ML20069L573

Application for TS Change Request 94-04-1 to License NPF-39, Re one-time Change Affecting AOT for Esws;Rhrsw;Spc;Sp Spray LPCI Modes of Rhrs;Cs Sys to Be Extended from 3 & 7 to 14 Days During Third Refueling Outage Scheduled Jan 1995

ML20069L573
Person / Time
Site:	Limerick
Issue date:	06/10/1994
From:	Hunger G PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML20069L575	List: ML20069L573 ML20069L582
References
NUDOCS 9406200083
Download: ML20069L573 (33)

Text

Etztlon Support Dspartment s '

z 1 y

l PECO ENERGY =fdha 965 Ches'erbrook Boutevard Wayne PA 19087-5691 r

l l

10CFR50.90 l

June 10, 1994 l l

l Docket No. 50-352 License No. NPF-39

U. S. Nuclear Regulatory Commission ATTN

Document Control Desk Washington, DC 20555

SUBJECT:

Limerick Generating Station, Unit 1 Technical Specifications change Request No. 94-04-1.

Gentlemen:

l PECO Energy Company is submitting Technical Specifications l (TS) Change Request No. 94-04-1, in accordance with 10CFR50.90, requesting a change to the TS (i.e., Appendix A) of Operating License No. NPF-39 for Limerick Generating Station (LGS), Unit 1.

This TS Change Request involves a one-time (i.e., temporary) change affecting the Allowed Outage Time (AOT) for the Emergency Service Water (ESW) System; Residual Heat Removal Service Water (RHRSW) System; the suppression Pool Cooling, the Suppression Pool Spray, and Low Pressure Coolant Injection modes of the Residual Heat Removal System; and Core Spray System to be extended from 3 and 7 days to 14 days during the LGS, Unit 2, third refueling outage scheduled to begin January, 1995. This proposed extended AOT will allow adequate time to install isolation valves and cross-ties on the ESW and RHRSW Systems to facilitate future inspections or maintenance.

The installation of unitization jumpers and valves on the ESW loops will allow for isolation of one loop of ESW from one unit while maintaining the operability of the remainder of that ESW loop to support operation on the other unit. The cross-ties will provide an operational alternative where either the ESW or RHRSW buried supply line can provide a common path for one loop of the ESW and RHRSW system. It will also provide the ability to isolate an RHRSW return line while I 9406200083 940610 f ph' PDR ADOCK 05000352 P PDR l' \

i

maintaining a return path to the spray pond. The isolated line can be drained for inspections or maintenance while maintaining the operability of the affected ESW and RHRSW loop.

Information supporting this TS Change Request is contained in Attachment 1 to this letter, and the proposed replacement pages for the LGS TS are contained in Attachment 2.

We request that, if approved, this TS change Request for LGS, Unit 1, be approved prior to January, 1995 and effective upon issuance.

If you have any questions, please do not hesitate to contact us.

Very truly yours,

,/ , liA (lbt, 1 G. A. Hunger, Jr.,

Director Licensing Section Attachments Enclosure cc: T. T. Martin, Administrator, Region I, USNRC (w/

attachments and enclosure)

N. S. Perry, USNRC Senior Resident Inspector, LGS (w/ attachments and enclosure)

R. R. Janati, PA Bureau of Radiological Protection (w/ attachments and enclosure)

s l

COMMONWEALTH OF PENNSYLVANIA  :

ss.

l COUNTY OF CHESTER  :

W. H. Smith, III, being first duly sworn, deposes and says:

That he is Vice President of PECO Energy Company, the Applicant herein; that he has read the enclosed Technical Specifications Change Request No. 94-04-1 "One-time (i.e., temporary) Extension of the Allowed Outage Time (AOT) for the Emergency Service Water (ESW) System; Residual Heat Removal Service Water (RHRSW) System; the Suppression Pool Cooling, the Suppression Pool Spray, and Low Prejoure Coolant Injection Modes of the Residual Heat Removal System; and Core Spray System to 14 days," for Limerick Generating Station, Unit 1, Facility Operating License No. NPF-39, and knows the contents thereof; and that the statements and matters set forth therein are true and correct to the best of his knowledge, information and belief.

l l

r 1 ^~Y ~~

77 Vice President Subscribed and sworn to before me this /d day of \);o 6 1994.

[L 64A.;_w/ '

CC/m U J Notary Public t*xanalseai Wayne H hyy PtfAc uJmeent%

Merreer,Pennsylvana Assocaton of tea r3

ATTACHMENT 1 LIMERICK GENERATING STATION UNIT 1 DOCKET NO.

50-352 LICENSE NO.

NPF-39 TECHNICAL SPECIFICATIONS CHANGE REQUEST NO. 94-04-1 "One-time (i.e., temporary) Extension of the Allowed Outage Time (AOT) for the Emergency Service Water (ESW) System; Residual Heat Removal Service Water (RHRSW) System; the Suppression Pool Cooling, the Suppression Pool Spray, and Low Pressure Coolant Injection Modes of the Residual Heat Removal System; and Core Spray System to 14 days."

Supporting Information for Changes - 28 PAGES

. PAGE 1 PECO Energy Company, licensee under Facility Operating License No.

NPF-39 for Limerick Generating Station (LGS) , Unit 1, requests that the Technical Specifications (TS) contained in Appendix A to the i operating License be amended, as proposed herein, to extend temporary the Allowed Outage Time (AOT) for the Emergency Service Water (ESW) System; Residual Heat Removal Service Water (RHRSW)

System; the Suppression Pool Cooling (SPC), the Suppression Pool Spray (SPS), and Low Pressure Coolant Injection (LPCI) modes of the Residual Heat Removal (RHR) System; and Core Spray (CS) System to 14 days during the LGS, Unit 2, third refueling outage scheduled to begin in January of 1995.

l The purpose of this TS Change Request is to allow the one-time l extension of AOTs for LGS Unit 1 while modifications are performed j concurrently on the 'B' loop of the Emergency Service Water (ESW) j System and the 'B' loop of the Residual Heat Removal Service Water 1 (RHRSW) System.

Discussion and Description of the Proposed Chances The RHRSW System consists of two independent supply and return l loops (i.e., Loops 'A' and 'B'), common to both units, with each  !

loop providing cooling water to the tube side (i.e., RHRSW System flow) of one heat exchanger on each unit. The cooling water originates from a common spray pond (i.e., Ultimate Heat Sink), is carried to the RHR heat exchangers through two physically separated buried RHRSW pipe lines which enter the building structure, below grade, into a common pipe tunnel, and return to the spray pond through two separated buried pipe lines. The ESW System consists of two supply loops (i.e., Loops 'A' and 'B'), common to both units, with each loop supplying coolant to select equipment during a Loss of Coolant Accident (LOCA) or Loss of Offsite Power (LOOP) I l

event. Like the RHRSW System, the coolant originates from the common spray pond, is carried to the equipment through two separated, buried ESW pipe lines which enter the building structure, below grade, into a common pipe tunnel. However, the ESW coolant is returned to the spray pond by combining with, and through the RHRSW return pipe lines.

The purpose for this TS Change Request is to support modifications which will improve the unit separation capability and serviceability of the ESW and RHRSW Systems. Modification P-00166 will install unitization jumpers and valves on the ESW loops. This will allow for isolation of one loop of ESW from one unit while maintaining the operability of the remainder of that ESW loop to support operation on the other unit. Modification P-00167 will install cross-ties between the ESW and RHRSW supply lines. This will allow for the use of either the ESW or RHRSW supply line to provide a common supply path for one of the ESW and RHRSW loops.

The unused supply line can then be drained for inspection or maintenance while maintaining the operability of the affected ESW and RHRSW loop. Modification P-00168 will install a cross-tie between the RHRSW 'A' and 'B' loop return lines to allow for the use of a common return path that will maintain the operability of both loops of RHRSW while one RHRSW return header is isolated.

l PAGE 2 The common portions of the ESW and RHRSW loops are unisolatable, and the use of multiple freeze seals and drain systems is necessary in order to install the piping and valves. The time required to establish multiple freeze seals, drain, install piping and valves and the subsequent system restoration dictates the need for these one-time TS changes. The modifications will be installed during the third, Unit 2, refueling outage, which is scheduled to begin in January of 1995.

PECO Energy proposes that TS 3.7.1.1, Action a.3, be revised to allow one subsystem of RHRSW (i.e., loop 'B') to be inoperable for 14 days and TS 3.7.1.2, Action a.3, be revised to allow one subsystem of ESW (i.e., loop 'B') to be inoperable for 14 days.

