ML20085G964

Issuance of Amendments Nos. 298 and 298 to Revise Technical Specifications Table 3.7-1, Reactor Trip Instrument Operating Conditions, for an Addition of 24-Hour Completion Time for an Inoperable Rector Trip Breaker

ML20085G964
Person / Time
Site:	Surry
Issue date:	05/19/2020
From:	Geoffrey Miller Plant Licensing Branch II
To:	Stoddard D Virginia Electric & Power Co (VEPCO)
Thomas V
References
EPID L-2019-LLA-0110
Download: ML20085G964 (31)

Text

May 19, 2020 Mr. Daniel G. Stoddard Senior Vice President and Chief Nuclear Officer Innsbrook Technical Center 5000 Dominion Blvd.

Glen Allen, VA 23060-6711

SUBJECT:

SURRY POWER STATION, UNITS 1 AND 2 - ISSUANCE OF AMEMDMENTS NOS. 298 AND 298 TO REVISE TECHNICAL SPECIFICATIONS TABLE 3.7-1, REACTOR TRIP INSTRUMENT OPERATING CONDITIONS, FOR AN ADDITION OF 24-HOUR COMPLETION TIME FOR AN INOPERABLE REACTOR TRIP BREAKER (EPID L-2019-LLA-0110)

Dear Mr. Stoddard,

The U.S. Nuclear Regulatory Commission has issued the enclosed Amendment No. 298 to Renewed Facility Operating License No. DPR-32 and Amendment No. 298 to Renewed Facility Operating License No. DPR-37 for the Surry Power Station (Surry), Units 1 and 2, respectively.

The amendments revise the Technical Specifications (TSs) in response to your application dated May 15, 2019 (Agencywide Documents Access and Management System (ADAMS)

Accession No. ML19143A201), as supplemented by letter dated December 12, 2019 (ADAMS Accession No. ML19350A004).

The amendments revise the Surry, Units 1 and 2, TS Table 3.7-1, Reactor Trip Instrument Operating Conditions, to provide a completion time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to restore an inoperable reactor trip breaker to operable status.

A copy of the related Safety Evaluation is also enclosed. The notice of Issuance will be included in the Commissions biweekly Federal Register notice.

Sincerely, G. Edward Miller, Project Manager Plant Licensing Branch II-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-280 and 50-281

Enclosures:

1. Amendment No. 298 to DPR-32

2. Amendment No. 298 to DPR-37

3. Safety Evaluation cc: Listserv Glenn E.

Miller Digitally signed by Glenn E. Miller Date: 2020.05.19 12:14:51 -04'00'

VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-280 SURRY POWER STATION, UNIT NO. 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 298 Renewed License No. DPR-32

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Virginia Electric and Power Company (the licensee) dated May 15, 2019, as supplemented by a letter dated December 12, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specification as indicated in the attachment to this license amendment, and Table 3.7-1, Action 8.A of the Renewed Facility Operating License No. DPR-32 is hereby amended to read as follows:

B.

Technical Specifications The Technical Specifications Contained in Appendix A, as revised through Amendment No. 298 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

The license amendment is effective as of its date of issuance and shall be implemented within 60 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch II-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to License No. DPR-32 and the Technical Specifications Date of Issuance: May 19, 2020 Michael T.

Markley Digitally signed by Michael T. Markley Date: 2020.05.19 18:17:02 -04'00'

VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-281 SURRY POWER STATION, UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 298 Renewed License No. DPR-37

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Virginia Electric and Power Company (the licensee) dated May 15, 2019, as supplemented by a letter dated December 12, 2019, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specification as indicated in the attachment to this license amendment, and Table 3.7-1, Action 8.A of the Renewed Facility Operating License No. DPR-37 is hereby amended to read as follows:

B.

Technical Specifications The Technical Specifications Contained in Appendix A, as revised through Amendment No. 298 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

The license amendment is effective as of its date of issuance and shall be implemented within 60 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch II-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to License No. DPR-37 and the Technical Specifications Date of Issuance: May 19, 2020 Michael T.

Markley Digitally signed by Michael T. Markley Date: 2020.05.19 18:17:47 -04'00'

ATTACHMENT TO SURRY POWER STATION, UNITS NOS. 1 AND 2 LICENSE AMENDMENT NO. 298 RENEWED FACILITY OPERATING LICENSE NO. DPR-32 DOCKET NO. 50-280 AND LICENSE AMENDMENT NO. 298 RENEWED FACILITY OPERATING LICENSE NO. DPR-37 DOCKET NO. 50-281 Replace the following pages of the Licenses and the Appendix A Technical Specifications (TSs) with the attached revised pages. The revised pages are identified by amendment number and contained marginal lines indicating the areas of change.

Remove Pages Insert Pages License No. DPR-32, page 3 License No. DPR-32, page 3 License No. DPR-37, page 3 License No. DPR-37, page 3 TS TS 3.7-16 3.7-16 Surry - Unit 1 Renewed License No. DPR-32 Amendment No. 298

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2587 megawatts (thermal).

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 298 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D. Records The licensee shall keep facility operating records in accordance with the requirements of the Technical Specifications.

E. Deleted by Amendment 65 F. Deleted by Amendment 71 G. Deleted by Amendment 227 H. Deleted by Amendment 227 I.

Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979, (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and Surry - Unit 2 Renewed License No. DPR-37 Amendment No. 298 E. Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such by product and special nuclear materials as may be produced by the operation of the facility.

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A. Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power Levels not in excess of 2587 megawatts (thermal)

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 298 are hereby incorporated in this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

C. Reports The licensee shall make certain reports in accordance with the requirements of the Technical Specifications.

D. Records The licensee shall keep facility operating records in accordance with the Requirements of the Technical Specifications.

E. Deleted by Amendment 54 F. Deleted by Amendment 59 and Amendment 65 G. Deleted by Amendment 227 H. Deleted by Amendment 227

TABLE 3.7-1 (Continued)

ACTION 7.

With the number of OPERABLE channels less than the Total Number of Channels, REACTOR CRITICAL and POWER OPERATION may proceed provided the following conditions are satisfied:

1.

The inoperable channel is placed in the tripped condition within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

2.

The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for surveillance testing per Specification 4.1.

If the conditions are not satisfied in the time permitted, reduce power to less than the P-7 setpoint within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

ACTION 8.A.

With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (

Reference:

WCAP-15376-P-A). In conditions of operation other than REACTOR CRITICAL or POWER OPERATIONS, with the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or open the reactor trip breakers within the next hour. However, one channel may be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing per Specification 4.1 provided the other channel is OPERABLE, or one reactor trip breaker may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for concurrent surveillance testing of the Reactor trip breaker and automatic trip logic provided the other train is OPERABLE.

8.B.

With one of the diverse trip features (undervoltage or shunt trip device) inoperable, restore it to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or declare the breaker inoperable and apply Action 8.A. The breaker shall not be bypassed while one of the diverse trip features is inoperable except for the time required TS 3.7-16 Amendment Nos. 298 and 298 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO THE ADDITION OF 24-HOUR COMPLETION TIME FOR AN INOPERABLE REACTOR TRIP BREAKER FACILITY OPERATING LICENSE NOS. DPR-32 AND DPR-37 VIRGINIA ELECTRIC AND POWER COMPANY DOMINION ENERGY VIRGINA SURRY POWER STATION, UNITS 1 AND 2 DOCKET NOS. 50-280 AND 50-281

1.0 INTRODUCTION

By letter dated May 15, 2019 (Reference 1), as supplemented by letter dated December 12, 2019 (Reference 2), Virginia Electric and Power Company, Dominion Energy Virginia (Dominion, the licensee), submitted a license amendment request (LAR) to modify the technical specifications (TS) for the Surry Power Station (Surry), Units 1 and 2.

