I Refueling System Malfunction Subcategory: 5 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities EAL:

CU5.1 NOUE Loss of all Table C-6 onsite communication methods OR Loss of all Table C-6 State and local agency communication methods OR Loss of all Table C-6 NRC communication methods Table C-6 Communication Methods State/

System Onsite NRC Local Radio Communications System X Public Address and Intercom System X Private Branch Telephone Exchange (PBX) X X X Sound Powered Telephone System X Commercial Telephone System X X Automatic Ring Downs (ARD) X lnstaphone Loop X Dedicated NRC Communications X Mode Applicability:

5 - Cold Shutdown, 6 - Refueling, DEF - Defueled Definition(s):

None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 107 of 251 Attachment 1: Emergency Action Level Technical Bases Basis:

This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to State and local agencies and the NRC.

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

The second EAL condition addresses a total loss of the communications methods used to notify all State and local agencies of an emergency declaration. The State and local agencies referred to here are the Commonwealth of Virginia and affected local communities.

The third EAL condition addresses a total loss of the communications methods used to notify the NRC of an emergency declaration.

This cold condition EAL is equivalent to the hot condition EAL MU7.1.

Reference(s):

1. Surry Power Station Emergency Plan, Section 7.2, "Communications Systems"

2. UFSAR Section 7.7.1

3. NEI 99-01 CU5

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 108 of 251 Attachment 1: Emergency Action Level Technical Bases Category: C - Cold Shutdown / Refueling System Malfunction Subcategory: 6 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting SAFETY SYSTEMS needed for the current operating mode EAL:

CA6.1 Alert The occurrence of any Table C-7 hazardous event AND Event damage has caused indications of degraded performance on one train of a SAFETY SYSTEM needed for the current operating mode AND EITHER:

Event damage has caused indications of degraded performance to the second train of the SAFETY SYSTEM needed for the current operating mode

Event damage has resulted in VISIBLE DAMAGE to the second train of the SAFETY SYSTEM needed for the current operating mode (Notes 9, 10)

Note 9: If the affected SAFETY SYSTEM train was already inoperable or out of service before the hazardous event occurred, then emergency classification is not warranted.

Note 10: If the hazardous event only resulted in VISIBLE DAMAGE, with no indications of degraded performance to at least one train of a SAFETY SYSTEM, then this emergency classification is not warranted.

Table C-7 Hazardous Events

Seismic event (earthquake)

Internal or external FLOODING event

High winds or tornado strike

FIRE

EXPLOSION

Other events with similar hazard characteristics as determined by the Shift Manager/SEM Mode Applicability:

5 - Cold Shutdown, 6 - Refueling

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 109 of 251 Attachment 1: Emergency Action Level Technical Bases Definition(s):

EXPLOSION -A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large quantities of smoke and heat are observed.

FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE - Damage to a SAFETY SYSTEM train that is readily observable without measurements, testing, or analysis. The visual impact of the *damage is sufficient to cause concern regarding the operability or reliability of the affected SAFETY SYSTEM train.

Basis:

This IC addresses a hazardous event that causes damage to SAFETY SYSTEMS needed for the current operating mode. In order to provide the appropriate context for consideration of an ALERT classification, the hazardous event must have caused indications of degraded SAFETY SYSTEM performance in one train, and there must be either indications of performance issues with the second SAFETY SYSTEM train or VISIBLE DAMAGE to the second train such that the potential exists for this second SAFETY SYSTEM train to have performance issues. In other words, in order for this EAL to be classified, the hazardous event must occur, at least one SAFETY SYSTEM train must have indications of degraded performance, and the second SAFETY SYSTEM train must have indications of degraded performance or VISIBLE DAMAGE such that the potential exists for performance issues. Note that this second SAFETY SYSTEM train is from the same SAFETY SYSTEM that has indications of degraded performance; commercial nuclear power plants are designed to be able to support single system issues without compromising public health and safety from radiological events.

Indications of degraded performance addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 110 of 251 Attachment 1: Emergency Action Level Technical Bases reliability of the SAFETY SYSTEM train.

VISIBLE DAMAGE addresses damage to a SAFETY SYSTEM train that is not in service/operation and that potentially could cause performance issues. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. This VISIBLE DAMAGE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.

An event affecting equipment common to two or more trains of a safety system (i.e., there are indications of degraded performance and/or VISIBLE DAMAGE affecting the common equipment) should be classified as an Alert under this EAL, as appropriate to the plant mode.

By affecting the functionality of multiple trains of a safety system, the loss of the common equipment effectively meets the two-train impact criteria that underlie the EALs and bases.

An event affecting a single-train safety system (i.e., there are indications of degraded performance and/or VISIBLE DAMAGE affecting the one train) would not be classified under this EAL because the two-train impact criteria that underlie the EALs and bases would not be met. If an event affects a single-train safety system, then the emergency classification should be made based on plant parameters/symptoms meeting the EALs for another IC. Depending upon the circumstances, classification may also occur based on SEM judgement.

An event that affects two trains of a safety system (e.g., one train has indications of degraded performance and the other VISIBLE DAMAGE) that also has one or more additional trains should be classified as an Alert under this EAL, as appropriate to the plant mode. This approach maintains consistency with the two-train impact criteria that underlie the EALs and bases and is warranted because the event was severe enough to affect the functionality of two trains of a safety system despite plant design criteria associated with system and system train separation and protection. Such an event may have caused other plant impacts that are not immediately apparent.

Escalation of the emergency classification level would be via IC CS1 or AS1.

This cold condition EAL is equivalent to the hot condition EAL MAB.1.

Reference(s ):

1. EP FAQ 2016-002

2. NEI 99-01 CA6

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 111 of 251 Attachment 1: Emergency Action Level Technical Bases Category E - Independent Spent Fuel Storage Installation (ISFSI)

EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.)

An independent spent fuel storage installation (ISFSI) is a complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage. A significant amount of the radioactive material contained within a canister must escape its packaging and enter the biosphere for there to be a significant environmental effect resulting from an accident involving the dry storage of spent nuclear fuel.

A NOUE is declared on the basis of the occurrence of an event of sufficient magnitude that a loaded cask CONFINEMENT BOUNDARY is damaged or violated.

The SPS ISFSI is located outside the SPS PLANT PROTECTED AREA but within the OWNER CONTROLLED AREA. Therefore a hostile security event that leads to a potential loss in the level of safety of the ISFSI is a classifiable event under Security category EAL HA4.1.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 112 of 251 Attachment 1: Emergency Action Level Technical Bases Category: ISFSI Subcategory: Confinement Boundary Initiating Condition: Damage to a loaded cask CONFINEMENT BOUNDARY EAL:

EU1.1 NOUE Damage to a loaded cask CONFINEMENT BOUNDARY as indicated by an on-contact radiation reading on the surface of a loaded spent fuel cask> any Table E-1 limit Table E-1 ISFSI Cask Surface Dose Rate Limits sssc HSM-H

152 mrem/hr (neutron + gamma)

1,600 mrem/hr at the front bird screen average on top of the cask

4 mrem/hr at the door centerline

448 mrem/hr (neutron + gamma) average on the side of the cask

4 mrem/hr at the end shield wall exterior Mode Applicability:

All Definition(s):

CONFINEMENT BOUNDARY- The barrier(s) between spent fuel and the environment once the spent fuel is processed for dry storage. As related to the SPS ISFSI, Confinement Boundary is defined as the Sealed Surface Storage Cask (SSSC) or NUHOMS Dry Shielded Canister (DSC).

INDEPENDENT SPENT FUEL STORAGE INSTALLATION (ISFSI): A complex that is designed and constructed for the interim storage of spent nuclear fuel and other radioactive materials associated with spent fuel storage.

Basis:

This IC addresses an event that results in damage to the CONFINEMENT BOUNDARY of a storage cask containing spent fuel. It applies to irradiated fuel that is licensed for dry storage beginning at the point that the loaded storage cask is sealed. The issues of concern are the creation of a potential or actual release path to the environment, degradation of one or more fuel assemblies due to environmental factors, and configuration changes which could cause challenges in removing the cask or fuel from storage.

The existence of "damage" is determined by radiological survey. The specified EAL threshold values correspond to 2 times the bounding Sealed Surface Storage Cask (SSSC) or Horizontal

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 113 of 251 Attachment 1: Emergency Action Level Technical Bases Storage Module (HSM-H) external surface dose rate limits (ref. 1, 2, 3). The technical specification multiple of "2 times", which is also used in Category R IC RU1, is used here to distinguish between non-emergency and emergency conditions. The emphasis for this classification is the degradation in the level of safety of the spent fuel cask and not the magnitude of the associated dose or dose rate. It is recognized that in the case of extreme damage to a loaded cask, the fact that the "on-contact" dose rate limit is exceeded may be determined based on measurement of a dose rate at some distance from the cask.

SPS utilizes the following dry cask storage systems (ref 1, 2, 3):

Transnuclear TN-32 (SSSC)

GNSI Castor V/21 (SSSC)

GNSI Castor X/33 (SSSC)

Westinghouse MC-10 (SSSC)

NAC International NAC-128 (SSSC)

NUHOMS HD System (32PTH DSC/HSM-H)

Security-related events for ISFSls are covered under ICs HU1 and HA1.

Reference(s):

1. Surry ISFSI SAR Section 7.3.2.1, "Cask Surface Dose Rates"

2. SNM-2501 Appendix A, Surry ISFSI Technical Specifications Section 3.3, "Dose Rates"

3. Certificate of Compliance 1030, "Transnuclear, Inc. Safety Analysis for the NU HOMS HD Horizontal Modular Storage System for Irradiated Nuclear Fuel Appendix A NUHOMS HD System Generic Technical Specifications Section 5.4 HSM-H Dose Rate Evaluation Program"

4. O-AP-52, "ISFSI TRBL"

5. NEI 99-01 E-HU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 114 of 251 Attachment 1: Emergency Action Level Technical Bases Category F - Fission Product Barrier Degradation EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes.

EALs in this category represent threats to the defense in depth design concept that precludes the release of highly radioactive fission products to the environment. This concept relies on multiple physical barriers any one of which, if maintained intact, precludes the release of significant amounts of radioactive fission products to the environment. The primary fission product barriers are:

A. Fuel Clad Barrier (FC): The Fuel Clad Barrier consists of the cladding material that contains the fuel pellets.

B. Reactor Coolant System Barrier (RCS): The RCS Barrier includes the RCS primary side and its connections up to and including the pressurizer safety and relief valves, and other connections up to and including the primary isolation valves.

C. Containment Barrier (CTMT): The Containment Barrier includes the containment building and connections up to and including the outermost containment isolation valves. This barrier also includes the main steam, feedwater, and blowdown line extensions outside the containment building up to and including the outermost secondary side isolation valve. Containment Barrier thresholds are used as criteria for escalation of the Emergency Classification Level (EGL) from an Alert to a Site Area Emergency or a ~eneral Emergency.

The EALs in this category require evaluation of the loss and potential loss thresholds listed in the fission product barrier matrix of Table F-1. "Loss" and "Potential Loss" signify the relative damage and threat of damage to the barrier. "Loss" means the barrier no longer assures containment of radioactive materials. "Potential Loss" means integrity of the barrier is threatened and could be lost if conditions continue to degrade. The number of barriers that are lost or potentially lost and the following criteria determine the appropriate emergency classification level:

Alert:

Any loss or any potential loss of either Fuel Clad or RCS Barrier Site Area Emergency:

Loss or potential loss of any two barriers General Emergency:

Loss of any two barriers and loss or potential loss of third barrier The logic used for emergency classification based on fission product barrier monitoring should reflect the following considerations:

The Fuel Clad Barrier and the RCS Barrier are weighted more heavily than the Containment Barrier.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 115 of 251 Attachment 1: Emergency Action Level Technical Bases

NOUE ICs associated with RCS and Fuel Clad Barriers are addressed under System Malfunction ICs.

For accident conditions involving a radiological release, evaluation of the fission product barrier thresholds will need to be performed in conjunction with dose assessments to ensure correct and timely escalation of the emergency classification. For example, an evaluation of the fission product barrier thresholds may result in a Site Area Emergency classification while a dose assessment may indicate that an EAL for General Emergency IC RG1 has been exceeded.

The fission product barrier thresholds specified within a scheme reflect plant-specific SPS design and operating characteristics.

As used in this category, the term RCS leakage encompasses not just those types defined in Technical Specifications but also includes the loss of RCS mass to any location- inside the containment, an interfacing system, or outside of the containment.

The release of liquid or steam mass from the RCS due to the as-designed/expected operation of a relief valve is not considered to be RCS leakage.

At the Site Area Emergency level, EAL users should maintain cognizance of how far present conditions are from meeting a threshold that would require a General Emergency declaration. For example, if the Fuel Clad and RCS fission product barriers were both lost, then there should be frequent assessments of containment radioactive inventory and integrity. Alternatively, if both the Fuel Clad and RCS fission product barriers were potentially lost, the SEM would have more assurance that there was no immediate need to escalate to a General Emergency.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 116 of 251 Attachment 1: Emergency Action Level Technical Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Any loss or any potential loss of either Fuel Clad or RCS EAL:

FA1.1 Alert Any loss or any potential loss of EITHER Fuel Clad or RCS barrier (Table F-1)

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

None Basis:

Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-1 lists the fission product barrier thresholds, bases and references.

At the Alert classification level, Fuel Clad and RCS barriers are weighted more heavily than the Containment barrier. Unlike the Containment barrier, loss or potential loss of either the Fuel Clad or RCS barrier may result in the relocation of radioactive materials or degradation of core cooling capability. Note that the loss or potential loss of Containment barrier in combination with loss or potential loss of either Fuel Clad or RCS barrier results in declaration of a Site Area Emergency under EAL FS1 .1 Reference(s):

1. NEI 99-01 FA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 117 of 251 Attachment 1: Emergency Action Level Technical Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss or potential loss of any two barriers EAL:

FS1 .1 Site Area Emergency Loss or potential loss of any two barriers (Table F-1)

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Basis:

Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-1 lists the fission product barrier thresholds, bases and references.

At the Site Area Emergency classification level, each barrier is weighted equally. A Site Area Emergency is therefore appropriate for any combination of the following conditions:

One barrier loss and a second barrier loss (i.e., loss - loss)

One barrier loss and a second barrier potential loss (i.e., loss - potential loss)

One barrier potential loss and a second barrier potential loss (i.e., potential loss -

potential loss)

At the Site Area Emergency classification level, the ability to dynamically assess the proximity of present conditions with respect to the threshold for a General Emergency is important. For example, the existence of Fuel Clad and RCS Barrier loss thresholds in addition to offsite dose assessments would require continual assessments of radioactive inventory and Containment integrity in anticipation of reaching a General Emergency classification. Alternatively, if both Fuel Clad and RCS potential loss thresholds existed, they would have greater assurance that escalation to a General Emergency is less IMMINENT.

Reference(s):

1. NEI 99-01 FS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 118 of 251 Attachment 1: Emergency Action Level Technical Bases Category: Fission Product Barrier Degradation Subcategory: N/A Initiating Condition: Loss of any two barriers and loss or potential loss of third the barrier EAL:

FG1.1 General Emergency Loss of any two barriers AND Loss or potential loss of the third barrier (Table F-1)

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

None Basis:

Fuel Clad, RCS and Containment comprise the fission product barriers. Table F-1 lists the fission product barrier thresholds, bases and references.

At the General Emergency classification level each barrier is weighted equally. A General Emergency is therefore appropriate for any combination of the following conditions:

Loss of Fuel Clad, RCS and Containment Barriers

Loss of Fuel Clad and RCS Barriers with potential loss of Containment Barrier

Loss of RCS and Containment Barriers with potential loss of Fuel Clad Barrier

Loss of Fuel Clad and Containment Barriers with potential loss of RCS Barrier Reference(s):

1. NEI 99-01 FG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 119 of 251 Attachment 1: Emergency Action Level Technical Bases Table F-1 Fission Product Barrier Threshold Matrix & Bases Table F-1 lists the threshold conditions that define the Loss and Potential Loss of the three fission product barriers (Fuel Clad, Reactor Coolant System, and Containment). The table is structured so that each of the three barriers occupies adjacent column$. Each fission product barrier column is further divided into two columns; one for Loss thresholds and one for Potential Loss thresholds.

The first column of the table (to the left of the Fuel Clad Loss column) lists the categories (types) of fission product barrier thresholds. The fission product barrier categories are:

A. RCS or SG Tube Leakage B. Inadequate Heat removal C. CTMT Radiation/ RCS Activity D. CTMT Integrity or Bypass E. SEM Judgment Each category occupies a row in Table F-1 thus forming a matrix defined by the categories.

The intersection of each row with each Loss/Potential Loss column forms a cell in which one or more fission product barrier thresholds appear. If NEI 99-01 does not define a threshold for a barrier Loss/Potential Loss, the word "None" is entered in the cell.

Thresholds are assigned sequential numbers within each barrier column beginning with number one.

If a cell in Table F-1 contains more than one numbered threshold, each of the numbered thresholds, if exceeded, signifies a Loss or Potential Loss of the barrier. It is not necessary to exceed all of the thresholds in a category before declaring a barrier Loss/Potential Loss.

Subdivision of Table F-1 by category facilitates association of plant conditions to the applicable fission product barrier Loss and Potential Loss thresholds. This structure promotes a systematic approach to assessing the classification status of the fission product barriers.

When equipped with knowledge of plant conditions related to the fission product barriers, the EAL-user first scans down the category column of Table F-1, locates the likely category and then reads across the fission product barrier Loss and Potential Loss thresholds in that category to determine if a threshold has been exceeded. If a threshold has not been exceeded, the EAL-user proceeds to the next likely category and continues review of the thresholds in the new category If the EAL-user determines that any threshold has been exceeded, by definition, the barrier is lost or potentially lost - even if multiple thresholds in the same barrier column are exceeded, only that one barrier is lost or potentially lost. The EAL-user must examine each of the three fission product barriers to determine if other barrier thresholds in the category are lost or potentially lost. For example, if containment radiation is sufficiently high, a Loss of the Fuel Clad and RCS Barriers and a Potential Loss of the Containment Barrier can occur. Barrier Losses and Potential Losses are then applied to the algorithms given in EALs FG1 .1, FS1 .1, and FA 1.1 to determine the appropriate emergency classification.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/55 Enclosure 5 Page 120 of 251 Attachment 1 Emergency Action. Level Technical Bases Table F-1 Fission Product Barrier Threshold Matrix Fuel Clad Barrier (FC) Reactor Coolant System Barrier (RCS) Containment Barrier (CTMT)

Category Loss Potential Loss Loss Potential Loss Loss Potential Loss

1. An automatic or manual Safety 1. UNISOLABLE RCS or SG tube 1. A leaking or RUPTURED SG is A Injection (SI) actuation required by leakage> 150 gpm FAULTED outside of CTMT RCS orSG None None EITHER: None

2. Integrity-RED Path condilions Tube

UNISOLABLE RCS leakage met Leakage

SG tube RUPTURE

1. Core Cooling-RED Path 1. Core Cooling-ORANGE Path 3. Heat Sink-RED Path conditions met 1. Core Cooling-RED PATH conditions conditions met conditions met AND met B None Heat sink is required None AND

2. Heat Sink-RED Path conditions Restoration procedures not Inadequate met effective within 15 min.

Heat Removal AND (Note 1)

Heat sink is reauired

2. CTMT High range Radiation 2. CTMT High range Radiation 2. CTMT High range Radiation Monitor RM-RI-( )27/28 Monitor RM-RI-( )27/28 reading Monitor RM-RI-( )27/28 reading >

reading > Table F-2 column > Table F-2 column RCS Loss Table F-2 column CTMT Fuel Clad Loss Potential Loss

3. Coolant activity > 300 µCi/gm DEl-131 C 4: Dose rate at 1 ft. from an CTMT unpressurized RCS sample None None None Radiation/ ~ Table F-3 RCS Activity 5. Sample line dose rate threshold ~ Table F-4

6. With letdown in service, Reactor Coolant Letdown Radiation Monitor CH-RI-( )18/19

> 5E+06 cpm

2. CTMT isolation (Phase 1, 2 or 3) 3. Containment-RED Path conditions is required met AND EITHER:

D . CTMT integrity has been lost based on SEM judgment

4. CTMT hydrogen concentration

?

