ML22172A134

License Amendment Request 10-Day Allowed Outage Time for Opposite Unit Auxiliary Feedwater (AFW) Cross-Connect Capability

ML22172A134
Person / Time
Site:	Surry
Issue date:	06/20/2022
From:	Lawrence D Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
22-081
Download: ML22172A134 (42)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 June 20, 2022 10 CFR 50.90 U.S. Nuclear Regulatory Commission Serial No.: 22-081 Attention: Document Control Desk NRA/GDM: R3 Washington, D.C. 20555 Docket Nos.: 50-280/281 License Nos.: DPR-32/37 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS 1 AND 2 LICENSE AMENDMENT REQUEST 10-DAY ALLOWED OUTAGE TIME FOR OPPOSITE UNIT AUXILIARY FEEDWATER (AFW} CROSS-CONNECT CAPABILITY Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion Energy Virginia) requests an amendment to Facility Subsequent Renewed Operating License Numbers DPR-32 and DPR 37 in the form of a change to the Technical Specifications (TS) for Surry Power Station (SPS) Units 1 and 2. The proposed change revises SPS TS 3.6.1.2 to include a 10-day Allowed Outage Time (AOT) for opposite unit Auxiliary Feedwater (AFW) cross-connect capability specific to when maintenance that would result in the inoperability of all three of the opposite unit's Auxiliary Feedwater (AFW) pumps is being performed. The proposed change would provide sufficient time to make repairs to the SPS Unit 2 AFW full flow recirculation piping connected to the Unit 2 Emergency Condensate Storage Tank (ECST). This license amendment request (LAR) is necessary to prevent an unnecessary shutdown of the opposite unit (resulting in a dual unit outage) due to the unavailability of opposite unit AFW cross-connect capability.

A permanent TS change is being requested, as opposed to a one-time change, since Unit 2 pipe repair/replacement activities are currently scheduled for the spring 2023 refueling outage (RFO) to address previously identified pipe leaks, and similar repairs may prove necessary for the corresponding Unit 1 AFW full flow recirculation piping following inspection activities planned for the fall 2022 refueling outage (RFO), although no leaks have been identified in this piping to date. The proposed 10-day AOT would also facilitate future maintenance activities on AFW system components should those activities result in the inoperability of all three unit-specific AFW pumps, e.g., ECST maintenance.

The proposed change is based on a risk evaluation performed in accordance with Regulatory Guides (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," which demonstrates the increase in risk associated with the 10-day AOT is acceptably small for both core damage frequency and large early release frequency with considerable remaining margin. A discussion of the proposed license amendment is provided in Attachment 1. The marked-up and typed proposed TS pages are provided in Attachments 2 and 3, respectively. The associated TS Basis change supports the proposed license amendment and is provided for the NRC's information.

Serial No.22-081 Docket Nos. 50-280/281 Proposed LAR-TS 3.6.1.2 Page 2 of 4 Dominion Energy Virginia has evaluated the proposed license amendment and has determined that it does not involve a significant hazards consideration as defined in 10 CFR 50.92. The basis for that determination is provided in Attachment 1. We have also determined that operation with the proposed change will not result in any significant increase in the amount of effluents that may be released offsite and no significant increase in individual or cumulative occupational radiation exposure. Therefore, the proposed amendment is eligible for categorical exclusion as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment is needed in connection with the approval of the proposed change. The basis for this determination is also provided in Attachment 1. The LAR has been reviewed and approved by the Facility Safety Review Committee.

Dominion Energy Virginia requests NRC review and approval of the proposed LAR by April 30, 2023, with a 30-day implementation period.

If you have any further questions or require additional information, please contact Mr. Gary D. Miller at (804) 273-2771.

Douglas . awrence Vice President - Nuclear Engineering and Fleet Support Attachments:

1. Description and Assessment

2. Proposed Technical Specifications Pages (Marked-Up)

3. Proposed Technical Specifications Pages (Typed) CRAIG D SLY Notary Public COMMONWEAL TH OF VIRGINIA Commonwealth of Virginia Reg.# 7518653 ~

My Commission Expires December 31, 20...:!

COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mr. Douglas C. Lawrence, who is Vice President - Nuclear Engineering and Fleet Support, of Virginia Electric and Power Company. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this 2ath day of S I..L1\...t..... , 2022.

My Commission Expires: I i.j 31 ( 1.:f Notary Public

Serial No.22-081 Docket Nos. 50-280/281 Proposed LAR - TS 3.6.1.2 Page 3 of 4 Commitments contained in this letter:

When entering the 10-day allowed outage time for the specific purpose of performing maintenance related to the operability of all three of the opposite unit's auxiliary feedwater pumps, the following compensatory actions are required to be in place:

• Additional AFW system maintenance, including associated water sources, or changes in plant configuration that would result in a risk significant configuration will be precluded;

• Weather conditions will be monitored, and AFW maintenance affecting operability of the opposite unit cross-connect will not be scheduled if severe weather conditions are anticipated;

• The opposite unit's steam-driven AFW pump will be controlled as "Protected Equipment";

• TRM compensatory actions to address 10 CFR 50.65(a)(4) fire risk related to the AFW cross-connect unavailability, which include periodic walkdowns in relevant fire areas, will be taken; and

• The AFW BOB/FLEX pump will be pre-staged to provide AFW defense-in-depth comparable to the AFW cross-connect.

Serial No.22-081 Docket Nos. 50-280/281 Proposed LAR - TS 3.6.1.2 Page 4 of 4 cc: U.S. Nuclear Regulatory Commission - Region II Marquis One Tower 245 Peachtree Center Avenue, NE Suite 1200 Atlanta, GA 30303-1257 Mr. L. John Klos NRC Project Manager - Surry U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 09 E-3 11555 Rockville Pike Rockville, MD 20852-2738 Mr. G. Edward Miller NRC Senior Project Manager - North Anna U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 09 E-3 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Surry Power Station State Health Commissioner Virginia Department of Health James Madison Building - 7th floor 109 Governor Street Suite 730 Richmond, VA 23219

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 DESCRIPTION AND ASSESSMENT Virginia Electric and Power Company (Dominion Energy Virginia)

Surry Power Station Units 1 and 2

Serial No.,22-081 Docket Nos. 50-280/281 Attachment 1 DESCRIPTION AND ASSESSMENT 1.0

SUMMARY

DESCRIPTION ............................................................................ 2 2.0 DETAILED DESCRIPTION ............................................................................ 2 2.1 System Design and Operation .................. .... ............ ..... .... ..... ..... ........... 2 2.2 Reason for the Proposed Change .......................................................... 3 2.3 Current Technical Specifications Requirements ..................................... 5 2.4 Description of the Proposed Change ........... .... ...... .............. ................... 6

3.0 TECHNICAL EVALUATION

.......................................................................... 8 3.1 Risk Assessment ...... ... ..................... ......... ............................................ 8 3.2 Compensatory Measures ........................................................................ 19

4.0 REGULATORY EVALUATION

...................................................................... 20 4.1 Applicable Regulatory Requirements/Criteria ......................................... 20 4.2 No Significant Hazards Consideration .................................................... 21 4.3 Environmental Assessment .................................................................... 24

5.0 CONCLUSION

................................................................................................ 24

6.0 REFERENCES

............................................................................................... 25 FIGURES ............................................................................................................... 26 Page 1 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 DESCRIPTION AND ASSESSMENT 1.0

SUMMARY

DESCRIPTION Pursuant to 10 CFR 50.90, Virginia Electric and Power Company (Dominion Energy Virginia) requests an amendment to Facility Subsequent Renewed Operating License Numbers DPR-32 and DPR 37 in the form of a change to the Technical Specifications (TS) for Surry Power Station (SPS) Units 1 and 2, respectively. The proposed change revises TS 3.6.1.2 to include a 10-day Allowed Outage Time (AOT) for opposite unit cross-connect capability due to the occasional need to perform maintenance on the Auxiliary Feedwater (AFW) System that would affect the operability of all three of the opposite unit's AFW pumps. The 10-day AOT would provide sufficient time to make repairs, as necessary, on the common, non-isolable SPS Units 1 and 2 AFW full flow recirculation piping, as well as future maintenance activities on common AFW System piping and components that would result in the inoperability of all three unit-specific AFW pumps. This amendment request is necessary to prevent an unnecessary shutdown of the opposite unit (resulting in a dual unit outage) due to the unavailability of opposite unit AFW cross-connect capability. A permanent TS change is being requested, as opposed to a one-time change, since Unit 2 pipe repair/replacement activities are currently scheduled for the spring 2023 refueling outage (RFO) to address previously identified pipe leaks, and similar repairs may prove necessary for the corresponding Unit 1 AFW full flow recirculation piping following inspection activities planned for the fall 2022 refueling outage (RFO), although no leaks have been identified in this piping to date.

A risk evaluation of the proposed change has been performed in accordance with Regulatory Guides (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," which demonstrated the risk associated with a 10-day AOT for opposite unit AFW cross-connect capability is acceptably small for both core damage frequency (GDF) and large early release frequency (LERF) with considerable remaining margin.

