Text

Technical Specification (TS) Bases Change
	ML16043A047
Person / Time
Site:	Oconee
Issue date:	02/09/2016
From:	Batson S; Duke Energy Carolinas
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	ONS-2016-009
	Download: ML16043A047 (26)
	v • d • e

Scott,. Bt

ENERGY, Vice President Oconee Nuclear Station Duke Energy ONO1VP 7800 Rochester Hvwy Seneca, SC 29672 0; 864.873.3274 f864.873.4208 ONS-201 6-009 Scott.Batson~duke-energy.corn February 9, 2016 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission 11555 Rockville Pike Rockville, Maryland 20852

Subject:

Duke Energy Carolinas, LLC Oconee Nuclear Station Docket Numbers 50-269, 50-270, and 50-287 Technical Specification (TS) Bases Change Please find attached changes to the Oconee Nuclear Station (ONS) TS Bases. These changes were processed in accordance with the provisions of Technical Specification 5.5.15, "Technical Specifications (TS) Bases Control Program."

Amendments 395/397/396 were issued for Oconee to revise ONS TS 3.5.2, "High Pressure Injection (HPI)," by reducing the allowed maximum Rated Thermal Power (RTP) value at which each unit can operate when select HPI equipment is inoperable. As a result of the TS 3.5.2 changes, associated changes were incorporated in the Bases for TS 3.5.2 and the Bases for TS 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

Any questions regarding this information should be directed to Chris Wasik, Manager, ONS Regulatory Affairs, at (864) 873-5789.

Sincerely, Scott L. Batson Vice President Oconee Nuclear Station Attachment www.duke-energy.com

U. S. Nuclear Regulatory Commission February 9, 2016 Page 2 cc: Ms. Catherine Haney Administrator, Region II U.S. Nuclear Regulatory Commission, Region II Marquis One Tower 245 Peachtree Center Ave., NE, Suite 1200 Atlanta, GA 30303-1257 Mr. James R. Hall, Senior Project Manager (ONS)

(By electronic mail only)

U. S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation 11555 Rockville Pike Mail Stop O-8G9A Rockville, MD 20852 Mr. Jeffrey A. Whited, Project Manager (By electronic mail only)

U. S. Nuclear Regulatory Commission Office of Nuclear Reactor Regulation 11555 Rockville Pike Mail Stop O-8B1A Rockville, MD 20852 Mr. Eddy L. Crowe Senior Resident Inspector Oconee Nuclear Station

ONS-201 6-009 February 9, 2016 Attachment Revised Oconee Nuclear Station TSB Manual Pages TSB List of Effective Pages (LOEPs), Rev. 004 TSB 3.5.2, High Pressure Injection (HPI)

TSB 3.7.4, Atmospheric Dump Valve (ADV) Flow Paths I

LOEPI1-4 3.5.2-1 thru 14 4.7.4-1 thru 5 www.duke-energy.com

&k OCONEE NUCLEAR STATION TECHNICAL SPECIFICATIONS-BASES REVISED 1/19/16 LIST OF EFFECTIVE PAGES SECTION/PAGES TOG B 2.1.1 B 2.1.2 B 3.0 B 3.1.1 B 3.1.2 B 3.1.3 B 3.1.4 B 3.1.5 B 3.1.6 B 3.1.7 B 3.1.8 B 3.2.1 B 3.2.2 B 3.2.3 B 3.3.1 B 3.3.2 B 3.3.3 B 3.3.4 B 3.3.5 B 3.3.6 B 3.3.7 B 3.3.8 B 3.3.9 B 3.3.10 B 3.3.11 B 3.3.12 REVISION NUMBER 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 001 000 000 000 000 000 000 000 000 000 000 000 IMPLEMENTATION DATE 09/03/14 05/31/12 02/06/14 10/20/11 05/16/12 05/16/12 06/02/99 07/23/12 05/16/12 07/23/12 07/23/12 05/16/12 05/16/12 05/16/12 05/16/12 09/30/15 12/14/04 12/10/14 12/10/14 12/10/14 12/10/14 12/10/14 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 Oconee Nuclear StationLEP1Rvso04 LOEP 1 Revision 004

OCONEE NUCLEAR STATION TECHNICAL SPECIFICATIONS-BASES REVISED 1/19/16 LIST OF EFFECTIVE PAGES SECTION/PAGES REVISION NUMBER BASES REVISION DATE B 3.3.13 B 3.3.14 B 3.3.15 B 3.3.16 B 3.3.17 B 3.3.18 B 3.3.19 B 3.3.20 B 3.3.21 B 3.3.22 B 3.3.23 B 3.3.24 B 3.3.25 B 3.3.26 B 3.3.27 B 3.3.28 B 3.4.1 B 3.4.2 B 3.4.3 B 3.4.4 B 3.4.5 B 3.4.6 B 3.4.7 B 3.4.8 B 3.4.9 B 3.4.10 B 3.4.11 B 3.4.12 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 001 000 000 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 09/26/01 11/05/03 11/05/03 12/10/14 05/16/12 05/16/12 12/16/9 8 03/04/15 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 09/21/15 10/12/12 06/13/14 Oconee Nuclear StationLEP2Rvso04 LOEP 2 Revision 004

