ML25079A045

Regulatory Commitment Evaluation Report

ML25079A045
Person / Time
Site:	Surry
Issue date:	03/18/2025
From:	Terry W Virginia Electric & Power Co (VEPCO)
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
25-077
Download: ML25079A045 (1)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VmGINIA 23261 March 18, 2025 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNITS 1 AND 2 ANNUAL CHANGES, TESTS, AND EXPERIMENTS REPORT REGULATORY COMMITMENT EVALUATION REPORT 10 CFR 50.59(d)(2)

Serial No.

SPS/MMT Docket Nos.

License Nos.25-077 RO 50-280 50-281 DPR-32 DPR-37 Virginia Electric and Power Company hereby submits the annual report of Changes, Tests, and Experiments pursuant to 10 CFR 50.59(d)(2) implemented at Surry Power Station. provides the descriptions and summaries of the Regulatory Evaluations, and the Regulatory Commitment Change Evaluations completed in 2024. Additionally, during the preparation of this report, two Regulatory Evaluations implemented in 2022 were identified that had not been included in the annual report of the Changes, Tests, and Experiments implemented in 2022.

Summaries of the 2022 Regulatory Evaluations are contained in Attachment 2, and this discrepancy has been captured in our corrective action program to prevent recurrence.

Should you have any questions regarding this report, please contact Michael M. True, Jr. at (757) 365-2446.

Very truly yours, Wolli(:;?zy---

Director Nuclear Safety & Licensing (Acting)

Surry Power Station : Surry Units 1 & 2 10 CFR 50.59 Changes, Tests, and Experiments, and Regulatory Commitment Evaluations for 2024 : Surry Units 1 & 2 10 CFR 50.59 Changes, Tests, and Experiments Update for 2022 Commitments made in this letter: None cc:

United States Nuclear Regulatory Commission, Region II NRC Senior Resident Inspector Surry Power Station Surry Units 1 & 2 Serial No.25-077 10 CFR 50.59 Annual Report Page 1 of 19 10 CFR 50.59 Changes, Tests, and Experiments, and Regulatory Commitment Evaluations for 2024 ETE-NAF-2023-0106/Rev. 0 Regulatory Evaluation 02/15/2024

==

Description:==

The proposed activity is to implement an alternate cladding strain acceptance criterion into the Surry Units 1 and 2 Design and Licensing basis. This alternate cladding strain limit, which has been approved by NRC under PWROG-21001-P-A, utilizes a new method of evaluation to demonstrate that the design basis limit of fission product barrier is met. This new method evaluates the behavior of the fuel cladding as a function of hydrogen concentration and establishes a design limit which precludes fuel failure due to excessive cladding strain during Condition II overpower transient events. The hydrogen-based transient cladding strain limit will be used as an alternative to the current 1 % cladding strain limit.

Summary:

Surry Units 1 and 2 implemented the NRC approved methodology of PWROG-21001-P-A, Rev.a as an alternative to the current 1 % cladding strain limit for Condition II overpower transients.

This new method evaluates the behavior of the fuel cladding as a function of hydrogen concentration and establishes a new design limit which precludes fuel failure due to excessive cladding strain during Condition II overpower transient events. The adoption of the hydrogen-based strain limit does not constitute an altered design basis limit for a fission product barrier under Criterion 7 as it is adopted as part of the en toto adoption of the NRC approved methodology of PWROG-21001-P-A, Rev.0 under Criterion 8 of the 50.59 Evaluation.

Implementation of PWROG-21001-P-A, Rev.a, is not a departure from a method of evaluation described in the SAR as the use of the method is (a) based on sound engineering practice, (b) appropriate for the intended application, and (c) within the limitation of its SER. The 50.59 Evaluation supporting the Surry Units 1 and 2 implementation of the NRC approved methodology of PWROG-21001-P-A, Rev.a concluded that the change may be implemented without prior NRC approval.

SU-22-00129 (FCR)/Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 2 of 19 04/10/2024 The existing movable incore detector system (MIDS) is approaching obsolescence and requires replacement. The proposed replacement involves a transition cycle during which three (3) of the flux thimble tube (FTT) assemblies that are currently inaccessible (B07, 007, and H13) are replaced with a fixed incore detector system (FIDS) platinum (Pt) lncore Detector Assemblies (ICDA). Design change DC SU-22-00129 installs the ICDAs and associated data acquisition equipment for the Unit 1 transition period.

The proposed three (3) new ICDAs are installed in core locations that have symmetric partner core locations which typically have very similar fuel design characteristics. The symmetric locations with thimble tubes are also monitored by the MIDS system. This allows for a comparison of detector type (Pt vs U-235) responses and uncertainties during the transition period for use in supporting evaluations required for full implementation of the Pt detector-based FIDS in all 50 reactor locations. The FIDS assembly detector signals will not be used for Technical Specification power distribution measurement during the transition period as the existing MIDS will continue to provide adequate core coverage.

The transition period is expected to be two (2) operating cycles. During the first transition cycle FIDS detector data is collected and compared to symmetric MIDS location data. This information will be used to support Technical Specifications (TS) changes required for full FIDS implementation which will be developed, submitted, and approved during the second transition cycle.

Both the MIDS flux thimbles tubes and fixed ICDAs contain Type K Core Exit Thermocouples (CETs). The CETs are safety-related components that measure core exit temperature and perform USNRC Regulatory Guide (RG) 1.97 functions for post-accident monitoring. The CETs also provide input into the safety-related Inadequate Core Cooling Monitoring (ICCM) system (including the Core Cooling Monitor subsystem) and play a role in the UFSAR described design function of detecting dropped/misaligned control rod assemblies.