2.0 DETAILED DESCRIPTION 2.1 System Design and Operation The SPS AFW System (see Figure 1) provides a source of feedwater to the secondary side of the steam generators (SGs) at times when the Main Feedwater (MFW) System is not available, thereby maintaining the heat sink capabilities of the SGs. The system is relied upon to prevent core damage and Reactor Coolant System (RCS) overpressurization in the event of transients, such as a loss of normal feedwater or a secondary system pipe rupture, and to provide a means for plant cooldown following any plant transient.

Page 2 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 The AFW System for each unit consists of two motor-driven AFW pumps, each rated for 350 gallons per minute (gpm) at 2730 feet of head, one steam-driven AFW pump rated for 700 gpm at 2730 feet of head, a 110,000 gallon Emergency Condensate Storage Tank (ECST), and associated piping, headers, valves, controls, and instrumentation.

The two motor-driven AFW pumps and the steam-driven AFW pump provide power source diversity for automatic actuation of the AFW supply. The AFW pumps, powered by either power source (i.e., motor-driven or steam-driven), provide adequate capacity to cool the RCS when required. The amount of AFW flow required is dependent upon the amount of decay heat being generated, the rate of cooldown desired for the RCS, and the heat being added to the RCS by operating reactor coolant pumps. Although the flowpaths from the pumps to the SGs include common piping, the configuration of the system provides two redundant flowpaths. The components in one flowpath are supplied by the "H" emergency bus, while the other is supplied by the "J" emergency bus. The AFW Systems for Units 1 and 2 are cross-connected to provide additional redundancy in case a single event, such as a fire or a high energy line break in the Main Steam Valve House (MSVH) where the pumps are physically located, disabled the AFW System on one unit.

Following a reactor trip (with the MFW System not available), heat removal from the RCS is accomplished by maintaining the heat sink on the secondary side of the SGs with the AFW System and releasing steam either to the condensers through the steam dump valves or to the atmosphere through a combination of the SG safety valves and available atmospheric steam dump valves. The AFW System feeds water to the SGs at a rate that both maintains adequate heat transfer and restores SG level to the narrow range where it can be maintained and controlled. The AFW System must be capable of functioning for extended periods to either allow for restoration of normal feedwater flow or to proceed with an orderly cooldown of the unit to RCS conditions where the Residual Heat Removal (RHR) System can be used for decay heat removal.

AFW flow and stored water capacity must be sufficient to provide for removal of core decay heat, reactor coolant pump heat, and sensible heat during plant cooldown. The core decay heat and RCS sensible heat loads increase as a function of the operating reactor power level. The design basis accident for the AFW System is a loss of normal feedwater with offsite power available (the reactor coolant pumps keep operating).

[Reference SPS Updated Final Safety Analysis Report (UFSAR) Chapter 14.2.11.1].

Required AFW flow can be delivered assuming the most limiting single failure, which is the loss of the steam-driven AFW pump.

2.2 Reason for the Proposed Change On December 10, 2021, following an identified increase in the Unit 2 ECST (2-CN-TK-1) leak rate, a plant walkdown was performed in an attempt to identify the source of the leakage. The walkdown determined the most likely location of the leak was in a common, non-isolable portion of the Unit 2 AFW full flow recirculation line that Page 3 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 returns to the ECST. lnoperability of the ECST renders all three associated AFW pumps inoperable, and TS 3.6.F.2 requires action to be taken immediately to return one pump to operability. The leak location was subsequently determined to be in the buried portion of the full flow recirculation pipe; consequently, the pipe was excavated to identify and characterize the leak and to determine the required repair. Once the pipe was excavated, the pipe was inspected and two through-wall leaks were identified. The leaks were appropriately characterized, temporary patches were installed, and periodic inspections were commenced pursuant to the requirements of ASME Code Case N-513-4, "Evaluation Criteria for Temporary Acceptance of Flaws in Moderate Energy Class 2 or 3 Piping." The highlighted portion of Figure 2 indicates the specific pipe where the leaks were located (6"-WCMU-174-151).

Prior to the determination that ASME Code Case N-513-4 could be used to address the pipe leaks on an interim basis, the potential existed that the pipe would need to be replaced. A schedule to replace the pipe was prepared, and it was determined that it would take eight (8) days to complete the work activities. However, TS 3.6.1.2, which addresses opposite unit AFW cross-connect capability, only provides a 72-hour AOT for inoperability of both of the opposite unit's flowpaths; the opposite unit's protected condensate storage tank (i.e., the ECST); the cross-connect piping from the opposite unit; or three of the opposite unit's AFW pumps. Consequently, replacement of the Unit 2 AFW full flow recirculation piping could not have been completed within the TS 3.6.1.2 72-hour AOT for the Unit 2 cross-connect to Unit 1 and would have required taking Unit 1 offline to complete the Unit 2 pipe repair. An emergency license amendment request (LAR) was prepared to request a one-time extension to the Unit 1 opposite unit AFW cross-connect 72-hour AOT but was ultimately not required once it was determined ASME Code Case N-513-4 could be used to maintain the operability of the Unit 2 AFW piping, ECST, AFW pumps and opposite unit cross-connect capability until permanent pipe repairs could be implemented during the next scheduled RFO.

However, as a result of the events noted above, it was recognized that even if Unit 2 were shut down, the Unit 2 pipe replacement activities could not be completed without also requiring the shutdown of Unit 1 because of the loss of opposite unit (i.e., Unit 2)

AFW cross-connect capability due to rendering the three Unit 2 AFW pumps inoperable to replace the pipe. Specifically, Unit 1 would enter the TS 3.6.1.2 72-hour AOT for the loss of the opposite unit AFW cross-connect capability. However, as previously noted as outlined below, the Unit 2 AFW full flow recirculation pipe replacement schedule requires eight days to complete the work; consequently, Unit 1 would have to be shut down upon the expiration of the 72-hour AOT.

Pipe Repair/Replacement Work Activities/Schedule The currently planned work activities and schedule associated with the replacement of the Unit 2 AFW full flow recirculation piping are listed below and demonstrate the need for the 10-day AOT for opposite unit cross-connect capability.

Page 4 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Day 1 Commence excavation of the affected line requiring repair.

Day 2 Complete excavation of affected line and potential freeze location.

Day 3 Perform NOE and necessary preparations for implementation of 6-inch freeze seal, install 6-inch freeze chamber, and establish 6-inch pipe freeze.

Day 4 Verify and implement tagout for 6-inch pipe plug, cut hole and drain isolated pipe, and cut out pipe Sections 1 (AFW pump side) and 2 (middle section of pipe).

Day 5 Cut out pipe Section 3 (2-CN-TK-1 side), prep existing welds, rig and weld in 6-inch pipe Section 3.

Day 6 Rig and weld in 6-inch pipe Section 2.

Day 7 Rig and weld in 6-inch pipe Section 1, complete NOE, and perform post-maintenance testing (PMT) to return the full flow recirculation line to service.

Day 8 Clear tagout and backfill excavated area.

Therefore, provision of a 10-day AOT for opposite unit cross-connect capability is necessary to permit the completion of the Unit 2 pipe replacement work activities, without requiring the shutdown of Unit 1, and to provide margin should unanticipated issues arise during the replacement work. The 10-day AOT would also be necessary should similar pipe repair/replacement activities prove necessary for the corresponding Unit 1 AFW full flow recirculation piping, as well as future repair activities, as necessary, to common, non-isolable AFW piping and components, e.g., the ECSTs, that would result in the inoperability of all three AFW pumps.

2.3 Current Technical Specifications Requirements SPS TS 3.6.C.4.a requires the operability of the opposite unit's AFW system as follows:

a. Two of the three auxiliary feedwater pumps and the associated redundant flowpaths on the opposite unit (automatic initiation instrumentation need not be OPERABLE) capable of being used with the opening of the cross-connect.

If TS 3.6.C.4.a cannot be met due to the unavailability of opposite unit cross-connect capability, the affected unit must enter TS 3.6.1, which states, in part, I. The requirements of Specification 3. 6. C.4 above concerning the opposite unit's auxiliary feedwater pumps; the associated redundant flowpaths, including piping, headers, valves, and control board indication; the cross-connect piping from the Page 5 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 opposite unit; and the protected condensate storage tank may be modified to allow the following components to be inoperable, provided immediate attention is directed to making repairs. Automatic initiation instrumentation associated with the opposite unit's auxiliary feedwater pumps need not be OPERABLE.

1. One of the opposite unit's flowpaths or two of the opposite unit's auxiliary feedwater pumps may be inoperable for a period not to exceed 14 days.

2. Both of the opposite unit's flowpaths; the opposite unit's protected condensate storage tank; the cross-connect piping from the opposite unit; or three of the opposite unit's auxiliary feedwater pumps may be inoperable for a period not to exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> ...