4%

CTMT Integrity or Bypass None None None None

. UNISOLABLE pathway from CTMT atmosphere to the

5. CTMT pressure > 23 psia with

< one full train of CTMT heat removal systems (Note 11) environment exists operating per design for~ 15 min.

(Note 1)

3. Indications of UNISOLABLE RCS leakage outside of CTMT E 7. Any condition in the opinion of 3. Any condition in the opinion of 3. Any condition in the opinion of the 4. Any condition in the opinion of the 4. Any condition in the opinion of the 6. Any condition in the opinion of the the SEM that indicates loss of the SEM that indicates potential SEM that indicates loss of the SEM that indicates potential loss of SEM that indicates loss of the SEM that indicates potential loss of SEM the fuel clad barrier loss of the fuel clad barrier RCS barrier the RCS barrier CTMT barrier the CTMT barrier Judgment

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 121 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

I None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 122 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

I None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 123 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold:

I 1. Core Cooling-RED Path condttions met Definition(s):

None Basis:

This condition indicates temperatures within the core are sufficient to cause significant superheating of reactor coolant.

The loss threshold is based on meeting either CSFST Core Cooling Red path criteria (ref. 1, 2):

Core Exit Thermocouple readings ;;:: 1,200 °F.

Core exit TCs are ;;:: 700°F with RCS subcooling based on core exit TCs s 30°F [85°F],

no RCPs are running, and RVLIS full range is s 46%

Reference(s):

1. F-2, "Core Cooling"

2. ( )-FR-C.1, "Response to Inadequate Core Cooling"

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Loss 2.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 124 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1 . Core Cooling-ORANGE Path conditions met Definition(s):

None Basis:

This condition indicates a reduction in reactor vessel water level sufficient to allow the onset of heat-induced cladding damage.

The potential loss threshold is based on meeting the CSFST Core Cooling Orange Path criteria.

CSFST Core Cooling-ORANGE path is entered if core exit thermocouples (TCs) are

< 1,200°F, RCS subcooling based on core exit TCs is s 30°F [85°F], and either of the following (ref. 1, 2): *

No RCPs are running and either: core exit TCs are ~ 700°F and RVLIS full range is

> 46%, or core exit TCs are < 700°F and RVLIS full range is s 46%.

At least one RCP is running and Reactor Vessel water level is s the specified RVLIS dynamic head readings based on the number of RCPs running.

Reference(s):

1. F-2, "Core Cooling"

2. ( )-FR-C.1, "Response to Inadequate Core Cooling"

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Potential Loss 2.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 125 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

2. Heat Sink-RED Path conditions met AND Heat sink is required Definition(s ):

None Basis:

The potential loss threshold is based on meeting the CSFST Heat Sink Red Path criteria of both of the following conditions existing (ref. 1):

Narrow Range levels in all SGs < 12% [18%]

Total feedwater flow to SGs s 350 gpm [450 gpm]

This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the Fuel Clad Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.

The phrase "and heat sink required" precludes the need for classification for conditions in which RCS pressure is less than SG pressure or Heat Sink-RED path entry was created through operator action directed by an EOP. For example, FR-H.1 is entered from CSFST Heat Sink-Red. Step 1 tells the operator to determine if secondary heat sink is required by checking that RCS pressure is greater than any non-faulted SG pressure and RCS That is greater than 350°F. If these conditions exist, Heat Sink is required. Otherwise, the operator is to either go to the procedure and step in effect or place RHR in service for heat removal. For large LOCA events inside the Containment, the SGs are irrelevant because heat removal through the containment heat removal systems takes place. Therefore, Heat Sink Red should not be required and, should not be assessed for EAL classification because a LOCA event alone should not require higher than an Alert classification. (ref. 1, 2).

Meeting this threshold results in a Site Area Emergency because this threshold is identical to RCS Barrier Potential Loss threshold B.3; both will be met. This condition warrants a Site Area Emergency declaration because inadequate RCS heat removal may result in fuel heat-up sufficient to damage the cladding and increase RCS pressure to the point where mass will be lost from the system.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 126 of 251 Attachment 1: Emergency Action Level Technical Bases Reference(s):

1. F-3, "Heat Sink"

2. ( )-FR-H.1, "Response to Loss of Secondary Heat Sink"

3. NEI 99-01 Inadequate Heat Removal Fuel Clad Potential Loss 2.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 127 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: C. CTMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

2. CTMT high range radiation monitor RM-RI-( )27/28 reading> Table F-2 column Fuel Clad Loss Table F-2 CTMT High Range Radiation Monitor Barrier Thresholds RM-RI-( )27 or RM-RI-( )28 Time > Shutdown Fuel Clad Loss RCS Loss CTMT Potential Loss (hrs) (R/hr) (R/hr) (R/hr)

2 95 5 380

> 2 -:s;4 65 5 260

> 4-:s; 8 35 5 140

> 8 - :s; 14 15 5 60

>14 8 5 32 Definition(s):

None Basis:

Containment radiation monitor readings greater than the Table F-2 Fuel Clad Loss column threshold indicate the release of reactor coolant, with elevated activity indicative of fuel damage, into the containment. The reading is derived assuming the instantaneous release and dispersal of the reactor coolant noble gas and iodine inventory associated with a concentration of 5% clad failure into the containment atmosphere. 5% clad failure is assumed equivalent to NEI 99-01 guidance of 300 uCi/gm DEl-131 which corresponds to an approximate range of 2%

to 5% fuel clad failure. Reactor coolant concentrations of this magnitude are several times larger than the maximum concentrations (including iodine spiking) allowed within Technical Specifications and are therefore indicative of fuel damage (approximately 5 % clad failure depending on core inventory and RCS volume). Containment sprays are assumed to be operating resulting in negligible iodines and particulates in the containment atmosphere to provide response to the containment radiation monitors (ref. 1, 2).

Time after shutdown values are provided to account for radioactive decay.

The values specified in Table F-2 were developed using a method to minimize error(+/-) for the threshold value within each defined time period. Time periods were chosen to fit monitor

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 128 of 251 Attachment 1: Emergency Action Level Technical Bases response (fast changes in response early following reactor shutdown are broken up into smaller time periods to better approximate expected change). Values were chosen within each time period to minimize error (<50%) to the highest and lowest response within the range.

The radiation monitor reading in this threshold is higher than that specified for RCS Barrier Loss threshold C.2 since it indicates a loss of both the Fuel Clad barrier and the RCS barrier.

Note that a combination of the two monitor readings appropriately escalates the ECL to a Site Area Emergency.

There is no Potential Loss threshold associated with RCS Activity/ Containment Radiation.

Reference(s ):

1. Calculation RA-0063, "Expected Containment High Range Radiation Monitor Response to a LOCA Based on Fuel Rod Gap Fractions Defined in NUREG 1228"

2. NEI 99-01 CTMT Radiation/ RCS Activity FC Loss 3.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 129 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: C. CTMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

13. Coolant activity> 300 µCi/gm DEl-131 Definition(s):

None Basis:

This threshold indicates that RCS radioactivity concentration is greater than 300 µCi/gm DEl-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

It is recognized that sample collection and analysis of reactor coolant with highly elevated activity levels could require several hours to complete. Nonetheless, a sample-related threshold is included as a backup to other indications.

There is no Potential Loss threshold associated with RCS Activity/ Containment Radiation.

Reference(s):

1. NEI 99-01 CTMT Radiation/ RCS Activity FC Loss 3.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 130 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: C. CTMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

4. Dose rate at 1 ft. from an unpressurized RCS sample ~ Table F-3 Table F-3 FC Loss Coolant Activity Dose Rates Time > Shutdown (hrs) mR/hr/ml

S 2 15

>2-:S8 8

>8 3 Definition(s):

None Basis:

This threshold indicates that RCS radioactivity concentration is greater than 300 µCi/gm DEl-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

It is recognized that sample collection and analysis of reactor coolant with highly elevated activity levels could require several hours to complete. Nonetheless, a sample-related threshold is included as a backup to other indications. This EAL provides the ability to take a dose rate off of an RCS sample to determine fuel clad barrier loss, without the need to analyze the sample before making this determination. This EAL saves significant time by allowing evaluation of contained radioactivity within the RCS by a direct dose rate measurement.

Per Engineering Calculation RA-0059, dose rate is assumed to result from radioactive iodines (1-131 thru 1-135) in RCS in concentrations corresponding to the loss of 5% of gap radioactivity of the core. For 5% loss of gap radioactivity (-300 µCi/gm DEl-131 ), 2% of the core inventory of radioactive iodines are assumed to be contained in the gap. The values contained in Table F-3 (FC Loss Coolant Activity Dose Rates) represent expected one foot dose rates per ml of sample based on time since reactor shutdown to the time when the sample is taken. The expected dose rate is a near linear relationship with the volume of the sample, so any volume collected can be determined by dividing the measured dose rate by the sample volume and comparing to the threshold value from Table F-3 for the applicable time frame. These dose rates assume no ECCS injection so there is no dilution credited which would vary coolant

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 131 of 251 Attachment 1: Emergency Action Level Technical Bases volume. Values in the table have been rounded for ease of use. The > 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months threshold is conservative up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following reactor shutdown. After 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the expected response from radioactive iodine levels off. Therefore, the value shown for> 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months applies for all samples taken 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or more since reactor shutdown (ref. 1, 2).

The values specified in Table F-3were developed using a method to minimize error(+/-) for the threshold value within each defined time period. Values were chosen to minimize error from the highest to lowest dose rate within each range.

There is no Potential Loss threshold associated with RCS Activity/ Containment Radiation.

Reference(s):

1. Calculation RA-0059, "Detector Response to an RCS Sample for EAL Classification of Fuel Clad Degradation and Barrier Loss"

2. NEI 99-01 CTMT Radiation/ RCS Activity FC Loss 3.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 132 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: C. CTMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

5. Sample line dose rate threshold 2: Table F-4 Table F-4 FC Loss RCS Sample Line Dose Rates Time > Shutdown (hrs) R/hr S2 4

>2-:58 2

>8 1 Definition(s):

None Basis:

This threshold indicates that RCS radioactivity concentration is greater than 300 µCi/gm DEl-131. Reactor coolant activity above this level is greater than that expected for iodine spikes and corresponds to an approximate range of 2% to 5% fuel clad damage. Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

Per Engineering Calculation RA-0079, dose rate is assumed to result from radioactivity in the RCS in concentrations corresponding to 5% clad failure. The values contained in Table F-4 (FC Loss RCS Sample Line Dose Rates) represent fuel clad failure thresholds when measured approximately 2" from the outside of the RCS hot leg sample line. RCS sample line locations have been predetermined for use with this EAL. Other RCS lines could be used if analyzed on a case-by-case basis. Values in the table have been rounded for ease of use. The sample line dose rates have been calculated for various time ranges after shutdown (ref. 1).

The values specified in Table F-4 were developed using a method to minimize error(+/-) for the threshold value within each defined time period. Values were chosen to minimize error from the highest to lowest dose rate within each range.

There is no Potential Loss threshold associated with RCS Activity/ Containment Radiation.

Reference(s):

1 . Engineering Calculation RA-0079

2. NEI 99-01 CTMT Radiation/ RCS Activity FC Loss 3.8

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 133 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: C. CTMT Radiation / RCS Activity Degradation Threat: Loss Threshold:

6. With letdown in service, Reactor Coolant Letdown Radiation Monitor CH-RI-( )18/19 > 5E+06 cpm Definition(s):

None Basis:

This threshold represents a significant reactor coolant concentration caused by failure of fuel cladding that is at least an order of magnitude above the Technical Specification iodine spike limit and falls within an approximate range of 2% to 5 % fuel clad failure (ref. 1). Since this condition indicates that a significant amount of fuel clad damage has occurred, it represents a loss of the Fuel Clad Barrier.

Per Engineering Calculation PA-0236-0-A, (ref. 1) the calculated letdown reading at 1 hr of decay corresponding to 300 uCi/gm DEl-131, is above the upper limit of detection of 1E+07 cpm. A threshold value of 5E+06 cpm was chosen for CH-RI-( )18/19 based on the midpoint of the highest decade of readable scale of the monitors. This threshold value is conservative compared to a value corresponding to 300 uCi/gm DEl-131.

A portion of the letdown stream bypasses the demineralizers and flows through radiation monitors for CH-RI-( )18 and CH-RI-( )19 to detect fission product activity in the reactor coolant and warn of a potential fuel element failure (ref. 2).

There is no Potential Loss threshold associated with RCS Activity/ Containment Radiation.

Reference(s):

1. Calculation No. PA-0236, Rev. 0, Add. A "Post Accident Letdown Radiation Monitor Response for Surry"

2. SDBD-SPS-RM; "System Design Basis Document for Radiation Monitoring System Surry Power Station"

3. NEI 99-01 CTMT Radiation/ RCS Activity FC Loss 3.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Do~ument Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 134 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: C. CTMT Radiation / RCS Activity Degradation Threat: Potential Loss Threshold:

None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 135 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: D. CTMT Integrity or Bypass Degradation Threat: Loss Threshold:

I None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 136 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: D. CTMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 137 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: E. SEM Judgment Degradation Threat: Loss Threshold:

7. Any condition in the opinion of the SEM that indicates loss of the Fuel Clad barrier Definition(s):

None Basis:

This threshold addresses any other factors that are to be used by the SEM in determining whether the Fuel Clad barrier is lost.

Reference(s):

1. NEI 99-01 Emergency Director Judgment Fuel Clad Loss 6.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 138 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Fuel Clad Category: F. SEM Judgment Degradation Threat: Potential Loss Threshold:

3. Any condition in the opinion of the SEM that indicates potential loss of the Fuel Clad barrier Definition(s):

None Basis:

This threshold addresses any other factors that are to be used by the SEM in determining whether the Fuel Clad barrier is potentially lost. The SEM should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Reference(s):

1. NEI 99-01 Emergency Director Judgment Potential Fuel Clad Loss 6.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 139 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: A. RCS or SIG Tube Leakage Degradation Threat: Loss Threshold:

1. An automatic or manual Safety Injection (SI) actuation required by EITHER:

UNISOLABLE RCS leakage

SG tube RUPTURE Definition(s ):

UNJSOLABLE -An open or breached system line that cannot be isolated, remotely or locally.

RUPTURE - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis:

This threshold is based on an UNISOLABLE RCS leak of sufficient size to require an automatic or manual actuation of the Emergency Core Cooling System (ECCS). This condition clearly represents a loss of the RCS Barrier.

This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS leakage through an interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

A steam generator with primary-to-secondary leakage of sufficient magnitude to require a safety injection is considered to be RUPTURED. If a RUPTURED steam generator is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold A.1 will also be met.

This threshold does not apply to a Safety Injection (SI) actuation not caused by excessive RCS leakage (i.e., steamline ~p or high steam flow) (ref. 1).

If EOPs direct operators to open the Pressurizer pressure relief valves to implement a core cooling strategy (i.e., a "feed and bleed" cooldown), then there will exist a reactor coolant flow path from the RCS, past the "pressurizer safety and relief valves" and into the containment that operators cannot isolate without compromising the effectiveness of the strategy (i.e., for the strategy to be effective, the valves must be kept in the open position); therefore, the flow through the pressure relief line is UNISOLABLE. In this case, the ability of the RCS pressure boundary to serve as an effective barrier to a release of fission products has been eliminated and thus this condition constitutes a loss of the RCS barrier.

Reference(s):

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 140 of 251 Attachment 1: Emergency Action Level Technical Bases

1. ( )-E-0, "Reactor Trip or Safety Injection"

2. ( )-E-3, "Steam Generator Tube Rupture"

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Loss 1.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 141 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: A. RCS or SIG Tube Leakage Degradation Threat: Potential Loss Threshold:

1. UNISOLABLE RCS or SG tube leakage> 150 gpm Definition(s):

UNISOLABLE - An open or breached system line that cannot be isolated, remotely or locally.

Basis:

This threshold is based on an UNISOLABLE RCS leak that results in the inability to maintain pressurizer level within specified limits by operation of a normally used charging pump, but an SI actuation has not occurred. The threshold is met when RCS leakage is determined to exceed 150 gpm excluding normal reductions in RCS inventory such as letdown and RCP seal leakoff (ref.1).

This threshold is applicable to unidentified and pressure boundary leakage, as well as identified leakage. It is also applicable to UNISOLABLE RCS leakage through an interfacing system. The mass loss may be into any location - inside containment, to the secondary-side (i.e., steam generator tube leakage) or outside of containment.

If the leaking steam generator(> 150 gpm) is also FAULTED outside of containment, the declaration escalates to a Site Area Emergency since the Containment Barrier Loss threshold A.1 will also be met.

Reference(s):

1. SPS UFSAR Table 9.1-2, "Chemical and Volume Control System Principal Component Data Summary" 2 NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 142 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: A. RCS or SIG Tube Leakage Degradation Threat: Potential Loss Threshold:

j 2. Integrity-RED Path conditions met Definition(s ):

None Basis:

This condition indicates an extreme challenge to the integrity of the RCS pressure boundary due to pressurized thermal shock - a transient that causes rapid RCS cooldown while the RCS is in Mode 3 or higher (i.e., hot and pressurized).

The potential loss threshold is defined by the CSFST Integrity - RED path. CSFST Integrity -

Red Path plant conditions(> 100°F/hr cold leg cooldown) and associated PTS Limit A Curve indicates an extreme challenge to the safety function when plant parameters are to the left of the limit curve following excessive RCS cooldown under pressure (ref. 1).