PECO Energy also proposes that the TS affecting two subsystems (i.e., 'B' and 'D') of the LPCI mode of RHR (TS 3.5.1), one loop (i.e., 'B') of the SPC mode of RHR (TS 3.6.2.3), one loop (i.e.,

'B') of the SPS mode of RHR (TS 3.6.2.2), and one subsystem (i.e.,

'B') of Core Spray (TS 3.5.1), be revised to allow them to be inoperable for the same 14 day period. In order to maintain compliance with TS 3.5.1, PECO Energy also proposes that the OPCON 3 portion of the TS 3.5.1 APPLICABILITY statement be amended to l allow, during the extend AOT period, for the alignment of the 'A' LPCI subsystem of the RHR system in the RHR shutdown cooling mode (SDC). In addition, three standby diesel generators (SDG), D14 on Unit 1 and D22, D24 on Unit 2, will also be inoperable for the 14 day period. However, the SDG requirements will not require a TS l change. These one-time extensions will be taken concurrently to 1 permit completion of the modifications and to allow continued l operation of Unit 1.

These proposed TS changes involve a one-time revision to extend the allowed outage time (AOT) for the ESW System, RHRSW System, and SPC mode of the RHR system from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days and to extend the AOT for the LPCI mode of the RHR system, the SPS mode of the RHR system, and CS System from 7 days to 14 days.

Finally, this request contains an administrative change to remove note "#" from Unit 1 TS page 3/4 7-1, which was in place to support work during the second, Unit 2, refueling outage, and is no longer valid.

Safety Asr.essment l These one-time TS changes are requested to allow adequate time during the Unit 2 refuel outage for the installation of the piping and isolation valves on the common ESW and RHRSW 'B' loops without a shutdown of Unit 1. Furthermore, approval of these TS changes is requested in order to install the isolation and cross-tie valves and thereby increase the availability of the ESW and RHRSW systems and minimize the need to invoke AOTs or request future one-time TS changes when maintenance or modifications on the affected portions of the ESW and RHRSW systems are planned.

l PAGE 3 The ESW and RHRSW systems each consist of two independent loops, common to both units (i.e., Loops 'A' and 'B'). The 'B' loop of a each system will be removed from service concurrently during the

! third, Unit 2, refueling outage. During these activities, LGS Unit 2 (i.e., refueling) will continue to comply with its applicable TS i by ensuring that the operable systems and components are supported l by the operable 'A' loops of ESW and RHRSW.

The following assumptions and compensatory measures have been specified as a bases of our proposal. A "special procedure" will be written for the control of this activity. Where appropriate, these items shall be included in the "special procedure."

1. The cooling water for the standby diesel generator (SDG),

D12, will be realigned from the 'B' loop of ESW to the ' A' loop j of ESW in order to maintain the operability of SDG D12. Even '

though a SDG D12 start will not automatically start either of the operable 'A' loop ESW pumps (i.e., OAP548 or OCP548), S DG D12 is considered to be operable. ASDG D12 isolated start will require a manual start of ESW loop 'A' or a manual trip of SDG D12. (For additional details, see Items b. and k2. in the following review of plant impacts) i 2. The 'A' loop of ESW return flow shall be aligned to the I operable RHRSW 'A' return header only. The ESW return valve (i.e., HV-11-011A) to the 'A' RHRSW return header will be verified open and blocked open prior to entering the extended AOT. The ESW return valve (i.e., HV-11-015A) to the 'B' RHRSW return header will be blocked closed. (See item b. In the following review of plant impacts)

3. A design basis change (i.e. modification) will be i implemented prior to the extended AOTs, such that the 'B' loop of ESW will not be required to support the operability of the Unit 1 High Pressure Coolant Injection (HPCI) system. (See item j e. in the following review of plant impacts) j 4. Unit 1 will be in Operational Condition (OPCON) 1, 2 or 3 '

4 during these extended AOTs. All TS required components, systems and subsystems not discussed will be maintained operable. The systems / equipment listed below will be verified to be operable prior to implementing the extended AOT and will be maintained operable for the duration of the extended AOTs.

Otherwise, the applicable TS will be followed. ,

1 If any of the following systems / components or their standby AC power supplies are declared inoperable, then the appropriate Technical Specification ACTION statements apply. l

'A' Loop ESW (including ESW Pumps 'A' & 'C')

'A' Loop RHRSW (including RHRSW Pumps 'A' & 'C')

Standby Diesel Generator (SDG) D11 SDG D12 '

SDG D13

l 1

t i . PAGE 4 SDG D21

! SDG D23 j Unit 1 'A' Loop Suppression Pool Cooling j- Unit 1 'A' Loop Suppression Pool Spray 4

Unit 1 'A' LPCI i Unit 1 'C' LPCI Unit 1 'A' Loop Core Spray l

Unit 1 HPCI 1 Unit 1 'A' CREFAS '

j Unit 1 A' H 2

/0 2

Analyzer 4 Unit 1 'A' Hydrogen Recombiner i Unit 1 'A' & 'G' Drywell Hydrogen Mixing' i

1 Not applicable if fans 1B1 and 1H1 are both operable.

i i 5. Unit 2 will be in OPCON 4, 5 or *.

6. It is intended that the Unit 1 suppression pool temperature i should be maintained low (i.e. , below 80*F) during the extended l AOTs. (See item f. in the following performed review of plant l impacts) i

7. Any equipment and/or systems that, if-removed from service, j would place the unit outside the bounds of the analysis

- described in LGS Updated Final Safety Analysis Report (UFSAR)

Section 6.2. will be required to be operable for the duration j of the proposed extended AOTs. (See item f. in the following j review of plant impacts) 1 8. Work on the 'B' RHRSW loop will not begin until the decay

heat generation rate of Unit 2 has been reduced to a level that will allow the removal of the Unit 2 'B' RHR Heat Exchanger from service per the guidance of procedure GP-6.2. (See item l f. in the following review of plant impacts)

! 9. Draining the Unit 2 reactor cavity will not occur until l RHRSW loop 'B' is returned to service or an alternate decay 3 heat removal method (e.g., core spray with MSRVs dumping to suppression pool) is available. ( See item f. in the following i review of plant impacts)

]

) 10. In order to maintain the full operability of the RHRSW and ESW 'A' loops to support Unit 1 operation, the Unit 1 SDG, D11

and D13, and the Unit 2 SDG, D21 and D23, must be maintained

operable. (See items kl. and k2. in the following review of j plant impacts) j 11. The 'B' hydrogen recombiner primary containment isolation valve pairs (i.e., HV-57-163/FV-DO-101B and HV-57-164/HV 169) must be maintained closed (i.e. , penetration isolated) in i order to avoid entering the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> ACTION statement in TS j 3.8.1.1 ACTION e.l. (See item q. in the following review of plant impacts) i

\

PAGE 5

12. The drywell unit coolers, 1BV212 and 1HV212, will have, if possible, their 1B1 and 1H1 fans operable (rather than the 1B2 and 1H2 fans) during the extended AOTs when the 'B' ESW loop is inoperable. It is intended to have the 1B1 and 1H1 fans operable, but it is not a requirement. (See item s. in the following review of plant impacts)

13. Appropriate compensatory measures will be taken as necessary to compensate for the decrease in the margin of safety resulting from the inoperable fire safe shutdown method equipment. (See item v. in the following review of plant impacts)

The ESW and RHRSW systems and their supported systems are designed with sufficient independence and redundancy such that the removal from service of a component and/or subsystem will not prevent the systems from performing their required safety function. Since removal of an ESW and a RHRSW loop from service is allowed by current Technical Specifications, then the main concern is the reduced margin of safety incurred by extending the affected AOTs.

Based on the support functions of the ESW and RHRSW systems, a review of the plant was performed to determine the impacts that the inoperable ESW and RHRSW 'B' loops would have on other systems.

The impacts were evaluated for each system as discussed below.

Single active failures are not postulated to occur during TS AOTs; however, since the selected TS AOTs are being extended beyond their normal limits, the impact of single failures is discussed to provide a better understanding of the impact that the removal of the 'B' loops of ESW and RHRSW have on the affected systems. As described below, the consequences of any postulated accident occurring on Unit 1 during the extended AOTs were found to be bounded by the previous analyses described in the LGS UFSAR.

a. RHRSW -- TS 3.7.1.1 ACTION a.3. provides for an AOT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with one RHRSW loop inoperable. The result of the inoperable RHRSW loop is to declare the 'B' RHR heat exchanger inoperable on each unit. This impacts the Unit 1 RHR modes of operation as described below in Item f.

The removal of the 'B' loop of RHRSW from service will also temporarily eliminate the ability of the RHRSW system from supporting a non-TS operation of the RHR system. The RHRSW 'B' loop is designed to be able to provide water to the RHR system as a backup source for post-accident containment spray and core flooding. The RHRSW supply to the RHR system is used for extreme emergency conditions when the RHR system cannot perform its cooling function.