This amendment revises TS Table 3.7-1, Reactor Trip Instrument Operating Conditions, to provide a completion time (CT) addition of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to restore an inoperable reactor trip breaker (RTB) to operable status as approved by the U.S. Nuclear Regulatory Commission (NRC) for Westinghouse plants in WCAP-15376-P-A, Revision 1, Risk-Informed Assessment of the Reactor Trip System (RTS) and Engineered Safety Features Actuation System (ESFAS)

Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times (Reference 3).

Implementation of the changes in this LAR is consistent with the NRC-approved Technical Specification Task Force (TSTF) Improved Standard Technical Specification Change Traveler TSTF-411, Revision 1, Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-15376-P), dated August 7, 2002 (Reference 4). The licensees supplement dated December 12, 2019, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staffs original proposed determination that the amendment involves no significant hazards consideration, as published in the Federal Register on August 13, 2019 (84 FR 40094).

2.0 REGULATORY EVALUATION

2.1 Background

The Pressurized Water Reactor Owners Group (PWROG), formerly the Westinghouse Owners Group (WOG), Technical Specifications Optimization Program (TOP), evaluated changes to surveillance testing intervals (STIs) and CTs for the analog channels, logic cabinets, master and slave relays, and RTBs. The methodology evaluated increases in the STIs, the test and maintenance out-of-service (OOS) times, and the bypassing of portions of the reactor protection system (RPS) during test and maintenance. As stated in the NRC staffs safety evaluation (SE) dated December 20, 2002, for the approval of WCAP-15376-P, Revision 0 (Reference 5), [i]n 1983, the WOG submitted WCAP-10271-P, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System, which provided a methodology to be used to justify revisions to a plants [RPS] TS. The WOG stated, in WCAP-10271-P (Reference 6), that the plant staff devotes significant time and effort to perform, review, document, and track surveillance activities that, in many instances, may not be required on the basis of the high reliability of the equipment. The justification for the changes was the small impact that the changes would have on plant risk.

By letter dated February 21, 1985, the NRC staff accepted WCAP-10271, including Supplement 1, with conditions. (Reference 7). The NRC staff subsequently adopted the TS changes proposed by WCAP-10271 into NUREG-1431, Standard Technical Specifications Westinghouse Plants, Volume 1, Specifications, issued September 1992 (Reference 8). After the approval of WCAP-10271 and its supplements, the PWROG submitted WCAP-14333-P, Probabilistic Risk Assessment of the RPS and ESFAS Test Times, in a letter dated June 20, 1995 (Reference 9) and (Reference 10). The NRC staff accepted WCAP-14333-P (proprietary) and WCAP-14334-NP (nonproprietary) by letter dated April 29, 1998 (Reference 11). The purpose of this topical report (TR) was to justify the following TS relaxations beyond those approved in WCAP-10271:

Increase the bypass test times and CTs for both the solid-state protection system (SSPS) and relay protection system and ESFAS designs for the analog channels and increase the CT from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and the bypass test time from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for the logic cabinets, master relays, and slave relays.

If the slave relay CT has expired, the component affected by the inoperable slave relay should be declared inoperable, and the TS action for this component should be followed.

If the logic cabinet and RTB both cause their train to be inoperable when in test or maintenance, allow bypassing of the RTB for the period of time equivalent to the bypass test time for the logic cabinets, provided that both are tested at the same time and the plant design is such that both the RTB and the logic cabinet cause their associated electrical trains to be inoperable during test or maintenance.

By letter dated March 19, 2003, WOG submitted WCAP-15376-P-A, Revision 1, which incorporated the NRC staffs SE dated December 20, 2002, and all requests for additional information (RAIs) (Reference 12) and responses thereto (Reference 2). WCAP-15376-P-A, Revision 1, is referenced as WCAP-15376 in this SE and justifies changes in TSTF Traveler TSTF-411 (Reference 6). Functions included in WCAP-15376 are considered as generically approved, while those not included in WCAP-15376 are considered as plant specific.

WCAP-15376 specifically evaluated the analog channels, logic cabinets, master relays, and RTBs and evaluated both SSPS and the relay protection system. WCAP-15376 also included justification for the following TS relaxations:

additional extension of the STIs for components of the RPS and ESFAS to those previously approved in WCAP-10271 (Reference 4) extension of the STI, CT, and bypass test times for the RTBs 2.2 Description of Changes If the reactor is critical or at power operation, the proposed change revises Action 8.A in TS Table 3.7-1 to restore an inoperable RTB to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or to be in at least hot shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. Additionally, the proposal adds a reference to WCAP-15376-P-A in Action 8.A.

The 24-hour CT to restore an inoperable RTB will provide additional time to complete testing and maintenance while at power, thereby reducing the potential to challenge plant systems due to unnecessary transients and shutdowns associated with TS compliance. The additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to restore an inoperable RTB also provides consistency with the established CT of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the automatic trip logics allowed by TS Table 3.7-1, Item 19, Action 11.

The CT extensions for the RTBs will provide the licensee additional time to complete test and maintenance activities while at power, potentially reducing the number of forced outages related to compliance with RTB CTs and provide consistency with the CTs for the logic cabinets.

2.3 Applicable Regulatory Requirements and Guidance The NRC issued construction permits for Surry Units 1 and 2 before May 21, 1971; consequently, Surry Units 1 and 2 were not subject to the requirements in Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix A, General Design Criteria [GDC] for Nuclear Power Plants (see SECY-92-223, Resolution of Deviations Identified during the Systematic Evaluation Program, dated September 18, 1992 (Reference 13). Surry Units 1 and 2 meet the intent of the GDC published in 1967 (draft GDC). Specifically, Section 1.4 of the Surry updated final safety analysis report (UFSAR) discusses Surry compliance with these criteria:

Draft GDC 19, Protection Systems Reliability, stated, Protection systems are designed for high functional reliability and inservice testability necessary to avoid undue risk to the health and safety of the public.

Draft GDC 20, Protection Systems Redundancy and Independence, stated, Redundancy and independence designed into the protection systems are sufficient to ensure that no single failure or removal from service of any component or channel of such a system results in a loss of the protection function. The redundancy provided includes, as a minimum, two channels of protection for each protection function to be served.

Draft GDC 25, Demonstration of Functional Operability of Protection Systems, stated, Means shall be included for the suitable testing of the active components of protection systems while the reactor is in operation to determine if a failure or loss of redundancy has occurred.

Draft GDC 26, Protection Systems Fail-Safe Design, stated, The protection systems are designed to fail into the safe state or into a state established as tolerable on a defined basis if conditions such as a disconnection of the system, a loss of energy (e.g., electrical power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.

The NRC staffs LAR review applied the UFSAR plant design criteria along with the current regulatory requirements of 10 CFR Part 50, including Appendix A, that are applicable to the RPS:

Surry UFSAR, Section 1.4.12, Instrumentation and Control Systems, states, in part, that instrumentation and controls are provided as required to monitor and maintain within prescribed operating ranges essential reactor facility operating variables, including neutron flux, primary coolant pressure and temperature, and control rod assembly positions.

