ML20081K971

Summary Description of Facility Changes,Tests & Experiments, Including Summary of Safety Evaluations Conducted at North Anna Station During 1994,per 10CFR50.59(b)(2)

ML20081K971
Person / Time
Site:	North Anna
Issue date:	12/31/1994
From:	Bowling M VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
95-146, NUDOCS 9503290367
Download: ML20081K971 (301)

Text

_

VINGINIA ELEcruic axn POWEH COMPANY RicunoNu,VIBOINTA 20261 March 27, 1995 United States Nuclear Regulatory Commission Serial No.95-146 Attention: Document Control Desk NAPS /JHL Washington, D. C. 20555 Docket Nos. 50-338 50-339 License Nos. NPF-4 NPF-7 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNIT NOS.1 AND 2

SUMMARY

OF FACILITY CHANGES. TESTS AND EXPERIMENTS Pursuant to 10 CFR 50.59 (b)(2), enclosed is a summary description of facility changes, tests and experiments, including a summary of the safety evaluations, that were conducted at North Anna Power Station during 1994.

If you have any questions, please contact us.

Very truly yours, M. L. Bowling, M nager Nuc!aar Licensing and Programs Enclosure cc: U. S. Nuclear Regulatory Commission Region ll 101 Marietta Street, N. W.

Suite 2900 Atlanta, Georgia 30323 Mr. R. D. McWhorter NRC Senior Resident inspector North Anna Power Station I

9503290367 941231 gog, ooocxoseo=e g6

1994 50.59 SAFETY EVALUATIONS REPORTAH.E TO THE NRC MODIFICATIONS (DESIGN CHANGE PACKAGES (DCP) AND ENGINEERING WORK REQUESTS (EWR))

DCP 85-48-3 DCP 93-282 DCP 89-041 DCP 94-007-DCP 89-041, Enclosures DCP 94-100 (93-SE-MOD-051) ,

DCP 90-12 DCP 94-104 DCP 91-014 DCP 94-115 (93-SE-MO[M28)

DC 91-129 DCP 94-119 DCP 91-174-3 DCP 94-144 DCP 92-236 DCP 94-146-1 (94-SE-MOD 44)

DC 92-273 (93-SE-MO[M40) DCP 94-151 (94-SE-MOD 019)

DC 92-290 DCP 94-155 (94-SE-MOD-018)

DC 92-292 DCP 94-176 (94-SE-MOD-030)

DC 92-293 DCP 94-179 DCP 92-302-1 DCP 9e-183 (93-SE-MOD-028)

DCP 92-305 (92-SE-MOD-056) DCP 94-184 (94-SE-MODO 60)

DCP 93-004 DCP 94-185 DCP 93-013 DCP 94-196 DCP 93-014 DCP 94-208 (94-SE-MOD-055)

D 93415 (93-SE-MOD-070) DCP 94-223 (94-SE-MO[M48)

DCP 93-016 DCP 94-231 (94-SE-MOD-054)

DCP 93-102 DCP 94-232 (94-SE-MODO 62)

DCP 93-122 (93-SE-MOD-013) DCP 94-242 DCP 93-123-1 (94-SE-MOD-003) DCP 94-246 (94-SE-MOD-061)

DCP 93-140 (93-SE-MOD-051) DCP 94-251 (94-SE-MODO 62)

DC 93-144 DCP 94-289 DC 93-147 EWR 88-271, X DCP 93-160 (94-SE-MOD-087) EWR 93-009 (93-SE-MOD 479)

DCP 93-161 (93-SE-MODOS6)

DCP 93-175 (93-SE-MOD-50)

DCP 93-180  :

DCP 93-200 (94-SE-MOD 020)

DCP 93-202 (94-SE-MOD-023)

DCP 93-205 (93-SE-MOD 075)

DCP 93-214 (94-SE-MO(M35)

DCP 93-231 (93-SE-MOD-066)

DCP 93-258 (94-SE-MOD-026)

DC 93-277

a m ---a ..c. - - -- - s a y 1994 50.59 SAFETY EVAWATIONS REPORTAEE.E TO THE NRC ABNORMAL STATUS 94-SE-AS-001

19fhuiL51 JUSTIFICATION FOR CONTINUED OPERATION 94-SE-JCO001 94-SE-JCO-001, Revision 1 94-SE-JCO-001, Revision 2 94-SE-JCO402 94-SE-JCO402, Revision 1 94-SE-JCO402, Revision 2 94-SE-JCOOO3 94-SE-JCO404

1 1

1994 50.59 SAFETY EVALUATIONS REPORTABW TO THE NRC JUMPERS 94-SE-JMP-001 94-SE-JMP-002 94-SE-JMP-003 94-SE-JMP-004 94-SE-JMP-005 94-SE-JMP-006 94-SE-JMP-007 94-SE-JMP-008 94-SE-JMP-009 94-SE-JMP-010 94-SE-JMP-011 94-SE-JMP-012  ;

94-SE-JMP-013 94-SE-JMP-014 94-SE-JMP-015 94-SE-JMP-016 94-SE-JMP-017 94-SE-JMP-018 94-SE-JMP-019 94-SE-JMP-020 94-SE-JMP-021 94-SE-JMP-022 94-SE-JMP-023 94-SE-JMP-024 94-SE-JMP-025 94-SE-JMP-026 a

fleUiOJ9JSAEED' E'/Al.UAIlONS_BEEETABLEIQJBELNBC TEMPORARY MODIFICATIONS 94-SE-TM-001 94-SE-TM402 94-SE-R4-003 '

94-SE-TM-004 94-SE-TM-005 94-SE-TTMX)6 94-SE-TM-007 94-SE-TM-008 94-SE-TM 009 94-SE-TM-010 94-SE-TM411 94-SE-TM-012 94-SE-TM-013 94-SE-TM-014 94-SE-TM-015 94-SE-TM-016 94-SE-TM-017

r 1994 50.59 SAFETY EVAL.UA'nONS REPORTABLE TO NE NRC PROCEDURE CHANGES 94-SE-PROC-001 94-SE-PROC-002 94-SE-PROC-003 94-SE-PROr 003, Revision 1 94-SE-PROr 004 94-SE-PROC-005 94-SE-PROC-006 94-SE-PROC-007 94-SE-PROC-008 94-SE-PROC-009 94-SE-PROC-010 94-SE-PROC-011 i 94-SE-PROC-012 94-SE-PROC-013 94-SE-PROC-014 94-SE-PROP 015 94-SE-PROC-015, Revision 1 94-SE-PROC-016 94-SE-PROC-017 94-SE-PROC-018 94-SE-PROC 018, Revision 1 94-SE-PROC-019 l

1994 50.59 SAFETY EVALUATIONS REPORTAELE TO mE NRC OTHERS 94-SE-OT-001 94-SE-OT-015 94-SE-OT-002 94-SE-OT-016 94-SE-OT-003 94-SE-OT-017 94-SE-OT-004 94-SE-OT-018  :

94-SE-OT-005 94-SE-OT-019  :

94-SE-OT-006 94-SE-OT-020 94-SE-OT-007 94-SE-OT021 94-SE-OT-008 94-SE-OT-022 94-SE-OT-010 94-SE-0T-023 94-SE-OT-010, Revision 1 94-SE-OT-024 94-SE-OT-010, Revision 2 94-SE-OT-025 94-SE-OT-011 94-SE-OT-026 94-SE-OT-011, Revision 1 94-SE-OT-027 94-SE-OT-012 94-SE-OT-028 94-SE-OT-013 94-SE-OT-029 94-SE-OT-014 94-SE-OT-030 94-SE-OT-015 94-SE-OT-031 94-SE-OT-016 94-SE-OT-032 94-SE-OT-017 94-SE-OT-033 94-SE-OT-018 94-SE-OT-034 '

94-SE-OT-019 94-SE-OT-035 94-SE-OT-020 94-SE-OT-036 94-SE-OT-021 94-SE-OT-036, Revision 1 94-SE-OT-022 94-SE-OT-037 94-SE-OT-023 94-SE-OT-038 94-SE-OT-024 94-SE-OT-039 94-SE-OT-025 94-SE-OT-040 94-SE-OT-026 94-SE-OT-041 94-SE-OT-027 94-SE-OT-042 94-SE-OT-028 94-SE-OT-043 ,

94-SE-OT-029 94-SE-OT-044 94-SE-OT-030 94-SE-OT-045 94-SE-OT-031 94-SE-OT-046 )

94-SE-OT-032 94-SE-OT-047 )

94-SE-OT-033 94-SE-OT-048 94-SE-OT-034 94-SE-OT-049 94-SE-OT-035 94-SE-OT-050 94-SE-OT-036 94-SE-OT-051 94-SE-OT-013 94-SE-OT-052 94-SE-OT-014 94-SE-OT-053 I

1994 50.59 SAFETY EVALUATIONS REPORTAELE TO THE NRC OTHERS 94-SE-OT-054 94-SE-OT-055 94-SE-OT-056 94-SE-OT-057 94-SE-0T-058 94-SE-OT-059 94-SE-OT-060 ,

l 94-SE-OT-061 94-SE-OT-062 I

1 1

DCP 85-48-3 SERVICE WATER t'NmMYCAL ADDITION MORTE AMMk UNITS 1 & 2 DESCRIPTION The corrosive nature of the lake water at North Anna had caused i internal corrosion of the Service Water system piping and the spray  !

array support system. Corrosion inhibitor chemicals had been used in attempts to treat the service water reservoir. During 1984,  !

Calgon Corporation developed a molybdate based corrosion inhibitor  :

used with a mild penetrant and microbiocide that proved effective j in the North Anna service water system. A temporary system was installed to store and inject makeup chemicals into the SW pump suction bays.

Although the temporary system provided satisfactory chemistry control, it was only designed and installed for short term use.  :

Questionable reliability, maintenance difficulties and housekeeping i concerns made long term use of the system impractical. The chemical treatment program could be improved by installation of a s permanent service water chemical addition system that would ensure l adequate means of controlling service water chemistry.

I Activity installed a new permanent chemical addition system to-replace the temporary system. The new system consisted of tanks,  :

pumps, piping, and instrumentation & controls that were housed in [

a new structure. The permanent chemical addition facility - was i designed with flexibility so that existing chemicals could be.

replaced with a more economical program if large amounts of  :

chemical makeup became necessary. l t

SUMMARY

OF SAFETY AMALYSIS j The modification did not constitute an unreviewed safety question as defined in 10CFR50.59 since it did not:

i A) Increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety .

and previously evaluated 3a UFSAR. ,

The new chemical addition system upgraded the SW chemical addition system which was currently in use. The piping tie-in to the SW supply headers was controlled as QA Category I, seismic Class I back through the second isolation valve which met or exceeded the existing system design. Construction was  ;

performed so as to not affect operation of the SW system. <

l I

Page 1 of 2 l

~ ~ ~ ~

l B) Create a possibility for an accident or malfunction of a different type than any evaluated previously in the UFSAR.- l The piping tie-in to the SW supply headers was QA category I, seismic class I back through the second isolation' valve. No other safety-related equipment was affected by the-modification. Single failure of one tie-in line would not ,

result in the loss of both redundant service water headers.

Construction was performed so as to not affect operation of the SW system.

C) Reduce the margin of safety as defined in the basis.of any Technical Specification. ,

The chemical addition system was not addressed in the -

Technical Specifications. The new chemical addition system did not reduce the margin of safety for the service water.

system. The piping tie-in incorporated double isolation and was seismically supported back through the isolation valves. i Failure or loss of the chemical addition system would not result in a decreased availability of the service water system. Tie-in to the Service water supply header was ,

performed within the Technical Specification limitations.

i l

i Page 2 of 2

,_.. - . . . . . = . - . .

.I DCP 89-041 i

RTD BYPASS LINE ELIMINATION- 1 NORTH ANNA UNIT 2 i

i DESCRIPTION i The Reactor Coolant System .(RCS) narrow range temperature measurement system used direct immersion Resistance Temperature Detectors (RTDs) installed in bypass lines. These lines were a- .

significant contributor to personnel ' radiation exposure due the' valves and manifolds which provided l l

configuration of piping, collection sites for corrosion products. j This modification removed the existing RCS narrow range temperature '

measurement system including associated piping, manifolds and valves and replaced it with a new system. The new system uses dual ,

element, thermowell mounted RTDs installed directly. in the RCS hot ,

and cold leg piping. The new RTDs were wired to the existing  ;

instrumentation cabinets for reactor protection and control.

Modifications to the protection and control circuitry were made to  !

provide for averaging the three hot leg temperatures in each RCS i loop and for providing a median signal select scheme for T-Average I and Delta-T control functions. i

SUMMARY

OF SAFETY ANALYSIS l This design change did not create an unreviewed safety question as ,

defined in 10 CFR 50.59. '

r A. The implementation of this modification did not increase the i probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously '

evaluated in the Safety Analysis Report.  !

The Safety Evaluation considered the following accidents and l malfunctions:

-Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power .

-Loss of External Electrical Load and/or Turbine Trip

-Excessive Heat Removal Due to Feedwater System l

+

Malfunctions

-Excessive Load Increase Incident l

-Major Secondary System Pipe Rupture i,

1 OF 3 1

l

1 DCP 89-041 These events were of interest because the Overtemperature Delta- Temperature (OTDT) reactor trip is one of the primary trips assumed in the safety analysis, with a total response time of 6 seconds. No Overpower Delta Temperature (OPDT) or low-low T-Average /high steam flow trips were assumed in the safety analysis. ,

The OTDT and OPDT reactor trips and low-low T-Average /high l steam flow safeguards actuation continue to function in a manner consistent with the existing analysis assumptions for these events. The total response time for the new system is equal to the response time of the old system, therefore, there is no increase in the consequences of the accidents or malfunctions considered.

There was no increase in the probability of occurrence of an accident or malfunction of equipment important to safety previously evaluated in the SAR. The events of interest are those initiated by a failure of those systems that use temperature inputs from the narrow range RTDs or could be initiated by a mechanical failure of the components affected by the change. There are three such events:

-Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power

-Excessive Load Increase Incident

-Major Secondary Pipe System Rupture The Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power is an event potentially initiated by a failure of the rod control system. The Excessive Load Increase Incident is potentially initiated by a failure of the steam dump control system. The inputs to these systems from the new narrow range RCS temperature measurement system is from isolated Delta-T and T-Average signals developed in the Reactor Protection System. The signals for each loop are sent to a Median Signal Select circuit in the Reactor Control System which ensures that only valid signals are used for reactor control functions. Accordingly, this design supports the criteria established in Section 4.7.3 of IEEE 279-1971 in that a single random failure within a channel will not cause a control system action resulting in a condition which requires protective action. The RTDs and signal processing cards used to develop and transmit the Delta-T and T-Average signals to the reactor control system have a reliability that equals or exceeds the reliability of the previous control grade instrumentation. The modification was implemented in a manner consistent with the plant design bases. As such there was no degradation in the performance of or increase in the potential number of challenges to equipment assumed to function during 2 OF 3

4 x i

'ii

]

~

.DCP 89-041.

an accident situation. Furthermore, there was no increase in -

the probability of failure or degradation in the performance of the systems designed to reduce the number of challenges to equipment assumed to function during these accident .

situations.

B. .The implementation of this modification did not create a possibility for an accident or a malfunction of a different type than any previously evaluated in the Safety Analysis l Report.

The modifications were performed in a manner consistent with applicable standards, preserved the existing design bases and did not impact the qualification of any plant systems. The  ;

installation of the median signal select circuitry precludes f adverse control and protection system interactions. The ,

design, installation and inspection of the new equipment was 7 done in accordance with ASME Boiler and Pressure Vessel Code  !

criteria. By adherence to industry standards, the pressure boundary integrity was preserved. I C. The implementation of this modification did not reduce the margin of safety as defined in the basis of any Technical Specification.

There was no reduction in the margin of safety as defined in ,

the bases of any technical specification:since the existing $

thermal / hydraulic design and evaluation remained bounding. l The applicable margins of safety are defined in the Basis of l Technical Specification 2.1 and UFSAR Chapter 4.4.1.1. These i state that the minimum value of the Departure from Nucleate. .

Boiling Ratio (DNBR) during normal operation and anticipated transients is 1.17. This value corresponds to a 95%

confidence level that DNB will not occur. The restrictions of' these fuel cladding integrity safety limits prevent overheating of the fuel and possible cladding perforation which would result in the release of fission products to the coolant. The minimum DNBR reported in the accident analyses was unaffected by the modification.

The Basis of Technical Specification 2.1.2 states that the safety limit on the maximum RCS pressure is 2735 psig. This safety limit protects the integrity of the RCS from overpressurization and thereby prevents the release of  ;

radionuclides contained in'the reactor coolant from reaching the containment atmosphere. The maximum RCS pressure reported in the accident analysis was unaffected by the modification.

l l

3 OF 3 l l

l

In order to' correct the problems identified above, it was necessary to replace.the existing- l I

security system with a new modern system. This new system was manufactured using state of the art components which are more reliable and easier to maintain than those that were in place.

Implementation of this design change included replacement of the alarm processing and access . j control computers with a modern integrated system performs both functions. New readers and l data' communication devices were provided which use existing security wiring and equipment enclosures to the extent that was practical. Additionally, consoles were provided in the Central Alarm Station (CAS) and Secondary Alarm Station (SAS) in order to ergonomically organize ,

equipment used by offers operating the system.

Also, performed under this Design Change was the installations of two new security lights-associated with the Station Blackout Project (see description below). This was done in an effort to better control the SAFEGUARDS INFORMATION involved with the design.

The installation of the alternate AC (AAC) system to comply with the requirements of 10CFR50.63 required the addition of a new building. This building houses the station blackout  !

. (SBO) diesel engine generator and it's support systems. The location for the SBO Building is '

west of the existing turbine building and north of the Auxiliary Boiler Room. The building was proposed as the preferred location by a type 2 report prepared jointly by Virginia Power and Stone and Webster. The NRC via Supplemental Safety Analysis approved this approach December 6,1991.  :

The location of the building, which was installed by DCP 92-010 and DCP 92-011, required the  !

relocation of an existing security light pole and the installation of a new security light.

r The modifications to the security lighting in this area required that safeguards material be issued !

to provide construction guidance to replace and relocate the existing pole and install a new pole.

To reduce the consequences of improperly controlling safeguards drawings, a change to this l existing safeguards DCP was the preferable method of controlling this modification. 5 Two new light poles complete with fixtures, fixture lowering mechanism and two foundations were added west of the Unit 2 Turbine Building to support the addition of the station blackout .

building. The existing light pole in this area was completely removed. This included the l foundation. -

SUMMARY

OF SAFETY ANALYSIS l This design change did not create an unreviewed safety question as defined in 10CFR50.59. The I initial security equipment installation evaluation was performed at a time when activity screening {

checklists were allowed for DCPs. The following excerpts come from that checklist:

A. Will this activity require a change to the Technical Specifications? Explain.

R

' No, a review of the Technical Specifications indicated there are no references to the Security System.

B. -Does this activity involve a temporary modification? Explain.

No, the design change being reviewed was a permanent change.

C. Does this activity involve a change, test, or experiment that may affect the environment? -

Explain.

No, the only testing to be performed by this design change .was to verify proper installation of non-safety related equipment. This design change did not propose any tests or experiments which had an environmental impact.

D. Does the change physically modify the facility as described in the Safety Analysis Report? Explain and indicate Safety Analysis Report documents / sections reviewed.

No, Sections 13.7 (" Industrial Security") and 3A.17 (" Protection Against Industrial Sabotage") were reviewed. No changes were made which modified the. plant as.

described in the SAR.

E. Does the change modify procedures, methods of operation, or alter a test or experiment as described in the Safety Analysis Report? Explain and indicate Safety Analysis Report reviewed.

No security related procedures, methods of operation, tests, or experiments are contained ~

in the SAR. Sections 13.7 and 3A.17 of the SAR were reviewed.

F. Does the change modify safety related structures, systems, equipment, or components not described in the Safety Analysis Report? Explain and indicate Safety Analysis Report documents / sections reviewed.

No safety related structures, systems, equipment, or components were modified by this design change.

G. Does the change perform a test or experiment that is not described in the Safety Analysis Report? Explain and indicate Safety Analysis Report documents / sections reviewed. i No, the purpose of this design change was to upgrade the North Anna Security System and not to perform any special tests or experiments as defined in VPAP-3001. The only testing to be performed by this design change was to verify proper installation of non-safety related equipment.

H. Will operation of another system that is described in the Safety arialysis Report be o.m sw

~_~~__.

(

6 adversely affected as a result of this change? Explain and indicate Safety Analysis Report documents / sections reviewed.

No, the security system does not interact with any other systems described in the SAR.

Sections 13.7 and #a.17 of the SAR were reviewed. >

The later installation'of the security light poles for the SBO building was reviewed using the  ;

Standard 50.59 format. The results as follows:

9 A change to the security lighting was required to install the new Station Blackout Building. This change required the excavation, installation, and removal oflighting foundations on the west side  :

of the Unit 2 Turbine Building. The proposed location of the light poles and foundations was selected to provide adequate lighting levels while minimizing the impact to construction during l the installation of the Station Blackout Building (by DC 92-010-3) and on the safety-related dike. ,

This change only impacts the flood berm. It did not increase the probability of a flood with or -

without a concurrent seismic event, did not reduce the ability of the berm or related equipment t to function and did not result in any new scenarios. This did not increase the probability or  ;

consequences of a malfunction and did not result in new scenarios since the berm and related components remained available and stable. The berm and related components remaining ~ >

functional, thereby, assured that the margin of safety was not reduced. l The installation of the drilled pier foundation for the security light pole did not affect the ability of the flood dike to prevent flooding of the Turbine Building for the postulated P.M.F.

Calculation No. CE-1052 was prepared to document this. i I'

Which accidents previously evaluated in the Safety Analysis Report were considered?

i (1) Probable Maximum Flood + 2 year wind speed applied in the critical direction.

(2) One half PMF + OBE + 2 year wind speed applied in the critical direction.

(3) 25 year flood + DBE + 2 year wind speed applied in the critical direction. l l

These load combinations are invoked by Reg. Guide 1.59, Appendix A, " Design Basis Floods for Nuclear Power Plants". <

A. Could the activity increase the probability of occurrence for the accidents identified  ;

above? State the basis for this conclusion. l No, the flood dike continued to perform its safety-related function. The function of the )

dike was not to be comprised by the activities associated with installing the pole l foundation in the dike as detailed in Calculation CE-1052. i B. Could the activity increase the consequences of the accidents identified above? State the DeuotsLW

basis for this conclusion.

No, the areal extent and depth of the drilling did not affect the flood dike stability; therefore, there was no increase in the consequences of an accident. (See Calc. CE-1052).

C. Cou'Id the activity create the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report? State the basis for this conclusion.

No, this activity did not increase the probability of an environmental event. The dike was stable and functional during loading conditions. There are no other accidents or load conditions for which the dike must perform a safety-related function.

What malfunctions of equipment related to safety, previously evaluated in the Safety Analysis Report, were considered?

The flood dike stability and function were considered. The flood dike was originally designed in accordance with the requirements of Reg. Guide 1.59. The malfunctions that were considered were a stability failure of the dike and/or damage to the sluice gate.

The change to the flood dike was reviewed in accordance with Reg. Guide 1.127 requirements to ensure the dike would continue to perform its safety-related function.

D. Could the activity increase the probability of occurrence of malfunctions identified above? State the basis for this conclusion.

No, the installation of the caisson for the security light pole did not increase the probability of a design basis flood, nor the flood wall's capacity to contain the flood should it occur. Calc. CE-1052 was been prepared in accordance with the requirements of Reg. Guide 1.59 to ensure that the dike maintained its ability to perform its safety-related function during the construction process and after the installation of the light poles.

E. Could the activity increase the consequences of the malfunctions identified above? State the basis for this conclusion.

No, the activity did not affect the stability of the flood dike; therefore, the activity did not affect the consequences of a flood, nor did it affect the ability of the sluice gate to perform its function.

F. Could the activity create the possibility for a malfunction of equipment of a different type than was previously evaluated in the Safety Analysis Report? State the basis for this conclusion.

No, the activity was only in the flood dike; therefore, no other piece of equipment wa (M1015UM-$

l

.~

affected. The flood dike is a passive structure designed to prevent flooding of main plant structures during PMP conditions. Since the dike only provides flood protection, there is no malfunction of equipment of ~a different type in the Safety Analysis Report that needs to be considered.

Has the margin of safety of any part of the Technical Specifications as described in the bases section been reduced? Explain.

No, the margin of safety as described in the bases section of the Technical Specifications was not reduced. The berm remained functional and the sluice gate in the berm-

~

remained operable during and after this change and, therefore, there was no reduction in margin of safety.

Does the proposed change, test, or experiment require a change to the Technical Specifications? Explain.

No, since the operation of the sluice gate was not impacted and the abil f the berm to provide protection against flooding was not reduced, therefore, no change was required to the Technical Specifications.

Onm.sou4 1

DCP 90-12 Recirculation Spray Heat Exchanger Radiation Monitor System Modification North Anna Units 1&2 DESCRINION The Recirculation Spray Heat Exchanger (RSHX) Service Water sample pumps are provided to supply samples for continuous radiological surveillance of Service Water which has passed through the RSHX during post-LOCA conditions. Operating history has indicated that the pumps are likely subject to seizure from the effects of suspended solids and micro-organisms contained in the service water, and by the close tolerances of the pump impeller design. These tolerances are necessary for the pump to work properly and to develop the proper discharge pressure. Because of the tight clearances, the manufacturer recommends that the pumps be used in clean liquid applications.

The North Anna Service Water System (NASWS) provides the cooling water to the Recirculation Spray Heat Exchanger during accident conditions. The cooling water is normally supplied from the Service Water Reservoir (SWR) with Lake Anna as a back-up supply. Because of the aggressive nature of the SWR and Lake Anna Water, the NASWS has experienced problems due to corrosion. The carbon steel piping undergon wall degradation and pitting. Build up of corrosion products experienced in various portions of the system has resulted in clogging of lines.

In 1989, investigation performed by Sargent and Lundy determined that the 3/4 inch suction and discharge lines to and from the radiation monitoring pumps a*e susceptible to fouling by micro-organisms and tuberculation and to corrosion product build up. This report also estimated that the service life of these carbon steel lines would be limited to about 10 years before replacement would be necessary. An earlier report prepared by Virginia Power in 1982 identified that corrosion damage with respect to the NASWS was extensive and indicated that it was especially a problem with smaller pipe sizes. The report concluded that, to reduce corrosion products in the NASWS, various sizes of the smaller piping headers (4 in. and less) should be replaced with 316L stainless steel piping. However, the 3/4" supply and return lines to each radiation monitor were examined and it was determined that they were in acceptable condition.

The existing RSHX Service Water Pumps manufactured by Aurora pumps and purchased by  ;

Specification NAS-184 were replaced by single stage stainless steel centrifugal pumps  !

manufactured by Gould Pumps. The model selected for the RSHX Service Water application is Model ICS,1 x 1 1/4 x 5 with a 315/16 inch impeller. If the pump is operated at 4 to 8 gpm, there should be sufficient head to provide adequate flow to the RSHX Service Water- l radiation monitors. See calculation 01040.2810-M-004 for confirmation of the system flow rates  ;

versus system pressure drops. A flow rate of 3-8 GPM was established by Westinghouse, the l m uum J

l 1

l

w original system designer, and is consistent with the 6 GPM specified in.the' original pump

~

procurement specification. However, as documented in Appendix 8-14, the radiation monitors 'l may be operated between 3-16 GPM. The pump comes with a 3/4 HP electric motor which is1  !

consistent with the existing pump design. This change did not cause impact on the Station's electrical system. .Other reasons for selecting this~particular pump was that it is designed to

- handle corrosive / abrasive liquids, slurries and small pr.rticulates. The pump was commercial grade and was dedicated as safety related by third party inspection.

The pump suction and discharge piping were increased from 3/4 inch to 1 1/2 inch'es and 1 inch, ,

respectively. The existing carbon steel, Class 151 piping was replaced with stainless steel type 316L piping. The piping replacement design was accomplished in accordance with North Anna

. Specification, NAS-1009, pipe class 163. 'The larger pipe and gate valves minimized the -  ;

potential for restriction due to fouling. In order to simplify piping arrangements, some piping  !

layouts were provided with the pump taking suction downstream of its discharge. Recirculation-  !

is not a concern as each RSHX is provided with approximately 4500 gpm of service water during a CA and only 3-16 gpm will be monitored. 'l l

Air binding of the new Goulds ICS pumps in the proposed configuration was evaluated and was' '

determined not to be a problem as:

a) The new pumps are located below the 16 in. service water lines in a manner which  !

allows SW to flow freely to the pump st'ction.

l b) The pumps are designed to start 120 seconds (post CA), therefore, suction lines will be - I flooded upon the pump start signal. t c) Air can pass through the pump.

\

The DC 89-43 solution to the task " Service Water Tied Rubber Expansion Joints" results in j approximately 1 1/2 inch movement in three directions in the 16 inch RSHX outlet service water lines each time the containment is pressurized.- The movement of these lines within the Quench Spray Pump area is away from the containment outer wall. Braided flexible metal hoses were ~

installed to accommodate the movement'between the 16 inch service water lines and the stationary radiation monitor pumps. Preventative measure is taken to ensure these hoses are laid up dry when not in use to eliminate any microbiologically influenced corrosion (MIC) concerns j as they will be the thinnest component in the system. j 1

The material changeover from carbon steel to stainless steel type 316L was based upon the l recommendations of the 1982 Virginia Power report on the NASWS and the fact that portions  ;

of the NASWS have already been replaced with type 316L stainless piping with satisfactory . ,

results. The portions of the NASWS replaced include service water to the control room chillers, i charging pump lube oil coolers and the air compressors.

waum c l

,-- w W -*"Y-

Threaded 1 inch test and flush connections were provided at the supply and return connections to the service water outlet headers. These were provided to assist in pump testing (supply water) and to facilitate flushing and blowdown of the subsystem piping. Cleanouts were also provided so the short carbon steel sections off the service water header can be accessed and rodded out if necessary. A drain was provided at the low point outside the radiation monitor cubicle to facilitate draining that section of the system. The piping neer the service water header can be drained by using a combination of the sample line, test and flush connections and pump casing drain while blowing down with service air.

Summary of Safety Analysis This modification was designed prior to requiring use of the current 50.59 format. At the time, an extensive ER & SA section was prepared for each DCP. The following is a summary of Section 7.0 of the ER & SA.

This Design Change did not create an unreviewed safety question as defined in 10CFR50.59.

Guidelines provided in ADM-3.9, dated October 5,1989, were used for the 10CFR50.59 review.

a) The implementation of this modification did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the Final Safety Analysis Report. This Design Change implemented the change out of some piping system material from carbon steel to stainless steel type 316L. The Design Change also replaced the existing radiation monitor pump and installed new gate valves and flexible metal hoses. These changes did not alter the System Function. These modifications make use of the original design criteria as the basis for the design.

b) The implementation of this modification did not create a possibility for an accident or malfunction of a different type from any previously evaluated in the Final Safety Analysis Report. The hardware used in this modification is of a type used elsewhere in the Station and the modification did not affect the design, function or operating conditions of the ESHX radiation monitor system. The modification changed out the sample pump and piping material, and installed new gate valves and flexible metal hoses. The piping for the radiation monitoring system which was replaced was changed from carbon steel to 316L stainless steel, c) The implementation of this modification did not reduce the margin of safety as defined in the basis of any Technical Specification. The RSHX radiation monitoring system is not included in the Technical Specifications. The control, function and operating conditions of the RSHX radiation monitoring System was not affected.

tvaMH2.$N1

DCP 91-014 RADIO SYSTEM UPGRADE-TRUNKING EQUIPMENT NORTH ANNA UNIT 1 AND 2 DESCRIPTION The existing plant UHF radio system consisted of portable, mobile and desk mounted units which communicated through fixed base, conventional repeaters operating on three licensed 450 mega hertz frequencies. Weak radio reception in some areas of the plant limited the usefulness of this system for plant personnel.

Thi's modification replaced the existing system with a new system employing radio trunking technology which makes available the use of five licensed 850 mega hertz frequencies for portable, mobile and desk mounted units which can be programmed for up to 48 separate channels. A new antenna system was also installed to increase signal strength in difficult coverage areas

( Containments, Auxiliary Building and Turbine Building Basement).

SUMMARY

OF SAFETY EVALUATION This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

A. The implementation of this modification did not increase the probability of occurence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Safety Analysis Report.

Implementation of this modification resulted in improvements in coverage, quality and availablity compared to the originally installed radio system. In-plant testing prior to implementation of the modification showed that the new system was less likely to affect plant electronic equipment due to Radio Frequency Interference (RFI) than the original system.

B. The implementation of this modification did not create a possibility for an accident or a malfunction of a different type than any previously evaluated in the Safety Analysis Report.

The new radio system resulted in improvements in coverage, ,

quality and availability and a reduction in the likelihood of i RFI occurrences compared to the original system. l 1 OF 2 l

~

L-  :

DCP 91-014 y ,

C.. The implementation of this modification did-not reduce-the i margin of safety as defined in the basis of any Technical . l

. Specification.

i The plant radio communications system is not described in the bases of the Technical Specifications.

i t

l t

i

?

I i

l t

i 2 OF 2 r i

i

'l

l P

DC 91-129 Removal of RE Isolation MOV Autoclosure i North Anna / Unit 1 & 2 l Descrintion i

The Residual Heat Removal (RHR) suction valves autoclose fuature was determined to be both unnecessary and a potential cause of loss  :

of RH, with failure of a solid state card or relay as examples of potential causes. For'these reasons a Technical Specification change was initiated. This DCP was prepared in anticipation of the change request approval and was implemented only when the approval ,

had been received.

The physical changes necessary to disable the autoclose

-interlock in the MOV control circuits was relatively simple. '

Two conductors in the cable running from the MCC to the SSP relay rack were determinated and spared which rendered the relay contacts incapable of closing the valve automatically.

No change in the containment or at the valves was required.

An approved maintenance procedure was utilized to perform the '

manipulation of the control wiring and the calibration procedures were used to test and verify the success in completing the task.

8"-- rv Of Safety analysis Safety Evaluation 90-SE-OT-007 was prepared in support of the -

Technical Specification change request. It determined that an  :

unreviewed safety question does not exist since adequate assurance exists that the RHR System will be isolated from the .

RCS when required. Procedures used require independent operator double verification of proper valve positions before 4 pressure ascension.

l i

i page 1 of 1 J

l i

DCP 91-174-3 Removal of Existing Strip Chart Recorders DESCRIPTION The existing eight TIGraph strip chart recorders located in the meteorological tower panel in the control room will be replaced by '

three multiple point strip chart recorders. This will not change the meteorological information available to the control room operators but will eliminate the existing unreliable and 1 obsolescent single point recorders presently installed. All station commitments and EPIP needs will still be met using these new recorders.

6 ALYSIS:

)An unreviewed safety question does not exist because:

• The implementation of this DCP does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR because: the measured variables of the panel will not be altered and the design function of the panel will be maintained. The information needed by the plant staff will still be available in case of the need to evaluate the wind borne transport of radioactive material from the plant site.

• The implementation of this DCP does not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR because: the new recorders are similar in design and function to those being replaced.

• The implementation of this DCP does not reduce the margin of safety as defined in the basis of any Technical Specification because: all limiting conditions will be observed during installation of this modification.

l l

DCP 92-236 REPLACE DURAMETALLIC SEAL WITH CHESTERTON i 2-CC-P-1A/B j NORTH ANNA UNIT 2 RESCRIPTION The component cooling water pumps were originally equipped with Durametallic seals. DCP 92-236 was intended to repicce the '

Durametallic seals with Chesterton cartridge type split seals.

This was being done to reduce the maintenance time required to ,

change the seals. The Chesterton seals were installed on 2-CC-P-1A but the inboard seal continuously leaked even when a vendor representative attempted to fix it. It is thought that shaft deflection caused by the bearing configuration was preventing the seal from working correctly. Due to the leakage, the original durametallic seal was reinstalled and no further attempt to install the Chesterton seals will be made on these pumps.

A shaft sleeve spacer and an o' ring groove internal to the shaft sleeve was installed to assist with sealing.

SUMMARY

OF SAFETY ANALYSES (94-SE-MOD-047 E 92-SE-MOD-074)_

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

Component cooling to containment is isolated during a Phase B isolation. Therefore, although all accidents were reviewed, the applicable accidents were considered to be all minor faults through the accidents which require a Phase A isolation.

1) Accident probability was not increased as the pumps have no ,

role in the causes for any of the accidents.

2) Accident consequences were not affected as pump operation, function and performance were not affected by this change.

3) No unique accident probabilities were created. The changes to l the shaf t sleeve did not affect the seal failure mode which is leakage. Seal leakage will not affect any other equipment or I

render the pump inoperable.

4) Margin of Safety was maintained because the operation, function and performance of the pump was not affected. I Integrity and reliability of the system was maintained.

Page 1 of 1

l DC 92-273 i

REPLACE 2#' MOTOR WITH 5#' MOTOR North Anna / Unit 1 Description In their Generic Letter 99-10, the USNRC identified several areas of concern regarding the operability of MOVs. As a result, the utilities were required to prepare and implement a program to improve the operability of safety related MOVs. As a part of the Virginia Power response to thc USNRC GL 89-10, calculations have been performed for various MOVs. One of these (ME-0317) for the 01-SW-MOV-103 A, B, C, D, 01-SW-MOV-104 A, B, C, D indicated that the motor size needed to be increased for the valve operator. As a result, the 2#' motors on 01-SW-MOV-103A,B,C,D, 01-SW-MOV-104A,B,C,D were replaced with qualified 5#' motors by this DCP. Also, the motor thermal overloads were replaced with new ones based on calculations which complies with GL 89-10 and STD-GN-0002.

S"==ary Of Safety Analysis (93-SE-MOD-040)

L An unreviewed safety question did not exist because:

A. The implementation of this DCP did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR because the new components provide margin for delivery of all important design features under all postulated conditions.

B. The implementation of this DCP did not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR because the design remains a like for like replacement in conjunction with standard reviews for GDC 17 and EQ.

UFSAR single failure criteria still bounds the design.

C. The implementation of this DCP did not reduce the margin of safety as defined in the basis of any Technical Specification because the design function of the MOVs remain the same with stroke time unchanged. The margin of safety is preserved.

page 1 of 1

DC 92-290 Provide GL 89-10 Wiring Modifications North Anna / Unit 1 & 2 Description The 1-SW-MOV-110A,B, 1-SW-MOV-113A,B, 1-SW-MOV-114A,B, 1-SW-MOV-115A.B, 1-SW-MOV-117, 1-SW-MOV-118, 1-SW-MOV-119, 1-SW-MOV-120A,B, 2-SW-MOV-220A,B, 2-SW-MOV-215A,B motor operators were modified by relocating the torque switch bypasses from rotors 1 and 2 to rotors 3 and 4 along with setting up the bypass rotors for bypass of 80-85% in the open direction and 20-25% bypass in the close direction.

This was accomplished with a relatively minor wiring modification supplemented with testing and setup.

Summary of Safaty Analysis An unreviewed safety question did not exist because:

A. The implementation of this DCP did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR because the performance characteristics of the MOVs (i.e. torque, stroke time, pressure ratings etc.) will not be altered.

The torque switch bypass will improve motor operator reliability by reducing the chances of inadvertent trip during valve stroke.

B. The implementation of this DCP did not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR because the application of torque switch bypass using the third and fourth rotors is a common component application for this station and the industry. It does not place any unusual performance demands on the component or systems involved.

C. The implementation of this DCP did not reduce the margin of safety as defined in the basis of any Technical Specification because the MOV operation is not altered and its contribution to the safety of the plant is not degraded. Thus the Tech Spec bases are not altered.

page 1 of 1

. .=. - . .

[

F DC 92-292 Provide GL 89-10 Wiring Modifications North Anna / Unit 1 pescription The 1-SW-MOV-121A,B, 1-SW-MOV-122A,B and 1-SW-MOV-123A,B motor operators were modified by relocating the torque switch bypasses from rotors 1 and 2 to rotors 3 and 4 along with setting up the bypass rotors for bypass of 80-85% in the open direction and 20-25%

bypass in the close direction. This was accomplished with a relatively minor wiring modification supplemented with testing and setup.

Sn==ary Of Safety Analysis An unreviewed safety question did not exist because:

A. The implementation of this DCP did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR because the performance characteristics of the MOVs (i.e. torque, stroke time, pressure ratings etc.) will not be altered.

The torque switch bypass will improve motor operator reliability by reducing the chances of inadvertent trip during valve stroke. -

B. The implementation of this DCP did not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR because the application of torque switch bypass using the third and fourth rotors is a common component application for this station and the industry. It does not place any unusual performance demands on the component or systems involved.

C. The implementation of this DCP did not reduce the margin  ;

of safety as defined in the basis of any Technical Specification because the MOV operation is..not altered and its contribution to the safety of the plant is not degraded. Thus the Tech Spec bases are not altered.

page 1 of 1 l

I i

s t

DC 92-293  !

Provide GL 89-10 Wiring Modifications North Anna / Unit 2 [

Description j The 2-SW-MOV-221A,B, 2-SW-MOV-222A,B and 2-SW-MOV-223A,B motor operators were modified by relocating the torque switch bypasses  ;

from retors 1 and 2 to rotors 3 and 4 along with setting up the l bypass rotors for bypass of 80-85% in the open direction and 20-25%  ;

bypass in the close direction. This was accomplished with a i relativsIy minor wiring modification supplemented with testing and setup.  ;

8"--ev Of Safety *==lvsis An unreviewed safety. question did not exist because: I A. The implementation of this DCP did not increase the probability of occurrence or the consequences of an accident or malfunction of. equipment important to safety and previously evaluated in the UFSAR because the '

performance characteristics of the MOVs (i.e. torque, stroke time, pressure ratings etc.) will not be altered.  ;

The torque switch bypass will improve motor operator i reliability by reducing the chances of inadvertent trip ,

during valve stroke. l B. The implementation of this DCP did not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR i because the application of torque switch bypass using the i third and fourth rotors is a common component application for this station and the industry. It does not place any -

unusual performance demands on the component or systems  ;

involved.

C. The implementation of this DCP did not reduce the margin i i

of safety as defined in the basis of any Technical Specification because the MOV operation is not altered and its contribution to the safety of the plant is not degraded. Thus the Tech Spec bases are not altered. ,

page 1 of 1

e l

l DCP-92-302-1  !

REPLACE TRIP DEVICES POR VARIOUS 4KV EQUIPMENT  ;

NORTE luGIA POWER STATION UNIT 1 l DESCRIPTION During the July 1991 NRC Electrical Distribution System Functional Inspection, several concerns were identified relating to breaker J mis-cootAination on safety related switchgear (Reference Finding ,

91-17-03p. Specifically, the 50/51V (voltage restraint f overcurrent) relays on the 4KV circuit breakers,' each supplying two ,

4160/480V load center transformers, did not coordinate with the '

480V load center breakers associated with the Inside Recirculation l Spray Pump (IRSP) and Quench Spray Pump (QSP) motors. The mis-coordination could have resulted in the loss of both transformers and connected 480V load centers for a failure of an IRSP/QSP motor 1 or associated 480V cable (s). Coordination problems were also  ;

identified between the ITE trip devices and the IRSP motor supply breakers. ,

To correct the mis-coordination problems on Unit 1, the 50/51V relays associated with breakers 15H8 and 15J8 needed to have the i existing settings for the " taps", " time-dial", an d" instantaneous amps" reset. (These breakers only af fect the IRSP and QSP motors) . .

In addition to resetting the relays, several overcurrent devices for the IRSP motors and Pressurizer Heater Panels need to be  !

replaced (breakers 14H1-2, 14H1-6, 14J1-2 and 14J1-6).

6 The overcurrent trip devices (OD) were replaced on five (5) 480V circuit breakers. These are the supply breakers for the IRSP i motors. The " taps", " time-dial" and " instantaneous amps" on the 50/51V relays for breakers 15H8 and 15J8 were reset.  !

8UMMARY OF 8AFETY ANALYSIS (93-SE-MOD-035)

This design change modified the setpoints for the 4KV transformer .

feeder breakers 15H8 and 15J8 and the breakers 14H1-2, 14H1-6,  !

14J1-2 and 14J1-6 IRSP motor overcurrent trip devices to correct a '

mis-coordination of overcurrent devices. The revised setpoints continue to meet all design requirements in accordance - with applicable industry standards. The needed setpoint changes could not be accomplished using the existing trip devices, therefore, i they were replaced. L This setpoint change represents an enhancement and did not I constitute an unreviewed safety question as defined by 10CFR50.59.

i Page 1 of 2 l i

~ . . . . _ _ _

This activity does not change the basis section of the Technical Specifications and will not create the possibility of an accident of a diff rent type than was previously evaluated in the UFSAR.

This change does not negatively impact operation' of a safety-related system or components and does not prevent systems from performing accident mitigating functions.

L E

l L

b r

R r

Page 2 of 2 4

I

DCP #92-305 CONTROL ROOM PAINTING NORTH ANNA UNITS 1 & 2 DESCRIPTION This DCP was implemented per an Operations request to beautify the Control Room. This included recarpeting and repainting under a new color scheme. Painting included the walls, doors, equipment cabinets, vertical board, and bench board. Groups of related components on the equipment cabinets, vertical board, and bench board were surrounded by a background which contrasts significantly with the surrounding colors for greater ease of location and identification.

SUMMARY

OF SAFETY ANALYSIS (92 SE-MOD-0561 MAJOR ISSUES:

The main issue considered by this evaluation was the Human Factors (HFE) design enhancement of the Control Room with respect to the Painting and Beautification effort.

Since this design change involved the modification of equipment located in the Main Control Room, (i.e. color change of the equipment cabinets, vertical board and bench board, and color change of the rug) a Human Factors review was performed. The purpose of the review was to ensure that the modifications met the requirements of NUREG-0700 " Guidelines for Control Room Design Reviews" and STD-GN-0005 " Human Factors Engineering".

The other major issue considered was Fire Protection / Appendix "R" acceptability. The fire rating of the new carpeting matched those of the original carpeting. These requirements met some of the requirements of the Appendix "R" Report. Additional certifications were obtained to ensure that the carpeting had a Smoke Development Rating of less than 200 and met the requirements of ASTM E 662 before the carpeting was qualified as an acceptable replacement. No new combustibles were added by installing the new carpeting. Although paint is considered a combustible, Appendix "R" does not have a combustible loading for dried paint. Liquid paint carried into the Control Room was restricted to the amount that would be consumed during the workshift.

UNREVIEWED SAFETY OUESTION ASSESSMENT:

1. The implementation of this DCP does not increase the probability of occurrence or the  ;

consequences of an accident or malfunction of equipment important to safety and '

previously evaluated in the UFSAR. The work process was controlled by an approved j procedure which minimized any risks of unintended operation during the l implementation of the modification. Also, the safety functions / design of the switches and boards were preserved.

1

- . , . _ . I

DCP #92-305 I

2. The implementation of this DCP does not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR. No.

system / component functions are altered. The HFE design of the Control Room is -

preserved.

3. The implementation of this DCP does not reduce the margin of safety as' defined in the basis of the Technical Specification. The Control Room color arrangement is not directly factored into the Tech Spec margin of safety.

DCP 93-004 SI System Pressure Transient Mitigation Modifications North Anna Unit 2 Descriotion During Periodic Test (PT) of the Low Head Safety Injection (LHSI) pumps, the LHSI pump discharge relief valves (2-SI-RV-2845A, B, & C) have lifted occasionally. The cause of the relief valve lifts is due to brief pressure transients resulting from the compression of entrapped air in the system. The lifting of the relief valves is an unacceptable condition. These relief valves discharge to an open sump in the safeguards building. If a design bases accident occurred and a relief valve lifted on LHSI pump start and failed to rescat before the start of the recirculation phase of safety injection, contaminated containment sump water would be discharged to the safeguards building sump.

On August 6,1992, a Unit #2 reactor trip resulted in a weld failure at vale 2-SI-377. The failed tubing joint was rigidly supported and failure was postulated as a result of LHSI piping movement caused by a LHSI pump start up pressure transient (ref. 6.6).

In order to mitigate the pressure transients being experienced during LHSI pump start, additional vents were added to the system. Because the system already contains high point piping vents, it was determined that the bonnets of the large diameter valves should be vented. Nine vent valves were added to the bonnets of existing valves in the SI system. Valves 2-SI-9,32,91,99, 105, MOV-2864A&B and MOV-2890C&D were modified to facilitate bonnet venting. In addition to the above, the set pressure for the three LHSI pump discharge relief valves (2-SI-RV-2845A,B&C) was increased from 220 psig to 264 psig. This reduced the challenges to the relief valves during LHSI pump start.

Summary of Safety Analysis This design change did not create an unreviewed safety question as defined in 10CFR50.59.

Upon starting the LHSI pumps during periodic testing, the relief valves in the discharge piping of the pumps occasionally lift momentarily. The cause of the momentary life of the relief valves  ;

is due to the compression of entrapped air in the system. In order to facilitate removal of additional air from the SI system, nine bonnet vent valves were added to the system. The bonnet vent valves were added to existing valves 2-SI-9,2-SI-32,2-SI-MOV-2864A&B,2-SI-MoV-2890C&D, 2-SI-91, 2-SI-99 and 2-SI-105. For valves 2-SI-9, 2-Si ~2, 2-SI-MOV-2864A&B, 2-SI-91, 2-Si-99 and 2-SI-105, the bonnet vent valves were added to the existing (WWXM SUM-l i

e

I l

l l

valves via a welded 1/2" minimal diameter pipe nipple. For valves 2-SI-MOV-2890C&D, the existing capped stem leak off connection was used instead of welding a pipe nipple to the bonnet. Valves 2-SI-MOV 2890C&D are double packed valves. In order to use the stem leak 1 off connection for a vent nipple, the lower packing set was removed and a bushing will be installed in its place. The valve vendor, Anchor Darling, stated that the current industry standard is to use five rings of packing to seal the stem and minimize stem drag. Five rings of packing were installed above the stem leak off connection. This did not result in a reduction in stem sealing efficiency. The addition of the vent valves did not increase the likelihood of recirculation fluid leakage. This is because the normal posidon of these vent (globe) valves is closed with the fluid under the seat. Seat leakage, if any, would be contained by the vent cap.

Increasing the LHSI pump discharge relief valves,2-SI-RV-2845A,B&C, set pressure from 220 psig to 264 psig did reduce the potential for relief valve lift subsequent to LHSI pump start. The new set pressure did not cause the LHSI system to exceed its maximum allowable working pressure (Calculation ME-0348).

Therefore, it is concluded that the above mentioned system modifications did not result in an unreviewed safety question.

Which accidents previously evaluated in the Safety Analysis Report were considered?

Loss of Coolant Accident A. Could the activity increase the probability of occurrence for the accidents identified above? State the basis for this conclusion.

No, the SI system is isolated from the Reactor Coolant system via check valves. The relief valves vent valves, pipe and fittings meet or exceed the design requirements of the SI system.

B. Could the activity increase the consequences of the accidents identified above? State the basis for this conclusion.

No, the addition of the vent valves to the SI system and the increasing of the relief valve set pressure did not prevent the SI system from performing its function. The relief valves, vent valves, pipe and fittings meet or exceed the design requirements of the system.

C. Could the activity create the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report? State the basis for this conclusion.

No, the relief valves, vent valves, pipe and fittings meet or exceed the design requirements of the system.

mo n :

, , j

_ -- - . 3 What malfunctions'of equipment related to safety, previously evaluated in the Safety Analysis - l

- Report, were considered? -

I LHSI discharge line rupture -l A. Could the activity increase the-probability of occurrence of malfunctions identified i above? State the basis for this conclusion. .!

The relief valves, vent valves, pipe and fittings meet or exceed the design requirements 1

- of the system.  !

1 B. ' Could the activity' increase the consequences of the malfunctions identified above? State  !

the basis for this conclusion. j No, the relief valves, vent valves, pipe ' and fittings meet or- exceed the.- design requirements of the system.

f i

C. Could the activity create the possibility for a malfunction of equipment of a different type than was previously evaluated in the Safety Analysis Report? State the basis.for this' j conclusion. t No, the relief valves, vent valves, pipe and fittings meet or exceed the design. f requirements of the system. l D. Has the margin of safety of any part of the Technical Specifications as described in the j bases section been reduced? Explain, i No, the LHSI system operability was maintained by these modifications. No Technical l

Specification margin of safety was reduced.  :

1 E. Does the proposed change, test, or experiment require.a change to the Technical  !

Specifications? Explain.

l No, the operation of the SI system remained unchanged.

L i

t

'?

I DfMXM.$l%) I 1

l v

i y4 .y. _ ) , n,- w++

DCP 93-013 Containment Equipment Hatch Platform Repairs -;

Nonh Anna Units 1&2 l

1 Description .

The Unit 1 equipment hatch platform was modified for the Steam Generator Replacement Project

' (SGRP). Analysis of the modified structure revealed that under tornado wind conditions portions -

of the structure would be stressed beyond the allowable limits as defined by the UFSAR . Upon review of the original calculation, it was determined that even without the modification the platform would be overstressed for this loading. JCO 93-03 was prepared to address this condition for both Units 1 & 2.

i The Labyrinth missile shields at the equipment hatch have experienced cracking and spalling _ _l where the roof section bolts to the wall section at embedded corner angle brackets due to

overtightening of the bolts in this connection. This condition was reported in DR N-93-0789. 'l Concrete repairs were needed in order to prevent further degradation of these missile shields.

l The purpose of this Design Change was to reinforce the Unit 1 & 2 containment equipment I hatch platforms by adding steel bracing which reduced tornado wind induced stresses to UFSAR '

design allowables. j Concrete repairs were made to damaged areas of the equipment hatch missile shields and the  !

connection detail between the roof and wall sections of the labyrinth was changed in order to.  !

prevent recurrence of the cracking /spalling. 1 Summary of Safety Analysis This design change did not create an unreviewed safety question as defined in 10CFR50.59.  !

1 The accident considered in this evaluation involved the protection of structures, systems and components from the effects of natural phenomena such as tornadoes. The function _ of the  ;

containment equipment hatch platforms and missile shields is to provide protection from the  ;

effects of these natural phenomena. The platforms and missile shields are specifically designed for such events and as such will have no effect on the probability of occurrence for these events.

The specific purpose of the platform and missile shield repairs was to reduce stress levels which ,

should reduce the consequences of such accidents. The ability of the platforms and missile l shields to perform their safety related function was enhanced by repairs done under this DC. I This activity did not create the possibility for an accident of a different type than previously .

evaluated in the SAR. No malfunctions of equipment associated with the platforms or missile l

shields were considered in the SAR because these structures were provided specifically to provide missile protection for the equipment hatch and equipment inside containment. There are no different equipment malfunctions which occurred other than those which could be postulated in the event that the missile shield failed to perform its intended safety related function. Since the platform and missile shield repairs enhanced the performance of these structures, there was no reduction in any TS Margin of Safety. Station procedures provided controls over temporary removal of missile shields in order to prevent unwarranted removal which could have rendered the barrier ineffective. There was no need to change the TS because the repairs enabled these structures to perform their safety related function.

Structural repairs and modifications which were performed under Design Change 93-013-3 were -

needed in order to restore the containment equipment hatch platform and missile shield to a configuration that satisfied design tornado loading requirements.

Precautionary actions were taken to ensure that wind braces are re-installed upon entry into severe weather AP-91. This ensured the platform structural iritegrity was returned prior to possible onset of a tornado. If a seismic event had occurred while a wind brace was removed.