The 'A' loop of RHR will be operable as discussed in item

f. below. Since this is a non-TS function, and the probability of needing this function during the extended AOTs is judged to be low, the loss of this function for fourteen days is considered to be acceptable.

l PAGE 6 l

The removal of RHRSW loop 'B' from service will also result in the RHRSW 'B' return header to the spray pond being inoperable. This header is also used by the 'A' and

'B' loops of ESW and the impact on the ESW system is evaluated in Item b. below.

i In addition, the inoperable RHRSW 'B' loop impacts the backup source of fuel pool makeup as discussed below in Item hl. The potential impacts on the RHRSW system due to the inoperable ESW loop 'B' and its associated SDG are evaluated in Item kl. below.

1

b. ESW -- TS 3.7.1.2 ACTION a.3. provides for an AOT of 72 l hours with one ESW loop inoperable. TS 3.7.1.2 ACTION a.3 l

also requires that all equipment aligned to the inoperable ESW loop be declared inoperable. This would normally include four SDG (i.e., D12, D14, D22 and D24), which provide standby AC power to safety-related equipment and are normally aligned and cooled by the 'B' loop of ESW. l However, since SDG D12 will be realigned to the 'A' loop ,

of ESW while the 'B' loop of ESW is inoperable, then SDG  !

, D12 will not be declared inoperable. The impact of the loss of cooling by ESW loop 'B' and the loss of standby AC power by SDG D14, D22 and D24 are described below in detail for all of the affected equipment and systems. The l potential impacts on ESW loop ' A' due to the inoperability  ;

of ESW loop 'B' and its associated SDG are evaluated in )

i Item k2. below.

With the 'B' RHRSW header inoperable, only the ' A' loop of I ESW will be impacted since the 'B' loop of ESW will already be out-of-service. The 'A' loop of ESW shall be aligned to the operable RHRSW 'A' return header only. l With only one RHRSW return header available, the 'A' ESW  ;

loop is not single failure proof. However, valve HV Olla is the only single active failure components in the ESW system which would have the potential for causing the complete failure of the 'A' loop of ESW during the extended AOT. The ESW return valve (i.e., HV-11-015A) to the 'B' RHRSW return header will be blocked closed. To  !

' assure the operability of the ' A' ESW loop, the ESW return j valve (i.e., HV-11-011A) to the 'A' RHRSW return header j will be verified open and blocked open prior to entering I the extended AOT. This will eliminate the possibility of a single active failure rendering 'A' ESW inoperable.

c. Standby Diesel Generators (SDG) - The D14, D22 and D24 SDG will be declared inoperable since the required ESW loop

'B' cooling to support their operation will not be available. D12 will be operable since the SDG will be realigned to ESW loop 'A'; however, with SDG D12 aligned to the loop 'A' of ESW, a SDG D12 start will not automatically start either of the operable 'A' loop ESW pumps (i.e., OAP548 or OCP548) supplying cooling water to SDG D12. SDG D12 will be considered to be operable, since

PAGE 7 following an accident and/or a LOOP an auto start of SDG D12 will coincide with an auto start of SDG D11, D13, D21 or D23. The auto start of any one of these SDG will ensure that at least one ESW pump in ESW loop 'A' will be started to support the emergency operation of the aligned SDG. However, if a Division 2 bus failure occurs during normal operation and ESW cooling water is not provided to SDG D12, then alarms would alert operators of the Division 2 failure or the lack of SDG D12 cooling. Operations personnel could then manually initiate the ESW loop 'A' pumps or manually trip SDG D12. This information will be noted in the Special Procedure which will provide guidance for operation personnel during the extended AOT.

Maintaining SDG D12 operable with ESW loop 'A' will support the operability of the Unit 1 HPCI system as discussed below in Item e. The Unit 2 SDG D21 and D23 must remain operable to support operation of the ' A' loops 4

of RHRSW and ESW as discussed below in Items kl. and k2.

TS 3.8.1.1 ACTION el. requires the verification of the operability of two train systems and their associated SDG to provide assurance that a loss of offsite power (LOOP) will not result in the complete loss of safety function when SDG are inoperable on either unit. If at least one train is fully operable (including its standby AC power sources), then the more restrictive AOT of either the AOT based on the number of inoperable SDG or the system AOT (i.e., if one of the system trains is inoperable), is applied. If at least one train is not fully operable, then an AOT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is applied along with the inoperable SDG AOT. The impact of the inoperable SDG is discussed below for each system. The standby AC power operability requirements for the common systems are addressed in the appropriate system TS ACTION statements and the potential impacts on these systems are also discussed below in Items kl. and k2.

d. Core Spray -- The removal of the 'B' ESW loop from service will remove the supply of cooling water to the Core Spray

'B' and 'D' pump room unit coolers; therefore, the 'B' loop of Core Spray must be declared inoperable. This impacts Emergency Core Cooling System (ECCS) capability as discussed below in Item f.

e. HPCI -- The removal of the 'B' ESW loop from service will remove the supply of cooling water to the HPCI pump room unit coolers. However, the design basis requirement for ESW loop 'B' to maintain the operability of the HPCI system will be eliminated, via a modification, prior to implementation of this change request, and the HPCI system will be operable in accordance with TS 3.5.1.c., and TS 1.25, definition of OPERABLE-OPERABILITY.

1 l

PAGE 8 l

The HPCI System is DC powered, with the exception of the I normally open containment isolation valves HV-55-1F003, HV-55-1F100, HV-1F002, HV-1F093 and HV-55-1F095. The j inoperability of the D14 SDG during a LOOP results in the l loss of the Division IV battery charger which would carry

the Division IV DC loads after four hours. This could result in the loss of power for the Division IV HPCI vertical board 10C647 (UFSAR Table 8.3-26) after four hours; however, loss of the vertical board does not affect the operability of HPCI.

In addition, inoperability of the D14 SDG also results in i unavailability of the standby AC power source for the HPCI

" inboard" containment isolation valves (i.e., HV-55-1F002 and HV-55-1F095) . With standby AC power unavailable to one valve on each penetration (i.e., X-11 and X-228),

continued operation with the isolation valves open is allowed by TS 3.8.1.1 ACTION e.1, as long as the

" outboard" containment isolation valves (i.e., HV 1F003, HV-55-1F100, and HV-1F093) remain operable and their associated SDG (i.e., D12) remains operable. If these conditions are not maintained, then the affected penetration would be required to be isolated within 72 l' hours and HPCI would be declared inoperable. However, if the operability of the outboard valves is maintained, then continued plant operation would be limited by the AOT of 30 days for one SDG inoperable (TS 3.8.1.1 ACTION a).

Therefore, the HPCI system can be maintained operable in accordance with the existing TS during the entire 14 day period that ESW loop 'B' and RHRSW loop 'B' are

, inoperable. The operability of HPCI will help to assure l that adequate core cooling will remain available as discussed below in Item f.

f. RHR -- The removal of the 'B' ESW loop from service will remove the supply of cooling water to the RHR 'B' and 'D' pump room unit coolers and to the 'B' and 'D' RHR pump motor oil coolers. Therefore, the 'B' and 'D' RHR pumps will be declared inoperable. This, along with the inoperability of the 'B' RHR heat exchanger (due to the inoperability of the 'B' RHRSW loop), impacts the various modes of RHR operation and emergency core cooling systems (ECCS) capability as discussed below.

ECCS CAPABILITY The removal of ESW loop 'B' from service will result in the inoperability of the 'B' Core Spray loop and the 'B' and 'D' LPCI loops. The removal of the RHRSW loop 'B' from service will not affect the capability of any of the

emergency core cooling system (ECCS) loops from injecting water into the reactor vessel. The Automatic l Depressurization System (ADS) is powered by the operable Division I and III DC battery systems which are backed up j

d

PAGE 9 after four hours by SDG D11 and D13, respectively. _ The i

availability of the DC powered ADS, which in itself is l single failure proof and is unaffected by this activity, assures that RHR and/or Core Spray can maintain adequate core cooling for all break sizes, even if HPCI is assumed to be unavailable. HPCI, loop 'A' of Core Spray, LPCI  !

loops 'A' and 'C' and ADS will remain operable to provide adequate core cooling following a non-ECCS pipe break, loss of coolant accident (LOCA). For an ECCS pipe break l

LOCA, the low pressure ECCS would not be single failure proof since a 'C' LPCI injection line break and a failure of Division 1 AC power would result in the loss of the 'A' core spray loop and LPCI loops 'A' and 'C'.

With or without applying the single failure criteria as

! described by UFSAR Section 6.3.1.1.2 to the available ECCS discussed above, the minimum ECCS combinations described l in UFSAR Table 6.3-3 are not met. However, since plant

! operation will be limited by the TS Limiting Condition for Operation (LCO), then the minimum ECCS requirements to be maintained are based on the General Electric Company ,

document, NEDO-24708A. This document, which has been t incorporated into UFSAR Section 6.3.1.1.2.o and 6.3.3.1, provides the analysis which concludes that either one LPCI pump or one Core Spray loop in conjunction with ADS, is adequate to re-flood the vessel and maintain core cooling in order to preclude fuel damage. For a large break LOCA, '

following two hours of LPCI injection, an alternate cooling path may be necessary for long term core cooling per General Electric Company document NEDC-30936P-A which has also been incorporated into LGS UFSAR Section 6.3.1.1.2.o and 6.3.3.1.- Plant procedures provide for this additional cooling capability.