In 10 CFR 50.36, Technical Specifications, the regulations state: Each applicant for a license authorizing operation of a production or utilization facility shall include in his application proposed technical specifications in accordance with the requirements of this section. Specifically, 10 CFR 50.36(c)(2)(ii) sets forth four criteria to be used in determining whether a limiting condition for operation is required to be included in the TS.

Appendix A, GDC 21, Protection System Reliability and Testability, requires that: The protection system be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

Appendix A, GDC 22, Protection System Independence, requires that: The protection system be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions, on redundant channels do not result in loss of the protection function.

In 10 CFR 50.65, Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, the NRC requires monitoring the performance or condition of structures, systems, or components (SSCs) against licensee-established goals in a manner sufficient to provide reasonable assurance that these SSCs are capable of fulfilling their intended functions.

The NRC staff also reviewed the LAR based on the following regulatory guidance and applicable documents:

WCAP-15376-P-A, Revision 1, describes an acceptable methodology to justify extending the surveillance test intervals for components of the RPS and RTB CTs.

NUREG-1431, Revision 4, Standard Technical SpecificationsWestinghouse Plants, Volume 1, Specifications, issued April 2012, contains the improved standard technical specifications (STS) for Westinghouse plants (Reference 14).

Regulatory Guide (RG) 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, issued January 2018 (Reference 15), describes an acceptable approach for developing risk-informed applications for a licensing basis change that considers engineering issues and applies risk insights. This RG also provides five key principles to be assessed in risk-informed changes to the licensing basis.

RG 1.177, Revision 1, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, issued May 2011 (Reference 16),

describes an acceptable risk-informed approach to TS changes, specifically for changes to CTs and surveillance frequencies (SFs). This RG also provides risk acceptance guidelines for evaluating the results of such assessments and lists the five key principles of a risk-informed application for a TS change should be evaluate to:

(1)

The proposed change meets the current regulations unless it explicitly relates to a requested exemption.

(2)

The proposed change is consistent with the defense-in-depth philosophy.

(3)

The proposed change maintains sufficient safety margins.

(4)

When proposed changes increase core damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

(5)

The impact of the proposed change be should monitored using performance measurement strategies.

The following sections of NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), address the review of risk-informed information used to support permanent plant-specific TS changes to the licensing basis, the technical acceptability of a baseline probabilistic risk assessment (PRA) used by a licensee to support license amendments for an operating reactor, and risk-informed decisionmaking:

SRP Section 16.1, Revision 1, Risk-Informed Decision Making: Technical Specifications, issued March 2007 (Reference 17).

SRP Section 19.1, Revision 3, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests after Initial Fuel Load, issued September 2012 (Reference 18).

SRP Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, issued June 2007 (Reference 19).

3.0 TECHNICAL EVALUATION

3.1 Proposed Change The proposed change revises Action 8.A in TS Table 3.7-1 for one inoperable RTB. The current action requires the plant to be in at least hot shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> if one RTB is inoperable.

The revised action provides a CT of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to restore an RTB to operable status in addition to the 6-hour hot-shutdown requirement.

Furthermore, in Section 5.0 of the NRCs SE for WCAP-15376 (Reference 5), the NRC staff asked the licensee to provide information in the LAR to confirm applicability of the TR for the plant proposing the TS change.

Section 3.0 of Attachment 1 to the licensees submittal (Reference 1) and the supplemental information provided by the licensee in a letter dated December 12, 2019 (Reference 2), contain the information the NRC staff used in its safety review of the licensees risk evaluation.

3.2 Current Technical Specifications The current TS Table 3.7-1, Item 18, requires two RTBs to be operable. If one of the two RTBs becomes inoperable while the reactor is critical or at power operation, TS Table 3.7-1, Action 8.A, requires the unit to be in at least hot shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. For conditions of operation other than power operation or reactor critical, an inoperable RTB must be restored within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, or the RTBs must be opened within the next hour.

3.3

NRC Staff Evaluation

The NRC staff reviewed the licensees incorporation of WCAP-15376-P-A, Revision 1 (Reference 3), using the key principles of risk-informed decisionmaking presented in RGs 1.174 and 1.177. The staff also reviewed the RTB A and the Reactor Trip Bypass Breaker (BY) logics.

The NRC staff reviewed Section 1.4 of the UFSAR, which discusses Surrys compliance with the draft GDC published in 1967. The staff specifically reviewed draft GDC 19, draft GDC 20, GDC 25, and draft GDC 26. The staff also reviewed Institute of Electrical & Electronics Engineers (IEEE) Standard (Std.) 603-2009, Criteria for Safety Systems for Nuclear Power Plants, (Reference 20) and IEEE Std. 379, Application of the Single-Failure Criterion to Nuclear Generating Station Safety Systems, (Reference 21). These two standards are applicable to 1967 draft GDC 19, 20, 25, and 26.

The NRC staff approved the 24-hour CT to restore a single RTB to operable status for Westinghouse plants in WCAP-15376-P-A, Revision 1 (Reference 3). The WCAP-15376 approach addresses the impact on defense in depth, safety margins, and risk. Based on its acceptance of WCAP-15376-P, Revision 0 (Reference 14), the NRC staff incorporated new test intervals and CTs into NUREG-1431. Surry Units 1 and 2 employ relay protection systems.

However, the WCAP considers both an SSPS and a relay protection system. WCAP-15376 uses PRA as part of the technical basis for changes to the TS in accordance with RG 1.174 and RG 1.177. The risk evaluation considered the three-tiered approach as presented by the NRC in RG 1.177 for the extension to the RTB CT.

Compliance Current Regulations The NRC staff evaluated Key Principle 1 in the WCAP-15376-P, Rev. 1 (Reference 3). The NRC staffs evaluation found that the WCAP-15376 was consistent with the accepted guidelines of RG 1.174 and RG 1.177, and NRC staff guidance as outlined in NUREG-0800. From traditional engineering insights, the NRC staff found that the proposed changes in WCAP-15376 continue to meet the regulations.

Defense-in-Depth In accordance with UFSAR Section 1.4.26, Protection Systems Fail Safe-Design, Surry, Units 1 and 2, protection systems have a fail-safe design. Draft GDC 26 states the following, in part:

An open circuit or loss of channel power therefore causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from two independent electrical buses. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event. Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on each drive, allowing the control rod assemblies to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.

Due to the fail-safe design and reliability of the normal reactor trip function, the anticipated transient without scram (ATWS) mitigating system actuation circuitry (AMSAC) system can shut down the reactor if an RTB failed to open. The defense-in-depth capabilities will not be impacted significantly by allowing a single RTB to be unavailable for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. To maintain appropriate measures of defense-in-depth, the licensee stated that no AMSAC maintenance will be planned while one RTB is inoperable. The staff noted that while the plant is shut down, the operation of opening the RTB is no longer applicable since the RTBs must be opened to shut down the reactor. The staff concludes that the fail-safe design is acceptable, and defense in depth is maintained appropriately.

Conditions and Limitations WCAP-15376 provides a technical justification to increase the CT for RTBs at Westinghouse plants. Section 5.0 of the NRC staffs SE that approved WCAP-15376 stated that the applicability of WCAP-15376 needs to be confirmed on a plant-specific basis. In Section 3.4 of the submittal dated May 15, 2019, the licensee provided the following information to demonstrate the applicability of the WCAP to Surry:

(1)

The risk impact of concurrent testing of one logic cabinet and associated RTB needs to be evaluated on a plant-specific basis to ensure conformance with the WCAP-15376 evaluation and guidance in RGs 1.174 and 1.177.