During the transition cycle, the new CETs provided with the ICDAs at core locations (B07, 007, and H13) are connected internally to the lncore Breakout Boxes (IBBs) via the prefabricated splitter/cable assemblies. The splitter/cable assemblies are used to separate the gamma flux signal pairs from the safety-related CET signals and route them to the designated output connections. However, based on qualification testing anomalies, the IBBs require additional LOCA qualification testing to ensure their Safety-Related Reg Guide1.97 functions are fully functional. Therefore, SU-22-00129 will treat the IBBs as Non-safety Related Quality (NSQ), as such, the existing Safety-Related CETs mineral insulated (Ml) extension cables will not be connected to the LEMO connectors on the bottom-side of the IBBs. This configuration will prevent the CETs at core locations (807, D07, and H13) from being utilized by the Inadequate Core Cooling Monitoring (ICCM) system and from performing other UFSAR described design functions during the transition period. This activity disables one (1) input to the ICCM however the minimum number of CETs required by Technical Specifications is still maintained. A 1 0CFR50.59 Screen was performed, and it was determined that this is an adverse change to the SAR described design functions:

Serial No.25-077 10 CFR 50.59 Annual Report Page 3 of 19 Use of CETs by the Inadequate Core Cooling Monitoring (ICCM) system Use of the CETs to detect misaligned/dropped control rod assemblies Summary:

The existing movable incore detector system (MIDS) is approaching obsolescence and requires replacement. The proposed replacement involves a transition cycle during which three (3) of the flux thimble tube (FTT) assemblies that are currently inaccessible (B07, 007, and H13) are replaced with a fixed incore detector system (FIDS) platinum (Pt) lncore Detector Assemblies (ICDA). Design change DC SU-22-00129 installs the ICDAs and associated data acquisition equipment for the Unit 1 transition period.

During the transition cycle, the new CETs provided with the ICDAs at core locations (B07, 007, and H 13) are connected internally to the In core Breakout Boxes (IBBs) via the prefabricated splitter/cable assemblies. The splitter/cable assemblies are used to separate the gamma flux signal pairs from the safety-related CET signals and route them to the designated output connections. However, based on qualification testing anomalies, the IBBs require additional LOCA qualification testing to ensure their Safety-Related Reg Guide1.97 functions are fully functional. Therefore, SU-22-00129 will treat the IBBs as Non-safety Related Quality (NSQ), as such, the existing Safety-Related CETs mineral insulated (Ml) extension cables will not be connected (physical and software) to the LEMO connectors on the bottom-side of the IBBs. This configuration will prevent the CETs at core locations (B07, 007, and H13) from being utilized by the Inadequate Core Cooling Monitoring (ICCM) system during the transition period. A 1 0CFR50.59 Screen was performed and it was determined that this is an adverse change to the SAR described design functions:

Use of CETs by the Inadequate Core Cooling Monitoring (ICCM) system Use of the CETs to detect misaligned/dropped control rod assemblies

1. The CETs are passive instruments that do not contribute to the occurrence of an accident and will continue to be monitored as required by Technical Specification 3.7-6. The disconnect of one operable GET at H13 core location does not introduce the possibility of a change in the frequency of an accident because the CETs are not an initiator of any accident and no new failure modes are introduced. Therefore, Disconnecting the CET at H13 does not result in more than a minimal increase in the frequency of occurrence of an accident previously evaluated in the SAR.

2. Physical disconnect of the remaining functional thermocouple at core location H13 and the corresponding software disconnect of the H13 input will not cause a malfunction of the remaining ICCM system or any SSC important to safety since the thermocouples and associated cabling are passive and there are no downstream failure modes for disconnect of the active thermocouple. Based upon item #6 in the 50.59 Resource Manual (Rev 3, Nov 2005 page 89), NRC prior approval for an activity is required if:

6. The change would reduce system/equipment redundancy, diversity, separation, or independence. (Licensees may, however, without prior NRC approval, reduce excess redundancy, diversity, separation or independence, if any, to the level credited in the UFSAR.)

Serial No.25-077 10 CFR 50.59 Annual Report Page 4 of 19 This change activity does not reduce redundancy, diversity, separation, or independence below what is currently credited in the SAR for CET design functions because the removal of H13 CET will not impact the minimum TS operability of the ICCM system. This change does reduce excess redundancy as allowed per 50.59 Resource manual item #6 noted above. Therefore, disconnecting the CET at H13 does not result in more than a minimal increase in the likelihood of occurrence of a malfunction of an SSC important to safety previously evaluated in the SAR.

3. The system provides means for acquiring data only and performs no operational unit control or protection. The CETs are not an initiator of any new accidents and no new failure modes are introduced. Disconnecting the CET at H13 does not result in more than a minimal increase in the consequences of an accident previously evaluated in the SAR since Technical Specification 3.7-6 will continue to be met for monitoring of core exit temperature.

4. Disconnect (physical and software) of the remaining functional thermocouple at H13 will not cause a malfunction of the remaining ICCM system or any SSC important to safety since the thermocouples and associated cabling are passive and there are no downstream failure modes for disconnect of the active thermocouple. The CETs are not an initiator of any new accidents and no new failure modes are introduced. Disconnecting the CET at H13 does not result in more than a minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the SAR since there are no malfunctions of SSC's affected by this change.

5. The CETs are credited for indication and do not impact the accident analyses nor create a potential failure that would cause an accident of a different type. The CETs are not an initiator of any new accidents and no new failure modes are introduced. Disconnecting the CET at H 13 does not create a possibility for an accident of a different type than any previously evaluated in the SAR.

6. Disconnect (physical and software) of the remaining functional thermocouple at H13 will not cause a malfunction of the remaining ICCM system or any SSC important to safety since the thermocouples and associated cabling are passive and there are no downstream failure modes for disconnect of the active thermocouple. Disconnecting the CET at H13 does not introduce a failure mode that is not bounded by those already described in the SAR.

Therefore, Disconnecting the CET at H13 does not create a possibility for a malfunction of an SSC important to safety with a different result than any previously evaluated in the SAR.

7. The CETs are credited for indication and do not affect parameters that are considered for design limits of fission product barriers. Therefore, Disconnecting the CET at H13 does not result in a design basis limit for a fission product barrier as described in the SAR being exceeded or altered.

8. This change does not involve a method of evaluation as described in the SAR.

SU-19-00124, Rev. 2 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 5 of 19 08/14/2024 The proposed activity is to implement supporting safety analysis, instrumentation, and procedural changes to support manual throttling of the low head safety injection (LHSI) flowrate via the LHSI pump discharge valves (i.e., 1 (2)-SI-MOV-1 (2)864A/B) prior to recirculation mode transfer (RMT). Throttling the LHSI flow prior to RMT ensures adequate net positive suction head (NPSH) and containment analysis margin when the pump suction source of water is changed from the refueling water storage tank (RWST) to the containment sump. This manual operator action is only applicable if a single LHSI pump is available during safety injection and the RWST level reaches 30% (new RWST Low Level Alarm setpoint).