The structure would have failed. However, a PRA memo in Appendix 4-2 indicates that a seismic event and tornado occurring at same time is not probable. Therefore, the consequences of any Chapter 15 accident were not increased.

Which accidents previously evaluated in the Safety Analysis Report were considered?

The accident considered in this evaluation involves the protection of structures, systems, and components from the effects of natural phenomena such as earthquakes and tornadoes.

A. Could the activity increase the probability of occurrence for the accidents identified  :

above? State the basis for this conclusion.

No, the function of the platforms and missile shields is to provide protection from the effects of natural phenomena. The platforms and missile shields are specifically designed for such events and as such will have no effect on the probability of occurrence for these events. Probability of concurrent seismic event and tornado is not likely. Therefore, performance of wind brace modifications at power did not increase the probability of an accident.

I3. Could the activity increase the consequences of the accidents identified above? State the basis for this conclusion.  ;

No, the specific purpose of the platform and missile shield repairs was to reduce stress levels which also reduced the consequences of such accidents. Since a seismic event and i tornado occurring concurrently is not probable, the consequences of Chapter 15 accidents were no increased.

i D91013 50M 2

y3 a:

C. Could the activity create the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report? State the basis for this conclusion.

No, the ability of the platforms and missile shields to perform their safety related function was enhanced by repairs done under this DC. This activity did not create the possibility for an accident of a different type than previously evaluated in the SAR.

What malfunctions of equipment related to safety, previously evaluated in the Safety Analysis Report, were considered?

No malfunctions of equipment associated with the platforms or missile shields were considered in the SAR because these structures were provided specifically to provide missile protection for the equipment hatch and equipment inside containment.

A. Could the activity increase the probability of occurrence of malfunctions identified above? State the basis for this conclusion.

No malfunctions of equipment associated with the platforms or missile shields were considered in the SAR because these structures were provided specifically to provide missile protection for the equipment hatch and equipment inside containment.

B. Could the activity increase the consequences of the malfunctions identified above? State the basis for this conclusion.

No malfunctions of equipment associated with the platforms or missile shields were considered in the SAR because these structures were provided specifically to provide missile protection for the equipment hatch and equipment inside containment.

C. Could the activity create the possibility for a malfunction of equipment of a different type than was previously evaluated in the Safety Analysis Report?- State the basis for this  :

conclusion. i No, there are no different equipment malfunctions which could occur other than those 1 which could be postulated in the event that the missile shield failed to perform its intended safety related function.

Has the margin of safety of any part of the Technical Specifications as described in the bases section been reduced? Explain. l No, containment integrity is addressed in TS 3/4.6.1.1. Since the platform and missile shield  !

repairs enhanced the performance of these structures, there was no reduction in any TS Margin j of Safety. Station procedures did provide controls over temporary removal of missile shields in order to prevent unwarranted removal which could render the barrier ineffective.

LWlot3 $UM 3 l

7

- Does the proposed change, test, or experiment require a change to the Technical Specifications? l Explain. ';

+

No, there was no need to change the TS because the repairs enabled these structures to perform

. their safety related function.

+

e k

I

?

t i

n f

5 9

twmn.sm

n. i;

g x DCP 93-014 I Steam Generator Blowdown System Tie-Ins  :

North Anna Unit 1 -

l Descriotion '

t Nuclear Steam Generator corrosion problems throughout the industry have caused significant loss ,

of plant availability, increased total personnel radiation exposure and eventually resulted in . l replacement of the damaged generators at great capital expense. (As was recently done for .

North Anna Unit 1 and is being planned for Unit 2.) One of the key methods of protecting steam generators (S/G's) from the various forms of corrosive attach is the use of continuous  !

blowdown (BD) systems. This approach is highly recommended by both EPRI and Westinghouse.

The current NAPS S/G BD system is both expensive from an operating standpoint and marginal .  !

from a design standpoint. It does not satisfy current requirements for capacity to minimize corrosion product buildup in the S/G's, or for efficiency (no heat recovery). The existing S/G

• BD system provides a maximum continuous operating blowdown rate of 20-25 gpm per S/G with ,

the system at capacities exceeding design has resulted in continual maintenance problems with -l substantial corresponding costs. i An operating S/G BD rate of 0.2% to 1.0% of main steam (MS) flow is recommended by EPRI. l This corresponds to a BD rate (at a fluid temperature of 60*F) of approximately 17 gpm to 85 gpm per S/G, based on the current NAPS MS flow of approximately 12.75 million Ib/hr. 'The l new NAPS Unit 1 S/G's have a 1% of MS flow BD design recommendation. Clearly, the i existing S/G BD system provides a marginal BD rate at best when operating at flow rates of i more than twice design capacity. However, a back fit system allowing a continuous BD of 85 i gpm per S/G is cost prohibitive. I i

Therefore, the design objectives for S/G BD system improvements are:

1) To provide an increased blowdown rate of as close as possible to 1% of the main steam Dow during startup and upset conditions, which will assist in minimizing corrosion of the ,

S/G's.

2) To provide a cost and energy efficient continuous BD system design with heat recovery function that has a continuous operating flow rate of at least 45 gpm per S/G.  ;

i Because of the complexity and time required for installation of S/G BD system improvements with the design attributes described above, it is desirable to complete as much of the installation work during non-outage periods as possible.

PM014 $UM.I

The abandoned high capacity S/G BD system can be made operational with the secondary side of the Unit in its current operational configuration by reworking or replacing, as required, the existing control instrumentation and by rerouting the drains from the BD flash tank to the circulating water discharge as waste, instead of the original design of routing the drains to the condenser hotwell. The original design concept of returning the untreated drains from the high capacity system BD flash tank to the condenser would result in zero net blowdown from the secondary side. The drains from the BD flash tank will be cooled via a shell and tube heat exchanger (the BD flash tank drains cooler) with condensate as the cooling medium. Thus, energy from the flash tank drains will be recovered to the steam cycle, while cooling the BD discharge to approximately the same temperature as the circulating water to which it is discharging. These upgrades to the high capacity BD system will permit the system to operate at its design capacity of 100,000 lb/hr (approximately 200 gpm at 60*F), or 67 gpm per S/G, if sufficient makeup water capacity is available. Present makeup water capacity allows a continuous S/G BD rate of approximately 45 gpm per S/G for both Units.

In order to be able to complete the majority of the proposed high capacity S/G BD system improvements during non-outage periods, installation of tie-ins (with isolation valves and welded caps as needed) to existing piping were completed during the refueling outage of the Unit.

These tie-ins were installed in locations for future connections of the upgraded high capacity S/G BD system piping to the existing interfacing piping systems, which will permit installation of all new S/G BD equipment (BD flash tank drains cooler and radiation monitor) and piping, including the removal of the tie-in stub weld caps, and the process tie-in, to be performed during non-outage times. This Design Change dealt only with the installation of the tie-ins to existing piping systems for future connections of the upgraded high capacity S/G BD system. The installation of the upgrades to the high capacity S/G BD system and the corresponding system process tie-ins will be dealt with by other Design Change Packages.

Required system tie-ins designed and installed by this DCP include: tie-in for condensate supply to the BD flash tank drains coolers (from the 24 in. condensate pump discharge line, 24"-

WCPD-4-301); tie-in for condensate return from the BD flash tank drains coolers (to the 24 in, condensate line, 24"-WCPD-14-301, between the gland steam condenser outlet and the condensate polishing inlet connection); tie-in for the flash tank steam vent divert line (to condenser connection originally designed for the flash tank drains discharge line,6"-WGCB 151); and tie-in for cooled blowdown discharge line (via abandoned 6"-WED-ll-151 to 20"-

WMD-2-121 to the circulating water discharge tunnel).

Summary of Safety Analysis This Design Change did not constitute an unreviewed safety question as defined in 10CFR50.59 since:

1. This modification did not affect or impact any safety related equipment or systems.

Therefore, this Design Change did not increase the probability of occurrence or the (PM014 $UM 2

consequences of an accident or malfunction of equipment in1portant to safety previously evaluated in the UFSAR.

2. This Design Change is consistent with the affected systems' design bases and existing design basis criteria. The tie-ins installed by this modification did not change the operation or performance of the affected systems, nor did they alter or create any process flow paths. Therefore, this modification did not create a possibility for an accident or malfunction of a different type than any previously evaluated in the UFSAR.

3. This Design Change did not impact or change the basis of any of the Technical Specifications, and, therefore, the margin of safety as defined in the bases of the Technical Specifications remained unchanged.

Which accidents previously evaluated in the Safety Analysis Report were considered?

' Loss of Normal Feedwater A. Could the activity increase the probability of occurrence for the accidents identified above? State the basis for this conclusion.

No, the addition of tie-ins to the condensate system installed by this Design Change are in accordance with the original design code and did not result in an increased probability of occurrence for the Loss of Normal Feedwater Accident. None of the other accidents previously evaluated by the SAR were impacted by this modification.

B. Could the activity increase the consequences of the accidents identified above? State the basis for this conclusion.

No, the addition of tie-ins to the condensaa system installed by this Design Change are in accordance with the original design code. Blowdown tie-ins did not affect equipment required for accident mitigation.

C. Could the activity create the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report? State the basis for this conclusion.

No, the addition of tie-ins to the condensate system installed by this Design Change are in accordance with the original design code and no operational or process flow changes were made as a result of this Design Change.

What malfunctions of equipment related to safety, previously evaluated in the Safety Analysis Report, were considered?

None, this Design Change did not involve or impact any safety related equipment or systems, t=u se

i A. Could the. activity increase the probability of occurrence of malfunctions identified above? Sate the basis for this conclusion. I No, this Design Change did not involve or impact any safety related equipment or systems.

B B. Could the activity increase the consequences of the malfunctions identified above?' State the basis for this conclusion.

No, this Design Change did not involve or impact any safety related equipment or-systems, i j

C. Could the activity create the possibility for a malfunction of equipment of a different type .

than was previously evaluated in the Safety Analysis Report? State the basis for this '

conclusion.

No, this Design Change did not involve or impact any safety related equipment or systems, and no operational or process flow changes were made as a result of this Design' {

Change.

Has the margin of safety of any part of the Technical Specifications as described in the bases i section been reduced? Explain.

No, this Design Change had no impact on the Technical Specifications. l Does the proposed change, test, or experiment require a change to the Technical Specifications?

Explain. ,

No, this Design Change had no impact on the Technical Specifications.  :

6 1

f I

l (Mol4 3UM 4

- . - ~ _ . . . ,

n _ ,

D93-015 CONNECTING ADJACENT ELECTRICAL CABINETS USI A-46 AND IPEEE (SEISMIC PROGRAMS NAPS U1 & 2 Safety Evaluation Number: 93-SE-MOD-070 I. Summary of Engineering Review and Design To resolve Unresolved Safety Issue USI A-46, most utilities subject to USI A-46 (including Virginia Power) formed the Seismic Qualification Utility Group (SQUG). SQUG developed guidelines for verifying the seismic adequacy of equipment based on earthquake experience data supplemented by test results and analyses, as necessary. These guidelines are contained in the " Generic Implementation Procedure (GIP) for Seismic Verification of Nuclear Plant Equipment." Per the GIP, any impact on electrical cabinets containing essential relays, i.e. relays that should not chatter during an earthquake, should be considered an unacceptable seismic interaction and cause for identifying that item of equipment as an outlier. Many of the freestanding electrical cabinets in the Unit 1 and 2 Instrument Rack Rooms contain essential relays, are close enough to impact one another, and were not bolted together.

To resolve this concern, the electrical cabinets in the Unit 1 and 2 Instrument Rack Rooms shown in Appendix 4-2 of DCP 93-015-3 were connected together. The modifications were external to the cabinets and involved no drilling or welding to the cabinets. Wherever possible, cabinets were connected with plates attached to the top of the cabinets (front and back) utilizing existing lifting lug holes. In some cases, several cabinets (sometimes entire cabinet rows) were connected using clamp assemblies consisting of tube steel or angle and threaded rod. If clamp assemblies were installed, shims were installed between cabinets if gaps existed between cabinets.

II. Summary of Safety Evaluation Many of the freestanding electrical cabinets in the Unit 1 and 2 Instrument Rack Rooms contain essential relays, were close enough to impact each other, and were not connected together.

Connecting these cabinets together ensured that they will not respond out of phase and impact one another so as to cause relay malfunctions. Connecting adjacent cabinets containing essential relays is a recommendation identified in SQUG's guidelines for verifying the seismic adequacy of equipment.

Therefore, these modifications ensured essential relays contained in these cabinets would not malfunction during a seismic event. Page 1 of 2 i

1 i

'D93 015 The modifications associated' with connecting together the electrical cabinets were a structural modification that-did not alter the operation of the cabinets or components within '

nor surrounding equipment. Additionally, these modifications -

were external to the cabinets and did not involve any drilling or welding to the cabinets. Therefore, it was concluded that-these modifications would not result into an unreviewed safety .

question. 1 .

l r

i k

4 0

i

'4 I

Page 2 of 2 l

?

_ , ~ - . , _ _ _ . _ , , ,1 -,y. ,

DCP 93-016 MAIN GENERATOR PROTECTION MCDIFICATIONS NORTH ANNA UNIT 1 DESCRIPTION Virginia Power's System Protection Department reviewed North Anna Power Station's' main generator protection design and identified several items requiring improvement to raise the level of protection to current guidelines . These items were:

a) The existing negative sequence relay provided generator protection for only extreme conditions. The generator was vulnerable to rotor damage from faulted conditions not detectible by the existing relay.

b) The existing reverse power /antimotoring protection design was vulnerable to single failures of components which could result in unnecessary turbine trips, overspeeding events or turbine blade overheating due to prolonged motoring.

c) Generator synchronization was a completely manual process for North Anna. Errors in manual synchronizing could recult in immediate or cumulative generator damage.

e The following modifications were implemented to improve the level of generator protection:

a) The existing electromechanical relay was replaced with a new static relay to provide protection for the entire negative sequence range of the generator, b) A second reverse power relay was added and circuits were reconfigured to assure that the generator is reliably tripped in a manner which avoids overspeed or excessive motoring.

c) A new synchronizing system was installed to provide automatic and guarded manual synchronizing capability.

1 OF 2 i

DCP 93-016

SUMMARY

OF SAFETY EVALUATION This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

A. The implementation of this modification did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Safety Analysis Report.

The Safety Evaluation considered the following accidents and malfunctions:

Loss of Electrical Load and /or Turbine Trip Loss of Normal Feedwater Loss of Offsite Power to Station Auxiliaries Loss of Reactor Coolant Pumps The existing negative sequence and reverse power relays produced a main generator trip and resultant turbine trip whenever the relay actuation setpoints were reached. The new relays produce the same trips at setpoints more closely matching the generator's capability. No increase in the probability of occurrence nor consequences of the accidents and malfunctions considered resulted from the modification of the relays and setpoints for negative sequence, reverse power or generator synchronization.

B. The implementation of this modification did not create a possibility for an accident or a malfunction of a different type than any previously evaluated in the Safety Analysis Report.

Although the types of relays were changed, the new relays perform the same main generator trip functions as in the original system.

C. The implementation of this modification did not reduce the margin of safety as defined in the basis of any Technical Specification.

The relay changes and additions involved are not a component of any margin of safety described in the bases of the Technical Specifications.

2 OF 2 l

)

DCP 93-102 REORIENT RELIEF VALVE INSTALLATION NAPS UNIT 1 & 2 DESCRIPTION Several component cooling water relief valves on the sample coolers were installed in the vertical position. These valves were reoriented to the vertical position per the manufacturer's literature.

The relief valves were provided on coolers using component cooling water as thermal relief valves. They provide overpressure protection when the component cooling water inlet and outlet valves are closed and the fluid being cooled is still aligned allowing '

heat input. This is not a normal valve lineup and should not occur.

SUMMARY

OF bAFETY ANALYPES (93-SE-MOD-061 & 93-SE-MOD-084)

All design basis accidents were reviewed and none were found to be applicable. During a design basis accident, the component cooling water for the accident plant is isolated. The sample coolers on the accident unit would be supplied from the non-accident unit.

The primary sampling system coolers are not required post accident as samples are taken using the high radiation sampling system. The malfunction of the relief valves would not prohibit component cooling water flow from the coolers.

l This design change did not create an unreviewed safety question as defined in 10CFR50.59.

1) Accident probability was not increased because the coolers have no role in any of the analyzed accidents. The operation of the coolers is intermittent and the CC water to the coolers can be isolated.

, 2) Accident consequences were not increased. The coolers can j continue to operate, if required, after an accident as the component cooling water is cross connected to both units and the cooling water can be supplied from the unaffected unit.

Also, post accident sampling is supplied by the high radiation sampling system so that it is not expected that the primary sample system coolers will be required post accident.

3) No unique accident probabilities were created. The design j function of the valves was not changed. The relief valves j

were reoriented to the vertical direction per manufacturer's information.

Page 1 of 2

1

. - . 1 i

DCP 93-102 REORIENT RELIEP YALVE INSTALLATION NAP 8 UNIT 1 & 2 i 1

1

4) Margin of Safety was maintained because the integrity and )

reliability of the systems, component cooling water, bcion l recovery and primary sampling, was not affected by the l reorientation of the relief valves. ,

i l

t S

l l

Page 2 of 2 .

l

i 1

l DCP 93-122 l Abandonment of Two In-Core Thermocouples I (2-IC-TE-32 and 2-IC-TE-11)

North Anna Unit 2 I

i pfscription l Two in-core, core exit, thermocouples were abandoned in place because they are inoperable. The thermocouples will not be repaired or replaced due to ALARA concerns, inaccessibility, and -l the probability of damaging additional thermocouples in the core during repair efforts. The Technical Specification requirement of two operable thermocouples per quadrant per train was not impacted by this modification. Abandonment consisted of removing the ,

computer points, for the thermocouples, from the ERFCS and ICCM '

computer software.

Su==ary~of Safety Analysis (93-SE-MOD-013) ,

t This design change in accordance with DCP 93-122 does not create an "unreviewed safety question" as defined in 10 CFR 50.59.

A. The implementation of this modification does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Final Safety Analysis Report.

Two in-core, core exit thermocouples were abandoned in place.

The remaining thermocouples provide sufficient data for monitoring core exit temperatures. The in-core thermocouples do not provide any control or protection functions.

Abandonment does not prevent the Operators from performing necessary measures to mitigate an accident.

B. The implementation of this modification does not create a possibility for an accident or malfunction of a different type than any previously evaluated in the Final Safety Analysis Report.

The in-core thermocouples do not provide any control or protection functions. Abandonment does not prevent the Operators from performing necessary measures to mitigate an accident. No feedback into protective circuitry is possible.

This modification removed the associated computer input points from the ICCM and the ERFCS computers. No other computer input is impacted.

Page 1 of 2 1

n -wi w a - -

DCP 93-122 Abandonment of Two In-Core Thermocouple (2-IC-TE-32 and 2-IC-TE-11) l North Anna Unit 2 i

Sn===ry of Safety Analysis (continued)

C. The implementation of this modification does not reduce the '

margin of safety as defined in any Technical Specification.

The minimum required number of operable thermocouples (Section 3.3.3.6) per Technical Specifications is not impacted. At least five operable thermocouples per quadrant per train are available.

1 i

t i

Page 2 of 2

DCP 93-123-1 PHASE A ISOLATION ANNUNCIATOR RECONFIGURATION NORTH ANNA UNIT 1 DESCRIPTION The Phase A Isolation annunciator - (1K-H7) was reconfigured such that an automatic ESF SI signal from the SSPS or if the " Phase A Isolation" benchboard switches (1CIPAA1 or 1CIPAA2) are held in the

" INITIATE" position will activate the annunciator. This DCP performed work in control room benchboards 1-1 and 1-2 and the Solid State Protection System (SSPS) output relay cabinets (01-EI-CB-47E/47F) located in Emergency Switchgear.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-003)

This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

A. The implementation of this modification did not increase the probability of occurrence or consequences of an accident or malfunctions of equipment important to safety and previously evaluated in the Final Safety Analysis Report.

Accident probability has not been increased because this design change conformed to standards and admins. The operation of the containment isolation system was not affected. The Engineered Safety Features- (ESF) of the SSPS have remained the same. This design change provides a more accurate representation of the status of a Phase A isolation.

B. The implementation of this modificetion did not create a possibility for an accident or a malfunction of a different type than any previously evaluated in the Final Safety Analysis Report.

The implementation of tcis DCP was performed during an outage. The operation of the SSPS, SI, Containment Isolation, and Hathaway systems was not affected due to the implementation of this design change. Consequences have not been increased because a possible failure of the DCP would not have corrupted any mitigating systems.

Page 1 of 2

DCP-93-123-1 r

C. The implementation of-this modification did not reduce

~t he margin of safety as defined in the basis of any.

Technical: Specification.

The integrity and. reliability of the Containment  !

Isolation system and ESF.have not been affected. ,

i l

t l

i 1

E l

l Page 2 of 2 -

l l

I

_ , . - . . - , ., , . , , , - ~ .

• 1

DCP 93-140 RER PUMP RELIEF VALVE SPRING REPLACEMENT NORTH ANNA UNIT 1 DESCRIPTION RHR pump suction relief valves (RVs) 1-RH-RV-1721A&B were designed to provide overpressure protection of the RHR system in the event of leakby from the reactor coolant system. The original design of l the RHR system had only one RV installed on the discharge header from the pumps. This RV was to be set to 600 psig. In 1977 Stone

& Webster Engineering made a modification to remove the single relief from the discharge of the pump and to install one relief per pump on the suction side. A lift setpoint of 450 psig was originally selected and the springs were changed to accommodate the new setpoint. However the setpoint was later changed to 467 psig.

The nameplate data was never changed to annotate the new setpoint.

It was discovered that the installed springs had a set range of 411 to 450 psig. This design change was implemented to replace the existing springs with springs which had a setting range of 451 to 492 psig. The RV lift setpoint of 467 psig would then be encompassed by the design setting range of the spring.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-051)

The replacement of the relief valve spring did not constitute an unreviewed safety question as defined in 10CFR50.59 since it did not:

A) Increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in UFSAR.

The RHR pump suction relief valve springs were replaced to ensure that the lift setpoint was encompassed by the design setting range of the new springs. The setpoint was not affected and operation of the RVs was not changed. The RHR system remains isolated from the RCS during power operations and is not taken credit for in mitigation of any accidents.

Page 1 of 2

- - - .. . - . ~. . - - _

I I

'DCP 93-140 RNR PUMP'RELIEP VALVE SPRING REPLACEMENT

-NORTM ANN & UNIT 1 B)- Create a possibility for an accident or malfunction of a different type than any evaluated previously in the UFSAR.

The Design Change increased.the reliability ~of.the RHR  !

system. Operation and integrity of . the RVs was not.  !

affected. The chances of overpressurization had not been  :

increased.and the failure of a RHR line at power would be bounded by the LOCA analysis.

c) Reduce the. margin of safety as defined in the basis of  ;

any Technical Specification.

Implementation of the Design . Change improved the-reliability of the RHR system. and overpressurization l protection for the piping was maintained. No margin of safety was reduced or impacted for the basis section of ,

e the Technical Specifications.

i k

l Page 2 of 2  !

l i l t t

DC 93-144 EDG LOAD SEQUENCING TIMER REPLACENENT NORTH ANNA / UNIT 1 DESCRIPTION The Agastat 2400/7000 Series timers currently used in the Unit 1 Emergency Bus Load Sequencing circuits 1HVRA04 (1-HV-F-37A) and 1HVRF04 (1-HV-F-37F) have been replaced. These timers were exhibiting setpoint drift which results from the timer's poor repeat accuracy (+/- 10% of setpoint for times greater than or equal to 200 seconds and +/- 5% for times less than 200 seconds). These Emergency Bus Load Sequencing circuits were modified to contain Allen-Bradley Series RTC timers instead of Agastat 2400/7000 Series timers. These circuits were chosen based upon a priority set by System Engineering.

One circuit on the 1H Bus and one circuit on the 1J Bus were involved.

SUMMARY

OF SAFETY ANALYSIS An unreviewed safety question did not exist because replacing the existing Agastat 2400/7000 series timers with Allen-Bradley Type RTC timers did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR. The new timers perform the same function as the existing equipment. All design parameters are met or exceeded by the new timers. This modification did not impact any of the existing input or resultant logic for the timer circuits.

The possibility of an accident or a malfunction of a different type than any evaluated previously in the UFSAR was not created because the new timers perform the identical function as the existing equipment. Failure of these timers is bounded by the single failure criteria. Additionally, manual operator actions to start the associated equipment were not being impacted by this modification. All accidents where a loss of off-site power was postulated or an actuation of ESF functions occurred were considered in this review.

The margin of safety as defined in the basses of Technical Specifications is not reduced. Replacing the existing timers with Allen-Bradley Type RTC timers ensured that the requirements for emergency bus load sequencing is maintained.

The new timers perform the same function as the existing equipment.

Page 1 of 1 I

l

DC 93-147 MOV Limit-Limit Control Circuit Wiring Modification North Anna / Unit 1 Descrintion During resolution of the Liberty Technologies Part 21 notification for Unit 1, Motor Operated Valve (MOV) as-left control switch trip (CST) settings were reviewed against the maximum thrust values. ,

The CST settings for several of MOVs were left above the ,

manufacturer's (Velan) specified continuous valve allowable because the targeted thrust band was too narrow to envelope inertial forces. Interim justification for this condition utilized the fatigue limit of the valve. Subsequent conversations with the manufacturer (Velan) resulted in the determination that increasing the continuous allowable may not be possible when considering stresses induced by seismic events. The corporate recommendation for resolving this issue was to modify the control circuitry to make the MOV limit-limit controlled. The MOV Engineer agreed to pursue this option.

The modification to limit-limit control involved wiring an additional limit contact into the control circuit, and re-setting the torque switch. The modification utilized an existing spare limit switch. Previous design philosophy for these valves was to control them torque closed, so as to ensure a seating in the closed direction. This meant the torque switch would deenergize the motor upon being subject to sufficient seating thrust. This modification changed this design so that the Mov trips on a limit switch when the valve reaches a preset position. The torque switch setting was also changed so that the torque switch may protect the mechanical components of the actuator (in case of limit switch failure): the manufacturer's intended control method.

Summary Of Safety Analysis An unreviewed safety question did not exist because:

A. The implementation of this DCP did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR because the torque switch was still wired into the circuit to provide a back-up means of de-energizing the motor if catastrophic failure of the limit switch gearing or rotors occurs or

• if the MOV encounters a line obstruction prior to reaching the preset position.

Page 1 of 2

e B. The implementation of this DCP did not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR ~

because this modification did not replace the limit switch but modified the wiring. This did not have any-impact on increasing the probability of a switch failure.

In addition, following . this modification, diagnostic testing was performed to ensure the wiring change was correct and the limit switch operated correctly. - A leak test was performed to ensure work performed on the valves was adequate to seat the Type C MOVs at the lower thrust-values. The non Type C MOVs~ utilized diagnostic testing to verify seating.

C. The implementation of this DCP did not reduce the margin of safety as defined in the basis of any Technical Specification because these valves still perform the same function to mitigate a LOCA, MSLB, or SGTR and did not change the system operation, flows, or safety related requirements. Therefore, an unreviewed safety question did not exist. In fact, the rewiring change improved the long-term reliability of the valve component portion of-the MOVs since the change does better at controlling the seating thrust.

Page 2 of 2

I DCP 93-160 INSTALL ISOLATION VALVE 8 ON GAS STRIPPER COMPRESSOR l PRESSURE SWITCHE8 AND REPLACE DOWNSTREAM ISOLATION VALVES NAPS - UNIT 1 & 2 l

DESCRIPTION i I

1-BR-57 and 1-BR-59 are check valves located downstream of gas  !

stripper compressor 1-BR-C-1A and 1-BR-C-1B respectively. DCP 93- I 160 replaced these valves with a different model check valve as the original model was no longer manufactured. New isolation valves 1-BR-586 and 1-BR-587 were installed downstream of 1-BR-56 and 1-BR-57, respectively, to facilitate isolation of the check valves for maintenance. In addition, the DCP replaced existing sensing lines to 1-BR-PS-600A/601A, associated with gas stripper compressor 1-BR-C-1A, and installed isolation valves 1-BR-584 and 1-BR-585 in the tubing lines to facilitate testing of the pressure switch. The existing sensing lines and isolation valves 1-BR-572 and 1-BR-574 associated with the 1B compressor were also replaced with stainless steel components under this DCP. I

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-087)

The function and operation of the compressor, its downstream check valve and the sensing line lines to the leak detection pressure switch are not altered by this modification. The modifications made to the gas stripper compressor skid and associated piping will not increase the probability or consequence of an accident previously evaluated in the UFSAR as no accident is directly related to the function or operation of the compressor and the components being installed satisfy the design requirements of the BR system. The probability of occurrence or the consequences of failure of equipment related to safety is not increased as all components installed satisfy the design requirements of the system and are installed using safety related procedures. The function and operation of the gas stripper compressor, its downstream piping and the associated leak detection pressure switch have not changed. ,

Therefore, the margin of safety as described in Tech Specs is not '

I reduced.

l Page 1 of 1 l

DCP 93-161 FABRICATE INSTRUMENT MANIFOLD NORTH ANNA UNIT 1 DESCRIPTION The reactor coolant bypass flow controllers, 1-RC-FC-1481A/1482A, had five valve Whitey block manifolds with threaded connections installed. These manifolds were mistakenly installed during the unit #1 steam generator replacement outage. JCO 93-02 was written to address unit operation with this abnormal condition with an action item to replace the manifolds during the 1994 unit #1 refuel outage. The manifolds were replaced with five valve arrangements fabricated with small Whitey instrument valves. The instrument valves used to fabricate the manifolds met all of the specifications and requirements of the original equipment and had welded connections in accordance with plant specifications.

The flow controllers measure the flow in the reactor coolant bypass loops which provide part of an interlock to the loop stop valves required by Technical Specification 3.4.1.5. The transmitters provide a signal preventing the opening of a cold leg loop stop valve unless the hot leg loop stop valve and bypass valve have been fully open and flow has been greater than 125 gpm for 90 minutes.

This interlock is to prevent a reactor transient which could occur because the isolated loop boron concentration is lower than that of the operating loops / core so that if flow is reinitiated a dilution occurs. The transmitters are only required during unit startup as in modes 1 and 2, the power to the loop stop valves is required to be removed by locking out the breakers.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-056)

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

All accidents were reviewed and a LOCA was found to be applicable.

1) Accident probability was not increased because the new instrument valve connections were welded and the probability of a failure of one of the connections was not increased.

2) Accident consequences were not increased. The manifolds and connections are RCS pressure boundaries which have no role in accident mitigation.

3) No unique accident probabilities were created. The design function of the manifolds was not changed. The manifolds act as system pressure boundaries only. The operation of transmitters was not affected and the interlocks to loop stop valves were still provided.

Page 1 of 2

i DCP 93-161 FABRICATE INSTRUMENT MANIFOLD NORTE AMMA UNIT 1

4) . Margin of Safety was maintained because compliance with the Technical Specifications for the reactor coolant system was not affected and the integrity and reliability of the RCS was not affected. i i

i l

Page 2 of 2  !

I

DCP 93-175 REPLACEMENT OF_RV. TEMPERATURE SWITCHES NORTH ANNA POWER STATION UNITS #1 E #2 DESCRIPTION This design change replaced the existing Honeywell heavy duty thermostat switches (model T6051A1016) for 1/2-HV-TS-1229/1230/2229/2230 with new Honeywell airswitch controllers (model '

T631C1053). The new Honeywell airswitch controllers have a temperature range of 35' to 100* F as compared to 45' to 85* on the old thermostat switches. The setpoints of 1/2-HV-TS-1229/1230/2229/2230 will be raised from 80' to 90' F. The higher setpoint will minimize the operation of the Rod Drive Room supply fans 1/2-HV-F-68A and 68B.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-50)

This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

A. The implementation of this modification did not increase the probability of occurrence or consequences of an accident or malfunctions of equipment important to safety and previously evaluated in the Final Safety Analysis Report.

Accident probability has not been increased because this design change conforms to standards and admins. The operation of the Rod Drive Room ventilation system will not be affected. The emergency air supply fans will be energized at 90* F and still be capable of maintaining the temperature in the MCC J area of the Rod Drive Room below 120' F.

B. The implementation of this modification did not create a possibility for an accident or a malfunction of a .

different type than any previously evaluated in the Final l Safety Analysis Report.

l The implementation of this DCP does not create a <

possibility for an accident or a malfunction of a  !

different type than any evaluated previously in the UFSAR I because the Rod Drive Room ventilation system will not be affected. Consequences have not been increased because a possible failure of the DCP would not have corrupted Page 1 of 2 i

I

1 1

I DCP 93-175 I

any mitigating systems.

l C. The implementation of this modification-did not reduce i the margin of safety as defined in the basis of any. ,

Technical Specification.

r The integrity and reliability of the Rod Drive Room l ventilation system has not been affected. .

t i

i I

4 Page 2 of 2

d' 1

l i

DCP 93-180  ;

Steam Generator Platforms r

. North Anna Unit .1 .:

i DESCRIPTION  :

Base plate anchorages of the steam generator secondary valve access platforms in the t Unit 1 containment were reinforced to bring Hilti bolt factors of safety to  !

manufacturers recommedation of 4.0 or greater. Various methods were utilized. l Additional Hilti bolts were installed in some cases and in others addition steel  ;

members were added in a trussed configuration. In all cases safety factors were  !

increased to a level of at least 4.0. i

SUMMARY

OF SAFETY ANALYSIS Design Change DCP 93-180 does not create an "unreviewed safety question" as  ;

delined in 10 CFR 50.59. .

A. The implementation of this modification does not increase the probability of occurrence or the consequences of an accident or malfunction of ,

equipment important to safety and previously evaluated in the Safety  :

Analysis Report. l The bases of the steam generator secondary valve access platforms were reinforced to increase safety factors to an industry accepted level  !

~

of at least 4.0.

B. The implementation of this modification does not create a possibility for ,

an accident or malfunction of a different type than any previously evaluated in the Safety Analysis Report.  :

Seismic restraint of the existing steam generator platforms was l enhanced by reinforcement of the platform bases. Some instances required additional Hitti bolts installed and other bases required additional  ;

steel to be installed in a trussed type configuration. In all cases the safety factors of Hilti bolts was increased to at least 4.0. j C. The implementation of this modification does not reduce the margin of +

safety as defined in any Technical Specification.

The margin of safety increased due to reinforcement of the platform j base plates. Safety factors were increased to a factor of at least 4.0.

Seismic restraint capabilities of the anchorages increased. 1 PAGE 1 OF 1 i

DCP 93-200 MODIFY CONTAINMENT RING DUCT DAMPERS NORTH ANNA UNIT 2 DESCRIPTION The manually operated containment ring duct dampers were difficult to inspect as it required personnel to enter the duct which is a i contaminated, high radiation area. Test taps were added to the duct at the dampers to allow inspection of the dampers from outside the duct.

The containment recirculation system is used to maintain containment temperatures within limits as defined by Technical Specifications. This is to ensure that equipment is not exposed to temperatures higher than it is qualified for.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-020)

The accidents considered were a LOCA and MSLB.

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

1. Accident probability was not increased because the system has no role in the occurrence of an accident. <

2. Accident consequences were not increased. Containment temperatures will still be maintained vithin limits as defined by Technical Specifications.

3. No unique accident probabilities were created. The test taps are passive components which will not affect the operation or ,

function of the system or the ring duct.

4. Margin of safety was maintained because containment temperatures will still be maintained within limits as required by Technical Specifications.

Page 1 of 1 1

_. - _ ~ . _ . -

4 l

DCP 93-202 REMOVAL OF PIPING ASSOCIATED WITH RCP TEST CONNECTIONS NAP 8 UNIT 1 DESCRIPTION To eliminate several potential sources of leakage, the thermal barrier test connection spool pieces have been removed from the Unit 1 reactor coolant pumps and the connections have been cut and capped at the pumps. The U-bolts and nuts of the existing spool piece supports have been removed and the support structures have been abandoned in place.

Removing the unused spool pieces and capping the connections has no affect on the normal or emergency operation of the unit. The pressure boundaries of the Chemical and Volume Control and Reactor Coolant Systems have been maintained.

SUMMARY

OF SAFETY EVALUATION (94-SE-MOD-023)

Each reactor coolant pump had 2 thermal barrier test connections.

These each had a flanged connection to a spool piece that had a blank installed on its end. These connections were used during pre-operational testing to set up the seal injection flow rates.

Earlier, one of the flanged connections on a thermal barrier test connection on 2-RC-P-1C started to leak. Design Change 93-176 was written and implemented to repair the leak and eliminate its source by removing a spool piece and installing a blank flange at the pump connection. Design Change 93-203-2 cut and capped the *emaining thermal barrier test connections on the Unit 2 reactor coolant  ;

pumps.

To further reduce the probability of leaks from these connections, the Unit 1 spool pieces have been removed and the flanges have been cut from the end of the pump connections and pipe caps installed.

Westinghouse was consulted and said that the" know of no use for these connections in the foreseeable future.

This change was allowed for the following reasons:

1. These test connections were no longer used.

2. Welding pipe caps on these connections eliminated possible leak sites at several gasketed connections.

3. The pipe caps were rated for RCS pressure.

Page 1 of 2

DCP 93-202 RENOVAL OF PIPING ASSOCIATED WITN RCP TEST CONNECTION 8 NAP 8 UNIT 1 An unreviewed safety question did not exist because:  ;

1. The probability of accidents such as the loss of coolant or i RCS depressurization was slightly decreased by elimination of possible leaks sites.

2. Consequences of accidents have not been affected because the test connections are not used to mitigate accident consequences.

3. No unique accident probabilities have been created and the margin of safety was maintained.

Page 2 of 2

DCP 93-205 REPLACEMENT OF TEE'S WITH ELBOWS NORTH ANNA UNIT 1 DESCRIPTION The pressurizer level transmitters were originally Barton transmitters. These were replaced with Environmentally Qualified Rosemount transmitters per DCP 81S-08 A&B. The Barton trancaitters were equipped with calibration taps which were no longer required.

The tubing tee's to the calibration ports were capped using Swagelock compression fittings. Swagelock compression fittings are no longer acceptable in containment in order to eliminate possible locations for RCS leakage. The tee's were removed and replaced with welded elbows.

The level transmitters provide inputs to the pressurizer high level trip, level control logics, control room annunciator, control room recorder, backup heater logics, CVCS flow control, CVCS letdown isolation and pressurizer heater cutoff controls. The reactor trip is a backup to the high pressure trip. No credit was taken for the trip in the accident analysis and they were installed only to enhance overall RCS reliability.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-075)

All accidents were reviewed and a small break LOCA, FW Pipe Rupture, Steam Generator Tube Rupture and Large Break LOCA were considered to be applicable.

1) Accident probability was not increased as the tubing elbows eliminated the compression caps and reduced the number of sites for possible RCs leakage and decreased the probability for a small break LOCA. The transmitters are to detect accidents and do not contribute to their probability.

2) The consequences of any of these accidents was not affected.

Failure of the elbows is still bounded by the small break LOCA analysis in the UFSAR. The trip function of the transmitters was not affected as the tubing operation was not affected. A reactor trip signal shall still be received with the 2/3 criteria if a high level is detected in the pressurizer.

3) No unique accident probabilities were created. The only function of the tee's was as system pressure boundaries. The elbows will serve the same function with less possible leakage sites.

4) Margin of Safety was maintained because the integrity and reliability of the RCS and the transmitters was not affected.

All components used for this modification were in accordance with all applicable codes, standards and specifications.

Page 1 of 1

DCP 93-214 SI TEROTTLE VALVE LOCKING DEVICES MAPS -' UNIT 1 l DESCRIPTION During flow balance testing of the high head safety injection system in the spring of 1992, it was found that difficulty exists in maintaining repeatability of the test. In order to ensure lack of repeatability is not a result of valve movement, a new locking device has been installed. The device holds the valve stem in position once the valve is set in position.

sUxmaRY or SAFETY AMALYSIB (94-SE-MOD-035)  !

The performance criteria for the SI system is to 1) support the function of providing cooling water to the reactor vessel to reflood the core and provide long term decay heat removal and 2) support the function of providing boric acid solution to the RCS so that the reactor can be shut down and can be maintained shutdown.

The throttle valves are used to limit the total pump flow to 650 -

gpm with the seal injection line open in order to prevent pump i runnout. The valves are set per Technical Specifications for flow rates through the lines.

All accidents were reviewed and the applicable accidents are those which require a safety injection. These. include accidental depressurization of the main steam system, major secondary system ,

pipe rupture, small break LOCA, large break LOCA, steam generator j tube rupture, main steam line break and rupture of the control rod  ;

drive mechanism housing. i l

1) Accident probability has not been increased as the SI system 4 is for accident mitigation only. These lines are normally isolated and will only be used after a safety injection i signal.  !

2) The consequences of the evaluated accidents is not affected. l Flow balancing of the system and installation of the lock will  !

be performed prior to entering mode 4. The valves will perform the same throttling function as the original valves.

3) No unique accident probabilities are created. The function of l the SI system is for accident mitigation. System operability  !

is already covered by Technical Specifications and the applicable Limiting Conditions for Operation.  ;

4) Margin of Safety is maintained because the integrity and ,

reliability of the SI system is not affected. The valves are l still capable of performing their safety function.  :

Page 1 of 1 I

l l

. . . _ , . . ~ . _ . , , _ , , _ . .__ _ ._ ___

DCP 93-231 l INSTALL DAMPER LATCHING DEVICE NAPS UNIT 1 & 2 DESCRIPTION During normal plant operations, the duct manways for the emergency ventilation fans, 1/2-HV-F-41/42, are open. During a DBA one or more of the fans automatically start in recirculation mode with the number of fans starting depending on the type of accident. These fans are in a recirculation mode with air from within the control room envelope being provided to the suction of the fans via the open manways. An hour later, the dampers to two of the fans are closed and these fans are used to provide filtered air from the turbine building. Due to the one of the manways being inadvertently closed on two occasions, a latching device was installed on the doors. The manways may still be closed rapidly following an accident as the latch is a quick release pin which requires no tools to remove.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-066)

All accidents were reviewed and all accidents were considered as the duct is part of the control room habitability system.

1) Accident probability was not increased because the control room habitability system allows plant operation from the control room to continue after an accident and does not affect the probability of accident occurrence.

2) Accident consequences were not increased. The operation and function of the dampers was not changed.

3) No unique accident probabilities were created. The design function of the dampers was not changed. The pressure boundary of the emergency ventilation system was not affected.

4) Margin of Safety was maintained because compliance with the Technical Specifications for the control room habitability system was not affected and the integrity and reliability of the system was not affected.

Page 1 of 1

DCP 93-258 PERFORM WIRING NODIFICATION TO THE FLOW TRANSMITTER MODULE NORTH ANNA POWER STATION UNIT #1 Executive Summary This design change interlocked a set of contacts on the emergency boration isolation valve (1-CH-MOV-1350) with the emergency boration flow transmitter module (1-CH-FM-1110). This set of contacts close when 1-CH-MOV-1350 is closed and open once the valve has been lifted from its seat. This set of contacts has been connected to the EXT CON of 1-CH-FM-1110. When the contacts are closed the EXT CON internal circuitry of the flow transmitter module (1-CH-FM-1110) drives the output to 4 mA, i.e. O gpm indication in the MCR. When the contacts are open, the EXT CON internal circuitry is bypassed and the output of the flow transmitter module (1-CH-FM-1110) will reflect the actual emergency boration flow conditions. The instrument accuracy of 1-CH-FM-1110 has not be affected by this design modification.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-026)

This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

MAJOR ISSUES:

The major issue in this DCP was to ensure that physical independence and overfill in cable trays has been maintained in accordance with NAS-3012. The newly installed cable was color coded neutral and routed in neutral tray and conduit between 1-CH-FM-1110 and 1-CH-MOV-1350 in the Aux Building.

JUSTIFICATION:

This modification eliminated the problem of the emergency boration flow indicator (1-CH-FI-1110) from indicating full flow when flow does not exist. This erroneous indication in the MCR caused the operator to make additional checks to ensure that there was not flow to the suction header of the charging pumps. This modification has eliminated this problem by causing the output of the emergency boration flow transmitter / module to be a constant 4 mA, i.e. O gpm, when emergency 1

h DCP 93-258 boration valve (1-CH-MOV-1350) is closed. The new cable has been installed in accordance with NAS-3012 to ensure physical independence and overfill in cable trays.and conduit has been maintained.

UNREVIEWED SAFETY QUESTION A88E88 MENTI

1) Accident probability has not been increased because this design change conforms to standards and admins. .The operation of 1-CH-MOV-1350 and the CVCS emergency boration system has not be affected.

The reliability of the emergency borate flow indication has been improved. This has enhanced the reactor reactivity control. If the flow transmitter / module were to fail, the emergency boration function has not been affected, however the emergency boration flow indication in the MCR has been lost. The fact that emergency boration was taking place would be apparent to the CRO through other instrumentation, i.e. alarms, Tavg, valve position indication.

2) Accident consequences have not increased. The implementation of this DCP was performed during an outage. The operation of the CVCS emergency boration function has not been affected due to this design change. The reliability of the emergency borate flow indication in the MCR has been improved and has enhanced the reactor reactivity control.

Consequences.are not increased because a failure of the DCP has not corrupted any mitigating systems.

3) No unique accident probabilities have been created.

The implementation of this DCP has not created a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR because the design change was performed ,

during an outage and operation of the emergency t boration function of the CVCS system has not been affected.

4) Margin of Safety has been maintained because the integrity and reliability of the CVCS has not been affected. The reliability of the emergency borate flow indication in the MCR has improved and this has enhanced the reactor reactivity control.

2 l

1 I

DC 93-277 Motor Operated Valve (MOV) Thermal Overload Replacement North Anna / Unit 1 Description In their Generic Letter 89-10, the USNRC identified several areas of concern regareding the operability of MOVs. As a result, the utilities were required to prepare and implement a program to improve the operability of safety related MOVs. As a part of the Virginia Power response to the USNRC GL 89-10, the sizes of Thermal overload elements for all safety related MOVs have been evaluated via calculation EE-0557. Proper sizing of an MOV TOL provides adequate protection of the motor and at the same time assures operability of the MOV under design basis events. The purpose of this DCP was to implement the TOL replacement for the Unit 1 MOVs which was accomplished during the Unit 1 outage.

Summary Of Safety Analysis An unreviewed safety question did not exist because:

A. The implementation of this DCP did not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR because the MOVs involved are used to respond to an accident which has already occurred.

B. The implementation of this DCP did not create a possibility for an accident or a malfunction of a different type than any evaluated previously in the UFSAR because the thermal overloads are not called upon to operate unless the MOV has already received a signal to change position and has failed to accomplish that change.

C. The implementation of this DCP did not reduce the margin of safety as defined in the basis of any Technical ,

Specification because the MOV operation is not altered and the overall reliability of the MOVs has been increased.

page 1 of 1

DCP 93-282 INSTALLATION OF LADDER RACKS North Anna Units 1 & 2 DESCRIPTION '

A ladder rack was installed in each of the Quench Spray Pump Houses, in order to permanently store ladders. This will prevent operators from having to check out a ladder from the tool crib, lower the ladder into the basement and then have Health Physics frisk and perhaps decontaminate the ladder when exiting the RCA. The ladder racks are steel plates bolted to reinforced concrete walls designed to seismically restrain the ladders, if that event should ever occur.

SUMMARY

OF SAFETY ANALYSIS Design Change DCP 93-282 does not create an "unreviewed safety question" as defined in 10 CFR 50.59.

A. The implementation of this modification does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Safety Analysis Report.

The engineered ladder racks offer seismic restraint to the light-weight ladders. Also the ladders were stategically located such that no safety related equipment is located in the collapse envelope of the ladders.

B. The implementation of this modification does not create a possibility for an accident or malfunction of .a different type than any previously evaluated in the Safety Analysis Report.

The ladders are supported seismically and located such that no safety related equipment lies within the fall envelope of the ladders.

C. The implementation of this modification does not reduce the margin of safety as defined in any Technical Specification.

The margin of safety of any safety related equipment in the basement of QS is not changed. The ladders are seismically restrained. Also no safety related equipment is located within the fall envelope of the ladder.

PAGE 1 Of 1

DCP 94-007 I HHSI Flow Instrumentation Upgrades North Anna Unit 1 l

Description North Anna Technical Specification 4.5.2.h gives requirements for High Head Safety Injection (HHSI) branch line flow balance testing. The Technical Specification requires flow balance testing during plant shutdown to be accomplished following modifications to Emergency Core Cooling (ECCS) subsystems which altered subsystem flow characteristics.

The Technical Specifications require that the total HHSI flow rate remain less than or equal to 660 gpm when flowing one pump to an atmospheric RCS. The basis of this total flow limitation is to prevent pump run out (approximately 675 gpm). The flow balance testing is performed with HHSI pumps taking suction from the Refueling Water Storage Tank (RWST). This total flow is the sum of three HHSI branch line flows plus simulated Reactor Coolant Pump (RCP) seal injection flow.

Technical Specification 4.5.2.h also requires that the sum of the injection line flow rates, excluding the highest flow rate, is greater than or equal to 359 gpm. This 359 gpm minimum value is based on ensuring that the ECCS criteria for peak clad temperature (2200 F)is met.

Pre-operational HHSI flow balance testing was performed for Unit I and Unit 2 on 5/5/77 and 3/14/80, respectively using the installed flow instrumentation. This instrumentation consist of two pressure taps off of the HHSI branch lines which are separated by only two feet. This configuration relies only on the frictional losses between the two taps which results in a head loss of approximately 4 feet at a flow rate of 200 gpm. Accuracy for this type ofinstrumentation is generally assumed to be on the order of 10%.

Special test 1-ST-41 was performed on 3/27/81 in response to Westinghouse technical bulletins NSD-TB-80-11 and NSD-TB-81-10. Both of these bulletins discussed potential problems associated with the delivery of flow and the HHSI branch line flow balancing related to pump degradation / replacement and instrument inaccuracies. The HHSI throttle valves were set by the number of turns open and the use of mechanical spacers to establish accurate and repeatable throttle valve stem heights.

A Westinghouse Letter, Serial #VRA-89-757, discussed several topics related to ECCS flow inconsistencies. These inconsistencies were 1) actual plant system resistances and pump curve assumptions may be inconsistent with Westinghouse assumptions, 2) RCP seal injection flow may be greater than the value used in the Westinghouse analysis, 3) pump degradation has resulted in some plants opening up throttle valves which could result in actual delivered flow to LM101 SUM i

the RCS during small and intermediate break LOCAs being less than that assumed in the safety analysis, and 4) the Westinghouse analysis assumed a maximum flow imbalance between branch lines of 10 gpm, but this may not be the case at some plants.

As a result of the Westinghouse letter, Station Deviation DR 89-2250 was written which resulted in an action plan to perform testing per NA&F report titled " Final Report for Evaluation of Flow Inconsistencies for Surry Units 1&2 and North Anna Units 1&2" dated 2/14/89. _In an effort to obtain better flow measurement accuracy, it was decided to pursue the use of clamp on

, ultrasonic Controlotron flowmeters. HHSI flow balance testing was subsequently performed each refueling outage for both units using the Controlotron flowmeters. These flowmeters were calibrated by Controlotron to have an error of less than 1%.

In October 1990, during the performance of Unit 2 HHSI flow balance testing it was discovered that the as-found cold leg branch line flows were not sufficient to meet Technical Specification requirements. At this time, Technical Specification 4.5.2.h required the sum of the branch flows, excluding the highest branch flow, to be greater than or equal to 384 gpm. Using the single most limiting pump, the sum of the two lowest branch line flows was only 347 gpm. The cause of the event was attributed to the previous positioning of the HHSI branch line throttle salves using the permanently installed in line flow instruments.

On April 13,1992, while reviewing the Unit 2 HHSI flow balance test results, it was determined that the as-found cold leg branch line flows were insufficient to meet Technical Specification requirement 4.5.2.h. Using the most limiting HHSI pump, the sum of the two lowest flows was only 347 gpm. The cause of the event was attributed to repositioning of the throttle valves using I previously taken stem height measurements after the installation of stem locking devices.

On March 20, 1993, it was discovered during the performance of Unit i HHSI flow balance testing that the as-found cold leg line flows were insufficient to meet Technical Specification ,

requirements. The cause of this event was attributed to the Technical Specification change j

(#259) which was issued for both units on August 4,1993. The change reduced the minimum l flow requirement for the two lowest flow branch lines from 384 to 359 gpm with no i measurement uncertainty. Therefore, flow balance acceptance criteria values the TS change also increased the maximum total pump flow from 650 to 660 gpm. Also, a surveillance requirement was added to define a value greater than or equal to 43.8 gpm to be used for simulated RCP seal injection flow during the flow balance testing.

On October 14,1993, during the performance of Unit 2 flow balance testing, the sum of the two lowest branch line flows, excluding the highest flow, was equal to 356 gpm. The cold leg throttle valves were adjusted so that the sum of the two lowest flow rates was equal to 347 gpm. q Review of previous flow balance and valve stem height measurements revealed that very small changes in stem height results in relatively large changes in flow rate. The Unit 2 HHSI branch line throttle valves were fixed in position using Locktite brand "Threadlocker 290". As a result of the Technical Specification violation, an emergency Technical Specification change (#259A) was submitted to the NRC to eliminate the simulated seal injection flow rate.

DM107.3UM1

Because of the 10/14/93, Unit 2 Technical Specification violation event, a iloot Cause Evaluation was initiated, RCE 93-05 "HHSI Flow Balance". It was determine that the uncertainty in measurement using Controlotrons is on the order of 5.5%.

As a result of the uncertainty associated with using the existing installed flow instrumentation configuration (i 10%) or the use of Controlotron flow instrumentation (i 5.5%), the Root Cause Evaluation recommended that a local means of flow measurement should be installed which would provide an accuracy of 0.5% (error only for differential producer).

In order to provide for accurate HHSI branch line flow indication, this DCP installed a flow venturi assembly with an integral upstream flow conditioner in each of the three HHSI branch lines to the RCS cold legs. Each flow venturi assembly was laboratory calibrated to verify a flow accuracy of 0.5% or better. One flow venturi was flow tested to verify the i 0.5%

accuracy in a piping arrangement which simulates the worst case "as-built" HHSI branch line piping arrangement. The flow venturi assemblies were installed upstream of the existing throttle valves,1-SI-188,191 and 193.

In addition, a pressure redr 'g orifice assembly were installed downstream of each HHS1 branch line throttle valve to fvide a portion of the pressure drop which was required to be taken solely by the throttle vt e. This permitted the throttle valves to be positioned more open with less pressure drop. Therefore, better throttle control was provided over the expected flow balancing range of 170 gpm to 210 gpm.

Summarv of Safety Analysis This design change did not create an unreviewed safety question as defined in 10CFR50.59.

Flow venturis were selected as the differential producer because of an expected flow measurement accuracy of 0.5%. The procurement specification for the venturi assemblies required a flow accuracy requirement of better than or equal to 0.5%. As part of the venturi assembly, an integral flow conditioner was utilized to provide a satisfactory flow profile for the pressure drop measurement. In order to ensure the flow accuracy requirements for the venturis was met, Alden Research Laboratory, Inc. calibrated all three of the Unit #1 flow venturis over the expected flow balance range of 170 gpm to 210 gpm (minimum). In addition, one flow venturi was flow tested over the expected flow range to verify the i 0.5 % accuracy requirement in a piping arrangement which simulates the worst case "as-built" HHSI branch line piping configuration at North Anna.

