Text

Proposed Tech Specs Establishing Operating Requirements for Recirculation Mode Transfer (Rmt) Function,Including LCO Action Statements & SR for Rmt & Deleting RWST Max Vol Requirements
	ML18151A714
Person / Time
Site:	Surry
Issue date:	08/07/1992
From:	; VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:	;
Shared Package
ML18151A715	List: ML18151A714; ML18153D087;
References
	NUDOCS 9208120261
	Download: ML18151A714 (63)
	v • d • e

ATTACHMENT 1 SURRY POWER STATION PROPOSED TECHNICAL SPECIFICATION CHANGES RECIRCULATION MODE TRANSFER FUNCTION

,,------~9208120261~20807 PDR ADOCK 05000280

\

i p PDR

TS 1.0-1 1.0 DEFINITIONS The following frequently used terms are defined for the uniform interpretation of the specifications.

A. RATED POWER A steady state reactor core heat output of 2441 MWt.

B. THERMAL POWER The total core heat transferred from the fuel to the coolant.

C. REACTOR OPERATION

1. REFUELING SHUTDOWN When the reactor is subcritical by at least 5% ~k/k and T avg is

140°F and fuel is scheduled to be moved to or from the reactor core.

2. COLD SHUTDOWN When the reactor is subcritical by at least 1% ~k/k and T avg is

200°F.

3. INTERMEDIATE SHUTDOWN When the reactor is subcritical by at least 1. 77% ~k/k and 200°F

< T avg < 547°F.

4. HOT SHUTDOWN When the reactor is subcritical by at least 1.77% ~k/k and T avg is

~ 547°F .

Amendment Nos.

TS 1.0-2

5. REACTOR CRITICAL When the neutron chain reaction is self-sustaining and keff = 1.0.

6. POWER OPERATION When the reactor is critical and the neutron flux power range instrumentation indicates greater than 2% of rated power.

7. REFUELING OPERATION Any operation involving movement of core components when the vessel head is unbolted or removed.

D. OPERABLE A system, subsystem, train, component, or device shall be operable or have operability when it is capable of performing its specified function(s).

Implicit in this definition shall be the assumption that all necessary attendant instrumentation, controls, normal and emergency electrical power sources, cooling or seal water, lubrication or other auxiliary equipment that are required for the system, subsystem, train, component or device to perform its function(s) are also capable of performing their related support function(s). The system or component shall be considered to have this capability when: (1) it satisfies the limiting conditions for operation defined in Section 3, and (2) it has been tested periodically in accordance with Section 4 and meets its performance requirements.

E. PROTECTIVE INSTRUMENTATION LOGIC

1. ANALOG CHANNEL An arrangement of components and modules as required to generate a single protective action digital signal when required by a unit condition. An analog channel loses its identity when single action signals are combined .

Amendment Nos.

TS 1.0-3

2. AUTOMATIC ACTUATION LOGIC A group of matrixed relay contacts which operate in response to the digital output signals from the analog channels to generate a protective action signal.

F. INSTRUMENTATION SURVEILLANCE

1. CHANNEL CHECK The qualitative assessment of channel behavior during operation by observation. This determination shall include, where possible, comparison of the channel indication and/or status with other indications and/or status derived from independent instrumentation on channels measuring the same parameter.

2. CHANNEL FUNCTIONAL TEST Injection of a simulated signal into an analog channel as close to

the sensor as practicable or makeup of the logic combinations in a logic channel to verify that it is operable, including alarm and/or trip initiating action.

3. CHANNEL CALIBRATION Adjustment of channel output such that it responds, with acceptable range and accuracy, to known values of the parameter which the channel measures. Calibration shall encompass the entire channel, including equipment action, alarm, or trip, and shall be deemed to include the CHANNEL FUNCTIONAL TEST.

G. CONTAINMENT INTEGRITY Containment integrity shall exist when:

a. The penetrations required to be closed during accident conditions are either:

1) Capable of being closed by an OPERABLE containment automatic isolation valve system, or Amendment Nos.

TS 1.0-4

2) Closed by at least one closed manual valve, blind flange, or deactivated automatic valve secured in its closed position except as provided in Specification 3.8.C. Non-automatic or deactivated automatic containment isolation valves may be opened intermittently for operational activities provided that the valves are under administrative control and are capable of being closed immediately, if required.

b. The equipment access hatch is closed and sealed.

c. Each airlock is OPERABLE except as provided in Specification 3.8.B.

d. The containment leakage rates are within the limits of Specification 4.4.

e. The sealing mechanism associated with each penetration (e.g.,

welds, bellows, or 0-rings) is OPERABLE.

H. REPORTABLE EVENT A reportable event shall be any of those conditions specified in Section

50. 73 of 10 CFR Part 50.