OCONEE NUCLEAR STATION TECHNICAL SPECIFICATIONS-BASES REVISED 1/19/16 LIST OF EFFECTIVE PAGES SECTION/PAGES REVISION NUMBER BASES REVISION DATE B 3.4.13 B 3.4.14 B 3.4.15 B 3.4.16 B 3.5.1 B 3.5.2 B 3.5.3 B 3.5.4 B 3.6.1 B 3.6.2 B 3.6.3 B 3.6.4 B 3.6.5 B 3.7.1 B 3.7.2 B 3.7.3 B 3.7.4 B 3.7.5 B 3.7.6 B 3.7.7 B 3.7.8 B 3.7.9 B 3.7.10 B 3.7.10a B 3.7.11 B 3.7.12 B 3.7.13 B 3.7.14 000 001 001 002 001 000 000 000 000 000 001 001 000 001 000 000 000 000 000 000 000 000 000 05/16/12 09/21/15 11/24/15 04/02/07 05/16/12 01/19/16 09/21/15 05/16/12 10o/20/11 05/16/12 05/16/12 05/16/12 09/21/15 09/21/15 11/13/12 09/21/15 01/19/16 09/21/15 05/16/12 12/10/14 05/16/12 08/28/14 09/03/14 09/03/14 05/16/12 05/16/12 08/19/10 05/16/12 Oconee Nuclear StationLEP3Rvso04 LOEP 3 Revision 004

OCONEE NUCLEAR STATION TECHNICAL SPECIFICATIONS-BASES REVISED 1/19/16 LIST OF EFFECTIVE PAGES SECTION/PAGES REVISION NUMBER BASES REVISION DATE B 3.7.15 B 3.7.16 B 3.7.17 B 3.7.18 B 3.7.19 B 3.8.1 B 3.8.2 B 3.8.3 B 3.8.4 B 3.8.5 B 3.8.6 B 3.8.7 B 3.8.8 B 3.8.9 B 3.9.1 B 3.9.2 B 3.9.3 B 3.9.4 B 3.9.5 B 3.9.6 B 3.9.7 B 3.9.8 B 3.10.1 B 3.10.2 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 10/24/07 05/16/12 04/12/06 06/15/06 06/25/14 O5/2 1/15 04/07/11 04/28/15 12/18/07 05/16/12 05/16/12 05/16/12 05/16/12 05/16/ 12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 05/16/12 06/25/14 11/05/14 11/05/14 Note: With the introduction of Fusion in June 2015, all controlled documents require a three-digit revision number. Thus, the revision numbers were set to "000" in the summer of 2015. As such, the revision dates for Revision 000 are based on the implementation dates for revisions in effect prior to this change.

Oconee Nuclear StationLEP4Rvsn04 LOEP 4 Revision 004

HPI B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 High Pressure Injection (HPI)

BASES BACKGROUND The function of the ECCS is to provide core cooling to ensure that the reactor core is protected after any of the following accidents:

a.

Loss of coolant accident (LOCA);

b.

Rod ejection accident (REA);

c.

Steam generator tube rupture (SGTR); and

d.

Main steam line break (MSLB).

There are two phases of ECCS operation: injection and recirculation. In the injection phase, all injection is initially added to the Reactor Coolant System (RCS) via the cold legs or Core Flood Tank (CFT) lines to the reactor vessel. After the borated water storage tank (BWST) has been depleted, the recirculation phase is entered as the suction is transferred to the reactor building sump.

The HPI System consists of two independent trains, each of which splits to discharge into two RCS cold legs, so that there are a total of four HPI injection lines. Each train takes suction from the BWST, and has an automatic suction valve and discharge valve which open upon receipt of an Engineered Safeguards Protective System (ESPS) signal. The two HPI trains are designed and aligned such that they are not both susceptible to any single active failure including the failure of any power operating component to operate or any single failure of electrical equipment. The HPI System is not required to withstand passive failures.

There are three ESPS actuated HPI pumps; the discharge flow paths for two of the pumps are normally aligned to automatically support HPI train "A" and the discharge flow path for the third pump is normally aligned to automatically support HPI train "B." The discharge flow paths can be manually aligned such that each of the HPI pumps can provide flow to either train. At least one pump is normally running to provide RCS makeup and seal injection to the reactor coolant pumps. Suction header cross-connect valves are normally open; cross-connecting the HPI suction OCONEE UNITS 1, 2, & 3 B3521Rv 0

B3.5.2-1 Rev. 002 I

HPI B 3.5.2 BASES BACKGROUND headers during normal operation was approved by the NRC in (continued)

Reference 6. The discharge crossover valves (HP-409 and HP-410) are normally closed; these valves can be used to bypass the normal discharge valves and assure the ability to feed either train's injection lines via HPI pump "B." For each discharge valve and discharge crossover valve, a safety grade flow indicator is provided to enable the operator to throttle flow during an accident to assure that runout limits are not exceeded.

A suction header supplies water from the BWST or the reactor building sump (via the LPI-HPI flow path) to the HPI pumps. HPI discharges into each of the four RCS cold legs between the reactor coolant pump and the reactor vessel. There is one flow limiting orifice in each of the four injection headers that connect to the RCS cold legs. If a pipe break were to occur in an HPI line between the last check valve and the RCS, the orifice in the broken line would limit the HPI flow lost through the break and maximize the flow supplied to the reactor vessel via the other line supplied by the HPI header.