ASME standard MFC-3M-1989 was used in designing the venturi assemblies with integral flow conditioners. The venturis were designed to provide a differential pressure of approximately 84.5 psi at a flow of 200 gpm. Flow passage through the flow conditioner and venturi bore were designed to pass post LOCA debris with a frontal dimension of 0.12" x 0.12" which could pass through the containment sump fine mesh screens.

DueU7 SL'M 3

i The flow venturi assembly consisted of a venturi body section with an integral flow conditioner and two instrument root valves as shown on vendor drawing N-94007-1-V-800 and N-94007 V-801. The venturi body and valves were made out of stainless steel SA 479 316. The flow conditioner was made out of stainless steel tubing SA 213 TP 316. The design weight of the ventu-i assembly was kept to a minimum (20 lbs.) to eliminate the need of any additional piping supports.

Which accidents previously evaluated in the Safety Analysis Report were considered?

Loss of Coolant Accident A. Could the activity increase the probability of occurrence for the accidents identified above? State the basis for this conclusion.

No, the venturis and pressure reducing orifice assemblies are isolated from the Reactor Coolant system via two downstream check valves. The venturis and pressure reducing orifice assemblies meet or exceed the design requirements for the SI system.

B. Could the activity increase the consequences of the accidents identified above? State the basis for this conclusion.

No, the venturis and pressure reducing orifice assemblies were designed to meet or exceed the requirements of the SI system. In addition, the flow passage through the venturis and pressure reducing orifices were sized so as not to create an obstruction due to post LOCA debris which passes through the containment sump screens. The SI system performance was not impacted as a result of this modification. Thus, ECCS flow delivered during a postulated LOCA remained unchanged by the modification.

C. Could the activity create the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report? State the basis for this conclusion.

No, the venturis and pressure reducing orifice assemblies were assigned to meet or exceed the requirements of the SI system.

Malfunctions of equipment related to safety, previously evaluated in the Safety Analysis Report, were considered?

HHSI branch line rupture A. Could the activity increase the probability of occurrence of malfunctions identified above? State the basis for this conclusion.

No, the venturis and pressure reducing orifice assemblies were designed to meet or exceed the requirements of the SI system.

l nuun sw l

l

t B .' Could the activity increase the consequence $ of the malfunctions identified above? State tne basis for this conclusion. ,

i

-No. the venturis and pressure reducing orifice assemblies were designed to meet or i exceed the requirements of the SI system. In addition, the flow passage through the i venturis and pressure reducing orifices were sized so as not to create an obstruction due to post LOCA debris which passes through the containment sump screens. The SI system performance was not impacted as a result of this modification.  !

C. Could the activity create the possibility for a malfunction of equipment of a different type j than was previously evaluated in the Safety Analysis Report?^ State the basis for this  !

conclusion. t No, the venturis and pressure reducing orifice assemblies were designed to meet or i exceed the requirements of the SI system. In addition, the flow passage through the .

venturis and pressure reducing orifices was sized so as not to create an obstruction due .

to post LOCA debris which passes through the containment sump screens. The SI l system performance was not impacted as a result of this modification.'  :

L Has the margin of safety of any part of the Technical Specifications as described in the bases section been reduced? Explain. ,

No, the operation, function and performance of the SI system was not impacted as a result of l this modification. No technical specification margin of safety was reduced.

i Does the proposed change test, or experiment require a change to the Technical Specifications?

Explain.  !

No, the operation, function and performance of the SI system was not altered as a result of this modification. ECCS flows were not degraded. No technical specification margin of safety _ was i reduced.

F 2

i Deq7.3UM $

f i

d DCP 94-100 INSTALL REDUNDANT CNBCE VALVE IN SERIES WITH 1-CH-215 NORTE ANNA UNIT 1 l

DESCRIPTION Westinghouse Nuclear Safety Advisory Letter 92-012 identified a i potential post-LOCA ECCS leakage path to the environment during the -

SI recirculation mode of operation. The component of concern was I the single check valve which isolates the combined VCT and seal  ;

water heat exchanger returns to the suction of the charging pumps.  !

A single failure of the check valve could result in it not fully i seating with back leakage occurring during LOCA with SI in  :

recirculation mode. LHSI pump discharge pressure would then pressurize the seal water heat exchanger line and potentially cause  !

its relief valve to lift. If the relief valve did lift, water recirculated from the containment sump would be discharged to the VCT. Eventually the VCT would fill sufficiently to compress the H 2 overpressure bubble and cause the VCT relief valve to lift. The discharge of potentially radioactive fluid from the VCT would be e sent to the waste drain system and eventually provide a gaseous fission product release path to the environment.

The design change installed a check valve in the 3" seal water heat exchanger return line near its junction with the VCT outlet line would provide a redundant check valve to prevent single failure of an active component (VCT outlet check valve) from initiating the event leading to the postulated ECCS leakage to the environment.

A leak-off drain / vent valve was also installed between the two check valves to allow for future ISI leak testing of the check i valves.

I

SUMMARY

OF 8AFETY ANALYSIS (93-SE-MOD-051)

The replacement of the relief valve spring did not constitute an unreviewed safety question as defined in 10CFR50.59 since it did ,

not t

i A) Increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety ,

and previously evaluated in UFSAR. l Activity installed a check valve in the seal water heat l

exchanger return line to provide redundancy and thus, .

eliminate single active failure of the VCT outlet check valve,  ;

as the cause of the potential ECCS leakage to the environment.

Function and operation of the CVCS and ECCS did not change as a result of the modification. The check valve was sized to ensure that the charging pump minimum recirc flow rate was Page 1 of 2 l

J

DCP 94-100 INSTALL REDUNDANT CHECK VALVE IN SERIES WITH 1-CH-215 NORTE ANNA UNIT 1 maintained to prevent overheating of the pumps. The check  :

valve and test valve assembly conformed to existing design '

codes and standards and qualified for use in this application.

The modification did not corrupt mitigating systems or redundant features associated with the charging pumps, CVCS or ECCS.

B) Create a possibility for an accident or malfunction of a different type than any evaluated previously in the UFSAR.

Activity eliminated the potential for an unmonitored radiological release to the environment. Addition of a '

redundant check valve did not create any accident scenario that.would not have been previously analyzed for the existing check valve arrangement. Modification met system design requirements. Addition of the check valve and test valve assembly had been seismically analyzed to ensure the seismic integrity of the line was maintained. UFSAR listed the most probable failure mechanism was back leakage through a normally closed valve. The redundant feature added by the check valve eliminated the possibility of creating an accident or malfunction not previously evaluated for the single check valve arrangement. Scenarios of failure due to a stuck closed check valve did not differ from that of existing conditions. '

New or unique malfunctions were not introduced.

c) Reduce the margin of safety as defined in the basis of any Technical Specification.

Operation and integrity of the CVCS remained unchanged. The operability of ECCS subsystems was not compromised by this activity. Verification that the charging pumps developed the required discharge pressure on recirculation flow was performed to ensure Tech Spec compliance. Charging pump recirc flow rate was verified to ensure minimum flow rate was maintained.

Page 2 of 2

l DCP 94-104 Fuel Transfer Tube Blind Flange Bolt Reduction-North Anna Unit 1 1 i

DESCRIPTION The blind flange was attached to the fuel transfer tube with 20 bolts. In order to reduce the time of removal and reinstallation and consequently reduce radiation dose  ;

a new blind flange was installed that would decrease the number of closure bolts to l

as few as four. To facilitate this, a new blind flange was fabricated with a double l concentric ring set of grooves to accept " Quad" ring seals. These new seats resemble the shape of a four leaf clover. The installation was successfully completed during the September 1994 Unit 1 outage.

SUMMARY

OF SAFETY ANALYSIS This design change in accordance with DCP 94-104 does not create an "unreviewed safety question" as defined in 10 CFR 50.59.  !

A. The implementation of this modification does not increase the probability  !

of occurrence or the consequences of an accident or malfunction of  ;

equipment important to safety and previously evaluated in the Safety l Analysis Report. ,

Calculations were performed to confirm the minimum number of bolts  !

required both for adequate sealing and to resist the operating conditions  !

including seismic loading. Also bolt stress calculations were performed  ;

to assure that the bolt preload plus any applied operational loads including seismic will not result in stresses that exceed the bolt allowable limits.  !

B. The implementation of this modification does not create a possibility for I an accident or malfunction of a different type than any previously evaluated in the Safety Analysis Report, j i

Based on engineering calculation it has been demonstrated that the  :

design requirements for the fuel transfer tube cover and bolting continue I to be met, and its containment isolation function is maintained. The .

reduction in the number of transfer tube cover bolts will not be the ] '

initiator of a new accident.

PAGE 1 OF 2 1

e w , -+- - - - ,,

C. The implementation of this modification does not reduce the margin of safety as defined in any Technical Specification.

The margin of safety of the flange to provide a leak tight boundary.

against the uncontrolled release of radioactivity to the environment and to assure that the containment design conditions important to safety are-not exceeded, for as long as postulated accident conditions require, have not changed. Requirements of the ASME Code with regard 'to the transfer tube cover and cover bolting have been maintained.

\

\

l PAGE 2 of 2  ;

DCP 94-115 REPLACEMENT OF CHARGING PUMP CA8ING 2-CH-P-1B NORTH ANNA UNIT 2 DESCRIPTION When charging pump 2-CH-P-1B was disassembled for routine maintenance, indications were discovered in the pump casing. The pump manufacturer had previously issued a bulletin advising owners of the pumps that had casings constructed of carbon steel cladded with stainless steel to inspect them for cladding cracks, erosion or damage when disassembled. The indications were severe enough to warrant casing replacement rather than repair the existing casing.

The existing pump casing was replaced with a solid stainless steel casing. All nozzles and connections on the new casing were of the same size and location, so no piping changes were required. The pump internals, which determine the pump's performance characteristics, were reinstalled in the new casing to avoid generating changes to the pumps pressure and flow features.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-028)

The replacement of the charging pump casing did not constitute an unreviewed safety question as defined in 10CFR50.59 since it did not:

A) Increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in UFSAR.

The new casing met or exceeded the design requirements of the original equipment. The operational characteristics of the pump remained the same since the original pump internals were retained for use in the new casing. The HHSI pump continued to perform its intended function for mitigation of applicable accidents. All modifications involved in the casing replacement were external to the pump and in no way affected pump performance or operation.

B) Create a possibility for an accident or malfunction of a different type than any evaluated previously in the UFSAR.

Pump casing replacement was essentially a one-for-one replacement and since the original pump internals were retained for use in the new casing, the pump would continue to operate in the same manner as before the modification was performed. The possibility of creating a different accident or malfunction that wasn't previously evalauted was not credible.

Page 1 of 2

l 4

DCP 94-115 REPLACEMENT OP CHARGING PUMP CASING 2-CH-P-1B NORTE ANNA UNIT 2 C) Reduce the margin of safety as defined in the basis of any Technical specification.  ;

l Replacement of the pump casing was essentially a one-for-one replacement with minor modifications to external mounting configurations. Pump operation remained unchanged as a result of the design change. The modification had no impact on the Tech Specs nor was the margin of safety affected by this work. l l

Page 2 of 2

DCP 94-119 INSTALLATION OF A PLATFORM OVER A FLOOD BARRIER North Anna Unit 1 DESCRIPTION A plate was installed on the concrete flood wallin front of the Emergency Switchgear Room in the basement of the turbine building. The platform provides a safer method of carrying equipment / tools over the flood wall.  :

EUMMARY OF SAFETY ANALYSIS Design Change DCP 94-119 does not create an "unreviewed safety question" as defined in 10 CFR 50.59.

A. The implementation of this modification does not increase the probability of occurrence or the consequences of an accident or malfunctio., of  :

equipment important to safety and previously evaluated in the Safety -

Analysis Report.

The ability of the existing flood wall to stop flooding into the Emergency i Switchgear Room is not changed. The structural capability of the reinforced concrete wall is not changed. The wall is not lowered or heightened. During a seismic event there is no safety related equipment or components within the fall envelope of the platform. The physical size of the platform is a plate 1/4" thick x 2' x 2'.

I B. The implementation of this modification does not create a possibility for an accident or malfunction of a different type than any previously evaluated in the Safety Analysis Report.

The installation of the smalllightweight platform will not cause accidents of any other type. The wall will still prevent flooding into the Emergency  :

Switchgear Room. Seismically, failure of the plate will cause no damage because there is no safety related equipment nor any other plant equipment within the fall envelope of the platform.

C. The implementation of this modification does not reduce the margin of safety as defined in any Technical Specification.

The margin of safety of the flood wall to prevent flooding into the Emergency Switchgear Room is not changed. Operability of the flood wall will be maintained during and after implementation.

PAGE 1 OF 1 1

- = . , . -- - . _ . .. _. - - -

. . . i i

UNDERFREQUENCY RELAY CABLE SEPARATION l

DCP 94144 Executive Summary  :

The 125VDC power cables to the Underfrequency Auxiliary Relay Cabinets have been color coded Red, White and Blue and re-routed accordingly per NAS-3012. Two new conduits were installed. This  ;

work was perforn'ed to meet required cable separation.

SUMMARY

OF SAFETY EVALUATION MAJOR ISSUES j The DC power supplies to the Underfrequency Auxiliary Relay Panels [1-EP-CB-28UA, UB, UC] are 1 designated Neutral, i.e. Black. Other cables associated with the panels are color coded. Outputs to

' the RPS are designated Blue, White, and Red and the frequency inputs are Green. Since the DC power cables are not color coded, cable separation was not required. Note that the DC power originated from the Blue, White, and Red batteries. From each battery, the power cables are routed in separate dedicated conaults to a ccmmon JB. From the JB, all three are routed in a single dedicated conduit to a second JB. Again, the cables separate at the JB and are routed in separate dedicated conduits to the UF Aux. Relay Panels. l UF on 2/3 RCP buses initiates a reactor trip via the RPS. UF is an original plant design primary  ;

reactor trip based on WCAP-7306. As identified in UFSAR sections 7.2.2.2.1 and 3.1.16.2, the RPS was designed in accordance with IEEE 279-1971. Further, the UFSAR states that one means of  ;

meeting single failure criterion is via the RCP UF relays. The cables should have been designated color  !

coded and thereby routed separately in accordance with NAS-3012.

Note that for an event to result in a significant frequency reduction on the system, the transmission grid -  ;

would have to be in a deteriorated condition. Existing procedures (1-OP-26.8) require initiation of an l LCO for offsite power sources for both units if the switchyard voltage decreases below 505kv.

REASON FOR CHANGE TO BE ALLOWED I This change is required in order to comply with the UFSAR requirements.

i UNREVIEWED SAFETY QUESTION j An unreviewed safety question does not exist for the following reasons:  ;

1 Neither the probability of occurrence, nor the consequences of a complete loss of forced reactor '

coolant flow have increased as a result of this DCP. Additionally, there is no increased probability of losing the reactor coolant pumps or the RCP bus UF relays since there are no modifications to the logic or protective setpoints. All three channels will meet the required separation specification after this DCP is implemented.

This DCP has not created the possibility for an accident or malfunction of a different type than any evaluated previously in the SAR.

All setpoints, system descriptions, and surveillance requirements as described in the Tech Spec remain unchanged. There is no reduction in the margin of safety denoted in TS Basis section 2.2.1 - Undervoltage and Underfrequency RCP Buses.

, , . - , < . - - - ,~ ~ ~-7.,,

I I

DCP-94-146-1 WIRING NOD FOR DIESEL FAST START FREQUENCY NORTH ANNA POWER STATION UNIT 1 l

l DESCRIPTION j l

Performing the Emergency Diesel Generator (fast start) I periodic tests involved the installation of several electrical .  !

jumpers between the control Room, switchgear room and the l instrument rack room. These cable carry 150VDC which can be considered a personnel hazard. Also, the test recorder was connected using alligator clips. These clips do not provide a secure termination and are susceptible to disconnecting.

Sufficient spare cables existed between the emergency switchgear cubicles and the associated emergency diesel generator control cabinets in the Control Room to permanently install test points. These terminations, located in the diesel control panel in the Control Room, are now used exclusively for performance of the Periodic Tests. The termination points in the emergency diesel cabinet were made using Pamona " banana jacks". Additionally, some internal wiring was installed between the 27W relays and the interconnection terminal blocks  ;

in the emergency switchgear to accomplish the monitoring.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-44) l Installation of permanent test points with Pomona " banana jacks" in the EDG control panel does not constitute an unreviewed safety question as defined in 10CFR50.59 since it does not:

A) Increase the Probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR.

Since the extension of the EDG start signal circuits with the addition of Pomona " banana" jacks is passive and does ,

not modify the circuit function and is only used during the performance of periodic tests, the probability of the occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the UFSAR are not increased.

Page 1 of 2 l

__..-._-_.-_--_s-_-__

~ -

B) Create a possibility of for an accident or malfunction of-a different type than'any previously in the UFSAR.- -

The change. being made' allows the performance of ' EDG -

periodic tests . to be ' conducted more efficiently by-permanently providing test points _with " banana - jacks" in the EDG' control-panels. This eliminates the possibility ,

of personnel injury as temporary jumpers carrying 150VDC.

were previously being installed. The: possibility of:

creating an accident or malfunction of a different. type. '

than previously evaluated is'not introduced.. l C) Reduce the margin of safetyLas defined in'the basis ~of l any Technical Specification.

This design , change did ' not change the basis of any-  !

Technical Specifications. Implementation of this '

modification simplified the performance and eliminated a personnel hazard for'the associated periodic tests.

B 4

I j

Page 2 of 2

I l

Y DCP 94-151 FABRICATE INSTRUMENT MANIFOLD 2-SI-FT-2943  !

NORTH ANNA UNIT 2 l i

l DESCRIPTION The high head safety injection flow transmitter, 2-SI-FT-2943, was I equipped with a Hoke five valve manifold. The manifold required l replacement but was no longer available. The manifold was replaced with a five valve manifold arrangement made with small instrument valves.

l The flow transmitter is required for post accident monitoring for l

} the verification of the proper operation of the system. J l

l

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-019)

The transmitter is required for all accidents which require a safety injection. The accidents considered were accidental l depressurization of the main steam system, major secondary system i pipe rupture, small break and large break LOCA, steam generator l tube rupture, ma'in steam line break and rupture of control rod drive mechanical housing.

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

1. Accident probability was not increased because the transmitter is used to monitor SI flow after an accident and has no role in accident probability.

2. Accident consequences were not increased. The manifold does not affect the operation of the transmitter or the possibility for the transmitter to fail. If the transmitter does fail there is a redundant transmitter.

3. No unique accident probabilities were created. The operation of the transmitter and the SI system were not affected by this l change. System design bases were not changed.

1 I

4. Margin of safety was maintained because the integrity and reliability of the SI system was maintained. The SI flow as a result of an accident was not affected.

Page 1 of 1

DCP 94-155 PERFORM WIRING MODIFICATION TO THE INSTRUMENT LOOP NORTH ANNA POWER STATION UNIT #1 DESCRIPTION The 0-10 VDC output signal from the Westinghouse 7300 Process Cabinet signal converter card (FM-1113A) to the boric acid blend system will be blocked anytime there is not flow demanded, automatically or manually, from the Boric Acid Storage Tanks (BASTS) to the blender (line 1"-CH-56-153A-Q3).

The 0-10 VDC output signal from signal converter card (FM-1113A) will be wired through an open set of contacts in the Auxiliary Relay Cabinet (1-EI-CB-48A). These contacts.will close anytime a  ;

MANUAL or BORATE makeup function is performed by the operator on the make up control switch - (43/MU) on benchboard 1-1 in the MCR.

In addition, these contacts will close anytime the make up control switch (43/MU) is in AUTO and a low VCT tank level signal has been received by the make up control circuitry. Thus, the signal converter card (FM-1113A) will only be supplying an input signal to the boric acid blend system control and indication circuitry when there is flow from the Boric Acid Storage Tanks (BASTS) through the magnetic flowtube (01-CH-FT-1113) to the blender (line 1"-CH 153A-Q3). During normal operation this flow transmitter will only have boric acid passing through it when makeup is being performed. ,

-At all other times this flow is isolated. ,

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-018)

This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

A. The implementation of this modification did not increase the probability of occurrence or consequences of an accident or malfunctions of equipment important to safety and previously evaluated in the Final Safety Analysis Report.

Accident probability has not been increased because this design change conforms to standards and admins. The operation of the CVCS makeup system will-not be affected.

The CVCS makeup system is not required for safe shutdown because the emergency borate flow path will be used to provide boric acid to the suction header of the charging pumps. This design change will provide a more accurate Page 1 of 2

DCP 94-155 representation of the boric acid flow through the flow path of 01-CH-FCV-1113A.

B. The implementation of this modification did not create a possibility for an accident or a malfunction of a different type than any previously evaluated in the Final Safety Analysis Report.

The implementation of this DCP does not create- a possibility for an accident' or a malfunction of a different type than any evaluated previously in the UFSAR because the design change will be performed during an outage and operation of the CVCS makeup system will not be affected. Consequences have not been increased because a possible failure of the DCP would . not have corrupted any mitigating systems.

C. The implementation of this modification did not reduce the margin of safety as defined in the basis of any '

Technical Specification.

The integrity and reliability of the CVCS have not been '

affected.

i i

i i

l l

l l

l i

l Page 2 of 2

DCP 94-176 INSTALL INSTRUNENT SNUBBER 8 NORTH ANNA UNIT 1 & 2 DESCRIPTION The casing cooling recirc flow switches were frequently found to be  ;

out of calibration. This was due to the flow switches being r

. located immediately downstream of a tee which causes turbulence in the line. The turbulence caused the needle to oscillate and beat itself out of calibration. Instrument snubbers were installed on ,

the flow switches to prevent the needles from oscillating. ,

The flow switches closed the casing cooling pump discharge MOV's t when low flow is sensed for 45 seconds. The timer also prevents the MOV from closing when a CDA occurs coincident with a loss of offsite power. The delay allows for the pump to be loaded onto the emergency bus, be started and come up to speed before the timer times out and closes the MOV. As the time delay is an important function of the switch and to allow for any increase in response time due to the snubber, the time delay was changed from 45 seconds to 60 seconds.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-030)

The accidents considered were those which result in a containment depressurization actuation which are loss of coolant accident, main steam line break, rod ejection and feedwater line break.

This design change did not create an unreviewed safety question as defined by 10CFR50.59. t

1. Accident probability was not increased because during normal operation the casing cooling system is in standby and it is ,

used for accident mitigation only.

2. Accident consequences were not increased. The changes made increased the reliability of the flow switches by reducing the potential for them to be out of calibration. The increased time delay ensures that the MOV does not close prematurely when a CDA occurs coincident with a loss of offsite power.

3. No unique accident probabilities were created. The system will only operate after accident occurrence and by ensuring its reliable operation, the possibility for an accident of a different type was not created. System design bases were not changed.

Page 1 of 2 l

l I

DCP 94-176 INSTALL INSTRUMENT SNUBBERS NORTN ANNA UNIT 1 & 2

4. Margin of safety was maintained because the safety margins associated with the system, pump capacity, sump. mass ph and boron concentration, and containment isolation were not affected.

I i

l

.l

\

I l

Page 2 of 2 l

REPLACEMENT OF LEVEL TRANSMITTER 1-CH-LT-1161 DCP 94-179 Executive Summary The Barton 384 level transmitter for the 1A Boric Acid Storage Tank has been replaced with a Rosemount transmitter model 1151LT. The transmitter was replaced because it was failing intermittently.

The replacement transmitter is more accessible since it is installed four feet off the floor. The Barton transmitter was mounted 23 feet off the floor.

SUMMARY

OF SAFETY EVALUATION MAJOR ISSUES This design change was a like-for-like component level replacement. ,

The reason for replacing the existing differential pressure level transmitter (1-CH-LT-1161) for 1A BAST is because it intermittently failed high. The replacement level transmitter (Rosemount model #

1151) gives the same output signal (4-20mA) with greater accuracy.

The reason that the level transmitter is safety related is because it is a pressure boundary to a safety related system. The major issue was whether or not this level transmitter would leak which could potentially empty the 1A BAST.

REASON FOR CHANGE TO BE ALLOWED The Rosemount level transmitter is classified as safety related and meets applicable codes. The level transmitter pressure rating exceeds the operational pressures it will experience.

UNREVIEWED SAFETY QUESTION An unreviewed safety question does not exist for the following reasons:

The probability of occurrence and consequences of a loss of boric acid in the 1A BAST has not increased due to the replacement of the level transmitter.

This level transmitter replacement has not created the possibility of an accident of a different type than evaluated previously in the SAR. The equipment is seismically restrained.

No margin of safety was not reduced. No operating parameters or indications were changed. The level, concentration, availability and method of operation of the 1A BAST have been unaffected by this design change. The transmitter is not required to be EQ qualified and it provides a non-Reg. Guide 1.97 indication.

DCP 94-183 REPLACEMENT OF CHARGING PUNP CASING 2-CH-P-1A NORTE ANNA UNIT 2 DESCRIPTION When charging pump 2-CH-P-1A was disassembled for routine maintenance, indications were discovered in the pump casing. The pump manufacturer had previously issued a bulletin advising owners of the pumps that had casings constructed of carbon steel cladded with stainless steel to inspect them for cladding cracks, erosion or damage when disassembled. The indications were severe enough to warrant casing replacement rather than repair the existing casing.

The existing pump casing was replaced with a solid stainless steel casing. All nozzles and connections on the new casing were of the same size and location, so no piping changes were required. The ,

pump internals, which determine the pump's performance characteristics, were reinstalled in the new casing to avoid generating changes to the pumps pressure and flow features.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-028)

The replacement of the charging pump casing did not constitute an unreviewed safety question as defined in 10CFR50.59 since it did not:

A) Increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in UFSAR.

The new casing met or exceeded the design requirements of the original equipment. The operational characteristics of the pump remained the same since the original pump internals were retained for use in the new casing. The HHSI pump continued to perform its intended function for mitigation of applicable accidents. All modifications involved in the casing replacement were external to the pump and in no way affected pump performance or operation.

B) Create a possibility for an accident or malfunction of a different type than any evaluated previously in the UFSAR.

Pump casing replacement was essentially a one-for-one replacement and since the original pump internals were retained for use in the new casing, the pump would continue to operate in the same manner as before the modification was performed. The possibility of creating a different accident or malfunction that wasn't previously evalauted was not credible.

Page 1 of 2

DCP 94-183 REPLACENENT OF CHARGING PUNP CA8ING 2-CH-P-1A NORTE ANNA UNIT 2 3

C) Reduce the margin of safety as defined in the basis of any Technical Specification.

Replacement of the pump casing was essentially a one-for-one replacement with minor modifications to external mounting configurations. Pump operation remained unchanged as a result of the design change. The modification had no impact on the ,

Tech Specs nor was the margin of safety affected by this work. '

?

v l

Page 2 of 2

l l

l DCP 94-184 l INSTRUMENT PORT COLUMN ASSEMBLY (IPCA) UPGRADE

. NORTH ANNA UNIT 1 DESCRIPTION In order to reduce the installation time and reduce radiation exposure to personnel working on disassembly / reassembly of the reactor, a new upgraded instrumentation port column assembly was installed on each of the four reactor head penetrations. The instrumentation port column assembly is the pressure retaining device that permits the incore instrumentation thermocouples to penetrate the pressure retaining boundary of the reactor head. The upgraded assemblies were designed, furnished and installed by Westinghouse, the original reactor supplier. The upgraded assemblies use the existing female flanges, thermocouple columns (conduit seal assemblies), and conoseal gaskets. The new upgraded assembly parts are new upper and lower articulated clamps, new male flanges, and new upper positioner clamps.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-060)

This design change did not create an unreviewed safety question as defined in 10 CFR 50.59.

A. The implementation of this modification did not increase the probability of occurrence or consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Final Safety Analysis Report.

The evaluation of the instrumentation port column assembly modifications indicated that they have no affect on the operability or integrity of the reactor vessel.

All service stress limits have been shown by analysis to be bounded by ASME Code limits. The instrumentation port column assembly modifications do not result in a condition where design, material, and construction standards that were applicable prior to the modification are altered. Therefore, the probability of an accident previously evaluated in the FSAR did not increase due to the instrumentation port column assembly modification.

The instrumentation port column assembly modifications did not affect the integrity of the reactor vessel and penetrations such that their function in the control of radiological consequences was affected. In addition, the instrumentation port column assembly modifications did not af fect any fission barrier. The instrumentation port Page 1 of 3

i DCP 94-184 INSTRUNENT PORT COLUNN ASSEMBLY (IPCA) UPGRADE NORTN ANNA UNIT 1 I column assembly modifications did not change, degrade, or ,

prevent the response of the reactor vessel to accident scenarios, as described in the FSAR Chapter 15. In addition, the instrumentation port column assembly modification did not alter any assumption previously made in the radiological consequence evaluations nor affect the mitigation of the- radiological consequences of an i accident described in the FSAR. Therefore, the consequences of an accident previously evaluated in the FSAR will not be increased. 1 The instrumentation port column assembly modification did not result in an increased probability of scenarios previously deemed improbable. The instrumentation port .

column assembly modification did not create any new failure modes for the reactor vessel and penetrations or other safety-related equipment. The instrumentation port column assembly modification did not result in original design specifications, such as seismic requirements, electrical separation requirements, and environmental qualification, being altered. In addition, the instrumentation port column assembly modification does not result in equipment used in accident mitigation to be  ;

exposed to an adverse environment. Therefore, the instrumentation port column assembly modification will ,

not increase the probability of a malfunction of .

equipment important to safety previously evaluated in the  !

FSAR.  ;

The performance and integrity of the reactor vessel and penetrations are not affected such that their control of radiological consequences was altered. The ,

instrumentation port column assembly modification does not result in a different response of safety-related systems and components to accident scenarios than that postulated in the FSAR. No new equipment malfunctions have been introduced that will affect fission barrier integrity. Therefore, the instrumentation port column ,.

assembly modification will not increase the consequences of a malfunction of equipment important to safety previously evaluated in the FSAR.

B. The implementation of this modification did not create a possibility for an accident or a malfunction of a different type than any previously evaluated in the Final Safety Analysis Report.

Page 2 of 3 t

6

DCP 94-184 INSTRUNENT PORT COLUNN ASSEMBLY (IPCA) UPGRADE-NORT3 ANNA UNIT 1 The instrumentation port column assembly modifications do not have any effect on the ability of the reactor vessel and penetrations to perform their intended safety functions. The instrumentation port column assembly modification did not create failure modes that could adversely impact safety-related equipment. Therefore, it did not create the possibility of a malfunction of equipment important to safety different than previously evaluated in the FSAR.

The instrumentation port column assembly modifications do not cause the initiation of any accident nor create any new credible limiting single failure. The instrumentation port column assembly modifications do not result in any event previously deemed incredible being made credible. Structural integrity will be maintained as indicated by compliance with ASME Code stress ,

criteria. As such, the modifications did not create the possibility of an accident different than any evaluated in the FSAR.

• C. The implementation of this modification did not reduce the margin of safety as defined in the basis of any Technical Specification.

The margin of safety with respect to integrity of the reactor coolant system is provided in part by the safety factors inherent to the ASME Boiler and Pressure Vessel Code. The instrumentation port column assembly modifications comply with the ASME Boiler and Pressure Vessel Code and have no effect on the availability, operability, or performance of the reactor vessel.

Therefore, the instrumentation port column assembly <

modifications did not reduce the margin of safety, as described in the bases of any Technical Specification.

Page 3 of 3

DCP 94-185 REMOVE REACE RODS AND SEAL WALL PENETRATIONS  !

NORTE ANNA UNIT 1 & 2 DESCRIPTION It was identified that the charging pump casing drain valve reach rod penetrations through the cubicle walls.were not sealed and.  ;

created the potential for simultaneous flooding of all six charging '

pump cubicles. A 1/16" gap exists between the reach rod and the ,

penetration. In the event of a service water header rupture, it l was found that the water level in the cubicles would reach the pump l' motors in approximately seven hours. -The valves could be operated from within the cubicles with the handwheels. Therefore the reach-

, rods were removed and the wall penetrations were sealed.

The reach rods were considered to be external to the valves which have a safety related function as system pressure boundaries. As the valves could still be operated from within the cubicles, the reach rod removal was considered non-safety related and a 50.59 Safety Evaluation was performed for the wall modification only.

SUMMARY

OF SAFETY ANALYSIS All previously analyzed accidents were reviewed and none were found to be available. The UFSAR does consider flooding as a result of a high energy line break. However, it was determined that the flooding that would result would not be severe enough to penetrate the charging pump cubicles. As the wall are Appendix "R" and flood barriers, fire and flooding were considered to be the accidents that were applicable.  ;

UNREVIEWED SAFETY QUESTION ASSESSMENT:

1. The wall is only a boundary for Appendix "R" and flooding and has no effect on the probability for a fire or flooding due to a service water header rupture.

2. Accident consequences were not increased. The gap between the penetration and the reach rod was removed by sealing the penetration so that there -is less risk of fire or water  ;

breaching the walls and entering the cubicles. ,

i

3. No unique accident probabilities were created. The walls and reach rods are outside all system boundaries and do not affect ,

the operability or function of any systems or components.

4. Margin of Safety was maintained as there are no Technical 1 Specification requirements for the walls which will still i maintain separation of equipment for fire and flood concerns.

Page 1 of 1 i

DCP 94-196 RECONFIGURE THE CHEMICAL ADDITION CONNECTION TO THE BEARING COOLING HEADER NAP 8 / Unit 1 PROBLEM STATEMENT The section of piping between .1-BC-339 and the bearing cooling water header.has a history of developing leaks. This section of piping is approximately 6" long and is unisolatable when the unit is on line. When a leak develops during operation, temporary patching is required. A more reliable connection of the phosphate chemical addition line to the bearing cooling water- header is required. I

SUMMARY

OF SAFETY ANALYSIS The phosphate chemical addition line connection to the 24" Bearing Cooling Water header was reconfigured. A two inch isolated flange connection with a piece of 1/2" stainless steel pipe passing through it was utilized. The carbon steel gate valve 1-BC-339 was replaced with a stainless steel valve. The new connection design:

provides a continuous stainless steel pathway for the phosphate injection into the bearing cooling water flow, and isolates the carbon steel and stainless steel from each other via a flange gasket kit.

This activity requires UFSAR figure 10.4-19 to be updated. The Safety Evaluation 94-SE-MOD-042 was written as this figure is considered to be part of the description of the facility as described in the Safety Analysis Report .

The Safety Analysis Report was reviewed. No accidents previously evalua&ed were identified as being applicable. The bearing cooling water system is a supporting system to the secondary. It does not have any safety related functions but is required for unit operation. The phosphate chemical addition system as no safety. i related functions. No malfunctions of equipment related to safety I were identified as being a possible result of this activity. There are no applicable Technical Specifications. For these reasons a unreviewed safety question does not exist and the change was allowed.

i i

Page 1 of 1 1

y DCP 94-208 LESI RELIEF VALVE SETPOINT CHANGE MAPS - UNIT 1 DESCRIPTION When the LHSI pumps are started, the relief valves on the discharge piping of the pumps occasionally lift. Increasing the set pressure for the relief valves will reduce the challenges to these valves  !

during pump start. DCP 94-208 raised the setpoint from 257 psig to  !

264 psig for the Unit 2 LHSI pump discharge relief valves. This setpoint change has already been performed on the Unit 2 relief  :

valves (See 93-SE-MOD-062).

t

SUMMARY

OF SAFETY AMhLYSIS (94-SE-MOD-055)

The probability of occurrence of an accident or malfunction of equipment previously evaluated in the UFSAR does not increase.since the function and operation of the Safety Injection-System does not change. Therefore, there will be no increase in consequences of an. accident or malfunction of equipment. The' possibility of an accident of a different type than previously evaluated does not exist since the integrity of the relief valve and the safety  ;

injection system is maintained. The margin of safety is not ,

affected since the function and operation of the SI system is not altered by this modification and at least one train of ECCS will be available at all times both during and after the setpoint is  ;

changed.

I Page 1 of 1 <

g.

a DCP 94-223 +

REPLACE SMAFT MATERIAL 2-CC-P-1A MAPS UNIT 2 DESCRIPTION The shatt- for the component cooling' water pump, 2-CC-P-1A, was found to be damaged. . A replacement shaft was furnished by the pump.

manufacturer, Ingersoll-Dresser.- The replacement shaft was fabricated from ASTM A276 type 410 SS where the original is ASTM A576 Gr. 1045 which was considered by Ingersoll-Dresser to be an enhancement. ' Table 9.2-5 of the UFSAR specified the shaft material and needed to be revised.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-048)

Component cooling is isolated during a phase B isolation.

Therefore, although all accidents were reviewed, the ~ applicable .

' accidents were considered to be all minor faults through the accidents which require'a Phase A isolation.

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

1) Accident probability was not increased as the pump has no role

~

in the cause for any of the accidents.

2) ~ Accident consequences were not 'affected as the operation, function and performance of the pump was not affected by this change.

3) No unique accident probabilities.were created. Shaft failure wou?d still render the pump inoperable but would not affect any other equipment.

4) Margin of Safety was maintained because the operation, function and performance of the pump was not affected.

Integrity and reliability of the system was maintained.

t Page 1 of 1 P

)

s , - -. . - - u -. .-. . . _ .- ..___ .__-- _._____ - .- _ - _ _ - . .

DCP 94-231 FABRICATE A BLOWDOWN NANIFOLD FOR 1-RC-FT-1434 NORTH ANNA UNIT 1 DESCRIPTION The reactor coolant "C" loop flow transmitter, 1-RC-FT-1434, was equipped with a two valve manifold on the high side inlet line to the drain. One of the valves required repair but these manifolds and repair parts are no longer available. The manifold was equipped with a test tap between the two valves. The test tap was originally intended for use during maintenance but was never used.

The manifold was removed and replaced with two instrument valves in series. The instrument valves were qualified to be used in the environment that they have been exposed to. The tubing was connected to the valves using welded connections.

The low flow transmitter is part of the reactor protection system.

It provides a trip signal when a low flow condition is detected in the "C" reactor coolant loop. There are three flow transmitter for each loop with the trip criteria being a trip signal from two out of the three transmitters. The operability of the transmitter is addressed in Technical Specification 3/4.3.1 was will not affected by this change.

SUMMARY

OF SAFETY EVALUATION (94-SE-MOD-054)

The accidents considered to be applicable were Partial Loss of Coolaat Accident, Loss of Offsite Power, Complete Loss of Forced Reactor Coolant Flow and Single RCP Locked Rotor.

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

1. Accident probability was not increased because the transmitter trip function is to mitigate an accident and it has no role in accident probability.

2. Accident consequences were not increased. The new isolation valves met all specifications, codes and requirements which were required for the original manifold. They operate in the same manner, as isolation when the plant is operating and did not affect the trip function of the transmitter.

3. No unique accident probabilities were created. The replacement of the manifold with instrument valves did not affect the operation of the RCS or RPS. System design bases were unchanged.

4. Margin of Safety was maintained because the integrity and I reliability of the RCS and RPS was unchanged.  ;

Page 1 of 1 l 1

l l

1

DCP 94-232 TERRY TURBINE GOVERNOR UPGRADE NORTH ANNA UNIT 1 DESCRIPTION The modification of the TDAFW pump governor nominally decreased the amount of time necessary for the pump to reach the required minimum flow and pressure values by changing the governor's ramp rate bushing. The device controls the rate at which the Terry turbine comes to full speed on start up. The bushing which was replaced on the Terry turbine was a nominal 15 second bushing. The time period i

between the point where the governor takes control to the point at which the turbine reaches full speed was be decreased from 15 seconds to 12 seconds.

The governor valve stem has experienced some corrosion which has resulted in binding of the valve stem. A concern raised was whether the change in ramp rate bushing would increase the occurrence of overspeed events due to the corroded valve stem. A ramp rate bushing was originally installed in order to prevent turbine overspeed transients due to cold starts. The 12 second ,

bushing still prevents normal overspeed transients. If the valve stem binds, the ramp rate bushing will not have a credible affect on the prevention of an overspeed event. The fact that a ramp bushing is installed, regardless of its delay time, helps to prevent the typical fast start speed overshoot and allow the governor to take control at a speed much lower than the normal operating speed setpoint. i

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-062)  ;

The accidents considered for this analysis were loss of normal i feedwater, loss of offsite power, small and large break LOCA, minor l and major secondary system pipe breaks and steam generator tube rupture.

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

1) Accident probability was not increased as the pump is for  !

accident mitigation and has no role in the cause for any of the accidents.

2) Accident consequences were not affected as the new ramp rate bushings ensure that the response time of the turbine is within that assumed by the accident analysis. The potential for an overspeed incident was not increased by this ramp rate bushing change.

Page 1 of 2

., _ _ ,f . _ . _ _ _

DCP 94-232 TERRY TURBINE GOVERNOR UPGRADE NORTE ANNA UNIT 1

3) No unique accident probabilities were created. The TDAFW pump 1 operates only after an accident and the change in ramp rate was within the design capabilities of the system. .

4) Margin of Safety was maintained because the operation, function and performance of the pump was not affected.

Integrity and reliability of the system was maintained. The slightly lower time required for the pump to reach rated flow and pressure slightly increased the margin of safety.

i n

Page 2 of 2 l

l I

DC 94-242 INCORE FLUX THIMBLE MODIFICATION NORTH ANNA / UNIT 1 Description  !

Eddy Current Examination of the Incore Flux Detector l Thimbles identified a thimble that required retraction repair due to wall losses. Thimble A09 was identified as requiring repair based on 1-PT-210.4. The repair ,

requested retraction of the thimble approximately 2" and cutting off the retracted piece to provide a new wear surface for the thimble.

The incore flux detector thimbles provide a path for inserting the miniature fission chambers into the reactor for flux mapping. The thimble serves as a pressure boundary between reactor coolant and containment atmosphere. Because of flow induced vibration causing wear of the thimble near the bottom of the reactor, the thimble was retrac;ted to provide a new wear surface on the thimble.

Removal of the small portion of the thimble had no adverse impact on the operation of the Incore Flux Detector system since the original thimbles had an additional 16 inches not required for system operation.

Retraction of this thimble was consistent with 1-PT-210.4 and ISI-15.0 which required that thimbles with 35-55%

wall loss be retracted.

This change did not change any system design parameters except the length of the thimble. Removal of the small portion of the thimble had no adverse impact on the operation of the Incore Flux Detector system since the original thimbles can accommodate retraction of up to 16 inches without adverse impact on system operation.

SUMMARY

OF SAFETY ANALYSIS Implementation of this design change does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety as previously evaluated in the UFSAR.

Page 1 of 2 l

i DC 94-242 INCORE FLUX THINBLE NODIFICATION NORTH ANNA / UNIT 1 ,

The implementation of this design change does not create .

a possibility ' for an accident or a malfunction of a  !

different type than any evaluated previously in the  !

UFSAR.

The implementation of this design change does not reduce the margin of safety as defined in the basis of the Technical Specification.

3 i

i l

Page 2 of 2 I i

i

1 l

_ _ . i DCP 94-246 1-CH-FT-1113 REPLACEMENT i NORTH ANNA UNIT 1 l DESCRIPTION The boric acid flow transmitter, 1-CH-FT-1113, required replacement. The PTFE electrical insulator lining in the metering tube of the existing flow transmitter was damaged at the teflon flair end located on the stainless steel flange connection. The new transmitter was dimensionally different and utilized carbon steel flange connections.

Activity installed a Foxboro model 2801 magnetic flow transmitter to replace the existing Foxboro model 1801. This was an acceptable replacement because the operational and performance characteristics of the two models were the same. The output functions of the two transmitters were identical. The new transmitter was approximately 6 inches shorter than the existing one. This difference was made up by installing additional piping between the existing bottom flange connection and an upstream elbow. The carbon steel flange connections associated with the new transmitter were acceptable because they met the pressure requirements imposed by the system and they did not come into direct contact with the process fluid due to the PTFE insulating liner installed within the metering tube and flared over the flange face. The UFSAR component description section 9.3.4.2.4 was revised to document this change since the current description stated that all CVCS piping that handled radioactive liquid was austenitic stainless steel.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-061)

The replacement of the flow transmitter did not constitute an unreviewed safety question as defined in 10CFR50.59 since it did not:

A) Increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in UFSAR.

1-CH-FT-1113 was essentially a one-for one replacement so the probability of occurrence of an accident or malfunction was not increased. The replacement transmitter did not generate or increase the consequences of accidents previously analyzed.

The flow transmitter conformed to existing design codes and standards and was qualified for use in this application. The replacement did not corrupt mitigating systems or redundant features associated with the CVCS.

Page 1 of 2

i L.

DCP 94-246 1-CE-FT-1113 REPLACEMENT

[ NORTE ANNA UNIT 1 B) Create a possibility for an accident or malfunction of a different type than arJ evaluated previously in the UFSAR.

1 f Transmitter operation and function remained the same.

j' Dimensional differences between the two transmitters was accounted for in the piping configuration which was modified. j The carbon steel flange material did not conform to existing .

UFSAR system description. However, it was acceptable based on pressure rating and fluid contact. Failure of the transmitter to retain its safety related pressure boundary mechanism was bounded by the UFSAR since alternate flow paths ' would be I available. The piping and components installed met or exceeded the design requirements of the CVCS. The seismic integrity of the associated lines were maintained. Transmitter replacement did not create any accident scenario that was not previously analyzed. Operation of the CVCS did not change and the possibility of a new accident was not created. Scenarios of transmitter failures would not differ from that of existing conditions. New or unique malfunctions were not introduced.

1 C) Reduce the margin of safety as defined in the basis of any Technical Specification.

Operation and integrity of the CVCS remained unchanged. Boron injection flow path operability was not impacted by this replacement.

l Page 2 of 2

DCP 94-251 REPLACE PRESSURE TRANSNITTER 1-CH-PT-1155 NORTH ANNA UNIT 1 DESCRIPTION The "B" RCP seal wa. or differential transmitter could not be calibrated. The origanal Barton Model 384 was replaced with a Barton FCX transmitter.

The transmitter senses the differential pressure across the RCP #1 seals and provides input to a knife edge gauge on the vertical board of the control room and actuates an annunciator at 210 psid.

This indicates leakage through the "B" RCP #1 seal.

SUMMARY

OF SAFETY ANALYSIS (94-SE-MOD-062)

The accidents considered were a main steam line break or large break LOCA which would constitute the worst case environment for the transmitter and a small break LOCA which would be the result of a tubing leak at the transmitter.

This design change did not create an unreviewed safety question as defined by 10CFR50.59.

1. Accident probability was not increased because the transmitter has no role in the probability for either the MSLB or LBLOCA.

The connections at the transmitter were not changed and the probability of them leaking was not affected.

2. Accident consequences were not increased. The transmitter has no role in accident mitigation. Tubing leakage is still bounded by the worst case SBLOCA.

3. No unique accident probabilities were created. Only a SBLOCA is a possible accident for the transmitter. The operation of the transmitter and the CH system were not affected by this change. System design bases were not changed.

4. Margin of safety was maintained because the integrity and reliability of the CH system was maintained. RCS operational leakage will be complied with.

l Page 1 of 1 l

l 1

l

DCP 94-289 REPLACEMENT OF HR88 PH SYSTEM

SUMMARY

DCP 94-289 documents the replacement of the High Radiation Sampling System (HRSS) pH system. This safety evaluation was required due to a necessary change to UFSAR table 9.3-10. Table 9.3-10 specified that the HRSS pH probe is manufactured by Cole-Parmer.

This DCP replaced the probe with a similar probe manufactured by Leeds & Northrup. The UFSAR change request was attached to the DCP to remove this particular manufacturer information since it is i deemed inappropriate for inclusion in the UFSAR. l l

The HRSS pH instrumentation is non-safety related. This DCP did not affect any safety related equipment. The HRSS pH equipment is fed from a non-vital power supply and used for post-accident mitigation.

Previously the HRSS pH indication was not included in the Reg.

Guide 1.97 technical report. From discussions with the Corporate Reg. Guide 1.97 Coordinator it has been decided that this l indication should be included and shall be done via DCP 94-289. l l

The replacement pH probe holder is slightly larger which will increase the expected dose to the operator of the Chemical Analysis Panel in a post accident situation. The dose rate is expected to increase by 17%. EPIP 4.23 shall be updated to reflect the new estimated dose rate.

REASON FOR CHANGE TO BE ALLOWED The previous pH system was not accurate enough to meet the requirements specified in NUREG-0737. The new system is expected to meet these requirements. Replacement the HRSS pH system does not pose any safety concerns.

UNREVIEWED SAFETY QUESTION An unreviewed safety question does not exist for the following reasons:

Neither the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety will be increased due to the failure of the HRSS pH system.

The possibility of an accident of a different type has not been created by this modification. All equipment and plant conditions remain unchanged. The operators ability to monitor the plant shall not be diminished.

The margin of safety has not been reduced. No plant parameter will change due to the replacement of the HRSS pH system.

Page 1 of 1

_ = _ _ _

EWR 88-271, X REACH ROD FOR 1-CH-39 ON LINE %"-CH-185-153A-Q2 NORTH ANNA UNIT 1 DESCRIPTION Reach rods are installed on Grinnell Diaphragm Valves in the High Radiation areas to enable remote operation of the valves to reduce occupational exposure. EWR 88-271 was initiated to evaluate the new design of reach rods to ensure reliability of operation. Reach rod of the new design was installed for valve 1-CH-39 on line %"-

CH-185-153A-Q2. Generic configuration of piping, reach rod and pipe supports have been evaluated for %" dia, piping per Calculation # SEO-1382. The piping, reach rod and the pipe support configurations for the modification of reach rod for 1-CH-39 per EWR 88-271X were found to be within the bounds of the above calculation. Safety Evaluation 94-SE= MOD-007 was performed for this EWR addendum to augment the Safety Evaluations 89-SE-MOD-059 per the original EWR and 90-SE-MOD-017 per EWR 88-271G.

SUMMARY

OF SAFETY ANALYSIS This design change in accordance with EWR 91-030 and 91-030A does not create an "unreviewed safety question" as defined in 10 CFR 50.59.

A. The implementation of this modification does not increase the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety and previously evaluated in the Final Safety Analysis Report.

The installation of the reach rod per the new design is to ensure reliable operation of the valve remotely. The modification ha been evaluated for reliability and structural adequacy under a Design basis Seismic event.

Thus the operation of the system remains unaltered and will not increase the probability of occurrence or consequences of any accident. The improved reliability of the valve operation will preclude malfunction of the valve and the system.

l PAGE I OF SL l

t

- - _., i EWR 88-271, X B. The' implementation of this modification does not create  :

a possibility _ for an accident .or malfunction of a different type than any previously evaluated in the Final-Safety Analysis report.

The reach rod modification for 1-CH-39 to comply with the new design of the reach rod being an improvement in the ,

i reliability of operation of the valve, the reliability of -

the associated system will also be improved. Thus this modification has no potential to create a possibility for. >

any other accident.

C. The implementation of this modification does-not reduce i the margin of safety as defined- in any Technical Specification.

The improved reliability of the valve operation and.

consequent improvement in reliability of the system cannot reduce'the margin of safety or alter-the design bases of the Charging System'as defined in the Technical ~

Specification.

i 1

9 F

PAGE 1 OF A

EWR 93-009 REVISE PRESSURE RATING OF AUX FEEDWATER DISCHARGE PIPING NAPS - UNITS 1 & 2 DESCRIPTION -

The design temperature and pressure for the turbine driven aux feedwater pump was rerated by this EWR. This was done to allow the relief valves on the discharge of the pumps to be set at a higher setpoint. Per original piping code requirements, relief valve set pressure is to be the same as system design pressure.

SUMMARY

OF SAFETY ANALYSIS (93-SE-MOD-079)

The aux feedwater system provides water to the steam generators at times when the normal feedwater system is not available. In accident conditions, aux feedwater maintains the heat sink capabilities of the steam generators. All accidents were reviewed and the aux feedeater system is required for all accidents which have a safety injection actuation. Accidental depressurization of the main steam systen, a small break LOCA, major secondary system pipe rupture, steam ganerator tube rupture, main steam line break and large break LOCA were considered to be applicable.

Accident probability has not been increased as the aux feedwater system is for accident mitigation purposes. The system is a backup for normal feedwater and does not contribute to the probability of occurrence of an accident.

The consequences of any of these accidents are not affected. The reduced temperature rating of the pipe is within the originally evaluated temperature range for ability to remove decay heat from the steam generator. The increased pressure rating is within the capability of the pipe. The system will still be operated within the original operating temperatures and pressures and will still function as designed.

No unique accident probabilities are created. The function, operation and performance of the TDAFWP and the aux feedwater system is not changing.

Margin of Safety is maintained because the integrity and reliability of the aux feedwater system has been evaluated and is not affected. The reduction of design feedwater temperature is below the value assumed to allow for decay heat removal from the steam generators. This temperature reduction is in the conservative direction as it allows for more heat removal than the maximum temperature (120*F) assumed by the UFSAR.

Page 1 of 1 I

EWR'94-009 UNDERVOLTAGE AND UNDERFREQUENCY RELAY RESETS t NORTM ANNA-/ UNIT.1  !

DESCRIPTION  ;

The standard for Nuclear Plant Setpoints, STD-GN-0030,.was revised November 20, 1992, and it included a more specific  ;

definition of where " Channel Statistical Allowance", CSA, was to be included in determining setpoints. This revision i specifically states, in paragraph 5.3.4, that CSA is to be' l

~

part of the calculation of setpoints for Technical '

Specification Underfrequency and Undervoltage setpoints. The North Anna Setpoint Document, NASD, was revised to show the i new Underfrequency and Undervoltage'. setpoints, 56.55Hz and j 86.95V (3043.5V primary), respectively. The Setpoint i Implementation / Change Forms are included in Attachment B. [

The Underfrequency and Undervoltage relays were reset on Unit  !

i during the refueling outage in order to comply with the i revision of - STD-GN-0030 and Calculation EE-0524. This was i done using approved maintenance procedures which were revised  !

to show the new settings.

SAFETY ANALYSIS

SUMMARY

The Undervoltage and Underfrequency relay settings changed the i margin of conservatism based on the channel Statistical Allowance methodology. The change was required to comply with i design standard STD-GN-0030, and it involved both Safety Related and Non-Safety Related relays. These relays continue to provide the same functions with more conservative setpoints.

An unreviewed safety question does not exist for the following -

reasons:

Neither the probability of occurrence, nor the consequences of Undervoltage or Underfrequency were increased. The revised relay setpoints added conservatism to the existing relay setpoints by including the Channel Statistical Allowance.

This change does not create the possibility for an accident or malfunction of a different type. The setpoints are higher (i.e., more conservative) than the previous setpoints by the .

CSA plus the allowable relay setting range.

There was no reduction of margin shown in the SAR and no changes were required to the Technical Specifications. The Undervoltage and Underfrequency relays continue to provide {

protection against the loss of coolant flow in the Reactor Coolant System.

Page 1 of 1 P

, ,,y-a.

I l

i.