1 l

Therefore, since the minimum ECCS to be maintained l operable during this extended AOT exceeds the minimums postulated in NEDO-24708A and NEDC-30936P-A and since a single failure is not required to be assumed during an AOT, then adequate core cooling capability will be maintained and the ECCS will adequately limit the consequences of an accident.

DECAY HEAT REMOVAL CAPABILITY l

The RHR heat exchangers provide methods of residual decay  ;

heat removal and suppression pool /drywell temperature  !

control. Residual decay heat removal is a normal shutdown cooling mode of operation when a unit is shutdown. Two l loops of the shutdown cooling mode of RHR (SDC) are required to be operable while in OPCON 3 (TS 3.4.9.1) with reactor vessel pressure less than the RHR cut-in permissive set point, in OPCON 4 (TS 3.4.9.2), and in OPCON 5 (TS 3.9.11.2) with irradiated fuel in the vessel and the water level less than 22 feet above top of the reactor vessel flange, otherwise an alternate method of

PAGE 10 decay heat removal is required to be demonstrated.

Unit 1 is expected to stay in OPCON 1. Therefore, these SDC mode of RHR TS would not be applicable to Unit 1. l' However, since there is a probability that Unit 1 might be forced to shutdown during the extended AOT period, the shutdown sequence and compliance with TS 3.4.9.1 must be evaluated. Upon entering OPCON 3 and while depressurizing to the RHR cut-in permissive set-point, the 'A' and 'C' RHR pumps would be maintained in their normal LPCI mode alignment. This would maintain the plant's level of compliance with the TS (as required for the extended AOTs) during OPCON 3.

The LPCI alignment would maintain the two operable LPCI subsystems (i.e., 'A' and 'C') for automatic operation.

The operable 'A' loop of suppression pool spray and the operable 'A' loop of suppression pool cooling would also be maintained operable since they could be aligned from l the control room if an accident were to occur. Once the RHR cut-in permissive set-point is reached, then TS 3.4.9.1 ACTION a. must be entered since only the 'A' SDC loop would be operable. The 'A' loop of SDC would be operable since it would be capable of being aligned from J the control room (except for system flushing) under normal shutdown conditions. The operability of alternate methods  ;

of decay heat removal would be demonstrated to meet the I requirements of TS 3.4.9.1 ACTION a. The alternate methods of decay heat removal that would be considered to meet TS 3. 4. 9.1 ACTION a. are covered by Procedure GP-6. 2.

However, an alternate method would only need to be put into operation if the 'A' loop of SDC became inoperable and if the operability of the 'A' SDC loop could not be l reestablished by implementing Off Normal Procedure ON-121.

When the 'A' loop of SDC is aligned, the 'A' loops of SPC l and SPS and the 'C' LPCI subsystem would remain operable.

However, the ' A' LPCI subsystem would be inoperable due to '

the closing of the pool suction valve HV-51-1F004A.

Therefore, during the extended AOT, if the plant is required to shutdown then one core spray and three LPCI subsystems will be inoperable, and the plant would be in a condition not addressed in TS 3.5.1 ACTIONS a.1 and b.5 as a result of aligning the operable 'A' LPCI subsystem for shutdown cooling. Therefore, we are proposing a change to add a note to TS 3.5.1. similar to the existing note "##" which permits alignment to SDC; however, it will specifically address the proposed configuration. Under these conditions, sufficient ECCS (i.e., LPCI subsystem

'C' and core spray subsystem 'A') and containment cooling capabilities are available should an accident occur since a single active failure would not have to be postulated.

If an accident does not occur, then the 'A' loop of SDC is sufficient for decay heat removal and achieving cold shutdown.

i .

PAGE 11 In OPCO'is 4 or 5, the 'A' and 'C' SDC loops, which both use the operable 'A' RHR heat exchanger, will be considered operable in accordance with LGS procedure GP-6.2. These loops will be operable with the 'B' ESW and RHRSW loops inoperable and will satisfy the Unit 1 .

shutdown cooling requirements in OPCONs 4 and 5, if j l

required.

The RHRSW system is manually operated and is not required j during the first ten minutes of an event (UFSAR Section  !

4 6.2.2.3). Long-term actions (i.e., greater than ten i I

minutes) will be affected to the extent that only the 'A' RHR heat exchanger will be operable for long-term decay heat removal. Long-term cooling requirements will be met by the operable Unit 1 'A' RHR heat exchanger and the ,

operable 'A' RHRSW loop in either the suppression pool spray (SPS) or suppression pool cooling (SPC) modes of i operation, as discussed below.

Decay heat removal for suppression pool /drywell ,

temperature control it. an accident mitigation function. l The RHR system supports this function by two modes of j operation, SPS and SPC, both of which utilize the RHR heat exchangers. TS 3.6.2.2 requires that two loops of the SPS mode of the RHR system be operable in OPCONs 1, 2 and 3.

The AOT for one inoperable loop of SPS is 7 days. The AOT for this LCO is proposed to be extended to 14 days. TS 3.6.2.3 requires that two loops of SPC mode of the RHR system be operable in OPCONs 1, 2 and 3. The AOT for one inoperable loop of SPC is 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The AOT for this LCO is also proposed to be extended to 14 days.

LGS UFSAR Section 6.2.2 states that one operable RHR heat exchanger is adequate for accident mitigation. Two cases with only one operable RHR heat exchanger are presented.

In the first case, the operable RHR heat exchanger is placed in service, in containment spray, while one LPCI pump and one Core Spray loop inject water into the vessel. '

In the other case, the RHR heat exchanger is placed in service with an associated RHR pump taking suction from

, the suppression pool and discharging to the vessel while another RHR pump (in LPCI mode of operation) and one Core Spray loop inject directly into the vessel. Both cases assume a LOOP and that the High Pressure Coolant Injection (HPCI) system is available for the entire accident. This analysis is for a rupture of a recirculation line and is the bounding event for similar occurrences. During the i extended AOT, there will be sufficient equipment available )

to operate in either one of these modes.  ;

1 Since one loop of RHRSW with two RHRSW pumps can mitigate l I

a Design Basis Accident (DBA) on one unit and support the

safe shutdown of the other unit, then the potential heat i removal demand from the operating unit and the shutdown unit, during the period that these temporary TS changes t

PAGE 12 will be in effect, is within the capacity of the single operable RHRSW 'A' loop.

During the third, Unit 2, refueling outage, work on the

'B' RHRSW loop will not begin until the decay heat generation rate of the Unit 2 has been reduced to a level 1 that will allow the removal of the Unit 2 'B' RHR Heat l Exchanger from service per the guidance of procedure GP-6.2. RHRSW loop 'A' may be in operation to support the '

shutdown cooling requirements of Unit 2. However, due to prior establishment of cold shutdown conditions, the reduction in decay heat generation and the ability to remove decay heat via the fuel pool, the heat removal demand on RHRSW for Unit 2 will be minimal. Draining the Unit 2 reactor cavity will not occur until RHRSW loop 'B' is returned to service or an alternate decay heat removal method (e.g. , core spray with MSRVs dumping to suppression pool) is available.

Therefore, by maintaining the Unit 1 'A' RHR heat exchanger and the 'A' RHRSW loop and associated equipment / systems operable during this period, the RHR and RHRSW system will be able to provide adequate decay heat removal, and the consequences of an accident will remain unchanged.

The following components (if they were to individually fail) would have the potential of completely preventing the Unit 1 RHR 'A' heat exchanger or the RHRSW 'A' loop from performing their safety functions (i.e., requiring use of the heat exchanger) on Unit 1 while RHRSW loop 'B' is removed from service. The RHRSW pumps are not included because one RHRSW pump would be sufficient for accident decay heat removal on Unit 1 the minimal heat load on Unit 2 is assumed to be removed via an alternate method (e.g.,

ESW loop 'A' makeup to the fuel pool).

RHR heat exchanger, RHR outlet valve:

HV-51-1F003A (normally open -

safety function )

open) l RHR heat exchanger, RHR bypass valve: i HV-C-51-1F048A (normally open -

safety function i i

throttled closed)

RHR heat exchanger, RHRSW inlet valve:

HV-51-1F014A (normally closed - safety function open)

RHR heat exchanger, RHRSW outlet valve:

HV-51-1F068A (normally closed - safety function ,

open throttled open) l RHRSW spray pond spray network A, inlet valve:

HV-12-032A (normally closed - safety function l I

open)

RHRSW spray pond spray network C, inlet valve:

HV-12-032C (normally closed - safety function open)

PAGE 13 The active failure of any Unit 2 components in the 'A' loop of RHRSW will only have the potential of preventing the Unit 2 RHR 'A' heat exchanger from performing its safety functions on Unit 2. The Unit 2 components will i not prevent the Unit 1 RHR 'A' heat exchanger or the RHRSW loop 'A' from performing their safety functions on Unit 1.