Reference(s ):

1. F-4, "Integrity"

2. ( )-FR-P.1, "Response to Imminent Pressurized Thermal Shock Condition"

3. NEI 99-01 RCS or SG Tube Leakage Reactor Coolant System Potential Loss 1.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 143 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Loss Threshold:

I None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 144 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

3. Heat Sink-RED Path conditions met AND Heat sink is required Definition(s):

None Basis:

The potential loss threshold is based on meeting the CSFST Heat Sink Red Path criteria of both of the following conditions existing (ref. 1):

Narrow Range levels in all SGs < 12% [18%]

Total feedwater flow to SGs s 350 gpm [450 gpm]

This condition indicates an extreme challenge to the ability to remove RCS heat using the steam generators (i.e., loss of an effective secondary-side heat sink). This condition represents a potential loss of the RCS Barrier. In accordance with EOPs, there may be unusual accident conditions during which operators intentionally reduce the heat removal capability of the steam generators; during these conditions, classification using threshold is not warranted.

The phrase "and heat sink required" precludes the need for classification for conditions in which RCS pressure is less than SG pressure or Heat Sink-RED path entry was created through operator action directed by an EOP. For example, FR-H.1 is entered from CSFST Heat Sink-Red. Step 1 tells the operator to determine if heat sink is required by checking that RCS pressure is greater than any non-faulted SG pressure and RCS That is greater than 350°F. If these conditions exist, Heat Sink is required. Otherwise, the operator is to either go to the procedure and step in effect or place RHR in service for heat removal. For large LOCA events inside the Containment, the SGs are irrelevant because heat removal through the containment heat removal systems takes place. Therefore, Heat Sink Red should not be required and, should not be assessed for EAL classification because a LOCA event alone should not require higher than an Alert classification. (ref. 1, 2).

Meeting this threshold results in a Site Area Emergency because this threshold is identical to Fuel Clad Barrier Potential Loss threshold B.3; both will be met. This condition warrants a Site Area Emergency declaration because inadequate RCS heat removal may result in fuel

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 145 of 251 Attachment 1: Emergency Action Level Technical Bases heat-up sufficient to damage the cladding and increase RCS pressure to the point where mass will be lost from the system.

Reference(s):

1. F-3, "Heat Sink"

2. ( )-FR-H.1, "Response to Loss of Secondary Heat Sink"

3. NEI 99-01 Inadequate Heat Removal RCS Loss 2.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 146 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: C. CTMT Radiation/ RCS Activity Degradation Threat: Loss Threshold:

2. CTMT high range radiation monitor RM-RI-( )27/28 reading> Table F-2 column RCS Loss Table F-2 CTMT High Range Radiation Monitor Barrier Thresholds RM-RI-( )27 or RM-RI-( )28 Time > Shutdown Fuel Clad Loss RCS Loss CTMT Potential Loss (hrs) (R/hr) (R/hr) (R/hr)

S2 95 5 380

>2-S4 65 5 260

>4-S8 35 5 140

> 8 - s 14 15 5 60

>14 8 5 32 Definition(s ):

None Basis:

A reading> 5 R/hr (minimum practical reading) on RM-RI-( )27/28 is indicative of a breach in the RCS barrier (ref. 1, 2).

The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that reactor coolant activity equals Technical Specification allowable limits. This value is lower than that specified for Fuel Clad barrier loss threshold C.2 since it indicates a loss of the RCS Barrier only.

Because of the very high fuel clad integrity, only small amounts of noble gases would be dissolved in the primary coolant. Conservative estimates indicated that the readings from release of the normal RCS inventory would be below normal readings on the monitor while the station was operating. Therefore, a value 5 times the normal containment radiation monitor (RM-RI-( )27/28) reading of - 1 R/hr is used. The reading is less than that specified for fuel cladding barrier loss because no damage to the fuel cladding is assumed. Only leakage from the RCS is assumed for this barrier loss threshold. The value is high enough to preclude erroneous classification of barrier loss due to normal plant operations and is the lowest readable value on the monitors (ref. 1).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 147 of 251 Attachment 1: Emergency Action Level Technical Bases.

There is no Potential Loss threshold associated with RCS Activity/ Containment Radiation.

Reference(s):

1. Calculation RA-0063, "Expected Containment High Range Radiation Monitor Response to a LOCA Baseq on Fuel Rod Gap Fractions Defined in NUREG 1228"

2. NEI 99-01 CMT Radiation/ HCS Activity RCS Loss 3.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 148 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: C. CTMT Radiation/ RCS Activity Degradation Threat: Potential Loss Threshold:

I None L

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 149 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: D. CTMT Integrity or Bypass Degradation Threat: Loss Threshold:

INone

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 150 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: D. CTMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

INone

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 151 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: E. SEM Judgment Degradation Threat: Loss Threshold:

3. Any condition in the opinion of the SEM that indicates loss of the RCS barrier Definition(s ):

None Basis:

This threshold addresses any other factors that may be used by the SEM in determining whether the RCS barrier is lost.

Reference(s):

1. NEI 99-01 Emergency Director Judgment RCS Loss 6.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 152 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Reactor Coolant System Category: E. SEM Judgment Degradation Threat: Potential Loss Threshold:

4. Any condition in the opinion of the SEM that indicates potential loss of the RCS barrier Definition(s):

None Basis:

This threshold addresses any other factors that may be used by the SEM in determining whether the RCS barrier is potentially lost. The SEM should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Reference(s ):

1. NEI 99-01 Emergency Director Judgment RCS Potential Loss 6.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 153 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: A. RCS or SG Tube Leakage Degradation Threat: Loss Threshold:

1. A leaking or RUPTURED SG is FAULTED outside of CTMT Definition(s):

FAUL TED - The term applied to a steam generator that has a steam leak on the secondary side of sufficient size to cause an uncontrolled drop in steam generator pressure or the steam generator to become completely depressurized.

RUPTURED - The condition of a steam generator in which primary-to-secondary leakage is of sufficient magnitude to require a safety injection.

Basis:

This threshold addresses a leaking or RUPTURED Steam Generator (SG) that is also FAULTED outside of containment. The condition of the SG, whether leaking or RUPTURED, is determined in accordance with the thresholds for RCS Barrier Potential Loss A.1 and Loss A.1, respectively. This condition represents a bypass of the containment barrier.

FAULTED is a defined term within the NEI 99-01 methodology; this determination is not necessarily dependent upon entry into, or diagnostic steps within, an EOP. For example, if the pressure in a steam generator is decreasing uncontrollably (part of the FAULTED definition) and the FAULTED steam generator isolation procedure is not entered because EOP user rules are dictating implementation of another procedure to address a higher priority condition, the steam generator is still considered FAULTED for emergency classification purposes.

The FAULTED criterion establishes an appropriate lower bound on the size of a steam release that may require an emergency classification. Steam releases of this size are readily observable with normal Control Room indications. The lower bound for this aspect of the containment barrier is analogous to the lower bound criteria specified in IC MU4 for the fuel clad barrier (i.e., RCS activity values) and IC MUS for the RCS barrier (i.e., RCS leak rate values).

This threshold also applies to prolonged steam releases necessitated by operational considerations such as the forced steaming of a leaking or RUPTURED steam generator directly to atmosphere to cooldown the plant, or to drive an auxiliary (emergency) feed water pump. These types of conditions will result in a significant and sustained release of radioactive steam to the environment (and are thus similar to a FAULTED condition). The inability to isolate the steam flow without an adverse effect on plant cooldown meets the intent of a loss of containment.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 154 of 251 Attachment 1: Emergency Action Level Technical Bases Steam releases associated with the expected operation of a SG power operated relief valve or safety relief valve do not meet the intent of this threshold. Such releases may occur intermittently for a short period of time following a reactor trip as operators process through emergency operating procedures to bring the plant to a stable condition and prepare to initiate a plant cooldown. Steam releases associated with the unexpected operation of a valve (e.g., a stuck-open safety valve) do meet this threshold.

Following an SG tube leak or rupture, there may be minor radiological releases through a secondary-side system component (e.g., air ejectors, gland seal exhausters, valve packing, etc.). These types of releases do not constitute a loss or potential loss of containment but should be evaluated using the Category R ICs.

The emergency classification levels resulting from primary-to-secondary leakage, with or without a steam release from the FAULTED SG, are summarized below.

Affected SG is FAULTED Outside of Containment?

P-to-S Leak Rate Yes No Less than or equal to 25 gpm No classification No classification Greater than 25 gpm NOUE per MU5.1 NOUE per MU5.1 Greater than 150 gpm (RCS Site Area Emergency per Alert per FA1.1 Barrier Potential Loss) FS1.1 Requires an automatic or manual Site Area Emergency per ECCS (SI) actuation (RCS Barrier Alert per FA1 .1 FS1.1 Loss)

There is no Potential Loss threshold associated with RCS or SG Tube Leakage.

Reference(s ):

1. 1-E-2 (2-E-2), "Faulted Steam Generator Isolation"

2. 1-E-3 (2-E-3), "Steam Generator Tube Rupture"

3. NEI 99-01 RCS or SG Tube Leakage Containment Loss 1.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 155 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: A. RCS or SG Tube Leakage Degradation Threat: Potential Loss Threshold:

INone

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 156 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: B. Inadequate Heat Removal Degradation Threat: Loss

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 157 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: B. Inadequate Heat Removal Degradation Threat: Potential Loss Threshold:

1. Core Cooling-RED Path conditions met AND Restoration procedures not effective within 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Definition(s):

IMMINENT: The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Basis:

The potential loss threshold is based on meeting either CSFST Core Cooling Red Path criteria (ref. 1, 2):

Core Exit Thermocouple readings ~ 1,200 °F.

Core exit TCs are ~ 700°F with RCS subcooling based on core exit TCs :s; 30°F [85°F],

no RCPs are running, and RVLIS full range is :s; 46%

and restoration procedures not effective within 15 minutes.

This condition represents an IMMINENT core melt sequence which, if not corrected, could lead to vessel failure and an increased potential for containment failure. For this condition to occur there must already have been a loss of the RCS Barrier and the Fuel Clad Barrier. If implementation of a procedure(s) to restore adequate core cooling is not effective (successful) within 15 minutes, it is assumed that the event trajectory will likely lead to core melting and a subsequent challenge of the Containment Barrier.

The restoration procedure is considered "effective" if core exit thermocouple readings are decreasing and/or if reactor vessel level is increasing. Whether or not the procedure(s) will be effective should be apparent within 15 minutes. The SEM should escalate the emergency classification level to a General Emergency as soon as it is determined that the procedure(s) will not be effective.

Severe accident analyses (e.g., NUREG-1150) have concluded that function restoration procedures can arrest core degradation in a significant fraction of core damage scenarios, and that the likelihood of containment failure is very small in these events. Given this, it is appropriate to provide 15 minutes beyond the required entry point to determine if procedural actions can reverse thE;! core melt sequence.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 158 of 251 Attachment 1: Emergency Action Level Technical Bases Reference(s ):

1. F-2, "Core Cooling"

2. ( )-FR-C.1, "Response to Inadequate Core Cooling"

3. NEI 99-01 Inadequate Heat Removal Containment Potential Loss 2.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 159 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: C. CTMT Radiation/RCS Activity Degradation Threat: Loss Threshold:

I None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 160 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: C. CTMT Radiation/RCS Activity Degradation Threat: Potential Loss Threshold:

2. CTMT high range radiation monitor RM-RI-( )27/28 reading> Table F-2 column CTMT Potential Loss Table F-2 CTMT High Range Radiation Monitor Barrier Thresholds RM-RI-( )27 or RM-RI-( )28 Time > Shutdown Fuel Clad Loss RCS Loss CTMT Potential Loss (hrs) (R/hr) (R/hr) (R/hr)

5 2 95 5 380

>2-:54 65 5 260

>4-:58 35 5 140

>8-:514 15 5 60

> 14 8 5 32 Definition(s):

None Basis:

The radiation monitor reading corresponds to an instantaneous release of all reactor coolant mass into the containment, assuming that 20% of the fuel cladding has failed. This level of fuel clad failure is well above that used to determine the analogous Fuel Clad Barrier Loss and RCS Barrier Loss thresholds (ref. 1).

Time after shutdown values are provided to account for radioactive decay.

The values specified in Table F-2 were developed using a method to minimize error(+/-) for the threshold value within each defined time period. Time periods were chosen to fit monitor response (fast changes in response early following reactor shutdown are broken up into smaller time periods to better approximate expected change). Values were chosen within each time period to minimize error (<50%) to the highest and lowest response within the range.

NUREG-1228, Source Estimations During Incident Response to Severe Nuclear Power Plant Accidents, indicates the fuel clad failure must be greater than approximately 20% in order for there to be a major release of radioactivity requiring offsite protective actions. For this condition to exist, there must already have been a loss of the RCS barrier and the Fuel Clad

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 161 of 251 Attachment 1: Emergency Action Level Technical Bases barrier. It is therefore prudent to treat this condition as a potential loss of containment which would then escalate the emergency classification level to a General Emergency.

Reference(s):

1. Calculation RA-0063, "Expected Containment High Range Radiation Monitor Response to a LOCA Based on Fuel Rod Gap Fractions Defined in NUREG 1228"

2. NEI 99-01 CMT Radiation/ RCS Activity Containment Potential Loss 3.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 162 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: D. CTMT Integrity or Bypass Degradation Threat: Loss Threshold:

2. CTMT isolation (Phase 1, 2 or 3) is required AND EITHER:

CTMT integrity has been lost based on SEM judgment

UNISOLABLE pathway from CTMT atmosphere to the environment exists Definition(s):

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally.

Basis:

The status of the containment barrier during an event involving steam generator tube leakage is assessed using Loss Threshold A.1. Therefore this threshold is not applicable to steam generator tube leakage.

These thresholds address a situation where containment isolation is required and one of two conditions exists as discussed below. Users are reminded that there may be accident and release conditions that simultaneously meet both bulleted thresholds.

First Threshold - Containment integrity has been lost, i.e., the actual containment atmospheric leak rate likely exceeds that associated with allowable leakage (or sometimes referred to as design leakage). Following the release of RCS mass into containment, containment pressure will fluctuate based on a variety of factors; a loss of containment integrity condition may (or may not) be accompanied by a noticeable drop in containment pressure. Recognizing the inherent difficulties in determining a containment leak rate during accident conditions, it is expected that the SEM will assess this threshold using judgment, and with due consideration given to current plant conditions, and available operational and radiological data (e.g.,

containment pressure, readings on radiation monitors outside containment, operating status of containment pressure control equipment, etc.).

Refer to the middle piping run of Figure 1. Two simplified examples are provided. One is leakage from a penetration and the other is leakage from an in-service system valve.

Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure.

Another example would be a loss or potential loss of the RCS barrier, and the simultaneous occurrence of two FAULTED locations on a steam generator where one fault is located inside containment (e.g., on a steam or feedwater line) and the other outside of containment. In this case, the associated steam line provides a pathway for the containment atmosphere to escape to an area outside the containment.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 163 of 251 Attachment 1: Emergency Action Level Technical Bases Following the leakage of RCS mass into containment and an increase in containment pressure, there may be minor radiological releases associated with allowable (design) containment leakage through various penetrations or system components. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Category A ICs.

Second Threshold - Conditions are such that there is an UNISOLABLE pathway for the migration of radioactive material from the containment atmosphere to the environment. As used here, the term "environment" includes the atmosphere of a room or area, outside the containment, that may, in turn, communicate with the outside-the-plant atmosphere (e.g.,

through discharge of a ventilation system or atmospheric leakage). Depending upon a variety of factors, this condition may or may not be accompanied by a noticeable drop in containment pressure.

Refer to the top piping run of Figure 1. In this simplified example, the inboard and outboard isolation valves remained open after a containment isolation was required (i.e., containment isolation was not successful). There is now an UNISOLABLE pathway from the containment to the environment.

The existence of a filter is not considered in the threshold assessment. Filters do not remove fission product noble gases. In addition, a filter could become ineffective due to iodine and/or particulate loading beyond design limits (i.e., retention ability has been exceeded) or water saturation from steam/high humidity in the release stream.

Leakage between two interfacing liquid systems, by itself, does not meet this threshold.

Refer to the bottom piping run of Figure 1. In this simplified example, leakage in an RCP seal cooler is allowing radioactive material to enter the Auxiliary Building. The radioactivity would be detected by the Process Monitor. If there is no leakage from the closed water cooling system to the Auxiliary Building, then no threshold has been met. If the pump developed a leak that allowed steam/water to enter the Auxiliary Building, then the second threshold would be met. Depending upon radiation monitor locations and sensitivities, this leakage could be detected by any of the four monitors depicted in the figure and cause the first threshold to be met as well.

Following the leakage of RCS mass into containment and an increase in containment pressure, there may be minor radiological releases associated with allowable containment leakage through various penetrations or system components. Minor releases may also occur if a containment isolation valve(s) fails to close but the containment atmosphere escapes to an enclosed system. These releases do not constitute a loss or potential loss of containment but should be evaluated using the Category R ICs.

Reference(s):

1. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 164 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: D. CTMT Integrity or Bypass Degradation Threat: Loss Threshold:

3. Indications of UNISOLABLE RCS leakage outside of CTMT Definition(s):

UN/SOLABLE -An open or breached system line that cannot be isolated, remotely or locally.

Basis:

To ensure proper escalation of the emergency classification, the RCS leakage outside of containment must be related to the mass loss that is causing the RCS Loss and/or Potential Loss threshold A.1 to be met.

The status of the containment barrier during an event involving steam generator tube leakage is assessed using Containment Loss Threshold A.1. Therefore this threshold is not applicable to steam generator tube leakage.

This threshold does not apply to an UNISOLABLE RSHX tube leak outside containment.

Such leaks are properly addressed under the Category R radiological release based EALs.

Containment sump, temperature, pressure and/or radiation levels will increase if reactor coolant mass is leaking into the containment. If these parameters have not increased, then the reactor coolant mass may be leaking outside of containment (i.e., a containment bypass sequence). Increases in sump, temperature, pressure, flow and/or radiation level readings outside of the containment may indicate that the RCS mass is being lost outside of containment.

Unexpected elevated readings and alarms on radiation monitors with detectors outside containment should be corroborated with other available indications to confirm that the source is a loss of RCS mass outside of containment. If the fuel clad barrier has not been lost, radiation monitor readings outside of containment may not increase significantly; however, other unexpected changes in sump levels, area temperatures or pressures, flow rates, etc.

should be sufficient to determine if RCS mass is being lost outside of the containment.

Refer to the middle piping run of Figure 1. In this simplified example, a leak has occurred at a reducer on a pipe carrying reactor coolant in the Auxiliary Building. Depending upon radiation monitor locations and sensitivities, the leakage could be detected by any of the four monitors depicted in the figure and cause loss threshold 0.2 to be met as well.