ATTACHMENT 1 Safety Evaluation Summaries 4 Abnormal Status 94-SE-AS-001 L

l

p 6 -

SAFETY EVALUATION LOG ABNORMAL STATUS. - BLUE TAGS. OPERATOR. AIDS 1994 S.E. # Unit # Document System . Description Evaluator / Date SNSOC SNS Reviewer Prepared Date i

94-SE-AS-001 2 Ab. St. #3760 HV isolate bypass line around relay roce AC unit via closing F. Mladen / Reid 6-24'-94 6-24-94 2-CD-146 to route all flow thru cooling coils i

1

Safety Evaluation Number 94-SE-AS-001 DESCRIPTION OF ABNORMAL STATUS ABNORMAL STATUS 3760 The bypass line around the relay room AC unit will be isolated via closing 2-CD-  ;

146 to route all of the flow through the cooling coils. Currently, the TCV for 02- ,

HV-AC-6 is not operating properly. Troubleshooting indicates that most of the  ;

flow bypasses the cooling coils no matter what the position of the TCV. This ,

results in elevated temperatures in the relay room and emergency switchgear room (ESR). It is desired to isolate the bypass line, thereby diverting all of the flow through the cooling coils and returning the AC unit to operable status. ,

SAFETY EVALUATION

SUMMARY

I The chilled water portion of the control room chillers is a closed loop system. The water is circulated through the in-service chiller via the circ pump (HV-P-20A, B, C) then passes through the two in-service AC units (HV-AC-6,9 or 7,8) cooling coils, after which it returns to the suction of the circ pump. Temperature control '

valves (TCVs) are installed in the chilled water lines to divert flow around the AC units as required to maintain the desired room temperature.

Concerns which need to be addressed are as follows: l

• Ensure there is adequate flow through the pump to prevent overheating. With - i the bypass line isolated, adequate flow will be verified through the AC unit. '

The relay room TGV is designed to pass 120 gpm per NAS 347 and the control room AC unit TCV is designed to pass 65 gpm. Therefore the total flow value for both the AC units should remain approximately the same (185 gpm). The circ pump is a Bingham model 2x3x7-1/2 CVA pump which is rated for 185 gpm at 160 feet of head. The shutoff head is 230 feet.

Therefore the potential for overheating of the pump is not increased. <

• Ensure that the temperature in the relay / emergency switchgear rooms remains acceptable. The ESR and relay rooms are walked down twice per shift by the Safeguards watch. In addition there are high temperature alarms ,

for the 2-11 and 2-IV battery rooms which obtain their supply air from the ESR.

This would provide control room personnel with an indication of potentially elevated temperatures. The discharge temperature for the chillers is approximately 45F Per NAS 315, the temperature of the chilled water passing through the circ pumps is 40 60F. Therefore the temperature in the j relay rooms should not go below 40F. In addition, diverting full flow through  :

the AC unit will prevent the upper temperature limit from being reached and ensure proper operation of the AC unit. UFSAR section 9.4.1.3 states that the design requirements for' the control equipment specify no loss of protective functions over a temperature range of 40-120F and 100% relative i

i-

humidity. Therefore defeating the temperature control-function will not increase the potential for degradation of SR functions.

Effects of TCV-266 failing to the bypass position with the bypass manually isolated. 02-HV-TCV-266 is a Honeywell three way valve with a motor operated actuator. The valve fails to the bypass position on loss of power. In the bypass position, there is no cooling water to the air handling units. The effect on the system would be an increase in pressure; however, over pressure protection is available via the relief valves downstream of the chiller. The actual pressure would be approximately 120 psig (shutoff head of 100 psi plus approximately 20 psi suction pressure) which is below the relief valve setpoint of 150 psig; therefore, there is no concern of loss of inventory.

The pump flow would be reduced to 65 gpm (flow through the control room AC unit). The pump manufacturer was contacted to ensure that this flow would be adequate for long term pump operation. Bingham stated that a minimum flow of 60-70 gpm would be acceptable. Therefore the potential for pump damage is not increased.

• Impact on Nuclear Policy on Defeating Equipment or System Automatic Function. The nuclear policy states that defeat of any automatic safety functions shall have a safety evaluation. It also states that control functions which will be defeated for long periods should be evaluated for impact on overall system performance.

The TCV for the AC unit is a control function. The temperature controller can be adjusted so that the desired temperature is 40F which would maintain the TCV flow through the cooling coils indefinitely. Isolation of the bypass line is similar to the above action. Impact on the remainder of the system and surrounding areas has been evaluated and found to be acceptable as described above.

l

= lmpact on Tech Specs. Tech Spec 3.7.7.1 requires two air conditioning systems to be operable. The bases of the Tech Spec is to ensure that the j ambient temperature does not exceed the allowable temperature for continuous duty rating in the affected area. As stated in UFSAR 9.4.1.3 this band is 40-120F. As stated above the evolution will not prevent the system from performing this function. Therefore the Tech Spec is complied with.

For the reasons given above, it is acceptable to perform the evolution. Once the line has been iso lated and adequate flow verified through 02-HV-AC-6, the action on the AC unit can be cleared.

1 l

l l

1

i 1

I l ATTACHMENT 2 i Safety Evaluation Summaries  !

Justification for Continued Operation 94-SE-JCO-001 thru 004 l

f f

i l

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - --- -- - - - - --- - -- - - A

SAFETY EVALUATION LOG JCOs ,

1994 S.E. # Unit # Document System Description Evaluator / Date SNSOC SNS Reviewer Prepared Date i JCO 94-01 Deviating condition for bolting examinations Leberstien / LaPrade 1-06-94 1-06 94-SE-JCO-001 / 2 2 JCO 94-01 Rev.1 adds the installation of a camera in the VCT Leberstien / Disosway 1-07-94 _ 1-07-94 4

(/4-SE-JCO-001 REV.1 gr / (Rev.1) cubicle to monitor potentialleakage from the VCT manway 94-SE-JCO-001 ,2 JCO 94-01 JCO Rev. 2 reflects that required inspectiorWolt replace- Garver / Hunsberger 6-05-94 6-05-94 ment has been completed on 2-St-TV-2884C & VCT REV.2 p (Rev. 2) manway - rnonitoring of VCT manway via camera is no DR N-94-16 longer required 94-SE-JCO-002, / 1.2 JCO 94-02 MSTV & letdown trip valve position indication failure Harper / Slankard 2-11-94 2-11-94 [

94-SE-JCO-002 , ' 1,2 JCO 94-02 Provide compensatory measures for verifying bypass Slankard / Mladen 3-31-94' 3 41-94~

REV.1 (Rev.1) MSTV position & take credit for redundant instruments for MSTV & letdown isolation valve position indication 1,2 JCO 94-002 Valve position indication light failure - addresses . Slankard / Mladen 7-22-94 7-27-94 94-SE-JCO-002 * /

REV.2 (Rev. 2) component cooling RCP inlet valves (MS & letdown eval.

in previous revision still applicable)

JCO 94-03 Enforcement discretion for 2-FW-P-2 maintenance Walker / Mladen 3-11-94 3-11-94 94-SE-JCO-004/ 2 longer than allowed by TS 3.7.1.2 94-SE-JCO-004 2 JCO 94-04 2-FW-P water inleakage into the lubricating oil Le / Hunsberger 3-12-94 3-12-94 during pump operation 1

l 1

Safety Evaluation Number 94-SE-JCO-001 DESCRIPTION OF JCO System walk downs are performed in accordance with PT-48 and PT-48.1, which are assigned to Maintenance Engineering. During these walk downs, the presence of boric acid at bolted connections indicates the necessity to either replace the bolting, or remove the bolting components and perform a VT-3 inspection of all bolting components in the connection, and evaluate for +

acceptability. In several cases for the Unit 2 outage, there is insufficient documentation to confirm either bolting replacement or VT-3 examinations of bolting materialleft in place.

SAFETY EVALUATION

SUMMARY

Failure of the fasteners due to boric acid degradation would result in increased leakage, but would respond as a leak-before-break mechanism in the same fashion as other piping joints in the plant. No catastrophic failure will occur.

Failure would occur slowly and would be indicated by increased operational leakage which would be observed by an increase in the sump pumping frequency, an increase in the vent stack radiation levels, and/or an increase in containment radiation levels. Any VCT leakage would be identified during i performance of the RCS Leakrate PT. Although the level of radioactivity in the Containment would increase, the increase would be small and would be contained. Operator identification of an increase in the leakrate would occur quickly and would prevent Unit operation outside of the limits allowed in Tech Specs. For components located in the Auxiliary Building, leakage would result in ,

increased Aux. Building doses which would be picked up by installed radiation '

detectors. This would prevent operation outside of analyzed limits for dose and exposure. Studs were inspected in place as a minimum except on the VCT manway where a VT-2 inspection indicated no evidence of active leakage. No defects were identified. C! ass 1 systems were tested during the RCS hydro following the RTD manifold work. The at-pressure walk down at the end of the outage did not indicate any leakage concerns in the repaired areas. Operational leakage is currently low. Any fastener failure is expected to develop as a leak-before break failure ard will be detected prior to exceeding Tech Spec limits for operational leakage. Operational leakage will therefore not exceed limits used as a precursor event for accident analyses. For these reasons, the probability of occurrence of accidents or malfunctions of equipment previously analyzed will not increase. Failure of the fasteners will not cause a catastrophic failure of any equipment required for the mitigation of analyzed accidents. Increased leakage at bolted connections may occur, but will not create a situation which is not bounded by existing accident analyses. For these reasons, the consequences of accidents or malfunctions of equipment previously identified will not increase. No fastener failures are expected since the inspections which were performed were conducted by knowledgeable craft and no defects were found. Leakage which may occur is bounded by existing analyses. Therefore, the margin of safety as

l represented in the Tech Specs is not-reduced. For these reasons, an Unreviewed Safety Question does not exist.

i

SUMMARY

OF SPECIAL REQUIREMENTS

• Perform a daily RCS Leakrate PT.

+ If RCS unidentified leakage exceeds 0.4 gpm, then an investigation to

• determine the source of the leakage will be initiated.

I e

k i

I F

P f

i L.

I i

i i

Safety Evaluation Number 94-SE-JCO-001, Rev.1 DESCRIPTION OF JCO System walk downs are performed in accordance with PT-48 and PT-48.1, which are assigned to Maintenance Engineering. During these walk downs, the presence of boric acid at bolted connections indicates the necessity to either replace the bolting, or remove the bolting components and perform a VT-3 inspection of all bolting components in the connection, and evaluate for acceptability. In several cases for the Unit 2 outage, there is insufficient documentation to confirm either bolting replacement or VT-3 examinations of botting material left in place.

SAFETY EVALUATION

SUMMARY

Revision 1 was written to require the installation of a camera in the VCT cubicle to monitor potential leakage from the VCT manway.

SUMMARY

OF SPECIAL REQUIREMENTS

• Perform a daily RCS Leakrate PT.

• If RCS unidentified leakage exceeds 0.4 gpm, then an investigation to determine the source of the leakage will be initiated.

• Install a camera in the VCT cubicle to monitor potential leakage from the VCT manway.

Safety Evaluation Number 94-SE-JCO-001, Rev. 2 t

DESCRIPTION OF JCO System walk downs are performed in accordance with PT-48 and PT-48.1, which are assigned to Maintenance Engineering. During these walk downs, the presence of boric acid at bolted connections indicates the necessity to either '

replace the bolting, or remove the bolting components and perform a VT-3 inspection of all bolting components in the connection, and evaluate for acceptability, in several cases for the Unit 2 outage, there is insufficient documentation to confirm either bolting replacement or VT-3 examinations of bolting materialleft in place.

SAFETY EVALUATION

SUMMARY

Revision 2 was written to reflect the fact that required inspection / bolt replacement has been completed on 2-SI-TV-2884C and the VCT manway.

SUMMARY

OF SPECIAL REQUIREMENTS

• Perform a daily RCS Leakrate PT.

• If RCS unidentified leakage exceeds 0.4 gpm, then an investigation to determine the source of the leakage will be initiated. i l

l l

I l

l l

l l

l 1

Safety Evaluation Number 94-SE-JCO-002 DESCRIPTION OF JCO MSTV and letdown isolation valve control board position indication lights have  !

been inoperable for an indeterminate length of time. These indications are i classified as RG-1.97, Variable B-14, Category 1 safety related. The failure of these lights presents the question of valve position as required by Technical Report PE-0013. ,

SAFETY EVALUATION

SUMMARY

Replacement of the subject light bulbs presents a letdown isolation or unit trip hazard and possible safety injection siiculd a MSTV ba inadvertently actuated.

Various RG-1.97 qualified inaications are available which can be used as a redundant indication of the MSTV and letdown isolation valve positions. These include S/G Level, S/G pressure and steam flow for the MSTV, and letdown flow

& pressure and VCT level for the letdown isolation valves. Changing S/G level and/or pressure following valve actuation will alert the operator to the condition of the valve following a steam line isolation signal. Additionally, the steam line flow indicators provide a direct correlation to the MSTV position. The position of the letdown isolation valves can be inferred from similar changes in letdown pressure, flow and VCT level. Although credit is not taken for the ERFCS '

Indication of the MSTV and letdown isolation valve position, the indications remain available. The most immediate need for determination of MSTV position '

would be following a LOCA or main steam line break. If one of these occurred concurrent with a loss of offsite power, the ERFCS indication would still be available for 15 minutes using its battery backup. There is also an indication of  :

the letdown isolation valve position should a Phase A' or SI signal occur.

Station EOPs direct the closure of the NRVs if there is sufficient doubt of the position of the MSTVs. This further ensures steam line isolation. 1 Consequences of an accident requiring a steam line/ letdown isolation are not affected due to use of the redundant indications. No new failure modes are being ,

introduced, and the probabilities of an accident are not increased. MSTV and l letdowr isolation valve position indication is not an accident precursor. For j these reasons, an Unreviewed Safety Question does not exist.  !

l

SUMMARY

OF SPECIAL REQUIREMENTS None l

l l

l

Safety Evaluation Number 94-SE-JCO-002, Rev.1 DESCRIPTION OF JCO

~

This revision provides compensatory measures for verifying the Bypass MSTV position in addition to the MSTV and the letdown isolation valves.

SAFETY EVALUATION

SUMMARY

Revision to add the Bypass MSTVs. The Bypass Main Steam Trip Valves are administra1 controlled in the closed position by Operations procedure 1/2-OP-1.4 prior to enterit Mode 2 and throughout normal operation. The upstream manualisolation valves are administratively controlled in the closed position by Operations procedure 1/2-OP-2E The Bypass Main Steam Trip Valves may be in the open position during Modes 3 & 4.

Modes 3 & 4 compensatory measures will be taken to verify that the valve (s) close <

Main Steam isolation Signal by using existing light indication available or manually closing the valve (s) from the Control Room. Although credit is not taken for the ERF indication of the Bypass Main Steam Trip Valve position, the indication remains availa -

The most immediate need for determination of Bypass Main Steam Trip Valve positio would be following a LOCA or main steam line break. If one of these occurred concui with a loss of offsite power, the ERFCS indication would still be available for 15 minui using its battery backup. Station EOPs direct the closure of the NRVs if there is sufficient doubt of the position of the MSTVs or their bypass valves. This further en steam line isolation. Consequences of an accident requiring a steamline isolation ar affected due to use of the compensatory measures. No new failure modes are being introduced, and the probabilities of an accident are not increased. Bypass Main Stea Valve position indication is not an accident precursor. For these reasons, an Unrev ]

Safety Question does not exist.  !

i

SUMMARY

OF SPECIAL REQUIREMENTS 1

None )

l

Safety Evaluation Number 94-SE-JCO-002, Rev. 2 1

DESCRIPTION OF JCO This safety evaluation will generically address similar failure of the light indication for the MSTVs, Bypass MSTVs, Letdown containment isolation valves, and CC to RCP containment isolation valves, should it occur in the future. These i indications are classified as RG-1.97, Variable B-14, Category 1 Safety Related. I The failure of these light (s) presents the question of valve position as required by i Technical Report PE-0013.

I SAFETY EVALUATION

SUMMARY

l Replacement of the subject light bulbs presents the possibility of causing an undesired system or unit transient should the light circuit be shorted or the control  ;

switch.be inadvertently actuated causing valve closure during the bulb 1 replacement activity. Such failure during the activity could result in the following: j MSTV - Reactor trip and Safety injection; Bypass MSTV - SG transient or i Reactor Trip and Safety injection; Letdown containment isolation TV - loss of l letdown with the possible lifting of the letdown relief valve; CC to RCP l containment isolation valve - loss of CC to an operating RCP. The UFSAR states in Section 7.3.1.3.5.1 that the position of each isolation trip valve and the ,

availability of power is monitored on the main control board. Though the  !

availability of valve position indicating lights is degraded, alternate means to determine valve position from the main control room will be available to determine valve position. These are the use of remaining position indication lights and/or process parameter indications. Similarly, power availability can be alternately monitored by process parameter indication, since the containment isolation valves are designed to fail closed on a loss of air or power. The MSTVs are an exception to this since they are energized to close; however, the light indication for the MSTVs is segregated from the closure control circuitry by the use of a separate circuit. Various RG-1.97 qualified indications are available which can be used as a redundant indication of MSTV position and letdown isolation valve position. These include S/G level, S/G pressure and steam flow for the MSTV and letdown flow and pressure and VCT level for the letdown isolation valves. Changing S/G level and/or pressure following valve actuation will alert the operator to the condition of the valve following a steam line isolation signal.

Additionally, steam flow indicators provide a direct correlation of MSTV position.

The Bypass Main Steam Trip Valves are administratively controlled in the closed position by Operations procedure 1/2-OP-1.4 prior to entering Mode 2 and throughout normal operation. The upstream manual isolation valves are also administratively controlled in the closed position by Operations procedure 1/2-OP-28.1. The Bypass Main Steam Trip Valves may be in the open position during Modes 3 & 4. During Modes 3 & 4 compensatory measures will be taken to verify that the valve (s) close on a Main Steam Isolation Signal by using existing light indication available (light indication from the redundant switch on the Safeguards Panel and/or ERFCS valve position indication) or manually closing

the valve (s) from the Control Room. .The CC to RCP containment isolation valves are required to close on a Phase "B" containment isolation signal. Each valve is provided with two sets of position indication (redundant to each other) in the Control Room on the Safeguards Panel. With at least one red light and one

~

green light position indication operable, sufficient indication is available to determine the position of the valve following containment isolation. (The availability of the ERFCS position indication also provides an additional means to determine valve position indication). This is acceptable until conditions exist that would allow restoration of the inoperable indication with less operating risk.

Although credit is not taken for the ERFCS indication of the MSTV, Bypass Main Steam Trip Valve, Letdown containment isolation valve, and CC to RCP containment isolation valve position, the indication remains available. The most immediate need for determination of such isolation valve position would be following a LOCA or main steam line break. If one of these occurred concurrent with a loss of offsite power, the ERFCS indication would still be available for 15 minutes using its battery backup. Station EOPs direct the closure of the NRVs if there is sufficient doubt of the position of the MSTVs or their bypass valves. This further ensures steam line isolation. In addition, E-0 directs the verification of Phase "A" and "B" containment isolation when actuated; if a ' valve is not determined to be closed, the procedure directs manual closure of the valve from the Control Room. Consequences of an accident requiring a steam line or containment isolation are not affected due to use of the compensatory measures (use of alternate indication). No new failure modes are being introduced, and the probabilities of an accident or malfunction are not increased. MSTV, Bypass Main Steam Trip Valve, Letdown containment isolation valve, and CC to RCP containment isolation valve position indication is not an accident precursor. For these reasons, an Unreviewed Safety Question does not exist.

SUMMARY

OF SPECIAL REQUIREMENTS None

Safety Evaluation Number 94-SE-JCO-003 DESCRIPTION OF JCO

^

NRC Enforcement Discretion of Technical Specification 3.7.1.2 is requested to allow for an additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> prior to implementing the action to place the Unit in Hot Shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. This additional time will allow completion of repairs to the steam turbine driven Auxiliary Feedwater Pump lube oil system.

Technical Specification 3.7.1.2 allows for continued operation for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> with one AFW pump inoperable. The repairs to the pump may exceed this time limit but will be completed within the following 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or plant shutdown to Mode 4 will commence in accordance with Tech Spec 3.7.1.2.

SAFETY EVALUATION

SUMMARY

Allowance of the additional time is acceptable for the following reasons:

• Both motor driven AFW pumps will be maintained operable during this time.

Operator rounds will verify no abnormal conditions exist to affect their operability.

• Performance of monthly surveillance testing of the motor driven AFW pumps, testing of the ESF circuits, and historical performance during trips has shown that the pumps have a high degree of reliability.

• Reliability of the emergency power supplies is maintained since both EDGs will be maintained operable during this time frame. No switchyard work will be performed, nor is severe weather forecast for the area. Therefore, the potential for loss of offsite power is limited.

• Inoperability of the turbine driven AFW pump is assumed to be the single failure of the AFW system. However, if the most limiting DBA for AFW, a rupture of a main feedwater line to one of the motor driven AFW pump's supplied steam generator occurred, and the motor driven pump aligned to the intact steam generator failed, core cooling would be maintained via proceduralized operator actions (2-AP-22 series). Specifically, the motor driven pump aligned to the faulted generator, which was protected from run out by a back pressure control valve, could be realigned to either non-faulted generator. Sufficient steam generator inventory exists such that core cooling would not be lost during these contingency actions.

• All three main feed pumps and condensate pumps are currently operable with no maintenance planned during this time frame. Only one main feed pump / condensate pump are required to maintain the unit at HOT SHUTDOWN conditions if offsite power is available and no Safety injection signal is present.

• During the time frame that the turbine driven AFW pump work is being performed, no additional work or testing is planned that will result in the unit being ramped. This will reduce the possibilities of a transient occurring which would require AFW and is consistent with NUREG 1431 (Standard Tech Specs) for the basis section dealing with no operable AFW pumps.

• All auto start circuitry (ESF and AMSAC) for the motor driven AFW pumps is routinely tested to verify operability and will not be affected by work on the turbine driven AFW pump.

• The North Anna Individual Plant Evaluation ~(IPE) model includes plant specific data for the steam driven AFW pump. The maintenance unavailability for this pump was conservatively adjusted to reflect a single additional outage of 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />. The core damage frequency (CDF) from internal events was recalcu!ated .witt the increased outage time to determine the sensitivity of ine additional outage. The CDF increase was 9.0E-8 per year. This increase is judged to be negligible.

• If the circumstances were such that AFW was not restored prior to loss of -

heat sink, the Functional Restoration procedure (FR-H.1) directs the Operations crew to perform Safety injection feed and bleed of the RCS until a secondary heat sink is restored. This will protect the core from damage. -

SUMMARY

OF SPECIAL REQUIREMENTS -

• No planned maintenance will be performed on the motor driven AFW Pumps t

• No planned maintenance will be performed in the switchyard

• No planned maintenance will be performed on the Emergency Diesel Generators

• All Main Feedwater Pumps are available with no maintenance planned for this l time period

• All Condensate Pumps are available with no maintenance planned for this time period

. Operating shifts will be briefed on the actions of abnormal procedure AP-22.1, Loss of 2-FW-P-2 Turbine Driven Aux. Feedwater Pump.- Specifically the ability to cross-tie Auxiliary Feedwater Pumps if required t

-[

i t

a i

6 J

b

Safety Evaluation Number 94-SE-JCO-004 DESCRIPTION OF JCO

^

The JCO justifies operability of 2-FW-P-2 (AFW Steam Driven pump) with the water in-leakage into the lube oil system exceeds the limit recommended by the lube oil manufacturer. The JCO has determined that the terry turbine pump would operate properly even if the water in leakage is as high as 7.4% during the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> design basis operation of the pump. Lube oil sample taken during operation of the terry turbine pump indicate increased water content will exceed the lube oil manufacturer's recommendation ci 0.2% during the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> run.

SAFETY EVALUATION

SUMMARY

The JCO assumed a loss of offsite power occurred during a MFWLB accident.

The end result could be the loss of one motor driven pumo due to single failure with the other motor driven pump being secured due to the break. The steam driven pump would be the only pump available at the start of the accident for core decay heat removal. The JCO has determined the steam driven pump would still be operable during the design basis operation with the water in-leakage as high as 7.4% at the end of the 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> design basis run. The AFW system is designed to be cross-tied so that any available pump could be manually aligned to feed .

any steam generator. As such, the operable motor driven pump could be aligned, as required, to feed a steam generator. In the long term, the lube oil used in the terry turbine pump could be changed out quickly as required. The bases of the AFW system is to ensure adequate flow is svailable to remove core decay heat and reduce RCS temperature to less than 350F from normal operating conditions in the event of a total loss of offsite power. Analysis shows that one pump flowing to one generator is capable of meeting this requirement.

The ability of the AFW to perform its intended function will still be maintained and i thus an unreviewed safety question does not exist.

SUMMARY

OF SPECIAL REQUIREMENTS .

I

• The total water in-leakage is 7.4%, or

• The water content in the lube oil prior to the pump running is 1.48% or less.,

and

• The water in-leakage is 0.74% or less per hour during the design basis 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> i run. l

• The AFW system can be cross-tied, as required, to feed the available steam i generators with one operable motor driven AFW pump.

• The tube oil can be changed out quickly, as required.

i i

t l

ATTACHMENT 3 Safety Evaluation Summaries Jumpers 94-SE-JMP-001 thru 026 1

l i

j j

/

SAFETY EVALUATION LOG .

JUMPERS 19_94 Date SNSOC Evaluator / Prepared Date Description SNS Reviewer Unit # Document System S.E. #

1-06-94 1-07-94 LaPrade / Harper ins *a!!Iocking device & lock on 2-EP-CB-507, bkr #4, 2 N2-1060 icr maintenance on 2H1-2N, bkr. #H4 (2-St-MOV-28658)

./94-SE-JMP-001 1-11-94 1-12-94

- Harper / Walker Allow repair to discharge vacuum priming seal water pump 1 N1-1586 discharge valve 1-VSW-16 9 94-SE-JMP-002 1-19-94 1-19-94 Mladen / Walker Installation of space heaters for freeze protection for 1.2 N1-1587 d4-SE-JMP-003 EDGs and RWST leveltransmitters 1-19-94 1-19-94 Mladen / Simpson Installation of portable heaters in TSC & Adm. Annex 1 N1-1588 deluge room for freeze protection.-

t 9'4-SE-JM P-004 1-22-94 LaPrade / Harper 1-22-94

,. Place portable space heaters in the fuel oil pump house 1.2 N1-1589 to raise ambient temperature

+94-SE-JMP-005 1-23-94 1-23-94 Walker / LaPrade y Allow repair to instrument air line without isolating air 2 N2-1061 to the bypass feedwater regulating valves 94-SE-JMP-006 1-27-94 1-21-94 Walker / Reid Dewater auxiliary building sump to facilitate sludge 1,2 N1-1590 94-SE-JMP-007 removal 2-04-94 Walker / Hunsberger 2-02-94 1-OP 21.1 (P-1)

Disable & enable control room annunciator G B-2 when E4-SE-JMP-008 1.2 transferring containment cooling to or from SW 2-OP-21.1 (P-1) (These changes are considered a temporary modification.)

2-10-94 2-11-94 Disosway / Stankard Place 2 temporary chargers on security battery to reduce 1 N1-1593 battery drain during replacement of EDS auto transfer switch - _ - _

4-SE-JMP-009 2-11-94 Nedza / Harper 2-11-94 Insert electrical power cables through the corner of the 7__ N1-1594

+ 94-SE-JMP-010 1.2 fuel oilpump house door and MCC Eng. transm. CE-94-002 12-10-94 R-15-94 Phelp Reid Temporary test on separation of EDS #1 & WDS #1 to 1.2 , N1-1591 d4-SE-JMP-011 Eng. transm EE-93-017 determine if f alse alarms are eliminated 2-17-94 C. Mladen / F. Mladen 2-10-94 Place LED lamps in HCV-1898 valve position indication 1 N1-94-1592 d4-SE-JMP-012 sockets 2-17-94 LaPrads / Disosway 2-15-94

/ Test procedure to install jumper to provide temporary ai 1.2 D-NAT-91-114-3-2 supply to various pieces of equipment while IA piping is

'$4-SE-JMP-013 (FC 2 to DCP 91-114-2) modified IAW DC 91-114 1

1 1

I Safety Evaluation Number 94-SE-JMP-001 DESCRIPTION OF TEMPORARY MODIFICATION l

TM Number N2-1060 i A locking device and lock are being installed on 2-EP-CB-507, breaker #4. This is the secondary protection breaker for 2-SI-MOV-2865B ("B" Accumulator Discharge MOV). The breaker will be locked in the open position for work on 2H1-2N bkr #H4 (normal supply breaker).

SAFETY EVALUATION

SUMMARY

The MOV is required to be de-energized open with its breaker locked to ensure Si accumulator discharge occurs when needed. This is required to meet accident analysis assumptions for peak clad temperature protection following a design basis accident. Since the MOV will remain de-energized during this evolution, no additional accidents are created and all existing accident analysis remains valid. The seismic implications of this activity have been evaluated by Engineering and determined to be acceptable due to the relatively low mass of the breaker and locking device and the requirement that the device be securely installed to the breaker handle. Locking the secondary protection breaker open +

meets the requirements of Technical Specification 4.5.1.1.c.

Safety Evaluation Number 94-SE-JMP-002 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1586 A temporary seal water supply line will be aligned to supply the required flow to the discharge vacuum priming pumps. This jumper will enable repairs to the discharge isolation of the discharge vacuum priming seal water pump,1-VSW-P-11A.

SAFETY EVALUATION

SUMMARY

Proper seal water flow to the discharge vacuum priming pumps will be maintained via installation of a temporary pump aligned from the discharge canal through a strainer to the normal seal water supply lines to 1-VP-P-2A & B. The temporary pump will be energized from the load side of 1-EP-MCC-1 A1-3 Breaker C2. Accident probability does not increase because the jumper provides for continued seal water flow to the discharge vacuum priming pumps. The temporary pump power supply is from a non-emergency bus. Accident consequences do not increase because the unit is currently operating in the condition specified by Operating Procedures for having the CW tunnel not fully primed (i.e. less than four CW pumps running). No unique accident probability is generated and the margin of safety is maintained because the jumper will be used only if adequate seal water flow is locally verified. The temporary pump power supply is non-emergency. In addition, the CW system is already operating in the configuration specified for unit operation with the tunnel not fully primed.

Therefore, there is no unreviewed safety question and this activity should be allowed.

Safety Evaluation Number 94-SE-JMP-003 DESCRIPTION OF TEMPORARY MODIFICATION <

L TM Number N1-1587 l 1 Due to the extremely cold weather, ambient temperatures in the EDG rooms and around the RWST level transmitter enclosures have dropped. In order to prevent the temperatures from dropping to a point where equipment is detrimentally affected, compensatory actions may be taken. These include installation of portable heaters in the EDG rooms, installation of Herculite drapes by the EDG louvers (at walkway around the missile barrier which will not affect air flow to the EDG while it is running), and installation of tents and heaters by the RWST level transmitter housings.

SAFETY EVALUATION

SUMMARY

The power supplies for the heaters will be off of station service therefore there will be no additional loading on the emergency busses. For a design basis  !

accident, it is assumed that all offsite power is lost which would result in loss of '

power to the heaters. This would not affect equipment operability for the following reasons:

- The EDG governor oil temperature should be maintained over 54F. Once the EDG starts, heat generated from the diesel and governor drive should maintain temperature over recommended value. Therefore loss of the heater upon EDG start has no negative consequences.

- The RWST level transmitter enclosures have two independent and redundant sets of heat trace. Each of which should be adequate to maintain temperature above freezing. During cold weather operations both sets will be energized and are powered from emergency busses. The heaters and enclosure will supplement the heat trace. Therefore upon loss of power, the heat trace circuits would be able to maintain the temperature above freezing until the swapover level to cold leg recirc is received (approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after initiation of accident assuming failure of one train). Therefore loss of the heater and/or enclosure will have negligible impact on the safety function of the transmitters.

The heaters and tents will be installed and secured such that they will not become a hazard to SR equipment in the area should a seismic event occur. Civil Engineering has provided direction to ensure th s is accomplished. Therefore there are no seismic concerns. Installation of the Herculite will reduce the air leaking by the louvers from entering the main portion of the EDG room. This will reduce loads on the existing heating system in the rooms. Installation of the Herculite will not have a detrimental affect on the EDG since the design airflow is over the missile barrier not around it. It should be noted that the 1H EDG room has a missile door installed which performs the same function as the Herculite would in terms of blocking air flow;if the Herculite would fall during an accident it would fall to the ground and would have a torturous path to follow to end up at

l Safety Evaluation Number 94-SE-JMP-004 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1588 Due to the extremely cold weather ambient temperatures in the Admin. Annex '

. deluge room and TSC support area have dropped. In order to prevent the ,

temperatures from dropping to a point where equipment is detrimentally affected '

portable heaters may be installed in the areas.

SAFETY EVALUATION

SUMMARY

The power supplies for the heaters will be off of station service therefore there will be no additionalloading on the emergency busses. The heater (s) in the TSC support area will maintain temperature elevated such that the Feedwater sensing lines located in the overhead will not freeze. Should offsite power be lost the feed flow indication would no longer be required since the feed pumps would also be lost. The heater in the Admin. Annex deluge room will prevent the fire protection piping from freezing. If power is lost and the line fails due to freezing it can be isolated from the fire loop via PlV-FP-92. Therefore there is no concern for loss of fire protection to the plant. The areas in which the heaters will be installed do not contain SR equipment (except for the FW sensing lines).

Therefore if the heaters fall over during a seismic event they will not damage any SR equipment. The FW sensing lines are located in the overhead therefore the heater cannot damage them during a seismic event since it will be on the ground.

Implementation of the compensatory actions will enhance equipment operation and will have no detrimental affects during a design basis accident. Therefore, there is no increase in the probability of an accident nor will there be an increase in the consequences of any accident. The potential modes of failure have been discussed above. Implementation of these actions will not result in a new type of accident.

i i

_m_ _. _ __-- - . _ _ _ _ - --- -

1 Safety Evaluation Number 94-SE-JMP-005 DESCRIPTION OF TEMPORARY MODIFICATION l

TM Number N1-1589 This temporary modification installs portable heaters in the fuel oil pump house. l Due to recent severe cold weather, it is suspected that the temperature of the 3

. fuel oil in the pipes in the FOPH is so cold as to affect the power requirements of d l the fuel oil transfer pumps. Several of these pumps have been experiencing high l amp readings during operation and subsequent activation of their thermal ,

l overload protective devices.  !

l i l 1 l SAFETY EVALUATION

SUMMARY

This temporary modification should provide adequate warmth in the FOPH to bring the pumps back to more normal power requirements, thereby increasing the overall reliability of the fuel oil transfer system. The UFSAR states that these rooms do not need to be heated since cold fuel oilis still viscous. The placement of heaters in the FOPH presents fire. protection concerns and as such, a continuous fire watch is required as long as the heaters are installed. This should reduce the probability of a catastrophic fire or explosion rendering the fuel oil system incapable of operation. Exhaust fans in the FOPH will be periodically cycled to limit fuel oil vapor buildup. Since there will be a continuous fire watch and this activity should increase the overall reliability of the fuel oil system, this activity presents no unreviewed safety questions and should be allowed.

I i

i

. .a

Safety Evaluation Number 94-SE-JMP-006 DESCRIPTION OF TEMPORARY MODIFICATION

^

TM Number N2-1061 The instrument air supply line to the Unit 2 Main Feed Reg. valves has an air leak at a fitting that recuires the Instrument Air (IA) header to be isolated for repair.

SAFETY EVALUATION

SUMMARY

The Unit is currently in Mode 2 with the Main Feed Reg. valves isolated and Steam Generator control via the Bypass valves. The Bypass valves are supplied with IA downstream of the Main Feed Reg. valves, therefore, isolating the instrument air header for repair would also isolate air to the controlling valves.

The jumper will use a rubber hose suitable for IA/SA pressures to connect 2-IA-2050 and 2-SA-1088. The portion of the lA header with the leak will then be isolated for repair. The jumper should be allowed because it is prudent to repair the lA leak prior to placing the Main Feed Reg. valves in service. The SA system normally supplies the Instrument Air system via the SA/lA tanks' cross connects in the Aux. Bldg. A check valve will be used in the jumper line to prevent a SA leak from bleeding down the lA system. In addition, the lA header portion that will be worked will be isolated out. The safety function of the bypass feed reg.

valves is not affected by this jumper and no equipment important to safety will be adversely affected. Therefore, there is no unreviewed safety question.

I

Safety Evaluation Number 94-SE-JMP-007 DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N1-1590 The Auxiliary Building sump tends to accumulate sludge in the bottom. This sludge can lead to higher area radiation levels than necessary and also can be flushed to the High Level Liquid Waste tanks if the amount of sludge gets too great. For these reasons, it is desired to clean out the sludge periodically. Prior to sludge removalit is necessary to dewater the sump as much as possible. The existing Auxiliary Building sump pumps do not remove all of the water, therefore a temporary modification has been proposed to use a temporary pump to dewater the Auxiliary Building sump.

SAFETY EVALUATION

SUMMARY

This temporary pump will discharge to the existing Auxiliary Building sump pumps' discha ge header which directs flow to the High Level Liquid Waste Tanks. The temporary pump to be used is made by Warren Rupp and is a Sandpiper Model SB11/2-A. The pump discharge will be directed to the normal sump pump discharge line via valve 1-DA-28 ('B' Aux. Bldg. sump pump discharge isolation valve). The bonnet will be removed from 1-DA-28 and a gasket and flanged nipple will be installed. An isolation valve will be attached to the nipple and the Sandpiper pump will be routed through the isolation valve.

The flanged nipple is made of carbon steel and is capable of handling the design pressure and temperature of the DA system (195 psig at 350F). The temporary isolation valve is also capable of handling the DA system design conditions. The Sandpiper pump will be powered by the Service Air system via a high flow cut off valve and rated hose. An operator will be stationed at the temporary pump during operation to provide isolation if necessary. (Note that the Sandpiper pump has an internal check valve to prevent reverse flow.) Auxiliary Building sump pump 1-DA-P-3B may be out of service during the time period that this jumper is used. 1-DA-P-3A will remain operable and be available as a back up to the temporary pump if required. No new accident scenarios are created by this jumper and the jumper does not affect the ability of safety equipment required to mitigate the consequences of any accident. Based on the above arguments, the temporary modification should be allowed.

Safety Evaluation Numbn- 94-SE-JMP-008 DESCRIPTION OF TEMPORARY MODIFICATION 1/2-OP-21.1 (P1) ,

i The proposed PAR allows defeating control room Annunciator "G B-2"(CD TO AIR RECIRC CLRS Hi-LO TEMP) for both Unit 1 and Unit 2. This Annu?ciator alarms on high or low chilled water temperature being supplied to the containment recire air cooling coils.

SAFETY EVALUATION

SUMMARY

System design allows aligning Service Water to the recirc air cooling coils to I allow for maintenance and unexpected problems with the chilled water system.

The subject Annunciator provides no useful information to the operators when Service Water is aligned. This PAR should be allowed because it is desirable to maintain a " black board" concept in the control room. That is, we want to eliminate any nuisance Annunciators that may distract the operators from identifying an important or useful Annunciator. The procedure ensures that the Annunciator is enabled prior to placing the chilled water back in service to the containment air recirc cooling coils. Defeating the Annunciator is a simple process that is used regularly at NAPS (pulling the Hathaway patch cord and installing a shorting plug) There is no possibility that this jumper will cause an accident or malfunction. In addition, the jumper can not prevent an accident or malfunction from being mitigated.

Safety Evaluation Number 94-SE-JMP-009 DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N1-1593 Implementation of a DCP to replace the Automatic Transfer Switch on the Security EDS will require removing the 480VAC distribution system from service for several hours. This will de-energize the Security Battery Charger during the time the 480VAC system is down. Although the Security Battery can carry the load during this time, it is more prudent to provide temporary battery chargers to help carry this load and reduce the draw on the Battery.

SAFETY EVALUATION

SUMMARY

Two 0-80 VDC and 0-20 Amp chargers will be used in series on the Battery to carry some of the Security DC load during the DCP implementation. The Security Battery is not part of any of the accident precursors for Chapter 15 accidents. For this reason, implementation of this jumper will not increase the probability of occurrence of any accident or malfunction of equipment previously identified. The Security Battery is not part of any mitigating system or equipment for Chapter 15 accidents. For this reason, implementation of this jumper will not increase the consequences of any accident or malfunction of equipment previously analyzed. Failure of the portable charger would be a local event and would not feed back into any systems or equipment important to stabilizing and shutting down the plant. Security contingencies are in place to mitigate the consequences of a loss of the Security EDS. For these reasons, implementation of this jumper will not create the possibility for an accident of a different type than was previously identified. Therefore, no Unreviewed Safety Question exists.

Safety Evaluation Number 94-SE-JMP-010 DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N1-1594 / Engineering Transmittal CE-94-002 This TM allows inserting electrical power cables through the corner of the Fuel Oil Pump House door and MCC. The purpose of the electrical cables is to provide power to the heaters in the fuel oil pump house.

SAFETY EVALUATION

SUMMARY

The major issue considered is the fire suppression of the CO2 system. The doors are not fire rated but provide a barrier for CO2 if actuation is made. This barrier shall be maintained. An unreviewed safety question does not exist because there are no changes to Tech Specs or the UFSAR. There is no increase in the probability, consequences, or possibility of any accident. The margin of safety will not decrease.

Safety Evaluation Number 94-SE-JMP-011 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1591/ Engineering Transmittal EE-93-017 This temporary Modification will allow electrical separation of the Explosive Detector System (EDS) and the Weapon Detector System (WDS) in front of the Security Access Control Building. The purpose of this separation is to try and determine cause of false alarms on the detectors. ,

SAFETY EVALUATION

SUMMARY

The temporary modification will include separation of an EDS and WDS in the front entrance of the Security Access Control Building. In addition, the WDS will b provided temporary power from the Security UPS system. The major issue involved is to ensure that the temporary increase in load on the Security UPS does not affect the operation of the Security System. The EDS and WDS will temporarily remove 58 VA from the "C" bus and temporarily add 30 VA to the Security UPS. The Security UPS is supplied power from MCC-1G2-2 and is modeled in the Station Electrical Load List (SELL) as 175 KVA and the security diesel is rated for 219 KVA An Electrical Systems Analysis in accordance with STD-EN-0026 has been performed and the Security UPS has the capacity to handle the temporary addition of the 50 VA without exceeding equipment ratings.

Therefore, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-JMP-012 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1592 This safety evaluation is being performed to allow the temporary use of LED lamps for 01-SI-HCV-1898 valve position indication. Over the years, the valve position indication lights powered from the 125 VDC bus have experienced a high rate of failure. The bus is normally maintained around 140 volts, which is significantly greater than nominal. The incandescent bulbs currently in use are rated for 120 volts. The LED lamps to be used are rated for 145 volts, which is sufficient for the bus voltage. The LED lamps are designed to last greater than 10 years. And the use of lamps rated for the bus voltage will also improve life expectancy. Also, the LED lamps draw much less current than the currently used incandescent bulbs (7.5mA vs. 25mA). Therefore, the power usage and consequently the heat developed will be less with a LED lamp than with an incandescent bulb.

SAFETY EVALUATION

SUMMARY

01-SI-HCV-1898 has no safety functions. Per the EDS, the limit switches for the valve are non-safety. Therefore, the valve position indication must not be safety related. The use of commercial grade equipment is acceptable in non-safety applications. 01-SI-HCV-1898 is powered from the 1-1125 VDC bus. Failure of the LED lamps could not credibly cause a loss of the de bus due to the fuse and the breaker in the valve circuitry. The nitrogen supply for the SI accumulators tap off the line to the nitrogen supply to the PRT. Failure of 01-SI-HCV-1898 in the +

open position would not prevent the ability to maintain the Si accumulator  ;

nitrogen cover-pressure in the range required by T.S.3.5.1.d due to other valves in the line to the PRT which would control flow. Per DEO Civil Engineering (G. T.

Bischof), the seismic qualification of the Control Room vertical board panel is unaffected since the light bulb mounting is unchanged.

l l

l 1

Safety Evaluation Number 94-SE-JMP-013 DESCRIPTION OF TEMPORARY MODIFICATION Procedure D-NAT-91-114-3-2 / (Field Change #2 to DCP 91-114-2)

DCP-91-114 is removing and capping some abandoned IA piping. During the removal process, IA will be isolated to several components. A procedure will control the evolution and provide for a temporary air supply from service air to be installed to the isolated equipment during the process. The equipment effected is:

• 1/2-CC-TV-1/206 (CC to the non-regenerative heat exchanger);

• High Radiation Sample System (HRSS) valves;

• Hydrogen Analyzer system valves.

SAFETY EVALUATION

SUMMARY

Since air supply will be maintained to all components, no adverse consequences will result from this evolution. The failure of the mechanical jumper will reposition the affected valves to their fail-safe position and is bounded by previous loss of IA analysis. All systems will perform as designed. While service air and instrument air will be cross-tied for a brief amount of time during the jumper installation and removal, an operator will be available to re-isolate the systems should a problem occur. Furthermore, the service air system normally backs up the instrument air system. Therefore, no major safety consequences will result from this jumper installation and no unreviewed safety questions exist or are created. '

Safety Evaluation Number 94-SE-JL P-014 DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N1-1596 DCP-91-011 is reworking some SW piping. During the piping alignment process, Operations has requested that a temporary lA jumper be available to supply air for the operation of screenwash instrumentation. This procedure will control the evolution and provide for a temporary air supply to be installed to the isolated equipment during the process. The equipment effected is: 1/2-CW-TV-1/200 1/2-CW-LDS-1/205A/B/C/D 1-BL-PIC-111 1-CW-FCV-1201/2-VP-HCV-1/206A/B -

1-RW-PCV-104.

SAFETY EVALUATION

SUMMARY

Since air supply will be maintained to all components and the valves to be installed have been approved by Engineering (see IPR 689), no adverse consequences will result from this evolution. The failure of the mechanical jumper will reposition the affected valves to their fail-safe position and is bounded by previous loss of IA analysis. All systems will perform as designed. While service air and instrument air will be cross-tied for a brief amount of time during ,

the jumper installation and removal, an operator will be available to re-isolate the '

systems should a problem occur. Furthermore, the service air system normally backs up the instrument air system. Therefore, no major safety consequences will result from this jumper installation and no unreviewed safety questions exist or are created.

l

)

i i

. I

l Safety Evaluation Number 94-SE-JMP-015 DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N2-1063 A casing joint leak on the Unit 2 Terry Turbine is spraying water on the bearing housing. This water is infiltrating into the bearing oil. Installation of a temporary deflection shield on the turbine inboard and outboard gland seal area to divert

. water leakage away from the bearing housing will aid in diverting the leakage away from the bearing oil.

SAFETY EVALUATION

SUMMARY

The shield will be constructed from 0.020 inch thick brass shim stock or equivalent. The amount of metal required to construct the shield is small, (less than 1 square foot) so it will not affect the seismic design of the pump. The metal will not present any sort of fire hazard. The shields will be attached to adjacent casing / gland housing fasteners using standard insulation tie wire. This will adequately support the shields such that no adverse affects on the pump will result. In the unlikely event that the shield (s) become dislodged, it should not interfere with the proper operation of the pump since it is a small, light piece of ,

metal. Proper operation of the Terry Turbine will be verified after the modification with performance of the normal Tech Spec surveillance,2-PT-71.10. Therefore, ,

an unreviewed safety question will not be created by the temporary installation of the shields.

1 l

=

Safety Evaluation Number 94-SE-JMP-016 '

DESCRIPTION OF TEMPORARY MODIFICATION

~

Procedure D-NAT-93-117-1 This procedure will install a temporary sump pump in the Safeguards Area Sump Trough to maintain control of sump level during the implementation of level switch replacement under DCP 93-117.

SAFETY EVALUATION

SUMMARY

The Safeguards Area Sump Pumps are not part of any accident precursors.  ;

installation of a temporary sump pump in this location will not affect any of the existing accident precursors. Therefore, implementation of this jumper will not increase the probability of occurrence of any accident previously evaluated. The Safeguards Area Samp Pumps are not part of any mitigating systems for the above accidents. Installation of a temporary sump pump will not affect any of the installed mitigating systems for the above accidents. Therefore, implementation of this jumper will not increase the consequences of any accident previously evaluated. Operation or failure of the temporary sump pump has no different consequence than operation or failure of the existing sump pumps. No new accidents of significance would be expected by failure of either sump pump.

Therefore, implementation of this jumper will not create any new accidents not previously evaluated. These sump pumps are not discussed in the bases of any Tech Specs. Therefore, implementation of this jumper will not reduce the margin of safety represented in the bases of any Tech Specs. For these reasons, no Unreviewed Safety Question exists.

l l

l l

1 l

Safety Evaluation Number 94-SE-JMP-017 DESCRIPTION OF TEMPORARY MODIFICATION TM Numbers N1-1597,1598, N2-1064,1065 This safety evaluation is being performed to allow installation of an electrical jumper around the containment isolation letdown trip valve push buttons and lifting of leads around the position indication lights. This activity will facilitate the replacement of the indicating lamp light sockets which are currently inoperable.

SAFETY EVALUATION

SUMMARY

Since the jumper will defeat the push buttons on the Safeguards control panel in the main control room, the associated valve is considered inoperable when the jumper is installed. The ietdown isolation trip valves are required to close on a Phase "A" Containment Isolation signal. This automatic actuation will not be affected by this jumper. The ability to close the valve using the close push-button will be lost while the jumper is installed; however, manual letdown isolation capability is maintained via the redundant trip valve (opposite train) in series on the letdown line. The position indicating lamps are classified as Reg. Guide 1.97 required indication. As these indications become inoperable, appropriate action statements are entered. The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action of TS 3.6.3.1 will be entered while the jumper is installed. The Tech Spec requirements for ESF actuation (TS 3.3.2.1) were reviewed. The requirement for manual actuation of Phase A isolation is still met because the control room Phase A actuation switches are still operable and will send a close signal to the subject valves. The subject circuitry is powered from the 125 VDC busses. Failure of a jumper could not credibly cause a loss of the de bus due to the fuse and the breaker upstream of the valve circuitry.

Failure of the jumper would cause the trip valve to inadvertently close.

Inadvertent letdown isolation could cause the letdown relief valve and/or the RHR relief valves to lift, but would not create a design basis accident. For the above reasons, an unreviewed safety question does not exist, and this activity should be allowed.

4 a

Safety Evaluation Number 94-SE-JMP-018 DESCRIPTION OF TEMPORARY MODIFICATION TM Numbers N2-1067 A temporary power supply to the RPI cabinet will be used to power the cabinet in the event that the normal power supply (H-Bus SOLA Transformer) fails. The ,

temporary power supply will be powered from the installed J-Bus Transformer

~

which powers the local plugs in the RPI cabinet. The power supplies will be swapped in a break-before-make fashion to ensure that the Emergency busses

are not cross tied.

SAFETY EVALUATION

SUMMARY

A temporary power supply for the Rod Position Indication system will be used in case the normal power supply is lost. The supply will be from the "J" bus powered receptacles located in the RPI cabinets. The RPI system will function as designed with the temporary power system installed and will maintain its function in the event of a loss of offsite power. Installation will only occur in the event of the loss of the normal power supply due to failure or desire to replace a malfunctioning unit. During swapover, indication will be lost briefly, but group i step counters will still be active, ensuring the operators of continued rod position surveillance capability. The temporary power supply will be secured in a seismic fashion, and will utilize an emergency power supply (J-Bus). The attemate power supply will be as reliable as the normal power supply. The power supply will be made in the break-before-make fashion, thus ensuring that the emergency busses are not cross tied. The load list has been considered, and the additional loading on the J-Bus is well within the design of the 2J EDG. Since this jumper will not adversely affect the emergency busses or any other plant systems, it does not pose any unreviewed safety questions and should be allowed.  :

?

r Safety Evaluation Number 94-SE-JMP-019 DESCRIPTION OF TEMPORARY MODIFICATION Procedure 1-MOP-8.02  :

This safety evaluation is being performed for the specific case in which the "B" charging pump is inoperable, and it is desired to switch the "C" pump from the normal to the alternate breaker configuration. "A" is to be maintained as the operable pump; however, the pump circuitry is designed with an 86 lockout of the '

"A" charging pump on a "H" bus UV/DV with the "C" normal breaker racked in.

Thus, with the "B" pump inoperable, pump manipulations to swap "C" pump from its normal power supply to its alternate (i.e., placing "C" in PTL), would render "A" pump inoperable. This would result in all three pumps being inoperable until "C" normal breaker is racked out. Additionally, entry into TS 3.0.3 would be required.

The activity proposed is to defeat the 86 lockout of the "A" pump while swapping the "C" pump from normal to the alternate breaker configuration, to maintain the -

"A" pump operable.

SAFETY EVALUATION

SUMMARY

The purpose of the specified 86 lockout protection is to provide protection against overloading the "H" bus upon restoration of voltage following a UV/DV condition.

Specifically, the capability of the EDG to energize the "H" bus with two HHSI and one LHSI pump breakers closed would be severely challenged. This overload protection will still be provided via the 15H7 86 lockout which will trip the "C" normal breaker since the "A" breaker will remain closed following a UV/DV signal .

on the "H" bus. The Charging / HHSI systems as well as the "H" EDG will function as designed with the lockout temporarily defeated and will maintain their function in the event of a loss of offsite power. With the "A" pump lockout  ;

defeated, the required protection will be provided via a redundant lockout of the "C" normal pump breaker. This activity only involves defeating an EDG overload protection logic associated with the "H" bus charging pump breakers for a short duration. While the EDG overload protection logic is defeated, the EDG will still function as designed because the redundant protective logic will remain available to trip open a HHSI pump breaker to prevent the EDG from being overloaded following a UV/DV condition. The "A" pump breaker position contacts associated with the "C" normal trip circuitry (for the redundant protective logic) will be verified prior to performance of the proposed activity. Adequate train separation will be maintained. In addition, the activity will ensure the operability of the "A" Charging / HHSI pump is maintained during the breaker realignment 1 evolution. Therefore, the consequences of a condition IV event concurrent with a -

loss of offsite power are not increased by the proposed activity. The activity in no way affects any initiators for design bases accidents. For these reasons, the  ;

probability of a condition IV event concurrent with loss of offsite power is not  !

altered by the proposed activity. Therefore, an unreviewed safety question does not exist. The required bus overload protection will still be provided. Since l l

t i

w_

y ..

_i

.i l

this activity will prevent'a condition outside'of the plant's design bases and the ,

undesired entry into TS 3.0.3, this activity should be allowed.

i

,- i f,

r 5

i i

l I

i b

4 5

l

l Safety Evaluation Number 94-SE-JMP-020 ,

I l

DESCRIPTION OF TEMPORARY MODIFICATION '

Work Orders WO 281572-01/ 281772-01 The Maintenance Department is attempting to remove 1-HV-TCV-141 A-1 and B-1 for repairs in accordance with maintenance procedures and work orders.

However, no Instrument Air isolation valves exist for 1-HV-TCV-141 A-1 and B-1.

Since the TCVs will be physically removed from the system (both IA and HV), an isolation of some kind is necessary for the lA system. The first IA isolation valve is the supply isolation valve to ventilation control panel 1-EP-CB-43,1-1A-693.

Closing this valve will prevent closure of the bypass dampers necessary to place the Aux. Building General and Central exhaust through the lodine Filters (1-HV-AOD-102-1, 2 and 103-1, 2 will fail open). Therefore, the maintenance procedures include a Temporary Modification to install pipe caps on the supply lines at the connections to 1-HV-TCV-141 A-1 and B-1, and then reopen the isolation valve,1-IA-693, to restore the iodine filter function.

SAFETY EVALUATION

SUMMARY

Installation of pipe caps on the IA lines to 1-HV-TCV-141 A-1 and B-1 does not create a situation which is part of any of the precursors for Chapter 15 accidents.