The HPI pumps are capable of discharging to the RCS at an RCS pressure above the opening setpoint of the pressurizer safety valves. The HPI pumps cannot take suction directly from the sump. If the BWST is emptied and HPI is still needed, a cross-connect from the discharge side of the LPI pump to the suction of the HPI pumps would be opened. This is known as "piggy backing" HPI to LPI and enables continued HPI to the RCS.

The HPI System also functions to supply borated water to the reactor core following increased heat removal events, such as MSLBs.

The HPI and LPI (LCO 3.5.3, "Low Pressure Injection (LPI)") components, along with the passive CFTs and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the cooling water necessary to meet 10 CFR 50.46 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the SAFETY ANALYSES ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a LOCA;

a.

Maximum fuel element cladding temperature is < 2200°F;

b.

Maximum cladding oxidation is _< 0.17 times the total cladding thickness before oxidation; OCONEE UNITS 1, 2, &3 B3..-

Rv 0

B3.5.2-2

HPI B 3.5.2 BASES APPLICABLE

c.

Maximum hydrogen generation from a zirconium water reaction is SAFETY ANALYSES

< 0.01 times the hypothetical amount generated if all of the metal in (continued) the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d.

Core is maintained in a coolable geometry; and

e.

Adequate long term cooling capability is maintained.

The HPI System is credited in the small break LOCA analysis (Ref. 2).

This analysis establishes the minimum required flow and discharge head requirements at the design point for the HPI pumps, as well as the minimum required response time for their actuation. The SGTR and MSLB analyses also credit the HP! pumps, but these events are bounded by the small break LOCA analyses with respect to the performance requirements for the HPI System. The HP! System is not credited for mitigation of a large break LOCA.

During a small break LOCA, the HP! System supplies makeup water to the reactor vessel via the RCS cold legs. The HP! System is actuated upon receipt of an ESPS signal. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, the Engineered Safeguards (ES) buses are connected to the Keowee Hydro Units. The time delay associated with Keowee Hydro Unit startup, HPI valve opening, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

One HPI train provides sufficient flow to mitigate most small break LOCAs.

However, for cold leg breaks located on the discharge of the reactor coolant pumps, some HP! injection will be lost out the break; for this case, two HP! trains are required. Thus, three HP! pumps must be OPERABLE to ensure adequate cooling in response to the design basis RCP discharge small break LOCA. Additionally, in the event one HPI train fails to automatically actuate due to a single failure (e.g., failure of HP! pump "C" or HP-26), operator actions from the Control Room are required to cross-connect the HP! discharge headers within 10 minutes in order to provide HPI flow through a second HPI train (Ref. 6).

Hydraulic separation of the HP! discharge headers is required during normal operation to maintain defense-in-depth (i.e., independence of the HPI discharge headers). Additionally, hydraulic separation of the HPI discharge headers ensures that a complete loss of HP! would not occur in the event an accident were to occur with only two of the three HPI pumps OCONEE UNITS 1, 2, & 3 B3523Rv 0

B3.5.2-3 Rev. 002 I

HPI B 3.5.2 BASES APPLICABLE OPERABLE coincident with the HPI discharge headers cross-connected.

SAFETY ANALYSES A single active failure of an HPI pump would leave only one HPI pump to (continued) mitigate the accident. The remaining HPI pump could experience runout conditions and could fail prior to operator action to throttle flow or start another pump.

Hydraulic separation on the suction side of the HPI pumps could cause a loss of redundancy. With any one of the normally open suction header cross-connect valves closed, a failure of an automatic suction valve to open during an accident could cause two pumps to lose suction. Thus, the suction header cross-connect valves must remain open.

The safety analyses show that the HPI pump(s) will deliver sufficient water for a small break LOCA and provide sufficient boron to maintain the core subcritical.

The HPI System satisfies Criterion 3 of 10 CFR 50.36 (Ref. 3).

LCO In MODES I and 2, and MODE 3 with RCS temperature > 350°F, the HPI System is required to be OPERABLE with:

a.

Two HPI trains OPERABLE;

b.

An additional HPI pump OPERABLE;

c.

Two LPI-HPI flow paths OPERABLE;

d.

Two HPI discharge crossover valves OPERABLE;

e.

HPI suction headers cross-connected; and

f.

HPI discharge headers separated.

The LCO establishes the minimum conditions required to ensure that the HPI System delivers sufficient water to mitigate a small break LOCA.

Additionally, individual components within the HPI trains may be called upon to mitigate the consequences of other transients and accidents.

Each HPl train includes the piping, instruments, pump, valves, and controls to ensure an OPERABLE flow path capable of taking suction from the BWST and injecting into the RCS cold legs upon an ESPS signal. For an HPI train to be OPERABLE, the associated HPI pump must be capable of OCONEE UNITS 1, 2, & 3 B3524Rv 0

B3.5.2-4 Rev. 002 I

HPI B 3.5.2 BASES LCO taking suction from the BWST through the suction header valve associated (continued) with that train upon an ESPS signal. For example:

1) if HPI pump "B" is being credited as part of HPI train "A," then it must be capable of taking suction through HP-24 upon an ESPS signal; or

2) if HPI pump "B" is being credited as part of HPI train "B," then it must be capable of taking suction through HP-25 upon an ESPS signal.