Surry Response: The plant-specific evaluation performed for Surry assessed the risk with one RTB unavailable concurrent with one train of RPS unavailable. The results conform with the RG 1.174 and RG 1.177 guidance.

As described in Section 3.3 of this SE, the NRC staff reviewed the core damage frequency (CDF) values based on the unavailability of one RTB, and the results meet the criteria in RG 1.174 and RG 1.175.

(2)

For future digital upgrades with increased scope, integration, and architectural differences beyond that of Eagle 21, the staff finds that the generic applicability of WCAP-15376 to future digital systems is not clear and should be considered on a plant-specific basis.

Surry Response: There are no digital components within the RTBs or the associated logic cabinets. Therefore, this item is not applicable for Surry.

The NRC staff reviewed this statement and agrees that the item is not applicable for Surry.

Therefore, the NRC staff finds it is acceptable.

Condition and Limitation No. 1 of the SE for WCAP-15376 (Reference 14) requested that the licensee confirm applicability of the technical review to the plant for which it is being applied, perform a plant-specific assessment of containment failures, and address any design or performance differences that may affect the proposed changes.

In LAR Attachment 1, Section 3.4 (Reference 1), the licensee assessed the applicability of WCAP-15376 (Reference 3) for Surry. The licensee determined that the Surry RPS and ESFAS are similar in design to the reference plant in the topical report. Additionally, the licensee confirmed that it considered plant-specific evaluations of current and future unavailability (i.e., increased RTB unavailability due to the CT extension) in the risk analysis of the RTB CT extension (i.e., Tier 1 analysis). Therefore, the NRC staff finds the licensee satisfies first part of Condition and Limitation No. 1.

The second part of Condition and Limitation No. 1 requires the licensee to perform a plant-specific assessment of containment failures and address any design or performance differences that may affect the proposed changes. WCAP-15376 (Reference 3) was based on a large, dry containment and assumed that the only contributions to large early release frequency (LERF) would come from containment bypass events and core damage events with the containment not isolated. The Surry Containment is not a large dry containment, however, the licensee stated in LAR Attachment 1, Section 3.4 (Reference 1), that a plant-specific assessment of containment failures and other failure modes that could result in a release was conducted to support the development the Surry LERF model. This plant-specific model addressed the specific design and performance of Surry containment. The LERF model used to evaluate the proposed change assessed the estimated increase in LERF as very small. The NRC staff finds that the licensee satisfies the second part of Condition and Limitation No. 1 because the licensee performed a plant-specific assessment using a model that included the specific design and performance of the Surry containment resulting in a minimal increase in LERF.

Safety Margins Surry UFSAR, Section 1.4.19, states, in part, the following:

Surry Units 1 and 2 protection system reliability is such that upon a loss of power to the coils, the control rod assembly is released and falls by gravity into the core.

The bypass removal of one trip circuit is accomplished by placing that circuit in a half-tripped mode; that is, a two-out-of-three circuit becomes a one-out-of-two circuit. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Surry UFSAR Section 1.4.20, states, in part, the following:

Two reactor trip breakers are provided to interrupt power to the control rod drive mechanisms. Opening either breaker interrupts power to all mechanisms, causing them to release all control rod assemblies to fall by gravity into the core.

Upon de-energization, contacts from the relay energize the reactor trip breaker shunt trip attachment and trips open the breaker. This provides a redundant/backup means to automatically trip the breakers upon the receipt of a trip signal from the reactor trip system.

The NRC staff noted that the RPS supplies signals to automatically trip the reactor to ensure plant conditions do not approach safety limits that could challenge the reactor coolant system or fuel integrity. Each RTB is equipped with a Reactor Trip Bypass Breaker (BY) to allow maintenance and testing of the RTB while the unit is at power. Each BY is equipped with an undervoltage trip coil, which de-energizes upon receipt of a trip signal from the opposite train of the RPS, thereby opening the BY and tripping the reactor. Unlike the RTB, the BY is not furnished with a diverse shunt trip attachment. Thus, allowing the completion time for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> does not affect the safety limits. The Surry PRA evaluated the impact on CDF and LERF evaluated for a single RTB unavailable. Similarly, incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) for a single 24-hour period with a single RTB unavailable were also calculated. The CDF, LERF, ICCDP, and ICLERP values meet the RG 1.177 criteria as shown in LRA Table 1, Section 3.3.

Therefore, the NRC staff finds the safety limits to be acceptable because the licensee demonstrated that the safety limits meet the acceptance criteria in RG 1.177.

Risk Insight Evaluation The evaluation presented below addresses the NRC staffs philosophy of risk-informed decisionmakingthat for proposed changes resulting in a change in risk, the increase should be small and consistent with the intent of the Commissions policy statement on safety goals for the operations of nuclear power plants. The NRC staff evaluated the proposed change in risk using the three-tiered approach described in SRP Section 16.1 and RG 1.177 :

Tier 1The first tier evaluates the licensees PRA and the impact of the proposed license amendment change on plant operational risk, as expressed by the change in CDF and LERF (CDF and LERF). The change in risk is compared to the acceptance guidelines presented in RG 1.174 (Reference 7). The first tier also aims to ensure that plant risk does not increase unacceptably during the period when equipment is taken OOS in accordance with the license amendment, as expressed by the ICCDP and ICLERP. The incremental risk is also compared to the acceptance guidelines presented in RG 1.177.

Tier 2The second tier addresses the need to preclude potentially high-risk plant configurations that could result in plant risk if plant equipment, in addition to that associated with the proposed license amendment, is taken OOS simultaneously, or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The objective of this part of the review is to ensure that appropriate restrictions on dominant risk-significant plant configurations associated with the CT extension are in place.

Tier 3The third tier addresses the licensees overall configuration risk management program (CRMP) to ensure that equipment removed from service before or during the proposed extended CT period will be appropriately assessed from a risk perspective.

The three-tiered approach ensures that adequate programs and procedures are in place to identify risk-significant plant configurations resulting from maintenance or other operational activities and to take appropriate compensatory measures to avoid such configurations. To determine whether the PRA used in support of the proposed CT extension is of sufficient quality, scope, and level of detail, the NRC staff evaluated the relevant information in the LAR submittal and considered the results of the PRA reviews. Consistent with RG 1.177, Revision 1, the NRC staffs review of the submittal focused on the capability of the licensees PRA model to analyze the risks stemming from the proposed CT extension.

The NRC staff finds that the licensee has demonstrated the applicability of WCAP-15376 (Reference 3) to Surry and has met the limitations and conditions outlined in the associated SE (Reference 14). The Tier 1 analysis is acceptable because the estimates for CDF, LERF, ICCDP, and ICLERP for the RTB CT extension are within the acceptance guidelines of RG 1.174 and RG 1.177. The Tier 2 analysis evaluated the risk of concurrent outage configurations to identify potential risk-significant configurations. For the Tier 3 analysis, the staff found the licensees CRMP at Surry to be consistent with the guidance in RG 1.177 and the Maintenance Rule (10 CFR 50.65(a)(4)) for the implementation of WCAP-15376. The NRC staff finds the licensee has followed the three-tiered approach outlined in RG 1.177 to evaluate the risk associated with the proposed TS CT change, and, therefore, the proposed change satisfies Key Principle 4 of RG 1.177.