A review of LGS maintenance records, for both the 'A' and

'B' loops of the above RHRSW components, was performed to identify any occurrences of Unit 1 or common valves failing to operate on demand. The review involved the 1 conservative estimated total number of LGS RHRSW valve actuations and the total number of failures compared to a 1.18 % failure rate provided by LER summaries of U.S.

Nuclear Power Plants (i.e., NUREG/CR 1363). The review concluded that the components' failure rate to operate on demand was consistent with or less than the percentage rate (i.e., 1.18%) of expected failure for motor operated valves. In addition, this same percentage failure rate was applied to a probabilistic safety assessment (PSA) performed for the proposed extended AOTs where the increase in the Core Damage Frequency (CDF) was found not to be a significant increase in risk. Therefore, the probability of a malfunction of any of these valves preventing the Unit 1 'A' RHR heat exchanger or the RHRSW

'A' loop from performing their safety functions on Unit 1 is considered to be minimal.

The potential impacts on RHRSW loop 'A' by the inoperable ESW loop 'B' and its associated SDG are evaluated below in Item kl.

g. Reactor Core Isolation Cooling (RCIC) --

Since the 'A' loop of ESW supplies cooling water to the RCIC pump room's redundant unit coolers, then RCIC will be fully operable in accordance with TS 3.7.3. In addition, since RCIC is DC powered and the RCIC containment isolation valves (i.e., HV-49-1F007, HV-49-1F008, HV-49-1F076, HV-49-1F080 and HV-49-lF084) are powered from SDG Dll and D13, which are cooled by the 'A' loop of ESW, there is no impact due to the lack of ESW 'B' loop cooling to SDG D14. This ensures that sufficient reactor water inventory is maintained following vessel isolation or loss of feedwater to permit adequate core cooling. HPCI or ADS and low pressure ECCS will provide backup to RCIC as designed.

h. Reactor Enclosure Cooling Water (RECW) system -- The RECW system provides cooling water for miscellaneous reactor auxiliary plant equipment and is normally cooled by service water. The Unit 1 RECW heat exchangers can be provided with backup cooling from the 'B' loop of ESW during a loss of of fsite power (LOOP) . However, according to UFSAR section 9.2.8.3, the RECW has no safety-related function and is not required to be operable following a LOCA.

l e

PAGE 14 The RECW system has the capability to provide cooling to the safety-related fuel pool heat exchangers according to UFSAR Section 9.2.8.2. Accordingly, the ESW system ,

provides backup cooling to this equipment. However, this  !

is considered to be backup only and is not required for l safety as discussed in Item hl. below. Therefore, there  !

is no safety impact, due to the 'B' loop of ESW not providing backup cooling to the RECW heat exchangers, on ,

the systems or components required to mitigate accidents I or to safely shutdown.

hl. Fuel pool cooling -- The fuel pool cooling system is I normally cooled by service water. Normally in the event of a LOOP, the Unit 1 Fuel Pool Cooling and Cleanup (FPCC) system heat exchangers can be cooled by the RECW system (which in turn can be cooled by the 'B' loop of the ESW j system) or the RHR 'B' heat exchanger can be used to cool the Unit 1 spent fuel pool. During the extended AOTs, neither of these backups will be available. However, with i a complete loss of capability to w.nove heat from the Unit i 1 spent fuel pool using heat excadngers (i.e., spent fuel pool or RHR heat exchangers), the pool can be allowed to boil and the ESW 'A' loop may be used as makeup to l maintain the pool water level (UFSAR Section 9.1.3.2).

Since the makeup to the Unit 1 fuel pool is the 'A' loop of ESW and the ESW pumps 'A' and 'C' will be operable, then a single failure proof method of providing makeup that is accessible from outside of the Reactor Enclosure is available.

Makeup to the Unit 2 fuel pool will be available from the

'A' loop of RHRSW which requires access to the Reactor  ;

Enclosure. This is acceptable since Unit 2 will be in cold shutdown or in refueling and not subject to a DBA l LOCA that limits accessibility to the Reactor Enclosure. I I

Therefore, there is no impact due to the inoperable 'B' loop of ESW and the lack of ESW 'B' loop makeup capability (

to the Unit 1 fuel pool, affecting the systems or components required to mitigate accidents or to safely shutdown.

h2. Reactor recirculation pumps -- According to UFSAR Sections l 9.2.2.2 and 9.2.8.2, backup cooling to the recirculation pump seals can be provided by supplying ESW directly to the seals. However, this nonsafety-related ESW function is not allowed by plant procedures. Therefore, there is no impact, due to the inoperable 'B' loop of ESW and the lack of ESW 'B' loop backup cooling to the Unit i recirculation pump seals, affecting We systems or components required to mitigate accidents or to safely shutdown.

i. Turbine Enclosure Cooling Water (TECW) -- The TECW system provides cooling water for miscellaneous turbine plant equipment and is normally cooled by service water. The

PAGE 15 Unit 1 TECW heat exchangers can be provided with backup cooling from the 'A' loop of ESW during a loss of offsite power (LOOP). The ESW return line from the TECW heat exchanger to the spray pond via the RHRSW loop 'A' return line is also unaffected. The TECW pumps will remain capable of running following a LOOP since the TECW pumps' standby AC power is provided by SDG D11 and D12. In addition, according to UFSAR section 9.2.9.3, the TECW has no safety-related function and is not required to be operable following a LOCA. Therefore, there is no impact, due to the inoperable 'B' loop of ESW and the lack of ESW

'B' loop backup cooling to the Unit 1 TECW system, affecting the systems or components required to mitigate accidents or to safely shutdown.

j. Main Control Room (MCR) chillers and HVAC -- The 'B' MCR chiller requires cooling water from the 'B' ESW loop and therefore, the 'B' chiller will not function during these extended AOTs. In addition, the removal of the 'B' ESW loop from service will render SDG D14, standby AC power source for the 'B' MCR chiller and HVAC subsystem, inoperable. The MCR HVAC is fully redundant. The inoperability of only one of the redundant trains does not require the supported systems in the MCR to be declared inoperable. Continued operation is allowed by TS for an unlimited period of time as long as the temperature in the main control room is maintained below 85'F (TS SR 4.7.2a) .

If the 'B' MCR chiller /HVAC is out-of-service and a DBA or other event occurs with or without a LOOP, then the probability, that the required single failure will disable the operable ' A' MCR chiller or HVAC train or its operable SDG, is assumed to be negligible. Therefore, the MCR HVAC is assumed to fulfill its design function during the DBA or event and will support the systems that limit the consequences of the accident and/or support safe shutdown.

kl. Systems supporting RHRSW -- The RHRSW pumps are supported by the operation of SDG Dil, D12, D21 and D22. The removal of the 'B' ESW loop from service requires that SDG D22 be declared inoperable. There is no additional TS impact due to the RHRSW pump / diesel generator pairs that are inoperable since there are only two (i.e., SDG D12/ pump OBP506 and SDG D22/ pump ODP506) inoperable pairs.

TS 3.7.1.1 ACTION a.5 requires a 30 day AOT, which is bounded by the 14 day extension.

I The following RHRSW valve pairs were evaluated for the I potential impact on RHRSW and ESW due to inoperability of i ESW loop 'B' and the SDG, (i.e., D14, D22 and D24) l supported by that ESW loop.

l

e PAGE 16

• HV-12-017A and HV-12-017B (D11 & D12)

HV-12-034A and HV-12-034B (D11 & D12)

The above valves isolate the RHRSW 'A' return loop from the RHRSW 'B' return loop. Since both SDG D11 and D12 will be operable, then these valves will be capable of being operated as designed and RHRSW loop 'A' and ESW loop

'A' will not be impacted.

• HV-12-111 and HV-12-113 (D11 & D23)

• HV-12-112 and HV-12-114 (D11 & D23)

The above valves isolate the RHRSW loop 'A' lines to and from the Unit 1 cooling tower. Since both SDG D11 and D23 will be operable, then these valves will be capable of being operated as designed and RHRSW loop 'A' and ESW loop

'A' will not be impacted.

HV-12-211 and HV-12-213 (D12 & D24)

I HV-12-212 and HV-12-214 (D12 & D24)

The above valves isolate the RHRSW loop 'B' lines to and from the Unit 2 cooling tower. In this case, the inoperability of the D24 SDG only results in unavailability of the standby AC power source for one valve (i.e., HV-12-213 and HV-12-214) in each line.