The safety grade flow indicator associated with the normal discharge valve is required to be OPERABLE to support the associated HPI train's automatic OPERABILITY.

To support HPI pump OPERABILITY, the piping, valves and controls which ensure the HPI pump can take suction from the BWST upon an ESPS signal are required to be OPERABLE.

To support HPI discharge crossover valve OPERABILITY, the safety grade flow indicator associated with the HPI discharge crossover valve is required to be OPERABLE.

To support LPI-HPI flow path OPERABILITY, each flow path must be capable of being supplied by an OPERABLE LPI train. When capable of being supplied by an OPERABLE LPI train:

1)

An LPI-HPI flow path, including the piping, instruments, valves and controls, must be in-place to ensure the capability to transfer suction to the reactor building sump from the control room. Within the LPI-HPI flow path are the LPI discharge valves to the LPI-HPI flow path (LP-15 and LP-16).

2)

The LPI discharge valves to the LPI-HPI flow path must be capable of being opened from the control room for the LPI-HPI flow path to be OPERABLE.

The OPERABILITY requirements regarding the LPI System are addressed in LCO 3.5.3, "Low Pressure Injection (LPI)."

As part of the LPI-HPI flow path, the piping, instruments, valves and controls upstream of LP-1 5 and LP-1 6 are part of the LPI system and are subject to LCO 3.5.3 (Low Pressure Injection system) requirements. The piping, instruments, valves and controls downstream of and including LP-15 and LP-16, are part of the HPI system and are subject to [CO 3.5.2 (High Pressure Injection system) requirements.

OCONEE UNITS 1, 2, & 3 B3525Rv 0

B 3.5.2-5 Rev. 002 I

HPI B 3.5.2 BASES LCO (continued)

When a LPI-HPI flow path is inoperable due to the flow path's associated LPI train being inoperable for maintenance only, the piggyback line and associated components may also be inoperable for greater than 72-hours up to the associated LPI train's maximum allowed outage time of 7-days.

For this scenario, any valve along the piggyback line flowpath can be used as an isolation boundary, with power removed as necessary, but no physical work is allowed to be performed on any component along the piggyback line flowpath without entering the applicable TS LCO condition.

This is allowed because with an associated LPI train inoperable, there is no water source for the LPI-HPI piggyback function. This support (LPI train) and supported (LPI-HPI piggyback) relationship is subject to the requirements of TS LCO 3.0.6.

During an event requiring HPI actuation, a flow path is provided to ensure an abundant supply of water from the BWST to the RCS via the HPI pumps and their respective discharge flow paths to each of the four cold leg injection nozzles and the reactor vessel. In the recirculation phase, this flow path is transferred from the control room to take its supply from the reactor building sump and to supply borated water to the RCS via the LPI-HPI flow path (piggy-back mode).

The OPERABILITY of the HPI System must be maintained to ensure that no single active failure can disable both HPI trains. Additionally, while the HPI System was not designed to cope with passive failures, the HPI trains must be maintained independent to the extent possible during normal operation. The NRC approved exception to this principle is cross-connecting the HPI suction headers during normal operation (Ref. 6).

APPLICABILITY In MODES 1 and 2, and MODE 3 with RCS temperature > 350°F, the HPI System OPERABILITY requirements for the small break LOCA are based on analysis performed at 100% RTP. The HPI pump performance is based on the small break LOCA, which establishes the pump performance curve.

Mode 2 and MODE 3 with RCS temperature > 350°F requirements are bounded by the MODE I analysis.

In MODE 3 with RCS temperature < 350°F and in MODE 4, the probability of an event requiring HPI actuation is significantly lessened. In this operating condition, the low probability of an event requiring HPI actuation and the LCO 3.5.3 requirements for the LPI System provide reasonable assurance that the safety injection function is preserved.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring HPI injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops OCONEE UNITS 1, 2, &3 B3..-

Rv 0 B 3.5.2-6 Rev. 002

HPI B 3.5.2 BASES APPLICABILITY Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled."

(continued)

MODE 6 core cooling requirements are addressed by LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level."

ACTIONS A.I and A.2 With one HPI pump inoperable, or one or more HPI discharge crossover valve(s) (i.e., HP-409 and HP-410) inoperable, the HPI pump and discharge crossover valve(s) must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

In the event HPI pump "C" becomes inoperable, Condition C must be entered as well as Condition A. Until actions are taken to align an HPI pump to HPI train "B," HPI train "B" is inoperable due to the inability to automatically provide injection in response to an ESPS signal.

This Condition permits multiple components of the HPI System to be inoperable concurrently. When this occurs, other Conditions may also apply. For example, if HPI pump "C" and HP-409 are inoperable coincidentally, HPI train "B" is incapable of being automatically actuated or manually aligned from the Control Room. Thus, Required Action C.I would apply.