If the above requirements are not met, be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be less than 350°F and 450 psig within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

2.4 Description of Proposed Change Repair/replacement of the common Unit 2 AFW full flow recirculation piping results in the inoperability of the opposite unit AFW cross-connect function for Unit 1. TS 3.6.1.2 provides a 72-hour AOT for the opposite unit AFW cross-connect function. As detailed above, the currently planned pipe repair schedule indicates it will take eight days to complete the work activities; consequently, the AFW full flow recirculation pipe replacement cannot be completed within the existing 72-hour AOT and would require Unit 1 to be shut down in addition to Unit 2. To avoid the unnecessary transient and shutdown of SPS Unit 1, as a result of the unavailability of opposite unit cross-connect capability due to three inoperable Unit 2 AFW pumps, a 10-day AOT is being added to TS 3.6.1.2 to allow time for the repair, testing, and return to service of the Unit 2 AFW full flow recirculation piping and the Unit 2 cross-connect function. Since similar repairs may be necessary for the Unit 1 AFW full flow recirculation piping, a permanent TS change is being proposed as opposed to a one-time TS change. The proposed TS 3.6.1.2 10-day AOT will also facilitate occasional future AFW work activities on non-isolable, common, AFW system piping or components that would result in the inoperability of the three opposite unit's AFW pumps, e.g., ECST maintenance.

Conforming changes to the TS 3.6 Basis are also being made and are included for the NRC's information.

TS 3.6.1.2 is being revised as follows (change indicated in bold text):

Both of the opposite unit's flowpaths; the opposite unit's protected condensate storage tank; the cross-connect piping from the opposite unit; or three of the opposite unit's auxiliary feedwater pumps may be inoperable for a period not to exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For the specific purpose of performing maintenance related to the operability of all three of the opposite unit's auxiliary feedwater pumps, these components may be inoperable for a period not to exceed 10 days.

Page 6 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 The TS 3.6 Basis is being revised to add the following text:

Due to the occasional need to perform maintenance on common AFW components that would render all three AFW pumps on the opposite unit inoperable, e.g., the AFW pumps' full flow recirculation piping or the protected condensate storage tank, a 10-day allowed outage time is provided for opposite unit AFW cross-connect capability. The 10-day allowed outage time is supported by a risk assessment that demonstrates the associated risk is acceptably small for both CDF and LERF with considerable margin remaining. When entering the 10-day allowed outage time for the specific purpose of performing maintenance related to the operability of all three of the opposite unit's auxiliary feedwater pumps, the following compensatory actions are required to be in place:

• Additional AFW system maintenance, including associated water sources, or changes in plant configuration that would result in a risk significant configuration will be precluded;

• Weather conditions will be monitored and AFW maintenance affecting operability of the opposite unit cross-connect will not be scheduled if severe weather conditions are anticipated;

• The steam-driven AFW pump will be controlled as "Protected Equipment";

• The Technical Requirements Manual compensatory actions to address 10 CFR

50. 65 (a)(4) fire risk related to AFW cross-connect unavailability, which include periodic walkdowns in relevant fire areas, will be taken; and

• The BDBIFLEX AFW pump will be pre-staged to provide AFW defense-in-depth comparable to the AFW cross-connect.

It should be noted that AFW System maintenance activities that would result in three inoperable AFW pumps and the need to enter the 10-day AOT is extremely limited due to the redundant design inherent in the AFW System. The proposed change will facilitate the small subset of AFW maintenance activities that would result in the inoperability of all three AFW pumps on a particular unit including completion of the Unit 2 AFW full flow recirculation pipe repair activities, repairs to the corresponding Unit 1 piping, as required, ECST maintenance (e.g., tank weld or coating repairs), etc., and precludes the unnecessary shutdown of an operating unit and the known risks from complex and infrequent plant shutdown and startup evolutions with no corresponding benefit to public health and safety. Finally, as detailed in Section 3.0 below, a risk assessment of the proposed change has been performed and demonstrates the reliability of the AFW System is not significantly impacted by the proposed TS 3.6.1.2 10-day AOT.

Page 7 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1

3.0 TECHNICAL EVALUATION

The proposed TS change includes a 10-day AOT in TS 3.6.1.2 for opposite unit cross-connect capability due to maintenance activities related to the operability of all three of the opposite unit's AFW pumps to facilitate necessary unit-specific common AFW pipe repairs, ECST maintenance, etc., without requiring the shutdown of the operating unit.

3.1 Risk Assessment A risk assessment of the proposed 10-day AOT for opposite unit AFW cross-connect capability was performed to determine the impact on Core Damage Frequency (CDF) and Large Early Release Frequency (LERF), as well as the Incremental Conditional Core Damage Probability (ICCDP) and the Incremental Conditional Large Early Release Probability (ICLERP).

3.1.1 Analysis 3.1.1.1 Inputs The following inputs were used for this assessment:

• Surry Average Maintenance PRA model R06e

• Regulatory Guide 1.174

• Regulatory Guide 1.177

• CAFTA code suite 3.1.1.2 Risk Impact Evaluation The NRC staff has identified a three-tiered approach in RG 1.177 for licensees to evaluate the risk associated with TS Completion Time changes (AOTs in the SPS TS).

The following sections document the three-tiered approach used for the evaluation of the proposed TS change.

3.1.1.3 Reg Guide 1.177 PRA Quality Evaluation RG 1.177 contains the following discussion of PRA Technical Adequacy:

The technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. That is, the more the potential change in risk or the greater the uncertainty in that risk from the requested TS change, or both, the more rigor that must go into ensuring the technical adequacy of the PRA. This applies to Tier 1 (above), and it also applies to Tier 2 and Tier 3 to the extent that a PRA model is used.

Page 8 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Regulatory Guide 1.200 describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decision making for light-water reactors.

A discussion of SPS PRA quality was provided in the SPS license amendment request to adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors," dated December 6, 2019 (Reference 6.1). The NRC staff evaluated the scope of the PRA including: (1) peer-review history and results (includes open Findings and Observations (F&Os)); (2) the F&O closure process; (3) credit for mitigating strategies (FLEX) in the PRA; and (4) assessment of assumptions and approximations, and documented their acceptance in the safety evaluation report included in SPS Units 1 and 2 Amendment Nos. 301/301 dated December 8, 2020 (Reference 6.2). The disposition of the six outstanding F&Os as discussed in those documents is applicable to this LAR as well. Included in the model is a correction to a Human Error Probability (HEP) that restarts MFW after a Safety Injection (SI) signal. The HEP needed to be coupled with an SI signal to satisfy the initial conditions for the HEP.

The six F&Os in the Surry internal events PRA model that are currently open and their impact on this application are described in the table below.

Page 9 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Disposition of Currently Open F&Os - Surry Internal Events PRA Model Peer Review F&O# Summary of Finding Impact ofF&O on Proposed Change Feb 2017 19-7 Success criteria for MSLB include the impact of This F&O was resolved in the model used to perform Peer failure to isolate AFW to the faulted SG with a small this analysis. The impact of main steam isolation Review probability of vessel failure. The more likely impact failures on AFW was explicitly modeled for MSLB of failure to isolate AFW is more rapid depletion of sequences.

CST inventory. This should be included in the MSLB sequences.

May2018 QU-F2-01 Dominions PRA update process periodically creates This F&O was resolved in the model used to perform Peer a new "model ofrecord" that addresses the this analysis. A truncation study was conducted with Review requirements of QU-F2 & QU-F3. However interim this model and a detailed review of the quantification updates are performed to maintain the PRA results was performed to ensure that quantification consistent with the as-built/as-operated plant that meets the PRA standard requirements.

do not address all ofrequirements of QU-F2 &

QU-F3. This FSPR reviewed interim model MC.1, which did not include the comprehensive results analysis such as, but not limited to, the truncation level sensitivity study required to meet the standard.

October 2018 HR-Al-01 The SR states "for equipment modeled in the PRA, A detailed review of test and maintenance procedures Peer Review IDENTIFY activities ... "The system notebooks was previously performed to determine which pre-contain (1) a list oftest and maintenance initiator human error events should be included in the procedures that are "modeled as potential model. Improving the documentation to clarify the pre-initiator human error events", and (2) a list of link between procedures, T&M events, and pre-other test and maintenance procedures that "do initiator HFEs will not impact the model not involve pre-initiator human error events". It is quantification, so this finding has no impact on the not clear what the bases are for selection of the acceptability of this analysis.

procedures to be modeled as pre-initiators.

Attachment 8 to the system notebooks includes a tab "T&M Unavailability BEs" that lists test and maintenance unavailability events, and a tab Page 10 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Disposition of Currently Open F&Os - Surry Internal Events PRA Model Peer Review F&O# Summary of Finding Impact of F&O on Proposed Change "Human Actions" listing the pre-initiators defined for the system, but there is no documented link between procedure, T&M event and pre-initiator HFE.