Reference(s):

1. NEI 99-01 CMT Integrity or Bypass Containment Loss 4.8

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/55 Enclosure 5 Page 165 of 251 Attachment 1 Emergency Action Level Technical Bases Figure 1: Containment Integrity or Bypass Examples

. :::: .. zna Threshold~ . :::::::::::

-: :::::: Airborne release :::-: :::::::

from pathway :: : :- . * * * *

Inside CTMT Auxiliary Building Damper Open valve Penetration Damper"-"'-',.,_,._..:,o..::ii JI t Closed Cooling RCP Seal Cooling

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 166 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: D. CTMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

13. Containment RED Path conditions met.

Definition(s):

None Basis:

CSFST Containment RED Path conditions are met if containment pressure exceeds its design pressure. If containment pressure exceeds the design pressure of 60 psia (ref. 1, 2), there exists a potential to lose the containment barrier. To reach this level, there must be an inadequate core cooling condition for an extended period of time; therefore, the RCS and Fuel Clad barriers would already be lost. Thus, this threshold is a discriminator between a Site Area Emergency and General Emergency since there is now a potential to lose the third barrier.

Reference(s):

1. F-5, "Containment"

2. UFSAR Section 5.4

3. NEI 99-01 CMT Integrity or Bypass Containment Potential Loss 4.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 167 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: D. CTMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

14. CTMT hydrogen concentration 2: 4%

Definition(s):

None Basis:

The existence of an explosive mixture means, at a minimum, that the containment atmospheric hydrogen concentration is sufficient to support a hydrogen burn (i.e., at the lower deflagration limit). A hydrogen burn will raise containment pressure and could result in collateral equipment damage leading to a loss of containment integrity. It therefore represents a potential loss of the containment barrier.

A containment hydrogen concentration of 4% conservatively represents the lowest threshold for flammability in the presence of oxygen (ref. 1,2).

Reference(s):

1. ( )-FR-C.1, "Response to Inadequate Core Cooling"

2. SAMG CA-3, "Calculation Aid Number 3 - Hydrogen Flammability in Containment"

3. NEI 99-01 CMT Integrity or Bypass Containment Potential .Loss 4.B

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 168 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: D. CTMT Integrity or Bypass Degradation Threat: Potential Loss Threshold:

5. CTMT pressure > 23 psia with < one full train of CTMT depressurization equipment (Note 11) operating per design for ~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 11: One full train of containment depressurization equipment consist of one Containment Spray Subsystem and two Recirculation Spray Subsystems operating together.

Definition(s):

None Basis:

This threshold describes a condition where containment pressure is greater than the setpoint (23 psia) (ref. 1) at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design (ref. 2, 3). The 15-minute criterion is included to allow operators time to manually start equipment that may not have automatically started, if possible. This threshold represents a potential loss of containment in that containment heat removal/depressurization systems (e.g.,

containment sprays but not including containment venting strategies) are either lost or performing in a degraded manner.

The spray systems consist of two separate parallel Containment Spray Subsystems, each of 100 percent capacity, and four separate parallel Recirculation Spray Subsystems, each of 50 percent capacity. With one Containment Spray Subsystem and two Recirculation Spray Subsystems operating together (one full train of CTMT depressurization equipment), the spray systems are capable of cooling and depressurizing the Containment to 0.5 psig in less than 60 minutes and to subatmospheric pressure within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months following the Design Basis Accident (ref. 2, 3). The combination of required pumps can be obtained from using equipment on either emergency busses H and J in order to meet the "one full train" requirement.

Reference(s):

1. Technical Specifications Section 3.4, "Spray Systems"

2. F-5, "Containment"

3. ( )-FR-Z.1, "Response to High Containment Pressure"

4. NEI 99-01 GMT Integrity or Bypass Containment Potential Loss 4.C

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 169 of 251 Attachment 1: Emergency Action Level Technical Bases _

Barrier: Containment Category: E. SEM Judgment Degradation Threat: Loss Threshold:

4. Any condition in the opinion of the SEM that indicates loss of the CTMT barrier Definition(s):

None Basis:

This threshold addresses any other factors that may be used by the SEM in determining whether the containment barrier is lost.

Reference(s):

1. NEI 99-01 Emergency Director Judgment Containment Loss 6.A i

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 170 of 251 Attachment 1: Emergency Action Level Technical Bases Barrier: Containment Category: E. SEM Judgment Degradation Threat: Potential Loss Threshold:

6. Any condition in the opinion of the SEM that indicates potential loss of the CTMT barrier Definition(s):

None Basis:

This threshold addresses any other factors that may be used by the SEM in determining whether the containment barrier is potentially lost. The SEM should also consider whether or not to declare the barrier potentially lost in the event that barrier status cannot be monitored.

Reference(s):

1. NEI 99-01 Emergency Director Judgment Containment Potential Loss 6.A

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 171 of 251 Attachment 1: Emergency Action Level Technical Bases Category H - Hazards and Other Conditions Affecting Plant Safety EAL Group: ANY (EALs in this category are applicable to any plant condition, hot or cold.)

Hazards are non-plant, system-related events.that can directly or indirectly affect plant operation, reactor plant safety or personnel safety.

1. Security Unauthorized entry attempts into the PLANT PROTECTED AREA, bomb threats, sabotage attempts, and actual security compromises threatening loss of physical control of the plant.

2. Seismic Event Natural events such as earthquakes have potential to cause plant structure or equipment damage of sufficient magnitude to threaten personnel or plant safety.

3. Natural or Technological Hazard Other natural and non-naturally occurring events that can cause damage to plant facilities include tornados, FLOODING, hazardous material releases and events restricting site access warranting classification.

4. Fire FIRES can pose significant hazards to personnel and reactor safety. Appropriate for classification are FIRES within the PLANT PROTECTED AREA or which may affect operability of equipment needed for safe shutdown

5. Hazardous Gas Toxic, corrosive, asphyxiant or flammable gas leaks can affect normal plant operations or preclude access to plant areas required to safely shutdown the plant.

6. Control Room Evacuation Events that are indicative of loss of Control Room habitability. If the Control Room must be evacuated, additional support for monitoring and controlling plant functions is necessary through the emergency response facilities.

7. SEM Judgment The EALs defined in other categories specify the predetermined symptoms or events that are indicative of emergency or potential emergency conditions and thus warrant classification. While these EALs have been developed to address the full spectrum of possible emergency conditions which may warrant classification and subsequent implementation of the Emergency Plan, a provision for classification of emergencies based on operator/management experience and judgment is still necessary. The EALs of this category provide the SEM the latitude to classify emergency conditions consistent with the established classification criteria based upon SEM judgment.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 172 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: Confirmed SECURITY CONDITION or threat EAL:

HU1.1 NOUE A SECURITY CONDITION that does not involve a HOSTILE ACTION as reported by SPS Security Shift Supervisor OR Notification of a credible security threat directed at the site OR A validated notification from the NRC providing information of an aircraft threat Mode Applicability:

All Definition(s):

HOSTAGE -A person(s) held as leverage against the station to ensure that demands will be met by the station.

HOSTILE ACTION - An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

OWNER CONTROLLED AREA (OCA) - The entire area contiguous to the PLANT PROTECTED AREA, owned by the Company and designated to be controlled for security reasons.

PROJECTILE - An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 173 of 251 Attachment 1: Emergency Action Level Technical Bases Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

SECURITY CONDITION - Any security event as listed in the approved security contingency plan that constitutes a threat/compromise to site security, threat/risk to site personnel, or a potential degradation to the level of safety of the plant. A security condition does not involve a HOSTILE ACTION.

Basis:

This IC addresses events that pose a threat to plant personnel or SAFETY SYSTEM equipment, and thus represent a potential degradation in the level of plant safety. Security events which do not meet one of these EALs are adequately addressed by the requirements of 10 CFR 73.71 or 10 CFR 50.72. Security events assessed as HOSTILE ACTIONS are classifiable under ICs HA1 and HS1. Guidance on. assessing Security Conditions is included in the Security Contingency Implementing Procedures (SCIP). The SCIPs are implementing procedures for the Station Safeguards Contingency Plan.

Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security-related event (ref. 1, 2, 3).

Classification of these events will initiate appropriate threat-related notifications to plant personnel and State and local agencies.

Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].

The first threshold references the Security Shift Supervisor because these are the individuals trained to confirm that a security event is occurring or has occurred. Training on security event confirmation and classification is controlled due to the nature of Safeguards and 10 CFR 2.39 information.

The second threshold addresses the receipt of a credible security threat. The credibility of the threat is assessed in accordance with the Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program) and associated Security Plan Implementing Procedures (SCIP) (ref. 1).

The third threshold addresses the threat from the impact of an aircraft on the plant. The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may also be provided by NORAD through the NRC. Validation of the threat is performed in accordance with O-AP-36.00 Station Security Land or Water Threat - Operations Response or O-AP-36.01 Station Security Air Threat -

Operations Response (ref. 2, 3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 174 of 251 Attachment 1: Emergency Action Level Technical Bases Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the Security Plan for SPS (ref. 1).

Escalation of the emergency classification level would be via IC HA 1.

Reference(s):

1. Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program

2. O-AP-36.00, "Station Security Land or Water Threat - Operations Response"

3. O-AP-36.01, "Station Security Air Threat - Operations Response"

4. NEI 99-01 HU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 175 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: . HOSTILE ACTION within the OWNER CONTROLLED AREA or airborne attack threat within 30 minutes EAL:

HA1.1 Alert A HOSTILE ACTION is occurring or has occurred within the OWNER CONTROLLED AREA as reported by SPS Security Shift Supervisor OR A validated notification from NRC of an aircraft attack threat within 30 min. of the site Mode Applicability:

All Definition(s):

HOSTAGE - A person(s) held as leverage against the station to ensure that demands will be met by the station.

HOSTILE ACTION - An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

HOSTILE FORCE - One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.

OWNER CONTROLLED AREA - The entire area contiguous to the PLANT PROTECTED AREA, owned by the Company and designated to be controlled for security reasons.

PROJECTILE - An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

This IC addresses the occurrence of a HOSTILE ACTION within the OWNER CONTROLLED AREA or notification of an aircraft attack threat. This event will require rapid response and

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 176 of 251 Attachment 1: Emergency Action Level Technical Bases assistance due to the possibility of the attack progressing to the PLANT PROTECTED AREA, or the need to prepare the plant and staff for a potential aircraft impact.

Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security-related event (ref. 1, 2, 3).

Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].

As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective measures (e.g., evacuation, dispersal or sheltering). The Alert declaration will also heighten the awareness of State and local agencies, allowing them to be better prepared should it be necessary to consider further actions.

This EAL does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc.

Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR 73.71 or 10 CFR 50.72.

The first threshold is applicable for any HOSTILE ACTION occurring, or that has occurred, in the OWNER CONTROLLED AREA. This includes any action directed against an ISFSI that is located outside the PLANT PROTECTED AREA such as SPS.

The second threshold addresses the threat from the impact of an aircraft on the plant, and the anticipated arrival time is within 30 minutes. The intent of this EAL is to ensure that threat-related notifications are made in a timely manner so that plant personnel and State and local agencies are in a heightened state of readiness. This EAL is met when the threat-related information has been validated in accordance with O-AP-36.00 Station Security Land or Water Threat- Operations Response or O-AP-36.01 Station Security Air Threat- Operations Response (ref. 2, 3).

The NRC Headquarters Operations Officer (HOO) will communicate to the licensee if the threat involves an aircraft. The status and size of the plane may be provided by NORAD through the NRC.

In some cases, it may not be readily apparent if an aircraft impact within the OWNER CONTROLLED AREA was intentional (i.e., a HOSTILE ACTION). It is expected, although not certain, that notification by an appropriate Federal agency to the site would clarify this point. In this case, the appropriate federal agency is intended to be NORAD, FBI, FAA or NRC. The emergency declaration, including one based on other ICs/EALs, should not be unduly delayed while awaiting notification by a Federal agency.

Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the Security Plan for SPS (ref. 1).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 177 of 251 Attachment 1: Emergency Action Level Technical Bases Escalation of the emergency classification level would be via IC HS1.

Reference(s):

1. Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program

2. O-AP-36.00, "Station Security Land or Water Threat - Operations Response"

3. O-AP-36.01, "Station Security Air Threat- Operations Response"

4. NEI 99-01 HA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 178 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards Subcategory: 1 - Security Initiating Condition: HOSTILE ACTION within the PLANT PROTECTED AREA EAL:

HS1 .1 Site Area Emergency A HOSTILE ACTION is occurring or has occurred within the PLANT PROTECTED AREA as reported by SPS Security Shift Supervisor Mode Applicability:

All Definition(s):

HOSTAGE -A person(s) held as leverage against the station to ensure that demands will be met by the station.

HOSTILE ACTION - An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the.. licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

HOSTILE FORCE - One or more individuals who are engaged in a determined assault, overtly or by stealth and deception, equipped with suitable weapons capable of killing, maiming, or causing destruction.

OWNER CONTROLLED AREA - The entire area contiguous to the PLANT PROTECTED AREA; owned by the Company and designated to be controlled for security reasons.

PROJECTILE - An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

This IC addresses the occurrence of a HOSTILE ACTION within the PLANT PROTECTED AREA. This event will require rapid response and assistance due to the possibility for damage to plant equipment.

Timely and accurate communications between Security Shift Supervision and the Control Room is essential for proper classification of a security-related event (ref. 1, 2, 3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 179 of 251 Attachment 1: Emergency Action Level Technical Bases Security plans and terminology are based on the guidance provided by NEI 03-12, Template for the Security Plan, Training and Qualification Plan, Safeguards Contingency Plan [and Independent Spent Fuel Storage Installation Security Program].

As time and conditions allow, these events require a heightened state of readiness by the plant staff and implementation of onsite protective. measures (e.g., evacuation, dispersal or sheltering). The Site Area Emergency declaration will mobilize State and local agency resources and have them available to develop and implement public protective actions in the unlikely event that the attack is successful in impairing multiple safety functions.

This EAL does not apply to a HOSTILE ACTION directed at an ISFSI Protected Area located outside the PLANT PROTECTED AREA; such an attack should be assessed using IC HA1. It also does not apply to incidents that are accidental events, acts of civil disobedience, or otherwise are not a HOSTILE ACTION perpetrated by a HOSTILE FORCE. Examples include the crash of a small aircraft, shots from hunters, physical disputes between employees, etc.

Reporting of these types of events is adequately addressed by other EALs, or the requirements of 10 CFR 73.71 or 10 CFR 50.72.

Emergency plans and implementing procedures are public documents; therefore, EALs should not incorporate Security-sensitive information. This includes information that may be advantageous to a potential adversary, such as the particulars concerning a specific threat or threat location. Security-sensitive information should be contained in non-public documents such as the Security Plan for SPS (ref. 1).

Reference(s):

1. Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan and Independent Spent Fuel Storage Installation Security Program

2. O-AP-36.00, "Station Security Land or Water Threat - Operations Response"

3. O-AP-36.01, "Station Security Air Threat - Operations Response"

4. NEI 99-01 HS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 180 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 2 - Seismic Event Initiating Condition: Seismic event greater than QBE levels EAL:

HU2.1 NOLIE Seismic event> QBE (0.07g horizontal or 0.04g vertical) as determined per O-AP-37.00 Seismic Event (Note 13)

Note 13: If, subsequent to activation of the SMA Event Indicator, the seismic event magnitude has not been determined (Channel 1 - horizontal and Channel 2 - vertical) within 15 minutes, the event should be immediately declared provided Control Room personnel felt the seismic event.

Mode Applicability:

All Definition(s):

None Basis:

O-AP-37 .00 Seismic Event provides the guidance for determining if the QBE earthquake threshold is exceeded (horizontal or vertical) and any required response actions. (ref. 2).

Ground motion acceleration of 0.07g horizontal or 0.04g vertical is the Operating Basis Earthquake for SPS (ref. 1).

Ground motion acceleration at the QBE is unmistakably a "felt" earthquake and is significantly greater than the ground motion acceleration required to activate the Event Indicator on the Strong Motion Accelerograph (SMA) which, in turn, activates annunciator VSP-45 (E-7),

ACCELEROGRAPH UNIT OPER, in the Control Room (ref. 3).

If, subsequent to activation of the SMA Event Indicator, the seismic event magnitude has not been determined (Channel 1 - horizontal and Channel 2 - vertical) within 15 minutes, the event should be immediately declared provided Control Room personnel felt the seismic event.

Event verification with external sources should not be necessary during or following an OBE.

Earthquakes of this magnitude should be readily felt by on-site personnel and recognized as a significant seismic event (e.g., lateral accelerations in excess of 0.07g). The Shift Manager may seek external verification if deemed appropriate (e.g., a call to the U.S. Geological Survey (USGS), check internet news sources, etc.); however, the verification action must not preclude a timely emergency declaration.

This IC addresses a seismic event that results in accelerations at the plant site greater than those specified for an Operating Basis Earthquake (QBE). An earthquake greater than an QBE but less than a Safe Shutdown Earthquake (SSE) should have no significant impact on safety-related systems, structures and components; however, some time may be required for the plant staff to ascertain the actual post-event condition of the plant (e.g., performs walk-

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 181 of 251 Attachment 1: Emerge*ncy Action Level Technical Bases downs and post-event inspections). Given the time necessary to perform walk-downs and inspections, and fully understand any impacts, this event represents a potential degradation of the level of safety of the plant.

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or MA9.

Reference(s):

1. UFSAR Section 2.5

2. O-AP-37.00, "Seismic Event"

3. O-VSP-E-7, "ACCELEROGRAPH UNIT OPER"

4. NEI 99-01 HU2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 182 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technological Hazard Initiating Condition: Hazardous event EAL:

HU3.1 NOUE A tornado strike within the PLANT PROTECTED AREA Mode Applicability:

All Definition(s):

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.

This EAL addresses a tornado striking (touching down) within the PLANT PROTECTED AREA.

Escalation of the emergency classification level would be based on ICs in Categories R, F, M or C.

If damage is confirmed visually or by other in-plant indications, the event may be escalated to an Alert under IC CA6 or MA9.

A tornado striking (touching down) within the PLANT PROTECTED AREA warrants declaration of an NOUE regardless of the measured wind speed at the meteorological tower. A tornado is defined as a violently rotating column of air in contact with the ground and extending from the base of a thunderstorm.

Reference(s ):

1. NEI 99-01 HU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 183 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technological Hazard Initiating Condition: Hazardous event EAL:

HU3.2 NOUE Internal room or area FLOODING of a magnitude sufficient to require manual or automatic electrical isolation of a SAFETY SYSTEM component required by Technical Specifications for the current operating mode Mode Applicability:

All Definition(s):

FLOODING - A condition where water is entering a room or area faster than installed equipment is* capable of removal, resulting in a rise of water level within the room or area.

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFRS0.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.

This EAL addresses FLOODING of a building room or area that results in operators isolating power to a SAFETY SYSTEM component due to water level or other wetting concerns.

Classification is also required if the water level or related wetting causes an automatic isolation of a SAFETY SYSTEM component from its power source (e.g., a breaker or relay trip). To warrant classification, operability of the affected component must be required by Technical Specifications for the current operating mode (ref. 1, 2).

Escalation of the emergency classification level would be based on ICs in Categories R, F, M or C.

Refer to EAL CA6.1 or MA9.1 for internal flooding affecting more than one SAFETY SYSTEM train.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 184 of 251 Attachment 1: Emergency Action Level Technical Bases Reference(s):

1. NEI 99-01 HU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 185 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technological Hazard Initiating Condition: Hazardous event EAL:

HU3.3 NOUE Movement of personnel within the PLANT PROTECTED AREA is IMPEDED due to an event external to the PLANT PROTECTED AREA involving hazardous materials (e.g., an offsite chemical spill or toxic gas release)

Mode Applicability:

All Definition(s):

IMPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.