However, since the 'B' loops of RHRSW and ESW will already be inoperable these valves will have no impact on safety.

The RHRSW system was designed with the capacity so that one loop of RHRSW with two pumps in operation and two spray networks can mitigate a DBA on one unit while supporting the safe shutdown of the other unit (UFSAR 9.2.3). In order to maintain the full operability of the RHRSW 'A' loop to support Unit 1 operation, the Unit 2 SDGs, D21 and D23, must be maintained operable, since SDG D21 powers RHRSW 'A' loop pump OCP506 and SDG D23 powers RHRSW 'A' loop valves HV-12-031C (winter by-pass), HV 032C (spray network 'C') and HV-12-003C ('C' pump pit sluice gate).

Therefore, RHRSW during the extended AOT can fulfill its design function during a DBA and limit the consequences of the accident.

k2. Systems supporting ESW -- The ESW pumps are supported by the operation of SDG D11, D12, D23 and D24. The removal of the 'B' ESW loop from service requires that SDG D24 be declared inoperable. There is no additional TS impact due to the ESW pump / diesel generator pairs that are inoperable since there are only two (i.e., SDG D12/ pump OBP548 and SDG D24/ pump ODP548) inoperable pairs. TS 3.7.1.2 ACTIONS

PAGE 17 a.4 and a.5 only require action when three or four pairs are inoperable.

The RHRSW valve pairs that required evaluation for their potential impact on ESW loop 'A' due to inoperability of ,

ESW loop 'B' and the SDG (i.e., D14, D22 and D24)  ;

supported by ESW loop 'B' were addressed in Item kl. l above. I 1

With the exception of the first ten minutes of a postulated DBA LOCA, the ESW system has sufficient capacity within one ESW loop, with one ESW pump in operation, to mitigate a DBA on one unit while supporting the safe shutdown of the other unit (UFSAR 9.2.2.3). Two ESW pumps may be required during the first ten minutes of a DBA LOCA since both loops of ESW must be operating in order to supply cooling water to support the operation of three RHR pumps. However, since Unit 2 will already be shutdown and since only the two Unit 1 RHR pumps cooled by ESW loop 'A' are operable, then one loop of ESW with one ESW pump will be adequate for the entire time. The adequacy of two RHR pumps was discussed in Item f. above.

In order to maintain the full operability of the 'A' ESW loop (including two ESW pumps) to support Unit 1 operation, Unit 1 SDG D11 and the Unit 2 SDG D23 must be maintained operable, since SDG D23 powers ESW loop 'A' pump OCP548.

Therefore, one loop of ESW during the proposed extended AOT can fulfill its design function during a DBA and limit the consequences of the accident.

1. Control Room Emergency Fresh Air System (CREFAS) -- The CREFAS does not require cooling water from ESW, and both subsystems of this two train system remain operable with ESW in an extended AOT. However, with the 'B' loop of ESW removed from service rendering SDG D14 inoperable, then one of the two required standby AC power sources (i.e.,

SDG D12 and D14) for the 'B' CREFAS subsystem is inoperable. Continued operation is allowed by TS for a limited period of time (i.e., 30 days). This AOT is not based on the CREFAS TS 3.7.2 Action statements (i.e., 7 days) but is based on the limitations imposed by TS 3.8.1.1 ACTION e. and based on TS 3.8.1.1 ACTION a. (AOT of 30 days) for one SDG inoperable.

If during this 30 day AOT, a DBA occurs without a LOOP, then the single failure criteria can be met since both CREFAS subsystems are functional. However, should a DBA along with a LOOP occur, the probability that a single failure will occur and disable the operable 'A' CREFAS train or its operable SDG, is assumed to be negligible due to the limited time of the AOT. Therefore, in either case, the CREFAS can fulfill its design function during a

i PAGE 18 DBA and limit the consequences of the accident. .

I

m. Standby Gas Treatment System (SGTS) -- The SGTS does not

' l require cooling water from ESW, and both subsystems of this two train system remain operable with ESW in an

! extended AOT. In addition, with the 'Bf loop of ESW

. removed from service rendering SDG D14 inoperable, the standby AC power sources (i.e., SDG D11 and D12) for both SGTS subsystems are operable. Therefore, the SGTS can fulfill its design functions during any DBA and limit the consequences of the accident.

. n. Reactor Enclosure Recirculation System (RERS) -- The RERS does not require cooling water from ESW, and both subsystems of this two train system remain operable with ESW in an extended AOT. In addition, with the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the standby AC power sources (i.e., SDG D11 and D12) for both RERS subsystems remain operable. Therefore, the RERS can ,

fulfill its design functions during a LOCA and limit the I consequences of the accident.

o. Standby Liquid Control (SLC) -- The SLC system does not require cooling water from ESW, and both trains of this two train system remain operable with ESW in an extended l AOT. In addition, with the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the standby AC power sources (i.e., SDG D11, D12 and D13) for all three SLC pumps and the standby AC power sources (i.e., SDG D11 and D12) for both non-pump SLC subsystems remain operable.

One of the two standby AC power sources (i.e. , SDG D13 and D14) for one of the SLC tank heaters is inoperable; however, the heaters are non-safeguard. TS 3.1.5 ACTION a.2 does not require that the heaters remain operable. TS 3.1.5 only requires action if the tank temperature is not maintained. Therefore, the SLC system can fulfill its design functions during a DBA and limit the consequences of the accident.

p. Hydrogen / Oxygen (H2

/0 2

) analyzers -- The 2H /0 2 analyzers do not require cooling water from ESW, and both trains of this two train system remain operable with ESW in an extended AOT. However, with the 'B' loop of ESW removed from service, rendering SDG D14 inoperable, the standby AC power source for the drywell H2 /02 analyzer subsystem is inoperable. Continued operation is allowed by TS for a limited period of time (i.e., 30 days). This AOT is not based on the H 2 /02 analyzers TS 3.3.7.5 ACTION statement (i.e., 7 days) but is based on the limitations imposed by TS 3.8.1.1 ACTION e. and based on TS 3.8.1.1 ACTION a.

(AOT of 30 days) for one SDG inoperable.

If during this 30 day AOT, a DBA occurs without a LOOP, then the single failure criteria can be met since both H2 /0 2 analyzer subsystems remain functional. However,

PAGE 19 should a DBA along with a LOOP occur, then the probability, that a single failure will occur and disable the operable suppression pool H2 /02 analyzer subsystem or its operable SDG, is assumed to be negligible due to the limited time of the AOT. Therefore, in either case, the H2/Oy analyzer system can fulfill its design functions during a DBA and limit the consequences of the accident.

q. Prinary Containment Hydrogen Recombiner System -- The hydrogen recombiners do not require cooling water from ESW; cooling water is provided by the 'A' and 'B' loops of .

RHR. However, since 'B' ESW is removed from service, the l

'B' RHR pump is inoperable, and the 'D' recombiner train  !

of this two train system is inoperable. Continued operation is allowed by TS for a limited period of time I (i.e., 30 days). The 30 day AOT is based on the recombiner TS 3.6.6.1 ACTION statement for one recombiner system inoperable. Stricter limitations due to the inoperable SDG D14 are not imposed by TS 3.8.1.1 ACTION e.1, since the 'A' recombiner and both of its associated SDG, D11 and D13, are operable. However, the AOT would be 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in accordance with TS 3.8.1.1 ACTION e.1 if either SDG D11 or D13 should become inoperable.

In addition, with the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the only standby AC power j source for the 'B' recombiner primary containment  !

isolation valves (i.e., HV-57-163 / FV-DO-101B and HV I 164 / HV-57-169) is inoperable. Therefore, if both valves l in either pair of these normally closed valves are open I concurrently, then the AOT would be 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in accordance i with TS 3. 8.1.1 ACTION e. l . However, the valve pairs will be maintained by having at least one valve in each pair closed in order to assure primary containment isolation capability for these penetrations during the extended AOT.

If during the 30 day AOT, a LOCA occurs with or without a i LOOP, then the probability, that a single failure will occur and disable the operable ' A' recombiner subsystem or either of its operable SDG, is assumed to be negligible due to the limited time of the AOT. This is supported by the fact that continued operation is allowed for 30 days (TS 3.6.6.1) with one recombiner system inoperable.

Therefore, the hydrogen recombiner system can fulfill its i design functions during a LOCA and limit the consequences of the accident.

r. Main Steam Isolation Valve Leakage Control (MSIVLC) -- The MSIVLC system does not require cooling water from ESW, and both subsystems of this two train system remain operable with ESW in an extended AOT. In addition, with the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the standby AC power sources (i.e., SDG D11 and D12) for both MSIVLC subsystems remain operable.