I. QUADRANT POWER TILT The quadrant power tilt is defined as the ratio of the maximum upper excore detector current to the average of the upper excore detector currents or the ratio of the maximum lower excore detector current to the average of the lower excore detector currents whichever is greater. If one excore detector is out of service, the three in-service units are used in computing the average.

J. LOW POWER PHYSICS TESTS Low power physics tests conducted below 5% of rated power which measure fundamental characteristics of the core and related

instrumentation.

Amendment Nos.

TS 1.0-5 V '

K. EIRE SUPPRESSION WATER SYSTEM

A fire suppression water system shall consist of: a water source(s),

gravity tank(s) or pump(s), and distribution piping with associated sectionalizing control or isolation valves. Such valves shall include yard hydrant curb valves, and the first valve ahead of the water flow alarm device on each sprinkler, hose standpipe, or spray system riser.

L. OFFSITE DOSE CALCULATION MANUAL (ODCM)

The Offsite Dose Calculation Manual (ODCM) shall contain the methodology and parameters used in the calculation of offsite doses resulting from radioactive gaseous and liquid effluents, in the calculation of gaseous and liquid effluent monitoring Alarm/Trip Setpoints, and in the conduct of the Radiological Environmental Monitoring Program. The ODCM shall also contain (1) the Radioactive Effluent Controls and "Radiological Environmental Monitoring Programs required by Section 6.4 and (2) descriptions of the information that should be included in the Annual Radiological Environmental Operating and Semi-annual Radioactive Effluent Release Reports required by Specifications 6.6.B.2 and 6.6.B.3.

M. DOSE EQUIVALENT 1-131 The dose equivalent 1-131 shall be that concentration of 1-131 (microcurie/gram) which alone would produce the same thyroid dose as the quantity and isotopic mixture of 1-131, 1-132, 1-133, 1-134, and 1-135 actually present. The thyroid dose conversion factors used for this calculation shall be those listed in Table Ill of TID-14844, "Calculation of Distance Factors for Power and Test Reactor Sites" or in NRC Regulatory Guide 1.109, Revision 1, October 1977.

N. GASEOUS RADWASTE TREATMENT SYSTEM A gaseous radwaste treatment system is any system designed and installed to reduce radioactive gaseous effluents by collecting primary coolant system offgases from the primary system and providing for delay

or holdup for the purpose of reducing the total radioactivity prior to release to the environment.

Amendment Nos.

TS 1.0-6

o. PROCESS CONTROL PROGRAM (PCP)

The process control program shall contain the current formula, sampling, analyses, tests, and determinations to be made to ensure that the processing and packaging of solid radioactive wastes based on demonstrated processing of actual or simulated wet solid wastes will be accomplished in such a way as to assure compliance with 10 CFR Parts 20, 61, and 71, State regulations, and other requirements governing the disposal of the waste.

P. PURGE - PURGING Purge or purging is the controlled process of discharging air or gas from a confinement to maintain temperature, pressure, humidity, concentration, or other operating condition, in such a manner that replacement air or gas is required to purify the confinement.

Q. VENTILATION EXHAUST TREATMENT SYSTEM A ventilation exhaust treatment system is any system designed and installed to reduce gaseous radioiodine or radioactive material in particulate form in effluents. Treatment includes passing ventilation or vent exhaust gases through charcoal adsorbers and/or HEPA filters for the purpose of removing iodines or particulates from the gaseous exhaust stream prior to the release to the environment (such a system is not considered to have any effect on noble gas effluents). Engineered Safety Feature (ESF) atmospheric cleanup systems are not considered to be ventilation exhaust treatment system components.

R. VENTING Venting is the controlled process of discharging air or gas from a confinement to maintain temperature, pressure, humidity, concentration or other operating condition, in such a manner that replacement air or gas is not provided or required during venting. Vent, used in system

names, does not imply a venting process.

Amendment Nos.

TS 1.0-7

s. SITE BOUNDARY The site boundary shall be that line beyond which the land is not owned, leased, or otherwise controlled by the licensee.

T. UNRESTRICTED AREA An unrestricted area shall be any area at or beyond the site boundary where access is not controlled by the licensee for purpose of protection of individuals from exposure to radiation and radioactive materials or any area within the site boundary used for residential quarters or for industrial, commercial, institutional, or recreational purposes.

u. MEMBER(S) OF THE PUBLIC Member(s) of the public shall include all individuals who by virtue of their occupational status have no formal association with the plant. This category shall include non-employees of the licensee who are permitted to use portions of the site for recreational, occupational, or other purposes not associated with plant functions. This category shall not include non-employees such as vending machine servicemen or postmen who, as part of their formal job function, occasionally enter an area that is controlled by the licensee for purposes of protection of individuals from exposure to radiation and radioactive materials .