This EAL addresses a hazardous materials event originating at a location outside the PLANT PROTECTED AREA and of sufficient magnitude to IMPEDE the movement of personnel within the PLANT PROTECTED AREA.

Escalation of the emergency classification level would be based on ICs in Categories R, F, M or C.

Reference(s):

1. NEI 99-01 HU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 186 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 3 - Natural or Technological Hazard Initiating Condition: Hazardous event EAL:

HU3.4 NOUE A hazardous event that results in on-site conditions sufficient to prohibit the plant staff from accessing the site via personal vehicles (Note 7)

Note 7: This EAL does not apply to routine traffic impediments such as fog, snow, ice, or vehicle breakdowns or accidents.

Mode Applicability:

All Definition(s }:

FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

Basis:

This IC addresses hazardous events that are considered to represent a potential degradation of the level of safety of the plant.

This EAL addresses a hazardous event that causes an on-site impediment to vehicle movement and significant enough to prohibit the plant staff from accessing the site using personal vehicles. Examples of such an event include site FLOODING caused by a hurricane, heavy rains, up-river water releases, dam failure, etc., or an on-site train derailment blocking the access road.

This EAL is not intended to apply to routine impediments such as fog, snow, ice, or vehicle breakdowns or accidents, but rather to more significant conditions such as the Hurricane Andrew strike on Turkey Point in 1992, the FLOODING around the Cooper Station during the Midwest floods of 1993, or the FLOODING around Ft. Calhoun Station in 2011.

Escalation of the emergency classification level would be based on ICs in Categories R, F, M or C.

Reference(s }:

1. NEI 99-01 HU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 187 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant EAL:

HU4.1 NOUE A FIRE is not extinguished within 15 min. of any of the following fire detection indications (Note 1):

Report from the field (i.e., visual observation)

Receipt of multiple (more than 1) fire alarms or indications

Field verification of a single fire alarm AND The FIRE is located within any Table H-1 area Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table H-1 SPS Fire Areas

Cable Vaults & Tunnels

Emergency Switchgear & Relay Rooms

Unit Switchgear Room

Reactor Containment

Safeguards Complex (incl. Cont. Spray Pump Area & Main Steam Valve House)

Main Control Room

Emergency Diesel Generator Rooms 1, 2 and 3

Auxiliary/ Fuel/ Decontamination Buildings

Underground Fuel Oil Pump House Rooms

Intake Structure - Emergency Service Water Pump House

Turbine Building

Mechanical Equipment Rooms 3, 4 & 5

Cable Tray Room Mode Applicability:

All

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 188 of 251 Attachment 1: Emergency Action Level Technical Bases Definition(s ):

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large quantities of smoke and heat are observed.

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

The 15 minute requirement begins with a credible notification that a FIRE is occurring, or receipt of multiple VALID fire detection system alarms or field validation of a single fire alarm.

The alarm is to be validated using available Control Room indications or alarms to prove that it is not spurious, or by reports from the field.

Table H-1 Fire Areas are those areas that contain equipment necessary for safe operation and shutdown of the plant (ref. 1).

The intent of the 15-minute duration is to size the Fl RE and to discriminate against small FIRES that are readily extinguished (e.g., smoldering waste paper basket). In addition to alarms, other indications of a FIRE could be a drop in fire main pressure, automatic activation of a suppression system, etc.

Upon receipt, operators will take prompt actions to confirm the validity of an initial fire alarm, indication, or report. For EAL assessment purposes, the emergency declaration clock starts at the time that the initial alarm, indication, or report was received, and not the time that a subsequent verification action was performed. Similarly, the fire duration clock also starts at the time of receipt of the initial alarm, indication or report.

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or MA9.

Reference(s):

1. SPS Appendix R Report, Sections 4.3, 4.4 and Table 2-1

2. NEI 99-01 HU4

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 189 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4- Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant EAL:

HU4.2 NOUE Receipt of a single fire alarm (i.e., no other indications of a FIRE)

AND The fire alarm is indicating a FIRE within any Table H-1 area (excluding Reactor Containment)

AND The existence of a FIRE is not verified within 30 min. of alarm receipt (Notes 1, 14)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 14: A Reactor Containment fire alarm is considered VALID upon receipt of multiple (more than one) fire zone alarms.

Table H-1 SPS Fire Areas

Cable Vaults & Tunnels

Emergency Switchgear & Relay Rooms

Unit Switchgear Room

Reactor Containment

Safeguards Complex (incl. Cont. Spray Pump Area & Main Steam Valve House)

Main Control Room

Emergency Diesel Generator Rooms 1, 2 and 3

Auxiliary/ Fuel/ Decontamination Buildings

Underground Fuel Oil Pump House Rooms

Intake Structure - Emergency Service Water Pump House

Turbine Building

Mechanical Equipment Rooms 3, 4 & 5

Cable Tray Room Mode Applicability:

All

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 190 of 251 Attachment 1: Emergency Action Level Technical Bases Definition(s):

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large quantities of smoke and heat are observed.

VALID -An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

The 30 minute requirement begins upon receipt of a single VALID fire detection system alarm.

The alarm is to be validated using available Control Room indications or alarms to prove that it is not spurious, or by reports from the field. Actual field reports must be made within the 30 minute time limit or a classification must be made. If a fire is verified to be occurring by field report, classification shall be made based on EAL HU4.1, with the 15 minute requirement beginning with the verification of the fire by field report.

Table H-1 Fire Areas are those areas that contain equipment necessary for safe operation and shutdown of the plant (ref. 1).

This EAL addresses receipt of a single fire alarm, and the existence of a FIRE is not verified (i.e., proved or disproved) within 30-minutes of the alarm. Upon receipt, operators will take prompt actions to confirm the validity of a single fire alarm. For EAL assessment purposes, the 30-minute clock starts at the time that the initial alarm was received, and not the time that a subsequent verification action was performed.

With regard to Reactor Containment fire alarms, there is constant air movement in the enclosed containment due to the operation of the containment ventilation system. The operating cooling units are drawing air to the units past the smoke detectors. It can be reasonably expected that a fire that burns for 15 minutes would produce sufficient products of combustion to cause fire detectors in multiple zones to alarm. Therefore, a single Reactor Containment fire alarm is not considered VALID.

A single fire alarm, absent other indication(s) of a FIRE, may be indicative of equipment failure or a spurious activation, and not an actual FIRE. For this reason, additional time is allowed to verify the validity of the alarm. The 30-minute period is a reasonable amount of time to determine if an actual FIRE exists; however, after that time, and absent information to the contrary, it is assumed that an actual FIRE is in progress.

If an actual FIRE is verified by a report from the field, then HU4.1 is immediately applicable, and the emergency must be declared if the FIRE is not extinguished within 15-minutes of the report. If the alarm is verified to be due to an equipment failure or a spurious activation, and

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 191 of 251 Attachment 1: Emergency Action Level Technical Bases this verification occurs within 30-minutes of the receipt of the alarm, then this EAL is not applicable and no emergency declaration is warranted.

Basis-Related Requirements from Appendix R (justification for the use of 30 minute criteria)

Appendix R to 10 CFR 50, states in part:

Criterion 3 of Appendix A to this part specifies that "Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions."

When considering the effects of fire, those systems associated with achieving and maintaining safe shutdown conditions assume major importance to safety because damage to them can lead to core damage resulting from loss of coolant through boil-off.

Because fire may affect safe shutdown systems and because the loss of function of systems used to mitigate the consequences of design basis accidents under post-fire conditions does not per se impact public safety, the need to limit fire damage to systems required to achieve and maintain safe shutdown conditions is greater than the need to limit fire damage to those systems required to mitigate the consequences of design basis accidents.

In addition, Appendix R to 10 CFR 50, requires, among other considerations, the use of 1-hour fire barriers for the enclosure of cable and equipment and associated non-safety circuits of one redundant train (G.2.c). As used in HU4.2, the 30-minutes to verify a single alarm is well within this worst-case 1-hour time period.

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or MA9.

Reference(s):

1. SPS Appendix R Report, Sections 4.3, 4.4 and Table 2-1

2. NEI 99-01 HU4

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 192 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4 - Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant EAL:

HU4.3 NOUE A FIRE within the PLANT PROTECTED AREA ot ISFSI Protected Area not extinguished within 60 min. of the initial report, alarm or indication (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

All Definition(s):

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large guantities of smoke and heat are observed.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

In addition to a FIRE addressed by EAL HU4.1 or HU4.2, a FIRE within the PLANT PROTECTED AREA not extinguished within 60-minutes may also potentially degrade the level of plant safety.

This basis extends to a FIRE occurring within the Protected Area of an ISFSI located outside the PLANT PROTECTED AREA.

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or MA9.

Reference(s):

1. NEI 99-01 HU4

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 193 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 4- Fire Initiating Condition: FIRE potentially degrading the level of safety of the plant EAL:

HU4.4 NOLIE A FIRE within the PLANT PROTECTED AREA or ISFSI Protected Area that requires an offsite fire department to assist with extinguishment Mode Applicability:

All Definition(s):

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large quantities of smoke and heat are observed.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

This IC addresses the magnitude and extent of FIRES that may be indicative of a potential degradation of the level of safety of the plant.

If a FIRE within the PLANT PROTECTED AREA or ISFSI Protected Area is of sufficient size to require a response by an offsite firefighting agency (e.g., a local town Fire Department), then the level of plant safety is potentially degraded. The dispatch of an offsite firefighting agency to the site requires an emergency declaration only if it is needed to actively support firefighting efforts because the fire is beyond the capability of the Fire Brigade to extinguish. Declaration is not necessary if the agency resources are placed on stand-by, or supporting post-extinguishment recovery or investigation actions.

The Shift Fire Brigade Incident Commander will assess whether the fire conditions warrant outside assistance (ref. 1).

Depending upon the plant mode at the time of the event, escalation of the emergency classification level would be via IC CA6 or MA9.

Reference(s):

1. NEI 99-01 HU4

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 194 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 5 - Hazardous Gases Initiating Condition: Gaseous release IMPEDING access to equipment necessary for normal plant operations, cooldown or shutdown EAL:

HA5.1 Alert Release of a toxic, corrosive, asphyxiant or flammable gas into any Table H-2 room or area AND Entry into the room or area is prohibited or IMPEDED (Note 5)

Note 5: If the equipment in the listed room or area was already inoperable or out-of-service before the event occurred, then no emergency classification is warranted.

Table H-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode Auxiliary Building El 13' 3 Auxiliary Building El 27' 3,4 ESGR 3 Mode Applicability:

3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

/MPEDE(D) - Personnel access to a room or area is hindered to an extent that extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

Basis:

This IC addresses an event involving a release of a hazardous gas that precludes or IMPEDES access to equipment necessary to maintain normal plant operation, or required for a normal plant cooldown and shutdown. This condition represents an actual or potential substantial degradation of the level of safety of the plant.

An Alert declaration is warranted if entry into the affected room/area is, or may be, procedurally required during the plant operating mode in effect at the time of the gaseous release. The emergency classification is not contingent upon whether entry is actually necessary at the time of the release.

Evaluation of the IC and EAL do not require atmospheric sampling; it only requires the SEM's judgment that the gas concentration in the affected room/area is sufficient to preclude or

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 195 of 251 Attachment 1: Emergency Action Level Technical Bases significantly IMPEDE procedurally required access. This judgment may be based on a variety of factors including an existing job hazard analysis, report of ill effects on personnel, advice from a subject matter expert or operating experience with the same or similar hazards. Access should be considered as IMPEDED if extraordinary measures are necessary to facilitate entry of personnel into the affected room/area (e.g., requiring use of protective equipment, such as SCBAs, that is not routinely employed).

An emergency declaration is not warranted if any of the following conditions apply:

The plant is in an operating mode different than the mode specified for the affected room/area (i.e., entry is not required during the operating mode in effect at the time of the gaseous release). For example, the plant is in Mode 1 when the gaseous release occurs, and the procedures used for normal operation, cooldown and shutdown do not require entry into the affected room until Mode 4.

The gas release is a planned activity that includes compensatory measures which address the temporary inaccessibility of a room or area (e.g., fire suppression system testing).

The action for which room/area entry is required is of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

The access control measures are of a conservative or precautionary nature, and would not actually prevent or IMPEDE a required action.

If the equipment in the listed room or area was already inoperable, or out-of-service, before the event occurred, then no emergency should be declared since the event will have no adverse impact beyond that already allowed by Technical Specifications at the time of the event.

An asphyxiant is a gas capable of reducing the level of oxygen in the body to dangerous levels. Most commonly, asphyxiants work by merely displacing air in an enclosed environment.

This reduces the concentration of oxygen below the normal level of around 19%, which can lead to breathing difficulties, unconsciousness or even death.

This EAL does not apply to firefighting activities that generate smoke and that automatically or manually activate a fire suppression system in an area.

Escalation of the emergency classification level would be via Category R, C or F ICs.

Reference(s):

1. Attachment 2, "Safe Operation & Shutdown Areas Tables R-2 & H-2 Bases"

2. NEI 99-01 HAS

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 196 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6 - Control Room Evacuation Initiating Condition: Control Room evacuation resulting in transfer of plant control to alternate locations EAL:

HA6.1 Alert An event has resulted in plant control being transferred from the Control Room to the Auxiliary Shutdown Panel Mode Applicability:

All Definition(s):

None Basis:

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations outside the Control Room. The loss of the ability to control the plant from the Control Room is considered to be a potential substantial degradation in the level of plant safety.

Following a Control Room evacuation, control of the plant will be transferred to alternate shutdown locations. The necessity to control a plant shutdown from outside the Control Room, in addition to responding to the event that ~equired the evacuation of the Control Room, will present challenges to plant operators and other on-shift personnel. Activation of the ERO and emergency response facilities will assist in responding to these challenges.

Transfer of plant control begins when the last licensed operator leaves the Control Room.

Control will be established at the Auxiliary Shutdown Panel if the Control Room is evacuated for any reason (ref. 1, 2, 3).

Escalation of the emergency classification level would be via IC HS6.

Reference(s):

1. O-AP-20.00, "Main Control Room Inaccessibility"

2. O-FCA-1.00, "Limiting MCR Fire"

3. NEI 99-01 HA6

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 197 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 6 - Control Room Evacuation Initiating Condition: Inability to control a key safety function from outside the Control Room EAL:

HS6.1 Site Area Emergency An event has resulted in plant control being transferred from the Control Room to the Auxiliary Shutdown Panel AND Control of any of the following key safety functions is not re-established within 15 min. of the last licensed operator leaving the Control Room (Note 1):

Reactivity (modes 1 , 2 and 3 only)

Core cooling

RCS heat removal Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown, 5 - Cold Shutdown, 6 - Refueling Definition(s):

None Basis:

This IC addresses an evacuation of the Control Room that results in transfer of plant control to alternate locations, and the control of a key safety function cannot be reestablished in a timely manner. The failure to gain control of a key safety function following a transfer of plant control to alternate locations is a precursor to a challenge to one or more fission product barriers within a relatively short period of time.

The determination of whether or not "control" is established at the remote safe shutdown location(s) is based on SEM judgment. The SEM is expected to make a reasonable, informed judgment within 15 minutes whether or not the operating staff has control of key safety functions from the remote safe shutdown location(s).

Transfer of plant control and the time period to establish control begins when the last licensed operator leaves the Control Room.

Control will be established at the Auxiliary Shutdown Panel if the Control Room was evacuated for any reason (ref. 1, 2).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 198 of 251 Attachment 1: Emergency Action Level Technical Bases Establishment of the reactivity safety function is only applicable in Modes 1, 2 and 3. Sufficient shutdown margin has already been established once in modes 4, 5 and 6 (ref.3).

Escalation of the emergency classification level would be via IC FG1 or CG1 Reference(s):

1. O-AP-20.00, "Main Control Room Inaccessibility"

2. O-FCA-1.00, "Limiting MCR Fire"

3. NRC EP FAQ 2015-014

4. NEI 99-01 HS6

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 199 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SEM Judgment Initiating Condition: Other conditions existing that in the judgment of the SEM warrant declaration of a NOUE EAL:

HU7.1 NOUE Other conditions exist which in the judgment of the SEM indicate that events are in progress or have occurred which indicate a potential degradation of the level of safety of the plant or indicate a security threat to facility protection has been initiated. No releases of radioactive material requiring offsite response or monitoring are expected unless further degradation of SAFETY SYSTEMS occurs.

Mode Applicability:

All Definition(s):

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SEM to fall under the emergency classification level description for a NOUE.

Reference(s):

1. NEI 99-01 HU7

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 200 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SEM Judgment Initiating Condition: Other conditions exist that in the judgment of the SEM warrant declaration of an Alert EAL:

HA7.1 Alert Other conditions exist which, in the judgment of the SEM, indicate that events are in progress or have occurred which involve an actual or potential substantial degradation of the level of safety of the plant or a security event that involves probable life threatening risk to site personnel or damage to site equipment because of HOSTILE ACTION. Any releases are expected to be limited to small fractions of the EPA Protective Action Guideline exposure levels.

Mode Applicability:

All Definition(s):

HOSTAGE -A person(s) held as leverage against the station to ensure that demands will be met by the station.

HOSTILE ACTION - An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

OWNER CONTROLLED AREA - The entire area contiguous to the PLANT PROTECTED AREA, owned by the Company and designated to be controlled for security reasons.

PROJECTILE - An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 201 of 251 Attachment 1: Emergency Action Level Technical Bases Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SEM to fall under the emergency classification level description for an Alert.

Reference(s):

1. NEI 99-01 HA7

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 202 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SEM Judgment Initiating Condition: Other conditions existing that in the judgment of the SEM warrant declaration of a Site Area Emergency EAL:

HS7.1 Site Area Emergency Other conditions exist which in the judgment of the SEM indicate that events are in progress or have occurred which involve actual or likely major failures of plant functions needed for protection of the public or HOSTILE ACTION that results in intentional damage or malicious acts, (1) toward site personnel or equipment that could lead to the likely failure of or, (2) that prevent effective access to equipment needed for the protection of the public.

Any releases are not expected to result in exposure levels which exceed EPA Protective Action Guideline exposure levels beyond the SITE BOUNDARY Mode Applicability:

All Definition(s):

HOSTAGE -A person(s) held as leverage against the station to ensure that demands will be met by the station.

HOSTILE ACTION - An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

OWNER CONTROLLED AREA - The entire area contiguous to the PLANT PROTECTED AREA, owned by the Company and designated to be controlled for security reasons.

PROJECTILE - An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

SITE BOUNDARY - The company-owned area within 1650 feet of Surry Unit 1 containment.

Basis:

This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SEM to fall under the emergency classification level description for a SITE AREA EMERGENCY.