In order to utilize another HPI pump to supply HPI train "B" when HPI pump "C" is inoperable, HP-I116 must be opened. This action results in cross-connecting the HPI discharge headers; thus, Condition E must be entered.

HP-I115 may be closed to provide hydraulic separation provided that pump minimum flow requirements are maintained. However, two operating pumps would be required for this configuration, one to provide makeup flow and one to provide seal injection flow.

B.I. B.2. B.3. and B.4 If the Required Action and associated Completion Time of Condition A is not met, THERMAL POWER of the unit must be reduced to _< 50% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit condition from full power

conditions in an orderly manner and without challenging unit systems. This time is less restrictive than the Completion Time for Required Action C.1, OCONEE UNITS 1, 2, & 3 B3527Rv 0

B3.5.2-7 Rev. 002 I

HPI B 3.5.2 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued) because the HPI System remains capable of performing its function, barring a single failure.

Two HPI trains are required to mitigate specific small break LOCAs, if no credit for enhanced steam generator cooling is assumed in the accident analysis. However, if equipment not qualified as QA-1 (i.e., an atmospheric dump valve (ADV) flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if reactor power is

_<50% RTP.

Required Actions B.2, B.3, and B.4 modify the HPI pump and discharge crossover valve OPERABILITY requirements to permit reduced requirements at power levels < 50% RTP for an extended period of time.

Required Action B.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OPERABLE within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This compensatory measure provides additional assurance regarding the ability of the plant to mitigate an accident. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

Required Actions B.3 and B.4 require that the HPI pump and discharge crossover valve(s) be restored to OPERABLE status within 30 days from initial entry into Condition A. The 30-day time period limits the time that the plant can operate while relying on non QA-1 ADVs to provide enhanced steam generator cooling to mitigate small break LOCAs. The 30-day time period is acceptable, because:

1.

Without crediting an ADV flow path, the HPI System remains capable of performing the safety function, barring a single failure;

2.

If credit is taken for an ADV flow path for a steam generator, the safety analysis has demonstrated that only one HPI train is required to mitigate the consequences of a small break LOCA when THERMAL POWER is < 50% RTP. Thus, for this case, the HPI System would be capable of performing its safety function even with an additional single failure; OCONEE UNITS 1, 2, & 3 B3528Rv 0

B3.5.2-8 Rev. 002 ]

HPI B 3.5.2 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued)

3.

OPERABILITY of the ADV flow path for each steam generator is required to be confirmed by Required Action B.2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Additional defense-in-depth is provided, because the ADV flow path for only one steam generator is required to mitigate the small break LOCA; and

4.

A risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with these Required Actions is acceptable.

C.1. C.2, and C.3 If the plant is operating with THERMAL POWER > 50% RTP, two HPI pumps capable of providing flow through two HPI trains are required. One HPI train is required to provide flow automatically upon receipt of an ESPS signal, while flow through the other HPI train must be capable of being established from the Control Room within 10 minutes. Thus, if the plant is operating at > 50% RTP, and one HPI train is inoperable and incapable of being automatically actuated or manually aligned from the Control Room to provide flow post-accident, the HPI System would be incapable of performing its safety function. For this Condition, Required Action C.1 requires the power to be reduced to < 50% RTP within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . Required Action C.1 is modified by a Note which limits its applicability to the condition defined above. The 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months Completion Time is considered reasonable to reduce the unit from full power conditions to < 50% RTP in an orderly manner and without challenging unit systems. The time frame is more restrictive than the Completion Time provided in Required Action B.1 for the same action, because the condition involves a loss of safety function.

If the plant is operating with THERMAL POWER > 50% RTP and the inoperable HPI train can be automatically actuated or manually aligned to provide flow post-accident, Required Action C.3 permits 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the HPI train to an OPERABLE status.

If enhanced steam generator cooling is not credited in the accident analysis, two HPI trains are required to mitigate specific small break LOCAs with THERMAL POWER

50% RTP. However, if equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if THERMAL POWER is < 50% RTP. In order to permit an HPI train to be inoperable regardless of the reason when THERMAL POWER is < 50% RTP,I Required Action C.2 provides a compensatory measure to verify by administrative means that the ADV flow path for each steam generator is OCONEE UNITS 1, 2, & 3 B3529Rv 0

B3.5.2-9 Rev. 002 I

HPI B 3.5.2 BASES ACTIONS Cl.1 C.2, and C.3 (continued)

OPERABLE within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This Required Action is modified by a Note which states that it is only required if THERMAL POWER is _< 50% RTP.

This compensatory measure provides assurance regarding the ability of the plant to mitigate an accident while in the Condition and THERMAL POWER

< 50% RTP. Compliance with this requirement can be established by ensuring that the ADV flow path for each steam generator is OPERABLE in accordance with LCO 3.7.4, "Atmospheric Dump Valve (ADV) Flow Paths."

With one HPI train inoperable, the inoperable HPI train must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action is appropriate because:

1.

With THERMAL POWER _* 50% RTP, the safety analysis demonstrates that only one HPI train is required to mitigate the consequences of a small break LOCA assuming credit is taken for the ADV flow path for one steam generator. The OPERABILITY of the ADV flow path for each steam generator is confirmed by Required Action C.2 within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months . This provides additional defense-in-depth. Additionally, a risk-informed assessment (Ref. 7) concluded that operating the plant in accordance with this Required Action is acceptable.