October 2018 HR-B1-01 Screening criteria that can be used to screen Additional documentation clarifying the bases on how Peer Review components/failure modes from further T&M events were screened out from inclusion as pre-consideration for preinitiators are provided in initiator human error events will not impact model Attachment 2 of NF-AA-PRA 101-2051, Revision 4. quantification, so this finding has no impact on the However, the screening criteria applied to the acceptability of this analysis.

screening of procedures and activities are not documented. In Attachment 8 of the system notebooks, maintenance unavailability events are listed in the "T&M Unavailability BEs". Each such activity should have a corresponding preinitiator HFE, unless it can be screened out. When comparing the list ofT&M events to the list in the "Human Actions" tab, it is not clear on what bases T&M activities were screened out, and it is not clear which HFEs relate to which activities.

October 2018 IE-A6-01 Common cause failures of CW and SW components Common cause failures of Circulating Water (CW) and Peer Review are not included in the initiating event fault trees. Service Water (SW) components are included in the Evaluate the inclusion of initiating event common Surry PRA model. For a cooling water support system causes, such as pump failures and traveling screen initiating event (SSIE) to take place, a single failure is plugging in the LOCW event tree. Include the evaluated over a mission time of one year and events or document the basis for exclusion. combined with failure modes of the parallel components (including common cause) over a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This is an industry standard method of modeling SSIEs as described in EPRI TR-1016741.

Modeling a common cause failure of multiple trains of Page 11 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Disposition of Currently Open F&Os - Surry Internal Events PRA Model Peer Review F&O# Summary of Finding Impact ofF&O on Proposed Change cooling water components over a mission time of one year would be excessively conservative as it would assume the first failure would be unable to be repaired during the mission time in the extensive period before the subsequent failures took place.

Additional documentation justifying the current modeling of cooling water systems will not impact model quantification, so this finding has no impact on the acceptability of this analysis.

October 2018 SY-All- SY-A11 directs the analyst to exclude components The component exclusion was reviewed for SPS-SY.2 Peer Review 01 only if the quantification criteria presented in and noted only additional instrumentation failures in SY-A15 are met. Although some components were Instrument Air (IA), Charging (CH) and Safety excluded based on the criteria in SY-A15, some Injection (SI) systems were needed. These additional components were excluded based on qualitative instrumentation failures will be included in a future arguments such as "failure frequency was model, but these changes are expected to have a negligible". negligible impact on quantification, so this finding does not impact the risk assessment for this application.

Page 12 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Regulatory Guide 1.177 contains the following discussion concerning Tier 1 Analysis:

In Tier 1, the licensee should assess the impact of the proposed TS change on GDF, ICCDP, LERF, and ICLERP. To support this assessment, two aspects need to be considered: (1) the validity of the PRA and (2) the PRA insights and findings. The licensee should demonstrate that its PRA is valid for assessing the proposed TS changes and identify the impact of the TS change on plant risk.

TS conditions addressed by CTs are entered infrequently and are temporary by their very nature. However, TS do not typically restrict the frequency of entry into conditions addressed by CTs. Therefore, the following TS acceptance guidelines specific to permanent CT changes are provided for evaluating the risk associated with the revised CT, in addition to those acceptance guidelines given in Regulatory Guide 1. 174:

The licensee has demonstrated that the TS CT change has only a small quantitative impact on plant risk. An ICCDP of less than 1. 0 x 10-6 and an ICLERP of less than 1.0 x 10- 7 are considered small for a single TS condition entry. (Tier 1).

Regulatory Guide 1.174 Acceptance Criteria are as follows:

• When the calculated increase in CDF is very small, which is taken as being less than 1o-6 per reactor year, the change will be considered regardless of whether there is a calculation of the total CDF (Region Ill).

• When the calculated increase in CDF is in the range of 1o-6 per reactor year to 10-5 per reactor year, applications will be considered only if it can be reasonably shown that the total CDF is less than 104 per reactor year (Region II).

• Applications that result in increases to CDF above 10-5 per reactor year (Region I) would not normally be considered.

• Acceptance criteria for LERF are structured similarly at an order of magnitude less (1.0E-7, etc.)

Tier 1 Analysis Assumptions

• The SPS PRA model R06e is valid for performing this assessment as demonstrated in the PRA Quality Review.

• The SPS Units 1 and 2 AFW cross-connect will be failed by failing cross-connect check valves 1-FW-272 and 2-FW-272.

• One of the AFW cross- connect motor-operated valve (MOV) maintenance terms was increased to 2.7E-02, and the opposite MOV maintenance term was increased to 1.00. This relates to using the entire proposed 10-day AOT every Page 13 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 year for each cross-connect valve. This conservative modeling demonstrates the amount of margin each risk metric has due to configuration risk.

Tier 1 Analysis Results The AFW cross-connect is explicitly modeled in the average maintenance model R06e.

Therefore a ~CDF and ~LERF for the proposed 10-day AOT for AFW cross-connect capability can be directly calculated. Incremental core damage and large early release probabilities for a 10-day period with an AFW cross-connect unavailable are also calculated.

Table 1: Tier 1 Criteria RG 1.177 RG 1.177 U1 8CDF U2 ~CDF 8CDF U1 ~LERF U28LERF ~LERF Criteria Criteria 10 DaysNear 1.15E-08 1.16E-08 1.00E-06 2.35E-09 2.36E-09 1.00E-07 Unavailability RG 1.177 RG 1.177 U1 ICCDP U2 ICCDP ICCDP U1 ICLERP U2 ICLERP ICLERP Criteria Criteria Single 10-day 9.64E-09 1.02E-08 1.00E-06 1.99E-09 2.03E-09 1.00E-07 TS Entry As evidenced in Table 1, extensive margin exists in the Reg Guide 1.177 acceptance criteria. Cutsets for these configurations were reviewed and are discussed below.

The dominant risk scenario is a high energy line break (HELB, either Feedwater (FW) or Main Steam (MS)) in the Unit 1 MSVH that could damage the Unit 1 AFW pumps. This scenario would leave Unit 1 without any source of AFW, leaving feed and bleed cooling as the only method of decay heat removal.

Shutdown Risk Evaluation In cases where there is no probabilistic shutdown PRA model available for evaluating the risk impact of a proposed change, as is currently the case with the SPS PRA, a qualitative evaluation process may be applied to assess shutdown risk. In general, this approach involves determining whether the proposed change affects functions that are credited in station administrative procedure OU-AA-200, "Shutdown Risk Management,"

and then considering what impacts the application may have on shutdown defense-in-depth, in particular, the following shutdown key safety functions: Decay Heat Removal, Page 14 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Reactor Coolant System/Spent Fuel Pool Inventory Control, Reactivity Control, Electrical Power, Spent Fuel Pool Cooling, and Containment Integrity.

When the RCS is ~ 84 psig and the SG tubes are filled, there must be mandatory backup cooling either with Natural Circulation or Forced Feed and Bleed. The equipment required for Natural Circulation is one of the motor-driven AFW pumps with the ECST, or the Condensate Storage Tank (CST) with the AFW booster pumps. A backup to this requirement is the U2 AFW cross-connect. Since the AFW cross-connect is only the backup to the Natural Circulation requirement for shutdown when the RCS pressure is above 84 psig, it is concluded the proposed change has negligible impact on shutdown core damage frequency (COF) and large early release frequency (LERF). Additionally, a BOB/FLEX pump is pre-staged each outage so it can be used to support an unexpected transient on a shutdown unit. This pump provides an additional layer of defense-in-depth that supports the decay heat removal key safety function when the AFW cross-connect is unavailable.

Internal Fire Hazard Evaluation The SPS Individual Plant Examination for External Events (IPEEE) and the Fire Contingency Action (FCA) procedures were used to evaluate the impact of a 10-day AFW cross-connect AOT on fire risk since a full-scope fire PRA model has not been developed for SPS. The IPEEE identified four areas as significant contributors to the fire COF. The areas that were identified include the Cable Vault and Tunnel (CVT), the Emergency Switchgear Room (ESGR), the Main Control Room (MCR), and the Normal Switchgear Room (NSGR). Since fires in other areas are not significant contributors to fire risk as characterized by the IPEEE, they are screened from further consideration.

Input from the SPS IPEEE was used to perform a quantitative risk estimate of the ICCOP for the 10-day AOT from fire hazards. Initiating event frequencies were used from the IPEEE and combined with basic event probabilities from the current SPS internal events model. Adjustments were made to reflect the unavailability of the AFW cross-connect and the ability to use the pre-staged BOB/FLEX AFW pump to mitigate some scenarios. A screening value of 0.1 was used to represent the failure rate of the recovery using the BOB/FLEX pump. The ICCOP for fire hazard is 1.69E-7. The dominant risk frequency is a fire in an ESGR with a failure of the steam-driven AFW pump, failure of the delivery line due to various valve failures, and failure of the BOB/FLEX AFW pump. These sequences lead to core damage. LERF was not quantified for fire risk in the IPEEE, so ICLERP for fire risk was not calculated but is expected to be significantly lower than COF since the limiting scenarios do not directly challenge containment pressure or isolation, and the internal events LERF fractions for these sequences are less than 0.1.