Amendment Nos.

TS 3.3-1 3.3 SAFETY INJECTION SYSTEM Applicability Applies to the operating status of the Safety Injection System.

Objective To define those limiting conditions for operation that are necessary to provide sufficient borated water to remove decay heat from the core in emergency situations.

Specifications A. A reactor shall not be made critical unless the following conditions are met:

1. The refueling water storage tank contains at least 387,100 gallons of borated water at a maximum temperature of 45°F. The boron concentration shall be at least 2300 ppm but not greater than 2500 ppm.

2. Each accumulator system is pressurized to at least 600 psia and contains a minimum of 975 ft3 and a maximum of 1025 ft3 of borated water with a boron concentration of at least 2250 ppm.

3. Two channels of heat tracing shall be OPERABLE for the* flow paths.

4. Two charging pumps are OPERABLE.

5. Two low head safety injection pumps are OPERABLE.

6. All valves, piping, and interlocks associated with the above components which are required to operate under accident conditions are OPERABLE.

Amendment Nos.

TS 3.3-2

7. The Charging Pump Cooling Water Subsystem shall be operating as follows:

a. Make-up water from the Component Cooling Water Subsystem shall be available.

b. Two charging pump component cooling water pumps and two charging pump service water pumps shall be OPERABLE.

C. Two charging pump intermediate seal coolers shall be OPERABLE.

8. During POWER OPERATION, the AC power shall be removed from the following motor-operated valves with the valves in the open position:

9.

Unit No. 1 MOV 1890C Unit No. 2 MOV 2890C During POWER OPERATION, the AC power shall be removed from the following motor-operated valves with the valves in the closed position:

Unit No. 1 Unit No. 2 MOV 1869A MOV 2869A MOV 18698 MOV 28698 MOV 1890A MOV 2890A MOV 18908 MOV 28908

10. The accumulator discharge valves listed below shall be blocked open by de-energizing the valves motor operators when the reactor coolant system pressure is greater than 1000 psig.

Amendment Nos.

TS 3.3-3 Unit No. 1 Unit No. 2 MOV 1865A MOV 2865A MOV 18658 MOV 28658 MOV 1865C MOV 2865C

11. POWER OPERATION with less than three loops in service is prohibited. The following loop isolation valves shall have AC power removed and be locked in open position during POWER OPERATION.

Unit No. 1 Unit No, 2 MOV 1590 MOV 2590 MOV 1591 MOV 2591 MOV 1592 MOV 2592 MOV 1593 MOV 2593 MOV 1594 MOV 2594 MOV 1595 MOV 2595

12. The total system uncollected leakage from valves, flanges, and pumps located outside containment shall not exceed the limit specified by Technical Specification 4.11.A.4.d.

B. The requirements of Specification 3.3.A may be modified to allow one of the following components to be inoperable at any one time. If the system is not restored to meet the requirements of Specification 3.3.A within the time period specified, the reactor shall be placed in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If the requirements of Specification 3.3.A are not satisfied within an additional 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months the reactor shall be placed in COLD SHUTDOWN within the next 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

1. One accumulator may be isolated for a period not to exceed 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

2. Two charging pumps per unit may be inoperable, provided immediate attention is directed to making repairs and one of the

inoperable pumps is restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Amendment Nos.

TS 3.3-4

3. One low head safety injection subsystem per unit may be inoperable provided immediate attention is directed to making repairs and the subsystem is restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4. One channel of heat tracing may be inoperable for a period not to exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , provided immediate attention is directed to making repairs.

5. One charging pump component cooling water pump or one charging pump service water pump may be inoperable provided the pump is restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

6. One charging pump intermediate seal cooler or other passive component may be inoperable provided the system may still operate at 100 percent capacity and repairs are completed within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

7. Power may be restored to any valve referenced in Specifications 3.3.A.8 and 3.3.A.9 for the purpose of valve testing or maintenance, provided that no more than one valve has power restored and the testing and maintenance is completed and power removed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

8. Power may be restored to any valve referenced in Specification 3.3.A.1 O for the purpose of valve testing or maintenance, provided that no more than one valve has power restored and the testing and maintenance is completed and power removed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

9. The total uncollected system leakage for valves, flanges, and pumps located outside containment can exceed the limit stated in Specification 4.11.A.4.d provided immediate attention is directed to making repairs and uncollected system leakage is returned to within limits within 7 days.

Amendment Nos.

TS 3.3-5

10. Refueling water storage tank volume, temperature, and boron concentration may be outside the limits of Specification 3.3.A.1 provided they are restored to within their respective limits within one hour.