Summary:

The proposed activity is to implement supporting safety analysis, instrumentation, and procedural changes to support manual throttling of the low head safety injection (LHSI) flowrate via the LHSI pump discharge valves (i.e., 1 (2)-SIMOV-1 (2)864A/B) prior to recirculation mode transfer (RMT) to ensure adequate net positive suction head (NPSH) and containment analysis margin when the pump suction source of water is changed from the refueling water storage tank (RWST) to the containment sump. Once the suction source has been realigned to the sump the LHSI pump discharge valves will be unthrottled and returned to their full open position. This manual operator action is only applicable if a single LHSI pump is available during safety injection and the RWST level reaches 30% (new RWST Low Level Alarm setpoint).

The current containment safety analysis outlined in the SAR utilized minimum LHSI flowrates based on full flow through the LHSI discharge piping and valves. The safety analysis will change based on throttling the minimum flow rates even further. Therefore, a change to the safety analysis, a change to the RWST Low-Level Alarm setpoint, and procedural changes are required and therefore an evaluation was necessary. As documented in this evaluation, all eight criteria were answered no or N/A and therefore no LAR is required.

SU-22-00132, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 6 of 19 09/13/2024 The Fuel Building Bridge Crane (FBBC) is becoming obsolete. The FBBC is required for routine fuel handling operations and to support plant operations for the Dry Cask Storage campaigns following the final fuel cycle before the units are subject to decommissioning. This activity replaces the existing analog-operated FBBC (01-FH-BRDG-13-CRANE) in its entirety with a new digital-operated FBBC.

Summary:

This Design Change (DC) replaces the FBBC with a new crane with digital components. The digital FBBC presents a potential for software or hardware failure.

The following are the design functions (i.e., listed in the 10CFR50.59 Screen) that are adversely affected:

DF-1: UFSAR Section 9.12.4.5, Motor-Driven Platform and Hoist The FBBC is designed to handle spent fuel.

Fuel storage and handling cascades up to GDC 61 - Fuel Storage and Handling and Radioactivity Control. Therefore, the GDC impacted by the proposed activity is a SAR-described design function (DF-1 ).

A qualitative assessment of the proposed activity concluded that the activity involves a sufficiently low likelihood of potential hardware or software failures.

The 10 CFR 50.59 evaluation concluded that the following :

The change did not result in more than a minimal increase in frequency of occurrence of an accident previously evaluated in the SAR.

The effects of the activity do not result in more than minimal increase in the likelihood of occurrence of malfunction of an SSC important to safety previously evaluated in the UFSAR.

The activity does not result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR.

The activity does not result in a more than minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the UFSAR.

The proposed activity will not introduce an accident of a different type than previously described in the UFSAR.

The activity does not create a malfunction of an SSC important to safety with a different result than currently analyzed.

The proposed activity does not result in a design basis limit for a fission product barrier, as described in the SAR, being exceeded, or altered.

The FBBC provide additional functionality with the installation of a digital control system and interface. The crane controls and interface are of a proven design have been utilized though out the nuclear industry with provable reliability.

SU-22-00113, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 7 of 19 10/07/2024 The existing Alstom Automatic Voltage Regulator (AVR) for Unit 2 was designed to provide reliable service for the remaining life of the plant at the time of installation. As part of the Subsequent License Renewal (SLR) project, the life of the plant will be extended another 20 years. Therefore, the existing AVR will be reaching the end of its expected design life and is not expected to be able to support operation for an additional 20 years.

This modification replaces existing Unit 2 Alstom AVR (02-EP-VREG-1), located on the south side of the turbine deck with a new ABB Unitrol 6000 Medium AVR (hereafter referred to as the ABB AVR) as procured per specification. The new ABB AVR provides similar functionality to the existing AVR but with improved redundancy and reliability. The new ABB AVR system provides a twin configuration (2 channels) where each channel can be the primary channel. Upon failure of the active channel, the system transfers to the standby channel automatically in a bumpless manner. This replacement supports the Surry Subsequent License Renewal program to extend the life of the plant by an additional 20 years of operation.

Summary:

This Design Change (DC) replaces the existing Digital Alstom AVR with Digital ABB AVR capable of providing trip signals. Existing functionality of the AVR will be performed by the replacement ABB AVR with similar functionality.

The following are the design functions (i.e. listed in the 1 0CFR50.59 Screen) that are adversely affected:

DF-1: The main generator AVR adjusts the exciter field to maintain a main generator voltage output within the allowable ranges. Additionally, it provides protection of the generator through V/hZ protection.

A qualitative assessment of the proposed activity concluded that the activity involves a sufficiently low likelihood of potential hardware or software failures, including a software CCF.

The 10 CFR 50.59 evaluation concluded that the following :

The software has been rigorously tested by vendor and will be tested prior to installation such that a system software common cause is no more credible than a single hardware failure on the existing system. Hardware failures have been evaluated as part of the ABB AVR FMEA. The voltage regulator manufacturer manufactured the system in accordance with industry standards while meeting their QA program requirements. The ABB AVR is a proven design and is used through the industry. Industry OE has not identified specific reliability concerns with this system. The change did not result in more than a minimal increase in frequency of occurrence of an accident previously evaluated in the SAR.

The design and testing of the ABB AVR are sufficient to produce a reliable design as discussed in the qualitative analysis. The effects of Design Change do not result in more than minimal increase in the likelihood of occurrence of malfunction of an SSC important to safety previously evaluated in the UFSAR.

Serial No.25-077 10 CFR 50.59 Annual Report Page 8 of 19 The change does not alter assumptions previously made while evaluating the radiological consequences of the above-mentioned accident. The change does not prevent or degrade the effectiveness of actions described in the accident analysis. The Main Generator will continue to function consistent with both the reliability and capacity considered within the UFSAR.

The ABB AVR with Generator Trip functionality is digitally controlled and is subject to software common-mode failure. This type of failure can result in system-level failures that affect the supply of power to the associated station busses or transmission system though the loss of the Generator due to cable interconnections. This malfunction of an SSC is previously evaluated in the UFSAR and the loss of the SSC (Generator) does not impact dose and therefore does not result in a more than minimal increase in the consequences of a malfunction of a SSC important to safety previously evaluated in the SAR.

The ABB AVR provides the same functionality to the Main Generator. The effect of a failure of the ABB AVR could result in a trip of the Main Generator. The ABB AVR could also fail to trip the Generator, would eventually result in the generator tripping via alternate protection features. The failure of the modified components could only lead to an accident previously analyzed in the UFSAR, that of a Generator being taken offiine.