Therefore, the probability of occurrence of accidents or malfunctions of equipment previously evaluated have not been increased. installation of pipe caps on the lA lines to 1-HV-TCV-141 A-1 and B-1 does not affect any of the mitigating systems for Chapter 15 accidents. Required safety related equipment functions are provided with air accumulators to insure operation upon complete loss of the IA system. Therefore, the consequences of accidents or malfunctions of equipment previously evaluated have not been increased. Use of pipe caps on the Instrument Air system is not discussed in the Tech Specs. No changes to Tech Specs are required to implement this Temporary Modification. Therefore, the margin of safety as reflected in the bases to the Tech Specs has not been changed. For these reasons, an unreviewed safety question does not exist.

1 Safety Evaluation Number 94-SE-JMP-021 l 1

DESCRIPTION OF TEMPORARY MODIFICATION

~

Jumper N2-1068  ;

02-SV-TV-202-1 failed its surveillance stroke time test PT-213.14. In order to l perform corrective maintenance on the containment isolation valve (divert to containment from condenser air ejector), the valve interlocks must be defeated with the normal air ejector discharge to "A" Stack valve 02-SV-TV-202-2. The second containment isolation valve 02-SV-TV-203 will be closed and de-energized in accordance with T. S. 3. 6. 3.1 during the corrective maintenance evolution.

SAFETY EVALUATION

SUMMARY

The air ejector will divert to containment on a Hi Hi Rad signal from 02-SV-RM-221. The 202-2 valve will close and the 202-1 and 203 valves will open allowing the discharge of the air ejector to flow to containment. If a Phase "A" occurs the air ejector will isolate and the Aux. steam supply valves will shut. Since the 203 is SHUT and de-energized the CRO will have to take action if a Hi Hi Rad signal is received from 02-SV-RM-221. The board operator will have to shut the Aux.

Steam valves to the air ejector because no containment flow path exists for the air ejector. If a Hi Hi Rad signal comes in on 02-SV-RM-221, Operations must notify HP to obtain a Grab Sample to verify that it is a valid alarm. If the alarm is valid, the CRO must shut the Aux. Steam valve to the air ejector to prevent an unmonitored Rad release through the air ejector loop seats.

Since T.S. 3.6.3.1's LCO is already entered, the containment isolation is established for the air ejector. The safety function of the isolation valve is to shut on a Phase "A". In addition, the CRO will ensure that the Aux. steam to the air ejector is isolated on a valid Hi Hi Rad signal from 02-SV-RM-221. Both of the functions of the air ejector will be addressed in this jumper. Therefore no unreviewed safety question exists for this Temporary Modification.

A

l l

Safety Evaluation Number 94-SE-JMP-022

)

l DESCRIPTION OF TEMPORARY MODIFICATION 1 l

Procedure 1-OP-8.7 (P-2)  !

The jumper will consist of a section of hose routed from a PG hose connection to the Boric Acid Batch Tank Overflow hose connection isolation valve,1-CH-435.

This will allow for flushing of the piping from the boric acid overflow lines to the HHLWT's. Not all of this piping is heat traced. This piping is being used to drain down the C BAST to the HLLWT's to make' room for batching. Batching is necessary to increase the boron concentration in the C BAST which is slowly being diluted by leakage past 2 SI-MOV-2867A/B.

SAFETY EVALUATION

SUMMARY

The drain valves from the BAST's to the HLLWT's will be verified closed before the flushing to prevent dilution of the BAST's. Opening of the hose connection isolation valve will be done slowly to prevent blowing out the BAST vent loop seats. Furthermore, levels in the BAST's will be closely monitored. Flushing will be secured at a 1 to 2 percent increase in HLLWT level.

The red rubber hose to be used is rated for the conditions to which it will be I exposed as are the affected portions of the CH and LW systems. The design conditions for the PG system are 195 psig and 130F. The hose is rated for 250 psig and 180F, the CH and LW piping is rated at approximately 205 psig and 200F. Therefore the integrity of the systems as well as the jumper is maintained.

Accident probability does not increase. The evolution will be monitored closely for any leakage past closed isolation valves and subsequent dilution of BAST's.

Accident consequences do not increase. The consequences of any BAST dilution are bounded by the consequences of an Uncontrolled Boron Dilution, which has been analyzed for (Reference UFSAR 15.2.4). Because the activity is bounded, no unique accident probability is generated and margin of Safety is maintained. Therefore, no unreviewed safety question exists.

l i

l

i l

l Safety Evaluation Number 94-SE-JMP-023 l 1

DESCRIPTION OF TEMPORARY MODIFICATION ,

l TM Number N2-1070 I l

Lift all wires of cable 2EXVINC009 at 2-El-CB-02, terminal block block TE, points )

9,13, and 14 i Lift all wires of cable 2SYGINC001 at 2-El-CB-20, terminal block block TB-1, '

points 7 and 8 Lift all wires of cable 2SYGINC002 at 2-El CB-20, terminal block block TB-1 )

points 1,2, and 3 i Main Unit 2 Generator breaker Automatic Synchronizer (common system for both units) is not operable, is not utilized by operations, nor is maintained by maintenance. Outputs from this system to the Unit 2 Regulator and EHC Turbine controls should be defeated during the next Unit 2 outage so that these outputs may be permanently removed by DCP-93-016 during the upcoming Unit 1 outage. This will preclude doing the Unit 2 side work with Unit 2 at power with l added unnecessary risks. The automatic synchronizing of interlocks isolated by l the performance of this temporary modification will be permanently removed by DCP-93-016 during the upcoming Unit 1 outage.

SAFETY EVALUATION

SUMMARY

Unit 2 will be shutdown. Instrument department personnel will be present for l steps being performed in cabinet 2-El CB-20 in the Control Room to lift and tape wires. All steps will be simultaneously verified. No additional testing will be required because independent verification of all lifted leads will be performed 1 following the evolution.

Accident probability does not increase because the automatic synchronization system is not currently used. Its absence will not increase the probability of any accident. For the same reason, accident consequences do not increase, no unique accident probability is generated, and margin of Safety is maintained. l Therefore, no unreviewed safety question exists.

l l

l Safety Evaluation Number 94-SE-JMP-024 DESCRIPTION OF TEMPORARY MODIFICATION

^

TM Number N2-1069 During the latest stroke test PT,2-SV-TV-202-1 did not stroke quickly enough.

As a correction for this problem, IA tubing to the TV will be replaced with larger tubing for reduced IA pressure loss and to eliminate potential debris in the existing tubing. During installation of this tubing, the following valves will be isolated from the lA header: 2-MS-TV-209, 210, 211 A, 211 B, 213A, 213B, and 213C; 2-MS-HCV-204; 2-SV-TV-203. Also, the Safeguards Exhaust dampers will reposition to the lodine Filter position when the lA Header is isolated.

SAFETY EVALUATION

SUMMARY

The action staternent for one inoperable Aux. Feedwater Pump will be entered during replacement of the tubing because the normal air supply to 2-MS-TV-211 A,B will be 50Mted. 2-MS-TV-209 and 210 will be allowed to remain closed during the tubing replacement and the drain header will be allowed to pressurize.

This is not expected to cause a problem for the short period of time the tubing replacement will require. 2-MS-TV-213A, B, and C are normally closed and are not required to be open during Mode 1 operation. 2-MS-HCV-204 is normally closed and M0?d. 2-MS-TV-203 is closed and isolated for compliance with the containmers iscetion Tech Spec during the time 2-MS-TV-202-1 is inoperable.

Allowing the Eateguards Exhaust to discharge through the lodine Filters is the accident position and will not unnecessarily harm the lodine filters for the period of time to replace the tubing.

The materials used to replace the potentially degraded lA tubing will be suitable for the application. This piping enhancement is intended to improve the performance of 2-SV-TV-202-1, and portions of the lA supply piping will be replaced with piping of a larger diameter. This increase in piping diameter will not adversely affect valve operation because air pressure will still be regulated

_ rior to entering the actuator. The portion of the lA piping affected is not required to be seismic.

The function of the valve will not be changed by the tubing replacement. The modification will aid in increasing the available supply air capacity for actuator operation. This should allow the valve to stroke more quickly; therefore, the design function of the valve is unchanged by the modification. During the actual tubing replacement, appropriate TS action statements will be complied with. For the above stated reasons, the probability of an accident or the increase of the consequences of an accicent or malfunction are not increased. Appropriate actions will be taken during lA isolation to the above components so that a new accident or malfunction is not created. For these reasons, an unreviewed safety question does not exist, and this activity should be allowed.

b

)

Sofety Evaluation Number 94-SE-JMP-025 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N2-1071 The existing air regulator (Fisher Model 67AF) for the air ejector divert trip valve (02-SV-TV-202-1) will be replaced with a different model (64) which will provide higher flow capabilities. Problems exist with the air ejector trip valve stroking in the opening direction. Modifications have been performed to reduce the losses in ,

the air supply lines and have helped reduce the problem but it has not been resolved. The new air regulator will pass more air flow than the existing model which should help with the problem with the valve.

4 SAFETY EVALUATION

SUMMARY

The air ejector trip valve is normally closed during power operations. It gets an open signal on a high-high radiation from the air ejector rad monitor to divert the air ejector exhaust to containment and it also receives a close signal on a Phase A containment isolation.

The new regulator is the same as the original in terms of form, fit, and function. It will be adjusted to maintain the air pressure to the actuator at the same pressure as the existing one. The material construction of the regulator is such that it will be compatible with the environment to which it will be exposed. Operation of the air ejector divert trip valve will not be detrimentally affected in any way.

The function of the valve will not be changed by the regulator replacement. The modification will aid in increasing available supply air capacity for actuator operation. This should allow the valve to stroke open more quickly; therefore, the design function of the valve is unchanged by the modification. During the replacement, appropriate TS action statements will be complied with. For the above stated reasons, the probability of an accident or the increase of the consequences of an accident or malfunction are not increased. For these reasons, an unreviewed safety question does not exist and the activity should be allowed.

l

Safety Evaluation Number 94-SE-JMP-026 DESCRIPTION OF TEMPORARY MODIFICATION Work Order 289746-02 While performing PT-213.14, containment isolation Instrument Air valve 01-IA-TV-102A failed to stroke CLOSE on demand. It was determined by Maintenance that the SOV is bad and needs to be replaced. A Jumper has been written to hook IA directly to the TV to maintain it OPEN while the SOV is being replaced by Maintenance. Without the jumper installed to maintain IA to containment, IA pressure will decrease. As the air pressure decreases, other Phase "B" containment isolation valves will start to go shut. The other Phase "B" TV supply CC to the RCP's. Without CC, the RCP's will heat up. The Operator will then be required to trip the Unit and shut down the affected pumps.

SAFETY EVALUATION

SUMMARY

The jumper will bypass the SOV by hooking an air line from the regulator to the Trip Valve air connection. 'ine air line and fittings used in the jumper are rated for temperature and pressure of the lA system. The "B" train isolation valve,01-lA-TV-1028 is operable and will provide isolation of the penetration if in the unlikely event a Phase "B" signal is received. In addition, an Operator will be stationed by the valve during the period the jumper is installed to provide manual isolation of the penetration if it is required. The T.S. action for the LCO provides for a four hour time period to restore the valve to operable status while maintaining the other penetration isolation valve operable. This requirement will be maintained during the Nriod the jumper is installed.

No unreviewed safety question exists for the following reasons: While the jumper is installed,1) one isolation valve for the affected penetration is operable. 2) the T.S. LCO will not be exceeded. 3) an Operator will be stationed by the penetration to isolate it should it be required.

I 1

1

i l

l l

l I

ATTACHMENT 4 i Safety Evaluation Summaries  !

Temporary Modifications 94-SE-TM-001 thru 017 i

l I

9 4

- - - - . m - - - , , . - . . . _ . . ,_ .,,

.gi SAFETY EVALUATION LOG TEMPORARY MODIFICATIONS 1994 i S.E. # Unit # Doc ument System Description Evaluator / Date SNSOC _

SNS Reviewer Prepared Date 1,2 N1-1599 BL,CW Install tees & isolation valve in discharge piping of bearing Mladen / Anderson 5-25-94 5-26-94 (SISE-TM-001 lube pump 1-BL-P-1 A & screenwash pump (2-CW-P-28)

--p. _

2 N2-1074 QS Jurnper around flow switch 2-OS-FS-202A Reid / Walker 6-15-95 6-15-95.

t 94-SE-TM-002 N1-1600 RS Install evaporator pressure regulating valve to maintain Mladen / Simpson 6-30-94 7-01-94

,94-SE-TM-303 1 constant backpressure on chiller portion of casing cooling refrigerant unit ge4-SE-TM-004 1,2 N1-1601 W Replacement of f ailed / obsolete signal conditioning system F. Mladen / Hunsberger 7-12-94 7-12-94 ~

with Analog Devices 3841 modules N1-1602 LW Install remote actuator on 1-LW-1161 (suction valve for Meire / LaPrade 7-25-94 7-27-94

,44-SE-TM-005 1 1-LW-P-18) to support primary resin transfer on Aug. 4/5. '94 r-1,2 N2-94-1076 CC Install temporary air jumper around 2-CC-TV-204B to allow Simpson / Hunsberger 7-31-94 8-02-94

'j94-SE-TM-006 light bulb socket to work 1,2 N2-1075 BC Defeat low level trip for zinc chloride tank pumps Mladen / Walker ' 8-02-94 8-04-94

- E-TM-007 4 1/2-BC-P-4B for repairs to a leaking fitting on suction piping N1-1603 SEC Install jumper on battery cells #1 & #44 of security UPS Phelps / Disosway 8-02-94 8-10-94 p S4-SE-TM-008 1 battery system V94-SE-TM-009 1 N1-1604 LW Install bag filter in discharge line from dewatering pump & Meire / Mladen ' 8-16-94 8-25-94 direct water from shipping lines for spent resin to fluid waste treatment tank via floor drains in decon bay 2 N2-1077 Si install fluorescent tubes & LEDs in vertical board 2-3 Lusk-Spichiger / 8-29-94 8-31-94 r94-SE-TM-010 and in overhead lamps - Hunsberger 94-SE-TM-011 ,1 N1-94-1606 LO Jumper out bearing lift pressure permissive for the Mladen / Slankard 9-09-94 9-09-94 9 tuming gear motor N1-94-1607 HV,BY Block exhaust & supply ductwork in 1-1 & 1-111 battery Badewitz-Pirooz / 9-16-94 9-16 44-SE-TM-012 1 rooms to maintain control room pressure boundary during Anderson 1-PT-87H & 1-PT-87J during fuel movement 7' Reid / Disosway 11-03-94 11-07 g/94-SE-TM-013 2 N2-1078 VB Lift leads on flow switch in vital bus inverter 2-VB-INV-01 1

- __:-.--_ -_ __ _ . . _ __ __- _ . - . . _ . . _ . . , _ _ _ - . . . . - . _ . . _ _ . . _,-u...

SAFETY EVALUATION LOG TEMPORARY MODIFICATIONS 1994 S.E. # Unit # Document System Description Evaluator / Date SNSOC SNS Reviewer _ Prepared . Datej J

p-SE-TM-014 1 N1-94-1609 CW Jumper out breaker closing signal from *D' CW pump LaPrade / Harper 12-13-94 12-14 94' -

to the 'D' CW punp discharge MOV SE 1 N1-94-1610 CC Elec. jumper to bypass Train A control pushbuttons . Walker / Mladen $1-17-94 12-16-94 f4I -TM-015 & lift leads to Train A lamp indication for 1-CC-TV-104C to change out the red lamp for 1-CC-TV-104C AN-SE-TM-016 2 N2-94-1079 01 Swaps leads from *C' RCP shaft seal temperature indicator LaPrade / Walker 12-15-94 12-20-94

& bearing indicator to get proper readings on P-250 e 64-SE-TM-017 2 N2-94-1080 & 1081 Install new LED lamps for 2-CH-TV-2204A & 2204B Walker / Mladen 12-22-94 12-22-94 i -

l i

4 euee 2

- _ _ . . - . - - . . - - -. - .. , . ~ , . , . .-. - . . - - - - -. - .. - - . .- - . . . .

Safety Evaluation Number 94-SE-TM-001 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1599 The 1 A Bearing Lube (BL) pump is degrading and needs to be worked on. The existing cross-tie between the BL and screen wash systems may be inadequate to supply the required BL flow to the Circulating Water pumps should the 1B BL purnp fail during maintenance on the 1 A pump. Therefore a jumper is being i installed which will ensure adequate flow should the above scenario occur.  ;

SAFETY EVALUATION

SUMMARY

The jumper will consist of tees and an isolation valve (1 A BL pump only) in the discharge piping of the unit 1 A bearing lube pump (01-BL-P-1 A) and the unit 2B screen wash pump (02-CW P-2B). A section of 3 inch fire hose will be used to tie the two systems together at the tees. In addition, the circuitry for the 1 A BL strainer will be modified to allow for it to operate in manual versus when the BL pump is running. The CW screen wash system is operated in manual (i.e. when the CW screen hi delta-P alarm comes in an operator is dispatched to backwash the screens). The function of the screen wash system is as follows:

-Provide screen wash to CW traveling screens

-Provide flow for the Reverse Osmosis (RO) System

-Backup to bearing lube system -Provide makeup capability to the SW reservoir The piping in the screen wash / bearing lube systems consists of carbon steel (class 121), copper (class 21B) and PVC (class 155). Per NAS 1009 these classes are rated for 175 psi at 150F,150 PSI at 150F and 145 PSI at 150F respectively. The bearing tube pumps are rated for 140 gpm flow at 140 foot head while the screen wash pumps are rated for 910 gpm at 225 foot head. The screen wash pump discharge flow will be throttled to maintain the CW pump Bearing Lube supply header (downstream of 1-BL-PCV-111) under 50 psig. This ensures that the CW pump coolers are not over pressurized and that the relief valve located on the plastic header piping (1-BL-RV-107: lift setpoint of 50 psi) does not actuate. The fire hose and fittings are rated for at least 125 p. ig, which is the shutoff head of 2-CW-P-28. From the above information it can be seen that this configuration will not result in any equipment being exposed to conditions outside their design. The pump manufacturer was contacted concerning minimum flow for long-term pump operation without damage. Mr.

Gerry Harrelson of Johnston Pump Company recommended a minimum flow of 300 gpm. 2-CW-P-2B will be started using an appropriate OP or Operations guideline, which will contain specific steps to support operating the pump with this temporary modification. Flow through an existing screen wash line will be adjusted to ensure this minimum flow requirement is met during continuous operation (i.e., this provides a " bypass" flow path), therefore there is no potential for pump damage. If backwash of the CW traveling screens is required, then flow

L through the " bypass" flow path can be adjusted or isolated to ensure adequate  ;

pressure is available. Therefore the ability for screen wash is not significantly  ;

affected. Flow to the RO system is normally supplied from the unit 1 A screen  !

wash therefore the jumper will not have any impact on it. Makeup to the SW  :

reservoir can be performed via the 1B (01-CW-P-28) and 2A . (02-CW-P-2A) CW l

~

L screen wash pumps. This jumper will not have any affect on that capability. It  !

should also be noted that the normal backup capability for bearing lube header i via FCV-120 will remain operable. The electrical portion of the jumper i (installation of a toggle switch to allow for manual operation of the 1 A BL strainer)  :

will not result in cross tie of any electrical busses, loss of channel separation or  ;

increase in 1E bus loading. There is adequate fault protection (fuses and i breakers) to ensure protection of the bus. Since the jumper has no interface will SR systems and failure of the electrical portion of the system will not result in loss of the bus, there is no unreviewed safety question.

\

t t

i l

k l

1 m . _ ,_ _ . _ ._,..%.,, .,. . . --

Safety Evaluation Number 94-SE-TM-002 DESCRIPTION OF TEMPORARY MODIFICATION 1 *

! TM Number N2-1074 Flow switch 2-OS-FS-202A is removed for maintenance which makes 2-OS-MR-1 A (RWST mechanical chiller) inoperable. Normally, the 'A' chiller will only start i if an RWST recirc pump is running and has sufficient flow to support the chiller operation as sensed by 2-OS-FS-202A. The purpose of this temporary modification is to jumper around the flow switch.

SAFETY EVALUATION

SUMMARY

l The chiller interlocks will still require that a recirc pump be running, and recirc temperature is warm enough to require refrigeration. During hot weather, if the

'B' RWST chiller were to fail or degrade, RWST temperature limits might be challenged. By jumpering around the flow switch contacts, the 'A' chiller will be available as a backup. The normal function of the flow switch is to provide assurance that sufficient flow is available to support chiller operation. By design, an operating chiller will trip if an RWST recirc pump is not flowing. Since this function is not available with the flow switch inoperable, additional administrative controls should be in place to ensure 2-OS-MR-1 A is only placed in service if 4 necessary. The remainder of the chiller interlocks will continue to be operable; the chiller can only be placed in operation if a recirc pump is running, and it will cycle on temperature. Tech Specs on the RWST temperature will be followed; if temperature exceeds allowable limits, appropriate action shall be entered. This ensures compliance with the design basis; therefore, an unreviewed safety

)

J question does not exist.

_ - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ - _ - _ _ _ = _ __

Safety Evaluation Number 94-SE-TM-003 l DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N1-1600 An evaporator pressure regulating valve (EPR) will be installed to maintain a l constant back pressure on the chiller portion of the casing cooling refrigerant unit.

The casing cooling refrigeration units are required to maintain the casing cooling tank temperature between 35F and 50F. Since the chillers are operating at low temperatures, the flow through the expansion valve (in the refrigeration cycle) is low which results in a low pressure in the chiller. This causes the hot gas bypass va!ve to open which allows gas from the discharge of the compressor to enter the chiller. The purpose of this process is to prevent freeze up of the water. However it is not operating at its optimum which is resulting in short cycling of the refrigeration process and reducing the cooling capacity / efficiency. To resolve the problem, it is desired to install an EPR which will maintain the chiller pressure above 58 psig (saturation pressure of freon at 32F) and the hot gas bypass valve can be isolated.

SAFETY EVALUATION

SUMMARY

The refrigeration units are not considered safety related nor is the piping to and from the refrigerant units. They are powered from station service busses. Tech Specs (3.6.2.2) do not address the refrigerant units. The Tech Spec only states that the casing cooling tank will be maintained from 35F-50F. Discussion of the refrigeration units in the UFSAR (6.2.2.2) is limited to the statement that there are two chillers and they maintain the casing cooling tank temperature between 35F and 50F.

Use of the EPR will allow for better control of the refrigeration process and thus allow for lower outlet water temperatures. Failure of the EPR could result in freeze up which would result in loss of the refrigeration unit. This would be detected by the casing cooling tank high temperature alarm and there would be adequate time to place the other refrigeration unit in service. The worst case failure scenario would occur if the redundant refrigeration unit was tagged out for maintenance and this one failed. This would result in increasing temperature of the casing cooling tank and entry into the action for an inoperable tank if temperature rose above 50F. The failure would not result in any type of accident or failure of other equipment. Any consequences to accidents would not be affected since the chillers are not required once the accident occurs. Use of the EPR valve would improve the efficiency of the unit and could not result in any unanalyzed accidents. For the reasons given, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-TM-004 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1601 Currently, various primary met tower indications (delta-T, upper and lower wind speed and lower wind direction) are inoperable due to failed process modules.

No spare modules are available. The existing Action Instruments UP10 modules will be replaced with Analog Devices 3B41 modules. These modules process the signals from the primary met tower instrumentation (delta-T, ambient temperature, upper and lower wind speed and direction) and send it to the control room indicators / recorders and ERF computer.

Lightning strikes to the primary met tower have resulted in numerous failures of the Action Instrument modules. Once the module fails, the applicable indication is lost. These modules process the signals from the primary met tower instrumentation (delta-T, ambient temperature, upper and lower wind speed and direction) and send it to the control room indicators / recorders and ERP computcr.

These modules are no longer manufactured and there are no spare modules in stock. The existing Action Instruments UP10 modules will be replaced with Analog Devices 3841 modules. The Analog Devices module will perform the same function as the original modules and can be installed with minimal hardware changes.

SAFETY EVALUATION

SUMMARY

The primary met tower is powered from construction power; thereforn there is no concern with loading of the emergency busses or the EDG, nor is there concern with cross tie of electrical power supplies. The new modules will be wired the same as the originals in terms of logic. The met tower instrumentation has adequate isolation capability to ensure no feed back to control or protection circuitry.

Once the new modules are installed the met tower indication will return to normal.

This is ensured by calibration of the loops, as required, once the module is installed. Compliance with TS 3.3.3.4 will be maintained.

An unreviewed safety question does not exist because:

- The modules only allow for the met tower data to be processed and sent to the control room indication and ERF computer. The primary met tower is powered from construction power and has adequate isolation to ensure feed back into control or protection circuits does not occur. Therefore the modification will in no way increase the probability of occurrence of any accidents.

-- The met tower data is used to calculate off site releases and implement PARS

-in EPIPs. Since operation of the system / indication will not change, installation I of the new modules will not increase the consequences of any accident.

)

- Only meteorologicalindication will be affected. Operation of the new module is the same as the original. Adequate isolation exists to prevent feed back from 1

affecting any control or protection channels. Therefore no other type of I accident can occur as a result of this modification.

l'

I l

Safety Evaluation Number 94-SE-TM-005 DESCRIPTION OF TEMPORARY MODIFICATION i

~

TM Number N1-11602 A remote actuator will be installed on 1-LW-1161, the suction valve for the spent resin metering pump 1-LW-P-18. The actuator will be air-to-open, spring closed, and controlled by a manual 3-way valve, with air supply from a service air connection in the Waste Solids building. The remote actuator will eliminate the need for an operator to climb onto the spent resin pump skid top operate the valve. During resin transfer operations, the radiation exposure can be very high and this unnecessary personnel risk can be easily eliminated by the actuator installation.

SAFETY EVALUATION

SUMMARY

Valve 1-LW-1161 is a 1-1/2" NIBCO F510 ball valve. There are two possible failure modes: 1) The closed valve fails to open, or closes while it is in use. This is a safe condition as it prevents movement of resin out of the spent resin hold-up tank. 2) The open valve fails to close, or opens inadvertently. In this case the spent resin will be admitted to the suction of 1-LW-P-18, and could be transferred to the shipping liner. This would be stopped by securing 1-LW-P-21, Spent resin Recirc Pump,1-LW-P-7 Spent Resin Dewatering Pump, and 1-LW-P-18 Spent Resin Metering Pump, as necessary. Pump 1-LW-P-18 would be secured first to stop resin movement, then the other two pumps would be stopped as necessary to prevent resin movement.

None of the failures can affect any safety related equipment. There are no electrical connections. All operations are controlled by procedures. All issues associated with the TM have been reviewed. Therefore, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-TM-006 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N2-1076 2-CC-TV-204B will be jumpered open by applying instrument air directly to the TV to allow. light bulb socket removal and replacement. In order to maintain continuous flow of CC into containment to the 'B' RCP shroud cooling coil, upper bearing motor cooler, stator cooler, lower bearing motor cooler, and thermal barrier, the valve must be jumpered open to perform this required maintenance.

SAFETY EVALUATION

SUMMARY

The indicator light is on the Unit 2 'B' Safeguards vertical board in the Main Control Room. In order to safely replace the bulb / repair the socket, it may be desired to de-energize the circuit. However, this would cause the trip valve to fail closed, thus stopping supply CC flow to the 'B' RCP.

The replacement of the burned out open indication light bulb will be performed by an operator or possibly by an electrician as a skill of the craft. The installation and removal of the jumper will be controlled by the steps of the procedure for the TM. The stroke PT will be performed for the valve to ensure operability prior to returning it to service.

The actual jumper will bypass the SOV by hooking an air line from the regulator to the TV air connection. The air line and fittings used in the jumper are rated for temperature and pressure of the lA system. The containment isolation valve inside containment,2-CC-115, a check valve, will be operable and will provide isolation of the penetration in the unlikely event a phase 'B' containment isolation signal is received. In addition, an operator will be stationed at the TV during the period of time the jumper is installed in order to provide manual isolation of the penetration if it is required. The TS Action (3.6.3.1) provides for a four-hour time period to restore the valve to operable status while maintaining the other isolation valve for the penetration operable. This requirement will be maintained during the period the jumper is installed.

No unreviewed safety question exists for the following reasons: While the jumper is installed 1) one isolation valve for the affected penetration will be operable 2) the Tech Spec LCO will not be exceeded 3) an operator will be stationed at the trip valve to isolate the penetration if it is required.

Safety Evaluation Number 94-SE-TM-007 -

DESCRIPTION OF TEMPORARY MODIFICATION TM Number N2-1075 The low level trip for the zinc chloride tank pumps (01/02-BC-P-4B) will be defeated. Repairs to a leaking fitting on the suction piping for 01/02-BC-P-4B near the zinc chloride addition tank require that it be drained below the tap on the -

tank. Zinc chloride is added to the BC system as a corrosion inhibitor. Due to the corrosive nature of the chemical, it is desired to pump it into the BC system via the tank's pumps. This level is below the normal pump shut off level. In order to perform this evolution, the low level trip for the pumps fed off of LSL-BC-126 will be defeated.

SAFETY EVALUATION

SUMMARY

The integrity of the tank, pump and piping will not be compromised. The Calgon pump manual 59-C129-00001 states that the pumps can have a suction lift of up to 4 feet. The low level shut off is to prevent the pump from running dry which would result in damage to its diaphragm. The tank has a siphon on the suction which is one inch above the base of the tank. Therefore the level should not be pumped below this point since it could result in pump damage. The level will be pumped to approximately 1 inch below the tanks inlet which is 8 inches above the bottom of the tank. This leaves 6 inches of water above the piping inlet. Tank level will be monitored to ensure proper level is maintained. The pumps capacity is 0.7 GPH and the tanks volume is 12.5 gallons per inch. Therefore it would take 107 hours0.00124 days <br />0.0297 hours <br />1.76918e-4 weeks <br />4.07135e-5 months <br /> to pump the tank down to the suction inlet. The tank level will be monitored at least daily during this evolution, therefore the pump protection will be maintained.

The BC system provides cooling water to various secondary systems during normal plant operations. The system is not safety related nor is it powered from  :

an emergency bus. The system is not required to mitigate any accident. The system could only pose a flooding concern should it fail, which is bounded by the flooding via CW system analysis. This jumper will not in any way increase the probability of failure of the BC piping.

Since the BC system is not required to mitigate the consequences of any accident, any evolution dealing with it will not impact the consequences of an accident.

^

For the reasons stated above, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-TM-008 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1603 This TM will jumper cells #1 and #44 of the Security UPS battery system. The battery cells have failed and new battery cells have an eight week lead time. ,

SAFETY EVALUATION

SUMMARY

This TM will reduce the battery floating voltage to 130.5 VDC. The security inverter is supplied power from the batteries in the event of a battery charger failure. The DC input voltage specifications on the inverter to maintain a regulated 120 VAC,60 Hz output are 105 - 140 VDC. The removal of the battery cells will also increase the discharge rate of the Security UPS battery system.

The battery system is required to carry the Security UPS load for approximately 10 seconds to allow the security diesel to start and carry tne load. The existing load on the UPS is approximately 22 amps. A cell sizing work sheet was performed in accordance with IEEE STD 485 to determine if the removal of two cells would affect operation of the Security UPS system. The results of the cell sizing worksheet indicated that only one plate pr cell is required to carry the Security system load for one minute. The existing security ES-7 battery cell contains 3 plates. Thus the reduction of the battery system float voltage and the removal of two battery cells will not impact the operation of the Security UPS system.

- Accident probability has not been increased because this design change conforms to standards and admins. The operation of the Security UPS system will not be affected by this TM.

- Accident consequences are not increased. The implementation of this TM will be performed and controlled using approved station procedures. The Security UPS system will not be affected by this TM. Failure of the Security system will not affect the safe shutdown of the plant.

- No unique accident probabilities are created. The implementation of this TM does not create a possibility for an accident or a malfunction of a different type than previously evaluated in the UFSAR because failure of the Security system will not affect the safe shutdown of the plant.

- Margin of safety is maintained because the integrity and reliability of the Security system has not been affected.

Safety Evaluation Number 94-SE-TM-009 DESCRIPTION OF TEMPORARY MODIFICATION

~

TM Number N1-1604 Spent Resin Shipping liners, both from Duratek lon Exchangers and primary resin shipments, will be dewatered through a bag filter hose connected into the discharge line from the shipping liner dewatering pump, with the waste water to be directed to the Fluid Waste Treatment Tank (FWTT) via floor drains in the i Decon Building. The purpose of this TM is to prevent migration of high activity solids to the FWTT and to prevent overflowing the Decon Building sumps by directing the water to drains which flow directly to the tank rather than to drains which flow to the sump.

SAFETY EVALUATION

SUMMARY

lssues considered were leakage of radioactive liquids, rupture of the filter housing, and overflowing the Decon Bay floor drains. The Decon Building is designed to handle radioactive waste liquid, being provided with proper ventilation, drains, and floor coatings. The filter housing is an ASME Vill pressure vessel. Overflow of the floor drains would be into an area which is provided with a stainless steel floor which is easily washed down. Observation by the operators will allow them to secure 1-LW-P-32 in the event of an overflow ,

during the " gross dewatering" phase of the operation. After " gross dewatering" is complete, not enough water remains in the shipping liner to cause the drains to ovedlow.

No Safety Related equipment is involved in this TM. There are no connections - i made.to equipment in the area. A review of SAR described accidents reveals  ;

that this TM will not cause or increase the probability or severity of such l accidents, or create a new type of accident. Therefore, an unreviewed safety l question does not exist. l l

il i

Safety Evaluation Number 94-SE-TM-010

• DESCRIPTION OF TEMPORARY MODIFICATION TM Number N2-1077 Installation of LED lamps rated for 145 VDC as valve position indication lights for valves 02-SI-HCV-2850A,2850B,2898, and 02-SI-TV-2884A. The purpose is that the 125VDC powered lights are experiencing a high failure rate. A possible action to mitigate this problem is to replace 120PSB bulbs with 145V LED lamps.

The LED lamps are sturdy and are designed to last 10 years. The 120PSB bulbs last approximately 3 months.

SAFETY EVALUATION

SUMMARY

The failure of the LED's or valves will not present any equipment from performing a safety related function. All valve position indications are non-Reg. Guide 1.97 and therefore, are non-safety related.

An unreviewed safety question does not exist for the following reasons:

Neither the probability of occurrence nor the consequences of an accident or malfunction of equipment important to safety will be increased due to failure of the subject valves. The SI system will still be able to perform its safety related function in the event of failures of any of the affected valves.

The possibility of an accident of a different type has not been created by  :

this TM. All equipment and plant conditions remain unchanged. The operators ability to monitor the plant shall not be diminished. '

The margin of safety has not been reduced. No plant parameter will change due to the replacement of incandescent bulbs with LEDs. The intent of using LEDs is to increase the reliability of control room indications.

1 l

l Safety Evaluation Number 94-SE-TM-011 DESCRIPTION OF TEMPORARY MODIFICATION -

l TM Number N1-1606

-The bearing lift pressure permissive for starting the turning gear _ motor is being jumpered out. ' When it was attempted to place the turbine on the turning gear,'  !

the turning gear motor did not start. Permissives to start the motor are adequate ,

bearing lube oil pressure and adequate bearing lift pressure. These conditions ,

were met; however, the contacts on the bearing lift pressure switch (LO-PS-600)  !'

did not close. In order to place the turbine on the turning gear, the permissive is being jumpered out. It is desired to place the turbine on the turning gear soon after it coasts down to prevent shaft bow from occurring. Prior to installing the jumper, the bearing lift pressure was verified to be 1650 psig which is well above ~ i the pressure switch setpoint of 525 psig.

~

SAFETY EVALUATION

SUMMARY

The pressure switch only feeds the permissive' for the turning gear motor. 'It serves no safety related function. Use of the jumper will_not result in any of the. -

Chapter 15 accidents occurring. The jumper will be removed prior to the unit -

starting up. The only failure mode 'which may have any significance would be loss of bearing lift pressure.'If this occurs, the contacts for the pressure switch ,

(LO-PS-600) open and the turning gear motor stops. Since the permissive is  !

Jumpered out, this trip would not occur which would result in overloading the- i motor. This'could result in failure of the motor which is powered from the 1H1_ .

480V emergency bus. Fuses and the supply breaker are adequate to isolate the bus from the fault therefore the potential for loss of the bus is not increased.

Once the turbine is taken off of the turning gear (approximately 40 hrs), the pressure switch will be repaired. Operation of the turning gear motor with the jumper in place does not pose any nuclear safety concern, therefore the modification is acceptable. For the reasons given above, an unreviewed safety question does not exist. -

I

.. _. _ _ . . _ _ . . _ . _ _ - . . _ , . _ . _ , , . ,,__,_m

l l

1 Safety Evaluation Number 94-SE-TM-012 l 1

DESCRIPTION OF TEMPORARY MODIFICATION l Procedure 1-PT-87H and 87J l This TM blocks the 1-1 and 1-ill battery room exhaust and supply ductwork closed in order to maintain the control room pressure boundary during the performance of the DC Distribution System Service Tests 1-PT-87H and 87J while fuel movement occurs. This will maintain the design basis of Control Room Habitability.  ;

SAFETY EVALUATION

SUMMARY

During the performance of DC Distribution System Service Tests 1-PT-87H and 87J, the doors to the 1-1 and 1-111 battery rooms will be left open for an extended period of time. Limiting Conditions and Special Requirements of this TM are as follows:

- A continuous fire watch shall be provided since the battery room doors will be propped open.

- Green Herculite and tape will be used to seal the ductwork in the 1-1 and 1-Ill battery rooms.

- The effectiveness of the TM will be verified prior to leaving the associated battery room door open for an extended period of time. l

- Security will be pcsted when the door is open. Also, security will be present if ,

the screens on the ductwork must be removed.

- Pressure boundary will be maintained during fuel movement.

- A temporary blower will ventilate the area for hydrogen removal.

- Adverse weather impact will be addressed in AP-41

- Fire watch and/or test engineer shall periodically monitor O2 and flammability ,

limit. J l

An unreviewed safety question does not exist because:

)

- The accidents considered were any event which releases radioactivity outside '

of containment for Units 1 and 2.

- The TM does not affect any precursors. Control Room Pressure Boundary is  ;

maintained during fuel movement.

- Accident mitigation equipment is not affected. Tech Spec compliance supports I control room habitability. Fire dampers in the 1-1 and 1-ill battery room I ductwork remains operable. The TM does not affect normal performance of the battery pts.

- The potential consequences of control room pressure boundary issues are already addressed by the habitability analysis. l

- Tech Spec compliance and UFSAR design basis is being maintained; l therefore, the margin of safety is not reduced. l i

i

Safety Evaluation Number 94-SE-TM-013 DESCRIPTION OF TEMPORARY MODIFICATION

^

TM Number N2-1078 The 2-1 vital bus inverter contains two fans that are located in the top of the cabinet. The fans normally draw air through louvers in the bottom of the cabinet and exhaust at the top. One fan motor has failed and a replacement is not available on site. A flow switch associated with each fan is used to monitor the fan performance. When the flow switch picks up, an alarm is received in the main control room which signifies vital bus inverter trouble.

The vital bus inverter trouble alarm is common with other inputs for low voltage (AC and DC), loss of sync, and ground. The alarm condition is real in that the air flow is low, but the alarm provides no useful information since the condition will not change until the fan motor is replaced. Hence, leads will be lifted on the flow switch in vital bus inverter 2-VB-INV-01.

SAFETY EVALUATION

SUMMARY

The purpose of the alarm is to provide a warning that tho inverter cooling air flow is low and inverter temperatures may be increasing. Since the failure approximately one week ago, additional monitoring has been performed on the inverter temperature. The temperature has remained relatively constant (85 - 95 degrees) since the time of the failure. This augmented monitoring will continue >

until the fan has been replaced.

The control room alarrn does not provide any additional information to the Operator At The Controls and the alarm is a distraction that may reduce the OATC's level of awareness to other alarms. The proposed temporary ,

modification does not affect the ability of the second flow switch from alarming on a low flow conditions. This activity does not present any unreviewed safety concerns and it does provide a positive benefit by removing an unnecessary alarm.

I

Safety Evaluation Number 94-SE-TM-014 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1609 This temporary modification jumpers out the breaker closing signal from the "D" CW pump to the "D" CW pump discharge MOV. This modification will allow the valve to receive a " pump breaker closed" signal so that the discharge MOV will go open when the pump breaker is closed as designed. This TM is being installed because the normal signal from the breaker is not working properly.

The TM will be removed once the pump is started.

This temporary modification will only be installed while the pump is being started

- for a period of several minutes. The mod will not affect the pump protective circuitry, or affect any other pump circuits. The CW system is not a safety-related system.and failure of this modification will at most result only in a turbine trip /

reactor trip on loss of condenser vacuum. For these reasons, no unreviewed safety question exists or is created.

SAFETY EVALUATION

SUMMARY

This temporary modification will only be installed while the pump is being started

- for a period of several minutes. The TM will not affect the pump protective circuitry, or affect any other pump circuits. The CW system is not a safety-related system and failure of this modification will at most result only in a turbine trip /

reactor trip on loss of condenser vacuum. For these reasons, no unreviewed safety question exists or is created.

I Safety Evaluation Number 94-SE-TM-015 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N1-1610 Temporary electrical jumper to bypass the Train 'A' control pushbuttons for 1-CC-TV-104C. Also lift leads to the Train 'A' lamp indication for 1-CC-TV-104C.

Containment isolation valve 1-CC-TV-104C supplies cooling water to the 'C' RCP lube oil coolers, motor stator coolers, thermal barrier heat exchanger, and the '

CRDM shroud coolers in the 'C' RCP motor room.

SAFETY EVALUATION

SUMMARY

The Train 'A' open lamp indication is burned out for 1-CC-TV-104C. In order to change out the lamp without closing the valve to de energize the circuit, a Temporary Modification will be used to defeat the control room pushbuttons and to de energize the Train 'A' indication lamps while still allowing the Train 'A' SOV to remain energized. Containment isolation valve 1-CC-TV-104C supplies cooling water to the 'C' RCP lube oil coolers, motor stator coolers, thermal barrier heat exchanger, and the CRDM shroud coolers in the 'C' RCP motor room. The valve is actuated by two SOVs in series powered off of Train 'A' and Train 'B'.

The Temporary Modification details consists of the following:

• Place jumper between Terminal Block 981CCPC06X00 to Terminal Block 103 1CCPC06C01 in 1-El-CB-5.

• Lift wires DV10 and R-1CCPC06X00 from right side of Terminal Block 98 and tape the lead.

While the Temporary Modification defeats the Train 'A' manual control l pushbuttons for 1-CC-TV-104C as well as the Train 'A' valve position indication lamps, all automatic safety functions of the valve are retained. Therefore, the ,

containment isolation requirement for this valve is retained, in addition, manual  !

valve closure and valve position verification can be accomplished via the Train 'B' I control pushbuttons for 1-CC-TV-104C.

Failure of this activity would result in closure of 1-CC-TV-104C. This would result in a loss of motor cooling for the 'C' RCP. A worst case scenario would be that an RCP trip would be required. Shutdown of the reactor and subsequent tripping of the RCP would not hinder any safety systems from functioning.

1-CC-TV-104C is a containment isolation valve described in Section 3/4.6.3 of the Technical Specifications. The requirements for having an inoperable containment isolation valve provide for up to four hours to repair the valve or to isolate the penetration. These requirements will not be violated by the proposed

~

activity.

Independent verification of Jumper removal and verification of valve position-indication being energized ensures that the control circuitry has been returned to the original configuration. ,

It is prudent to return the burned out indicating lamp to an operable condition.

The Temporary Modification will not increase the potential for any accident or malfunction nor will it affect the ability of any safety system to function as required. Based on the above discussion,' the proposed Temporary Modification should be allowed. .

1 I

b a

i i

t E

2  %

l

i Safety Evaluation Number 94-SE-TM-016 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N2-1079 The leads from the 'C' RCP shaft seal temperature indicator and bearing temperature indicator will be swapped. The leads are swapped in containment causing the readout for the P-250 computer to be swapped. This TM will result in the P-250 reading correctly.

SAFETY EVALUATION

SUMMARY

This TM will correct a wiring problem which causes two of the 'C' RCP temperatures on Unit 2 to read incorrectly. This TM involves swapping the leads for the two indicators, and will not affect the performance of the RCP or any of its protective circuitry. This is an enhancement for the operators only and involves temperature indication only. No other functions of any systems are affected.

Therefore, no unreviewed safety question is created.

i I

Safety Evaluation Number 94-SE-TM-017 DESCRIPTION OF TEMPORARY MODIFICATION TM Number N2-1074 Temporary electrical jumper to bypass the close control pushbutton for 2-CH-TV-2204A and 22048. Also lift leads to the lamp indication for 2-CH-TV-2204A and 22048. Containment isolation valves 2-CH-TV-2204A and 2204B isolate Reactor Coolant system letdown flow during accident conditions (i.e., Phase A signal).

SAFETY EVALUATION

SUMMARY

The lamp indication is burned out for 2-CH-TV-2204A and 2204B. It is desired to replace the burned out bulbs with new LED lamps (IAW DCP 94-239). Personnel safety concerns require that the control switch circuitry is de energized while changing out the bulbs. In order to change out the lamp without isolating RCS letdown, the Temporary Modification will be used to defeat the close control pushbutton and to de energize the indication lamps while still allowing the valve's SOV to remain energized.

The Temporary Modification details consist of the following for 2-CH-TV-2204A:

• Lift wires P21 from terminal TR-19 and P23 from terminal TR-27 in 2-El-CB-05.

• Install jumper between TK-75 and TR-10 in 2-El-CB-05.

• Lift wire on TK-75 labeled "P210" in 2-El-CB-05.

The Temporary Modification details consist of the following for 2-CH-TV-2204B:

• Lift wires PT1 from terminal TA-99 and PT3 from terminal TA-100 in 2-El-CB-05.

• Install jumper between TA-97 and TA-103 in 2-El-CB 05.

• Lift wire on TA-97 labeled PT-10 in 2-El-CB-05.

While the Temporary Modification defeats the close manual control pushbutton for 2-CH-TV-2204A and 2204B as well as the valve position indication lamps, all automatic safety functions of the valve are retained. Therefore, the containment isolation requirement for this valve is retained. The valves will be considered INOPERABLE during the time period that the TM is installed due to loss of manual closure capability from the control switch. The entry into TS Action will limit the time that the TM can be installed. Note that the letdown line containment penetration can be individually isolated by using the pushbuttons for the opposite train valve.

Failure of this activity would result in a loss of RCS letdown flow. The CRO would need to limit charging ficw to prevent the high level Reactor Trip. AP-16 provides appropriate guidance.

2-CH-TV-2204A and 2204B are containment isolation valves described in

Section 3/4.6.3 of the Technical Specifications. The requirements for having an inoperable containment isolation valve provide for up to four hours to repair the valve or to isolate the penetration. These requirements will be applicable for the proposed activity.

Independent verification of jumper removal and verification of valve position indication being energized ensures that the control circuitry has been returned to the original configuration. If the pushbuttons are replaced, a continuity check is required to verify pushbutton operability.

It is prudent to return the burned out indicating lamps to operable conditions. The Temporary Modification will not increase the potential for any accident or malfunction nor will it affect the ability of any safety system to function as required. Based on the above discussion, the proposed Temporary Modification should be allowed.

r h

j

ATTACHMENT 5 Safety Evaluation Summaries Procedure Changes 94-SE-PROC-001 thru 019

~~

~

L SAFETY EVALUATION LOG PROCEDURES 1994 Evaluator / Date SMSOC' Document System Description Prepared .Dete-S.E. # Unit # SNS Reviewer Disosway / Slankard 6-06-94 6-06 Adds step 6.6 to P&Ls to provide compensatory 94-SF-M 901/ 1.2 EMP-P-RT-210 (P-1 chg to Rev. 3) measures for operators durir.g an RCP start Harper / Walker 7-18-94 ' 7-19-94 1/2-OP-6.7 Allows pressurizing an EDG starting air receiver tank

{

D-SE-PROC-00g/ 1,2 via a jumper from the opposite train compressor (OTO-1 to Rev. 7) 7-26-94 7-28-94 Mladen/ Walker e

installation & removal of N2 rig for RHR Hx CC outlet

! g4-SE-PROC-00p' 1,2 1/2-MOP-51.03 valve actuators (block open 1-CC-TV-103A or 8 or (Rev 0) . 2-CC-TV-203A or B during maint. )

B-03-94 8-03-94.

Revised to include use of instrument air supply or N2 Mladen / Walker

$4-SE-PROC-00g/ 1,2 1/2-MOP-51.03 to block open 1-CC-TV-103A or B or 2-CC-TV-203A or B

REV. 1 during maintenance 1 ,

Mladen / LaPrade 7-28-94 7-2904 MD AP-00.9 Supplementalinstructions for Harvard Portable Filtration gi4-SE-PROC-004/2 " Unit W.O. 90000000-01 Day / Walker 7-07-94 '8-04-94:

1,2 0-PT-75.19 DP testing of service water MOVs .

94-SE-PROC-00q / (1-SW-MOV-121 A,B; 122A; 123A,B; 113A,B)

Simpson / Reid 8-24-94 8-24 Addition of oil to upper reservoir of I-RC-P-1 A SE-PROC-006/ 1 MDAP-0019 without shutting down pump (has locked in alarm)

~

W.O. 297730-01

,_ Miaden / Simpson 9-08-94 9-09-94 Provides for installing & removing a temporary 1 1 -PT-61.3.6 tj -SE-PROC-007,/ Gaitronics in Aux. Bid. penetration area (P-2 to Rev. 2)

LaPrade / Harper 5-24-94 '9-14-94

-r Utilizes a temporary modification to defeat UV trip of 'A' g,94-SE-PROC-004/ 1,2 1-OP-8.1 (Rev. 26) charging purnp while 'C' pump is racked in & in PTL 2-OP-8.1 (Rev.19)

LaPrade / Disosway 8-08-94 9-14-94 Utilizes a temporary modification to prevent isolation of

/4-SE-PROC-003[ 1,2 1/2-MOP-8.01 letdown when tagging the control power for either the 1/2-MOP-8.02

'A' or 'B' charging pumps 9-16-94 9-19-94 Utilizes a temporary modification to start 1-OS-P-1 A T. John / Anderson 94-SE-PROC-010

/ 1- 1 -O P-7.4 in recire mode (OTO-1 to Rev.13)

~ Walker / Mladen 9-21-94 '9-22-94

.; ~ Utilizes a temp. mod. to allow using containment vacuum y 94-SE-PROC-011/' 1 1-O P-5.1 sys. to perform a vacuum fill of RCS loops with icop stop (Rev. 25) valves isolated .-.

1

-.- _ _ _ _ _ . . - - , _ . _ . _ . - . _ . - - . , _ . . . - _, _ . , _ - . _ . _ . - _ _ _ . , - .. .._ . _ . . . ~ . . _ _ _ _ _. . _ - . _ _ -- _ . _ . _ _

Safety Evaluation Number 94-SE-PTU-001 DESCRIPTION OF PROCEDURE REVISION

~

Procedure Number (One Time Only Change to:) 2-PT-57.1 A (LHSI Pump 2-SI-P-1 A quarterly test) and 2-PT-57.18 (LHSI Pump 2-SI-P-18 quarterly test)

The change to the procedures involved installation of Rosemount pressure transmitters on the LHSI headers and use of a tygon tube routed to a collection flask. The pressure transmitters and the tygon tube are attached to LHSI header 3/4" LMC drains or vents. Upon completion of the test, the temporarily installed equipment is removed.

SAFETY EVALUATION

SUMMARY

The purpose of the procedure change was to quantitatively measure the peak pressure attained during the start of a LHSI pump. The procedure also provides a process to determine the volume of air which remains in the header after the pump is run by draining a controlled volume of liquid into a collection flask while monitoring the resultant change in header pressure with the installed pressure transmitters.

The following issues were considered:

a) Uncontrolled Boron Dilution - this is not credible for this test as no path is created with which to dilute the header.

b) Large Break LOCA - the LHS1 system opposite train remains available throughout the test. The pump undergoing testing is place in TS Action for the duration of the test and restored to operability at the conclusion of the test. A boration path and operable ECCS is maintained at all times. No penetration of any RCS boundary will occur to conduct this test.

The one time only procedure change should be allowed for the following reasons:

• The LHSI system is operated within normal expectations of system capability.

• The test performs a valuable function collecting data with which to improve the venting process of the LHSI header. This is conducted to mitigate pump start transients and prevent relief valve actuation.

• Technical Specifications will be adhered to at all times.

• All temporary installed equipment is fully controlled by this procedure with independent verification.

For these reasons, an Unreviewed Safety Question does not exist.

l I

Safety Evaluation Number 94-SE-PROC-001 I i

DESCRIPTION OF PROCEDURE REVISION

~

Procedure Number EMP-P-RT-210 A step has been added to the Precautions and Limitations section of this Protective Relay Maintenance procedure to provide compensatory measures for operators during an RCP start.

1 SAFETY EVALUATION

SUMMARY

l Because of the defeat of automatic protective actions during RCP motor starts, manual compensatory actions are substituted to provide equivalent electrical '

protection.

The use of manual operator actions instead of automatic actions to provide for RCP motor protection during startup does not change any of the accident precursors previously identified in the UFSAR. Therefore, the probability of occurrence of accidents or malfunctions of equipment previously identified in the i UFSAR is not increased.

The consequences of failure to manually trip a RCP in time to prevent damage i should it stall during startup are bounded by existing analyses for RCP locked i rotor, Large Break LOCAs, and Shutdown LOCAs. Also, RCP starts are l performed during Modes 3, 4, and 5 and would be far less challenging to i mitigating equipment. Therefore, the consequences of accidents and malfunctions of equipment previously evaluated in the UFSAR are not increased.

The RCP motors are slow starting and accelerating and allow sufficient time to identify and respond to a stalled motor condition prior to causing physical damage to the motor. Therefore, the possibility for an accident or malfunction of a different type than previously identified in the UFSAR is not increased.

RCP motor protection is not discussed in the Technical Specifications.

Therefore, the margin of safety as represented in the bases of the Technical Specifications is not reduced. For these reasons, an Unreviewed Safety  !

Question does not exist.

l l

1

l Safety Evaluation Number 94-S::-PROC-002 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1/2-OP-6.7 in order to facilitate repairs to the 2J EDG starting air compressor,2-EG-C-2JA, a jumper will be installed which allows pressurization of the starting air reservoir tank,2-EG-TK-2JB, from the opposite train compressor,2-EG-C-2JA. The "A" train tank will be maintained above its required pressure. A high pressure hose with a tee and drain valve will be installed between the drain valves of the two tanks. If it is desired to equalize pressure between tanks, the two drain valves will be opened such that the "A" tank will pressurize the "B" tank. The procedure requires that the jumper be isolated if the %" tank pressure approaches the minimum pressure specification. This Safety Evaluation is applicable to cross-tying the air reservoir tanks associated with any one EDG on either unit.

SAFETY EVALUATION

SUMMARY

The individual EDG air start systems are interconnected to provide an overlap of air port points. The jumper will only be used when it is desired to increase pressure in the tank with an inoperable compressor. After pressure is increased to the desired level, the tank drain valves will be isolated and the jumper will be removed.

The " Nuclear Policy on Defeating Equipment or System Automatic Functions" specifically addresses the cross-tying of EDG air bottles as a short term substitution of manual operator action for an automatic function to facilitate short term maintenance activities. The guidelines state that an approved safety evaluation is required, and the activity must be allowed by Technical Specifications. In the case of this proposed jumper, manual operator action will ensure that the pressure in one air bottle will always be maintained above the minimum required pressure. Thus, during the short time when the air reservoir tanks are being equalized, sufficient air start capacity will be available as described in the UFSAR. Additionally, one train of the EDG air start system can be unavailable without affecting the TS operability of the EDG.