PAGE 20 Therefore, the MSIVLC can fulfill its design functions following a LOCA and limit the consequences of the accident.

s. Drywell Hydrogen mixing system --

The containment atmosphere mixing system function is accomplished by the operation of four of the eight drywell air unit coolers, each with one operable fan. The drywell air unit coolers do not require cooling water from ESW to perform this safety function, and all four subsystems of this system remain operable with ESW in an extended AOT. However, with the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the standby AC power sources for two of the eight fans (i.e., the 1B2 and 1H2 fans in the 'B' and 'H' coolers) are inoperable. Based on UFSAR Section 6.2.5.2.3, the mixing system only requires that, "at least one fan in each of two of the safety-related coolers (i.e., 1AV-212 or 1BV-212 and 1GV-212 or 1HV-212) continues to run after a LOCA." Therefore, by ensuring that the 1B1 and 1H1 fans of the 'B' and 'H' coolers are operable, then the mixing system would be fully operable and capable of tolerating a single failure (including the failure of any SDG) without a loss of the mixing system's safety function.

However, if the 1B2 and 1H2 fans of the 'B' and 'H' coolers are alone operable, the standby AC power source (i.e., SDG D14) for coolers 1BV-212 and 1HV-212 would be inoperable. Therefore, the mixing system would not be capable of tolerating a single failure without a loss of the mixing system's safety function. Continued operation is allowed by TS for a limited period of time (i.e., 30 days). The 30 day AOT is not based on the hydrogen mixing TS 3.6.6.2 ACTION statement (i.e., 30 days) but is based on the limitations imposed by TS 3.8.1.1 ACTION e. and based on TS 3.8.1.1 ACTION a. (i.e., AOT of 30 days) for one SDG inoperable.

If during this 30 day AOT, a LOCA occurs without a LOOP, then the single failure criteria can be met since both hydrogen mixing trains are functional. However, should a LOCA with a LOOP occur, then the probability that a single failure will occur, disabling either of the powered coolers (i.e., 1AV-212 or 1GV-212) or their operable SDG (i.e., either D11 or D13), is assumed to be negligible due to the limited time of the AOT. Therefore, in either case, the hydrogen mixing system can fulfill its design functions during a LOCA and limit the consequences of the accident.

t. Spray pond -- The spray pond pump house HVAC does not require cooling water from ESW, and this system remains operable with the ESW in an extended AOT. However, with the 'B' loop of ESW removed from service rendering SDG D24 inoperable, one of the standby AC power sources (i.e. , SDG

PAGE 21 D12 and D24) for the 'B' and 'D' spray pond HVAC is inoperable. However, the 'B' and 'D' fan cabinets only serve the 'B' ESW and RHRSW loops, which are already removed from service. The redundant 'A' and 'C' fan cabinets provide full capacity, and can fully support operation of the ' A' ESW and RHRSW loops assuming a single failure. These common systems are not subject to the requirements of TS 3.8.1.1 ACTION e. per Reference 4 or any other TS. Therefore, there is no safety impact due to the loss of standby AC power to the 'B' spray pond HVAC fan subsystems.

u. Safeguard Piping Fill System (SPFS) -- The SPFS does not require cooling water from ESW, and both trains of this two train system remain operable with ESW in an extended AOT. With the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the standby AC power sources (i.e., SDG D11 and D12) for both SPFS subsystems remain operable. Therefore, the SPFS can fulfill its design function and support the systems that limit the consequences of an accident. In addition, since the SPFS pumps and valves are provided with standby AC power by SDG D11 and D12, the SPFS can fulfill its design function to provide water to both feedwater lines following a l LOCA/ LOOP to prevent bypass leakage and limit the consequences of an accident. j

v. Fire protection -- The fire detection and the public l address (PA) systems are non-safeguard loads common to i both units but are not tripped from SDG D14 on a LOCA l (UFSAR Table 8.3-3). With the 'B' loop of ESW removed I from service rendering SDG D14 inoperable, the standby AC power source for these systems is inoperable. However, other backup systems are available and appropriate established actions will be taken when SDG D14 is inoperable.

The electric fire pump does not require standby AC power from any of the SDG and is backed up by the diesel driven fire pump. The fire suppression deluge and sprinkler systems are on the non-safeguard batteries 101D112 and 102D112 (UFSAR Figure 8.3-3). The associated battery chargers (i.e., D113) are tripped from SDG D14 on a LOCA but can be manually reloaded on to the bus. With the 'B' loop of ESW removed from service rendering SDG D14 inoperable, the standby AC power source for these non-safety related systems is unavailable. However, other backup power is available (batteries in the deluge release control panels) and appropriate actions will be taken when SDC D14 is inoperable.

The components that are relied upon for post-fire safe shutdown, and that are either inoperable or their standby AC power is inoperable, can be removed from service in accordance with current TS AOTs. In addition, a list was

s PAGE 22 compiled and an analysis was performed for " Rooms of Concern", which are those fire regions that, rely on one or more safe shutdown methods which would all be unable to safely shutdown the plant due to the inoperable loops of the ESW and RHRSW systems or the inoperable systems that ESW or RHRSW support. This analysis concluded that either the Rooms of Concern have a low combustible loading, and sufficient fire boundaries between adjacent areas or compensatory measures would be taken during the proposed extended AOT. These measures, will offset the increased risk of a fire event occurring during the fourteen day versus three day AOT period.

Therefore, the prcposed extended AOTs do not significantly affect the approved level of fire protection as described in UFSAR Appendix 9A (Fire Protection Evaluation Report).

w. Batteries and battery chargers -- By removing the 'B' loop of ESW from service, chilled water will not be available from the 'B' loop of the control enclosure chilled water system supporting the 'B' loop of the emergency switchgear and battery room HVAC (i.e., fan cabinet motor OBV118).

However, loss of one train of this redundant, non-TS support system does not require the supported systems (i.e., batteries and switchgear) to be declared inoperable.

In addition, with the 'B' loop of ESW removed from service, and SDG D14, D22 and D24 inoperable, the standby AC power sources for the Unit 1 and 2, Division 4 battery chargers, and the Unit 2 Division 2 battery chargers are inoperable. Without the ability to recharge these batteries during a LOOP, these batteries must only be relied upon for the initial four hours that the battery will maintain an adequate charge (UFSAR section 8.3.2.1.1.2). Based on a review of UFSAR Table 8.3-26, the loads on Unit 1 battery 1DD101 will either fulfill their safety function within four hours or are already inoperable. Based on UFSAR Tables 8.3-22, 23, 24 and 26, the Unit 2 batteries 2B1D101, 2B2D101 and 2DD101 do not support common system equipment that would be required to support Unit 1 (i.e., ESW or RHRSW). These Unit 2 batteries support Unit 2 systems that will either fulfill their safety function within four hours or that are already out-of-service or inoperable. Therefore, there is no safety impact due to the loss of standby AC power to the battery chargers. The DC power system can fulfill its design functions during a DBA and support the systems that limit the consequences of the accident.

x. Remote shutdown system (RSS) - By removing the 'B' loop of ESW from service, chilled water will not be available from the 'B' loop of the control enclosure chilled water system supporting the 'B' loop of the auxiliary equipment room HVAC (i.e., fan cabinet motor OBV114). However, loss of

PAGE 23 l

I one train of this redundant, non-TS, support system does l not require the supported RSS to be declared inoperable.

j Therefore, the RSS can fulfill its design functions and ,

l support the safe shutdown of the plant if required.

y. Non-safeguard SDG loads --

The non-safeguard equipment loads listed in UFSAR Table 8.3-9 can be manually loaded on to the SDG bus following a LOOP or a LOCA; however, since SDG D14 will be inoperable, we assume that these loads will not be fully functional following a IDOP or a LOCA. This is considered acceptable since the equipment is non-safeguard and are not accident mitigation systems.

The existing AOTs limit the amount of time that the plant can operate with certain equipment inoperable, where single failure criteria is still met. The minimum equipment required to mitigate the consequences of an accident and/or safely shutdown the plant will be operable or the plant will be shutdown.

Therefore, by extending certain AOTs and extending the assumptions concerning the combinations of events and single failures for the longer duration of each extended AOT, we conclude, based on the evaluations above, that at least the

[ minimum equipment required to mitigate the consequences of an l accident and/or safely shutdown the plant will still be operable during the extended AOT. Therefore, the consequences l

of an accident previously evaluated in the SAR will not be increased.

' l PAGE 24 Information Supportina a Findina of No Sionificant Hazards Consideration We have concluded that the proposed changes to the Limerick Generating Station, Unit 1, Technical Specifications, which will one-time (i.e. , temporary) extend the Allowed Outage Time ( AOT) for the Emergency Service Water (ESW) System; Residual Heat Removal Service Water (RHRSW) System; the Suppression Pool Cooling (SPC),

the Suppression Pool Spray (SPS), and Low Pressure Coolant Injection (LPCI) Modes of the Residual Heat Removal (RHR) System; and Core Spray (CS) System to 14 days do not involve a Significant Hazards Consideration. In support of this determination, an evaluation of each of the three (3) standards, ret forth in 10 CFR 50.92 is provided below.