To mitigate fire risk, MRule (a)(4) Fire Risk Equipment AFW cross-connect risk mitigation actions (RMAs) will be followed whenever the 10-day AOT is entered.

Page 15 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Based on the review of risk significant fire areas, the expected equipment damage, and the fire strategies used to achieve safe shutdown (SSD), it is concluded the fire risk of having the AFW cross-connect unavailable for 10 days during these scenarios is within the acceptance guidelines in Reg Guide 1.174.

Seismic Hazard Evaluation Generic Letter (GL) 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f)," Supplement 4, was issued by the NRC on June 28, 1991 (ADAMS Accession No. ML031150485). This letter and NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," June 1991, requested each nuclear plant licensee to perform an IPEEE. In a letter to the NRC dated December 20, 1991 (Reference 6.3), SPS identified its planned approach to address the IPEEE. For non-seismic external events and fires, the IPEEE effort was completed and a report was submitted to the NRC on December 14, 1994 (Reference 6.4).

SPS was categorized in NUREG-1407 as a focused scope plant. As identified in the SPS December 1991 letter, the Seismic Margins Method (SMM) developed by the Electric Power Research Institute (EPRI) with enhancements was selected for SPS. A completion schedule for IPEEE - Seismic was initially provided by SPS in its September 18, 1992 letter to the NRC (Reference 6.5) which also noted that elements of the effort to resolve IPEEE - Seismic, notably plant walkdowns, would be integrated with the resolution of Unresolved Safety Issue (USI) A-46 identified in NRC's Supplement 1 to GL 87-02 dated February 1992.

On September 8, 1995, the NRC issued Supplement 5 to GL 88-20 (ADAMS Accession No. ML031130465). This letter gave further guidance on the basis for selection of components that needed capacity evaluation. Based on GL 88-20, Supplement 5, SPS submitted a revised approach to the NRC in November 1995 (Reference 6.6). This approach, while still retaining the Seismic Probabilistic Risk Assessment (SPRA) methodology and treating SPS as a focused scope plant, identified areas where screening and judgment by experienced and trained engineers would eliminate the need for performing capacity calculations for rugged components, structures, and systems; and require such evaluations only for weaker and critical components. The IPEEE - Seismic program at SPS was performed in accordance with the SPRA methodology for a focused plant and SPS stated commitments.

In February 1996, a peer review was conducted to assess the implementation of the IPEEE - Seismic program at SPS. This review included walkdowns of about 15% of the items representing all classes of equipment in the Safe Shutdown Equipment List.

Although a few open issues were noted at the time of the review, the reviewer concluded the Seismic Review Teams involved did an excellent seismic walkdown review at SPS.

Page 16 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 In summary, the IPEEE-Seismic program, integrated with the USI A-46 effort, resulted in several plant improvements and design modifications. The SPRA quantification concluded that no severe accident vulnerabilities exist at SPS from a potential seismic event. No other cost beneficial upgrade can be performed to improve the seismic margin and the CDF of the plant.

The SPS Seismic Probability Risk Assessment Pilot Plant Report was reviewed, and this LAR does not impact the conclusions drawn in that report. Seismic failures are usually correlated meaning that if a seismic event severe enough to fail one AFW pump occurs, then it would more than likely cause all of the AFW pumps to fail. In this case, there is no impact to plant risk from the AFW cross-connect being unavailable for a longer period of time because there would not be any pumps to provide water through the cross-connect. Depending on the event, the AFW function may be provided by the staged or stored BOB/FLEX AFW pumps because seismic failure of these pumps would not be correlated with the installed AFW pumps.

Other External Hazards Evaluation Other external hazards, as identified by NUREG/CR-2300, "A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants," and NUREG/CR-4839, "Methods for External Event Screening Quantification: Risk Methods Integration and Evaluation Program (RMIEP) Methods Development," have been taken into consideration. These hazards were evaluated by Dominion Energy Virginia in response to Generic Letter 88-20, Supplement 4. The analysis utilized the method and results obtained by NUREG/CR-4550, "Analysis of Core Damage Frequency from Internal Events: Methodology Guidelines, Vol 1," supplemented with information from the SPS UFSAR. Other external events, except for external flooding, aircraft impacts and pipeline accidents, were screened out based on the UFSAR and NUREG/CR-4550 information. A bounding analysis based on the methods used by NUREG/CR-4550 was performed for the effects of aircraft impacts and pipeline accidents, and these initiators were shown to have a small frequency of occurring and are therefore screened from further consideration. External flooding was evaluated separately and also shown to be a non-significant contributor to core damage risk.

Therefore, it can be concluded that non-seismic external events do not pose a significant risk to the safe operation of SPS. With respect to wind hazards, the AFW pumps are located in missile protected buildings, and the other BOB/FLEX AFW pumps will remain in the missile protected dome to backup AFW function if necessary. Based on the region of Virginia where SPS is located, the wind hazard is not high enough to require development of a High Winds PRA. Therefore, based on this evaluation, other External Events have been screened from further consideration in this risk analysis.

RG 1.177 Tier 2: Avoidance of Risk Significant Plant Configurations Regulatory Guide 1.177 contains the following discussion concerning Tier 2 analysis:

Page 17 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 The licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service consistent with the proposed TS change. An effective way to perform such an assessment is to evaluate equipment according to its contribution to plant risk (or safety) while the equipment covered by the proposed CT change is out of service.

Evaluation of such combinations of equipment out of service against the Tier 1 ICCDP and ICLERP acceptance guidelines could be one appropriate method of identifying risk-significant configurations. Once plant equipment is so evaluated, an assessment can be made as whether certain enhancements to the TS or procedures are needed to avoid risk significant plant configurations. In addition, compensatory actions that can mitigate any corresponding increase in risk (e.g., backup equipment, increased surveillance frequency, or upgraded procedures and training) should be identified and evaluated. Any changes made to the plant design or operating procedures as a result of such a risk evaluation (e.g., required backup equipment, increased surveillance frequency, or upgraded procedures and training required before certain plant system configurations can be entered) should be incorporated into the analyses utilized for TS changes as described under Tier 1 above.

Although the risk analysis is not dependent upon restricting maintenance on the AFW System, no maintenance will be permitted on the operating unit's AFW system when work is being performed within the proposed 10-day AOT. Also, a cutset review was performed that focused on loss of the AFW cross-connect, and no additional risk significant configurations were identified that need to be addressed.

RG 1.177 Tier 3: Risk-Informed Plant Configuration Control and Management The SPS 10 CFR 50.65(a)(4) program fully satisfies the recommendations of Regulatory Guide 1.177, Tier 3. RG 1.177, section 2.3 states that:

The licensee should develop a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. A viable program would be one that is able to uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation.

The SPS 10 CFR 50.65 (a)(4) program performs PRA analyses of planned maintenance configurations in advance. The AFW system is included in the 10 CFR 50.65(a)(4) scope, and its removal from service is monitored, analyzed, and managed.

Configurations that approach or exceed the NUMARC 93-01 risk limits are identified and either avoided or addressed by RMAs. Emergent configurations are identified and analyzed by the on-shift staff for prompt determination of whether RMAs are needed.

The configuration analysis and risk management processes are fully proceduralized in compliance with the requirements of 10 CFR 50.65(a)(4). The SPS (a)(4) program is implemented with station procedures WM-AA-300, "Work Management," and NF-AA-PRA-370, "MRule (a)(4) Risk Monitor Guidance."

Page 18 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 To support the SPS 10 CFR 50.65(a)(4) program, a dedicated PRA model is used to perform configuration risk analysis. The model uses the R06a model as a framework with some adjustments to optimize the model for configuration risk calculations. The model allows for quantitative Level 1 and Level 2 (LERF) assessments of internal events and internal flood hazards for at-power configurations. Risk during shutdown configurations and risks due to other hazards are assessed qualitatively. Changes in plant configuration or PRA model features are dispositioned and managed by Dominion Energy's PRA configuration control process. Procedures are in place to ensure actions are taken as necessary to qualitatively assess configurations outside the scope of the PRA model.

3.1.2 Results and Conclusions The estimated combined internal events and internal fires ICCOP associated with the proposed TS change is 1.79E-7 and the internal events ICLERP is 2.03E-9. These values are consistent with the RG 1.174 and RG 1.177 acceptance guidelines for a permanent TS Completion Time (i.e., AOT) change. This evaluation demonstrates nuclear defense-in-depth will not be significantly impacted by allowing the opposite unit's AFW cross-connect capability to be inoperable for up to 10 days.

3.2 Compensatory Measures The following compensatory measures will be put in place prior to entering the 10-day AOT:

• Additional AFW system maintenance, including associated water sources, or changes in plant configuration that would result in a risk significant configuration will be precluded;

• Weather conditions will be monitored and AFW maintenance affecting operability of the opposite unit cross-connect will not be scheduled if severe weather conditions are anticipated;

• The steam-driven AFW pump will be controlled as "Protected Equipment";

• The Technical Requirements Manual compensatory actions to address 10 CFR 50.65 (a)(4) fire risk related to AFW cross-connect unavailability, which include periodic walkdowns in relevant fire areas, will be taken; and

• The BOB/FLEX AFW pump will be pre-staged to provide AFW defense-in-depth comparable to the AFW cross-connect.