This proceduralized TM is mechanical in nature and cannot affect protection or .

control circuitry. Failure of this activity could cause depressurization of one of the '

two EDG air reservoir tanks; however, the operator performing the activity would isolate the jumper before the pressure in the tank with the operable compressor falls below the minimum specification. One tank will provide sufficient air start i capacity for five EDG starts. The jumper will only be used to allow pressurization of a tank without its normal compressor in service, and will not be left installed. 1 For these reasons, an unreviewed safety question does not exist. Since this '

jumper will increase the operator's ability to control pressure in the EDG air start system without decreasing the margin of safety, the activity should be allowed.

Safety Evaluation Number 94-SE-PROC-003 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1/2-MOP-51.03

" Installation and Removal N2 Rig for RHR HX CC Outlet Valve Actuators" These MOPS allow the RHR system to remain operable during maintenance to 1-CC-TV-103A/B or 2-CC-TV-203A/B by installing a jumper to maintain the valves open.

SAFETY EVALUATION

SUMMARY

The existing design of the RHR system has individual supply lines to and return lines from each RHR heat exchanger. Each line has its own trip valve (103A/B, 203A/B). CC is supplied to the RHR pump seal coolers from both supply lines, and both coolers return to the "B" line. Therefore isolation of the "B" return line would result in loss of cooling to both seal coolers which renders both RHR subsystems inoperablo. Failure of the "A" trip valve will only affect the "A" RHR heat exchanger which would result in one RHR subsystem being inoperable.

Therefore, the jumper will be installed to maintain the trip valves open and RHR ,

operable and allow performance of maintenance These valves are also containment isolation valves, therefore the action of TS 3.6.3.1 will be entered while the TVs are inoperable. TS 3.6.3.1 states that one isolation valve must remain operable per penetration and the other valve must be returned to operable within 4 hrs or the unit shut down. The CC supply to and return from the RHR heat exchangers only have one containment isolation valve per penetration. UFSAR section 6.2.4.2 discusses the system design of the containment isolation system. The CC supply to and return from RHR penetrations are designed per General Design Criteria (GDC) 57 (an exception is taken to the supply line isolation check valves as discussed in UFSAR section 6.2.4.2) which states that each line that penetrates the containment and is neither j part of the reactor coolant pressure boundary nor connected directly to the i containment atmosphere shall have at least one containment isolation valve.

Therefore crec (is taken for the CC piping as a boundary One compensatory action which will be performed per the MOP prior to .

installation of the jumper (if the unit is in MODES 1-4) will be to close the NS l system fill valve (01/02-NS-LCV-101/201). This ensures integrity of the CC piping I due to the NS tank system piping not being seismically supported. The question of leakage testing requirements for these valves were discussed with system engineering, since it would be isolating containment atmosphere during an accident. Per the Type C system engineer, there are no requirements for testing 4 of sealed systems (as defined in GDC 57) within containment. The past  !

performance history of the LCVs indicates that they do not leak by. Since this l

boundary is operable (i.e. not breached), the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action of TS 3.6.3.1 may be -

l l

i entered if the return trip valves are declared inoperable. The RHR system has no ,

automatic function which will be defeated. The temporary nitrogen supply to the '

CC TV actuator will ensure cooling water to the RHR pump seal coolers by maintaining the CC flow path in service. The valve will be in its safe position for RHR operability which is consistent with similar positions such as not declaring SW inoperable if a SW spray valve is tagged out in its safe position (open) for ,

maintenance.

The nitrogen bottle will be adequately restrained to one of the concrete columns near the TVs so that it will not fall during a seismic event; therefore, there is no '

potential for damage to the TVs or other equipment in the area.'In the event of Jumper failure of the "B" TV and subsequent valve closure, both trains of RHR will be declared inoperable (if the "A" TV fails closed, one train will be declared ,

inoperable) and the appropriate action statement will be entered based on unit MODE. It should be noted that the TV will be closed in order for the jumper to be installed and removed. During this short time, the RHR system will not be considered inoperable. Since the evolution will be controlled via an approved procedure, the time the valve is closed will be minimal and this is similar to cycling the valve for its PT. The Tech Spec bases for RHR says that the system must be "available below 350 degrees F following plant shutdown." Since this function has not been altered, and the containment isolation tech spec will continue to be adhered to, no unreviewed safety question exists.

F m _ _ _ _ _ _ 9

i l

Safety Evaluation Number S4-SE-PROC-003, Rev 1 l l

DESCRIPTION OF PROCEDURE REVISION Procedure Number 1/2-MOP-51.03 i

" Installation and Removal of N2 or Air Rig for RHR HX CC Outlet Valve '

Actuators" l These MOPS allow the RHR system to remain operable during maintenance to 1-CC-TV-103A/B or 2-CC-TV-203A/B. This Revision allows the use of Instrument i' Air as well as N2 to jumper open the valves.

SAFETY EVALUATION

SUMMARY

)

l The existing design of the RHR system has individual supply lines to and return l lines from each RHR heat exchanger. Each line has its own trip valve (103A/B, l 203A/B). CC is supplied to the RHR pump seal coolers from both supply lines, i and both coolers return to the "B" line. Therefore isolation of the "B" return line l would result in loss of cooling to both seal coolers which renders both RHR l subsystems inoperable. Failure of the "A" trip valve will only affect the "A" RHR '

heat exchanger which would result in one RHR subsystem being inoperable.  !

Therefore, the jumper will be installed to maintain the trip valves open and RHR operable and allow performance of maintenance.

These valves are also containment isolation valves, therefore the action of TS 3.6.3.1 will be entered while the TVs are inoperable. TS 3.6.3.1 states that one isolation valve must remain operable per penetration and the other valve must be returned to operable within 4 hrs or the unit shut down. The CC supply to and -j return from the RHR heat exchangers only have one containment isolation valve 1 per penetration. UFSAR section 6.2.4.2 discusses the system design of the containment, isolation system. The CC supply to and return from RHR penetrations are designed per General Design Criteria (GDC) 57 (an exception is taken to the supply line isolation check valves as discussed in UFSAR section l 6.2.4.2) which states that each line that penetrates the containment and is neither  !

part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere shall have at least one containment isolation valve.

Therefore credit is taken for the CC piping as a boundary.

One compensatory action which will be performed per the MOP prior to installation of the jumper (if the unit is in MODES 1-4) will be to close the NS system fill valve (01/02-NS-LCV-101/201). This ensures integrity of the CC piping  ;

due to the NS tank system piping not being seismically supported. The question of leakage testing requirements for these valves was discussed with system i engineering, since it would be isolating containment atmosphere during an  ;

accident. Per the Type C system engineer, there are no requirements for testing l of sealed systems (as defined in GDC 57) within containment. Type "C" System i Engineer concurrence was received in safety evaluation 94-SE-PROC-003 Rev 0

approved 07/28/94. The past performance history of the LCVs indicates that they do not leak by. Since this boundary is operable (i.e. not breached), the 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action of TS 3.6.3.1 may be entered if the return trip valves are declared inoperable.

The actual jumper will bypass the SOV by connecting an air line from a pressure regulator to the trip valve air cylinder. The regulator will either be attached to an auxiliary nitrogen gas supply or the normal trip valve lA supply line. The air line, regulator, and fittings used in the jumper are rated for temperature and pressure of the lA system or the nitrogen gas supply, as required. The RHR system has no automatic function which will be defeated. The temporary nitrogen supply or Instrument Air rig to the CC TV actuator will ensure cooling water to the RHR pump seal coolers by maintaining the CC flow path in service. The valve will be in its safe position for RHR operability which is consistent with similar positions such as not declaring SW inoperable if a SW spray valve is tagged out in its safe position (open) for maintenance. If nitrogen gas will be used, the nitrogen bottle will be adequately restrained to one of the concrete columns near the Ws so that it will not fall during a seismic event; therefore, there is no potential for damage to the TVs or other equipment in the area. In the event of jumper failure of the "B" TV and subsequent valve closure, both trains of RHR will be declared inoperable (if the "A" TV fails closed, one train will be declared inoperable) and the appropriate action statement will be entered based on unit MODE. It should be noted that the TV will be closed in order for the jumper to be installed and removed. During this short time, the RHR system will not be considered inoperable. Since the evolution will be controlled via an approved procedure, the time the valve is closed will be minimal and this is similar to cycling the valve for its PT. The Tech Spec bases for RHR says that the system must be "available below 350 degrees F following plant shutdown." Since this function has not been altered, and the containment isolation tech spec will continue to be adhered to, no unreviewed safety question exists.

Safety Evaluation Number 94-SE-PROC-004 DESCRIPTION OF PROCEDURE REVISION Procedure Number MDAP-0019

" Supplemental Instructions for Harvard Portable Filtration Unit" An oil filtration rig will be installed on the turbine driven auxiliary feed water pump (2-FW-P-2) following periodic testing. This evaluation determines the filtration rig's impact on pump operability.

SAFETY EVALUATION

SUMMARY

Due to problems with moisture intrusion into the steam driven AFW pump's lube oil system, it is desired to install a portable filtration system to remove excess moisture. The system will consist of hoses / isolation valves installed at two points on top of the lube oil reservoir. The hoses will be tied down to grating and existing supports using tie wraps to ensure they remain secure during a seismic event. The filtration unit will be maintained outside of the of the pump house but potentially inside the screen door, This ensures that no SR equipment within the pump house is damaged. If placed within the screen door, the unit will be placed next to the screen with its back to the concrete wall. This ensures that if the unit falls over during a seismic event it will not damage the electrical conduit in the area. The distance from the screen door to the pad containing the conduit is approximately 7 feet. The unit is 2 feet wide by approximately 4 feet tall. Per Civil Engineering, during a seismic event, the unit could fall over and slide one foot. This would result in the unit going up to the pad but would not result in any damage since the conduit is approximately one foot from the edge of the pad.

This evolution would result in an increase in the combustible materials in the steam driven AFW pump house. This increase would be approximately one gallon of oilin the hose within the room and 30 feet of hydraulic hose. This is not a concern for Appendix R since the increase will only be for a short time and personnel will be present in the area to take action should a spill or fire occur. A portable fire extinguisher is located outside of the pump house. The filtration unit will contain approximately 10 gallons of oil. Portable oil dams will be set up to i contain any leakage / spills which may occur. Therefore there is no increase in the l potential for a release to the environment.

The jumper will not have any detrimental affect on the steam driven AFW pump nor does it impact the integrity of the tube oil system. The hoses can be isolated should a problem occur. The suction will consist of a section of copper pipe soldered to a stainless steel nipple. Should the joint fail, the copper pipe is inserted into the nipple enough to ensure it contacts the bottom of the reservoir prior to falling in. This ensures the pipe will not block the lube oil suction piping.

Prior to performance of the evolution, both motor driven AFW pumps will be verified operable. Should one of the motor driven pumps become inoperable, the i

l l

evolution will be terminated (i.e. filtration unit shut down and valves at reservoir closed as a minirnum). Personnel will be stationed at the pump and the filtration unit while it is installed and they shall stop the filtration process and manually isolate the hoses if the pump auto starts, a seismic event occurs, or an

~

unexpected level decrease in the oil reservoir occurs. These actions are provided in the MDAP-0019 for this evolution.

Installation of the jumper only affects the steam driven pumps lube oil system.

This will not result in any accident nor will it increase the consequences of any accident. The jumper only affects the one component, therefore there is no potential for it impacting the other two AFW pumps. For these reasons an unreviewed safety question does not exist.

i i

Safety Evaluation Number 94-SE-PROC-005 l

DESCRIPTION OF PROCEDURE REVISION

' 1 Procedure Number 0-PT-75.19 l "DP Testing of Service Water MOVs" The procedure provides instructions for performance of delta pressures tests for l various SW MOVs. This is in response to GL 89-10.

SAFETY EVALUATION

SUMMARY

Generic Letter 89-10 requires dynamic testing of MOVs to ensure they will operate properly when required. MOVs to be tested include those identified as safety related or being used in Emergency procedure, etc. The spray and bypass MOVs to be tested are required to operate as the start of a CDA. The bypass MOVs close while the spray MOVs open. The procedure assumes the SW MOVs will stroke successfully against dynamic conditions. The limiting condition is single failure of a spray or bypass MOV (or single failure of the MOV's emergency power supply) in conjunction with a LOCA during the performance of this test. The bypass MOVs are in series and are powered by separate emergency power supplies; therefore, failure of one bypass MOV to close would not divert flow from the spray arrays during a LOCA. The remaining bypass MOV in series would close providing isolation.

Single failure of one spray MOV on the accident unit to open would not adversely affect the heat transfer capability of the RSHXs. Each pair of arrays is capable of handling 100% of the flow and heat load generated by one unit during normal operation and DBA conditions. Each pair of arrays are powered by separate emergency power supplies. The SW MOVs to and from the spent fuel pit coolers are required on a loss of Component Cooling. The CC system is isolated from the SW system by a manualisolation valve. These MOVs will not be tested if excessive SW or CC leak-by is suspected.

There are three special requirements in the procedure: 1) The test must be performed with both Units in Mode 1. This eliminates concerns with low SW flow affecting the RHR system. 2) Monitor CC temperatures due to periods of low SW flow during the test. The SW system will be returned to normal lineup if CC temperatures become elevated. The test can be re entered when CC temperatures stabilize. 3) Monitor SW pump vibrations due to periods of high head during the test. The test will be terminated if pump vibrations are not within procedural limits. The maximum pump pressure will be approximately 90 psig.

The manufacturer, Johnston Pumps, was contacted regarding operating the SW pumps at this elevated head for approximately one hour. The manufacturer did not have any concerns with running a SW pump at 90 psig for approximately one hour. The manufacturer did recommend monitoring vibrations while operating at this elevated head.

?

Because the MOV DP testing will not be defeating any automatic actions for the  !

SW system, there is no increased consequences for any accidents or malfunctions. The SW system will be operating within its design capabilities i during the MOV DP testing; therefore, the probability of generating a new ,

accident or malfunction is not affected. Also the probability of a previously i analyzed accident or malfunction is not increased. This test is within the design j operation of the SW system and no unreviewed safety question exists.  ;

t.

t P

h l

F I

i l

1 l

']

l

I 1

i l

Safety Evaluation Number 94-SE-PROC-006 DESCRIPTION OF PROCEDURE REVISION Procedure Number MDAP-0019 Supplemental Work Instructions for addition of oil to 1-RC-P-1 A, which has a locked in and verified alarm for low oil level in the upper oil reservoir. Actual level l is 0.125 inch above alarm setpoint. According to the Annunciator response, the setpoint is 1 inch below normal.

The procedure is to remove as necessary any oil collection system enclosure,-  ;

add oil per VPAP-0812 equipment lube oil addition check list, use hand signals to i communicate, fill to 0.25 inch below standstill mark, record as left measurement, l reinstall removed oil collection system enclosure, and finally cleanup work area and remove all equipment that was taken into containment. Plans are to move a 55 gallon drum into containment leaving it at the 291 foot elevation and routing oil to the upper reservoir through tygon hose using an opening in the 291 foot elevation floor. The drum will be removed after the evolution.

SAFETY EVALUATION

SUMMARY

l The Westinghouse Reactor Coolant Pump Motor Technical Manual,59-W893-00045, does not require that the pump be shut down to add oil. Furthermore, the manual states that the alarm setpoint should be 1.25 inch below the normal level.

Thus, the current level of 0.125 inch above the NAPS setpoint of 1.00 inch below normal, or a net of 0.875 inch below normal is conservative and does not jeopardize pump operation thus in turn jeopardizing the margin to the Departure .;

from Nucleate Boiling, DNB. In addition, the bearings which are lubricated by the i oil have thermal devices which on high temperature cause an alarm in the control  !

room. In case of degradation of the lubrication and bearings this alarm would l come in alerting the operators to take action. Currently, the UFSAR states in i section 5.5.1.3.4 " Low oil levels in the motor bearings signal an alarm in the control room and require shutting down the pump." Without the pump being in operational jeopardy, it is not desired to shut down the pump which would necessitate tripping the unit first and thus placing it through an unnecessary transient.

A 55 gallon drum holding makeup oil will be moved into containment leaving it at the 291 foot elevation and routing oil to the upper reservoir through tygon hose using an opening in the 291 foot elevation floor. The drum will be removed after the evolution. This is the maximum amount of oil allowed to be transported into containment by Loss Prevention with the condition of removal after the work is complete.

1 As a compensatory action, the personnel that partially remove the oil collection system in order to add oil the upper resen/oir must remain at the RCP in order to I

i monitor for oil leaks while the oil collection system is partially removed. If they )

are to leave the RCP area while the work is still incomplete, as an example for  !

shift change, the oil collection system must be reinstalled. Per the Appendix R - i Coordinator, the Limiting Condition of Technical Requirement 7.6 for an operable oil collection system will thus be met as personnel will be present to monitor for -

an oil leak. Because the oil collection system is being removed temporarily and l will be reinstalled to fully operable status, putting an alternative oil collection ,

system in place is not viable. . Thus, no alternative ol! collection arrangement is  :

- needed.- However, a thirty-day Action should be entered to write a special report to the NRC in the event the oil collection system is not reinstalled within thirty days. .

The consequences of an oil leak or spill will not be increased and will be limited by the presence of personnel to actively monitor for a leak or spill and to take corrective action to clean up such. No possibility of a new accident is created as- ,

the only activity is to partially and temporarily remove the oil collection system i and add oil to the RCP. The activity is bounded by the analysis conducted for Appendix A as documented in Chapter 12 of the Appendix R Manual. Thus the possibility of the analyzed accident or event is not increased. No unreviewed - .

safety question exists. '

l l

I l

l n __ ._ _

r 1

l Safety Evaluation Number 94-SE-PROC-007 DESCRIPTION OF PROCEDURE REVISION

^

Procedure Number 1-PT-61.3.6

" CONTAINMENT TYPE C TEST OF LHSI, HHSI, CHARGING AND LOOP FILL PENETRATIONS" A temporary Gaitronics communications unit will be installed in the Aux. Bldg. '

penetration area during the outage to provide a means of communication within a potentially contaminated area.

SAFETY EVALUATION

SUMMARY

If the Aux. Bldg. nonetration area becomes contaminated, there is no means for personnel withir: ae contaminated area to communicate with the control room without exiting the contaminated area. This results in added time, dose and radiation waste to all jobs in the area. Installation of a temporary Gaitronics within the penetration area will improve communications without added any significant loads (<0.5 Amps) to the Vital Bus. The temporary unit will be fused such that failure of the unit shouldn't feed back into the bus. In addition, the temporary unit will be adequately restrained to ensure no damage occurs to adjacent equipment should a seismic event occur. The temporary unit will be removed prior to the unit starting up per the PT. For these reasons, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-PROC-008 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1/2-OP-8.1 This procedure revision installs and removes a Temporary Modification that defeats the UV trip of the "A" charging pump while the "C" pump is racked in and in pull-to-lock. Revision number is 26 for 1-OP-8.1 SAFETY EVALUATION

SUMMARY

This safety evaluation is being performed for the specific case in which the "B" charging pump is inoperable, and it is desired to switch the running pump from "A" to "C" or "C" to "A" while RCS temps are below the tech spec minimum temperature for allowing two operable charging pumps. The pump circuitry is designed with an 86 lockout of the "A" charging pump on a "H" bus UV/DV with the "C" normal breaker racked in. Thus pump manipulations to swap between the "A" and "C" pumps (i.e., placing "C" in PTL), would render "A" pump inoperable. This would result in all three pumps being inoperable until "C" normal breaker is racked out. Additionally, entry into TS 3.0.3 would be required. The activity proposed is to defeat the 86 lockout of the "A" pump while swapping between the "A" and "C" pumps to maintain the "A" pump operable.

The purpose of the specified 86 lockout protection is to provide protection against overloading the "H" bus upon restoration of voltage following a UV/DV condition.

Specifically, the capability of the EDG to energize the "H" bus with two HHSI and one LHSI pump breakers closed would be severely challenged. This overload protection will still be provided via the 15H7 86 lockout which will trip the "C" normal breaker since the "A" breaker will remain closed following a UV/DV signal on the "H" bus.

The Charging / HHSI systems as well as the "H" EDG wil! function as designed with the lockout temporarily defeated and will maintain their function in the event of a loss of offsite power. With the "A" pump lockout defeated, the required protection will be provided via a redundant lockout of the "C" normal pump breaker.

This activity only involves defeating an EDG overload protection logic associated with the "H" bus charging pump breakers for a short duration. While the EDG overload protection logic is defeated, the EDG will still function as designed because the redundant protective logic will remain available to trip open a HHSI pump breaker to prevent the EDG from being overloaded following a UV/DV condition. The "A" pump breaker position contacts associated with the "C" normal trip circuitry (for the redundant protective logic) will be verified prior to performance of the proposed activity. Adequate train separation will be maintained. In addition, the activity will ensure the operability of the "A" Charging

/ HHSI pump is maintained during the breaker realignment evolution. Therefore,  !

the consequences of a condition IV event concurrent with a loss of offsite power are not increased by the proposed activity. The activity in no way affects any initiators for design bases accidents. For these reasons, the probability of a condition IV event concurrent with loss of offsite power is not altered by the proposed activity.

Therefore, an unreviewed safety question does not exist. The required bus overload protection will still be provided. Since this activity will prevent a condition outside of the plant's design bases and the undesired entry into TS 3.0.3.

e

i Safety Evaluation Number 94-SE-PROC-009 i l

DESCRIPTION OF PROCEDURE REVISION l Procedure Number 1/2-MOP-8.01 and 8.02 I The procedure installs a Temporary Modification to prevent the automatic  ;

isolation of letdown when tagging the control power for either the "A" or "B" I charging pumps.

1 SAFETY EVALUATION

SUMMARY

When tagging out the control power for either the "A" or "B" charging pumps, l letdown will automatically isolate due to circuitry configurations which give a false l signal that no charging pumps are running. The jumper being added to 1/2- 1 MOP-8.01 and 8.02 will prevent the automatic isolation of letdown in this case.

This is an anticipatory control function designed to prevent loss of RCS inventory when no makeup is available. Makeup will continue to be available during this activity. Should the need to isolate letdown arise, manual closure of the letdown orifice valves has not been defeated nor has the automatic isolation of letdown on a low pressurizer level or on a Phase A/SI signal.

i Since no safety function is being defeated by this jumper, no unreviewed safety l question exists.

1 I

I

Safety Evaluation Number 94-SE-PROC-010 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1-OP-7.4, Rev 13 OTO1 "Recirc of RWST Using OS Pumps" The one-time-only procedure change adds instructions to install a Temporary Modification to start the 1-OS-P-1 A pump in recirc mode. The jumper is installed across the CDA relay contacts (actually across terminals on a terminal block, not the relay contacts) to simulate a CDA signal to start the OS pump.

SAFETY EVALUATION

SUMMARY

The major issue associated with this one-time-only procedure change is the installation of an electrical jumper to simulate a CDA signal to start the QS pump.

The procedure includes simultaneous verification of the jumper installation and removal to ensure that the jumper is not installed incorrectly or left in place after the test. This jumper will not feed back into protective or control circuitry. This procedure will be performed in Modes 5 or 6 or defueled.

There is no increase in the probability of occurrence for the accidents evaluated in the SAR because this change has no effect on the initiating events for these accidents. There is no increase in the consequences of these accidents because the PAR will not be performed in Modes 1 - 4, which are the operating modes the accidents are assumed to occur. The performance of the change does not create the possibility of a unique accident because the QS pump will be running on recirc, which has no effect on core or fuel protection. The OS system integrity will protect against the release of contamination. The margin of safety is not reduced because compliance with the TS will be maintained. Therefore, no unreviewed safety question exists.

i l

l 1

Safety Evaluation Number 94-SE-PROC-011 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1-OP-5.1, Revision 25

" Filling and Venting the Reactor Coolant System" Revision 25 of 1-OP-5.1 (Filling and Venting the Reactor Coolant System) allows for using the containment vacuum system to perform a vacuum fill of the RCS loops with the loop stop valves isolated. This involves using a jumper to tie the RCS loop high point vents to the suction of either containment vacuum pump.

The purpose of performing vacuum assisted filling of the RCS loops is to minimize the amount of gas left in the system that needs to be swept from the Steam Generator U-tubes. Ensuring that a minimum amount cf gas is entrained in the RCS prevents challenging the RCP seal delta pressure requirements on initial pump starts.

SAFETY EVALUATION

SUMMARY

The major consideration in this evaluation was that the RCS loops will be isolated from the reactor vessel via the loop stop valves during the time the vacuum is drawn and during the filling process. The loop side of the RCS will therefore be out of service. Once the loop is filled, the vacuum will be broken on the loop side and return to service of the RCS will proceed normally. Drawing a vacuum on the isolated RCS toop(s) to enhance the loop fill process does not affect the probability for dilution of the RCS.  ;

A positive pressure will be maintained on the vessel side of the RCS loop stop i valves. This will ensure that low temperature boiling will not occur in the reactor  ;

vessel.

The RHR system is not affected because of the loop stop valves being closed.  ;

The activity will have no affect on the vessel side of the RCS loop stop valves ,

which could result in increasing the potential for cavitation of the RHR pump. l Abnormal Procedure AP-11 provides methods to respond to loss of RHR. The activity does not affect th: ability to perform feed and spill cooling as described in the Abnormal Procedure.

Loop stop valve interlock circuitry and administrative procedures rmure the startup of an inactive loop does not occur. The delta-P across the loop stop valves will increase due to a vacuum, however the valves are adequate to prevent any gross increase in leakage from the reactor side of the RCS.

The activity will not increase the probability for any piping failure. The components can withstand the vacuum to which they will be exposed. The vacuum pump is designed for the conditions to which it will be exposed. Blocking off the vacuum breaker will not significantly increase the potential for pump k ,

i i

damage. Failure of the RCS piping or vacuum pump would impact the vacuum - l fill process, however, the vacuum fill process would not affect the consequences  !

of the failures discussed.  !

Based on the above discussion, no unreviewed safety question exists.

i

)

i 9

i i

b I

I e

-l l

1 l

i t

d 1

Safety Evaluation Number 94-SE-PP.OC-012 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1-PT-210.19 "Si Accumulator Discharge Check Valve Full Open Test" This test will verify that the SI Accumulator discharge check valves will exhibit full open stroke as indicated by non-intrusive check valve testing equipment during a controlled dump of an Si accumulator into an open RCS.

SAFETY EVALUATION

SUMMARY

This Safety Evaluation is being performed due to a YES response to the Activity Screening Checklist. Specifically, the YES resulted in response to the question of whether this test varies from any test discussed in the SAR. The UFSAR addresses dumping Si accumulators without reactor upper internals installed.

This procedure is performed with the upper internals installed to minimize the possibility of airborne radioactivity and insure the vessel material sample caps remain in place.

The equipment and systems involved will all be operated well within their design limits. This precludes the failure or cracking of any piping. The containment equipment hatch will be installed and ventilation established in accordance with Health Physics. The potential nitrogen introduced to the containment will not pose a health hazard as it rep [ resents less than 1% of the free volume of the containment.

Reactivity addition is precluded by performing the test defueled. Preclusion of a fuel handling accident inside containment is achieved by requiring as an initial condition that no fuel movement be in progress in the containment. The overall test condition that goes far to ensure a safe test is the requirement that the reactor be defueled prior to performing the test.

____.______n_ f

i 1

i l

j Safety Evaluation Number 94-SE-PROC-013 DESCRIPTION OF PROCEDURE REVISION

~

Procedure Number 1-OP-5.1  !

" Filling and Venting the Reactor Coolant System" The procedure allows installation of a Temporary Modification to bypass the cold leg loop stop valve interlocks.

SAFETY EVALUATION

SUMMARY

RCS Cold Leo Loop Stop Valve interlocks are designed to ensure that an l accidental s aiup of an unborated and/or cold, isolated reactor coolant loop results only in a relatively slow reactivity insertion rate. The interlock performs a protective function using two independent limit switches to verify that the hot leg loop stop valve is open, two independent limit switches to verify that the cold leg loop stop valve is full closed, and two independent flow switches to verify that bypass flow around the cold leg loop stop valve is greater than 125 gpm for 90 minutes. (The flow verifies that the pump is running, the bypass line is not blocked, and the valves in the bypass line are open).

Previous experience with the described protective circuitry has shown that spurious flow spikes (due to sweeping of air out of the loop or random noise) can result in restarting the 90 minute timer resulting in failure to receive the cold leg stop valve open permissive after the required 90 minute run time. This Safety Evaluation considers a Temporary Modification that would allow bypassing the protective circuitry to allow opening of the cold leg loop stop valve. This jumper is considered acceptable because all of the required conditions will be met via administrative controls. Operating Procedure 1-OP-5.1 has steps to verify that the hot leg loop stop valve is full open, verify that cold leg loop stop bypass flow  !

is greater than 125 gpm after starting the RCP and after the 90 minute required flow time is complete, and verifying that loop temperatures are within the required band.

Because the administrative controls meet the' required Technical Specification requirements and do not alter the bases of diminishing the potential for a water slug injection accident, this Temporary Modification should be allowed. In addition, the jumper will not be installed unless the installed protective circuitry fails to perform as designed.

No Unreviewed Safety Question exists because the probability of occurrence and the consequences of the startup of an inactive reactor coolant loop accident are not affected. In addition, there is no postulated accidents or malfunctions that could be generated by the proposed activity.

Additionally, the UFSAR analyzed condition for startup of an inactive loop with

the cold loop stop valve initially closed states: "Even with the assumption that administrative procedures are violated to the extent that an attempt is made to open the loop stop valves with 0 ppm in the inactive loop while the remaining portion of the system is at 1200 ppm, the dilution of the boron in the core is slow.

... For these conditions, the time for shutdown margin to be lost and the reactor to become critical is 16.4 min ". As can be seen, there is plenty of time for the operator to identify the high count rate and to terminate the dilution by turning off the pump in the inactive loop.

l l

l

)

4 i

Safety Evaluation Number 94-SE-PROC-014 DESCRIPTION OF PROCEDURE REVISION

• Procedure Number 1-ICP FW-F-1498 (2-ICP-FW-F-2498)

" Loop C Feedwater Control System (F-FW-1498) Calibration", Rev 0 - P1

• Procedure Number ICP-P-1-P-446B ( ICP-P-2-P-446B)

"P-446B, First Stage Pressure for Tave Control, SG Level Control and Feedwater Bypass Control", Rev 10 (9)

The above calibration procedures require that Relay Card C8-321 be removed.

This results in the defeat of the selectable turbine first stage pressure input to all control functions (i.e., C-5, Rod Control, Steam Generator Water Level Control).

Note that the steam dump controlinputs come off upstream of the subject Relay Card. The temporary defeat of the C-5 logic results in loss of the automatic turbine trip from generator output breaker open (1/3 phases) with greater than 15% turbine impulse pressure.

SAFETY EVALUATION

SUMMARY

1-ICP-FW-F-1498 (2-ICP-FW-F-2498), " Loop C Feedwater Control System (F-FW-1498) Calibration", Rev 0 - P1 and ICP-P-1-P-446B ( ICP-P-2-P-4468), "P-446B, First Stage Pressure for Tave Control, SG Level Control and Feedwater Bypass Control", Rev 10 (9), require removal of Relay Card C8-321. This results in the defeat of the selectable turbine first stage pressure input to all control functions (i.e., C-5, Rod Control, Steam Generator Water Level Control).

Note that the steam dump controlinputs come off upstream of the subject Relay Card and is therefore, not affected. In addition, the temporary defeat of the C-5 logic results in loss of the automatic turbine trip from generator output breaker open (1/3 phases) with greater than 15% turbine impulse pressure.

Prior to removing the subject Relay Card at power, the rod control system and the feedwater regulating valve controllers are placed in manual. This is because the loss of the first stage pressure signal to these systems will result in undesired transients - rods would step in at maximum speed as a result of the power mismatch circuitry and the decrease in Tref, and would be prevented from stepping out in auto by the C-5 signal that would be generated. The program Steam Generator water level would decrease from the normal 44% to the low power set point of 33%. Therefore, the procedure relies on the control room operators to maintain a stable plant.

Additionally, the solenoid turbine trip that is generated from one of three phases i of the generator output breaker open with greater than 15% power indicated by ,

turbine impulse pressure will be defeated. The purpose of this turbine trip is to I prevent turbine overspeed due to the loss of turbine load. This particular trip is )

not discussed in the UFSAR nor is any credit taken for it in the accident analysis. l The turbine overspeed protection system is taken credit for and will be l l

i I

l

operational. This overspeed protection consists of: 1) OPC actuation at 103%

turbine speed resulting in closure of the governor and intercept valves until the signal clears,2) mechanical overspeed protection that actuates at approximately 111% turbine speed to cause a turbine trip, and 3) electronic overspeed ,

protection that actuates at approximately 112% turbine speed to cause a turbine trip.

The Instrument Calioration Procedures do not increase the probability of an accident or malfunction since manual operator actions are described which will maintain the plant in a stable condition, in addition, the consequences of any accident or malfunction are not altered since the turbine still maintains overspeed protection and no safety elated equipment will be prevented from performing the required functions (i.e., Feedwater Isolation, Reactor Trip, etc.). No new accident scenarios are introduced since no equipment is required to function outside of original design.

The procedures should be allowed since calibration of the affected circuitry may need to be performed at power. The procedure provides the guidance that the operator at the controls will need to ensure stable plant operation. -

i i

?

,- g

^

i l

i Safety Evaluation Number 94-SE-PROC-015 '

Safety Evaluation Number 94-SE-PROC-015, Rev 1 DESCRIPTION OF PROCEDURE REVISION Procedure Number 0-GIP-2.0

" Defeating an incore Detector Withdrawn Limit Switch" This new GIP will defeat and subsequently restore the Unit 1 "B"Incore Detector Withdrawn limit switch. Revision 1 of this safety evaluation required that the incore drive be tagged in some way to the Reactor Engineer to safeguard that the cable will not be damaged or sheared while the limit switch is defeated.

SAFETY EVALUATION

SUMMARY

MAJOR ISSUES: .

The Unit 1 "B" incore detector drive is not operable. Repairs would be difficult and require an at-power containment entry. The detector is currently in storage and the ability to move it to the WITHDRAWN position is questionable. It will be necessary to defeat the "B" Detector Withdrawn limit switch in order to complete the TS-required flux maps until the drive can be repaired during the next outage.

JUSTIFICATION:

Sufficient safeguards exist to ensure that the "B" drive will not be sheared during movement of the 5-path device. Use of this temporary modification does not impact any safety-related equipment but does support TS compliance and ALARA concerns.

UNREVIEWED SAFETY OUESTION ASSESSMENT:

Accident probability is not increased because no accident precursors are affected.

Accident consequences are not increased because no accident mitigation equipment is affected. In fact, the TM supports the ability of plant staff to perform assessments of normal and off-normal conditions.

No new accident probability is created because no part of the reactor coolant system or any accident mitigation system is affected.

Margin of Safety is preserved because the temporary modification supports Technical Specification compliance.

V-Safety Evaluation Number 94-SE-P. ROC-016 l DESCRIPTION OF PROCEDURE REVISION

^

. Procedure Number 1-OP-26.1 Rev 15 P1 Steps are being added to defeat directional overcurrent relay protection when transferring between normal and alternate feed. This is being done in order to prevent an unnecessary trip of either 15H1 (15J1) or 15H11 (15J11) breakers-when transferring between' normal and altemate power supplies. '

SAFETY EVALUATION

SUMMARY

While attempting to transfer the 1H bus from its normal feed to the attemate feed, the normal feed breaker tripped on high circulating current when the alternate i feed breaker was closed. This evolution has been performed often without experiencing any breaker trips due to circulating currents. It is' now necessary to return the 1H bus to its normal feed, but the cause of the high circulating current has not yet been determined. NES-Electrical is studying this problem and will provide recommendations for long term solutions. In order to restore the bus, Control Operations will unplug the Directional Overcurrent relays during the bus transfer only to prevent another breaker trip. The Directional Overcurrent relays i provide protection for the EDGs when they are paralleled to the Unit to prevent them from feeding a fault on an upstream bus. No protection required for responding to any design basis accident will be defeated. The relays will be defeated for the bus transfer only and will be restored immediately.

]

Defeating the Directional Overcurrent relays during bus transfer will prevent any I unnecessary challenges to the plant electrical distribution system and will 1 preserve the operation of the 1H Bus -during the transfer. Therefore, implementation of this PAR will not increase the probability of occurrence of any accident or malfunction of equipment previously analyzed.

The Directional Overcurrent relays are designed to protect the EDGs during parallel operation. They will prevent an EDG from feeding a fault on an upstream i bus. The relays provide no protection for the EDG during the time it responds to any loss of offsite power accident. These relays are provided for transfer and ,

testing of the EDGs only. For this reason, implementation of this PAR will not increase the consequences of any accident or malfunction of equipment previously analyzed.

The Directional Overcurrent relays protect the EDG during parallel operation.from upstream bus faults. The relays will be disconnected only during bus transfers.

No EDG will be operating parallel to the unit during bus transfers, so no loss of EDG protection will result. Therefore, implementation of this PAR will not create any accidents or malfunctions of equipment not previously identified.

l

I i

The Directional Overcurrent relays are not discussed in Tech Specs or the bases  !

to the Tech Specs. These relays are not required for response to loss of offsite  !

power accidents. Therefore, implementation of this PAR will not decrease the margin of safety represented in the bases to any Tech Specs. j For these reasons, an Unreviewed Safety Question does not exist.  :

r P

t U

9 t

-1 1

I h

[

t i

r

Safety Evaluation Number 94-SE-PROC-17 DESCRIPTION OF PROCEDURE REVISION Procedure Number MDAP-0019

" Supplemental Work Instructions for 02-HV-E-4C Work Order 00298037-01" MDAP-0019, Supplemental Work Instructions for WO 00298037-01 has been written to provide installation of telltale fuses into the Unit 2 control room chiller 4C control circuitry. The fuses are installed around normally closed contacts to the chiller trip actuation coil.

SAFETY EVALUATION

SUMMARY

Currently, there is no indication of what caused a chiller trip to actuate. After installation of the telltale fuses, if a contact opens, the associated fuse will open (if sized to cut at less amperage than is required to hold the trip relay in). The purpose of the installation of these telltale fuses is to identify what signal actually caused the chiller to trip.

The proposed activity should be allowed because it will allow efficient use of maintenance resources to fix the cause of repeated control room chiller trips.

The installation of the telltale fuses does not constitute an unreviewed safety question because the ability of the chiller to perform its design function is not altered. The chiller wil! be rernoved from service for the purpose of installing and removing the telltale fuses. This may result in entry into the Tech Spec action statement depending on the status of the other two chillers for Unit 2. (The 'C' chiller is a " swing" chiller). In no case will the Tech Spec requirements related to the control room chillers be violated.

Safety related fuses that are sized to be less than required trip coil amperage will be used. This will ensure that the applicable fuse will blow on a trip signal resulting in de-energizing the trip coil and protecting the chiller.

Safety Evaluation Number 94-SE-PROC-018 ,

Safety Evaluation Number 94-SE-PROC-018, Rev 1 t

DESCRIPTION OF PROCEDURE REVISION Procedure Number MDAP-19

" Supplemental Work Instructions for Work Order 00303222-01" The supplementalinstructions were written to troubleshoot possible leakage of 2-SW-MOV-208B. The MOV will be stroked closed and relevant data (pump flow, discharge pressure, CCHX delta pressure) taken to determine if the MOV is leaking by and to quantify the leakage. If sufficient leakage is present, then the mechanical and electrical limits will be adjusted to minimize the leakage. The ,

Aux. Service Water headers will be used as a bypass for the 'B' SW supply '

header if the MOV limits need to be adjusted.

SAFETY EVALUATION

SUMMARY

Operation of the SW system with both supply headers cross-tied and 2-SW-MOV-2088 isolated is not addressed in the UFSAR. This mode of operation must be entered to detect, quantify, and minimize any leakage by 2-SW-MOV-  ;

208B. This cross-tie is established through the Aux. SW supply headers. This safety evaluation considered TS compliance and 10CFR50 GDC compliance while in this mode of operation.

During a DBA when the SW system is needed for containment depressurization, both return headers are directly cross-tied through 24" lines in the RSHX headers for the accident unit. The SW system is designed to tolerate a single failure during the period of recovery following an incident, without loss of its protective function. The SW system is also designed to tolerate a passive failure in the long i term (>24 hrs following initiation of ESF) recovery period. Operator action is required to negate the effects of a passive failt!;e. In the case of the RSHX l cross-ties, there are two isolation valves ir sories and powered from different i emergency busses which can be closed from the MCR to isolate a passive failure l of one of the SW supply or return headers. The addition of the supply header l cross-tie through the Aux. SW supply lines will similarly not adversely affect the ability of the SW system to provide required flows to the RSHXs during a DBA.

Any one of five isolation valves on the Aux. SW supply headers can be closed from the MCR to isolate a passive failure of a SW supply or retum header. If a passive failure were to occur, the CRO on the non-accident unity and the CRO on the accident unit each has the capability to close the cross-ties opened between the SW supply headers. There are two emergency busses shared by the five isolation valves. These five MOVs are stroked open and closed per 0-PT-213.19 on a three month frequency; therefore, the ability to isolate the two ,

headers is single failure proof. As a result, the capabilities of responding to a i single passive failure is preserved.~ Note that 10CFR50 Appendix A requires a  !

l

f I

single active failure to be assumed while a single passive failure must only be l considered. l Only one Unit 1 CCHX will be aligned to the 'A' header. This ensures that only two CCHXs maximum operate on the 'A' header. Approximately 35000 gpm total is required for 2 CCHXs and 4 RSHXs. Maintaining <= 2 CCHXs on the 'A' SW header guarantees design flow even if a single failure ol a pump occurred. All four SW pumps will remain operable during this evolution to ensure design flows to the RSHXs are achieved. The cross-tie on the supply header will have little or no effect on the flow to the RSHXs since the headers are cross-tied at the RSHXs. All four SW pumps being operable will ensure this effect is more than adequately mitigated.

In the event of a Unit 1 CDA, SW f!ow will be lost on Unit 2. The UFSAR does address this as follows 'The component cooling water system has sufficient volume such that a loss of one SW supply header will result in a 3 degrees F per minute rise in component cooling water temperature for that plant. Since the valves are readily accessible, this will allow more than enough time to change the component cooling heat exchanger supply and return to the other SW header."

b I

l

Safety Evaluation Number 94-SE-PROC-019 DESCRIPTION OF PROCEDURE REVISION Procedure Number 1-TOP-8.3

" MAKEUP TO VCT DURING MAINTENANCE ON 1-CH-FCV-1114A" The temporary procedure provides for performing a makeup to the RCS with the blender removed from service for maintenance. It is suspected that PG is leaking by 1-CH-FCV-1114A (PG to blender control valve), and 1-CH-240 (check valve downstream of the boric acid to the CVCS blender control valve 1-CH-FCV-1113A) resulting in dilution of the in-service Boric Acid storage Tank. In order to perform maintenance on 1-CH-FCV-1114A, it is required that the blender be tagged out. The proposed temporary operating procedure,1-TOP-8.3, provides for performing RCS makeup with the blender out of service.

SAFETY EVALUATION

SUMMARY

The basic steps of the TOP are to have an operator open the manual PG addition valves,1-CH-220 and 221, while flowing boric acid through the emergency borate valve,1-CH-MOV-1350. These manipulations will be performed by licensed reactor operators. The licensed operator in the Auxiliary building will be in constant commun'. cation with the operator at the controls.

RCS leakage is currently small and VCT make ups are required on an infrequent basis. The most likely situation during the planned maintenance is that a PG only addition is required in order to increase RCS temperature due to fuel burnup.

The TOP also allows for performing this RCS dilution.

An unreviewed safety question does not exist for the following reasons:

. The probability of an accident occurring does not increase because the procedure is rigorously controlled and provides for adequate monitoring of the makeup.

• The consequences of accidents or malfunctions do not increase because <

UFSAR 15.2.4 (Uncontrolled Boron Dilution) remains the bounding accident.

There are no new accidents or malfunctions generated because the existing equipment is used within its design limitations.

. The margin of safety is maintained because Tech Spec required boration flow paths remain operable.

Safety Evaluation Number 94-SE OT-001 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change # 307 The Technical Specifications 4.6.2.1.d and 4.6.2.2.1.d surveillance requirement for Quench Spray (OS) and Recirculation Spray (RS) spray nozzle testing is being revised to reduce the frequency of testing from five to ten years.

SAFETY EVALUATION

SUMMARY

This change in surveillance frequency is in accordance with the NRC's Generic Letter 93-05, "Line-item Technical specification improvements to Reduce Testing During Power Operation" Line-item improvement No. 8.1, Containment Spray System. The generic letter recommends a change in the surveillance frequency of the Containment Spray System spray nozzles from five to ten years. The NRC's evaluation has shown that in stainless steel systems the corrosion is negligible during the decreased inspection interval. In addition, with the OS and RS Systems maintained dry during normal operation there is no other credible source of blockage. Therefore, a reduction in test frequency from five to ten years is acceptable to ensure the spray nozzles are not clogged.

No physical modifications are being made to the OS and RS Systems. The operation of and the operability requirements of the OS and RS Systems will not be altered by this change in spray nozzle test frequency. Surveillance testing of the spray nozzles has no impact on the probability of any accident, since the system is maintained in standby during normal operation. The corrosion rate of the stainless steel piping is negligible during the increased surveillance interval.

There are no other realistic mechanisms in the dry piping that could cause clogging of the spray nozzles. Therefore, the consequence of any accident previously analyzed or malfunction of equipment is not being increased by the change in surveillance frequency of the spray nozzles.

There are no new methods of operation or accident precursors generated by this change in spray nozzle test frequency, since the system is maintained in standby during normal operation. The OS and RS System spray headers are maintained dry and the piping is stainless steel.

The margin of safety is not being adversely affected since the OS and RS system will be maintained operable in accordance with the Technical Specifications requirements. The reduced surveillance testing is adequate to ensure the spray nozzles are operable. Therefore, the OS and RS Systems will be operable to reduce the pressure and remove heat and from the containment in the event of a DBA.

Safety Evaluation Number 94-SE-OT-002 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change # 302 The changes requested are:

1) Eliminate the need to test run EDGs when in an action for inoperable off-site power source.

2) Allow elimination of the need to test run the operable EDG when in action for an inoperable EDG if an absence of a common mode failure can be proved.

3) If it is necessary to test run an EDG to prove operability while in an action statement, only require one run within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> vice 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

4) Separate the hot restart test of an EDG from the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> load run.

5) Only do fast start loading on the 18 month Loss of Offsite Power Test.

SAFETY EVALUATION

SUMMARY

The changes in the testing and surveillance requirements for the EDGs follow the guidelines established in REG. GUIDE 1.9 Revision 3 " Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants" of July 1993, NUREG-1366 " Improvements to Technical Specifications Surveillance Requirements" of December 1992, and NRC Generic Letter 93-05 "Line-Item Technical Specifications improvements to Reduce Surveillance Requirements for Testing During Power Operation", September 27,1993.

It has been determined that these changes do not result in an unreviewed safety question based on the following items:

1) The EDGs will continue to be tested on a regular basis as required in REG.

GUIDE 1.9 so there is no decrease in the probability that they will start when required. Unnecessary starting has historically led to excessive wear and tear on the EDGs which has resulted in reduced reliability of the diesel engines.

Approval of this Technical Specification change will ultimately result in the improved reliability of the EDGs therefore there is no increase in the probability of occurrence nor increase in the consequences of any accident evaluated in the Safety Analysis Report.

2) There are no modifications or change in operations of any plant equipment that would result in the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report.

3) There will be no increase in the probability of occurrence of malfunctions evaluated in the Safety Analysis Report or will this TS change create the possibility of a malfunction of equipment of a different type because the EDGs Q

s will continue to be adequately tested to ensure that they will start and carry -

their design loads when required to do so.

The margin to safety is not affected by this Technical Specification ' change <

because the Bases section of Technical Specifications does not specifically list the testing and surveillance requirements of the EDGs.

L f

l

Safety Evaluation Number 94-SE-OT-003 DESCRIPTION OF CHANGE DOCUMENT Procedure MDAP-0019 (01-CC-E-1 A)

MDAP-0019 was written by Maintenance Engineering to provide guidance on plugging the Unit #1 "A" Component Heat Exchanger. The plug to be used will be a 304 SS welded thimble plug.

SAFETY EVALUATION

SUMMARY

Maintenance has determined the "A" Component Cooling Heat Exchange on Unit

1. 1 has 22 leaking tubes. A MDAP-0019 was written by Maintenance Engineering to provide the Welders with guidance on tube plug installation. The plugs will be welded thimble type made of 304 Stainless Steel. Engineering has provided three different types of welded plug types depending on whether or not a tube is fully removed, partially removed, or cut and not removed. A Tube which has been cut and not removed will have a stabilizer installed to ensure tube does not vibrate.

Mechanical Engineering has reviewed the effects of plugging of 22 tubes on the heat transfer capability of Unit #1's "A" CC HX. They concluded that the small amount of tubes plugged represents less than one percent of the heat transfer area of the heat exchanger and the minor reduction in heat transfer area was determined to have no impact on the capability of this HX to meet allits design basis heat transfer requirements. As a result, no unreviewed safety question is created or exists.

Safety Evaluation Number 94-SE-OT-004 DESCRIPTION OF CHANGE DOCUMENT Work Order Task #00280851010-MCM-1904-1 Re-injection of leak sealant to the hinge pin cover of 2-FW-62, 'A' Main Feedwater containment isolation check valve SAFETY EVALUATION

SUMMARY

The proposed maintenance activity is a re-injection of the valve hinge pin cover plate for Main Feedwater check valve 2-FW-62. The possibility of the leak '

sealant preventing the valve from performing its intended functions is remote.

The valve disk is free to swing on the valve hinge pin. The valve hinge pin is free to spin in the hinge pin housing. Even if the leak sealant were to cause the pin to seize, the valve disk would still be free to swing. In addition, it is unlikely that the leak sealant would prevent the check valve from closing under the delta pressure that would be experienced during a design basis accident.

The activity should be allowed because it is prudent to stop leaks since they tend to develop into bigger leaks if they are not stopped. Since valve function should not be affected, an unreviewed safety question does not exist.

l i

1 i

Safety Evaluation Number 94-SE-OT-005 DESCRIPTION OF CHANGE DOCUMENT Supplemental Work Instructions (MDAP-0019)

These instructions are to install a temporary line stop (Stopple) so that the "C" High Pressure Drain Pump relief valve can be replaced. This is considered a Temporary Modification contained in a procedure which requires a Safety Evaluation.

SAFETY EVALUATION

SUMMARY

The relief valves for the Unit 1 and Unit 2 "C" HP Heater Drain pumps are leaking and require replacement. Currently, the RVs are isolated and the pump recirc line is throttled to provide over pressure protection. The RV discharge line goes to the MSR drain receiver tank and will need to be isolated for RV replacement because the MSR drain receiver tank can not be isolated with the unit at power.

This is considered a Temporary Modification contained in a procedure which requires a Safety Evaluation.

A Stopple saddle and vent valve already exist on Unit 2 from a previous relief valve replacement effort. On Unit 1, the Stopple saddle and vent valve must be installed. This work will be performed while the relief valve discharge piping is under pressure (normal MSR Drain Receiver pressure and temperature). The work will be performed by a vendor following proven practices. Once the Stopple saddle is in place and the piping drilled and prepared, the Stopple can be installed. The Stopple is simply a plug to provide isolation of the relief valve discharge line.

The relief valves should be replaced so that we can return the RVs to service.

They are currently valved out (see jumper log for details) because of pilot valve leaks. The most likely failure scenario for this activity is failure of the Stopple or failure of the Stopple device resulting in a minor secondary piping failure. This would pose personnel safety concerns but would not jeopardize nuclear plant safety. Minor secondary pipe breaks are identified as a Condition 2 accidents per the UFSAR.

L Safety Evaluation Number 94-SE-OT-006

)

DESCRIPTION OF CHANGE DOCUMENT NA-C-DSE-809, " Repair of Reserve "C" SkV Overhead Buswork" A brace will be installed on a pair of conductors on the "C" RSST Overhead Bus.

One of the existing welded plates has broken. This repair will restore the structural integrity of the overhead bus.

SAFETY EVALUATION

SUMMARY

l l

A conductor-to-conductor support repair of one of the phases of the "C" RSST l overhead bus will be performed by this procedure. One of the existing plates I welded in place between the conductors has broken. This plate is used for structural integrity of the overhead bus. This procedure uses aluminum plates, bolted in place, to restore the structural integrity.  !

Adequate preventive and safety measures are included in the procedure to produce a safe repair. No challenges to the "C" RSST are expected. However, a loss of the "C" RSST would result in an auto start and load of the 1H and 2J EDGs. The 1H and 2J emergency busses would then be energized. For these reasons, implementation of this procedure would not increase the probability of occurrence of accidents or malfunctions of equipment previously analyzed in the SAR.

l The overhead bus is not used to mitigate any accidents. Failure of the "C" RSST as a result of the repair installation would cause the 1H and 2J busses to be l energized by their respective EDGs. These busses would still be available for l accident mitigation. For these reasons, implementation of this procedure would '

not increase the consequences of the accidents or malfunctions of equipment  !

previously identified in the SAR.

This repair restores the original integrity of the overhead bus. The existing Tech specs are adequate to safely operate the plant during and after implementation of this procedure. Therefore, the margin of safety as reflected in the bases of the Tech Specs is not reduced.

For these reasons, an Unreviewed Safety Question is not created.

Safety Evaluation Number 94-SE-OT-007 DESCRIPTION OF CHANGE DOCUMENT

^

New procedure, 0-GOP-4.2, " Extreme Cold Weather Operations", This document proceduralizes actions to be taken to mitigate the consequences of severe cold weather on various plant components.

SAFETY EVALUATION

SUMMARY

The Temporary Modifications used in 0-GOP-4.2 were previously reviewed for '

safety concerns under SNSOC-approved safety evaluations # 94-SE-JMP-003, 004, and 005. The major actions addressed by these safety evaluations was temporary supply power (none of the space heaters are power by class 1E systems) and overall effect on safety related equipment (e.g. Herculite in the EDG rooms). These evaluations, which are still valid (as evidenced by  ;

Engineering's signature on page 12 of the Safety Evaluation), showed that these Temporary Modifications would not impact the overall safety of the plant and therefore would pose no unreviewed safety questions.

The remaining actions taken by 0-GOP-4.2 pose no impact to the safety of the plant. These include the placement of tents and heaters at the intake structure, requiring daily walk downs by various plant personnel for freezing conditions, isolation of susceptible domestic water systems, and the isolation of various FP systems outside the protected area (and the posting of the required fire watches to compensate). Since all of these actions pose no risk to plant safety, this procedure will not create any unreviewed safety questions and therefore can be allowed.

This procedure will also allow the energization of both trains of RWST heat tracing. Engineering Work Request 86-614E concluded it was acceptable to have both trains of RWST heat trace energized once sensing line or enclosure temperature dropped below 40*F. This procedure may direct energization of both heat trace circuits prior to that condition. This is acceptable based on the "self regulating" design of the heat trace. Therefore, no unreviewed safety question exists or is created.

j

Safety Evaluation Number 94-SE-OT-008 DESCRIPTION OF CHANGE DOCUMENT

^

Work Order 282211, Temporary repairs to 2-IA-FL-2A-1 Instrument air filter 2-IA FL-2A-1 has developed a leak on an O ring seal that can not be easily repaired while the unit is at power and containment is maintained in subatmospheric conditions. A soft patch consisting of rubber gasket material and a stainless steal hose clamp will be installed in accordance with approved maintenance repair procedures to stop the leak. Permanent repairs will be made when possible.