The proposed activity will not introduce an accident of a different type than previously described in the UFSAR.

Software failures in the ABB AVR can result in system-level failure including the tripping of the Main Generator, which would impact downstream buses and equipment. Software failures in ABB AVR are limited to impacting the ABB AVR as no digital signals are outputted from the system. Failures of the AVR software will not propagate to other plant systems. The ABB AVR could also fail to trip the Generator, would eventually result in the generator tripping via alternate protection features. As the result of a malfunction of the ABB AVR is limited to the same result as current system level failures that of impacting availability of the Main Generator. The trip of the generator through the ABB AVR results in the same outcome, that of loss of the Main Generator. The result of the failures of the ABB AVR therefore does not create a result different than currently analyzed.

The replacement of the existing AVR with a new ABB AVR does not result in a change that would cause any system parameter to change. As this is the case, the proposed activity does not result in a design basis limit for a fission product barrier, as described in the SAR, being exceeded or altered as it is not an accident mitigator.

The ABB AVR provides additional protection features and enhances component reliability through the installation of redundant channels, allowing a single channel to fail while the system would continue to operate. The new ABB AVR system does not introduce any new operator intervention or burden with installation. The ABB AVR is of a proven design and has been utilized though out the nuclear industry with provable reliability.

SU-22-00112, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 9 of 19 10/23/2024 The existing Alstom Automatic Voltage Regulator (AVR) for Unit 1 was designed to provide reliable service for the remaining life of the plant at the time of installation. As part of the Subsequent License Renewal (SLR) project, the life of the plant will be extended another 20 years. Therefore, the existing AVR will be reaching the end of its expected design life and is not expected to be able to support operation for an additional 20 years.

This modification replaces the existing Unit 1 Alstom AVR (01-EP-VREG-1), located on the south side of the turbine deck with a new ABB Unitrol 6000 Medium AVR (hereafter referred to as the ABB AVR) as procured per specification. The new ABB AVR provides similar functionality to the existing AVR but with higher redundancy which results in improved reliability. The new ABB AVR system provides a twin configuration (2 channels), where each channel can be the primary channel. Upon failure of the active channel, the system transfers to the standby channel automatically.

The new AVR system is designed to support the operation of both the existing Main Generator and Main Generator Exciter, as well as the future Main Generator and Main Generator Exciter replacements which will maintain the same operating ratings as the existing equipment. This replacement supports the Surry Subsequent License Renewal program to extend the life of the plant by an additional 20 years of operation.

Summary:

This Design Change (DC) replaces the existing Digital Alstom AVR with Digital ABB AVR capable of providing trip signals. Existing functionality of the AVR will be performed by the replacement ABB AVR with similar functionality.

The following are the design functions (i.e. listed in the 1 0CFR50.59 Screen) that are adversely affected:

DF-1: The main generator AVR adjusts the exciter field to maintain a main generator voltage output within the allowable ranges. Additionally, it provides protection of the generator through V/hZ protection.

A qualitative assessment of the proposed activity concluded that the activity involves a sufficiently low likelihood of potential hardware or software failures, including a software CCF.

The 10 CFR 50.59 evaluation concluded that the following:

The software has been rigorously tested by vendor and will be tested prior to installation such that a system software common cause is no more credible than a single hardware failure on the existing system. Hardware failures have been evaluated as part of the ABB AVR FMEA. The voltage regulator manufacturer manufactured the system in accordance with industry standards while meeting their QA program requirements. The ABB AVR is a proven design and is used through the industry. Industry OE has not identified specific reliability concerns with this system. The change did not result in more than a minimal increase in frequency of occurrence of an accident previously evaluated in the SAR.

Serial No.25-077 10 CFR 50.59 Annual Report Page 10 of 19 The design and testing of the ABB AVR are sufficient to produce a reliable design as discussed in the qualitative analysis. The effects of Design Change do not result in more than minimal increase in the likelihood of occurrence of malfunction of an SSC important to safety previously evaluated in the UFSAR.

The change does not alter assumptions previously made while evaluating the radiological consequences of the above-mentioned accident. The change does not prevent or degrade the effectiveness of actions described in the accident analysis. The Main Generator will continue to function consistent with both the reliability and capacity considered within the UFSAR.

The ABB AVR with Generator Trip functionality is digitally controlled and is subject to software common-mode failure. This type of failure can result in system-level failures that affect the supply of power to the associated station busses or transmission system though the loss of the Generator due to cable interconnections. This malfunction of an SSC is previously evaluated in the UFSAR and the loss of the SSC (Generator) does not impact dose and therefore does not result in a more than minimal increase in the consequences of a malfunction of a SSC important to safety previously evaluated in the SAR.

The ABB AVR provides the same functionality to the Main Generator. The effect of a failure of the ABB AVR could result in a trip of the Main Generator. The ABB AVR could also fail to trip the Generator, would eventually result in the generator tripping via alternate protection features. The failure of the modified components could only lead to an accident previously analyzed in the UFSAR, that of a Generator being taken offiine.

The proposed activity will not introduce an accident of a different type than previously described in the UFSAR.

Software failures in the ABB AVR can result in system-level failure including the tripping of the Main Generator, which would impact downstream buses and equipment. Software failures in ABB AVR are limited to impacting the ABB AVR as no digital signals are outputted from the system. Failures of the AVR software will not propagate to other plant systems. The ABB AVR could also fail to trip the Generator, would eventually result in the generator tripping via alternate protection features. As the result of a malfunction of the ABB AVR is limited to the same result as current system level failures that of impacting availability of the Main Generator. The trip of the generator through the ABB AVR results in the same outcome, that of loss of the Main Generator. The result of the failures of the ABB AVR therefore does not create a result different than currently analyzed.

The replacement of the existing AVR with a new ABB AVR does not result in a change that would cause any system parameter to change. As this is the case, the proposed activity does not result in a design basis limit for a fission product barrier, as described in the SAR, being exceeded or altered as it is not an accident mitigator.

The ABB AVR provides additional protection features and enhances component reliability through the installation of redundant channels, allowing a single channel to fail while the system would continue to operate. The new ABB AVR system does not introduce any new operator intervention or burden with installation. The ABB AVR is of a proven design and has been utilized though out the nuclear industry with provable reliability.