1. The proposed Technical Specifications chances do not involve a sianificant increase in the probability or consecuences of an accident previously evaluated.

The proposed one-time TS changes will not increase the probability of an accident since it will only extend the time period that the 'B' ESW and RHRSW loops and the affected equipment can be out-of-service. The extension of the time duration that certain equipment is out-of-service has no direct physical impact on the plant. The proposed inoperable systems are normally in a standby mode while the unit is in OPCON 1 or 2 and are not directly supporting plant operation. Therefore, they can have no impact on the plant that would make an accident more likely to occur due to their inoperability.

During transients or events which require these systems to be operating, there is sufficient capacity in the operable loops to support plant operation or shutdown, in-so-much that failures that are accident initiators will not occur more frequently than previously postulated.

In addition, the consequences of an accident previously evaluated in the SAR will not be increased. With the 'B' loops of ESW and RHRSW inoperable, a known quantity of equipment is either inoperable or the equipment is not fully capable of fulfilling its design function under all design conditions due to certain support systems not being operable. Based on the support functions of the ESW and RHRSW systems, a review of the plant was performed to determine the impacts that the inoperable ESW and RHRSW 'B' loops would have on other systems.

The impacts were identified for each system, as discussed in the preceding Safety Assessment, and it was determined whether there were any adverse affects on the systems. It was then determined how the adverse affects would impact each system's design basis and overall plant safety. The consequences of any postulated accidents occurring on Unit 1 during this AOT extension was found to be bounded by the previous analyses as described , Ue SAR.

PAGE 25 The existing AOTs limit the amount of time that the plant can operate with certain equipment inoperable, where single failure criteria is still met. The minimum equipment required to mitigate the consequences of an accident and/or safely shutdown the plant will be operable or the plant will be shutdown.

Therefore, by extending certain AOTs and extending the assumptions concerning the combinations of events and single failures for the longer duration of each extended AOT, we conclude, based on the evaluations above, that at least the minimum equipment required to mitigate the consequences of an accident and/or safely shutdown the plant will still be operable during the extended AOT. Therefore, the consequences of an accident previously evaluated in the SAR will not be increased.

Therefore, these proposed one-time TS changes will not result in a significant increase in the probability or consequences of an accident previously evaluated.

2. The oronosed TS chances do not create the nossibility of a new or different kind of accident from any accident oreviously evaluated.

The proposed one-time TS changes will not create the possibility of a different type of accident since it will only extend the time period that the 'B' ESW and RHRSW loops and the affected equipment can be out-of-service. The extension of the time duration that certain equipment is out-of-service has no direct physical impact on the plant and does not create any new j accident initiators. The systems involved are either accident j mitigation systems, safe shutdown systems or systems that support plant operation. All of the possible impacts that the inoperable equipment may have on its supported systems were {

previously analyzed in the SAR and are the basis for the j present TS ACTION statements and AOTs. The impact of I inoperable support systems for a given time duration was previously evaluated and any accident initiators created by the inoperable systems was evaluated. The lengthening of the time duration does not create any additional accident initiators for the plant.

Therefore, the proposed one-time TS changes will not create the possibility of a new or different type of accident from any accident previously evaluated.

l

.. . ~ - . ~ . - . . . .. - . - - - .

PAGE 26

3. The oronosed TS chances do not involve a sianificant reduction in a marain of safety.

The ESW and RHRSW systems and their supported systems are designed with sufficient independence and redundancy such that the removal from service of a component / subsystem will not prevent the systems from performing their required safety functions. Since removal of an ESW and a RHRSW loop from service with one unit in operation and the other unit in a refueling outage is allowed by the current Technical Specifications, then the concern is the reduced margin of safety incurred by extending the affected AOTs.

The present ESW and RHRSW AOT limits were set to ensure that sufficient safety-related equipment is available for response to all accident conditions and that sufficient decay heat

! removal capability is available for a LOCA/ LOOP on one unit and simultaneous safe shutdown of the other unit. A slight reduction in the margin of safety is incurred during the proposed extended AOT due to the increased risk that an event could occur.in a fourteen day period versus a three or seven l day period. This increased risk is judged to be minimal due to the low probability of an event occurring during the extended AOT and based on the following discussion of minimum ECCS/ decay heat removal requirements. i l

The reduction in the margin of safety is not significant since i l the remaining operable ECCS equipment is adequate to mitigate the consequences of any accident. This conclusion is based on the information contained in documents NEDO-24708A and NEDC-30936-A. These documents describe the minimum requirements to successfully terminate a transient or LOCA initiating event (with scram), assuming multiple failures with realistic conditions and were used to justify certain TS AOTs per UFSAR

, sections 6. 3.1.1. 2. o and 6. 3. 3.1. The minimum requirements for short term response to an accident would be either one LPCI pump or one Core Spray loop in conjunction with ADS, which would be adequate to re-flood the vessel and maintain core cooling sufficient to preclude fuel damage. For long term I response, the minimum requirements would be one loop of RHR for l decay heat removal, along with another low pressure ECCS loop.

These minimum requirements will be met since implementation of the proposed TS changes will require the operability of HPCI, ADS, two LPCI subsystems (or'one LPCI subsystem and one RHR subsystem during decay heat removal) and one core Spray subsystem be maintained during the 14 day period.

In addition, measures will be taken prior to or during the proposed extended AOT for those fire regions that rely on one or more safe shutdown methods which would all be unable to safely shutdown the plant with inoperable loops of the ESW and

PAGE 27 RHRSW systems or the inoperable systems that ESW or RHRSW support. These measures will offset the increased risk of a fire event occurring in the vulnerable areas, during the fourteen day versus three day AOT period. Therefore, the proposed extended AOT does not adversely affect the approved level of fire protection as described in UFSAR Appendix 9A (Fire Protection Evaluation Report).

A special procedure will be written to administratively control the requirement to maintain the operability of specified components and implementation of any appropriate compensatory measures which are deemed necessary during the proposed AOT.

In addition, operations personnel are fully qualified by normal periodic training to respond to and mitigate a Design Basis Accident, including the actions needed to ensure decay heat removal while LGS Unit and Unit 2 are in the operational configurations described within this submittal. Accordingly, procedures are already in pl ace that cover safe plant shutdown and decay heat removal for situations applicable to those in the proposed AOTs.

A Probabilistic Safety Assessment (PSA) Study was performed for an ESW and RHRSW loop being out-of-service for 14 days on an operating unit. This analysis includes EDG D12 being aligned to 'A' ESW and HPCI and RCIC not requiring room cooling. No other deviations from the bounding assumptions used in the base PSA model were made. The Core Damage Frequency (CDF) 6 increased l by 2.7x10-6, f rom 5. llx10-6 / reactor-year to 7.8x10 / reactor-year. In absolute terms, this is not a significant increase in risk. In addition, the modifications to be installed during this proposed extended AOT will allow for future maintenance and inspections to be performed on the ESW and RHRSW loops without removing an entire loop from service, which will reduce risk in the future. For example, if the ESW loop unavailability, due to testing or maintenance, is reduced by half, the CDP will decrease by more than four percent. It will also minimize the potential need for future AOT extensions on these systems.

Therefore, the implementation of the proposed one-time TS changes will not involve a significant reduction in the margin of safety.

l l

l l

l

PAGE 28 1

Information Supportina an Environmental Assessment An Environmental Assessment is not required for the Technical Specifications changes proposed by this Change Request because the requested changes to the Limerick Generating Station, Unit 1, TE conform to the criteria for " actions eligible for categorical exclusion," as specified in 10CFR51.22 (c) (9) . The requested change j will have no impact on the environment. Tne proposed TS changes do not involve a Significant Hazards Consideration as discussed in the preceding safety assessment section. The proposed changes do not 3

involve a significant change in the types or significant increase in the amounts of any effluent that may be released offsite. In addition, the proposed TS changes do not involve a significant

. increase in individual or cumulative occupational radiation exposure.

Conclusion The Plant Operations Review Committee and the Nuclear Review Board have reviewed these proposed changes to the Limerick Generating Station, Unit 1, Technical Specifications, and have concluded that they do involve an unreviewed safety question; however, they do not involve a significant hazards consideration, and will not endanger the health and safety of the public.

l t

a l

J 4

ATTACHMENT 2 4

1 l

.i LIMERICK GENERATING STATION UNIT 1 DOCKET NO.

I 50-352 4 l LICENSE NO.

< NPF-39 TECHNICAL SPECIFICATIONS CHANGE REQUEST NO. 94-04-1 AFFECTED UNIT 1 PAGES j 3/4 5-1 3/4 5-2 3/4 6-15 3/4 6-16 3/4 7-1 3/4 7-3 l

l l

.