2.

With THERMAL POWER > 50% RTP, the remaining OPERABLE HPI train is capable of automatic actuation, and the inoperable train can be manually aligned by operator action to cross-connect the discharge headers of the HPI trains. This manual action was approved by the NRC in Reference 6.

D.1 With the HP! suction headers not cross-connected, the HPI suction headers must be cross-connected within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on NRC recommendations (Ref. 4) that are based on a risk evaluation and is a reasonable time for many repairs.

An argument similar to that utilized for Required Actions B.2, B.3, and B.4 could have been made for operating the HPI System with the suction headers not cross-connected for an extended period of time. However, this action was not considered prudent, due to the potential of damaging two HPI pumps in the event HP-24 or HP-25 failed to open in response to an ESPS signal while the HPI suction headers were not cross-connected.

OCONEE UNITS 1, 2, & 3B35210Rv02 B 3.5.2-10 Rev. 002 I

HPI B 3.5.2 BASES ACTIONS E.1 With the HPI discharge headers cross-connected, the independence of the HPI trains is not being maintained to the extent practical (i.e., defense-in-depth principle is not met). Thus, the HPI discharge headers must be hydraulically separated within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This action limits the time period that the HPI discharge headers may be cross-connected. The 72-hour allowed outage time is acceptable, because cross-connecting the HPI discharge headers in conjunction with:

1.

the rest of the HPI System being OPERABLE would not result in the inability of the HPI System to perform its safety function even assuming a single active failure; and

2.

an HPI pump being inoperable would not result in the inability of the HPI System to perform its safety function, barring a single failure.

However, in this condition, a single active failure of one of the two remaining OPERABLE HPI pumps could result in the remaining HPI pump failing due to runout.

F. I~

With one LPI-HPI flow path inoperable, the inoperable LPI-HPI flow path must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The HPI System continues to be capable of mitigating an accident, barring a single failure.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is justified because there is a limited range of break sizes, and therefore a lower probability for a small break LOCA which would require piggy back operation.

G.l and G.2 If a Required Action and associated Completion Time of Condition B, C, D, E, or F are not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and the RCS temperature reduced to < 350° F within 60 hours6.944444e-4 days 0.0167 hours 9.920635e-5 weeks 2.283e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

H.._

If two HPI trains are inoperable or two LPI-HPI flow paths are inoperable, the HPI System is incapable of performing its safety function and in a condition not explicitly addressed in the Actions for ITS 3.5.2. Thus, immediate plant shutdown in accordance with LCO 3.0.3 is required.

OCONEE UNITS 1, 2, & 3B352-1Rv02 B3.5.2-11 Rev. 002 I

HPI B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verifying the correct alignment for manual and non-automatic power operated valves in the HPI flow paths provides assurance that the proper flow paths will exist for HP[ operation. This SR does apply to the HPI suction header cross-connect valves, the HPI discharge cross-connect valves, the HPI discharge crossover valves, and the LPI-HPI flow path discharge valves (LP-15 and LP-16). This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. Similarly, this SR does not apply to automatic valves since automatic valves actuate to their required position upon an accident signal.

This Surveillance does not require any testing or valve manipulation; rather, it involves Verification that those valves capable of being mispositioned are in the correct position. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.2 With the exception of the HPI pump operating to provide normal makeup, the other two HPI pumps are normally in a standby, non-operating mode.

As such, the emergency injection flow path piping has the potential to develop voids and pockets of entrained gases. Venting the HPI pump casings periodically reduces the potential that such voids and pockets of entrained gases can adversely affect operation of the HPI System. This will also reduce the potential for water hammer, pump cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ESPS signal. This Surveillance is modified by a Note that indicates it is not applicable to operating HPI pump(s) providing normal makeup. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.3 Periodic surveillance testing of HPI pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code (Ref. 5). SRs are specified in the Inservice Testing Program of the ASME Code.

OCONEE UNITS 1, 2, & 3B35212Rv02 B 3.5.2-12 Rev. 002 I

HPI B 3.5.2 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.2.4 and SR 3.5.2.5 These SRs demonstrate that each automatic HPI valve actuates to the required position on an actual or simulated ESPS signal and that each HPI pump starts on receipt of an actual or simulated ESPS signal. This SR is not required for valves that are locked, sealed, or otherwise secured in position under administrative controls. The test will be considered satisfactory if control board indication verifies that all components have responded to the ESPS actuation signal properly (all appropriate ESPS actuated pump breakers have opened or closed and all ESPS actuated valves have completed their travel). The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program. The actuation logic is tested as part of the ESPS testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.6 Periodic inspections of the reactor building sump suction inlet (for LPI-HPI flow path) ensure that it is unrestricted and stays in proper operating condition. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.7 Periodic stroke testing of the HPI discharge crossover valves (HP-409 and HP-410) and LPI-HPI flow path discharge valves (LP-15 and LP-16) is required to ensure that the valves can be manually cycled from the Control Room. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

OCONEE UNITS 1, 2, &3 B3..-3Rv 0

B 3.5.2-13 Rev. 002 I

HPI B 3.5.2 BASES REFERENCES

1.