3.4 Tier 1: Probability Risk Assessment Capability and Insights 3.4.1 Evaluation of the Probabilistic Risk Assessment Model Section 2.3.2 of RG 1.177 states that, as a minimum, the licensee should perform evaluations of CDF and LERF to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal floods, internal fires, seismic events, high winds, transportation events, and other external hazards). Section 2.3.1 of RG 1.174 states that a qualitative treatment of the missing modes and hazard groups may be sufficient when the licensee can demonstrate that those risk contributions would not affect the decision.

RG 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, issued March 2009 (Reference 22),

describes one acceptable approach for determining whether the technical acceptability of a PRA is sufficient for use in regulatory decisionmaking for light-water reactors. The PRA acceptability review assesses whether the PRA model used to evaluate the proposed TS changes is of sufficient scope and detail for this application. WCAP-15376 (Reference 3) provided a generic PRA model to evaluate extensions to STIs, RTB CTs, and bypass test times.

The NRC staff found this generic model and the WCAP-15376 evaluations to be acceptable on a generic basis in its SE dated December 20, 2002. Although the NRC staff accepted the use of a representative model as generally reasonable, the application of the representative model and the associated results to a specific plant introduces a degree of uncertainty because of modeling, design and operational differences. Therefore, each licensee adopting WCAP-15376 would need to confirm that the TR analyses and results are applicable.

In LAR Attachment 1, Section 3.4 (Reference 1), the licensee confirmed the applicability of WCAP-15376 to Surry, as prescribed in Section 5.0 of the SE for WCAP-15376 for conditions and limitations. The licensee provided a quantitative assessment of the change in risk using its PRA Level 1 and Level 2 models, which include assessment of internal events and internal flood events. The licensee made a qualitative assessment for internal fire events, seismic events, and other external hazards.

Internal Events Probabilistic Risk Assessment (includes internal floods)

The NRC staff based its review of the Surry internal events PRA (IEPRA) on the results of a full-scope peer review, a self-assessment, focused-scope peer reviews, independent assessments, Condition and Limitation No. 4 of the NRC staff SE for WCAP-15376, and previously docketed information on PRA quality submitted to the NRC in the LARs dated May 31, 2017 (Reference 23), and July 28, 2017 (Reference 24). The LAR dated May 15, 2019 (Reference 1), includes the independent assessments. The SEs associated with the previously docketed information concluded that the Surry IEPRA (including internal floods) was subjected to a peer-review process using the guidance in RG 1.200.

Condition and Limitation No. 4 of the SE for WCAP-15376 requested that the licensee confirm that the plant-specific model assumptions for the human reliability analysis (HRA) are consistent with the assumptions delineated in the NRC-approved WCAP-15376. In LAR Attachment 1, Section 3.4 (Reference 1), the licensee listed the operator actions credited in the WCAP-15376 (Reference 3) analysis and identified the corresponding human failure events used in the Surry IEPRA (including internal floods) for the HRA. The licensee confirmed that the Surry plant-specific HRA is either consistent with or more conservative than the assumptions used in WCAP-15376. Accordingly, the NRC staff concludes that the licensee satisfies Condition and Limitation No. 4.

Following the issuance of the NRC staff SEs in May and July 2017, respectively, the licensee used an independent assessment to close certain facts and observations (F&Os) in March 2018, based on the guidance in Appendix X to Nuclear Energy Institute (NEI) 05-04/07-12/12-[13], Close Out of Facts and Observations (F&Os), dated February 21, 2017 (Reference 25), that the NRC staff had accepted, with conditions (Reference 26). In of the LAR, the licensee provided the remaining open F&Os, along with dispositions of the findings for this application that were not determined to be closed during the independent assessment. The NRC staff reviewed the dispositions for the F&Os and concluded that the licensee had resolved them appropriately for this risk-informed application.

Probabilistic Risk Assessment Capability Conclusions RG 1.177 states that [t]he licensee should provide the rationale that supports the acceptability of the proposed changes by integrating probabilistic insights with traditional considerations to arrive at a final determination of risk (Reference 8). In summary, the licensee has evaluated the Surry IEPRA against RG 1.200, Revision 2; evaluated the open findings identified from the peer reviews; and addressed the impact of those findings on this risk-informed application. To address integrating the probabilistic insights and traditional considerations, the NRC staff reviewed the quality standards for design conformance discussed in Section 4.0 of the LAR (Reference 1), along with evaluating any risk-significant configurations.

The NRC staff concludes that the Surry IEPRA (including internal floods), which was subjected to a peer review process using the guidance in RG 1.200, Revision 2, is acceptable and that findings from those reviews have either been closed in accordance with Appendix X to NEI 05-04/07-12/12-[13], as accepted, with conditions by the NRC staff, or were determined to have no adverse impact on this application. The NRC staff finds that the Surry IEPRA is sufficient to assess the risk impact for this risk-informed application.

3.4.2 Probabilistic Risk Assessment Results and Insights Satisfaction of the fourth key principle of risk-informed decisionmaking may be demonstrated with reasonable assurance by comparing risk metrics that reflect the proposed TS changes to the numerical risk acceptance guidelines in RG 1.174, Revision 3 (Reference 7), and RG 1.177, Revision 1 (Reference 8). Furthermore, Condition and Limitation Nos. 2 and 3 in Section 5.0 of the NRC staff SE for WCAP-15376 (Reference 14) lists information that the licensee should provide in the LAR to assess the applicability of the plant-specific TS change to the approved technical review.

Section 2.3.3.1 of RG 1.177, Revision 1, states that, to evaluate a TS change, the PRA should model specific systems or components involved in the change. The model should also be able to treat the alignments of components during periods when testing and maintenance are being carried out. In Section 3.3 of the LAR (Reference 1), the licensee confirmed that the IEPRA explicitly modeled the RTBs, no credit was applied for any operator actions to recover failed RTBs, and the dominate core damage sequences for the Surry-requested change involves failure of the RPS where a reactor trip is required but an ATWS occurs. To perform the PRA analyses, the licensee used the average maintenance PRA model and assessed the following conditions and limitations in Section 5.0 of the NRC staff SE for WCAP-15376:

WCAP-15376 SE Condition and Limitation No. 2 Condition and Limitation No. 2 of the SE for WCAP-15376 (Reference 14) requested that the licensee perform Tier 2 and Tier 3 analyses, including determination of risk-significant configuration insights and confirmation that these insights are incorporated into the plant-specific CRMP.

WCAP-15376 SE Condition and Limitation No. 3 Condition and Limitation No. 3 of the SE for WCAP-15376 requested that the licensee perform a plant-specific evaluation of the risk impact of concurrent testing of one logic cabinet and associated RTB to ensure conformance with WCAP-15376 (Reference 3), RG 1.174 (Reference 7), and RG 1.177 (Reference 8).

Tier 1 Results In Table 1 of the LAR (Reference 1) for the Tier 1 analysis, the licensee provided the calculated CDF, change in LERF, ICCDP, and ICLERP values associated with the increase of the RTB CT from 6 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Table 1 below includes the risk results provided by the licensee in the LAR and compares these results against the risk acceptance guidelines in RG 1.174 and RG 1.177 for CDF, LERF, ICCDP, and ICLERP.