The BOB/FLEX AFW pump can use either unit's ECST as a suction source using connection points specifically provided for pump hookup located inside the concrete Page 19 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 enclosures (tornado missile barrier) enveloping the ECSTs. Numerous additional water sources are available to supply the pump if required including the Emergency Condensate Makeup Tank and the BOB/FLEX High Capacity Pump, which can draw water from the Circulating Water Discharge Canal. The BOB/FLEX AFW pump has been designed to deliver the required minimum of 300 gpm to the SGs at a pressure of 300 psig. Hydraulic analysis of the BOB/FLEX AFW pump with the associated hoses and installed piping systems confirm the BOB/FLEX AFW pump minimum flow rate and head capabilities exceed the FLEX strategy AFW requirements for core cooling. The primary connection for SG injection is located in the MSVH on the AFW pump discharge header. As this connection point would not be available in the event of a fire or a HELB in the MSVH, an alternate connection for SG injection for the BOB/FLEX AFW pump discharge is available and located in the AFW cross-tie lines between the two units. The connection for each unit is located in the opposite unit's AFW pump room (ground floor of the MSVH). This connection will be utilized if the AFW pump room for a particular unit becomes unavailable or inaccessible.

Consequently, the ability to connect and use the BOB/FLEX AFW pump would not be impacted by a fire or HELB in either unit's MSVH.

4.0 REGU LATORY EVALUATION 4.1 Applicable Reg ulatory Requirements/Crite ria Section 182a of the Atomic Energy Act requires applicants for nuclear power plant operating licenses to include Technical Specifications (TS) as part of the operating license. The TS ensure the operational capability of structures, systems, and components that are required to protect the health and safety of the public. The U.S.

Nuclear Regulatory Commission's (NRC) requirements related to the content of the TS are contained in Section 50.36 of Title 10 of the Code of Federal Regulations (10 CFR 50.36), which requires that the TS include items in the following specific categories:

(1) safety limits, limiting safety system settings, and limiting control settings; (2) limiting conditions for operation; (3) surveillance requirements per 10 CFR 50.36(c)(3);

(4) design features; and (5) administrative controls.

Operability requirements for the AFW System and its associated instrumentation are prescribed by the Surry Power Station (SPS) Units 1 and 2 TS Sections 3.6, "Turbine Cycle," and 3.7, "Instrumentation Systems." Surveillance requirements for the AFW System and its associated instrumentation are contained in TS Sections 4.1, "Operational Safety Review," and 4.8, "Auxiliary Feedwater System."

10 CFR 50 Appendix A, General Design Criteria - The regulations in Appendix A to Title 10 of the Code of Federal Regulations (10 CFR) Part 50 establish minimum principal design criteria for water-cooled nuclear power plants. During the initial plant licensing of SPS Units 1 and 2, it was demonstrated that the design of the AFW System met the regulatory requirements in place at that time. The General Design Criteria (GDC)

Page 20 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 included in Appendix A to 10 CFR Part 50 did not become effective until May 21, 1971.

The Construction Permits for SPS Units 1 and 2 were issued prior to May 21, 1971; consequently, SPS Units 1 and 2 were not subject to GDC requirements. (Reference SECY-92-223 dated September 18, 1992.) Regardless, GDC 34 and 44 reflect the design basis for the AFW system with respect to decay heat removal. GDC 34 specifies, in part, that the system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded. GDC 44 for cooling water specifies, in part, that a system to transfer heat from structures, systems, and components important to safety, to an ultimate heat sink shall be provided. Both GDCs specify that suitable redundancy in components and features, interconnections, and isolation capabilities shall be provided.

The SPS Units 1 and 2 AFW Systems effectively implement these requirements.

10 CFR 50 Appendix B and the licensee quality assurance program establish quality assurance requirements for the design, manufacture, construction, and operation of structures, systems, and components. Quality assurance criteria provided in 10 CFR Part 50, Appendix B, that apply to the systems and components pertinent to the proposed change include: Criteria Ill, V, XI, XVI, and XVII. Criteria Ill and V require measures to ensure that applicable regulatory requirements and the design basis, as defined in 10 CFR 50.2, "Definitions," and as specified in the license application, are correctly translated into controlled specifications, drawings, procedures, and instructions. Criterion XI requires a test program to ensure that the subject systems will perform satisfactorily in service and requires that test results shall be documented and evaluated to ensure that test requirements have been satisfied. Criterion XVI requires measures to ensure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances, are promptly identified and corrected, and that significant conditions adverse to quality are documented and reported to management. Criterion XVII requires maintenance of records of activities affecting quality.

The Dominion Energy Quality Assurance Program is described in Topical Report DOM-QA-1, "Dominion Nuclear Facility Quality Assurance Program Description (QAPD)."

This topical report provides the QAPD for SPS Units 1 and 2. The Dominion QAPD conforms to applicable regulatory requirements, such as 10 CFR 50, Appendix B, and approved industry standards, including equivalent alternatives, where identified. This program applies to activities during design, construction, and operation, as well as siting. The Dominion QAPD describes how 10 CFR 50, Appendix B, requirements are met.

4.2 No Significant Hazards Consideration In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Virginia Electric and Power Company (Dominion Energy Virginia) proposes a change to the Surry Power Station (SPS) Units 1 and 2 Technical Specifications (TS) to add a 10-day Allowed Outage Time (AOT) specific to opposite Page 21 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 unit cross-connect capability when maintenance related to the operability of all three of the opposite unit's AFW pumps is being performed. The proposed 10-day AOT will permit the repair/replacement of common, non-isolable, unit specific AFW full flow recirculation piping while preventing an unnecessary plant transient and unscheduled shutdown of the opposite unit. The proposed change will also permit future maintenance activities for AFW components (e.g., the Emergency Condensate Storage Tank (ECST)), that would impact the operability of all three of the opposite unit's AFW pumps.

A supporting risk evaluation was performed for the proposed addition of the 10-day AOT. The risk evaluation concluded the increase in risk associated with the proposed change is consistent with the Regulatory Guide (RG) 1.174 and RG 1.177 acceptance guidelines for a permanent TS AOT change. This PRA evaluation demonstrates that defense-in-depth will not be significantly impacted by providing a 10-day AOT for opposite unit cross-connect capability.

In accordance with the criteria set forth in 10 CFR 50.92, Dominion Energy Virginia has performed an analysis of the proposed TS change and concluded that it does not represent a significant hazards consideration. The following discussion is provided in support of this conclusion:

1. Does the proposed license amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment adds a 10-day AOT for opposite unit cross-connect capability when maintenance related to the operability of all three of the opposite unit's AFW pumps is being performed. The 10-day AOT will permit repair/replacement of common, unit specific AFW full flow recirculation piping, ECST maintenance, etc., without requiring shutdown of the opposite unit.

The AFW System is used to respond to accidents previously evaluated and is not an initiator of any design basis accident or event; therefore, the proposed change does not increase the probability of any accident previously evaluated. The proposed change does not affect the design or operation of the AFW System. The proposed amendment does not adversely alter the design assumptions, conditions, or configuration of the facility. Also, the proposed amendment will not alter assumptions relative to the mitigation of an accident or transient event. With the change to TS 3.6.1.2, adequate AFW cooling flow continues to be provided for accidents previously evaluated, and there is no significant impact on accident consequences. The proposed change does not significantly change how the plant would mitigate an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

Page 22 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1

2. Does the proposed license amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed amendment does not introduce any new or unanalyzed modes of operation and does not result in a change in the manner in which the AFW System provides plant protection. The AFW System will continue to remain available to supply water to the steam generators (SGs) to remove decay heat and other residual heat while in the proposed 10-day AOT. There are no design changes associated with the proposed change. The proposed 10-day AOT does not change any existing accident scenarios, nor does it create any new or different accident scenarios. The proposed change does not alter any assumptions made in the safety analysis.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed change does not adversely affect any current plant safety margins or the reliability of the equipment assumed in the safety analysis. There are no changes being made to any safety analysis assumptions, safety limits, or limiting safety system settings that would adversely affect plant safety as a result of the proposed change. Furthermore, as noted above, a supporting risk evaluation was performed for the proposed 10-day AOT. The risk evaluation concluded the increase in risk associated with the proposed change is consistent with RG 1.174 and RG 1.177 acceptance guidelines for a permanent TS AOT change and is acceptably small with considerable remaining margin. The risk evaluation demonstrates that defense-in-depth will not be significantly impacted by permitting a 10-day AOT for opposite unit AFW cross-connect capability. The proposed change does not alter the manner in which safety limits, limiting safety system settings, or limiting conditions for operation are determined. The safety analysis acceptance criteria are not impacted by this change. The proposed change will not result in plant operation in a configuration outside the design basis since the AFW System will still be capable of performing its design function of providing cooling flow to the steam generators if required.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Dominion Energy Virginia concludes that the proposed change Page 23 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.3 Environmental Assessment This amendment request meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9) as follows:

(i) The amendment involves no significant hazards consideration.