10 CFR 50.46.

2.

UFSAR, Section 15.14.3.3.6.

3.

10 CFR 50.36.

4.

NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended Interim Revisions to LOOs for ECCS Components," December 1, 1975.

5.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

6.

Letter from R. W. Reid (NRC) to W. 0. Parker, Jr. (Duke) transmitting Safety Evaluation for Oconee Nuclear Station, Units Nos. 1, 2, and 3, Modifications to the High Pressure Injection System, dated December 13, 1978.

7.

Letter from W. R. McCollum (Duke) to the U. S. NRC, "Proposed Amendment to the Facility Operating License Regarding the High Pressure Injection System Requirements," dated December 16, 1998.

OCONEE UNITS 1, 2, & 3B352-4Rv02 B 3.5.2-14 Rev. 002 I

ADV Flow Paths B 3.7.4 B 3.7 PLANT SYSTEMS B 3.7.4 Atmospheric Dump Valve (ADV) Flow Paths BASES BACKGROUND The ADV flow paths provide a method for cooling the unit to decay heat removal (DHR) entry conditions, should the preferred heat sink via the Turbine Bypass System to the condenser not be available, as discussed in the UFSAR (Ref. 2). This is done in conjunction with the secondary cooling water from the Emergency Feedwater (EFW) System.

The steam generator tube rupture (SGTR) analysis (Ref. 3) credits operator action to depressurize the steam generators by opening each of the ADV flow paths.

In addition, the ADV flow path for each steam generator is credited as a compensatory measure in Technical Specification (TS) 3.5.2, "High Pressure Injection (HPI)." In certain HPI configurations, the ADV flow path for one steam generator is credited to depressurize the steam generator and enhance primary-to-secondary heat transfer during certain small break loss of coolant accidents (LOCAs).

For each steam generator, the ADV flow path is comprised of the atmospheric dump block valve bypass (1" bypass), the atmospheric vent valve (a 12" block valve), the atmospheric dump control valve (i.e., throttle valve), and the atmospheric vent block valve (i.e., isolation valve). The throttle valve and the isolation valve are in parallel and are located downstream of the atmospheric vent valve.

The atmospheric vent valve should be opened prior to opening the throttle valve or isolation valve. This is accomplished by first opening the atmospheric dump block'valve bypass.

This equalizes the differential pressure across the atmospher'ic vent valve.

Once the atmospheric vent valve is opened, the cool down rate is controlled using the throttle valve. If additional relief capacity is needed, the isolation valve can be opened. The capacity of the throttle or isolation valve exceeds decay heat loads and is sufficient to cool down the plant.

OCONEE UNITS 1,2, &3 B3..-

Rv 0 B3.7.4-1 Rev. 001 I

ADV Flow Paths B 3.7.4 BASES (continued)

APPLICABLE The SGTR analysis credits operator action to depressurize the steam SAFETY ANALYSIS generators by opening both ADV flow paths (i.e., the ADV flow path for each steam generator) within 40 minutes of identifying the ruptured steam generator. Within this 40-minute time period, the operators are only required to open the bypass valve, the block valve, and the throttle valve.

However, later in the event, the analysis also assumes that the operators will open the isolation valves in each ADV flow path.

Operator action to depressurize a steam generator via its ADV flow path is credited in the analysis of certain small break LOCAs with THERMAL POWER _< 50% RTP and the plant operated with a degraded HPI System.

This event credits operator action to open one ADV flow path within 25 minutes of an Engineered Safeguards Protective System (ESPS) actuation.

If enhanced steam generator cooling is not credited in the small break LOCA analysis, two HPI trains are required to mitigate specific small break LOCAs. However, if equipment not qualified as QA-1 (i.e., an ADV flow path for a steam generator) is credited for enhanced steam generator cooling, the safety analyses have determined that the capacity of one HPI train is sufficient to mitigate a small break LOCA on the discharge of the reactor coolant pumps if THERMAL POWER is

50% RTP.

The analysis for degraded HPI credits an ADV flow path for one steam generator as a compensatory measure in the event an HPI train is inoperable and THERMAL POWER is <_ 50% RTP. During this situation, the ADV flow path for one steam generator is credited during certain small break LOCAs to depressurize the steam generator and enhance primary-to-secondary heat transfer. This is done in conjunction with the EFW System providing cooling water to the steam generator. The ADV flow path is comprised of manual valves. Operator action is credited for establishing the ADV flow path within 25 minutes of an ESPS signal.

Additionally, the ADV flow path for each steam generator is credited as a compensatory measure in TS 3.5.2, "High Pressure Injection (HPI)."

Typically, single failures are not considered once the plant has entered a condition defined in the TS. However, the Completion Time permitted when the HP! system is degraded, is an extended period of time. In the event an accident occurred during this extended Completion Time and a single failure were to occur in the degraded HPI system, the ability of a plant to mitigate the consequences of specific small break LOCAs continues to be assured by the ADV flow path for one steam generator.

The ADV flow paths satisfy Criterion 3 of 10 CER 50.36 (Ref. I).