SU-22-00133, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 11 of 19 11/05/2024 The Fuel Transfer System (FTS) is becoming obsolete and requires replacement to support plant operation for the Period of Extended Operation (PEO) through the Subsequent License Renewal (SLR) (SLR extends operating range from 60 to 80 years). The FTS is required for refueling operations.

Summary:

This Design Change (DC) replaces the Fuel Transfer System (FTS) with digital components and an automatic control option. The digital components of the new FTS present the potential for a software failure, and the automatic control option of the new FTS presents the potential for operator error.

The following are the design functions that are adversely affected:

UFSAR Section 9.12.4.9, Fuel Transfer System:

The FTS is designed to handle nuclear fuel.

Fuel storage and handling cascades up to GDC 61 - Fuel Storage and Handling and Radioactivity Control. Therefore, the GDC impacted by the proposed activity is a SAR-described design function (DF-1 ).

A qualitative assessment (performed consistent with the guidance in NRC RIS 2002-22, Supplement 1) of the proposed activity concluded that the activity involves a sufficiently low likelihood of a potential software failure. Additionally, an HFE evaluation of the proposed activity concluded that the proposed changes will not have an adverse impact on how an operator performs or controls the design functions of the FTS.

The 10 CFR 50.59 evaluation concluded that the following:

The change did not result in more than a minimal increase in frequency of occurrence of an accident previously evaluated in the SAR.

The effects of the activity do not result in more than minimal increase in the likelihood of occurrence of malfunction of an SSC important to safety previously evaluated in the UFSAR.

The activity does not result in more than a minimal increase in the consequences of an accident previously evaluated in the UFSAR.

The activity does not result in a more than minimal increase in the consequences of a malfunction of a SSC important to safety previously evaluated in the UFSAR.

The proposed activity will not introduce an accident of a different type than previously described in the UFSAR.

Serial No.25-077 10 CFR 50.59 Annual Report Page 12 of 19 The activity does not create a malfunction of a SSC important to safety with a different result than currently analyzed.

The proposed activity does not result in a design basis limit for a fission product barrier, as described in the SAR, being exceeded, or altered as it is not an accident mitigator.

The FTS provides additional functionality with the installation of a digital control system and automatic control option.

The FTS controls and interface are of a proven design have been utilized though out the nuclear industry with provable reliability.

SU-19-01004, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 13 of 19 11/10/2024 The proposed activity replaces the existing electro-mechanical Main Generator Protection Relays with multifunction digital protective relays. The relays being replaced are located in the Emergency Switchgear Room (ESGR) in panels 1-EP-PNL-8 (Generator Relay Panel #8) and 1-EP-PNL-14 (Unit 1 Main Generator Auto Sync Panel).

Summary:

This Design Change (DC) replaces the existing electro-mechanical Main Generator Protection Relays with multifunction digital protective relays. The digital relays (SEL-700G1 + and SEL-2664S) in each channel present a potential for a common cause software or hardware failure.

The following are the design functions (i.e., listed in the 1 0CFR50.59 Screen) that are adversely affected:

DF-1: The main generator generates power to the station and to the switchyard through the station service transformers and main step-up transformers respectively.

DF-2: The generator protective relaying automatically trips the turbine stop valves and electrically isolates the generator protecting the equipment from faults.

DF-3: The Reverse Power protection system provides two forms of turbine protection.

Excessive heat damage to the turbine is prevented during generator motoring by tripping the generator breakers 40 seconds after sensing the reverse power condition. Additional turbine overspeed protection is provided by using the reverse power relay to provide sequential tripping. Sequential Tripping is provided through a reverse power protection scheme with any trip circuit using steam valve close position switches.

As described in NRG Regulatory Issue Summary (RIS) 2002-22, Supplement 1, "Clarification on Endorsement of Nuclear Energy Institute Guidance in Designing Digital Upgrades in Instrumentation and Control Systems," and Nuclear Energy Institute (NEI) Technical Report 96-07, Appendix D, "Supplemental Guidance for Application of 10 CFR 50.59 to Digital Modifications," Revision 1, a 10 CFR 50.59 evaluation may be required if the activity adversely impacts a SAR-described design function, based on a potential reduction in reliability and independence due to hardware or software failures, including a software common cause failure (CCF).

A qualitative assessment of the proposed activity concluded that the activity involves a sufficiently low likelihood of potential hardware or software failures, including a software CCF.

The 10 CFR 50.59 Evaluation and Qualitative Analysis concluded that the following:

The software has been rigorously tested by vendor and will be tested prior to installation such that a system software common cause is no more credible than a single hardware failure on the existing system. The relay manufacturer manufactured the protective relays in accordance with industry standards while meeting their QA program requirements. The SEL protective relays are a proven design and are used through the industry and in the Dominion Energy Nuclear Fleet. Industry OE has not identified specific reliability

Serial No.25-077 10 CFR 50.59 Annual Report Page 14 of 19 concerns with this system. The change did not result in more than a minimal increase in frequency of occurrence of an accident previously evaluated in the SAR.

The design and testing of the Schweitzer relays is sufficient to produce a reliable design as discussed in the qualitative analysis. The effects of the Design Change do not result in a more than minimal increase in the likelihood of occurrence of malfunction of an SSC important to safety previously evaluated in the UFSAR.

The change does not alter assumptions previously made while evaluating the consequences of the above-mentioned accident. The change does not prevent or degrade the effectiveness of actions described in the accident analysis. The Main Generator will continue to function consistent with both the reliability and capacity considered within the UFSAR.

The Main Generator protective relays trip functionality is digitally controlled, with redundant relays, and is subject to software common-mode failure. This type of failure can result in system-level failures that affect the supply of power to the associated station busses or transmission system though the loss of the Generator due to the trip control circuit. This malfunction of an SSC is previously evaluated in the UFSAR and the loss of the SSC (Generator) does not impact dose and therefore does not result in a more than minimal increase in the consequences of a malfunction of an SSC important to safety previously evaluated in the SAR.

Failure of the Main Generator protection could only lead to an accident previously analyzed in the UFSAR. The protective relays have three modes of operation. They can operate correctly (detecting a fault and sending a trip signal}, fail to operate (not providing a trip signal during a fault}, and provide false actuation (false trip signal without a fault).

Trip and false trip would provide input through contacts into other control circuits. Failure to operate would be monitored by other protective devices outside the zone of protection.

The failure of the modified components could only lead to an accident previously analyzed in the UFSAR, that of a Generator being taken offline. The proposed activity will not introduce an accident of a different type than previously described in the UFSAR.