As described above, the proposed change involves no significant hazards consideration.

(ii) There is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

The proposed change does not involve the installation of any new equipment, or the modification of any equipment that may affect the types or amounts of effluents that may be released offsite. The AFW System remains capable of performing its required design functions following the implementation of the proposed change. Therefore, there is no significant change in the types or significant increase in the amounts of any effluents that may be released offsite.

(iii) There is no significant increase in individual or cumulative occupation radiation exposure.

The proposed change does not involve plant physical changes or introduce any new mode of plant operation. Therefore, there is no significant increase in individual or cumulative occupational radiation exposure.

Based on the above, Dominion Energy Virginia concludes the proposed change meets the criteria specified in 10 CFR 51.22 for a categorical exclusion from the requirements of 10 CFR 51.22 relative to requiring a specific environmental assessment by the Commission.

5.0 CONCLUSION

The proposed amendment adds a 10-day AOT for opposite unit cross-connect capability specific to when maintenance related to the operability of all three of the opposite unit's AFW pumps is being performed. The 10-day AOT will permit the performance of a small subset of required AFW System maintenance including repair/replacement of the unit-specific, common, non-isolable AFW full flow recirculation piping, ECST maintenance, etc., without requiring shutdown of the opposite unit. The risk-informed evaluation of this change concluded that the increase in annual core Page 24 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 damage and large early release frequencies associated with the proposed change are characterized as "acceptably small" by Regulatory Guide (RG) 1.174. Also, the incremental conditional core damage and large early release probabilities associated with the proposed change are each within the acceptance criteria in RG 1.177.

Appropriate compensatory measures will also be required when the 10-day AOT is entered.

The Facility Safety Review Committee has reviewed the proposed change to the TS and has concluded that it does not involve a significant hazard consideration and will not endanger the health and safety of the public.

6.0 REFERENCES

6.1 Letter from Virginia Electric and Power Company to US NRC dated December 6, 2019 (Serial No.19-031), "Virginia Electric and Power Company, Surry Power Station Units 1 and 2, Application to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors," (ADAMS Accession No. ML19343A019).

6.2 Letter from US NRC to Daniel G. Stoddard of Virginia Electric and Power Company dated December 8, 2020, "

Subject:

Surry Power Station, Units 1 and 2- Issuance of Amendment Nos. 301 And 301 to Adopt 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors," (EPID L-2019-LLA-0269). (ADAMS Accession No.

ML20293A160).

6.3 Letter from Virginia Electric and Power Company to the USNRC dated December 20, 1991, (Serial No. 91 -410) "Response to Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events for Severe Accident Vulnerabilities," (ADAMS Accession No. ML18153C854).

6.4 Letter from Virginia Electric and Power Company to the USNRC dated December 14, 1994 (Serial No.94-692), "Response to Generic Letter 88-20 Supplement 4, Individual Plant Examination of Non-Seismic External Events and Fires."

6.5 Letter from Virginia Electric and Power Company to the USNRC dated September 18, 1992 (Serial No. 92-448/9), "Schedule for Generic Letter 88-20, Supplement 4, Individual Plant Examination of External Events For Severe Accident Vulnerabilities," (ADAMS Accession No. ML18153D134).

6.6 Letter from Virginia Electric and Power Company to the USNRC dated November 3, 1995 (Serial No.95-497), "Generic Letter 88-20, Supplement 5, Revised Procedures for Performing Individual Plant Examination of External Events (IPEEE) - Seismic."

Page 25 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Figure 1 - SPS Unit 1 / 2 AFW System To Main Condcn::er Aeci,a.,IQlion filow Conllol 1A Vo.I""" I 1A I I .... 1....

tr

\ ToSt.elllYI From{

Cond=,a<lt.e 1B Generalors Sy:,tem Hen1.,.

Cooler.,

High --..J ) ) , ,. 1C P,~=ure Low P,..,~ure Feedwlller Feedw:it.er He:it.er0 Heatets C10C&1ie MOV",.

To O~ . ...,

Unit Alllx,hnry Feedw"ler ~

S~ m

.., * ..r From Oppo$ite Uni! Auxiliruy Emergency* Aux~inry Feedwo.1er Conden~ate Feedw:iter ~ .. C' Subcy,::t.em Ston19e Pump.:

To.nit Auxilio.r Feedwo.ter B00!:ter Pumpll From F11em11.in Emergen cy M~

.!!!!f1110a-.c::m,~

Page 26 of 27

Serial No.22-081 Docket Nos. 50-280/281 Attachment 1 Figure 2 - Unit 2 Emergency Condensate Storage Tank 2-CN-TK-1 I

I I

I

~

N-1

.I u0.,00Q,J1A.L

• Et<<R CONDENSATE !

STCJfAGE TANK I r&-

• - *-*-' *- *- *- *- *- *J 2*0N5.I J I

ftlM ~ T E SY'STE

[154B-FH *eii7A, SH. 2 Page 27 of 27

LBDCR/TSCR 471 Docket Nos. 50-280/281 Attachment 2 PROPOSED TECHNICAL SPECIFICATIONS AND BASES PAGES (MARKED-UP)

Virginia Electric and Power Company (Dominion Energy Virg inia)

Surry Power Station Units 1 and 2

TS 3.6-4a L-02 23 06 --1' I. The requirements of Specification 3.6.C.4 above concerning the opposite unit's auxiliary feedwater pumps; the associated redundant flowpaths, including piping, headers, valves, and control board indication; the cross-connect piping from the opposite unit; and the protected condensate storage tank may be modified to allow the following components to be inoperable, provided immediate attention is directed to making repairs. Automatic initiation instrumentation associated with the opposite unit's auxiliary feedwater pumps need not be OPERABLE.

1. One of the opposite unit's flowpaths or two of the opposite unit's auxiliary feedwater pumps may be inoperable for a period not to exceed 14 days.

2. Both of the opposite unit's flowpaths; the opposite unit's protected condensate ~

storage tank; the cross-connect piping from the opposite unit; or three of the ater *

• exceed 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> . For the specific purpose of performing maintenance related to 11 three of the opposite unit's auxiliary feedwater pumps, these e ino erable for a eriod not to exceed IO da s.

3. A train of the opposite unit's emergency power system as required by Section 3.6.C.4.c above may be inoperable for a period not to exceed 14 days; if L.

this train's inoperability is related to a diesel fuel oil path, one diesel fuel oil path /f may be "inoperable" for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other flowpath is proven OPERABLE; if after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the inoperable flowpath cannot be restored to service, the diesel shall be considered "inoperable." During this 14 day period, the following limitations apply:

a. If the offsite power source becomes unable to energize the opposite unit's OPERABLE train, operation may continue provided its associated emergency diesel generator is energizing the OPERABLE train.

b. If the opposite unit's OPERABLE train's emergency diesel generator becomes unavailable, operation may continue for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> provided the offsite power source is energizing the opposite unit's OPERABLE train.

Amendment Nos. 246 aRcl 245

TS 3.6-Sa 02 23 06 restore operability of one inoperable pump or of the inoperable component or instrumentation in one flowpath. With such a loss of auxiliary feedwater capability, the unit is in a seriously degraded condition. In this condition, the unit should not be perturbed by any action, including a power change, which could result in a plant transient or trip. The seriousness of this condition requires that action be taken immediately to restore ~rability, where immediately means the required action should be pursued without delay and in a controlled manner. Under these circumstances, Specification 3.0.1 and all other required actions directing mode changes are suspended until one inoperable pump or the inoperable component or instrumentation in one flowpath is restored to operable status, because taking those actions could place the unit in a less safe condition.

IINSERTI In the event of complete loss of electrical power to the station, residual heat removal would continue to be assured by the availability of either the turbine driven auxiliary feedwater pump or /

one of the motor driven auxiliary feedwater pumps and the 110,000-gallon protected condensate storage tank.

In the event of a fire or high energy line break which would render the auxiliary feedwater pumps inoperable on the affected unit, residual heat removal would continue to be assured by the availability of either the turbine driven auxiliary feedwater pump or one of the motor driven /

auxiliary feedwater pumps from the opposite unit. A minimum of two auxiliary feedwater pumps are required to be operable* on the opposite unit to ensure compliance with the design basis accident analysis assumptions, in that auxiliary feedwater can be delivered via the cross-connect, even if a single active failure results in the loss of one of the two pumps. In addition, the requirement for operability of the opposite unit's emergency power system is to ensure that auxiliary feedwater from the opposite unit can be supplied via the cross-connect in the event of a common-mode failure of all auxiliary feedwater pumps in the affected unit due to a high energy line break in the main steam valve house. Without this requirement, a single failure (such as loss of the shared backup diesel generator) could result in loss of power to the opposite unit's emergency buses in the event of a loss of offsite power, thereby rendering the cross-connect inoperable. The longer allowed outage time for the opposite unit's emergency power system is based on the low probability of a high energy line break in the main steam valve house coincident with a loss of offsite power.