Reference(s ):

1. NEI 99-01 HS?

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 203 of 251 Attachment 1: Emergency Action Level Technical Bases Category: H - Hazards and Other Conditions Affecting Plant Safety Subcategory: 7 - SEM Judgment Initiating Condition: Other conditions exist that in the judgment of the SEM warrant declaration of a General Emergency EAL:

HG7.1 General Emergency Other conditions exist which in the judgment of the SEM indicate that events are in progress or have occurred which involve actual or IMMINENT substantial core degradation or melting with potential for loss of containment integrity or HOSTILE ACTION that results in an actual loss of physical control of the facility. Releases can be reasonably expected to exceed EPA Protective Action Guideline exposure levels offsite for more than the immediate site area.

Mode Applicability:

All Definition(s):

HOSTAGE - A person(s) held as leverage against the station to ensure that demands will be met by the station.

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

HOSTILE ACTION - An act toward SPS or its personnel that includes the use of violent force to destroy equipment, take HOSTAGES, and/or intimidate the licensee to achieve an end. This includes attack by air, land, or water using guns, explosives, PROJECTILES, vehicles, or other devices used to deliver destructive force. Other acts that satisfy the overall intent may be included. Hostile action should not be construed to include acts of civil disobedience or felonious acts that are not part of a concerted attack on SPS. Non-terrorism-based EALs should be used to address such activities (i.e., this may include violent acts between individuals in the OWNER CONTROLLED AREA).

OWNER CONTROLLED AREA - The entire area contiguous to the PLANT PROTECTED AREA, owned by the Company and designated to be controlled for security reasons.

PROJECTILE - An object directed toward a Nuclear Power Plant that could cause concern for its continued operability, reliability, or personnel safety.

PLANT PROTECTED AREA - An area encompassed by physical barriers and to which access is controlled. The Plant Protected Area refers to the designated security area around the reactor and turbine buildings to which access is strictly controlled by the Plant Security Force.

Basis:

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 204 of 251 Attachment 1: Emergency Action Level Technical Bases This IC addresses unanticipated conditions not addressed explicitly elsewhere but that warrant declaration of an emergency because conditions exist which are believed by the SEM to fall under the emergency classification level description for a GENERAL EMERGENCY.

Reference(s ):

1. NEI 99-01 HG7

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 205 of 251 Attachment 1: Emergency Action Level Technical Bases Category M - System Malfunction EAL Group: Hot Conditions (RCS temperature > 200°F); EALs in this category are applicable only in one or more hot operating modes.

Numerous system-related equipment failure events that warrant emergency classification have been identified in this category. They may pose actual or potential threats to plant safety.

The events of this category pertain to the following subcategories:

1. Loss of Emergency AC Power Loss of emergency plant electrical power can compromise plant safety system operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of onsite and offsite power sources for 4160V emergency buses.

2. Loss of Vital DC Power Loss of emergency plant electrical power can compromise plant safety system operability including decay heat removal and emergency core cooling systems which may be necessary to ensure fission product barrier integrity. This category includes loss of power to or degraded voltage on the 125V DC vital buses.

3. Loss of Control Room Indications Certain events that degrade plant operator ability to effectively assess plant conditions within the plant warrant emergency classification. Losses of indicators are in this subcategory.

4. RCS Activity During normal operation, reactor coolant fission product activity is very low. Small concentrations of fission products in the coolant are primarily from the fission of tramp uranium in the fuel clad or minor perforations in the clad itself. Any significant increase from these base-line levels (2% - 5% clad failures) is indicative of fuel failures and is covered under the Fission Product Barrier Degradation category. However, lesser amounts of clad damage may result in coolant activity exceeding Technical Specification limits. These fission products will be circulated with the reactor coolant and can be detected by coolant sampling.

5. RCS Leakage The reactor vessel provides a volume for the coolant that covers the reactor core. The reactor pressure vessel and associated pressure piping (reactor coolant system) together provide a barrier to limit the release of radioactive material should the reactor fuel clad integrity fail. Excessive RCS leakage greater than Technical Specification limits indicates potential pipe cracks that may propagate to an extent threatening fuel clad, RCS and containment integrity.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 206 of 251 Attachment 1: Emergency Action Level Technical Bases

6. RPS Failure This subcategory includes events related to failure of the Reactor Protection System (RPS) to initiate and complete reactor trips. In the plant licensing basis, postulated failures of the RPS to complete a reactor trip comprise a specific set of analyzed events referred to as Anticipated Transient Without Scram (ATWS) events. For EAL classification, however, A TWS is intended to mean any scram failure event that does not achieve reactor shutdown. If RPS actuation fails to properly result in reactor shutdown, positive control of reactivity is at risk and could cause a threat to fuel clad, RCS and containment integrity.

7. Loss of Communications Certain events that degrade plant operator ability to effectively communicate with essential personnel within or external to the plant warrant emergency classification.

8. Containment Failure Failure of containment isolation capability (under conditions in which the containment is not currently challenged) warrants emergency classification. Failure of containment pressure control capability also warrants emergency classification.

9. Hazardous Event Affecting Safety Systems Various natural and technological events that result in degraded plant safety system train performance or significant VISIBLE DAMAGE warrant emergency classification under this subcategory.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 207 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 1 - Loss of Emergency AC Power Initiating Condition: Loss of all offsite AC power capability to emergency buses for 15 minutes or longer EAL:

MU1.1 NOLIE Loss of all offsite AC power capability, Table M-1, to Unit () 4160V emergency buses H and J for;;:: 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table M-1 AC Power Sources Offsite:

Unit 1

Reserve Station Service Transformer A

Reserve Station Service Transformer C

Station Service Buses back-fed via Main Transformer (if already aligned)

Unit 2

Reserve Station Service Transformer B

Reserve Station Service Transformer C

Station Service Buses back-fed via Main Transformer (if already aligned)

Onsite:

EOG 1

EOG2

EOG 3

AAC (SBO) Diesel Generator Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

None Basis:

Table M-1 provides a list of offsite AC electrical power sources credited for this EAL.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 208 of 251 Attachment 1: Emergency Action Level Technical Bases Unit () 4160V emergency buses Hand J are the essential buses (ref. 1).

This IC addresses a prolonged loss of offsite power. The loss of offsite power sources renders the plant more vulnerable to a complete loss of power to AC emergency buses. This condition represents a potential reduction in the level of safety of the plant.

For emergency classification purposes, "capability" means that an offsite AC power source(s) is available to the emergency buses, whether or not the buses are powered from it.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of offsite power.

Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off the line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.) However, since it takes longer than 15 minutes to align the station service bus backfeed, the backfeed must be "already aligned" to credit it as an AC power source.

The normal or preferred source of power to the Unit ( ) 4160V emergency buses H and J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EDG 1, EDG 2 and EDG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1 , 2).

The Unit () 4160V emergency buses are powered from transfer buses as follows:

Transfer bus D provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1H and Unit 2 emergency bus 2J.

4160V emergency bus 1H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EDG 1 (EDG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus D (F)

AAC diesel (1 J only) via transfer bus D

EDG 3

4160V emergency bus 1 H (2H) via the crosstie breaker

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 209 of 251 Attachment 1: Emergency Action Level Technical Bases The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1 J and 2H) via the D and E transfer buses during a station blackout. The AAC diesel generator automatically starts following the loss of either transfer bus D or E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power.

Escalation of the emergency classification level would be via IC MA 1.

Reference( s):

1. UFSAR Figure 8.3-1

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator- Emergency Operations"

4. NEI 99-01 SU1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 210 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 1 - Loss of Emergency AC Power Initiating Condition: Loss of all but one AC power source to emergency buses for 15 minutes or longer EAL:

MA1.1 Alert AC power capability, Table M-1, to Unit () 4160V emergency buses Hand J reduced to a single power source for~ 15 min. (Note 1)

AND Any additional single power source failure will result in loss of all AC power to SAFETY SYSTEMS Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table M-1 AC Power Sources Offsite:

Unit 1

Reserve Station Service Transformer A

Reserve Station Service Transformer C

Station Service Buses back-fed via Main Transformer (if already aligned)

Unit 2

Reserve Station Service Transformer B

Reserve Station Service Transformer C

Station Service Buses back-fed via Main Transformer (if already aligned)

Onsite:

EOG 1

EOG 2

EOG 3

AAC (SBO) Diesel Generator Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 211 of 251 Attachment 1: Emergency Action Level Technical Bases Definition(s):

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related* (as defined in 10CFRS0.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

Table M-1 provides a list of offsite and onsite AC electrical power sources credited for this EAL.

Unit () 4160V emergency buses Hand J are the essential buses (ref. 1).

This IC describes a significant degradation of offsite and onsite AC power sources such that any additional single failure would result in a loss of all AC power to SAFETY SYSTEMS. In this condition, the sole AC power source may be powering one, or more than one, train of safety-related equipment. This IC provides an escalation path from IC MU1.

An "AC power source" is a source recognized in AOPs and EOPs, and capable of supplying required power to an emergency bus. Some examples of this condition are presented below.

A loss of all offsite power with a concurrent failure of all but one emergency power source (e.g., an onsite diesel generator).

A loss of all offsite power and loss of all emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being back-fed from the unit main transformer.

A loss of emergency power sources (e.g., onsite diesel generators) with a single train of emergency buses being fed from an offsite power source.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of power.

Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off the line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.) However, since it takes longer than 15 minutes to align the station service bus backfeed, the backfeed must be "already aligned" to credit it as an AC power source.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 212 of 251 Attachment 1: Emergency Action Level Technical Bases The normal or preferred source of power to the Unit () 4160V emergency buses Hand J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EOG 1 , EOG 2 and EOG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1, 2).

The Unit () 4160V emergency buses are powered from transfer buses as follows:

Transfer bus D provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1Hand Unit 2 emergency bus 2J.

4160V emergency bus 1 H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EOG 1 (EOG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus D (F)

AAC diesel (1 J only) via transfer bus D

EOG 3

4160V emergency bus 1H (2H) via the crosstie breaker The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1 J and 2H) via the D and E transfer buses during a station blackout. The AAC diesel generator automatically starts following the loss of either transfer bus D or E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power.

Escalation of the emergency classification level would be via IC MS1.

This hot condition EAL is equivalent to the cold condition EAL CU2.1.

Reference(s):

1. UFSAR Figure 8.3-1

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator - Emergency Operations"

4. NEI 99-01 SA1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 213 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 1 - Loss of Emergency AC Power Initiating Condition: Loss of all offsite power and all onsite AC power to emergency buses for 15 minutes or longer EAL:

MS1.1 Site Area Emergency Loss of all offsite and all onsite AC power to Unit ( ) 4160V emergency buses H and J for 2: 15 min. (Notes 1, 15)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 15: For this EAL credit can be taken for any AC power source that has sufficient capability to operate equipment necessary to maintain a safe shutdown condition provided it can be aligned within the 15 minute classification criteria.

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 . . Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

For this EAL credit can be taken for any AC power source that has sufficient capability to operate equipment necessary to maintain a safe shutdown condition, such as FLEX generators, provided it can be aligned within the 15 minute classification criteria.

Unit ( ) 4160V emergency buses H and J are the essential buses (ref. 1).

This IC addresses a total loss of AC power that compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink.

In addition, fission product barrier monitoring capabilities may be degraded under these

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 214 of 251 Attachment 1: Emergency Action Level Technical Bases conditions. This IC represents a condition that involves actual or likely major failures of plant functions needed for the protection of the public.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off the line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.)

The normal or preferred source of power to the Unit () 4160V emergency buses Hand J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EOG 1, EOG 2 and EOG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1, 2).

The Unit () 4160V emergency buses are powered from transfer buses as follows:

Transfer bus O provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1H and Unit 2 emergency bus 2J.

4160V emergency bus 1H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EOG 1 (EOG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus O (F)

AAC diesel (1 J only) via transfer bus 0

EOG 3

4160V emergency bus 1H (2H) via the crosstie breaker The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1J and 2H) via the O and E transfer buses during a station blackout. The AAC diesel generator automatically starts following the loss of either transfer bus Dor E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 215 of 251 Attachment 1: Emergency Action Level Technical Bases Escalation of the emergency classification level would be via ICs RG1, FG1 or MG1.

This hot condition EAL is equivalent to the cold condition EAL CA2.1.

Reference(s):

1. UFSAR Figure 8.3-1"

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator- Emergency Operations"

4. NEI 99-01 SS1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 216 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M -System Malfunction Subcategory: 1 - Loss of Vital AC Power Initiating Condition: Prolonged loss of all offsite and all onsite AC power to emergency buses EAL:

MG1 .1 General Emergency Loss of all offsite and all onsite AC power to Unit ( ) 4160V emergency buses H and J AND Core Cooling-RED Path conditions met Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

For this EAL credit can be taken for any AC power source that has sufficient capability to operate equipment necessary to maintain a safe shutdown condition, such as the FLEX generators.

This IC addresses a prolonged loss of all power sources to AC emergency buses that results in degraded core cooling. A loss of all AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink.

A prolonged loss of these buses will eventually lead to a loss of one or more fission product barriers. In addition, fission product barrier monitoring capabilities may be degraded under these conditions.

The EAL threshold is based on meeting either CSFST Core Cooling Red Path criteria (ref. 4, 5):

Core Exit Thermocouple readings;;:: 1,200 °F.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 217 of 251 Attachment 1: Emergency Action Level Technical Bases

Core exit TCs are :?: 700°F with RCS subcooling based on core exit TCs s 30°F [85°F],

no RCPs are running, and RVLIS full range is s 46%

For extended loss of emergency bus AC power events that do not result in a breach of the RCS barrier, this EAL should require declaration of a General Emergency prior to meeting the thresholds for IC FG1. This will allow additional time for implementation of offsite protective actions.

The EAL will require a General Emergency declaration if the loss of AC power results in parameters that indicate an inability to adequately remove decay heat from the core.

Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off the line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.)

The normal or preferred source of power to the Unit ( ) 4160V emergency buses H and J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EOG 1, EOG 2 and EOG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1, 2).

The Unit ( ) 4160V emergency buses are powered from transfer buses as follows:

Transfer bus O provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1H and Unit 2 emergency bus 2J.

4160V emergency bus 1 H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EOG 1 (EOG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus O (F)

AAC diesel (1 J only) via transfer bus 0

EOG 3

4160V emergency bus 1H (2H) via the crosstie breaker The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1 J and 2H) via the O and E transfer buses during a station blackout. The AAC diesel generator automatically starts following the

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 218 of 251 Attachment 1: Emergency Action Level Technical Bases loss of either transfer bus Dor E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power.

Reference(s):

1. UFSAR Figure 8.3-1

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator- Emergency Operations"

4. F-2, "Core Cooling"

5. ( )-FR-C.1, "Response to Inadequate Core Cooling"

6. NEI 99-01 SG1

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 219 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all vital DC power for 15 minutes or longer EAL:

MS2.1 Site Area Emergency Indicated voltage is< 105 VDC on both vital 125 VDC battery buses ( )A AND ( )B for~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

There are two independent 125 volt DC systems for each unit.

Each system consists of 125 volt DC distribution panels and its respective battery and a battery charger which is part of the vital bus Uninterruptible Power Supply (UPS). Each unit has four UPSs and, therefore, four battery chargers. The batteries 1A, 1B, 2A, and 28) supply power only if the battery chargers fail or if the demand exceeds the capacity of the chargers.

The batteries are rated for a minimum of two hours. A battery terminal voltage of 105 volts DC is the minimum voltage required to ensure proper operation of equipment connected to the DC bus (ref. 1, 2).

This IC addresses a loss of vital DC power which compromises the ability to monitor and control SAFETY SYSTEMS. In modes above Cold Shutdown, this condition involves a major failure of plant functions needed for the protection of the public.

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

Escalation of the emergency classification level would be via ICs RG1, FG1 or MG1.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 220 of 251 Attachment 1: Emergency Action Level Technical Bases This hot condition EAL equivalent of the cold condition EAL CU4.1.

Reference(s):

1. ( )-AP-10.06, "Loss of DC Power"

2. UFSAR Section 8.4.4

3. NEI 99-01 SS8

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 221 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M -System Malfunction Subcategory: 2 - Loss of Vital DC Power Initiating Condition: Loss of all emergency AC and vital DC power sources for 15 minutes or longer EAL:

MG2.1 General Emergency Loss of all offsite and all onsite AC power to Unit () 4160V emergency buses Hand J for

~ 15 min. (Note 1)

AND Indicated voltage is < 105 voe on both vital 125 VDC battery buses ( )A AND ( )B for~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

Basis:

This IC addresses a concurrent and prolonged loss of both emergency AC and vital DC power.

A loss of all emergency AC power compromises the performance of all SAFETY SYSTEMS requiring electric power including those necessary for emergency core cooling, containment heat removal/pressure control, spent fuel heat removal and the ultimate heat sink. A loss of vital DC power compromises the ability to monitor and control SAFETY SYSTEMS. A sustained loss of both emergency AC and vital DC power will lead to multiple challenges to fission product barriers.

For this EAL credit can be taken for any AC power source that has sufficient capability to operate equipment necessary to maintain a safe shutdown condition, such as the FLEX generators.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 222 of 251 Attachment 1: Emergency Action Level Technical Bases Unit ( ) 4160V station service buses A, B and C can be supplied by the output of the main generator when the unit is on line (the normal supply), by the switchyard through the RSSTs and transfer buses when the unit is off the line (the standby supply), or by a backfeed lineup if the RSSTs or transfer buses are not available. (The backfeed lineup can be used to allow the station service buses to supply the emergency buses if the RSSTs are unavailable.)

The normal or preferred source of power to the Unit ( ) 4160V emergency buses H and J is the three Reserve Station Service Transformers (RSSTs) and the associated transfer buses, with an emergency source from diesel generators EOG 1, EOG 2 and EOG 3. The RSSTs are supplied by the 34.5 kV switchyard Buses 5 and 6. The RSSTs also supply power to the station service buses when the main generator is off the line (ref. 1, 2).

The Unit ( ) 4160V emergency buses are powered from transfer buses as follows:

Transfer bus D provides power to Unit 1 emergency bus 1J.

Transfer bus E provides power to Unit 2 emergency bus 2H.

Transfer bus F provides power to Unit 1 emergency bus 1H and Unit 2 emergency bus 2J.

4160V emergency bus 1 H (2H) can be powered from the following:

Transfer bus F (E)

AAC diesel (2H only) via transfer bus E

EOG 1 (EOG 2)

4160V emergency bus 1J (2J) via a crosstie breaker 4160V emergency bus 1J (2J) can be powered from the following:

Transfer bus D (F)

AAC diesel (1 J only) via transfer bus D

EOG 3

4160V emergency bus 1H (2H) via the cmsstie breaker The station is equipped with an Alternate AC (AAC) Diesel Generator System that provides a source of power to one emergency bus on each unit (1 J and 2H) via the D and E transfer buses during a station blackout. The AAC diesel generator automatically starts following the loss of either transfer bus Dor E in conjunction with a loss of transfer bus F. Procedural guidance allows the use of the AAC diesel generator to supply power to an emergency bus under station blackout and non-blackout conditions (ref. 3). If the AAC diesel generator is supplying power to an emergency bus of a unit that has lost all other sources of emergency AC power, the unit has not lost all 4160V AC power.