Software failures in the main generator protective relays can only result in system-level failure (the relay is isolated from other circuits and components, and the output is from an analog component with dry contacts) including the tripping of the Main Generator, which would impact downstream buses and equipment. Software failures in protective relays are limited to impacting the individual trip circuit as no digital signals are outputted from the relays. Failures of the relay software will not propagate to other plant systems.

Malfunction of the relays is limited to the same result as the current system level failures, that of impacting availability of the Main Generator. Failure to operate would be monitored by other protective devices outside the zone of protection. The result of the failures of the protective relays therefore do not create a malfunction of an SSC important to safety with a different result than currently analyzed.

The replacement of the existing analog relays with new digital protective relays does not result in a change that would cause any system parameters of the fission product barriers to change. As this is the case, the proposed activity does not result in a design basis limit for a fission product barrier as described in the SAR being exceeded or altered as it is not an accident mitigator.

Serial No.25-077 10 CFR 50.59 Annual Report Page 15 of 19 The Main Generator protective relays provide additional protection features and enhance system reliability through the installation of redundant channels, allowing a single channel to fail in a non-tripped state, while the system would continue to operate. The new digital relays do not introduce any new operator intervention or burden with installation. The Schweitzer relays are of a proven design and have been utilized throughout the nuclear industry with proven reliability.

As the eight questions to determine if the activity requires prior NRC approval are answered as no or N/A, this activity may be implemented without the need for further NRC review or approval.

SU-21-00171, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Annual Report Page 16 of 19 11/10/2024 The proposed activity replaces the existing electro-mechanical Main Generator Protection Relays with multifunction digital protective relays. The relays being replaced are located in the Emergency Switchgear Room (ESGR) in panel 2-EP-PNL-08 (Generator Relay Panel #8).

Summary:

This Design Change (DC) replaces the existing electro-mechanical Main Generator Protection Relays with multifunction digital protective relays. The digital relays (SEL-700G1 + and SEL-2664S) in each channel present a potential for a common cause software or hardware failure.

The following are the design functions (i.e., listed in the 1 0CFR50.59 Screen) that are adversely affected:

DF-1: The main generator generates power to the station and to the switchyard through the station service transformers and main step-up transformers respectively.

DF-2: The generator protective relaying automatically trips the turbine stop valves and electrically isolates the generator protecting the equipment from faults.

DF-3: The Reverse Power protection system provides two forms of turbine protection.

Excessive heat damage to the turbine is prevented during generator motoring by tripping the generator breakers 40 seconds after sensing the reverse power condition. Additional turbine overspeed protection is provided by using the reverse power relay to provide sequential tripping. Sequential Tripping is provided through a reverse power protection scheme with any trip circuit using steam valve close position switches.

As described in NRC Regulatory Issue Summary (RIS) 2002-22, Supplement 1, "Clarification on Endorsement of Nuclear Energy Institute Guidance in Designing Digital Upgrades in Instrumentation and Control Systems," and Nuclear Energy Institute (NEI) Technical Report 9.6-07, Appendix D, "Supplemental Guidance for Application of 10 CFR 50.59 to Digital Modifications," Revision 1, a 10 CFR 50.59 evaluation may be required if the activity adversely impacts a SAR described design function, based on a potential reduction in reliability and independence due to hardware or software failures, including a software common cause failure (CCF).

A qualitative assessment of the proposed activity concluded that the activity involves a sufficiently low likelihood of potential hardware or software failures, including a software CCF.

The 10 CFR 50.59 Evaluation and Qualitative Analysis concluded that the following:

The software has been rigorously tested by vendor and will be tested prior to installation such that a system software common cause is no more credible than a single hardware failure on the existing system. The relay manufacturer manufactured the protective relays in accordance with industry standards while meeting their QA program requirements. The SEL protective relays are a proven design and are used through the industry and in the Dominion Energy Nuclear Fleet. Industry OE has not identified specific reliability

Serial No.25-077 10 CFR 50.59 Annual Report Page 17 of 19 concerns with this system. The change did not result in more than a minimal increase in frequency of occurrence of an accident previously evaluated in the SAR.

The design and testing of the Schweitzer relays is sufficient to produce a reliable design as discussed in the qualitative analysis. The effects of the Design Change do not result in a more than minimal increase in the likelihood of occurrence of malfunction of an SSC important to safety previously evaluated in the UFSAR.

The change does not alter assumptions previously made while evaluating the consequences of the abovementioned accident. The change does not prevent or degrade the effectiveness of actions described in the accident analysis. The Main Generator will continue to function consistent with both the reliability and capacity considered within the UFSAR.

The Main Generator protective relays trip functionality is digitally controlled, with redundant relays, and is subject to software common-mode failure. This type of failure can result in system-level failures that affect the supply of power to the associated station busses or transmission system though the loss of the Generator due to the trip control circuit. This malfunction of a SSC is previously evaluated in the UFSAR and the loss of the SSC (Generator) does not impact dose and therefore does not result in a more than minimal increase in the consequences of a malfunction of a SSC important to safety previously evaluated in the SAR.

Failure of the Main Generator protection could only lead to an accident previously analyzed in the UFSAR. The protective relays have three modes of operation. They can operate correctly (detecting a fault and sending a trip signal), fail to operate (not providing a trip signal during a fault), and provide false actuation (false trip signal without a fault).

Trip or false trip would provide input through contacts into other control circuits. Failure to operate would be monitored by other protective devices outside the zone of protection.

The failure of the modified components could only lead to an accident previously analyzed in the UFSAR, that of a Generator being taken offline. The proposed activity will not introduce an accident of a different type than previously described in the UFSAR.

Software failures in the main generator protective relays can only result in system-level failure (the relay is isolated from other circuits and components, and the output is from an analog component with dry contacts) including the tripping of the Main Generator, which would impact downstream buses and equipment. Software failures in protective relays are limited to impacting the individual trip circuit as no digital signals are outputted from the relays. Failures of the relay software will not propagate to other plant systems.

A malfunction of the relays is limited to the same result as the current system level failures, that of impacting availability of the Main Generator. Failure to operate would be monitored by other protective devices outside the zone of protection. The result of the failures of the protective relays therefore do not create a malfunction of an SSC important to safety with a different result than currently analyzed.