Table 1 Change in CDF and LERF for Proposed RTB CT Extension to 24 Hours Reactor Trip Breaker RG 1.174 CDF Criterion for a Very Small Change Unit 1 CDF Unit 2 CDF RG 1.174 LERF Criterion for a Very Small Change Unit 1 LERF Unit 2 CDF Average maintenance

<1E-06 per year 6.93E-09 6.72E-09

<1E-07 per year 4.30E-11 4.70E-11 Reactor Trip Breaker RG 1.177 ICCDP Criterion Unit 1 ICCDP Unit 2 ICCDP RG 1.177 ICLERP Criterion Unit 1 ICLERP Unit 2 ICLERP Single 24-hour TS Entry

<1E-06 1.21E-09 1.17E-09

<1E-07 8.07E-12 8.46E-12 For Surry Units 1 and 2, the NRC staff finds that the CDF and LERF satisfy the RG 1.174 acceptance guidelines for a very small change in risk (Reference 7). The NRC staff also finds that the ICCDP and ICLERP satisfy the RG 1.177 risk-acceptance guidelines (Reference 8).

The licensee performed a plant-specific evaluation for Surry that assessed the risk of one RTB unavailable concurrent with one train of RPS unavailable. The results demonstrated that the increase in risk due to the RTB CT extension is consistent with the guidance provided in RG 1.174 and RG 1.177. Based on its review of information in the LAR (Reference 1), as supplemented in the letter dated December 12, 2019 (Reference 2), the NRC staff concludes that the Surry IEPRA (including internal floods) is acceptable for this risk-informed application; the licensee has adequately identified the impact of the proposed TS CT extension on plant risk; and the risk increase for the proposed TS CT extension can be considered a small change, in accordance with RG 1.174 and RG 1.177, and is, therefore, acceptable for this application.

Accordingly, the NRC staff finds that the licensees Tier 1 evaluation is acceptable for this risk-informed application and satisfies Condition and Limitation No. 3 in Section 5.0 of the NRC staffs SE for WCAP-15376 (Reference 14).

Tier 2: Avoidance of Risk-Significant Plant Configurations RG 1.177, Revision 1 (Reference 8), states that the licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is OOS, consistent with the proposed TS change. The second tier evaluates the capability of the licensee to recognize and avoid risk-significant plant configurations that could result in plant risk if plant equipment, in addition to that associated with the proposed change, is taken OOS simultaneously, or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved.

For Tier 2, the licensee conducted an analysis to ensure that appropriate restrictions are placed on risk-significant plant equipment outage configurations that occur during the proposed CT extension. The licensee further stated in Section 6.0 of the LAR that a detailed review of the PRA importance measures (i.e., risk achievement worth (RAW), Fussell-Vesely (F-V)) based on the IEPRA model (including internal floods) did not reveal risk-significant maintenance configurations when one RTB is unavailable. In RAI 01, the NRC staff asked the licensee to describe how it used importance measures to identify risk-significant plant configurations, including the criteria that were used to determine risk-significant configurations when one RTB is OOS.

In its response to RAI 01 (Reference 2), the licensee explained that it reviewed the Tier 1 PRA results to identify basic events associated with the unavailability of an SSC that appeared in the same cutsets as the RTB. The licensee stated that these basic events were considered important if their associated RAW importance measures were greater than or equal to 2.0 or the F-V importance measures were greater than or equal to 4.5E-03. The NRC staff notes that the threshold values used to assess the importance measures by the licensee are consistent with Appendix A to RG 1.174, Revision 3 (Reference 7). The licensee stated that the unavailability of an emergency diesel generator was determined to be important using these criteria, but such an unavailability is prohibited by procedure when one RTB is inoperable. The licensee confirmed that the unavailability of a diesel-driven fire pump does not represent a vulnerable configuration that would require additional compensatory actions beyond current procedural controls.

In RAI 01, the NRC staff also asked the licensee to confirm that the unavailability of the SSCs identified in Section 8.5 of WCAP-15376 (i.e., the RCS pressure relief system; auxiliary feedwater flow; AMSAC; turbine trip; other RPS components, including master and slave relays; and the alternating current and direct current power distribution) would not create a risk-significant configuration. The licensee confirmed that, for alternating current power, direct current power, and other RPS components, the equipment is procedurally prohibited from being unavailable when an RTB is inoperable. The licensee stated that the importance measures for the RCS pressure relief system did not exceed the RAW or F-V threshold values for an important SSC, the auxiliary feedwater RAW and F-V importance values are not significantly affected by RTB unavailability, and the turbine trip function is not significantly affected when an RTB is inoperable.

The NRC staff concludes that the licensee has provided reasonable assurance that risk-significant plant equipment outage configurations will not occur when an RTB is inoperable.

The NRC staff finds that the licensees Tier 2 analysis is sufficient to support the proposed TS CT extension and consistent with the guidance in RG 1.177 (Reference 8) and, therefore, satisfies the applicable portion of Condition and Limitation No. 2 in Section 5.0 of the NRC staffs SE for WCAP-13576 (Reference 14).

Tier 3: Risk-Informed Plant Configuration and Control Management Section 2.3 of RG 1.177 (Reference 8) discusses Tier 3 of the three-tiered approach for evaluating risk associated with proposed changes to TS CT. Tier 3 is the establishment of a risk-informed plant configuration control program (i.e., a CRMP) to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and compensated for. Because the Maintenance Rule, as codified in 10 CFR 50.65(a)(4), requires licensees to assess and manage the potential increase in risk that may result from activities such as surveillance testing and corrective and preventive maintenance, a licensee may use its existing Maintenance Rule program to satisfy Tier 3.

As described in LAR Section 3.4, the licensee confirmed that the risk associated with unavailable plant equipment, including the RTBs, is assessed at Surry as required by 10 CFR 50.65(a)(4) and that their removal from service is monitored, analyzed, and maintained.

The NRC staff finds that the licensees Tier 3 CRMP is in accordance with the regulatory position specified in RG 1.177 and is acceptable to the extent needed to support this application. Furthermore, based on the NRC staffs review of the licensees Tier 2 and Tier 3 analyses provided in this section of the SE, the NRC staff concludes that Condition and Limitation No. 2 is fully satisfied.

3.4.3 Nonprobabilistic Risk Assessment Methods: Internal Fires, Seismic, and Other External Hazards Section 3.1 of RG 1.200, Revision 2, states that missing hazard groups may be evaluated using bounding arguments to cover the risk contributions not addressed by the PRA model.

The licensee provided qualitative assessments for the internal fires, seismic, and other external hazards in Section 3.3 of Attachment 1 of the LAR (Reference 1). For these hazards, the NRC staff reviewed the licensees qualitative assessments as discussed below.

Internal Fires To assess the contribution from internal fires, the licensee reviewed the Surry individual plant examination for external events (IPEEE) (Reference 27) (GL 88-20). The NRC staff reviewed the Surry IPEEE and reported the results in a letter dated March 7, 2007, Review of Surry Power Station Units 1 & 2 Individual Plant Examination of External Events (IPEEE) Submittal (Reference 28). The NRC staff concluded that, [o]n the basis of the IPEEE review, the staff concludes that the licensee's IPEEE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities.

In LAR Section 3.3 (Reference 1), the licensee listed the four areas identified in the Surry IPEEE that did not screen out as insignificant contributors. These four areas included the cable vault and tunnel, emergency switchgear room, main control room, and normal switchgear room.

The licensee stated, since fires in other areas, such as the cable spreading room where the reactor trip breakers are located, are not significant contributors to fire risk as characterized by the IPEEE, they are screened from further consideration. The licensee concluded that the fail-safe design and reliability of the normal reactor trip function, the availability of AMSAC to trip the reactor, and the reliability of operator actions to manually trip the reactor all contribute to the negligible contribution of internal fire risk associated with the proposed CT extension. The NRC staff reviewed the licensees assessment of the internal fire risk and finds that the licensee provided reasonable assurance that the contribution from internal fires for this risk-informed TS change is not significant because the licensee evaluated the IPEEE to assess the TS change and considered defense in depth, as well as the results from the RG 1.177 (Reference 8) risk analysis, which demonstrated that significant margin exists to the risk thresholds for the requested TS change.