There are two independent 125 volt DC systems for each unit.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 223 of 251 Attachment 1: Emergency Action Level Technical Bases Each system consists of 125 volt DC distribution panels and its respective battery and a battery charger which is part of the vital bus Un interruptible Power Supply (UPS). Each unit has four UPSs and, therefore, four battery chargers. The batteries 1A, 1B, 2A, and 28) supply power only if the battery chargers fail or if the demand exceeds the capacity of the chargers.

The batteries are rated for a minimum of two hours. A battery terminal voltage of 105 volts DC is the minimum voltage required to ensure proper operation of equipment connected to the DC bus (ref. 4, 5).

Fifteen minutes was selected as a threshold to exclude transient or momentary power losses.

The 15-minute emergency declaration clock begins at the point when both EAL thresholds are met.

Reference(s):

1. UFSAR Figure 8.3-1

2. UFSAR Section 8.3

3. O-AP-17.06, "AAC Diesel Generator- Emergency Operations"

4. ( )-AP-10.06, "Loss of DC Power"

5. UFSAR Section 8.4.4

6. NEI 99-01 SG8

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 224 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer EAL:

MU3.1 NOLIE An UNPLANNED event results in the inability to monitor one or more Table M-2 parameters from within the Control Room for~ 15 min. (Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table M-2 Safety System Parameters

Reactor power

RCS level

RCS pressure

Core exit TC temperature

Level in at least one SG

Auxiliary feedwater flow to at least one SG Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

SAFETY SYSTEM-A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 225 of 251 Attachment 1: Emergency Action Level Technical Bases Basis:

Applicable safety system parameters are listed in Table M-2.

The Plant Computer System/Safety Parameter Display System (SPDS) serve as redundant indicators which may be utilized as compensatory measures in lieu of the Control Room indicators associated with safety functions (ref. 1, 2, 3).

This IC addresses the difficulty associated with monitoring normal plant conditions without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. This condition is a precursor to a more significant event and represents a potential degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRG event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for RCS water level cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via IC MA3.

Reference(s):

1. UFSAR Section 7.5, "Engineered Safeguards"

2. UFSAR Section 7.,8 "Computer System"

3. UFSAR Section 7.9, "Inadequate Core Cooling (ICC) System"

4. NEI 99-01 SU2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 226 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 3 - Loss of Control Room Indications Initiating Condition: UNPLANNED loss of Control Room indications for 15 minutes or longer with a significant transient in progress EAL:

MA3.1 Alert An UNPLANNED event results in the inability to monitor one or more Table M-2 parameters from within the Control Room for~ 15 min. (Note 1)

AND Any significant transient is in progress, Table M-3 Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Table M-2 Safety System Para

Reactor power

RCS level

RCS pressure

Core exit TC temperature

Level in at least one SG

Auxiliary feedwater flow to at least one SG Table M-3 Significant Transients

Automatic turbine runback > 25%

thermal reactor power

Electrical load rejection > 25% full electrical load

Reactor Trip

SI actuation Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 227 of 251 Attachment 1: Emergency Action Level Technical Bases Definition(s):

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

UNPLANNED - A parameter change or an event that is not 1) the result of an intended evolution or 2) an expected plant response to a transient. The cause of the parameter change or event may be known or unknown.

Basis:

Applicable safety system parameters are listed in Table M-2.

Significant transients are listed in Table M-3.

The Plant Process Computer System/Safety Parameter Display System (SPDS) serve as redundant indicators which may be utilized as compensatory measures in lieu of the Control Room indicators associated with safety functions (ref. 1, 2, 3).This IC addresses the difficulty associated with monitoring rapidly changing plant conditions during a transient without the ability to obtain SAFETY SYSTEM parameters from within the Control Room. During this condition, the margin to a potential fission product barrier challenge is reduced. It thus represents a potential substantial degradation in the level of safety of the plant.

As used in this EAL, an "inability to monitor" means that values for one or more of the listed parameters cannot be determined from within the Control Room. This situation would require a loss of all of the Control Room sources for the given parameter(s). For example, the reactor power level cannot be determined from any analog, digital and recorder source within the Control Room.

An event involving a loss of plant indications, annunciators and/or display systems is evaluated in accordance with 10 CFR 50.72 (and associated guidance in NUREG-1022) to determine if an NRC event report is required. The event would be reported if it significantly impaired the capability to perform emergency assessments. In particular, emergency assessments necessary to implement abnormal operating procedures, emergency operating procedures, and emergency plan implementing procedures addressing emergency classification, accident assessment, or protective action decision-making.

This EAL is focused on a selected subset of plant parameters associated with the key safety functions of reactivity control, core cooling and RCS heat removal. The loss of the ability to determine one or more of these parameters from within the Control Room is considered to be

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 228 of 251 Attachment 1: Emergency Action Level Technical Bases more significant than simply a reportable condition. In addition, if all indication sources for one or more of the listed parameters are lost, then the ability to determine the values of other SAFETY SYSTEM parameters may be impacted as well. For example, if the value for RCS water level cannot be determined from the indications and recorders on a main control board, the SPDS or the plant computer, the availability of other parameter values may be compromised as well.

Fifteen minutes was selected as a threshold to exclude transient or momentary losses of indication.

Escalation of the emergency classification level would be via ICs FS1 or RS1 Reference(s):

1. UFSAR Section 7.5, "Engineered Safeguards"

2. UFSAR Section 7.8, "Computer System"

3. UFSAR Section 7.9, "Inadequate Core Cooling (ICC) System"

4. NEI 99-01 SA2

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 229 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 4- RCS Activity Initiating Condition: RCS activity greater than Technical Specification allowable limits EAL:

MU4.1 NOLIE With letdown in service, Reactor Coolant Letdown Radiation Monitor CH-RI-( )18/19

> 1.0E+06 cpm Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, *4 - Intermediate Shutdown

> 500F only Definition(s ):

None Basis:

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications (ref. 1, 2). This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Per Engineering Calculation PA-0236, Rev. 0, Add. A, the threshold value is indicative of more than 10 µCi/cc DEl-131 full power accident mix. A monitor reading in excess of the threshold value 1.0E+06 cpm (value rounded and equivalent to 10 µCi/cc) indicates a challenge to the Technical Specification allowable limits for fuel clad degradation (ref. 1).

A portion of the letdown stream bypasses the demineralizers and flows through radiation monitors for CH-RI-( )18 and CH-RI-( )19 to detect fission product activity in the reactor coolant and warn of a potential fuel element failure (ref. 3).

Escalation of the emergency classification level would be via IC FA 1 or the Category R ICs.

Reference(s):

1. CALC PA-0236, Rev. 0, Add. A, "Post Accident Letdown Radiation Monitor Response for Surry"

2. Technical Specifications 3.1.D

3. SDBD-SPS-RM, "System Design Basis Document for Radiation Monitoring System Surry Power Station"

4. NEI 99-01 SU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 230 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: RCS activity greater than Technical Specification allowable limits EAL:

MU4.2 NOUE Dose rate at 1 ft. from an unpressurized RCS sample ~ Table M-4 Table M-4 Tech. Spec. Coolant Activity Dose Rates Time> Shutdown (hrs) mR/hr/ml S2 0.16

>2-S8 0.10

>8 0.05 Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, *4 - Intermediate Shutdown

> 500F only Definition(s):

None Basis:

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Per Engineering Calculation RA-0059 (ref. 1), dose rate is assumed to result from radioactive

iodines (1-131 thru 1-135) in RCS in concentrations corresponding to 60 µCi/gm DEl-131. This value corresponds to the Technical Specification coolant activity limit for iodine spike at full power operations (ref. 2). The values contained in Table M-4 (Tech. Spec. Coolant Activity Dose Rates) represent expected one foot dose rates per ml of sample based on time since reactor shutdown to the time when the sample is taken. The expected dose rate is a near linear relationship with the volume of the sample, so any volume collected can be determined by dividing the measured dose rate by the sample volume and comparing to the threshold value from Table M-4 for the applicable time frame. These dose rates assume no emergency core cooling system (ECCS) injection so there is no dilution credited which would vary coolant volume. Values in the table have been rounded for ease of use. The > 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months threshold is conservative up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months following reactor shutdown. After 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the expected response from radioactive iodine levels off. Therefore, the value shown for> 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months applies for all samples taken 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or more since reactor shutdown.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 231 of 251 Attachment 1: Emergency Action Level Technical Bases The values specified in Table M-4 were developed using a method to minimize error(+/-) for the threshold value within each defined time period. Values were chosen to minimize error from the highest to lowest dose rate within each range.

It should be noted that this EALs is primarily directed toward mechanical damage to the clad not involving inadequate core cooling (ICC) sequences. Clad damage due to ICC sequences is addressed by the fuel clad and CTMT fission product barrier thresholds (Category F).

Escalation of the emergency classification level would be via IC FA1 or the Category R ICs.

Reference(s):

1. RA-0059, "Detector Response to an RCS Sample for EAL Classification of Fuel Clad Degradation and Barrier Loss"

2. Technical Specifications 3.1.D

3. NEI 99-01 SU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 232 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 4 - RCS Activity Initiating Condition: Reactor coolant activity greater than Technical Specification allowable limits EAL:

MU4.3 NOUE Sample analysis indicates that a reactor coolant activity value is > any of the following Technical Specification 3.1.D limits:

Dose equivalent 1-131 > 1.0 µCi/gm for> 48 hrs

Dose equivalent 1-131 > 10 µCi/gm

Dose equivalent Xe-133 > 234 µCi/gm for> 48 hrs Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, *4 - Intermediate Shutdown

> SOOF only Definition(s):

None Basis:

This IC addresses a reactor coolant activity value that exceeds an allowable limit specified in Technical Specifications. This condition is a precursor to a more significant event and represents a potential degradation of the level of safety of the plant.

Escalation of the emergency classification level would be via ICs FA1 or the Category R ICs.

Reference(s):

1. Technical Specifications 3.1.D

2. NEI 99-01 SU3

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 233 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 5 - RCS Leakage Initiating Condition: RCS leakage for 15 minutes or longer EAL:

MU5.1 NOUE RCS unidentified or pressure boundary leakage > 10 gpm for~ 15 min.

OR RCS identified leakage > 25 gpm for~ 15 min.

OR Leakage from the RCS to a location outside containment > 25 gpm for ~ 15 min.

(Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

UNISOLABLE -An open or breached system line that cannot be isolated, remotely or locally.

Basis:

The 15-minute threshold duration allows sufficient time for prompt operator actions to isolate the leakage, if possible.

Once the RCS leak rate has been quantified to be greater than the specified value, failure to isolate the leak within 15 minutes, or if known that the leak cannot be isolated within 15 minutes, from the time of leak rate quantification, requires immediate classification.

This IC addresses RCS leakage which may be a precursor to a more significant event. In this case, RCS leakage has been detected and operators, following applicable procedures, have been unable to promptly isolate the leak. This condition is considered to be a potential degradation of the level of safety of the plant.

The first and second EAL conditions are focused on a loss of mass from the RCS due to "unidentified leakage", "pressure boundary leakage" or "identified leakage" (as these leakage types are defined in the plant Technical Specifications) (ref. 1, 2). The third condition addresses an RCS mass loss caused by an UNISOLABLE leak through an interfacing system.

These conditions thus apply to leakage into the containment, a secondary-side system (e.g.,

steam generatortube leakage) or a location outside of containment.

Unidentified leakage is all leakage (except RCP seal water injection or leak-off) that is not identified leakage. Pressure Boundary leakage is leakage (except SG leakage) through a non-

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 234 of 251 Attachment 1: Emergency Action Level Technical Bases isolable fault in an RCS component body, pipe wall, or vessel wall. Generally, leakage into closed systems, or leakage into the containment atmosphere from sources that are both specifically located and known either not to interfere with the operation of the unidentified leakage monitoring systems or not to be from a fault in the reactor coolant pressure boundary, are called identified leakages.

The leak rate values for each condition were selected because they are usually observable with normal Control Room indications. Lesser values typically require time-consuming calculations to determine (e.g., a mass balance calculation). The first condition uses a lower value that reflects the greater significance of unidentified or pressure boundary leakage.

The release of mass from the RCS due to the as-designed/expected operation of a relief valve does not warrant an emergency classification. An emergency classification would be required if a mass loss is caused by a relief valve that is not functioning as designed/expected (e.g., a relief valve sticks open and the line flow cannot be isolated).

Escalation of the emergency classification level would be via ICs of Category R or F.

Reference(s):

1. Technical Specification Section 1.0, "Definitions"

2. Technical Specification 3.1.C, "RCS Operational Leakage"

3. ( )-OPT-RC-10.0, Reactor Coolant Leakage - Computer Calculated"

4. ( )-OPT-RC-10.01, "Reactor Coolant Leakage - Manually Calculated"

5. ( )-AP-16.00; "Excessive RCS Leakage"

6. NEI 99-01 SU4

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 235 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor EAL:

MU6.1 NOUE An automatic trip did not shut down the reactor as indicated by reactor power~ 5% after any RPS setpoint is exceeded AND A subsequent automatic trip or manual trip (trip pushbuttons or manual turbine trip) are successful in shutting down the reactor as indicated by reactor power< 5% (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operation Definition(s):

IMMINENT - The trajectory of events or conditions is such that an EAL will be met within a relatively short period of time regardless of mitigation or corrective actions.

Basis:

This EAL addresses a failure of the RPS to initiate or complete an automatic reactor trip that results in a reactor shutdown (reactor power< 5%), and either a subsequent operator manual action taken at the reactor control consoles or an automatic trip is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Following the failure on an automatic reactor trip, operators will promptly initiate manual actions at the reactor control consoles to shut down the reactor (e.g., initiate a manual reactor trip using the reactor trip pushbuttons or manually tripping the main turbine). If these manual actions are successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems(< 5%).

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor trip using the reactor trip pushbuttons or manually tripping the main turbine). This action does not include manually driving in control rods or implementation of boron injection strategies.

Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

A reactor trip resulting from actuation of the ATWS Mitigation System Actuation Circuitry (AMSAC) logic is considered a successful subsequent automatic reactor trip for the purposes of this EAL (ref. 3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 236 of 251 Attachment 1: Emergency Action Level Technical Bases The plant response to the failure of an automatic trip will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC MA6.

Depending upon the plant response, escalation is also possible via IC FA 1. Absent the plant conditions needed to meet either IC MA6 or FA1, an NOUE declaration is appropriate for this event.

A reactor shutdown is determined consistent with CSFST Subcriticality Red path criteria (ref.

1). Because the power level threshold for subcriticality RED path (5%) is greater than the Power Operation operating mode transition power (2%), this EAL is only applicable in Mode 1.

Should a reactor trip signal be generated as a result of plant work (e.g., RPS setpoint testing),

the following classification guidance should be applied.

If the signal causes a plant transient that should have included an automatic reactor trip and the RPS fails to automatically shut down the reactor, then this IC and the EALs are applicable, and should be evaluated.

If the signal does not cause a plant transient and the trip failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

In the event that the operator identifies a reactor trip is IMMINENT and initiates a successful manual reactor trip before the automatic RPS trip setpoint is reached, no declaration is required. The successful manual trip of the reactor before it reaches its automatic trip setpoint or reactor trip signals caused by instrumentation channel failures do not lead to a potential fission product barrier loss. However, if subsequent manual reactor trip actions fail to shut down the reactor, the event escalates to the Alert under EAL MA6.1.

Reference(s):

1. F-1 Subcriticality

2. ( )-FR-S.1, "Response to Nuclear Power Generation/ ATWS"

3. UFSAR Section 7.2.2.2.12, "Turbine Trip Reactor Trip"

4. NEI 99-01 SUS

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 237 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 6 - RPS Failure Initiating Condition: Automatic or manual trip .fails to shut down the reactor EAL:

MU6.2 NOUE A manual trip did not shut down the reactor as indicated by reactor power~ 5%

AND A subsequent manual trip (trip pushbuttons or manual turbine trip) OR automatic trip is successful in shutting down the reactor as indicated by reactor power< 5% (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operation Definition(s ):

None Basis:

This EAL addresses a failure of a manual reactor trip that results in a reactor shutdown (reactor power< 5%), and either a subsequent operator manual action taken at the reactor control consoles or an automatic trip is successful in shutting down the reactor. This event is a precursor to a more significant condition and thus represents a potential degradation of the level of safety of the plant.

Depending upon several factors, the initial or subsequent effort to manually trip the reactor, or a concurrent plant condition, may lead to the generation of an automatic reactor trip signal. If a subsequent manual or automatic trip is successful in shutting down the reactor, core heat generation will quickly fall to a level within the capabilities of the plant's decay heat removal systems(< 5%) (ref. 1, 2).

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor trip using the reactor trip pushbuttons or manually tripping the main turbine). This action does not include manually driving in control rods or implementation of boron injection strategies.

Actions taken at back-panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

A reactor trip resulting from actuation of the ATWS Mitigation System Actuation Circuitry (AMSAC) logic is considered a successful subsequent automatic reactor trip for the purposes of this EAL (ref. 3).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 238 of 251 Attachment 1: Emergency Action Level Technical Bases The plant response to the failure of a manual reactor trip will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If subsequent operator manual actions taken at the reactor control consoles are also unsuccessful in shutting down the reactor, then the emergency classification level will escalate to an Alert via IC MA6.

Depending upon the plant response, escalation is also possible via IC FA1. Absent the plant conditions needed to meet either IC MA6 or FA1, an NOUE declaration is appropriate for this event.

A reactor shutdown is determined consistent with CSFST Subcriticality Red path criteria (ref.

1). Because the power level threshold for subcriticality RED path (5%) is greater than the Power Operation operating mode transition power (2%), this EAL is only applicable in Mode 1.

Should a reactor trip signal be generated as a result of plant work (e.g., RPS setpoint testing),

the following classification guidance should be applied.

If the signal causes a plant transient that should have included an automatic reactor trip and the RPS fails to automatically shut down the reactor, then this IC and the EALs are applicable, and should be evaluated.

If the signal does not cause a plant transient and the trip failure is determined through other means (e.g., assessment of test results), then this IC and the EALs are not applicable and no classification is warranted.

Reference(s):

1. F-1, "Subcriticality"

2. ( )-FR-S.1, "Response to Nuclear Power Generation/ ATWS"

3. UFSAR Section 7.2.2.2.12, "Turbine Trip Reactor Trip"

4. NEI 99-01 SU5

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 239 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Automatic or manual trip fails to shut down the reactor and subsequent manual actions taken at the reactor control consoles are not successful in shutting down the reactor EAL:

MA6.1 Alert An automatic or manual trip did not shut down the reactor as indicated by reactor power

~5%

AND Subsequent automatic or manual trip actions (trip pushbuttons or manual turbine trip) are not successful in shutting down the reactor as indicated by reactor power;:: 5% (Note 8)

Note 8: A manual trip action is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core, and does not include manually driving in control rods or implementation of boron injection strategies.