• excluding automatic initiation instrumentation Amendment Nos. 246 aH:El 245

Serial No.22-081 Docket Nos. 50-280/281 TS 3.6 Basis INSERT Due to the occasional need to perform maintenance on common AFW components that would render all three AFW pumps on the opposite unit inoperable, e.g., the AFW pumps' full flow recirculation piping or the protected condensate storage tank, a 10-day allowed outage time is provided for opposite unit AFW cross-connect capability. The 10-day allowed outage time is supported by a risk analysis that demonstrates the associated risk is acceptably small for both CDF and LERF with considerable margin remaining. When entering the 10-day allowed outage time for the specific purpose of performing maintenance related to the operability of all three of the opposite unit's auxiliary feedwater pumps, the following compensatory actions are required to be in place:

• Additional AFW system maintenance, including associated water sources, or changes in plant configuration that would result in a risk significant configuration will be precluded;

• Weather conditions will be monitored and AFW maintenance affecting operability of the opposite unit cross-connect will not be scheduled if severe weather conditions are anticipated;

• The steam-driven AFW pump will be controlled as "Protected Equipment";

• The Technical Requirements Manual compensatory actions to address 10 CFR 50.65 (a)(4) fire risk related to AFW cross-connect unavailability, which include periodic walkdowns in relevant fire areas, will be taken; and

• The BOB/FLEX AFW pump will be pre-staged to provide AFW defense-in-depth comparable to the AFW cross-connect.

Serial No.22-081 Docket Nos. 50-280/281 Attachment 3 PROPOSED TECHNICAL SPECIFICATIONS PAGE (TYPED)

Virginia Electric and Power Company (Dominion Energy Virginia)

Surry Power Station Units 1 and 2

TS 3.6-4a I. The requirements of Specification 3.6.C.4 above concerning the opposite unit's auxiliary feedwater pumps; the associated redundant flowpaths, including piping, headers, valves, and control board indication; the cross-connect piping from the opposite unit; and the protected condensate storage tank may be modified to allow the following components to be inoperable, provided immediate attention is directed to making repairs. Automatic initiation instrumentation associated with the opposite unit's auxiliary feedwater pumps need not be OPERABLE.

I. One of the opposite unit's flowpaths or two of the opposite unit's auxiliary feedwater pumps may be inoperable for a period not to exceed 14 days.

2. Both of the opposite unit's flowpaths; the opposite unit's protected condensate storage tank; the cross-connect piping from the opposite unit; or three of the opposite unit's auxiliary feedwater pumps may be inoperable for a period not to exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. For the specific purpose of performing maintenance related to the operability of all three of the opposite unit's auxiliary feedwater pumps, these components may be inoperable for a period not to exceed 10 days.

3. A train of the opposite unit's emergency power system as required by Section 3.6.C.4.c above may be inoperable for a period not to exceed 14 days; if this train's inoperability is related to a diesel fuel oil path, one diesel fuel oil path may be "inoperable" for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> provided the other flowpath is proven OPERABLE; if after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the inoperable flowpath cannot be restored to service, the diesel shall be considered "inoperable." During this 14 day period, the following limitations apply:

a. If the offsite power source becomes unable to energize the opposite unit's OPERABLE train, operation may continue provided its associated emergency diesel generator is energizing the OPERABLE train.

Amendment Nos.

TS 3.6-4b

b. If the opposite unit's OPERABLE train's emergency diesel generator becomes unavailable, operation may continue for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> provided the offsite power source is energizing the opposite unit's OPERABLE train.

c. Return of the originally inoperable train to OPERABLE status allows the second inoperable train to revert to the 14 day limitation.

If the above requirements are not met, be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and be less than 350°F and 450 psig within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

J. The requirements of Specification 3.6.C.2 above may be modified to allow utilization of protected condensate storage tank water with the auxiliary feedwater pumps provided the water level is maintained above 60,000 gallons, sufficient replenishment water is available in the 300,000 gallon condensate storage tank, and replenishment of the protected condensate storage tank is commenced within two hours after the cessation of protected condensate storage tank water consumption.

Amendment Nos.

TS 3.6-5a restore operability of one inoperable pump or of the inoperable component or instrumentation in one flowpath. With such a loss of auxiliary feedwater capability, the unit is in a seriously degraded condition. In this condition, the unit should not be perturbed by any action, including a power change, which could result in a plant transient or trip. The seriousness of this condition requires that action be taken immediately to restore operability, where immediately means the required action should be pursued without delay and in a controlled manner. Under these circumstances, Specification 3.0. l and all other required actions directing mode changes are suspended until one inoperable pump or the inoperable component or instrumentation in one flowpath is restored to operable status, because taking those actions could place the unit in a less safe condition.

Due to the occasional need to perform maintenance on common AFW components that would render all three AFW pumps on the opposite unit inoperable, e.g., the AFW pumps' full flow recirculation piping or the protected condensate storage tank, a 10-day allowed outage time is provided for opposite unit AFW cross-connect capability. The 10-day allowed outage time is supported by a risk analysis that demonstrates the associated risk is acceptably small for both CDP and LERF with considerable margin remaining. When entering the 10-day allowed outage time for the specific purpose of performing maintenance related to the operability of all three of the opposite unit's auxiliary feedwater pumps, the following compensatory actions are required to be in place:

• Additional AFW system maintenance, including associated water sources, or changes in plant configuration that would result in a risk significant configuration will be precluded;

• Weather conditions will be monitored and AFW maintenance affecting operability of the opposite unit cross-connect will not be scheduled if severe weather conditions are anticipated;

• The steam-driven AFW pump will be controlled as "Protected Equipment";

• The Technical Requirements Manual compensatory actions to address 10 CPR 50.65 (a)(4) fire risk related to AFW cross-connect unavailability, which include periodic walkdowns in relevant fire areas, will be taken; and

• The BOB/FLEX AFW pump will be pre-staged to provide AFW defense-in-depth comparable to the AFW cross-connect.

Amendment Nos.

TS 3.6-5b In the event of complete loss of electrical power to the station, residual heat removal would continue to be assured by the availability of either the turbine driven auxiliary feedwater pump or one of the motor driven auxiliary feedwater pumps and the 110,000-gallon protected condensate storage tank.

In the event of a fire or high energy line break which would render the auxiliary feedwater pumps inoperable on the affected unit, residual heat removal would continue to be assured by the availability of either the turbine driven auxiliary feedwater pump or one of the motor driven auxiliary feedwater pumps from the opposite unit. A minimum of two auxiliary feedwater pumps are required to be operable* on the opposite unit to ensure compliance with the design basis accident analysis assumptions, in that auxiliary feedwater can be delivered via the cross-connect, even if a single active failure results in the loss of one of the two pumps. In addition, the requirement for operability of the opposite unit's emergency power system is to ensure that auxiliary feedwater from the opposite unit can be supplied via the cross-connect in the event of a common-mode failure of all auxiliary feedwater pumps in the affected unit due to a high energy line break in the main steam valve house. Without this requirement, a single failure (such as loss of the shared backup diesel generator) could result in loss of power to the opposite unit's emergency buses in the event of a loss of offsite power, thereby rendering the cross-connect inoperable. The longer allowed outage time for the opposite unit's emergency power system is based on the low probability of a high energy line break in the main steam valve house coincident with a loss of offsite power.

The specified minimum water volume in the 110,000-gallon protected condensate storage tank is sufficient for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of residual heat removal following a reactor trip and loss of all offsite electrical power. If the protected condensate storage tank level is reduced to 60,000 gallons, the immediately available replenishment water in the 300,000-gallon condensate tank can be gravity-fed to the protected tank if required for residual heat removal. An alternate supply of feedwater to the auxiliary feedwater pump suctions is also available from the Fire Protection System Main in the auxiliary feedwater pump cubicle.

• excluding automatic initiation instrumentation Amendment Nos. Bases

TS 3.6-5c The five main steam code safety valves associated with each steam generator have a total combined capacity of 3,842,454 pounds per hour at their individual relieving pressure; the total combined capacity of all fifteen main steam code safety valves is 11,527,362 pounds per hour.

The maximum steam flow at full power is approximately 11,444,000 pounds per hour. The combined capacity of the safety valves required by Specification 3.6 always exceeds the total steam flow corresponding to the maximum steady state power than can be obtained during three reactor coolant loop operation.

The availability of the auxiliary feedwater pumps, the protected condensate storage tank, and the main steam line safety valves adequately assures that sufficient residual heat removal capability will be available when required.

The limit on steam generator secondary side iodine-131 activity is based on limiting the dose at the site boundary following a postulated steam line break accident to the Regulatory Guide 1.183 limits. The accident analysis assumes the release of the entire contents of the faulted steam generator to the atmosphere.

Amendment Nos . Bases