Seismic Hazard In 2010, the Electric Power Research Institute (EPRI) published TR-1020756, Surry Seismic Probabilistic Risk Assessment Pilot Plant Review (Reference 29). In LAR Section 3.3 (Reference 1), the licensee stated that the seismic probabilistic risk assessment (SPRA) evaluated in the report represents the most accurate characterization of the seismic risk for Surry and identified ATWS as a very small contributor to seismic risk for Surry. In addition, the licensee reviewed the seismic-induced transients and loss-of-offsite-power events from its SPRA model and determined that the RTB OOS time does not play a significant role in these sequences. In summary, the licensee concluded that, due to the fail-safe design and reliability of the normal reactor trip function, and operator actions to shut down the reactor following a seismic event, the risk contribution from seismic events associated with the proposed CT extension is assessed to be negligible. The NRC staff finds that the licensee provided reasonable assurance that the contribution from seismic hazard for this risk-informed TS change is not significant because the Surry SPRA evaluation results were consistent with the WCAP-15376 (Reference 3) methodology, the licensee considered defense in depth, and the risk results from the RG 1.177 (Reference 8) risk analysis demonstrated that significant margin exists to the risk thresholds for the requested TS change.

Other External Hazards In LAR Section 3.3 (Reference 1), the licensee stated that it identified other external hazards and screened them using guidance in NUREG/CR-2300, PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants, Volume 2, issued January 1983 (Reference 30), and NUREG/CR-4839, Methods for External Event Screening Quantification: Risk Methods Integration and Evaluation Program (RMIEP) Methods Development, issued July 1992 (Reference 31). The licensee stated that it based its screening of external hazards on information from the Surry USFAR and NUREG/CR-4550, Analysis of Core Damage Frequency from Internal Events: Methodology Guidelines, Volume 1, issued April 1990 (Reference 32). The NRC staff finds acceptable the licensees conclusion that nonseismic and nonfire external events are not significant risk contributors to this application because the licensees screening of these external events is consistent with NRC-endorsed guidance, and the risk results provided by the licensee in LAR Table 1 demonstrated significant margin to the risk-acceptance guidelines in RG 1.174 (Reference 7) and RG 1.177 (Reference 8).

Non-Probabilistic Risk Assessment Methods Conclusions Section 2.4 of RG 1.174, Revision 3 (Reference 7), states, in part, [w]hen the calculated increase in CDF is very small (i.e., the increase in CDF falls within Region III of Figure 4), which is taken as being less than 10-6 per reactor year, the change is considered regardless of whether there is a calculation of the total CDF. In Table 1 of this SE, the NRC staff reviewed the licensees risk results and concluded that large margin exists to the RG 1.174 and RG 1.177 criteria for CDF, LERF, ICCDP, and ICLERP. Therefore, based on the discussion in Sections 3.4.2 and 3.4.3 of this SE, the NRC staff finds that the risk contribution from internal fires, seismic hazards, and other external hazards for the proposed TS CT extension is small and consistent with the guidance in RG 1.174 (Reference 7) and RG 1.177 (Reference 8).

3.5 Performance Monitoring RGs 1.174 and RG 1.177 also establish the need for an implementation and monitoring program to ensure that extensions to TS CTs do not degrade operational safety over time and that no adverse effects occur from unanticipated degradation or common-cause mechanisms.

The purpose of an implementation and monitoring program is to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the change. In addition, the application of the three-tiered approach in evaluating the extensions to CTs provides additional assurance that the changes will not significantly impact the key principle of defense in depth.

In LAR Section 3.4 (Reference 1), the licensee confirmed that the RTBs are included in the Maintenance Rule scope in accordance with 10 CFR 50.65, which requires a licensee to monitor the performance or condition of SSCs against licensee-established goals. The NRC staff finds that Surry satisfies the guidance in RG 1.174 and RG 1.177 for implementing and monitoring the proposed change, and, therefore, the licensees performance monitoring program is acceptable.

4.0 TECHNICAL CONCLUSION The NRC staff concludes that the licensee meets the requirements in GDC 13, 21, and 22 and in 10 CFR 50.36 and 10 CFR 50.65, and that the licensee has demonstrated the applicability of WCAP-17376-P-A, Revision 1, to Surry Units 1 and 2. The staff found the risk impacts for CDF, LERF, ICCDP, and ICLERP, as estimated by WCAP-15376-P-A, Revision 1, to be applicable to Surry Units 1 and 2 and the plant-specific function contribution to be within the acceptance guidelines in RGs 1.174 and 1.177. Thus, the NRC staff considered the licensees proposed change to TS Table 3.7-1 to restore an inoperable RTB to operable status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or be in at least hot shutdown within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> approved by the NRC staff for WCAP-15376-P-A, Revision 1, to be acceptable and that the proposed change will not impact the licensees continuous compliance with regulatory requirements and guidance prescribed in Section 2.3 of this SE.

5.0 STATE CONSULTATION

In accordance with the Commissions regulations, the NRC notified an official from the Virginia Division of Radiological Health of the proposed issuance of the amendment. On February 6, 2020, the State official confirmed that the Commonwealth of Virginia had no comments.

6.0 ENVIRONMENTAL CONSIDERATION

The amendment changes a requirement with respect to the installation or use of a facility component located within the restricted area, as defined in 10 CFR Part 20, Standards for Protection Against Radiation, and changes surveillance requirements. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released off site, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission previously issued a proposed finding that the amendments involve no significant hazards consideration, issued a proposed finding that the amendments involve no significant hazards consideration, published in the Federal Register on August 13, 2019 (84 FR 40094),

and the agency has received no public comments of this finding. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Under 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that (1) there is reasonable assurance that operation in the proposed manner will not endanger public health and safety, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of these amendments will not be inimical to the common defense and security or to public health and safety. Therefore, on the basis of the above review and justification, the staff concludes that the request proposed in Surrys submittal dated May 15, 2019, is acceptable.

8.0 REFERENCES

1.

Sartain, M.D., Dominion Energy Virginia, letter to U.S. Nuclear Regulatory Commission, Virginia Electric and Power Company, Surry Power Station Units 1 and 2, Proposed License Amendment Request Addition of 24-Hour Completion Time for An Inoperable Reactor Trip Breaker, May 15, 2019 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML19143A201).

2.

Sartain, M.D., Dominion Energy Virginia, letter to U.S. Nuclear Regulatory Commission, Virginia Electric and Power Company, Surry Power Station Units 1 and 2, License Amendment Request Addition of 24-Hour Completion Time for an Inoperable Reactor Trip Breaker, Response to NRC Request for Additional Information, December 12, 2019 (ADAMS Accession No. ML19350A004).

3.

Bryan, Robert.H., Westinghouse Owners Group (WOG), letter to U.S. Nuclear Regulatory Commission, Transmittal of Approved Topical Reports: WCAP-15376-P-A, Revision 1 (Proprietary), and WCAP-15377-NP-A, Revision 1 (Non-Proprietary), Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, March 19, 2003 (ADAMS Accession No. ML030870033).

4.