The replacement of the existing analog relays with new digital protective relays does not result in a change that would cause any system parameters of the fission product barriers to change. As this is the case, the proposed activity does not result in a design basis limit for a fission product barrier, as described in the SAR, being exceeded or altered as it is not an accident mitigator.

Serial No.25-077 10 CFR 50.59 Annual Report Page 18 of 19 The Main Generator protective relays provide additional protection features and enhance system reliability through the installation of redundant channels, allowing a single channel to fail in a non-tripped state, while the system would continue to operate. The new digital relays do not introduce any new operator intervention or burden with installation. The Schweitzer relays are of a proven design and have been utilized throughout the nuclear industry with proven reliability.

As the evaluation criteria responses to determine if the activity requires prior NRC approval are answered as No or N/A, this activity may be implemented without the need for further NRC review or approval.

Commitment Change Evaluation Original Commitment Summary:

Flux Thimble Eddy Current Inspection Program Revised Commitment Summary:

Serial No.25-077 10 CFR 50.59 Annual Report Page 19 of 19 11/27/2024.

Extending Unit 1 and Unit 2 Flux Thimble Tubes Eddy Current inspection frequency from every fourth operational cycle to every sixth operation cycle.

Justification:

The amount of thimble tube degradation identified over the past 30 years for Unit 1 and 2 has been minor relative to the ASME limit of 60% wear through of the inner wall. There has not been a trend associated with any degradation in the inner or outer wall of the flux thimble tubes. The Surry thimble tubes design is a double wall versus a single wall. The double wall thimble tube design provides an added level of protection compared to the single wall, in that both walls must be breached prior to leakage. Therefore, it is acceptable to extend the flux thimble tubes eddy current inspection frequency from every 4th operational cycle to every 6th operational cycle.

It is noted that in the original commitment made to NRC by Letter Serial No. 88-51 SC stated the following: "this inspection frequency is subject to change based on accumulation of data or evidence of wear on inner tube". The letter also states that "The inner tube can lose 60% of its wall thickness without exceeding ASME Code material allowable under design conditions.. This thimble tube wear limit was determined using finite element structural analysis under the assumption that the outer tube would be completely worn through. The inner tube wear limit of 60% is also identified in Westinghouse WCAP-12292.

Surry Units 1 & 2 Serial No.25-077 10 CFR 50.59 Annual Report Page 1 of 4 10 CFR 50.59 Changes, Tests, and Experiments Update for 2022 SU-21-00117, Rev. 0 Regulatory Evaluation 06/07/2022

==

Description:==

The proposed activity is for the implementation of Design Change (DC) SU-21-00117, the Surry Unit 1 Reactor Vessel (RV) will be converted from a Downflow design to an Upflow design. This will include the associated SAR changes performed under SPS-UCR-2022-002 Revision 000.

This change will be accomplished by drilling holes in the upper former plate and plugging existing holes in the core barrel using vendor supplied plugs designed for this specific purpose and qualified as Safety Related.

This change will cause the flow in the baffle-barrel region of the reactor to flow upward (reverse of the previous direction). This effort is being implemented based on Operating Experience (OE) in which fuel damage has occurred due to "jetting" through the baffle joints as a result of the high differential pressure in the previous downflow configuration.

Since the flow through the reactor core and the baffle-barrel region will be in the. same direction, the pressure gradient across the existing baffle joints will be greatly reduced. This reduction. in the pressure gradient will result in a substantial reduction in the coolant jetting through the baffle joints and significantly reduce the potential for baffle jetting damage to the fuel rods that was caused by the original core barrel downflow configuration.

Elements of the activity were identified as requiring a 50.59 Evaluation during the 50.59 Screening. The three elements from the 50.59 Screening which require a 50.59 Evaluation are:

1. The increased bypass flow was determined to be Adverse as it has a negative impact on the Departure from Nucleate Boiling safety analyses.

2. The evaluation of end of life (EOL) conditions within the fuel assembly structural analyses in addition to consideration of beginning of life (BOL) conditions. This is a change to the methodology of WCAP-9401 -PA which is the Surry UFSAR methodology governing fuel assembly structural analyses in response to a LOCA/seismic event.

3. The use of the ANSYS computer code in place of the WECAN computer code for the modeling of core forces. The Surry UFSAR identifies the use of the WECAN computer code for the modeling of core forces. WECAN is no longer supported. ANSYS was used in the assessment of the upflow conversion. The use of AN SYS is a change to a method of evaluation described in the Surry UFSAR. UFSAR changes in SPSUCR-2022-002 are updating the UFSAR to include discussion of the ANSYS computer code and its use in the structural analyses.

Summary:

Serial No.25-077 10 CFR 50.59 Report Page 2 of 4 The proposed activity considered is the Upflow conversion of the Surry Unit 1 barrel/baffle region. Three elements in the activity required a 50.59 Evaluation. The three elements are:

1. The increased bypass flow was determined to be Adverse as it affects the Departure from Nucleate Boiling safety analyses.

2. The evaluation of end of life (EOL) conditions within the fuel assembly structural analyses in addition to consideration of beginning of life (BOL) conditions. This is a change to the methodology of WCAP-9401-PA which is the Surry UFSAR methodology governing fuel assembly structural analyses in response to a LOCA/seismic event.

3. The use of the ANSYS computer code in place of the WECAN computer code for the modeling of core forces. The Surry UFSAR identifies the use of the WECAN computer code for the modeling of core forces. WECAN is no longer supported. ANSYS was used in the assessment of the upflow conversion. The use of AN SYS is a change to a method of evaluation described in the Surry UFSAR.

Item (1) determined the impact of the increased bypass flow as a result of Surry Unit 1 Upflow Conversion on DNB safety analyses. The adverse impact to DNB is addressed through the application of a penalty to retained DNBR margin. The use of retained DNBR margin to offset penalties is allowed under the methodology of VEP-NE-2-A. The increase in bypass flow does not impact how SSCs are operated or controlled. Therefore, the increased bypass flow associated with Surry Unit 1 Upflow Conversion is acceptable and does not require NRC approval.

Item (2) changed a method of evaluation, WCAP-9401-P-A which is the Surry UFSAR methodology governing fuel assembly structural analyses in response to a LOCA/seismic event.