SAFETY EVALUATION

SUMMARY

The materials are appropriate for use in containment and they are of a size that will not increase the chances of creating a sump blockage during a design basis accident. The filter is approximately 6 inches in diameter and the soft patch will be placed around the circumference, covering a flange connection that is normally sealed with an O ring. A stainless steal hose clamp will then be installed to hold the gasket material in place.

No function of the filter or the instrument air system is being affected by this )

repair. The repair material is approved for use in containment, and does not add a significant amount of mass to the filter so seismic qualifications are not affected. For the above reasons, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-OT-010 DESCRIPTION OF CHANGE DOCUMENT UFSAR Change Request FN 94-003 This change is to eliminate intermediate break locations from the Augmented Inspection program for high energy line break point locations in the Service Building.

SAFETY EVALUATION

SUMMARY

This change is based on Virginia Power Technical Report CE-0065. Generic Letter 87-1 relaxed the requirement to postulate arbitrary intermediate pipe rupture locations for high energy lines. Virginia Power Technical Report CE-0065 Rev. O reviewed the pipe stress analysis for the main steam and feedwater lines in the Service Building. The results of the review showed no intermediate break locations need to be postulated in the piping based on stress level. Hence, no augmented inspection of any intermediate weld locations need to be performed.

The purpose of the Augmented Inspection program is to locate flaws in high stressed areas and take corrective action prior to the defect growing to the point of a through-wall crack. Should the inspection program fail to locate the defect during shutdown and a crack develops during operation, a leak detection system is designed to alert the operators and pinpoint the location. If the crack propagates quickly to the point of a pipe rupture, loss of normal feedwater or a main steam line break could occur. These accidents have been previously evaluated in the SAR.

1 I

l l

i Safety Evaluation Number 94-SE-OT-010 Safety Evaluation Number 94-SE-OT-010, Rev 1 Safety Evaluation Number 94-SE-OT-010, Rev 2 '

DESCRIPTION OF CHANGE DOCUMENT 0-TMOP-21.33 PAR P2 " Central Air Conditioner Chilled Water System Flush" The temporary procedure was written to allow for flushing of the chilled water portion of the central air conditioner. The PAR P2 changed the feed and bleed requirements from 2-6 gpm to less than 6 gpm. In addition the requirement for removal of the chiller from service was deleted. Therefore a chiller will remain in service during the flush.

SAFETY EVALUATION

SUMMARY

0-TMOP-21.33 was developed to allow for flushing of the central air conditioning chilled water system. In addition a feed and bleed path would be established to allow for removal of the corrosion inhibitor and bacteria. Recirculation through the system would be accomplished by running the pumps one at a time. The system will be drained to the sewer ejector station in the unit #1 turbine building basement. This will be accomplished via a jumper (i.e. red rubber hose) from a drain at the inlet to the front office AC unit (01 HV-AC-5) to a newly fabricated plate on top of the sewer station. The hose is rated for 250 psig which is greater than the relief valve setpoints (150 psig) which are in the chilled water system. -

The flow through the red rubber hose will be limited to less than 6 gpm. This is negligible when compared to the capacity (130 gpm each) of the sewer station pumps (01-PB-EJ-2A/B). Therefore there will be no potential for overfilling the tank. The tank will be discharged to the sewage treatment plant prior to being discharged to the lake. The treatment plant has a capacity to process 30,000 gallons of fluid per day. Presently it processes approximately 10,000 gallons per day. Assuming 6 gpm of drainage into the tank the added fluid to process would be 8640 gallons which is within the capacity of the treatment plant. The existing chilled water has nitrates added as a corrosion inhibitor. The treatment plant will break this down to nitrogen and oxygen prior to discharging the fluid, therefore there is no environmental impact.

During the flushing / bleed and feed process makeup water will be supplied via 01-HV-PCV-1304 which is the normal makeup supply for the chilled water system head tank. The PCV is a 3/4" Fisher model 95 regulator. Literature on the regulator indicates that it will be able to supply the required amount of water to maintain level in the tank during the bleed process. Since the system will be on recirc for a long time (24-48 hours) there is a potential for the water to heat up from the pumps input. However this will be no higher than that during normal operation, therefore the net affect of heat input is negligible. The pumps have a required net positive suction head (NPSH) of 7 feet. Available NPSH is approximately 55 feet. While the increase in temperature will affect the available

NPSH, it will not reduce it to below the required NPSH. Therefore there is no potential to damage the pumps.

The central air conditioning system supplies cooling water to AC units for various -

areas (front office, lab area, assembly) in the plant. A chiller will remain in service

~

during the flush, therefore impact on the conditioned temperatures will be minimal. None of these areas house SR equipment which require this system for cooling (HV AC-4 supplies fresh air to the MCR however cooling is performed via the control room chillers and cooling of fresh air is not required in winter) nor is any of the equipment involved in this evolution SR or powered off of a.1E bus.

The evolution will reduce the bacteria in the cooling system. Failure of this activity or the jumper will not lead to detrimental consequences to any SR equipment. If the hose were to fail it could easily be isolated. Even if it was not, the flow passing through it would not be enough to result in flooding. Since the jumper evolution does not involve any SR equipment and cannot detrimentally affect any SR equipment, an unreviewed safety question does not exist.

Safety Evaluation Number 94-SE-OT-011 Safety Evaluation Number 94-SE-OT-011, Rev 1 DESCRIPTION OF CHANGE DOCUMENT 2-TOP-8.10, testing of 2-CH-155 (boric acid to blender check valve).

The blender will be isolated from the charging system and pressurized by the PG ,

system. Blender pressure will then be watched to see if leakage is occurring out of the blender and into the boric acid storage system (BAST). Section 5.4 of the TOP isolates the boric acid addition system in attempts to quantify the amount of leakage through 2-CH-155. This procedure is being written to determine if 2-CH-155 is leaking by and causing a dilution of the BAST and attempts to quantify any leakage.

Revision 1 was written to take into account fact that the emergency boration valve,2-CH MOV-2350, would not be available during the activity.

SAFETY EVALUATION

SUMMARY

The blender will not be available for use for an extended period of time during this procedure (at least one and one-half hours). There exists the ability to make up to the RCS from the RWST if necessary. Furthermore, the procedure can be exited fairly rapidly, but the resulting makeup would be mostly PG water for a short period of time. The VCT will be filled to approx. 60% prior to starting the procedure. Current VCT makeup frequency is approx. 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. There will be sufficient volume in the VCT to perform the procedure.

The installation of a pressure gauge in the procedure neither alters the design of the system or bypasses any component in the system. The pressure gauge is being attached to a drain line which is normally isolated. VPAP-1403 (Temporary Modifications) allows for hoses connected to vent or drain line to be excluded from the TM program.

The procedure gives adequate guidance to flush the boric acid lines prior to returning the blender to service in the event that any PG is leaked into the boric acid system. The procedure gives adequate guidance for returning the blender to operation in the event an RCS makeup is required. The RWST will remain available for emergency makeup if necessary. Control rods will be available to control reactivity. ,

Note that emergency boration will be unavailable during the performance of procedure section 5.4. Emergency boration is required in several instances throughout the Emergency Operating Procedures. This evolution is acceptable as other sources of boration, such as the RWST and the BIT are available to maintain required shutdown margin or to control reactivity. Furthermore, this

procedure can be exited in rapid fashion and the normal flowpath for emergency boration rapidly restored if necessary.

GDC 26 requires two redundant and independent reactivity control systems.

According to the UFSAR, the boration control system must be capable of maintaining the reactor in a cold shutdown condition with ALL control rods withdrawn. Since emergency boration capability can be restored rapidly by exiting the procedure, the intent of GDC 26 is fully satisfied. Engineering concurs with this evaluation as evidenced by their approval on page 12 of the Safety Evaluation.

Any dilution as a result of this procedure would be small and bounded by the analysis in UFSAR chapter 15.2.4 (which assumes a dilution rate of 165 gpm for at least 15 minutes). Therefore, this procedure does not create any unreviewed safety questions.

Safety Evaluation Number 94-SE-OT-012  !

DESCRIPTION OF CHANGE DOCUMENT Work Order 280436 I This work order is for painting of the Service Water spray array piping. The coating on the spray array piping has deteriorated from exposure to the environment.

SAFETY EVALUATION

SUMMARY

An unreviewed safety question does not exist because: )

1) The re-coating of the spray array piping will be done in cool weather when individual sections of the spray array piping can be taken out of service while maintaining the system's ability to remove heat.

2) Operation of the Service Water system will not change. The re-coating job can be performed within the limitations of the Technical Specifications.

3) Precautions will be taken to prevent personnel, tools, and/or paint from dropping into the Service Water reservoir. In the event that some foreign matter should fall into the reservoir, the trash bars and the traveling water screens at the pump house will prevent it from entering the SW system. ,

i I

l 1

I

i Safety Evaluation Number 94-SE-OT-013 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change Request #306 The present surveillance requirements of Technical Specifications call for control rod movement testing to be completed on a monthly basis. A study conducted by the NRC and documented in NUREG-1366 " Improvements to Technical Specifications Surveillance Requirements", December,1992, recommended that this testing be changed to a quarterly frequency. NRC Generic Letter 93-05, issued on September 27,1993, stated that the NRC will now accept a line item  ;

change to Technical Specifications that changes the frequency of control rod  ;

movement testing to once per 92 days. Reducing the testing frequency will reduce the transients on the reactor plant and reduce the probability of rod  !

control system failures that could result in one or more dropped rods.

SAFETY EVALUATION

SUMMARY

NUREG-1366, " Improvements to Technical Specifications Surveillance Requirements," dated December 1992, evaluated the testing of control rod assemblies. NUREG-1366 found that electrical problems with the control rod drive system were the major contributor to rod motion failure. However, the i control rods that could not be moved due to a rod control system failure remained {

trippable and could perform their intended safety function. Mechanical problems are less common than electrical problems. Most stuck control rods are {

discovered during rod drop testing or during plant startup after refueling.

Therefore, the surveillance interval could be increased to quarterly without any decrease in plant safety. In confirmation of that conclusion, although both stations have experienced Rod Control Drive System failures during surveillance testing, neither Surry or North Anna have identified any stuck control rods during  :

routine surveillance testing. l A review of the accident analysis in the UFSAR determined that the only credible accident that could be affected by this change is a Rod Control Cluster Assembly (RCCA) Misalignment.

This safety evaluation has shown that an unreviewed safety question does not exist based on the following items:

1

1. The change in frequency of control rod movement testing from monthly to quarterly does not affect the operation of the Rod Control System or the Control Rod Drive Mechanisms nor are any hardware modifications being made to any component of the Rod Control System or the Control Rod Drive Mechanisms. Because there are no physical modifications nor any change in operation to the systems there is no increase in the probability of occurrence

~

i of a RCCA misalignment. l

2. The consequences of a RCCA misalignment depend on a combination of factors including core power level, RCS flow rate, RCS pressure, core flux distribution, and the magnitude of the misalignment of the RCCA. Since this TS change is only concerned with the frequency of control rod movement testing and no physical modifications are being made,' approval of this change will have no affect on the consequences of a RCCA misalignment.

3. The change in frequency of control rod movement testing from monthly to quarterly does not affect the operation of the Rod Control System or the Control Rod Drive Mechanisms nor are any hardware modifications being made to any component of the Rod Control System or the Control Rod Drive Mechanisms. Because there are no physical modifications nor any change in operation to the systems there is no possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report.

Since this change will not affect the probability or consequences of any previously evaluated accident and will not result in the possibility of a new or different type of accident and the bases section of Technical Specifications does not address the frequency of control rod movement testing, there is no reduction in the margin of safety.

l

Safety Evaluation Number 94-SE-OT-014 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change Package 309 This change is submitted to provide additional flexibility for the HHSI flow balancing requirements of TS 4.5.2.h.1 and 6.9.1.7 by permitting current analysis values to set the constraints rather than using fixed values based on more limiting analysis.

SAFETY EVALUATION

SUMMARY

This change to Technical Specifications does not change any of the requirements for the LOCA analysis for the North Anna station. It simply removes the numerical values for the testing limits from the TS and places them under administrative control in the periodic test procedures. This change is expected to provide a significant improvement in the flexibility for setting the surveillance limits for the HHSI flow balance testing. The approach is consistent with the information provided for this system in the NUREG-1431 STS. No unreviewed safety question is created by this change as evidenced by the following:

1) No increase in the probability of occurrence or consequence of an accident or malfunction of equipment will result from this change since both requirements for the LOCA analysis acceptance criteria and the methodology for analyzing the LOCA transients remains unchanged. No physical changes are being made to the plant equipment and the HHSI system will continue to be operated in a manner consistent with both the safety analysis assumptions j and the pump run-out limits.  !

2) The implementation of this change does not create the possibility of an accident or malfunction of equipment of a different type than any which have been previously evaluated in the SAR. No new or unique accident precursors have been introduced.

3) The margin of safety as defined in the basis for any technical specification is not reduced by implementation of this change. The requirements for acceptance criteria and the analysis methodology remain unchanged.

l l

l

i i

Safety Evaluation Number 94-SE-OT-015 DESCRIPTION OF CHANGE DOCUMENT MCM-1904-01 "On-Line Leak Repair Using Contractor Leak Sealing Methods" The proposed activity is injection of leak sealant to the casing flange of the Terry Turbine. The casing flange seal is leaking steam which is impinging on the turbine bearing housing. It is postulated that this steam leakage is the source of toe Water intrusion that is occurring to the steam driven AFW pump's lubricating oil system.

SAFETY EVALUATION

SUMMARY

lt is prudent to attempt to stop this steam leakage in order to reduce the oil system water intrusion. The proposed leak sealant injection should be allowed for the following reasons:

Leak sealant injection is a routine practice performed in a controlled manner using an approved procedure. The sealant compound (FSC-N-9A) is approved for this application per the CME program. Therefore, there is no concern with degradation to the casing or blading from sealant contact. If any sealant material were to intrude into the turbine casing, it would be cut off by the blading and discharged to atmosphere. The material is soft enough that no damage will occur to the turbine blading.

The injection process is such that minimal sealant will be injected into the casing. Any affects to turbine performance (turbine imbalances / steam flow path) due to sealant adhesion to the turbine are negligible. Leak sealant injection of the casing is not considered a repair to the turbine's pressure boundary. It is replacement of the gasket material. Gasket material is not considered a pressure retaining component per ASME. Steam flow will ensure that the sealant material will not propagate upstream where it could interfere with the governor valve or the overspeed trip valve. The integrity of the turbine casing is not affected by the drilling of injection ports or the injection process itself. The Auxiliary Feedwater Technical Specification requirements will be met.

Based on the above discussions, there is no effect on the probability of '

occurrence or the consequences for any accidents or malfunctions. In addition, there is no possibility of creating any new accidents or malfunctions. Therefore, no unreviewed safety question exists.

Safety Evaluation Number 94-SE-OT-016 DESCRIPTION OF CHANGE DOCUMENT Final Design Test Procedure: SBO Diesel Generator Tie-in to Station,2-TV-DG-200A and 2-TV-DA-200A Conduit Modification, Procedure number D-NAT 012-3-1.

The above procedure will place a temporary modification in the auto control circuits of the outside Phase A isolation valve, 2-TV-DA-200A, of the Containment Sump Pumps, 2-DA-P-4A and B, and the Phase A outside containment isolation valve,2-TV-DG-200A, of the Primary Drains Tank Transfer Pumps,2-DG P-1 A and B. These control circuits normally automatically open the valves on the manual start of one of their respective pumps. However, this auto start feature will be removed by the lifting of leads. This requires the valve be opened and held open manually by holding down the open pushbutton of the valve.

SAFETY EVALUATION

SUMMARY

During TM placement and removal the requirements of Tech Spec 3.6.3.1, Containment Isolation Valves, will be complied with by steps to de-energize the isolation valves in the closed position by opening and tagging out the supply breakers to the isolation valves.

Thus, this jumper affects only the control feature of valve auto open and close on pump start and stop. It does not affect the protection feature of close on Phase A.

An extra operator is required for pumping the PDT and the containment sump to free the RO to monitor the plant and respond to a transient, to secure the pump in mid-cycle due to no auto pump cutoff at low level and no pump protection such as RV's once the isolation valve is closed. These pumps auto secure only on low level. The PDT Transfer Pumps do not recirc back to the PDT, therefore the PDT RV does not protect the pump and piping. The next RV in the flowpath is outside the Containment at the Gas Stripper. Thus, if the operator holding down the open pushbutton on the valve control releases the pushbutton in the middle of pumping and did not also secure the pump, the pump may be damaged.

Likewise, no low flow protection (such as an RV or mini-flow line) exists inside containment for the Containment Sump Pumps. However, an extra RO dedicated to the valve control will be able to secure the pump in the event of valve closure before the pump cutoff on low level is achieved, thereby providing pump protection. At current leakage, the PDT will need to be pumped once per day for 40 seconds and the Sump pumped three times per day for 30 seconds.

Hence, these are 5-minute tasks for an extra RO.

9

i l

l Sump and tank levels can still be monitored by level gauges in the control room.  ;

Alarms will still function. The pumps will not auto start as they must be maintained in manual. Sump integrator data must be taken before opening the >

valve and starting the pump after a hi alarm level is received. Integrator data

.must also be taken after the pump auto shuts off on low level. The data is needed to meet the surveillance requirement for Tech Spec 3.4.6.1, RCS Leakage Detection Systems, and Tech Spec 3.4.6.2, RCS Operational Leakage, because the pump starts and stops will not always occur at the same level allowing input to the P-250. Since this. jumper will not adversely affect containment isolation or safe operation, it does not constitute an unreviewed safety question and should be allowed.

F k

)

Safety Evaluation Number 94-SE-OT-017 i

DESCRIPTION OF CHANGE DOCUMENT i UFSAR Change # FN 94-05 Technical Requirements Manual Revision 0  ;

i Section 16.2 of the UFSAR, Technical Requirements, and Appendix R l requirements in VPAP-2401 will be relocated to the Technical Requirements  !

Manual (TRM).

SAFETY EVALUATION

SUMMARY

l l

MAJOR ISSUES:

This Safety Evaluation was written to determine if relocating Section 16.2 of the UFSAR, Technical Requirements, and Appendix R requirements in VPAP-2401 to the TRM will present an Unreviewed Safety Question.

JUSTIFICATION:

. This change is an administrative change only. The materialin Section 16.2 of the UFSAR and VPAP-2401 will be moved in its entirety to the TRM, which is a station document controlled by 50.59 Safety Evaluations.

UNREVIEWED SAFETY QUESTION ASSESSMENT:

It has been determined that the proposed change does not present an unreviewed safety question because it does not:

1. Involve an increase in probability of occurrence of any accident previously evaluated in the UFSAR because the change does not involve any modifications to any plant systems or operations.

2. Create the possibility of any accident not previously defined in the UFSAR because the change does not involve modifications to any plant systems or operations.

3. Involve a reduction in the margin of safety because it does not affect the margin of safety as referenced in the bases section of the Technical Specifications.

l

)

I i

l I

l I

f Safety Evaluation Number 94-SE-OT-018 DESCRIPTION OF CHANGE DOCUMENT Work Order Task #00286289 01 0-MCM-1904-1 Re-injection of leak sealant to the hinge pin cover of 2-FW-62, 'A' Main Feedwater containment isolation check valve.

SAFETY EVALUATION

SUMMARY

The proposed maintenance activity is a re-injection of the valve hinge pin cover plate for Main Feedwater check valve 2-FW-62. The possibility of the leak sealant preventing the valve from performing its intended functions is remote.

The valve disk is free to swing on the valve hinge pin. The valve hinge pin is free to spin in the hinge pin housing. Even if the leak sealant were to cause the pin to seize, the valve disk would still be free to swing. In addition, it is unlikely that the leak sealant would prevent the check valve from closing under the delta pressure that would be experienced during a design basis accident.

No new injection taps will be performed under this Work Order and any peeni-that will occur will not affect the hinge pin cover stud integrity nor will it affect t a pressure retaining capability of the valve. The activity should be allowud because it is prudent to stop leaks since they tend to develop into bigger leaks if they are not stopped. Since valve function should not be affected, an unreviewed safety question does not exist.

1 l

l l

Safety Evaluation Number 94-SE-OT-019 DESCRIPTION OF CHANGE DOCUMENT 1/2-MOP-28.46 " Main Steam Valve Indication Replacement" The procedures will provide direction for de-energizing the valve operation circuit and/or light indication power supply for replacement of light bulbs on the main steam trip valves.

SAFETY EVALUATION

SUMMARY

The main steam trip valves (MSTV) are open during power operations. They close on a high steam flow with low-low Tavg or low steam pressure signal or on containment intermediate Hi-Hi pressure signal. The valves are containment isolation valves and close to isolate a faulted steam generator. The light indication for the MSTVs is required to be operable for Reg. Guide 1.97 (Post Accident Monitoring). Due to the sensitivity of the trip valves and the transient on the unit should one go closed a procedure was developed to de-energize the valve operation circuit and/or the light indication power supply.

The procedures (1/2-MOP-28.46) provide direction to de-energize the light indication power supply which would eliminate the possibility of a short occurring during replacement of the bulb. The MSTV will still auto close on either train or could be manually closed via either train pushbutton or the Appendix "R" isolation switches. If this option is chosen the MSTV will be operable during the entire time and no Tech Spec actions will be required to be entered.

Since the light bulbs are in close proximity to the close pushbutton for the valve, the potential exists for contact with the pushbutton and inadvertent closure of the valve. Therefore the option to de-energize the valve operation circuit, in addition to de-energizing the light indication circuit, is available at the discretion of the Superintendent of Operations. This option will result in that train of MSTV operation being inoperable since both the manual and automatic operation will be disabled. The other train (automatic and manual) in addition to both Appendix "R" isolation switches will remain fully operable. The work on the one train will in no way affect or interface with the other train or Appendix "R" switches. Emergency Operating Procedures (EOPs) have steps which specifically check for main steam line isolation, therefore should the auto closure of the valve fail, the EOPs would ensure the MSTVs are manually closed. Therefore the main steam isolation capability will be retained. Since one train of the MSTV operation circuitry will be de-energized, the actions of Tech Spec 3.6.3.1 and 3.7.1.5 will be entered. These will be entered since the MSTV will not be fully operable.

The action of Tech Spec 3.3.2.1 is not applicable for the following reasons: The automatic portion of the main steam isolation circuitry that feeds ESF remains operable and the signal generated will still be sent to the valve, however the

affected train of the valve will not respond since it is de-energized. This is similar to tagout of a LHSI pump or AFW pump. In these instances actions are entered for inoperable ESF equipment not the actuation instrumentation. The action for inoperable manual actuation is not applicable since there is no manual main steam line isolation actuation that goes through the solid state output relays such as manual SI, Phase A isolation, and CDA. This is the position of System Engineering during their review of Tech Spec Surveillance Requirements.

Therefore this action will not be entered.

Since one train of automatic MSTV closure will remain operable at all times for the affected valve and both trains of Appendix "R" isolation will remain operable and Tech Spec actions will be entered and complied with, operation of the system is within its design bases and no unreviewed safety question exists. The potential for increase in the probability of an accident is not increased since de-energizing the circuit will reduce the potential for spurious closing of the valve resulting in a transient on the unit. There will be no increase in the consequences of any accident since one train of auto closure will remain operable as well as the manual closure via numerous switches. In addition, the EOPs specifically address closure of the valves. There is no potential for a new type of accident since the evolution is simp!a in nature, involves no jumpers and only affects one train of one MSTV.

l

Safety Evaluation Number 94-SE-OT-020 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change # 287 This TS change provides revised heatup and cooldown operating limit curves for Unit 1, LTOPS PORV lift setpoints and LTOPS enabling temperatures for both Units.

SAFETY EVALUATION

SUMMARY

New requirements were developed in accordance with ASME XI Appendix G. No unreviewed safety question is posed because the analysis is consistent with standard practice. The TS changes address the concerns of GL 90-06 for unreliability of the PORVs.

Safety Evaluation Number 94-SE-OT-021 DESCRIPTION OF CHANGE DOCUMENT Technical Requirements Manual (TRM) Revision 1 The TRM will be revised to include TR 12.1. This requirement will contain lists of safety related and non-safety related snubbers which are required by Unit 1 and Unit 2 Technical Specifications 6.10.2(n). Limiting conditions for operation and

( surveillance requirements for these snubbers are contained in Unit 1 and 2 TS 3/4.7.10. 1 l SAFETY EVALUATION

SUMMARY

MAJOR ISSUES:

This Safety Evaluation was written to determine if adding the list of safety related and non-safety related snubbers to the TRM presents an Unreviewed Safety .

Question. I JUSTIFICATION: l This change is an administrative change only. The lists of snubbers are being centralized into the TRM.

UNREVIEWED SAFETY ASSESSMENT QUESTION:  !

It has been determined that the proposed change does not present an unreviewed safety question because it does not:

1. Involve an increase in probability of occurrence of any accident previously evaluated in the UFSAR because the change does not involve any modifications to any plant systems or operations.

2. Create the possibility of any accident not previously defined in the UFSAR because the change does not involve modifications to any plant systems or 4 operations.

3. Involve a reduction in the margin of safety because it does not affect the margin of safety as referenced in the bases section of the Technical Specifications.

I

1 Safety Evaluation Number 94-SE-OT-022 DESCRIPTION OF CHANGE DOCUMENT UFSAR Ohange Request # FN 94-010 See list included with UFSAR Change Request # FN 94-010.

l SAFETY EVALUATION

SUMMARY

UFSAR Change Request # FN 94-010 incorporates the results of a recent  ;

periodic review of Chapter 11 of the North Anna UFSAR to ensure that it is i consistent with current processes as well as UFSAR Change Request #'s FN 92-035,93-020 & 93-055. It contains administrative, editorial and technical changes that have previously been evaluated by design change or safety evaluation processes, therefore, it will not create the possibility of a new or different kind of accident than those design basis accidents previously evaluated, nor will it increase the probability or consequences of an accident.

This change: a) identifies the Duratek Pre-filter System added to the lon Exchange Filtration System by DCP 93-233-3, b) deletes the 60 day decay tank hold requirement, c) revises the percentage of failed fuel and the actual dose rates for the RWSTs, d) revises the methodology for obtaining liquid samples for radioactivity determination, e) adds instructions for the removal of spent filter cartridges in radioactive liquid service, f) revises primary to secondary SG leakage, g) updates the parameters for U1 SGs, h) revises the flow assumed for input to the high-level liquid waste system, i) adds an additional process to package solid radioactive waste for disposal, j) deletes sampling of evaporator bottoms, k) revises the estimated amount of resin, miscellaneous solid waste and spent filters requiring offsite disposal,1) deletes use of the jib crane within the decontamination area, m) deletes the description of the waste solidification and shipping area of the decontamination building, m) deletes reference to the solid waste disposal facility operated by Chem Nuclear near Barnwell North Carolina, n) identifies the evaporator distillate test tank as a temporary storage tank for water from the Component Cooling System, o) adds a footnote that the Liquid Waste Evaporator has been abandoned in place and incorporates the operation of the gas strippers without steam heating.

1 i

l I

l I

l

Safety Evaluation Number 94-SE-OT-023 DESCRIPTION OF CHANGE DOCUMENT UFSAR Change Request # FN 94-008 This change incorporates recent revisions to 10 CFR Part 20 as well as the location and descriptions of various tanks, deletes area monitor gamma detector descriptions, corrects references for the performance of tests / calibrations of radiation monitors and revises containment structure purging frequencies.

Additionally, it revises sampling capacities and administrative frequencies for low volume air samplers, removes instructions for filters, adds descriptions of temporary air ducting and deletes duplicate tables.

SAFETY EVALUATION

SUMMARY

UFSAR Change Request # FN 94-008 incorporates administrative, editorial and technical changes needed to make chapter 12 of the North Anna UFSAR consistent with recent revisions made to 10 CFR 20 and North Anna Technical Specifications. It also corrects deficiencies identified in a OA Audit Finding, incorporates a previous UFSAR Change Request and recommendations resulting from a recent periodic review of Chapter 12 to ensure it reflects current processes. These changes, however, will not affect plant design, therefore, they will not create the possibility of a new or different kind of accident from design basis accidents previously evaluated, nor will they increase the probability or consequences of an accident.

1 l

I

l l

l Safety Evaluation Number 94-SE-OT-024 ,

DESCRIPTION OF CHANGE DOCUMENT 0-ECM-0303-01 " Fuse Replacement" The procedure revision adds steps to install an electrical jumper when replacing Gaitronics system power supply fuses.

SAFETY EVALUATION

SUMMARY

Fuses and agastat timers were installed on the power supplies for the Gaitronics ,

systems per EWR 84-316 and DCP 84-38. These were added to ensure protection of the bus from a non-SR equipment fault. The agastat timers were installed to bypass the fuses during initial energization of the circuit to prevent blowing of the fuse. Problems have been encountered with the design of the agastat timers such that the fuses continue to blow upon energization.

Maintenance is working on a resolution, however until that time a jumper will be used to facilitate replacement of the blown fuses. Installation of the jumper will perform the same function as the timer. It is considered substitution of a manual action for an auto action however it is in compliance with the Nuclear Safety Policy (i.e. auto action is not part of Tech Specs and is not addressed in the UFSAR and is only for a short time).

The revision to 0-ECM-0303-01 adds steps to install an electrical jumper when replacing Gaitronics system power supply fuses. Once energizeo, the jumper will be removed. The Gaitronics system is one of many forms of communications at the plant. It can powered from Vital Bus 1-11 or Vital Bus 2-11. Installation of the jumper will eliminate the protection afforded by the fuses however additional separation / protection is provided by the supply breaker. The jumper would only be used during the replacement of the fuses. The electricians would check the circuit to ensu e a fault does not exist. In addition they would be present the entire time the jumper is installed. The worst case failure of this evolution would result in loss of the affected Gaitronics circuits. Feedback into the bus and other i loads would be prevented by the supply breaker. Loss of the Gaitronics would not disable Operations personnel during normal / accident scenarios due to other forms of communications such as the sound powered phones and hand held radios.

No unreviewed safety question exists from the use of the jumper during fuse i replacement because the jumper: ,

a Will not increase the probability of an accident occurring since the jumper will l be simple in nature and will only affect the Gaitronics power supply. Supply i breakers will prevent back-feed of a fault to the bus and other loads. l

• Will not increase the consequences of an accident since other forms of l communications are available should the Gaitronics system be lost.  !

l 4

L  !

• Will not result in any type of unanalyzed accident since the jumper will only affect the one power supply. Failure of a jumper will result in partial loss of the Gaitronics system only. No other systems important to safety will be affected.

Safety Evaluation Number 94-SE-OT-025 DESCRIPTION OF CHANGE DOCUMENT UFSAR Change Request 94-14 The UFSAR change is a general update of the information in Sections 2.1,

" Geography and Demography" and 2.2 " Nearby Industrial, Transportation, and Military Facilities" of the UFSAR - Section 2, " Site Characteristics." The sections on land use and water use are being eliminated consistent with the guidance of Regulatory Guide 1.70 and the Standard Review Plan.

SAFETY EVALUATION

SUMMARY

This change is a general update of Section 2, Site Characteristics, of the UFSAR to revise the population data to the available 1990s information. As such, an unreviewed safety question does not exist because:

The probability of occurrence of an accident or equipment malfunction important to safety is not increased by this change since no physical modifications are being implemented and system / component operation is not being altered. The consequences of the Chapter 15 accident analyses are not increased. The dose rate calculations are not affected by the population density.

The Emergency Plan is maintained up-to-date relative to the population and the results of this change are comparable to the Emergency Plan.

- The possibility for an accident or malfunction of a different type than previously evaluated is not created as this change merely updates existing information in Chapter 2 of the UFSAR with more recent statistical data.

- The margin of safety as defined in the Technical Specification bases is not reduced since no modifications are being implemented and station operation has not changed. Existing Chapter 15 accident analyses are not affected.

Safety Evaluation Number 94-SE-OT-026 DESCRIPTION OF CHANGE DOCUMENT UFSAR Change FN 94-013 for North Anna UFSAR Chapter 13, " Conduct of Operations," and Chapter 17, " Quality Assurance Program."

UFSAR Change FN 94-013 incorporates the NRC-approved Operational Quality Assurance (OA) Program into Chapter 17 of the UFSAR and deletes the sections containing the descriptions of the QA Programs during the construction and pre-operational phases. Editorial changes are also made to Chapter 13 of the UFSAR to accommodate the incorporation of the Operational OA Program and to conform with the format of NRC Regulatory Guide 1.70 (Section 13 for Conduct of Operations).

SAFETY EVALUATION

SUMMARY

The likelihood that an accident will occur is neither increased nor decreased by this change to the UFSAR. Incorporating the NRC-approved Operational OA Program into the UFSAR will not be a precursor to nor cause of an accident or other previously analyzed accident in the UFSAR. Further, the consequences of a malfunction of equipment important to safety previously evaluated in the UFSAR are not increased by this change, because the programmatic controls will provide a greater degree of control in distributing the NRC-approved Operational ,

OA Program and increase accessibility to that program. As such, this UFSAR change does not adversely impact the design or operation of plant equipment.

Incorporating the NRC-approvod Operational OA Program into the UFSAR will not produce a new accident scenario or produce a new type of equipment malfunction.

The Operational OA Program has been approved by the NRC and does not impact any margin of safety described in the Safety Analysis Report documents.

The sections being deleted and/or revised w:ll eliminate redundancy and will accommodate the incorporation of the NRC-approved Operational OA Program.

Thus, no margin of safety is impacted by this proposed change.

Safety Evaluation Number 94-SE-OT-027 DESCRIPTION OF CHANGE DOCUMENT UFSAR change request to store irradiated fuel components in the Spent Fuel Pool in locations other than spent fuel assemblies or spent fuel rack locations.

SAFETY EVALUATION

SUMMARY

Spent fuel pool storage locations that are under the path used to move the transfer canal gates are prohibited from receiving spent fuel. Tech Specs prohibit movement of any heavy load over irradiated fuel assemblies. These prohibited locations are currently being used to store irradiated fuel inserts (burnable poison rods, control rods, and thimble plugs). A Tech Spec change is being processed that would allow movement of the transfer canal gates over irradiated fuel. If the irradiated inserts are moved to acceptable alternate locations, additional spent fuel cells will be made available.

This proposed activity will be the storage of irradiated components (but not fuel) between the storage racks and the spent fuel pool wall. The irradiated inserts will be located on the floor of the fuel pool, in available space between the fuel racks and the pool wall. The components stored in these locations will not be re-used in any future core. The design of the spent fuel pool systems, including but not limited to, the cooling system, the storage racks, the pool foundation, and the pool walls, are not affected. The irradiated inserts do not contribute to the heat load of the poci. Their mass is insignificant by comparison to the mass of the fuel assemblies and storage racks. The irradiated inserts can not interfere with the flow of water into and out of the cooling system.

Moving irradiated fuel inserts within the boundaries of the spent fuel pool does not affect overall pool reactivity. Reactivity contre' 'f the spent fuel pool are prov'.dd by the Boraflex fuel racks, the fuel rack sps . , and the spent fuel pool boron concentration. These are not affected by this activity.

Safety Evaluation Number 94-SE-OT-028 DESCRIPTION OF CHANGE DOCUMENT 1-OP-51.1, Component Cooling System, Rev. 20 2-OP-51.1, Component Cooling System, Rev.13 Revised 1-OP-51.1 and 2-OP-51.1 to ease steps to cross connect the CC System between Units 1 and 2. Added Section 5.12 to direct operations for swapping CC PCV between Units with CC cross connected.

SAFETY EVALUATION

SUMMARY

The CC System was not designed to mitigate any design basis accident including a DBA LOCA or MSLB. The CC System was designed to support RHR operation, but the RHR System was also not designed to mitigate any design basis accident. However, on a CDA, the affected Units CC Pumps are required to trip and CC containment isolation valves are required to shut on a Phase B isolation signal. The affected Units CC System is not required to operate on a CDA. If a CDA were to occur while cross connected, the unaffected Units CC Pumps can be started, CC Pump discharge cross connect (1-CC-49) can be closed, and/or CCHXs aligned quickly as needed in accordance with the revision to 1,2-AP-15, Loss of Component Cooling. If needed,1-OP-51.1 and 2-OP-51.1 Section 5.11, also address splitting out the CC System.

The CC System was designed to operate in a cross connected manner as referenced in the SER, Section 9.2.2 and FSAR Figure 9.2.2-1, Component Cooling Water System, shows the CC System cross connected valve alignment as the normal CC lineup. UFSAR Figure 9.2-15, Component Cooling Water System, however, does show the current normal alignment of the CC System as split between the Units. UFSAR Section 9.2.2 discusses that the four CC subsystems (a subsystem consists of 1 CC Pump and 1 CCHX) are already shared between the Units. UFSAR Section 9.2.2.5 addresses operation of CC common loads beMg either cross connected or aligned to an individual Unit and the capability to cross connect CC so that it would be shared by both Units. The CC common loads returns are already operated cross connected at the CC Pumps suction header via 1-CC-14 and 1-CC-15 being open. NAPS T.S. 3.7.3.1 and 3.7.3.2 as written address that the CC System is shared between the Units.

Cross connecting the CC System between Units 1 and 2 is accomplished by valve manipulation only of installed CC System valves in existing CC piping. No modification on the CC System is performed. Cross connection is at the CC Pump suction header (1-CC-40), discharge header (1-CC-49), and CC common loads cross connect isolation valves (1-CC-59 and 2 CC-36).

Normal operation of the CC System cross connected distributes the CC heat load on the CCHXs more evenly enabling them to operate more efficiently. During hot ,

summer days when SW is warmest, an additional SW Pump to cool the Unit with I

l

i CC common load', may no longer be required thus saving energy. Reliability is increased becaus e the standby CC Pump from either Unit would be available to operate as needeit in support of both Units.

Based on the abos e issues considered, an unreviewed safety question does not exist.

t i

1

i

\

l Safety Evaluation Number 94-SE-OT-029 l i

DESCRIPTION OF CHANGE DOCUMENT 0-ICM-RC-T-002, Instrument Corrective Maintenance procedure.

The new ICM provides procedural guidance to replace a reactor coolant wide  ;

range (WR) RTD with a narrow range (NR) RTD when an installed WR RTD fails at power.

I SAFETY EVALUATION

SUMMARY

Procedure 0-ICM-RC-T-002 will evaluate the condition of a failed WR RTD in a protection channel, aid in determining the appropriate corrective actions based on the type of failure, direct a Temporary Modification (TM.) be installed to provide an operable WR protection channel, and direct appropriate testing, Return-To-Service and Follow-On actions to complete the Temporary Modification. The two types of TMs that this procedure will install are: a) swapping a RTD's failed compensating lead (there are 4 field wires, but only three are used at the RTD) and b) swapping a NR spare RTD element in place of a failed WR primary element. In addition, this procedure will direct the removal of the TM. including testing, Return-to Service and Follow-On actions. The ICM will provide instructions for the following:

• Troubleshooting and determining appropriate corrective actions for failed WR RTD primary element or element extension wiring.

• Temporarily re-configuring protective cabinet input wiring to correct for a failed WR RTD primary extension wire.

• Temporarily re-configuring protection cabinet input wiring and re-calibrating process cards to substitute a NR RTD spare for WR RTD primary element.

• Restoring any temporary re configurations as a Temporary Modification controlled by an approved procedure in accordance with VPAP-1403.

Each reactor coolant loop has three NR Hot Leg RTD's with two elements each and one Cold Leg RTD with two elements, there are a total of three spare Th NR RTD's and one spare Tc NR RTD which can be used to replace a failed WR RTD. The spare NR RTD can be modeled to perform the same function as a WR RTD by re-calibrating the instrument loop cards. The control room indication would remain unaffected and the Operator's ability to monitor the plant would not be impacted. The procedure tracks the failed instrument and ensures that at the next refueling cutage, the failed WR RTD is replaced, and the wiring in the process racks :S returned to its original configuration. The procedure addresses instrument qualification for WR RTD application by have Engineering verify that the APP-R spec's are satisfied prior to clearing any APP-R action. Per conversations with DEO and corporate Engineering, APP-R requirements are met to use a NR spare RTD in the instrument loop for WR RTD.

p i .;

After rewiring and re-calibration of the spare NR RTD, the NR RTD will function

_ the same as a WR RTD. The instrument loop will be able to perform all of its desigreed functions. For these reasons, no unreviewed safety question exists.

1 j

i 4

I

i Safety Evaluation Number 94-SE-OT-030 DESCRIPTION OF CHANGE DOCUMENT UFSAR Change Request FN 94-018 Corrects the description of the PRT pressure transmitter in Section 5.6.2.3 of the UFSAR.

SAFETY EVALUATION

SUMMARY

UFSAR Section 5.6.2.3 states that the pressure transmitter provides a signal to isolate the PRT from the Waste Disposal system when a pressurizer safety lifts.

The flow path to the Vents and Drains system from the PRT is normally maintained closed. In the unlikely event that this HCV was opened while the pressurizer safety had opened, the radioactive gas would flow to the gas stripper and be processed through the Gaseous Waste system. The stripper should be i able to handle the pressure since the stripper relief valve settings are the same l as the PRT rupture discs. If the stripper RVs opened, the gas would be processed through the Process Vent system. During accident conditions that would generate a Phase A signal, the PRT vent to the gas strippers would isolate. Therefore, accident doses would not be released through the PDTT.

I i

I l

i Safety Evaluation Number 94-SE-OT-031 DESCRIPTION OF CHANGE DOCUMENT 94-SE-OT-031 Technical Specification Change # 311 On December 29,1993 the NRC issued Generic Letter 93-08, " Relocation of Technical Specification Tables of instrument Response Time Limits" which provides guidance for preparing a change to TS to relocate the Reactor Trip System (RTS) and the Engineered Safety Features Actuation System (ESFAS) tables of instrument response time limits to station controlled documents. The advantage of relocating these tables to station controlled documents is that any changes to these tables can be performed in accordance with 10 CFR 50.59 without the necessity of prior approval by the NRC in the form of a license amendment.

SAFETY EVALUATION

SUMMARY

These proposed changes do not create the possibility of an unreviewed safety question based on:

1. The proposed changes will relocate the RTS and ESFAS instrument response time limit tables from TS to station controlled documents but will not change the operability or surveillance requirements for these instruments. This activity will not change any accident precursors nor change the operation or configuration of any plant equipment. Therefore, the proposed change will not affect the probability of occurrence of any accident previously evaluated.

2. The proposed changes will relocate the RTS and ESFAS instrument response time limit tables from TS to station controlled documents but will not change the operability or surveillance requirements for these instruments. This activity will not change any accident precursors nor change the operation or configuration of any plant equipment. Therefore, the proposed change will not increase the consequences of any accident previously evaluated.

3. The proposed changes will relocate the RTS and ESFAS instrument response time limit tables from TS to station controlled documents but will not change the operability or surveillance requirements for these instruments. This activity will not change the operation or configuration of any plant equipment. No new hardware is being added by these proposed changes to TS; therefore, the proposed change will not create the possibility for an accident of a different type than was previously evaluated.

4. The proposed changes will not affect the functions of the RTS and ESFAS instruments. Relocating the response time limits will not alter the operability or l

1 l

the surveillance requirements of these instruments. Therefore, the proposed change _ does not reduce the margin of safety as described in the bases r section of the Tech Specs.

h I

i

Safety Evaluation Number 94-SE-OT-032 DESCRIPTION OF CHANGE DOCUMENT 1/2-ECM-2802-01/02 New Electrical Corrective Maintenance procedures to control the placing of the A, B, and C phase Emergency Bus Undervoltag's and Degraded Voltage relays in trip during Unit operation.

SAFETY EVALUATION

SUMMARY

The ECMs provide instructions for installing and removing Temporary Modifications (TMs). Implementation of these ECMs will insert a trip signalinto the UV-DV logic. This inserted trip signal will insure the protection provided by the UV-DV relays remains intact should a relay be determined inoperable, insertion of this trip signal is similar to placing any other protection channel in trip and is consistent with the plant's design basis.

l l

l 1

F Safety Evaluation Number 94 SE-OT-033 DESCRIFTION OF CHANGE DOCUMENT

• 1-TMOP-26.78 REV 0 "B RSS TRANSFORMER CHANGEOUT"

• Memo from E. S. Hendrixson to G. T. Bischof dated May 10, 1994,

" Clarification of 2H EDG Operability" SAFETY EVALUATION

SUMMARY

The 'B' RSST will be replaced with the spare RSST due to internal oil leakage.

The 2H EDG will be running and supplying the 2H emergency bus. Because the emergency bus load shed and load sequence scheme are automatically defeated when the EDG output breaker is closed, the EDG is normally considered

" INOPERABLE" when breaker 25H2 is closed. Administrative controls will be placed on the 2H emergency bus loads such that the 2H EDG can be considered

" OPERABLE" with its output breaker closed and load sequence timers automatically removed from service for the performance of the 'B' RSST maintenance. TMs are used in the temporary MOP to lift leads for 'B' RSST i control power and to facilitate return to service of the 'B' RSST after maintenance. NEE calculations have shown that this will not result in a EDG overload concern as long as proper administrative controls are taken. The required administrative controls are contained in a memo from W. C. Stallings to E. S. Hendrixson and are summarized below:

• In order to limit starting loads, the following pumps must be running on the 2H emergency bus:

2-SW-P-1 A 2-CC-P-1 A 2-CH-P-1C

• 2-CH-P-1 A must be placed in Pull-to-Lock

• PZR Heater bank 4 must be placed in Pull-to-Lock Tech Spec surveillance requirement 4.8.1.1.2.d.3 requires verification that the load sequencing timers listed in Table 4.8.1 are OPERABLE every 18 months. It is the station's position that Technical Specification compliance for the 2H EDG is maintained because the load sequence timers are still operable even though they have been automatically removed from the circuit.

Appendix R loads are assumed not to be placed on the 2H emergency bus while DBA accident equipment is loaded. This is consistent with the design of Appendix R equipment.

The Nuclear Safety Policy on defeating equipment or system automatic safety functions is complied with since all required manual actions are performed prior i

to transferring the emergency bus load to the EDG. Therefore, no subsequent operator action is required to prevent EDG overload or to maintain the emergency bus operable.

RSST Lond Shed is defeated for the 'B' RSST. This is acceptable since the transformer will not need protecting.

No unreviewed safety question exists because the 2H emergency bus loads will be administratively controlled to ensure that the 2H EDG will not be overloaded during a worst case accident scenario. Therefore, the 2H EDG will be capable of performing its intended design function and can be considered operable during the 'B' RSST maintenance activity.

Safety Evaluation Number 94-SE-OT-034 DESCRIPTION OF CHANGE DOCUMENT CCHX Retubing / Repair Study. (CCHX Plugging evaluation)

SA8:ETY EVALUATION

SUMMARY

CCHXs experience tube leakage due to microbiologically influenced pitting corrosion. Calculation ME-0420 established the limit (10%) of tubes which can be plugged without adversely affecting CC system performance. It is expected that measures will be taken to replace or retube the CCHXs prior to this limit being exceeded.

Tube plugging activities will be implemented within the existing Technical Specification limitations. The design basis of the SW and CC systems are not altered. Examination of the previously evaluated accidents from the standpoint of plugging of up to 10% of the CCHX tubes shows that the tube plugging cannot increase either the probability of occurrence of accidents identified in the SAR or the consequences of these accidents. Pinhole leakage through the tubes do not compromise structuralintegrity of the tubes. Periodic heat exchanger inspections and plugging of the leaking tubes will be performed every 3 - 6 months. If leakage is detected through chemical analysis or drop of level in CC expansion tank, the affected CCHX will be isolated for the tube plugging.

e

Safety Evaluation Number 94-SE-OT-035 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change Package #302A Modify the testing requirements for the Emergency Diesel Generators.

SAFETY EVALUATION

SUMMARY

On March 1,1994, the company submitted Technical Specification Change Package #302 to the NRC. Part of this original submittal modified the action for one inoperable EDG in that the time allowed for determining if a common mode failure was present for the inoperable EDG was reduced from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. If a common mode failure was not present, the OPERABLE EDG would not need to be test run. Generic Letter 93-05 stated that this determination must be made within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The currently approved Technical Specifications for North Anna Units 1 and 2 and NUREG-1431 allow 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for this determination. During a conference call with the NRC staff on May 17,1994, the i NRC staff stated that the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time period allowed by NUREG-1431 was acceptable. This Safety Evaluation is written to support a supplemental letter to the NRC requesting that the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period be retained.

The changes in the testing requirements for the EDG's follow the guidelines l established in REG GUIDE 1.9, Revision 2, " Selection, Design, Qualification, and Testing of Emergency Diesel Generator Units Used as Class 1E Onsite Electric Power Systems at Nuclear Power Plants," dated December 1979, NUREG-1366,

" Improvements to Technical Specifications Surveillance Requirements," dated December 1992, NRC Generic Letter 93-05, "Line-Item Technical Specifications improvements to Reduce Surveillance Requirements for Testing During Power Operation," dated September 27,1993, and NUREG-1431, " Standard Technical Specifications - Westinghouse Plants," dated September,1992, it has been determined that these changes do not result in an unreviewed safety question based on the following items:

1

1) The EDG's will continue to be tested on a regular basis as required in REG '

GUIDE 1.9 so there is no decrease in the probability that they will start when required. Unnecessary starting has historically led to excessive wear and tear i on the EDG's which has resulted in reduced reliability of the diesel engines.

Approval of this Technical Specification change will ultimately result in the improved reliability of the EDG's therefore there is no increase in the probability of occurrence nor increase in the consequences of any accident evaluated in the Safety Analysis Report.

T1

2) There are no modifications or change in operations of any plant equipment  ;

that would result in the possibility for an accident of a different type than was previously evaluated in the Safety Analysis Report.

3) There will be no increase in the probability of occurrence of malfunctions evaluated in the Safety Analysis Report nor will this TS change create the possibility of a malfunction of equipment of a different type because the >

EDG's will continue to be adequately tested to ensure that they will start and ,

carry their design loads when required to do so.

The margin to safety is not affected by this Technical Specification change because the Bases section of Technical Specifications does not specifically list '

the testing and surveillance requirements of the EDG's.

i I

Safety Evaluation Number 94 SE-OT-036 Safety Evaluation Number 94-SE-OT-036, Rev 1 DESCRIPTION OF CHANGE DOCUMENT

• 2-MOP-6.92: Cross-Connection of Emergency Busses for Maintenance (Emergency Bus 2H/2J 4160 Cross-Tie)

• VPAP-2805: Shutdown Risk Program a 1-TMOP-26.78: "B" RSS Transformer Changeout Procedure The Revision simply allowed entry into TS 3.4.1.3 during the evolution.

SAFETY EVALUATION

SUMMARY

The evaluated activity is the "B" RSS Transformer replacement with Unit 1 at 100% power and Unit 2 in Mode 5. The activity will involve the use of the Unit 2 4160V cross-tie breaker between Emergency Busses 2J and 2H to allow the 2H Bus to remain energized during replacement of the transformer. This activity will render the "A" Train of RHR technically inoperable, with fuel in the vessel, due to the Inoperability of its normal and emergency power supply; however, power will be available during the activity via the 2J Emergency Bus. The activity will render one of the two Offsite Power sources for Unit 2 inoperable, with fuel in the vessel.

MAJOR ISSUES CONSIDERED Operation of the 2H/2J cross tie breaker for maintenance is allowed by the UFSAR. Section 8.3.1.1.1 states that the Unit 2 4160 volt H and J buses may be interconnected by a breaker that is normally removed from its cubicle, that is under strict administrative control, and is provided for maintenance purposes.

'Nith the cross tie breaker closed, one bus will continue to be fully operable and the other bus will be energized, but not operable. The cross-tie breaker is provided with protection features (including breaker coordination) to ensure that a fault on one of the cross-tied busses will not adversely affect the other bus.

Nuclear Electrical Engineering Calculation EE-0361 documents the acceptability of the breaker coordination.

Overload protection of the Emergency Diesel Generator (EDG) on the operable bus is assured by controlling the allowable equipment that would be powered from that EDG in the event of a loss of Offsite Power, so as not to exceed the normal full power rating of 3000 kW. Since EDG overloading is prevented, the performance characteristics of the EDG are not affected. The EDG on the inoperable bus is placed in MANUAL-LOCAL to ensure that it will not start on a loss of off site power. This action eliminates the possibility of two EDGs running in parallelin the isochronous mode.

This activity is allowed by Tech Specs. In the Modes in which the busses may be cross tied, only one emergency bus is required to be operable. The required bus will continue to be fully operable and the normal Tech Spec surveillance will be appropriate and correct. The Tech Spec basis for having only one operable l

emergency bus available in Modes 5 and 6 is that the plant can be maintained in a shutdown condition for extended time, instrumentation and control capability is available to monitor and maintain plant status, and sufficient power is available for systems necessary to recover from postulated events. Since one bus will be operable at all times, this basis is not affected.

By the Tech Specs, only one train of RHR is required to be operable and in operation as long as at least one Reactor Coolant Loop is operable. In the proposed condition, the RHR related Tech Specs will continue to be met as stated. During the activity, one train of RHR ("B") will be fully operable to provide sufficient heat removal capability for removing decay heat. At least one RCS Loop will be operable for core cooling considerations. The reactor coolant pumps will be tagged out per the normal shutdown procedure. Tech Spec 3.4.1.3 requires two loops which requires Cold Shutdown within 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Compliance with the Action Statement will be ensured via Operating Procedures. Therefore, the basis for the RHR/ Reactor Coolant Loops specifications will not be affected.

Guidance provided by VPAP-2805 for outage activities with fuel in the vessel will be challenged in the areas of RHR operability and Offsite Power availability. The VPAP requires two operable RHR trains and two Offsite Power supplies for the outage unit with fuel in the vessel. During this activity there will only be one operable RHR train ("B") and one operable Offsite Power supply (for 2J Bus).

This has been evaluated and found acceptable for the following reasons.1) All .

Tech Spec requirements for RHR and Power Supplies will be maintained during l the activity. 2) "A" RHR subsystem will be available for use with limited manual ,

action in the event of a non-bus related loss of "B" RHR subsystem. 3) 2H EDG, l although removed from service for this activity, would be available to be placed in j service with manual action to power required emergency loads, in the unlikely  !

event of a Loss of Offsite Power with a subsequent loss of the 2J EDG. These actions would be accomplished through the guidance provided in 0-AP-10.

)

CONCLUSION The evaluation of the major issues summarized above provides the basis that the activity does not create nor involve an unreviewed safety question. More detailed explanation and evaluation of the effects on applicable accident and malfunction analyses is provided on pages 10 and 11 of the Safety Evaluation.

l

Safety Evaluation Number 94-SE-OT-037 DESCRIPTION OF CHANGE DOCUMENT Technical Requirements Manual (TRM) Revision 3 This Safety Evaluation was written to determine if adding the list of EQ Doors and its associated requirements to the TRM presents an Unreviewed Safety Question.

SAFETY EVALUATION

SUMMARY

JUSTIFICATION:

This change is an administrative change only. The list of EQ Doors and its technical requirement and surveillance will be located into the TRM. The list is currently located in the North Anna Environmental Zone Description. Neither the list nor the EZD will be affected by this change. The surveillance requirements for this requirement are the same requirements imposed on the doors by TR 7.2.

UNREVIEWED SAFETY OUESTION ASSESSMENT:

It has been determined that the proposed change does not present an unreviewed safety question because it does not:

1. Involve an increase in probability of occurrence of any accident previously evaluated in the UFSAR because the change does not involve any modifications to any plant systems or operations.