The 50% partial-power SBLOCA analysis includes a sensitivity case that models an operator action to modulate the main steam pressure at 300 psig via the ADV during the secondary-side depressurization. The purpose of the ADV modulation to maintain steam pressure is to limit Reactor OCONEE UNITS 1, 2, & 3 B3742Rv 0

B 3.7.4-2 Rev. 001 I

ADV Flow Paths B 3.7.4 BASES APPLICABLE Coolant System (RCS) depressurization, which then prevents the CFTs SAFETY ANALYSIS from completely discharging their liquid contents and introducing nitrogen (continued) gas into the RCS during the depressurization. The secondary-side pressure control to preclude significant nitrogen injection is consistent with the generic Emergency Operating Procedure (EOP) guidance for B&W plants provided by ARE VA.

To ensure that the new SBLOCA analysis is bounding, the plant must be controlled to a main steam pressure that is less than the value assumed in the 50% partial-power SBLOCA analysis, since less borated water from the CFT would be injected at the higher analyzed value. This ensures that the 50% partial-power SBLOCA analysis remains conservative with respect to actual plant operation. The 50% partial-power SBLOCA analysis modeling the modulation of steam pressure at 300 psig allows operating space within the EOPs such that CFT isolation does not conflict with the applicable safety analysis in terms of isolating the borated water source from the CFTs.

A supplemental SBLOCA analysis demonstrates that long-term core cooling is assured with or without nitrogen gas intrusion for all break sizes.

The operator actions required by the ONS licensing basis remain unchanged. The analyses show that nitrogen gas intrusion does not occur for the small break sizes that rely on steam generator heat removal for a number of hours. In the longer term, core cooling is still assured if the CFTs completely discharge their liquid contents much later because at these longer times following the reactor trip, the lower decay heat levels can be matched by HPI cooling.

Based on the evaluation of impacts to long-term core cooling if ADV modulation does not occur, the operator action modeled in the partial-power SBLOCA analysis to maintain steam generator pressure at 300 psig is considered to be a desired action, and not a required action needed to demonstrate post-LOCA long-term core cooling.

LCO The ADV flow path for each steam generator is required to be OPERABLE.

The failure to meet the LCO can result in the inability to depressurize the steam generators following a SGTR.

The ADV flow path for each steam generator is required to be OPERABLE.

Failure to meet the LCO can result in the inability to depressurize a steam generator following a small break LOCA. This function is required to support operation with a degraded HPI System when THERMAL POWER is*<50% RTP.

An ADV flow path is considered OPERABLE when it is capable of providing a controlled relief of the main steam flow, and each valve which comprises the ADV flow path is capable of opening and closing.

OCONEE UNITS 1, 2, & 3 B3743Rv 0

B 3.7.4-3 Rev. 001 I

ADV Flow Paths B 3.7.4 BASES (continued)

APPLICABILITY The ADV flow path for each steam generator is required to be OPERABLE in MODES 1, 2, and 3, and in MODE 4, when a steam generator is being relied upon for heat removal. In MODE 4, steam generators are relied upon for heat removal whenever an RCS loop is required to be OPERABLE or operating to satisfy LCO 3.4.5, "RCS Loops - MODE 4" or available to transfer decay heat to satisfy LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled." The steam generators do not contain a significant amount of energy in MODE 4 when the unit is not relying upon a steam generator for heat transfer, and MODES 5 and 6; therefore, the ADV flow paths are not required to be OPERABLE in these MODES and condition.

With the ADV flow paths required to be OPERABLE at all times that the steam generators are being relied upon for heat removal, it is assured that the ADV flow paths will be available for use for mitigation of a SBLOCA and a SGTR. These are the only two conditions in which the use of the ADV flow paths is credited in the analyses of any accident.

ACTIONS A.1 and A.2 With one or both of the ADV flow path(s) inoperable, the Unit must be placed in a condition in which the LCO does not apply. To achieve this status, the Unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and at least MODE 4 without reliance on a steam generator for heat removal within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The Completion Times are reasonable, based on operating experience, to reach the required Unit conditions from full power conditions in an orderly manner and without challenging Unit systems.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS To perform a controlled cool down of the RCS, the valves that comprise the ADV flow path for each steam generator must be able to perform the following functions:

a) the atmospheric dump block valve bypass and the atmospheric vent valve must be capable of being opened and closed; and b) the atmospheric dump control valve and atmospheric vent block valve must be capable of being opened and throttled through their full range.

OCONEE UNITS 1,2, & 3 B3744Rv 0

B3.7.4-4 Rev. 001 I

ADV Flow Paths B 3.7.4 BASES SURVEILLANCE REQUIREMENTS (continued)

This SR ensures that the valves that comprise the ADV flow path for each steam generator are cycled through the full control range. Performance of inservice testing or use of an ADV flow path during a unit cool down satisfies this requirement. This surveillance does not require the valves to be tested at pressure. The Surveillance Frequency is based on operating experience, equipment reliability, and plant risk and is controlled under the Surveillance Frequency Control Program.

REFERENCES

1.

10 CFR 50.36.

2.

UFSAR, Section 10.3.

3.

UFSAR, Section 15.9.

4.

UFSAR, Section 15.12

5.

UFSAR, Section 15.14 OCONEE UNITS 1, 2, & 3 B3745Rv 0

B 3.7.4-5 Rev. 001