This change is governed by the NRC approved methodology of PWROG-16043-P-A. PWROG-16043-P-A is approved for evaluating the fuel assembly structural analyses in response to a LOCA/seismic event under end of life conditions and has been applied within the Conditions and Limitations of the NRC Safety Evaluation on PWROG-16043-P-A. It is thus determined that this method change in the fuel assembly structural analyses performed for Surry Unit 1 Upflow Conversion meets the qualification of 1 0CFR50.59(a)(2)(ii) that it has been approved by NRC for the intended application. Therefore, this is allowed by the provisions of 1 0CFR50.59 and does not require NRC approval.

Item (3) changed a method of evaluation from WE CAN to AN SYS in the reactor vessel structural internals evaluation. The use of ANSYS use for Surry Unit 1 meets the qualification of 1 0CFR50.59(a)(2)(ii) that it has been approved by NRC for the intended application. Therefore, the use of AN SYS is allowed by the provisions of 1 0CFR50.59 and does not require NRC approval.

In conclusion, NRC review and approval is not required prior to implementing the changes associated with the analysis supporting the Upflow Conversion for Surry Unit 1. The three (3) items listed in this 1 0CFR 50.59 Evaluation have been shown to satisfy the eight criterion.

Therefore, the Surry Unit 1 Upflow conversion may be performed under the provisions of 1 0CFR 50.59 and can be implemented without prior NRC review and approval.

SU-21-00118, Rev. 0 Regulatory Evaluation

==

Description:==

Serial No.25-077 10 CFR 50.59 Report Page 3 of 4 11/04/2022 The proposed activity is for the implementation of Design Change (DC) SU-21-00118, the Surry Unit 2 Reactor Vessel (RV) will be converted from a Downflow design to an Upflow design. This will include the associated SAR changes performed under SPS-UCR-2022-018 Revision 0.

This change will be accomplished by drilling holes in the upper former plate and plugging existing holes in the core barrel using vendor supplied plugs designed for this specific purpose and qualified as Safety Related.

This change will cause the flow in the baffle-barrel region of the reactor to flow upward (reverse of the previous direction). This effort is being implemented based on Operating Experience (OE) in which fuel damage has occurred due to "jetting" through the baffle joints as a result of the high differential pressure in the previous downflow configuration.

Since the flow through the reactor core and the baffle-barrel region will be in the same direction, the pressure gradient across the existing baffle joints will be greatly reduced. This reduction in the pressure gradient will result in a substantial reduction in the coolant jetting through the baffle joints and significantly reduce the potential for baffle jetting damage to the fuel rods that was caused by the original core barrel downflow configuration.

Elements of the activity were identified as requiring a 50.59 Evaluation during the 50.59 Screening. The three elements from the 50.59 Screening which require a 50.59 Evaluation are:

1. The increased bypass flow was determined to be Adverse as it has a negative impact on the Departure from Nucleate Boiling safety analyses.

2. The evaluation of end of life (EOL) conditions within the fuel assembly structural analyses in addition to consideration of beginning of life (BOL) conditions. This is a change to the methodology of WCAP-9401-PA which is the Surry UFSAR methodology governing fuel assembly structural analyses in response to a LOCA/seismic event.

3. The use of the AN SYS computer code in place of the WE CAN computer code for the modeling of core forces. The Surry UFSAR identifies the use of the WECAN computer code for the modeling of core forces. WECAN is no longer supported. ANSYS was used in the assessment of the upflow conversion. The use of AN SYS is a change to a method of evaluation described in the Surry UFSAR. UFSAR changes in SPS-UCR-2022-018 are updating the UFSAR to include discussion of the AN SYS computer code and its use in the structural analyses.

Summary:

The proposed activity considered is the Upflow conversion of the Surry Unit 2 barrel/baffle region. Three elements in the activity required a 50.59 Evaluation. The three elements are:

1. The increased bypass flow was determined to be Adverse as it affects the Departure from Nucleate Boiling safety analyses.

Serial No.25-077 10 CFR 50.59 Report Page 4 of 4

2. The evaluation of end of life (EOL) conditions within the fuel assembly structural analyses in addition to consideration of beginning of life (BOL) conditions. This is a change to the methodology of WCAP-9401-P-A which is the Surry UFSAR methodology governing fuel assembly structural analyses in response to a LOCA/seismic event.

3. The use of the ANSYS computer code in place of the WECAN computer code for the modeling of core forces. The Surry UFSAR identifies the use of the WECAN computer code for the modeling of core forces. WECAN is no longer supported. ANSYS was used in the assessment of the upflow conversion. The use of AN SYS is a change to a method of evaluation described in the Surry UFSAR.

Item (1) determined the impact of the increased bypass flow as a result of Surry Unit 2 Upflow Conversion on DNB safety analyses. The adverse impact to DNB is addressed through the application of a penalty to the retained DNBR margin. The use of retained DNBR margin to offset adverse impacts is allowed under the methodology of VEP-NE-2-A. The increase in bypass flow does not impact how SSCs are operated or controlled. Therefore, the increased bypass flow associated with Surry Unit 2 Upflow Conversion is acceptable and does not require NRC approval.

Item (2) changed a method of evaluation, WCAP-9401-P-A which is the Surry UFSAR methodology governing fuel assembly structural analyses in response to a LOCA/seismic event.

This change is governed by the NRC approved methodology of PWROG-16043-P-A, which is approved for evaluating the fuel assembly structural analyses in response to a LOCA/seismic event under end of life conditions and has been applied within the Conditions and Limitations of the NRC Safety Evaluation on PWROG-16043-P-A. It is thus determined that this method change in the fuel assembly structural analyses performed for Surry Unit 2 Upflow Conversion meets the qualification of 1 0CFR50.59(a)(2)(ii) that it has been approved by NRC for the intended application. Therefore, this is allowed by the provisions of 1 0CFR50.59 and does not require NRC approval.

Item (3) changed a method of evaluation from WECAN to AN SYS in the reactor vessel structural internals evaluation. The use of AN SYS use for Surry Unit 2 meets the qualification of 1 0CFR50.59(a)(2)(ii) that it has been approved by NRC for the intended application. Therefore, the use of ANSYS is allowed by the provisions of 10CFR50.59 and does not require NRC approval.

In conclusion, NRC review and approval is not required prior to implementing the changes associated with the analysis supporting the Upflow Conversion for Surry Unit 2. The three (3) items listed in this 1 0CFR 50.59 Evaluation have been shown to satisfy the eight criterion.

Therefore, the Surry Unit 2 Upflow conversion may be performed under the provisions of 1 0CFR 50.59 and can be implemented without prior NRC review and approval.