2. Create the possibility of any accident not previously defined in the UFSAR because the change does not involve modifications to any plant systems or operations.

3. Involve a reduction in the margin of safety because it does not affect the margin of safety as referenced in the bases section of the Technical Specifications.

l l

I l

Safety Evaluation Number 94-SE-OT-038 1

DESCRIPTION OF CHANGE DOCUMENT I I

Memo from R. M. Garver to SNSOC, Tech Spec Clarification of UV/DV instrument Channels Clarification of Technical Specification requirements on emergency bus UV / DV incif umant channels for TS 3.3.2.1, Table 3.3-3, Item 7. The Technical Specification is not ciear as to the requirements for placing channels in trip for emergency bus UV / DV input to EDG auto start.

SAFETY EVALUATION

SUMMARY

Technical Specification 3.3.2.1 provides the requirements for Engineered Safety Feature Actuation system instrumentation. Table 3.3-4, item 7 gives the allowable values for UV / DV emergency bus stripping and EDG auto starting.

The subject ESF actuation occurs on a low bus voltage for a given time span.

I Technical Specification 3.3.2.1 requires that the instrument channel be declared inoperable and placed in trip within one hour when the Loss of Power ESF l instrumentation channel trip setpoint is less conservative than the allowable values given in Table 3.3-4. If the voltage sensor relays (27X relays) are deemed i inoperable, then that relay would be placed in trip leaving the circuit with a more conservative 1 of 2 logic for EDG auto start and emergency bus stripping /

loading. But, if the UV or DV timer (62 relay) does not operate within the TS required time frame, then there is some confusion about what should be placed in the tripped condition. Since the timer is fed from all three voltage sensing channels, it would seem that the conservative approach would be to place all three sensor relays in trip. However, placing the sensor relays in trip would cause the Loss of Power ESF actuation to occur (i.e., emergency bus load stripping, EDG auto starting, and emergency bus loads sequencing back on the bus) which would NOT be conservative.

A deliberate initiation of the Loss of Power ESF function when the emergency bus power supply is adequate is an unnecessary challenge to the emergency equipment. As seen from the logic sketch above, it is clear that the intent of the TS is not to actually place the timer in trip. The timer is more appropriately addressed by the actions of TS 3.8.1.1 for emergency diesel operability requirements. When the timer is inoperable, then the associated EDG should also be considered inoperable. This would result in entry into a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> action statement (assuming two independent circuits between offsite and onsite power and the other EDG were operable) to repair the subject timer of bring the unit to I hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and cold shutdown within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />. This TS interpretation is consistent with the requirements of the WOG Standard Tech Spec 3.3.5, condition 'C'.

This Tech Spec clarification should be allowed because it is the :ogical and i conservative interpretation of the requirements of Tech Spec 3.3.2.1. No l unreviewed safety question exists because of the proposed clarification because the probability of an accident or malfunction is not increased. The consequences of an accident or malfunction are not increased because there is still one train of EDG available for accident mitigation. Note that no other active failures are required to be assumed while the plant is in the LCO of TS 3.8.1.1. In addition, no new accidents or malfunctions are created by the proposed TS interpretation.

Although the Technical Specification requirements are not immediately clear, a TS revision (license amendment) is not required because this interpretation is not a change to the Technical Specifications. When the actual EDG auto start logic configuration is reviewed, it is evident what the TS requirements are.

l l

Safety Evaluation Number 94-SE-OT-039 DESCRIPTION OF CHANGE DOCUMENT MDAP-0019 Supplemental Work Instructions for WO 283378-01 These supplemental work instructions allow replacement of the control room meteorological recorders without losing the signal path from the Met Towers to the SPDS/ERF system. (Temporary Modification)

SAFETY EVALUATION

SUMMARY

The current loop interface connecting various meteorological instruments to Control Room recorders and the ERF computer will be momentarily disconnected and then reconnected by using a jumper to bypass the control room Met data recorders. This will permit replacement of the recorders via DCP 91-174. The interface current loop will later be momentarily disconnected to permit including the new recorders. These instruments are required by TS 3.3.3.4 and are necessary to estimate doses to the public if a radiological release occurs. Met instrument outages are not considered unreviewed safety questions. The TS have a seven day Action statement for continuous loss of operability of these instruments.

An unreviewed safety question does not exist because:

1) Only one meteorological signal path is interrupted at a time (backup signal should be available).

2) Each signal path is verified restored operable to the SPDS/ERF system prior to proceeding to the next step.

3) This work is within the bounds of a normal maintenance outage and compliance with the applicable Tech Spec Action statement will be adhered to for this jumper process

4) The severity of all analyzed accidents will not be increased by this activity.

, Safety Evaluation Number 94-SE-OT-040 DESCRIPTION OF CHANGE DOCUMENT UFSAR update for DCP 88-05, installation of Third System Reserve Transformer SAFETY EVALUATION

SUMMARY

The UFSAR is being updated to reflect the installation of equipment under DCP 88-05. The DCP installed a new 230 kV control house, a new 500 kV breaker (H502), relocate the feed for the 500/230 transformer from the 575 Ladysmith line to its own breaker and a half bay, replace the 230 kV existing line breaker with a faster breaker and use it as a low side breaker for the 500/230 transformer, install the 230/36.5 kV third system reserve transformer, install a new 230 kV line breaker, install new 34.5 kV bus 5 including an impedance matching reactor and breakers for it to be able to feed RSSTs A, B, and/or, C.

The actual modification was evaluated previously for unreviewed safety question concerns.

Safety Evaluation Number 94-SE-OT-041 DESCRIPTION OF CHANGE DOCUMENT DR 90-900, PPR 90-022 The need to replace relief valves 1-CC-RV-125 A, B, and C on Unit 1 and 2-CC-RV-225A, B, and C on Unit 2 with relief valves set at a higher pressure has been evaluated. The evaluation determined that the existing relief valves were adequate.

SAFETY EVALUATION

SUMMARY

The CC line supplying water to the RCP Thermal Barrier heat exchanger is protected from over pressure by the aforementioned RVs. These RVs have a setpoint of 1500 psig. A review of system design established that a failure of the RCP thermal barrier heat exchanger could result in a condition where these RVs lift and discharge reactor coolant to the containment at a pressure below the design capability of this portion of the CC system. A design change was initiated to replace these RVs with valves that would be set at 2485 psig to retain reactor coolant in the CC system piping in the event of the thermal barrier failure.

The impact of retaining the existing RVs was evaluated by the Nuclear Safety Analysis Group with respect to increase in the core damage frequency which might result from the use of a RV with a setpoint of 1500 psig rather than the proposed 2485 psig. The evaluation determined that the estimated flow from the RCS would be 275 gpm based on information supplied by Westinghouse. This would categorize the event as a "very small break LOCA" for IPE purposes. The CDF the very small break LOCA is 9.5E 8, and it was also noted that the design of the RCP would also be expected to limit kind of breaks actually experienced with Westinghouse concluding that a credible leak rate from a failed Thermal Barrier tube being only 7.5 gpm. With all this information taken into consideration, it was concluded that the impact on overall CDF for NAPS retaining the existing RVs is insignificant. l i

I l

l i

Safety Evaluation Number 94-SE-OT-042 DESCRIPTION OF CHANGE DOCUMENT I

TRM Revision 4 TR 7.1.8 will be added to the TRM. This new requirement will require notification  ;

of the Station Safety and Loss Prevention Coordinator whenever any fire i suppression systems listed in TR 7.1.8 (or portions of these systems) are )

impaired or reduced in status for any reason. TR 7.1.1 through TR 7.1.7 will be l revised to reference TR 7.1.8 in the event that a system is reduced or impaired j for any reason. TR 12.2 will be revised to include notification of the EO l Coordinator if an EQ Door is latched open. This change has been developed to include the requirement for this notification into the TRM with the fire protection requirements.

SAFETY EVALUATION

SUMMARY

1 MAJOR ISSUES:

This Safety Evaluation was written to determine if adding the requirements to notify the EO Coordinator if an EQ Door is blocked open or the Station Safety and Loss Prevention Coordinator whenever any fire protections systems, portion i of systems, or equipment are impaired or reduced in status for any reason to the I TRM presents an Unreviewed Safety Question. l JUSTIFICATION:

This change is an administrative change only. The current requirements for this  ;

notification are contained in VPAP-2401. The requirement is being placed in the TRM to centralize this requirement with the other fire protection requirements to aid !n plant operations.

UNREVIEWED SAFETY OUESTION ASSESSMENT:

It has been determined that the proposed change does not present an unreviewed safety question because it does not:

1. Involve an increase in probability of occurrence of any accident previously '

evaluated in the UFSAR because the change does not involve any modifications to any plant systems or operations.

2. Create the possibility of any accident not previously defined in the UFSAR because the change does not involve modifications to any plant systems or operations.

3. Involve a reduction in the margin of safety because it does not affect the margin of safety as referenced in the bases section of the Technical Specifications.

Safety Evaluation Number 94-SE-OT-043 DESCRIPTION OF CHANGE DOCUMENT NAPS UFSAR Change 94-016 Added a new section 3.10.3, Use of Seismic Experience Data as an alternate method for seismic verification of Mechanical and Electrical Equipment.

SAFETY EVALUATION

SUMMARY

The Generic Letter 87-02, Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Plants, Unresolved Safety issue (USI) A-46 was issued on 2-19-87. In the letter, the NRC indicated that a direct application of current seismic criteria to older plants could require extensive, and probably impractical modification of these facilities. An alternate resolution of this problem is to use earthquake experience data supplemented by test data. The staff concluded that this approach is the most reasonable and cost-effective means of ensuring that the purpose of General Design Criteria 2 is met for these older plants. The staff also determined that the USl A-46 methodology is also acceptable for verifying the seismic adequacy of future modifications and replacement equipment. Therefore, to change the UFSAR is not an unreviewed safety question.

1 i

l l

l Safety Evaluation Number 94-SE-OT-044 DESCRIPTION OF CHANGE DOCUMENT UFSAR 15.3.1 (Tech Report NE-979) l A revised Small Break LOCA analysis is being implemented based on a reduced 1 assumed minimum high head Si flow rate.

SAFETY EVALUATION

SUMMARY

As documented in the Tech Report, both the small and large break LOCA analyses meet the 10CFR50.46 acceptance criteria with the reduced HHSI flow i rates. The other input parameters for these analyses are bounded by current l Technical Specifications. -

The reduction of the HHSI flow rate assumption has given acceptable results for the LOCA analyses that support station operation. These analyses will support a j reduction in the minimum required HHSI flow rate for acceptance test. This l change to the test acceptance criteria can be implemented following approval of I Tech Specs to remove specific numerical values from TS 4.5.2.h. .

l l

l l

1

Safety Evaluation Number 94-SE-OT-045 DESCRIPTION OF CHANGE DOCUMENT IE Bulletir) 80- 10 / IE'N 91-40 The Safety Evaluation was prepared to evaluate operation of the Component Cooling system as a contaminated system.

SAFETY EVALUATION

SUMMARY

UFSAR Section 9.2.2 identifies the CC system as an intermediate cooling system which transfers heat from heat exchangers containing reactor coolant or other radioactive liquids. As such, the UFSAR recognizes that the CC system may at some time contain radioactive liquid.

The CC system is not used as a mitigating system for any Chapter 15 accident.

Operation of the CC system as a contaminated system will make no changes to the accident precursors or mitigating systems for analyzed accidents. The levels of contamination are not sufficient to challenge EQ of any safety related equipment. Discharge of the system into any buildings which house it will not create a radiation fidd winch could challenge equipment or pa annel.

If the CC cystem ware to rupture and empty into any of the building sumps, the effluent would be processed by the Liquid Waste system. Any gaseous or particulate activity would be detected by the Vent A or Vent B monitors to warn operMxs. Concentration, total curie inventory, and potential credible releases to the envuonment have been calculated by RP and are well below the limits of 10CFR20 and 40CFR190.

The existing Tech Specs cover the necessary requirements for the normal operation of the CC system. Operation of the CC system as a contaminated system requires no change to these Tech Specs.

1 l

l l

Safety Evaluation Number 94-SE-OT-046 DESCRIPTION OF CHANGE DOCUMENT DR 94-997 The Service Water Traveling Water Screens were found severely corroded.

SAFETY EVALUATION

SUMMARY

The SW traveling screens are safety related components which have exhibited  !

excessive corrosion that prohibits inspection of the screen assemblies to )

adequaterf assess and evaluate the remaining structuralintegrity of the screen  ;

assembliet to withstand a design basis loading scenario.  !

The condition does not increase the probability of occurrence or the i consequences of an accident or malfunction of equipment important to safety and l previously evaluated in the UFSAR. The degraded condition of the SW traveling screens will not adversely affect the operation of the SW pumps. If screen failure were to occur, the size and type of debris introduced into the service water pump l bay and the relatively low service water velocity in the vicinity of the screens would not be sufficient to carry the debris to the suction of the SW pump.

Components cooled by SW both during normal operation or upon the receipt of a CDA will continue to operate as designed with the screens in their existing condition. Existing periodic maintenance and testing procedures associated with the SW traveling screens and pumps are indicative that a degraded SW syste.m does not exist. The SW system currently operates as designed.

The condition does not create a possibility for an accident or malfunction of a different type than any evaluated in the SAR. The function and operation of the SW system is not adversely affected as a result of the present condition of the traveling screens. The screens continue to operate as designed. The possibility of an accident or malfunction of a different type than previously evaluated is not created.

The condition does not reduce the margin of safety as defined in the bases section of the Tech Specs. The traveling screens are not discussed in the Tech Specs. The screens are considered a subsystem of the SW pumps and thus no action statements are specifically associated with the screens. The degraded condition of the SW traveling screens will not adversely affect the operation of the SW pumps.

I

Safety Evaluation Number 94-SE-OT-047 DESCRIPTION OF CHANGE DOCUMENT 10CFR50 Appendix R Report incorporates modifications to the plant that impact the Appendix R program.

Updates the program to reflect actual plant conditions.

SAFETY EVALUATION

SUMMARY

This is a document update only. The report serves only as a mechanism to show compliance with 10CFR50 Appendix R.

The changes to the report fall into two categories: DCP changes and engineering evaluation and exemption request changes. The DCP or design changes have been previously evaluated during the design process. This program update merely incorporates these previously approved changes.

i Safety Evaluation Number 94-SE-OT-048 )

i DESCRIPTION OF CHANGE DOCUMENT UFSAR Section 15.4.4, " Locked Rotor incident" This safety evaluation is being performed to support application of the Statistical  ;

DNBR Evaluation Methodology to the Locked Rotor Accident, and to implement into North Anna's design basis a revised Locked Rotor Accident analysis which utilizes a statistical treatment of key DNBR analysis uncertainties.

SAFETY EVALUATION

SUMMARY

j An evaluation of the applicability of the Statistical DNBR Evaluation Methodology l (Stat DNB) to the Locked Rotor accident has been performed and documented in Technical Report NE-951, Revision 1 (" Application of the Statistical DNBR Evaluation Methodology to the Locked Rotor Accident; Surry and North Anna Units 1 and 2," dated May,1994). The results of this evaluation may be  ;

summarized as follows. l l

1. The Statistical DNB Evaluation Methodology is technically applicable to  !

the Locked Rotor accident, since the North Anna Surry Stat DNB implementation i analyses considered thermal / hydraulic conditions which encompass those experienced during a Locked Rotor accident.

2. The Statistical DNB Evaluation Methodology is applicable to the Locked  !

Rotor accident in a licensing context. An evaluation of the Stat DNB Topical Report; Technical Specifications Change Submittals and Safety Evaluation Reports; Technical Reports; and implementation and Uncertainty calculations for Surry and North Anna confirmed that application of the methodology to the Locked Rotor event is consistent with the implementation guidance presented in the Stat DNB Topical Report and the NRC SER's.

3. Application of the Stat DNB Evaluation Methodology to the Locked Rotor event does not create an Unreviewed Safety Question: ,

a. The probability of occurrence of a Locked Rotor accident is not increased by application of the Statistical DNBR Evaluation Methodology.

Application of an analytical methodology has no effect on accident initiators.

Further, future utilization of the analytical margin made available by a statistical treatment of key analysis parameter uncertainties (RCS pressure, temperature, flow, core power, reactor coolant bypass flow, the radial core power peaking factor (FAH), and the radial peaking factor engineering uncertainty (FAHe)) to relax reload design limits for these same parameters will not affect the probability of occurrence of a Locked Rotor accident.

i

b. The consequences of a Locked Rotor accident are not increased l by application of the Statistical DNBR Evaluation Methodology. The Locked )

Rotor accident analysis determines the fraction of fuel rods which experiences l Departure from Nucleate Boiling (DNB) and, hence, fail during a Locked Rotor accident. The fraction c,f fuel rods which experiences DNB is limited to the fuel failure fractions assumed in the currently applicable dose calculations (i.e.,5% for Surry and 13% for North Anna). The accident analysis has traditionally accommodated key analysis uncertainties deterministically (i.e . uncertainties have been individually applied to the accident analysis initial cor dltions). The Virginia Power Statistical DNBR Evaluation Methodology provides for a statistical treatment of key DNB analysis uncertainties, including those associated with RCS pressure, temperature, flow, core power, reactor coolant bypass flow, the radial core power peaking factor (FAH), and the radial peaking factor engineering uncertainty (FAHe). The allowance for uncertainties provided by the Stat DNB Methodology bounds the actual effect of uncertainty in key DNB analysis parameters with 95% probability at 95% confidence. This conclusion has been affirmed by the NRC in their Safety Evaluation Reports on the Surry and North Anna Stat DNB implementation analyses. Therefore, it is concluded that the Virginia Power statistical treatment of key DNB analysis parameters provides a high degree of confidence that the actua/ number of fuel failures, and hence the accident consequences, remains unchanged.

i

c. The margin of safety in the Locked Rotor accident analysis is not reduced by application of the Statistical DNBR Evaluation Methodology.

i Application of the Stat DNB Methodology potentially affects only the detailed core thermal / hydraulics portion of the analysis. (Acceptable overpressurization results are demonstrated with a deterministic treatment of key analysis uncertainties.) In a deterministic DNB analysis such as that currently performed for the Locked Rotor accident, key analysis uncertainties are factored into the transient of DNBR analysis initial conditions, and the resulting DNBR is compared to the CHF correlation limit (e.g.,1.17 for WRB-1). A DNBR result above the CHF correlation limit ensures that the appropriate margin to assumed failure is maintained. For deterministic DNB analyses, the margin of safety is inherent in the CHF correlation limit.

In statistical DNB analyses, key analysis uncertainties are considered by adjusting the CHG correlation limit to conservatively account for the effect of parameter uncertainties. The DNBR calculated in the analysis is compared to the adjusted CHF correlation limit (i.e, the statistical DNBR limit), and the transient or DNBR analyses may be initiated from nominal conditions. Because (a) Stat DNB is an NRC-approved methodology for considering the impact of key DNBR analysis parameter uncertainties under thermal / hydraulic conditions such as those experienced during a Locked Rotor accident, and (b) the margin of safety inherent in the WRB-1 CHF correlation limit of 1.17 is maintained, it may be concluded that the margin of safety in the Locked Rotor accident analysis is not reduced by application of the Statistical DNBR Evaluation methodology.

4. Supplemental (i.e., non-licensing-basis) analyses demonstrate that there is a high degree of conservatism within the currently accepted analysis

s

. methodologies, making it highly unlikely that the fraction of fuel failure assumed- ,

in current dose analyses could ever be achieved. -

The currently applicable overpressurization analyses utilize a deterministic treatment of uncertainties, and will not change as a result of this evaluation.

4- On the basis of the evaluation documented in NE-951, it has been concluded that there are no technical or licensing concerns raised by the application of Stat DNB .;

to the Locked Rotor Accident, and that application of Stat DNB to the Locked  !

Rotor Accident may proceed via the provisions of 10 CFR 50.59.

t O

t 5

s

)

)

r j

t 8

e

w. , .-.n , .,, . w , .,

Safety Evaluation Number 94-SE-OT-049 DESCRIPTION OF CHANGE DOCUMENT Technical Specifications North Anna Unit 1 UFSAR Chapter 4, Chapter 15 VEP-FRD-42 Rev 1-A," Reload Nuclear Design Methodology" Reload and operation of North Anna Unit 1 Cycle 11. This reload incorporates the following mechanical features described in Technical Report NE-992 Rev 0 for North Anna Unit 1:

1. Vibration suppression damping assemblies (VSDA) are being placed in V5H fuel assemblies used in baffle locations.

2. Rotation of alternate mixing vane grids in the fresh fuel to suppress assembly vibration.

3. Minor modifications to the fresh fuel to enhance debris resistance including a new protective grid being added directly above the bottom nozzle.

In addition, starting with the fresh feed assemblies for North Anna Unit 1 Cycle 11, all North Anna fuel assemblies will be fabricated with fuel cladding, guide thimble tubes, instrumentation tubes and mixing vane grids made from Westinghouse's advanced zirconium alloy, ZlRLO.

SAFETY EVALUATION

SUMMARY

A safety evaluation has been performed to determine whether an unreviewed safety question will result from the refueling and operation of North Anna Unit 1 Cycle 11. In this evaluation, reload cycle parameters have been calculated and compared to the existing safety analysis assumptions. These parameters have been shown to be either 1) explicitly bounded, or 2) accommodated by existing safety analysis margin and/or conservatism.

The impact of the following mechanical design changes and use of ZlRLO materialin the reload fuel have been accounted for in the appropriate evaluations performed for Cycle 11:

1. Vibration suppression damping assemblies being placed in Vantage 5H fuel assemblies used in core baffle locations.

2. Rotation of alternate mixing vane grids for the fresh fuel to suppress assembly vibration.

3. Minor modifications to the fresh fuel to enhance debris resistance, including a new protective grid being added directly above the bottom nozzle.

4. Minor dimensional changes in the fuel rod and fuel assembly design due to the use of ZlRLO material for fuel cladding and skeleton components.

The following reload cycle parameters were found to be outside the range of the current safety analysis input assumptions: (i) The most negative Doppler power coefficient vs. power is not bounded by the analysis assumptions below

approximately 16% rated power. (ii) Two of the peripheral assembly RPDs in Cycle 11 are slightly higher than those assumed in the current PTS analysis. In accordance with VEP-FRD-42 Rev 1-a, " Reload Nuclear Design Methodology,"

an evaluation was performed to determine the impact of the parameters on the currently applicable safety analyses.

The Doppler power coefficient (DPC) provides a measure of reactivity feedback that affects transients sensitive to changes in heat flux and reactor power after trip and transients where large power spikes may occur. The unbounded DPC was accommodated by showing that the power-integrated reactivity contribution -

the Doppler defect - which is used as input in the safety analyses remains bounded by the input assumptions.

The more limiting peripheral assembly RPDs could result in a slightly higher fluence to the vessel during Cycle 11 than was assumed in the PTS analysis.

The slight increase in fluence will not cause PTS screening criteria to be exceeded during Cycle 11 operation; nor will it have any significant impact on reactor vessel operability over the life of the plant. The change in projected vessel fluence is insignificant. This conclusion will be confirmed by one or more vessel fluence analyses to be performed well before the expiration of the Unit 1 operating license.

The results of this evaluation can be summarized as follows:

1. No increase in the probability of occurrence or consequences of an accident will result from this core reload. The reload creates only incremental changes in the values of parameters previously shown to be significant in determining core response to known accidents. Since the currently applicable safety analyses remain bounding for North Anna Unit 1 Cycle 11, it is concluded that operation with the proposed reload will neither increase the probability of occurrence nor the consequences of initiating events for any known accident.

2. N1C11 reload fuel incorporates changes in mechanical design and in the material used for cladding and skeleton components. However, there have been no changes which would violate currently applicable safety analysis limits.

Further, the effects upon system accident response are fully described by the parameters evaluated; and therefore, operation with this core does not create the possibility of an accident of a different type than any which has been evaluated previously in the Safety Analysis Report.

3. The effects of reload parameter variations were accommodated within the conservatism of the assumptions used in the applicable safety analyses. These analyses have demonstrated that calculated results meet all design acceptance criteria as stated in the UFSAR. Therefore, the margin of safety is not reduced for North Anna Unit 1 Cycle 11 reload.

t. ,

i J l The conclusions stated above are based on the following: ,

i

1. Operation at a maximum core thermal power which does not exceed 2893  !

M W t.  ;

i

2. Cycle 11 burnup'will not exceed 21,000 MWD /MTU for EOC10 = 17,800  ;

MWD /MTU, or 19,000 MWD /MTU for EOC10 = 20,000 MWD /MTU. This limit

~

includes approximately 3,000 MWD /MTU for power coastdown from end of full power reactivity.  ;

3. There is adherence to plant operating limitations as stated in the Technical

- Specifications and the Core Operating Limits Report.  !

4. A maximum FO of 2.19 as modified by K(Z)is not exceeded.

i

5. RCCA fully withdrawn position of 225 steps.

, 6. Use of ZlRLO material in place of Zircaloy-4 in fresh fuel cladding and skeleton components. ,

i i

t a

L i

e < - .- . , - - _

i i

Safety Evaluation Number 94-SE-OT-050 DESCRIPTION OF CHANGE DOCUMENT UFSAR Change Request to revise Table 3.8-12 PAR,1-PT-9, " Main Reservoir - Reference Monuments," to delete.

1 UFSAR - delete " Reference Monuments" from Table 3.8-12, Geotechnical Instrumentation Summary. This will delete the 10 yr survey implemented by 1-PT-9 to determine horizontal and vertical stability of Reference Monuments A, B, E and F and the main dam. Delete 1-PT-9.

SAFETY EVALUATION

SUMMARY

The Reference Monument survey (1-PT-9) is performed to verify location of reference monuments at the North Anna Main Dam with the United States Coast and Geological Survey Monuments. Frequency of this survey is once every 10 years. It was determined that this survey yields no significant information on settlement or alignment and can be deleted.

Reasons for this decision are as follows:

I

1. The Main Dam reference monuments are founded in rock and are inherently mora stable than the USC&G Survey monuments, founded in soil.

2. The relatively long distance (41/2 miles) between the reference monuments and the USC&G monuments inherently induces survey error.

3. An annual survey will continue to be performed to monitor settlement and alignment of the main dam even after the Reference Monument Survey (1-PT-9) is deleted.

An unreviewed safety question does not exist because settlement and alignment of the Main Dam will still be monitored annually. Therefore overallintegrity of the Main Dam and plant is maintained, margins of safety are not decreased, there are no changes to Technical Specifications and probabilities and consequences of accidents will not increase.

l l

l

I l

Safety Evaluation Number 94-SE-OT-051 DESCRIPTION OF CHANGE DOCUMENT i

l TSR's #94-TSR-006,014,015, & 22 it is proposed to place lead blanket shielding on selected reactor coolant and letdown lines in NAPS Unit 1 during the 1994 refueling outage. The dead weight of the lead blanket shielding will be carried by the subject Safety-Related piping for which a 10CFR.59 Safety Evaluation must be performed. Shielding is proposed to be placed on a reactor coolant spray line (i.e. several locations),

reactor coolant 2" bypass lines for loops "A", "B", and "C", and loops "A" letdown lines.

SAFETY EVALUATION

SUMMARY

MAJOR ISSUES:

Each outage, ALARA chooses ce tain lines to be externally shielded to reduce general area dose rates in support of the ALARA goals. In certain instances, the shielding must be placed directly on the pipe to be an effective radiation shield.

When lead blanket shielding bears directly on seismic plant piping, its dead weight must be added into the seismic pipe stress analysis in order for that analysis to remain valid. This year, ALARA has selected the following lines to be externally shielded in support of the ALARA goals for the 1994 NAPS Unit 1 refueling outage:

94-TSR-006: PZR Spray Line,4"-RC-15-1502-01, near 01-RC-PCV-1455A & B 94-TSR-014: 2" Flow Element Bypass Lines in RCP Motor Cubicles A, B, & C at EL. 262'-10" 94-TSR-015: PZR Spray Line,4"-RC-15-1502-01, near 01-RC-E-2 top nozzle 94-TSR-022: Letdown Line,2"-CH-5-1502-01, along horizontal tap off "A" Cold Leg to 01-CH-HCV-1460A & B The major issue associated with all four of these TSR's is the seismic structural stability of the lines and associated supports with the proposed lead blanket shielding installed. This issue is of primary importance on 94-TSR-06,015, &

022 since the lines associated with the TSR's are non-isolable in Modes 5 and 6.

Failure in any of the tributary segments of these lines could cause an isolable leak in the RCS Therefore, this seismic evaluation considers these lines to be full of water while carrying the dead load of the shielding under seismic load conditions in Modes 5 and 6. The 2" Flow Element Bypass lines are isolable and will be drained before lead blanket shielding is placed on them. This will require a special seismic evaluation to determine the resulting stresses under the dead load of the lead shielding. )

l l

Calculation No. CE 1163, Rev. O, was performed to justify the additional dead weight of the lead blanket shielding on PZR spray line,4"-RC-15-1502-Q1, during Modes 5 and 6. Calculation No. CE-1097, Rev. O, was performed to justify the additional dead weight of lead blanket shielding on the three 2" diameter bypass flow element lines in the RCP motor cubicles. All TSR installation and removal operations are controlled under VPAP-2105 and the applicable HP Work Procedures.

UNREVIEWED SAFETY OUESTION ASSESSMENT:

1. The probability of experiencing a design basis seismic event is unrelated to the installation of this lead blanket shielding in containment.

2. Since the affected piping systems have been seismically analyzed and their responses were found to be within acceptable limits, there is no identified increase in the consequences related to a design basis seismic event.

3. Seismic concerns are the main issues associated with these TSR's. No other programmatic issues are known to be affected by the attachment of temporary lead blanket shielding to piping. As such, no accidents of a different kind are expected.

4. Margins of safety are not reduced. Seismic analyses have shown that the resulting stresses are within the piping design allowable limits.

l Safety Evaluation Number 94-SE-OT-052 DESCRIPTION OF CHANGE DOCUMENT Technical Specification Change Package #319 j Change the frequency of the functional surveillance test of the hydrogen Recombiners from once every six months to once per 18 months as per NRC Generic Letter 93-05, delete the requirement for a continuity check of Recombiner heaters and add exemption to Specification 3.0.4 on Unit 1 to be consistent with Unit 2 Tech Specs and be in conformance with NUREG-1431,

" Standard Technical Specifications - Westinghouse Plants", replace the "2" symbol with " greater than or equal to" in Unit 1 TS 3.6.4.2 for readability, and insert " hydrogen recombiner" before " purge blower"in both units for clarification.

Revise the surveillance testing of the Hydrogen Recombiner System as per NRC documents and have both units TS in agreement with NUREG-1431.

SAFETY EVALUATION

SUMMARY

Changing the test frequency of the Hydrogen Recombiner System, deleting the requirement of continuity testing of the Recombiner heaters, clarifying which purge blower is to be tested, and allowing exception to Specification 3.0.4 on Unit 1 does not affect the probability of occurrence of the accidents identified in the UFSAR since there are no modifications in the physical characteristics of the plant or changes in operation of the plant. Testing of the Hydrogen Recombiner System once per 18 months is adequate to ensure that the Hydrogen Recombiner System will be capable of performing its intended safety function.

Changing the test frequency of the Hydrogen Recombiner System, deleting the requirement of continuity testing of the Recombiner heaters, clarifying which purge blower is to be tested, and allowing exception to Specification 3.0.4 on Unit 1 does not affect the consequences of the accidents identified in the UFSAR.

The Hydrogen Recombiner System will continue to be operable when required to perform its design function. Testing of the Hydrogen Recombiner System once per 18 months is adequate to ensure that the system will be capable of performing its intended safety function. Therefore, the consequences of any accident previously identified is not altered by these changes.

The change in surveillance frequency from once every six months to once per 18 months, deleting the requirement of continuity testing of the Recombiner heaters, l clarifying which purge blower is to be tested, and allowing exception to Specification 3.0.4 on Unit 1 does not affect plant or Hydrogen Recombiner System operations. The Hydrogen Recombiner System is not being operated in a different manner. Therefore, no new accident precursors are being generated.

Changing the test frequency of the Hydrogen Recombiner System, deleting the requirement of continuity testing of the Recombiner heaters, clarifying which j l

__ _ _ l

purge blower is to be tested, and allowing exception to Specification 3.0.4 on Unit 1 will not significantly increase the probability of a malfunction of the Hydrogen Recombiner System to operate when required to perform its intended safety function. The Hydrogen Recombiner System will continue to be tested in a manner that will ensure the system is capable of performing its intended safety function. Therefore, this change will not increase the consequences of any malfunctions identified above.

Operability requirements for the Hydrogen Recombiner System are not being changed. Testing of the Hydrogen Recombiner System once per 18 months is adequate to ensure that the Hydrogen Recombiner System will be capable of performing its intended function. The system operability requirements will ensure the Hydrogen Recombiner System is operable when required. Therefore, this change does not reduce the margin of safety as described in the Technical Specifications.

Based on the above conclusions, it is determined that an unreviewed safety question does not exist.

l l

l i

i l

l

- Safety Evaluation Number 94-SE-OT-053 DESCRIPTION OF CHANGE DOCUMENT SECL-94-156A Westinghouse Safety Evaluation of Plant Operation with Erosion - Corrosion of the Steam Generator Feedrings Visual inspection of the Unit 1 'A' Steam Generator indicates that erosion /

corrosion (e/c) is occurring on the feedring at the inconnel J-tube interface. 'B' and 'C' Steam Generators were not inspected but are expected to have similar levels of e/c.

SAFETY EVALUATION

SUMMARY

The assessment of the operation of the North Anna Unit 1 steam generators includes an evaluation of:

• The potential for J-tubes to separate from the feedring, become loose parts, and interact with the primary pressure boundary.

• Feedwater jet impingement on the shell and internal due to perforations in the feedring and the potential for the generation of loose parts.

• The potential for bubble collapse water hammer in the steam generator feedring due to drainage of the feedring.

Based on the evaluation it was concluded that the operation of North Anna Unit 1 with a degraded feedring in SG A and potentially in SG B, and SG C, as described within the evaluation, for a period of time consistent with routine ,

inspections of the secondary side of the steam generators does not represent an unreviewed safety question.

l

__ -_______.___._-__-__-_0

I Safety Evaluation Number 94-SE-OT-054 DESCRIPTION OF CHANGE DOCUMENT DR 94-1529 on 01-RC-MOV-1593 as-left condition An evaluation was performed on the on the as-left condition of the "B" cold leg loop stop valve. The evaluation concluded that the method to reduce the loading on the valve stem was acceptable and there were no concerns with valve integrity.

SAFETY EVALUATION

SUMMARY

During inspection of the deflection of the spring compensator for the "B" loop stop valve, the torque switch setting was also checked and noted to be outside of the allowable band in the setpoint document. This would result in the compensator deflection being as high as it was. To resolve the problem, the valve was manually stroked closed eight hand wheel turns. This reduced the deflection from 9/23" to less than 3/16". The concern with the excessive loading on the stem is potential failure of the 17-4PH stem due to embrittlement. This failure has occurred on other plants PORV block valves and review of the Westinghouse letter sent out documenting the condition concluded that it could be applicable to the loop stop valves. One factor which affects embrittlement of the material is the temperature to which it is exposed. The Westinghouse letter stated that exposure to temperatures in excess of 600F cou;d result in the material becoming brittle and failing.

The as-left condition of the loop stop valve is acceptable for the following conditions:

• The as-left deflection of the compensator is within the allowable value provided ,

by Westinghouse.

• UT inspection of the stem was performed SAT during the previous outage.

• The temperature to which the cold leg loop stop valve is exposed to is approximately 550F which is below the value given by Westinghouse therefore the potential for embrittlement is less.

• The limit switch cover is hinged on one side and is held closed by 12 bolts.

With one bolt missing, eleven remain to ensure the cover remains closed.

• The valve stem is still back seated, therefore the potential for stem leakage is not increased.

Since the loop stop valve is only used for maintenance purposes during the outage and its operation and pressure integrity are not affected by this evolution, it is acceptable and no unreviewed safety question exists.

l l

Safety Evaluation Number 94-SE-OT-055 ,

DESCRIPTION OF CHANGE DOCUMENT

• Scaffolding Request M-7976, for work associated with WO# 300923. One 3 foot tall buck of scaffolding will be installed on the 291' elevation of containment near the 01-HV-F-92C fan.

= Temporary repair of 01-WT-505 in accordance with 0-MCM-1904-01, "On-line leak repair using contractor leak repair methods."

This review will address leaving the scaffolding in the containment until the work is complete on the body to bonnet leak associated with 01-WT-505, "C" S/G wet lay-up line. It also address the leak repair associated with 01-WT-505.

SAFETY EVALUATION

SUMMARY

During the ASME leak check in containment,01-WT-505 was identified during the walk down as having a body to bonnet leak. 01-WT-505 is located on the wet lay up line associated with the "C" steam generator. It is the wet lay-up header outlet isolation valve. WO# 300923-01 was written to inject the valve to stop the leak. In order to inject the valve, maintenance requires that scaffolding be erected on the 291' elevation of containment near the 01-HV-F-92C fan.

Scaffolding request M-7976 was initiated to erect a 3 foot tall buck of scaffolding by the "C" S/G adjacent to the "C" 92 fan. The scaffolding will have to remain inside containment for a short period of time while the work is being performed.

The scaffolding will be immediately removed when the maintenance on 01-WT-505 is complete.

Engineering has reviewed the scaffolding request and determined that the location of the scaffolding would not adversely affect any safety related structure or component should it fail. The scaffolding will be constructed in accordance with VPAP 1903. In addition, the amount of aluminum and zinc added to the containment would not significantly add to the hydrogen concentration nor will the extra amount of zinc add significantly to the sump concentrations which would interfere with the inside RS pumps during an accident condition.

The scaffolding will not be erected over any safety related equipment / cabling nor will it have the potential for common mode failure per Engineering review of location and structure. In addition, Engineering has reviewed the location, installation and given permission to erect the structure for the repair work. All work associated with the repair of 01-WT-505 has been reviewed and approved by 0-MCM-1904-01.

Failure of the scaffolding during an accident would not result in the clogging of the Recire Spray sump due to the installed grating and screens.

An unreviewed safety question does not exist due to aforementioned reasons.

i l

Safety Evaluation Number 94-SE-OT-056 DESCRIPTION OF CHANGE DOCUMENT North Anna Technical Requirements Manual (TRM)

This change to the TRM adds a specific requirement for the periodic visual inspection of fire doors and dampers. Also, editorial changes were made to add a listing of the required fire dampers and to clarify definitions.

SAFETY EVALUATION

SUMMARY

The addition of periodic surveillance of penetration fire doors and dampers does not create an unreviewed safety question. An Appendix R fire is the accident that is expected and the addition of these surveillance requirements will not increase the probability or consequences of this type of accident. It is not expected that the addition of visual inspection surveillance will create any malfunctions.

Margins of safety in the Tech Specs will not be affected and neither will the Technical Specifications themselves.

This change is an upgrade to the Technical Requirements Manual to add an additional surveillance. This surveillance is required and was previously left out of the TRM. The procedures are currently in place to meet the surveillance.

This change will enhance the fire protection program and will not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

v

1 l

Safety Evaluation Number 94-SE-OT-057 DESCRIPTION OF CHANGE DOCUMENT W. O. 00301908 Engineering Letter of Transmittal CE-94-027 Work Procedure C-CAF-001 Building Erection of CAF Work Procedure C-CAF-002 Removal of CAF The security department requires the inside security fence to be raised approximately 4'in the vicinity of the Containment Access Facility (CAF) for the duration of the U2 Steam Generator Replacement Project.

SAFETY EVALUATION

SUMMARY

The major issues considered are:

1. Providing adequate station security while the containment access facility is located adjacent to the western security fence. The fence is to be raised approximately 4'.

2. Removal of this temporary fence extension and return of said fence to original configuration.

The raising of the fence should be allowed because it is a compensatory measure for having the CAF in close proximity to the security fence. The security department will also require lighting, per the security plan, and closure fence and locked gates to restrict personnel in the space between the CAF and fence.

Removal of the taller fence and return to its original configuration is ensured by work order and work procedure. Per security, the security plan may be revised.

An unreviewed safety question does not exist because:

1. There are no changes to TS or the UFSAR.

2. Probabilities or consequences of accidents or malfunctions of equipment are not increased. A portion of the security fence is being raised to provide compensatory security measures for the erection of the CAF.

3. Margin of safety will not change due to raising the security fence.

1 Safety Evaluation Number 94-SE-OT-058 l l

DESCRIPTION OF CHANGE DOCUMENT '

North Anna Unit 1 and Unit 2 Facility Operating Licenses, Appendix B, Environmental Protection Plan (EPP)

The EPP is updated to reflect current Federal and State regulatory requirements i pertaining to minimizing the impact of operating the North Anna Power Station on l the surrounding environment. The changes include identifying the Virginia Soil  !

and Water Conservation Board as the regulatory authority for erosion control l issues within the North Anna transmission corridor rights-of-way, providing an )

optional 25% extension for the annual surveillance frequency of the site erosion i control program, revising the title of Sate agencies and permits to reflect current titles, updating the text to reflect current status of certain studies and monitoring programs, and making various minor administrative corrections.

SAFETY EVALUATION

SUMMARY

A proposed change, test, or experiment shall be deemed to involve an unreviewed safety question (i) if the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety ,

previously evaluated in the safety analysis report may be increased; or (ii) if a l possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (iii) if the margin of safety as defined in the basis for any technical specification is reduced.

The likelihood that an accident will occur is neither increased nor decreased by this change to the Environmental Protection Plan (EPP). Updating the EPP to reflect current requirements would not be a precursor to nor cause of an accident I or other previously analyzed accident in the UFSAR. The only plausible adverse l effect is that erosion in the transmission rights-of-way could be allowed to l propagate further than the current program allows for (i.e., surveillance  ;

inspections for erosion in these areas would be accomplished once every three  !

to five years rather than annually). However, the degree and nature of erosion noted thus far in these areas, the inherent design of the transmission towers (concrete bases are buried between 10 and 35 feet underground), and the annual inspections of transmission lines and towers to ensure that they remain in good repair assure that erosion control issues will not be translated into operability concerns. The consequences of a malfunction of equipment important I to safety previously evaluated in the UFSAR are not increased by this change, since this is primarily an update reflecting current regulatory requirements, State agencies and permits, and focusing on environmental issues associated with operation at the nuclear facility. The EPP's consistency requirements for plant design and operation and NRC reporting requirements remain unchanged j (except for correcting certain references). Therefore, this change to the EPP j does not adversely impact the design or operation of plant equipment.

l

. i

)

Updating the EPP will not produce a new accident scenario or produce a new type of equipment malfunction since no physical modifications are being made and station operations are not affected.

The EPP does not impact any margin of safety described in the Safety Analysis Report documents (i.e., Technical Specifications, UFSAR, or Final Environmental Statement). The EPP update will eliminate redundancy, clarify current regulatory requirements, and focus greater attention upon those regulatory requirements associated with the operational phase of North Anna Power Station. Thus, no margin of safety is impacted by this proposed change.

l l

l Safety Evaluation Number 94-SE-OT-059 DESCRIPTION OF CHANGE DOCUMENT UFSAR Section 15.2.4 (Uncontrolled Boron Dilution) ,

i implement a revised Uncontrolled Boron Dilution analysis at North Anna Units 1 l am ' ;

SAFETY EVALUATION

SUMMARY

The revised analysis demonstrates that North Anna operation within the limits prescribed by Technical Specifications, including maintenance of minimum shutdown margin requirements and Mode 3-6 lockout of the primary grade water flow path, ensures that all generic ANS Condition 11 acceptance criteria are met:

1. Fuel cladding integrity is maintained during postulated Boron Dilution events in all North Anna operating modes.

2. RCS and main steam system pressures remain below 110% of design pressure d".ing postulated Boron Dilution events in all North Anna operating modes.

i

3. A Boron Dilution event initiated in any North Anna operating mode will not generate a more serious (Condition lli or IV) event without other faults occurring indepen&itly.

More specifically, I

1. The DNB consequences of the Boron Dilution at Power accident are bounded in severity by those of the Rod Withdrawal at Power event.

2. RCS and main steam pressures during a Boron Dilution at Power event are bounded by those of more limiting transients (Loss of Load, Locked Rotor, and Rod Withdrawal at Power).

3. The pressurizer overfill results of the Boron Dilution at Power event are bounded by those of the Rod Withdrawal at Power analysis.

4. Calculated reactivity insertion rates for the current North Anna reloads could be increased by approximately 60% before the Boron Dilution at Power "Available Operator Response Time" criterion would be violated.

5. The Mode 2 (startup with reactor critical) Boron Dilution analysis demonstrates that 15 minutes are available for corrective operator action prior to loss of shutdown margin li rods are withdrawn beyond the Rod Insertion Limits. During

approach to critical (Mode 2), adequate available operator response time is provided by withdrawn shutdown rods.

6. Lockout of the primary grade water flow path precludes Boron Dilution events in Modes 3 through 6.

Implementation of the revised Boron Dilution analysis does not increase the probability of occurrence of a Boron Dilution event, or create any new accident initiators: No changes are being made to allowable North Anna Unit 1 and 2 operating conditions. Technical Specifications presently prescribe Mode 3 through 6 lockout of the primary grade water flow path. The licensing basis (North Anna Boron Concentration increase Safety Evaluation Report (SER))

requires lockout of the primary grade water flow path to preclude the possibility of a Boron Dilution event, or demonstration of adequate time for corrective operator action (30 minutes during refueling; 15 minutes otherwise) in response to an inadvertent Boron. Dilution event. Implementation of the revised Boron Dilution analysis does not increase the consequences of a Boron Dilution event, or decrease the margin of safety as defined in the basis for any Technical Specification: As described above, all generic ANS Condition 11 acceptance criteria, and the specific analysis acceptance criteria established by regulatory guidance and the Safety Evaluation Reports for North Anna Technical Specification change submittals continue to be met.

I l

t r

Safety Evaluation Number 94-SE-OT-060 DESCRIPTION OF CHANGE DOCUMENT l UFSAR Section 15.2.1 (Rod Withdrawal from Subcritical) l Implement a revised North Anna Units 1 and 2 Rod Withdrawal from Suberitical l accident analysis.

l SAFETY EVALUATION

SUMMARY

The revised RWSC accident analysis includes the following assumptions to l

minimize core DNBR and maximize transient pressure:

1 For the DNBR case:

1. Minimum initial steady state pressurizer pressure (2220 psia)

2. Minimum steady state pressurizer level (16.4% level span)

3. Full credit is taken for operation of the pressurizer PORV's and sprays.

For the overoressure case:

4. Maximum initial steady state pressurizer pressure (2280 psla) )

5. Maximum steady state pressurizer level (33.4% pressurizer level span)

6. No credit is taken for operation of either the pressurizer PORV's or sprays.

For the overoressure and DNBR cases:

7. A bounding least negative temperature Doppler temperature coefficient (DTC)

8. A most positive moderator temperature coefficient (MTC) (+6.0 pcm/F)

9. A bounding large BOC Beff The revised analysis demonstrates that North Anna operation within the limits prescribed by Technical Specifications, including the limits expressed in the Core Operating Limits Report (COLR), ensures that all generic ANS Condition 11 acceptance criteria are met:

1. Fuel cladding integrity is maintained during postulated RWSC events in all North Anna operating modes, since the minimum DNBR remains above the 95%

probability / 95% confidence DNB correlation limit.

2. RCS and main steam system pressures remain below 110% of design i pressure during postulated RtNSC events in all North Anna operating modes.

f l 3. An RWSC event initiated in any North Anna operating mode will not generate a more serious (Condition lll or IV) event without other faults occurring l

1 l

l . ..

I Safety Evaluation Number 94-SE-OT-061 DESCRIPTION OF CHANGE DOCUMENT North Anna Power Station UFSAR Section 15.2.5, Partial Loss of Forced Reactor Coolant Flow North Anna Power Station UFSAR Section 15.3.4, Complete Loss of Forced Reactor Coolant Flow (

A revised analysis of the Complete Loss of Reactor Coolant Flow translent is being incorporated into the licensing analysis basis for North Anna Units 1 and 2.

The revised analysis takes credit for reactor trip on low flow in any RCS coolant loop, versus trip on RCP undervoltage or underfrequency in the existing analysis.

With this analysis, the low flow trip becomes the primary trip for mitigating this event, while the undervoltage and underfrequency trips become backup trip functions. The revised analysis is based on extensive sensitivity studies to determine the worst case loss of flow scenario.

SAFETY EVALUATION

SUMMARY

This safety evaluation implements a revised analysis of the Complete Loss of Reactor Coolant Flow transient (the most limiting UFSAR loss of flow event) which also provides a bounding analysis for the Partial Loss of Flow event. The revised transient analysis takes no credit for the undervoltage and underfrequency reactor trips, which are the primary trips in the existing analysis for events in which power is lost to all RCPs. In the reanalysis, reactor trip was assumed to occur on low reactor coolant flow in any loop, with a setpoint of 87%

of minimum measured RCS flow, and a 1.0 second trip delay. A penalty to retained DNBR margin is used to accommodate TS minimum flow below the flow used in the analysis. The revised analysis basis assumes that the primary reactor trip is the trip on low flow in any coolant loop. Reactor coolant pump undervoltage and underfrequency are retained as backup trips for loss of flow events. For the revised analysis two cases were run, modeling these situations:

1) simultaneous loss of voltage to all RCPs and 2) an underfrequency coastdown of all RCPs, at a rate of 5 Hz/second. The results of both cases meet the design limit for Departure from Nucleate Boiling Ratio (DNBR), for North Anna 1 and 2 cores.

The analysis explicitly accounts for the "back-EMF" issue of Westinghouse Technical Bulletin NSD-TB 92-03-R0 by assuming a prompt 5% drop in pump output which exceeds the expected reduction at the undervoltage setpoint. The analysis is based on extensive sensitivities to various thermal-hydraulic, reactivity, and secondary side parameters to determine the limiting set for accident analysis.

This analysis revises the analytical basis for the RCP undervoltage and underfrequency reactor trip circuits. The revised design basis requires operability

independently. This conclusion is substantiated by the " pressurizer fill" analysis results.

implementation of the revised RWSC analysis does not increase the probability of occurrence of a RWSC event, or create any new accident initiators. No changes are being made to allowable North Anna Units'1 and 2 operating conditions defined by Technical Specifications and operating procedures or to any plant design feature. Implementation of the revised RWSC analysis does not increase the consequences of a RWSC event, or decrease the margin of safety as defined in the basis for any Technical Specification. As described above, all generic ANS Condition 11 acceptance criteria continue to be met.

I l

d 4-

.- ,, , , .- , - - , - . , - ,, , , - , , - , - c-, . , - . . ,, .- , n ,, - --

of the RCP undervoltage and underfrequency trips only as a backup to the low flow trip. The undervoltage and underfrequency trips must be maintained operable per existing TS requirements.

MINIMUM DNBR FOR LOFA TRANSIENTS (REFERENCE 1 ANALYSIS)

MDNBR/ Time (sec) MDNBR Limit Undervoltage 1.565 / 9.0 1.46 Underfrequency 1.550 / 4.7 1.46 These results demonstrate that the fuel cladding integrity will be maintained by the actuation of the low flow reactor trip signal for all Loss of Flow events (both partial and complete).

Even though the analysis takes credit for a reactor trip on low RCS flow in any loop (which occurs later in time than the trip assumed in the existing analysis of record), the revised analysis results meet the design limits for Departure from Nucleate Boiling Ratio (DNBR) for North Anna 1 and 2 cores. Therefore, these changes do not constitute an unreviewed safety question, as indicated by the following:

1. No increase in the probability of occurrence or consequences of an accident will result from implementing the revised analysis, because reanalysis assuming actuation of a different protection circuit has no bearing on the probability of occurrence for these accidents. Since the revised analysis meets the design DNBR limits and fuel integrity is ensured, implementation of the changes will not result in more severe consequences than those of the current analysis of record.

The diversity of the Reactor Protection System is not diminsished by thi change because the undervoltage and underfrequency trips are retained as back-up functions.

2. Implementing the revised analysis cannot create the possibility of an accident of a different type than was previously evaluated in the SAR. No changes to plant configuration or mode of operation are being implemented; therefore, no new mechanisms for the initiation of accidents are created by the changes. The changes merely credit a different reactor trip circuit for core protection from the Loss of Flow events.

3. Since the revised analysis results have been confirmed to meet the design DNBR limits, the margin of safety defined in TS basis is unaffected. The basis to TS 2.1 (Safety Limit, Reactor Core) defines the thermal / hydraulic basis and actions of reactor protection circuits as ensuring that the minimum DNBR will exceed the design limit. Since this has been verified by the revised analysis, margin of safety is unaffected.

References:

1. Calculation SM-0950," Loss of Flow Accident Reanalysis for North Anna Power Station," 10/94

Safety Evaluation Nurnber 94-SE-OT-062 i

DESCRIPTION OF CHANGE DOCUMENT Tech Spec interpretation concerning effects of PORV N2 Accumulator on the OPERABILITY of the PORVs for Unit 1 and Unit 2 TS 3.4.3.2.

SAFETY EVALUATION

SUMMARY

TS 3.4.3.2 provides the requirements for Pressurizer PORVs and their associated block valves. Surveillance Requirement 4.4.3.2.1.a.2 requires that on an 18 month frequency that each PORV shall be demonstrated OPERABLE by

" Operating the solenoid air control valves and check valves on the associated accumulators in the PORV control systems through one complete cycle of full travel." None of the surveillance requirements in Specification 3.4.3.2 address the ability to maintain the PORV nitrogen accumulators pressurized in MODES 1, 2, and 3.

The question addressed by this interpretation is that if the PORV accumulators cannot maintain pressure should the PORVs be declared inoperable and the ACTION for an inoperable PORV be entered? This ACTION requires that the PORV block valve be closed within one hour with power maintained to the block valve.

This would be the most conservative action to take, however, this action would place the plant in a less safe condition for the following reasons: 1) The normal instrument air supply would still be available to operate the PORV if the plant conditions warranted,2) Closing the PORV block valve would prevent the PORV from fulfilling its intended function of mitigating over pressure conditions, and 3) operator action would be required to allow the PORV to function (i.e., opening the block valve).

This safety evaluation has demonstrated that even with the PORV nitrogen accumulators unavailable, an unreviewed safety question does not exist because:

1) The unavailability of the N2 backup source of motive power to the PORVs does not affect the operation of any plant equipment that would increase the probability of occurrence of any accident. The PORVs can be used to mitigate analyzed accidents but are not designed to prevent the occurrence of these accidents.

2) Even with both PORVs unavailable, the Pressurizer code safety valves would still be available to prevent over pressure of the RCS; therefore, the PORV unavailability would not result in an increase in the consequences of any accident.

( w S

3) This' activity does not change the design nor alter the operation of any  :

equipment that would result in the generation of any accident precursors that ,

have not been previously analyzed.

l

4) The unavailability of the PORV N2 supply would not prevent the PORVs from '

operating with the normal instrument. air supply. In addition, this N2 unavailability would not affect the ability of the Pressurizer code safety valves .

from functioning during an RCS over pressure event

5) The margin of safety as addressed in Tech Specs is not reduced because the Tech Specs bases section does not address the N2 pressure in the PORV accumulators.  ;

i Based on the above conclusions, the PORV should not be declared inoperable  !

based on nitrogen accumulator pressure. Although the TS requirements are not ,

immediately clear, a TS revision is not required because this interpretation is not a change to the Tech Specs. f i

e

[ .

i l

f 4

l l

i

_ _ _ _ - _ . _ . . _ _ _ _ . . -