Mode Applicability:

1 - Power Operation Definition(s):

None Basis:

This IC addresses a failure of the RPS to initiate or complete an automatic reactor trip or failure of a manual reactor trip that results in a reactor shutdown, and subsequent operator manual actions taken at the reactor control consoles to shut down the reactor are also unsuccessful. This condition represents an actual or potential substantial degradation of the level of safety of the plant. An emergency declaration is required even if the reactor is subsequently shutdown by an action taken away from the reactor control consoles since this event entails a significant failure of the RPS.

A manual action at the reactor control consoles is any operator action, or set of actions, which causes the control rods to be rapidly inserted into the core (e.g., initiating a manual reactor trip using the reactor trip pushbuttons or manually tripping the main turbine). This action does not include locally tripping reactor trip and bypass breakers, manually driving in control rods or implementation of boron injection strategies. If this action(s) is unsuccessful, operators would immediately pursue additional manual actions at locations away from the reactor control consoles (e.g., locally opening breakers). Actions taken at back panels or other locations within the Control Room, or any location outside the Control Room, are not considered to be "at the reactor control consoles".

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 240 of 251 Attachment 1: Emergency Action Level Technical Bases A reactor trip resulting from actuation of the ATWS Mitigation System Actuation Circuitry (AMSAC) logic is considered a successful subsequent automatic reactor trip for the purposes of this EAL (ref. 3).

The plant response to the failure of an automatic or manual reactor trip will vary based upon several factors including the reactor power level prior to the event, availability of the condenser, performance of mitigation equipment and actions, other concurrent plant conditions, etc. If the failure to shut down the reactor is prolonged enough to cause a challenge to the core cooling or RCS heat removal safety functions, the emergency classification level will escalate to a Site Area Emergency via IC MS6. Depending upon plant responses and symptoms, escalation is also possible via IC FS1. Absent the plant conditions needed to meet either IC MS6 or FS1, an Alert declaration is appropriate for this event.

It is recognized that plant responses or symptoms may also require an Alert declaration in accordance with the Category F ICs; however, this IC and EAL are included to ensure a timely emergency declaration.

A reactor shutdown is determined consistent with CSFST Subcriticality Red path criteria (ref.

1). Because the power level threshold for subcriticality RED path (5%) is greater than the Power Operation operating mode transition power (2%), this EAL is only applicable in Mode 1.

Reference(s):

1. F-1, "Subcriticality"

2. ( )-FR-S.1, "Response to Nuclear Power Generation/ ATWS"

3. UFSAR Section 7.2.2.2.12, "Turbine Trip Reactor Trip"

4. NEI 99-01 SAS

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 241 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 2 - RPS Failure Initiating Condition: Inability to shut down the reactor causing a challenge to core cooling or RCS heat removal EAL:

MS6.1 Site Area Emergency An automatic or manual trip did not shut down the reactor as indicated by reactor power 2:5%

AND All actions taken to shut down the reactor are not successful as indicated by reactor power 2: 5%

AND EITHER:

Core Cooling-RED Path conditions met

Heat Sink-RED Path conditions met Mode Applicability:

1 - Power Operation Definition(s):

None Basis:

This EAL addresses a failure of the RPS to initiate or complete an automatic or manual reactor trip that results in a reactor shutdown, all subsequent operator actions to manually shutdown the reactor are unsuccessful, and continued power generation is challenging the capability to adequately remove heat from the core and/or the RCS. This condition will lead to fuel damage if additional mitigation actions are unsuccessful and thus warrants the declaration of a Site Area Emergency.

Reactor shutdown achieved by use of other trip actions such as locally opening supply breakers, emergency boration, or manually driving control rods are also credited as a successful manual trip if reactor power is < 5% before indications of an extreme challenge to either core cooling or heat removal exist (ref. 1, 2, 3).

In some instances, the emergency classification resulting from this IC/EAL may be higher than that resulting from an assessment of the plant responses and symptoms against the Category F ICs/EALs. This is appropriate in that the Category F ICs/EALs do not address the additional threat posed by a failure to shut down the reactor. The inclusion of this IC and EAL ensures the timely declaration of a Site Area Emergency in response to prolonged failure to shut down the reactor.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 242 of 251 Attachment 1: Emergency Action Level Technical Bases A reactor shutdown is determined consistent with CSFST Subcriticality Red path criteria (ref.

1) .. Because the power level threshold for Subcriticality Red path (5%) is greater than the Power Operation operating mode transition power (2%), this EAL is only applicable in Mode 1.

A severe challenge to adequate core cooling is based on meeting the Core Cooling Red path criteria (ref. 4, 5):

Core Exit Thermocouple readings;:;: 1,200 °F.

Core exit TCs are ;:;: 700°F with RCS subcooling based on core exit TCs :5 30°F [85°F],

no RCPs are running, and RVLIS full range is :5 46%.

The severe challenge to RCS heat removal is based on meeting the Heat Sink Red path criteria of both of the following conditions existing (ref. 6, 7):

Narrow Range levels in all SGs < 12% [18%]

Total feedwater flow to SGs :5 350 gpm [450 gpm]

Escalation of the emergency classification level would be via IC RG1 or FG1.

Reference(s):

1. F-1, "Subcriticality"

2. ( )-FR-S.1, "Response to Nuclear Power Generation / A TWS"

3. ( )-E-0, "Reactor Trip or Safety Injection"

4. F-2, "Core Cooling"

5. ( )-FR-C.1, "Response to Inadequate Core Cooling"

6. F-3, "Heat Sink"

7. ( )-FR-H .1, "Response to Loss of Secondary Heat Sink"

8. NEI 99-01 SS5

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 243 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 7 - Loss of Communications Initiating Condition: Loss of all onsite or offsite communications capabilities EAL:

MU7.1 NOUE Loss of all Table M-5 onsite communication methods OR Loss of all Table M-5 State and local agency communication methods OR Loss of all Table M-5 NRC communication methods Table M-5 Communication Methods State/

System Onsite NRC Local Radio Communications System X Public Address and Intercom System X Private Branch Telephone Exchange (PBX) X X X Sound Powered Telephone System X Commercial Telephone System X X Automatic Ring Downs (ARD) X lnstaphone Loop X Dedicated NRC Communications X Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

None

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 244 of 251 Attachment 1: Emergency Action Level Technical Bases Basis:

This IC addresses a significant loss of on-site or offsite communications capabilities. While not a direct challenge to plant or personnel safety, this event warrants prompt notifications to State and local agencies and the NRG.

This IC should be assessed only when extraordinary means are being utilized to make communications possible (e.g., use of non-plant, privately owned equipment, relaying of on-site information via individuals or multiple radio transmission points, individuals being sent to offsite locations, etc.).

The first EAL condition addresses a total loss of the communications methods used in support of routine plant operations.

The second EAL condition addresses a total loss of the communications methods used to notify all State and local agencies of an emergency declaration. The State and local agencies referred to here are the Commonwealth of Virginia and local communities.

The third EAL addresses a total loss of the communications methods used to notify the NRG of an emergency declaration.

This hot condition EAL is equivalent to the cold condition EAL CUS.1.

Reference(s):

1. Surry Power Station Emergency Plan, Section 7.2, "Communications Systems"

2. UFSAR Section 7.7.1

3. NEI 99-01 SU6

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 245 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 8 - Containment Failure Initiating Condition: Failure to isolate containment or loss of containment pressure control EAL:

MUB.1 NOUE Any penetration is not closed within 15 min. of a VALID Phase 1, 2 or 3 isolation signal OR CTMT pressure > 23 psia with < one full train of CTMT depressurization equipment (Note 11) operating per design for~ 15 min.

(Note 1)

Note 1: The SEM should declare the event promptly upon determining that the time limit has been exceeded, or will likely be exceeded.

Note 11: One full train of containment depressurization equipment consist of one Containment Spray Subsystem and two Recirculation Spray Subsystems operating together.

Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition(s):

VALID - An indication, report, or condition, is considered to be valid when it is verified by (1) an instrument channel check, or (2) indications on related or redundant indicators, or (3) by direct observation by plant personnel, such that doubt related to the indicator's operability, the condition's existence, or the report's accuracy is removed. Implicit in this definition is the need for timely assessment.

Basis:

This EAL addresses a failure of one or more containment penetrations to automatically isolate (close) when required by an actuation signal. It also addresses an event that results in high containment pressure with a concurrent failure of containment pressure control systems.

Absent challenges to another fission product barrier, either condition represents potential degradation of the level of safety of the plant.

For the first condition, the containment isolation signal (Phase 1, 2 or 3) must be generated as the result of an off-normal/accident condition (e.g., a safety injection or high containment pressure); a failure resulting from testing or maintenance does not warrant classification. The determination of containment and penetration status - isolated or not isolated - should be made in accordance with the appropriate criteria contained in the plant APs and EOPs. The 15-minute criterion is included to allow operators time to manually isolate the required penetrations, if possible (ref. 1).

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 246 of 251 Attachment 1: Emergency Action Level Technical Bases The second condition addresses a condition where containment pressure is greater than the setpoint (23 psia) at which containment energy (heat) removal systems are designed to automatically actuate, and less than one full train of equipment is capable of operating per design.

The spray systems consist of two separate parallel Containment Spray Subsystems, each of 100 percent capacity, and four separate parallel Recirculation Spray Subsystems, each of 50 percent capacity. With one Containment Spray Subsystem and two Recirculation Spray Subsystems operating together (one full train of CTMT depressurization equipment), the spray systems are capable of cooling and depressurizing the Containment to 0.5 psig in less than 60 minutes and to subatmospheric pressure within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months following the Design Basis Accident (ref. 2, 3, 4). The combination of required pumps can be obtained from using equipment on either emergency busses H and J in order to meet the "one full train" requirement.

The 15-minute criterion is included to allow operators time to manually start equipment that may not have automatically started, if possible. The inability to start the required equipment indicates that containment heat removal/depressurization systems (e.g., containment sprays or

) are either lost or performing in a degraded manner.

This event would escalate to a Site Area Emergency in accordance with IC FS1 if there were a concurrent loss or potential loss of either the Fuel Clad or RCS fission product barriers.

Reference(s):

1. UFSAR Section 5.2, "Containment Isolation"

2. Technical Specifications Section 3.4, "Spray Systems"

3. F-5, "Containment"

4. ( )-FR-Z.1, "Response to High Containment Pressure"

5. NEI 99-01 SU7

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 247 of 251 Attachment 1: Emergency Action Level Technical Bases Category: M - System Malfunction Subcategory: 9 - Hazardous Event Affecting Safety Systems Initiating Condition: Hazardous event affecting SAFETY SYSTEMS needed for the current operating mode EAL:

MA9.1 Alert The occurrence of any Table M-6 hazardous event AND Event damage has caused indications of degraded performance on one train of a SAFETY SYSTEM needed for the current operating mode AND EITHER:

Event damage has caused indications of degraded performance to the second train of the SAFETY SYSTEM needed for the current operating mode

Event damage has resulted in VISIBLE DAMAGE to the second train of the SAFETY SYSTEM needed for the current operating mode (Notes 9, 10)

Note 9: If the affected SAFETY SYSTEM train was already inoperable or out of service before the hazardous event occurred, then emergency classification is not warranted.

Note 10: If the hazardous event only resulted in VISIBLE DAMAGE, with no indications of degraded performance to at least one train of a SAFETY SYSTEM, then this emergency classification is not warranted.

Table M-6 Hazardous Events

Seismic event (earthquake)

Internal or external FLOODING event

High winds or tornado strike

FIRE

EXPLOSION

Other events with similar hazard characteristics as determined by the Shift Manager/SEM Mode Applicability:

1 - Power Operation, 2 - Reactor Critical, 3 - Hot Shutdown, 4 - Intermediate Shutdown Definition{s):

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 248 of 251 Attachment 1: Emergency Action Level Technical Bases EXPLOSION - A rapid, violent and catastrophic failure of a piece of equipment due to combustion, chemical reaction or overpressurization. A release of steam (from high energy lines or components) or an electrical component failure (caused by short circuits, grounding, arcing, etc.) should not automatically be considered an explosion. Such events require a post-event inspection to determine if the attributes of an explosion are present.

FIRE - Combustion characterized by heat and light. Sources of smoke such as slipping drive belts or overheated electrical equipment do not constitute fires. Observation of flame is preferred but is not required if large quantities of smoke and heat are observed.

FLOODING - A condition where water is entering a room or area faster than installed equipment is capable of removal, resulting in a rise of water level within the room or area.

SAFETY SYSTEM - A system required for safe plant operation, cooling down the plant and/or placing it in the cold shutdown condition, including the ECCS. These are typically systems classified as safety-related (as defined in 10CFR50.2):

Those structures, systems and components that are relied upon to remain functional during and following design basis events to assure:

(1) The integrity of the reactor coolant pressure boundary; (2) The capability to shut down the reactor and maintain it in a safe shutdown condition; (3) The capability to prevent or mitigate the consequences of accidents which could result in potential offsite exposures.

VISIBLE DAMAGE - Damage to a SAFETY SYSTEM train that is readily observable without measurements, testing, or analysis. The visual impact of the damage is sufficient to cause concern regarding the operability or reliability of the affected SAFETY SYSTEM train.

Basis:

This IC addresses a hazardous event that causes damage to SAFETY SYSTEMS needed for the current operating mode. In order to provide the appropriate context for consideration of an ALERT classification, the hazardous event must have caused indications of degraded SAFETY SYSTEM performance in one train, and there must be either indications of performance issues with the second SAFETY SYSTEM train or VISIBLE DAMAGE to the second train such that the potential exists for this second SAFETY SYSTEM train to have performance issues. In other words, in order for this EAL to be classified, the hazardous event must occur, at least one SAFETY SYSTEM train must have indications of degraded performance, and the second SAFETY SYSTEM train must have indications of degraded performance or VISIBLE DAMAGE such that the potential exists for performance issues. Note that this second SAFETY SYSTEM train is from the same SAFETY SYSTEM that has indications of degraded performance; commercial nuclear power plants are designed to be able to support single system issues without compromising public health and safety from radiological events.

Indications of degraded performance addresses damage to a SAFETY SYSTEM train that is in service/operation since indications for it will be readily available. The indications of degraded performance should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 249 of 251 Attachment 1: Emergency Action Level Technical Bases VISIBLE DAMAGE addresses damage to a SAFETY SYSTEM train that is not in service/operation and that potentially could cause performance issues. Operators will make this determination based on the totality of available event and damage report information. This is intended to be a brief assessment not requiring lengthy analysis or quantification of the damage. This VISIBLE DAMAGE should be significant enough to cause concern regarding the operability or reliability of the SAFETY SYSTEM train.

An event affecting equipment common to two or more trains of a safety system (i.e., there are indications of degraded performance and/or VISIBLE DAMAGE affecting the common equipment) should be classified as an Alert under this EAL, as appropriate to the plant mode.

By affecting the functionality of multiple trains of a safety system, the loss of the common equipment effectively meets the two-train impact criteria that underlie the EALs and bases.

An event affecting a single-train safety system (i.e., there are indications of degraded performance and/or VISIBLE DAMAGE affecting the one train) would not be classified under this EAL because the two-train impact criteria that underlie the EALs and bases would not be met. If an event affects a single-train safety system, then the emergency classification should be made based on plant parameters/symptoms meeting the EALs for another IC. Depending upon the circumstances, classification may also occur based on SEM judgement.

An event that affects two trains of a safety system (e.g., one train has indications of degraded performance and the other VISIBLE DAMAGE) that also has one or more additional trains should be classified as an Alert under this EAL, as appropriate to the plant mode. This approach maintains consistency with the two-train impact criteria that underlie the EALs and bases and is warranted because the event was severe enough to affect the functionality of two trains of a safety system despite plant design criteria associated with system and system train separation and protection. Such an event may have caused other plant impacts that are not immediately apparent.

Escalation of the emergency classification level would be via IC FS1 or RS1.

This hot condition EAL is equivalent of the cold condition EAL CA6.1.

Reference(s):

1. EP FAQ 2016-002

2. NEI 99-01 SA9

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 250 of 251 Attachment 2 Safe Operation & Shutdown Rooms/Areas Tables R-2 & H-2 Bases

Background

NEI 99-01, Rev. 6, ICs AA3 and HA5 prescribe declaration of an Alert based on impeded access to rooms or areas (due to either area radiation levels or hazardous gas concentrations) where equipment necessary for normal plant operations, cooldown or shutdown is located.

These areas are intended to be plant operating mode dependent. Specifically the Developers Notes for AA3 and HA5 states:

The "site-specific list of plant rooms or areas with entry-related mode applicability identified" should specify those rooms or areas that contain equipment which require a manual/local action as specified in operating procedures used for normal plant operation, coo/down and shutdown. Do not include rooms or areas in which actions of a contingent or emergency nature would be performed (e.g., an action to address an off-normal or emergency condition such as emergency repairs, corrective measures or emergency operations). In addition, the list should specify the plant mode(s) during which entry would be required for each room or area.

The list should not include rooms or areas for which entry is required solely to perform actions of an administrative or record keeping nature (e.g., normal rounds or routine inspections).

Further, as specified in IC HA5:

The list need not include the Control Room if adequate engineered safety/design features are in place to preclude a Control Room evacuation due to the release of a hazardous gas.

Such features may include, but are not limited to, capability to draw air from multiple air intakes at different and separate locations, inner and outer atmospheric boundaries, or the capability to acquire and maintain positive pressure within the Control Room envelope.

SPS Table R-2 and H-2 Bases A review of station operating procedures identified the following mode dependent in-plant actions and associated areas that are required for normal plant operation, cooldown or shutdown:

In-Plant Actions (SPS) Safe Shutdown Area Modes Secure PG Isolation valves AB El 13' & El 27' 3 Ensure boron concentration for Cold Shutdown AB El 27' 3,4 Reactor Vessel OPMS Functional & Setpoint ESGR 4 Test Isolate SI Accumulators ESGR 4 Place RHR in service ESGR 4 Control Room ventilation systems have adequate engineered safety/design features in place to preclude a Control Room evacuation due to the external release of a hazardous gas (UFSAR Section 9.13.3.6). Therefore, the Control Room is not included in this assessment or in Table H-2.

Surry Power Station Units 1 and 2 Serial No.19-296 Emergency Action Level Technical Bases Document Docket No.: 50-280/281, 72-2/556 Enclosure 5 Page 251 of 251 Attachment 2 Safe Operation & Shutdown Rooms/Areas Tables R-2 & H-2 Bases Ref: 1-GOP-2.4, "Unit Cooldown, HSD to 351 °F" 1-GOP-2.5, "Unit Cooldown, 351 °F to Less Than 205°F" Table R-2 & H-2 Results Table R-2/H-2 Safe Operation & Shutdown Rooms/Areas Room/Area Mode Auxiliary Building El 13' 3 Auxiliary Building El 27' 3,4 ESGR 3

ML19249B774

Text

1.0 INTRODUCTION

4.0 REFERENCES

1.0 INTRODUCTION

4.0 REFERENCES

Background

Navigation menu

Search