Westinghouse Owners Group (WOG) WOG-151, Rev. 0, Industry/TSTF [Technical Specification Task Force] Standard Technical Specification Change Traveler, TSTF-411, Revision 1, Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-15376-P), August 7, 2002 (ADAMS Accession No. ML022470164).

5.

Ruland, William H., U.S. Nuclear Regulatory Commission (NRC), letter to Robert H.

Bryan, Westinghouse Owners Group, Tennessee Valley Authority, Acceptance for Referencing of Topical Report WCAP-15376-P, Rev. 0, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, December 20, 2002 (ADAMS Accession No. ML023540534).

6.

Sheppard, J.J., Westinghouse Owners Group (WOG), letter to H. R. Denton, NRC, Submittal of WCAP-10271, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System, February 3, 1983 (ADAMS Accession No. ML20028G404).

7.

Thomas, Cecil.O., U.S. NRC, letter to J. J. Sheppard, Westinghouse Owners Group (WOG), Acceptance for Referencing of Licensing Topical Report WCAP-10271, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation Systems, February 21, 1985 (ADAMS) Accession No. ML18029A332, Non-Public).

8.

U.S. NRC, NUREG-1431, Standard Technical Specifications: Westinghouse Plants, September 1992 (ADAMS Accession No. ML13196A330).

9.

WCAP-14333-P, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, in letter dated June 20, 1995 (ADAMS Accession No. ML17309A583).

10.

Newton, R.A., Westinghouse Owners Group, letter to U.S. Nuclear Regulatory Commission, Transmittal of Reports: WCAP-14333-P [Proprietary] and WCAP-14334-NP [Nonproprietary] Entitled Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, June 20, 1995 (ADAMS Accession No. ML17263B245).

11.

U.S. Nuclear Regulatory Commission, Approval of WCAP-14333-P (Proprietary) and WCAP-14334-NP (Nonproprietary), Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion, April 29, 1998 (ADAMS Accession No. ML20013H811 -

Non-Public).

12.

Vaughn, Thomas, U.S. Nuclear Regulatory Commission (NRC), Email to Gary D. Miller, Dominion Energy, RAI Regarding Surry TSTF-411 LAR to Extend RX Trip Breaker TS CT to 24 Hours, November 13, 2019 (ADAMS Accession No. ML19323E221).

13.

U. S. NRC, SECY-92-223, Resolution of Deviations Identified During the Systematic Evaluation Program. September 18, 1992 (ADAMS Accession No. ML003763736).

14.

U.S. NRC, NUREG-1431, Volume 1, Revision 4, Standard Technical Specifications:

Westinghouse Plants, Revision 4, Volume 1, Specifications, April 2012 (ADAMS Accession No. ML12100A222).

15.

U.S. NRC, Regulatory Guide (RG) 1.174, Revision 3, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, January 2018 (ADAMS Accession No. ML17317A256).

16.

U.S. NRC, Regulatory Guide (RG) 1.177, Revision 1, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, May 2011, (ADAMS Accession No. ML100910008).

17.

U.S. NRC, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Chapter 16, Section 16.1, Revision 1, Risk-informed Decision Making: Technical Specifications, March 2007 (ADAMS Accession No. ML070380228).

18.

U.S. Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Chapter 19, Section 19.1, Revision 3, Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load, September 2012 (ADAMS Accession No. ML12193A107).

19.

U.S. NRC, NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Chapter 19, Section 19.2, Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis: General Guidance, June 2007 (ADAMS Accession No. ML071700658).

20.

Institute of Electrical and Electronics Engineers, Inc. (IEEE) Std 603-2009 Criteria for Safety Systems for Nuclear Power Generating Stations, 2009.

21.

Institute of Electrical and Electronics Engineers, Inc. (IEEE) Std 379 Application of the Single-Failure Criterion to Nuclear Generating Station Safety Systems, March 2015.

22.

U.S. NRC, Regulatory Guide (RG) 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, March 2009 (ADAMS Accession No. ML090410014).

23.

Cotton-Gross, K., U.S. NRC, letter to D. G. Stoddard, Virginia Electric and Power Company, Surry Power Station, Unit Nos. 1 and 2Issuance of Amendments Regarding Extension of Technical Specification 3.14, Service Water Flow Path Allowed Outage Times and Deletion of Expired Temporary Service Water Jumper Requirements, (Amendments 289 and 289) May 31, 2017 (ADAMS Accession No. ML17100A253).

24.

Cotton-Gross, K., U.S. Nuclear Regulatory Commission, letter to Stoddard, D.G.,

Virginia Electric and Power Company, Surry Power Station, Unit Nos. 1 and 2 Issuance of Amendments Regarding the Extension of the Emergency Service Water Pump Allowed Outage Time, July 28, 2017 (ADAMS Accession No. ML17170A183).

25.

Anderson, V. K., Nuclear Energy Institute (NEI), letter to Stacey Rosenberg, NRC, Final Revision of Appendix X to NEI 05-04/07-12/12-1[6], Close-Out of Facts and Observations, dated February 21, 2017 (ADAMS Package Accession No. ML17086A431).

26.

Giitter, J., and Ross-Lee, M.J., U.S. Nuclear Regulatory Commission, letter to Krueger, G.,

Nuclear Energy Institute, U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 07-12, and 12-13, Close-Out of Facts and Observations (F&Os), May 3, 2017 (ADAMS Accession No. ML17079A427).

27.

OHanlon, J.P., Virginia Electric and Power Company, letter to U.S. NRC, Virginia Electric and Power Company, Surry Power Station Units 1 and 2, Response to Generic Letter 88-20, Supplement 4 Individual Plant Examination of Non-Seismic External Events and Fires, December 14, 1994 (ADAMS Accession No. ML080100404).

28.

King, T.L., U.S. NRC, Memorandum to Zwolinski, J.A., U.S. NRC, Review of Surry Power Station Units 1 and 2 Individual Plant Examination of External Events (IPEEE)

Submittal, March 7, 2000 (ADAMS Accession No. ML003692174).

29.

Electric Power Research Institute, EPRI TR-1020756, Surry Seismic Probabilistic Risk Assessment Pilot Plant Review, July 2010.

30.

U.S. Nuclear Regulatory Commission, NUREG/CR-2300, PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants, Volume 2, Chapters 9-13 and Appendices A-G, January 1983 (ADAMS Accession No. ML063560440).

31.

U.S. Nuclear Regulatory Commission, NUREG/CR-4839, Methods for External Event Screening Quantification: Risk Methods Integration and Evaluation Program (RMIEP)

Methods Development, July 1992 (ADAMS Accession No. ML062260210).

32.

U.S. Nuclear Regulatory Commission, NUREG/CR-4550, Volume 1, Analysis of Core Damage Frequency: Surry, Unit 1 Internal Events, April 1990 (ADAMS Accession No. ML070580453).

Principal Contributors: Adrienne Brown Hari Kodali Date: May 19, 2020

ML20085G964

• Via Memorandum, **Via e-mail OFFICE NRR/DORL/ LPL2-1/PM*

NRR/DORL/LPL2-1/LA NRR/DRA/APLA/BC*

NAME VThomas KGoldstein RPascarelli DATE 03/23/2020 04/30/2020 02/05/2020 OFFICE NRR/DEX/EEOB/BC*

OGC**

NRR/DORL/LPL2-1/BC*

NAME BTitus AGhosh Nabaer MMarkley DATE 02/06/2020 04/21/2020 05/19/2020 OFFICE NRR/DORL/LPL2-1/PM*

NAME GEMiller DATE 05/19/2020