The normal procedure for starting the reactor is, first, to heat the reactor coolant to near operating temperature by running the reactor coolant pumps. The reactor is then made critical by withdrawing control rods and/or diluting boron in the coolant. With this mode of startup the Safety Injection System is required to be OPERABLE as specified. During LOW POWER PHYSICS TESTS there is a negligible amount of energy stored in the system. Therefore, an accident comparable in severity to the Design Basis Accident is not possible, and the full capacity of the Safety Injection System would .not be necessary.

The OPERABLE status of the various systems and components is to be demonstrated by periodic tests, detailed in TS Section 4.11. A large fraction of these tests are performed while the reactor is operating in the power range. If a component is found to be inoperable, it will be possible in most cases to effect repairs and restore the system to full operability within a relatively short time. A single component being inoperable does not negate the ability of the system to perform its function, but it reduces the redundancy provided in the reactor design and thereby limits the ability to tolerate additional equipment failures. In some cases, additional components (i.e., charging pumps) are installed to allow a component to be inoperable without affecting system redundancy.

If the inoperable component is not repaired within the specified allowable time period, or a second component in the same or related system is found to be inoperable, the reactor will initially be placed in HOT SHUTDOWN to provide for reduction of the decay heat from the fuel, and consequent reduction of cooling requirements after a postulated loss-of-coolant accident. After 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months in HOT SHUTDOWN, if the malfunction(s) is not corrected the reactor will be placed in COLD SHUTDOWN following normal shutdown and cooldown procedures.

Amendment Nos.

TS 3.3-6

The Specification requires prompt action to effect repairs of an inoperable component or subsystem. Therefore, in most cases, repairs will be compieted in less than the specified allowable repair times. Furthermore, the specified repair times do not apply to regularly scheduled maintenance of the Safety Injection System, which is normally to be performed during refueling shutdowns. The limiting times for repair are based on: estimates of the time required to diagnose and correct various postulated malfunctions using safe and proper procedures, the availability of tools, materials and equipment, health physics requirements, and the extent to which other systems provide functional redundancy to the system under repair.

Assuming the reactor has been operating at full RATED POWER for at least 100 days, the magnitude of the decay heat production decreases as follows after a unit trip from full RATED POWER.

Time After Shutdown Decay Heat,% of RATED POWER 1 min. 3.7 30 min. 1.6 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1.3 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 0.75 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months 0.48 Thus, the requirement for core cooling in case of a postulated loss-of-coolant accident, while in HOT SHUTDOWN, is reduced by orders of magnitude below the requirements for handling a postulated loss-of-coolant accident occurring during POWER OPERATION. Placing and maintaining the reactor in HOT SHUTDOWN significantly reduces the potential consequences of a loss-of-coolant accident, allows access to some of the Safety Injection System components in order to effect repairs, and minimizes the plant's exposure to thermal cycling.

Failure to complete repairs within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months of going to HOT SHUTDOWN is considered indicative of unforeseen problems (i.e., possibly the need of major maintenance). In such a case, the reactor is placed in COLD SHUTDOWN.

Amendment Nos.

TS 3.3-7 The accumulators are able to accept leakage from the Reactor Coolant System without any effect on their operability. Allowable inleakage is based on the volume of water than can be added to the initial amount without exceeding the volume given in Specification 3.3.A.2. The maximum acceptable inleakage is 50 cubic feet per tank.

The accumulators (one for each loop) discharge into the cold leg of the reactor coolant piping when Reactor Coolant System pressure decreases below accumulator pressure, thus assuring rapid core cooling for large breaks. The line from each accumulator is provided with a motor-operated valve to isolate the accumulator during reactor start-up and shutdown to preclude the discharge of the contents of the accumulator when not required.

These valves receive a signal to open when safety injection is initiated.

However, to assure that the accumulator valves satisfy the single failure criterion, they will be blocked open by de-energizing the valve motor operators when the reactor coolant pressure exceeds 1000 psig. The operating pressure of the Reactor Coolant System is 2235 psig and accumulator injection is initiated when this pressure drops to 600 psia. De-energizing the motor operator when the pressure exceeds 1000 psig allows sufficient time during normal startup operation to perform the actions required to de-energize the valve. This procedure will assure that there is an OPERABLE flow path from each accumulator to the Reactor Coolant System during POWER OPERATION and that safety injection can be accomplished.

The removal of power from the valves listed in the specification will assure that the systems of which they are a part satisfy the single failure criterion.

Total system uncollected leakage is controlled to limit offsite doses resulting from system leakage after a loss-of-coolant accident.

TS 3.4-1 I 3.4 SPRAY SYSTEMS Applicability Applies to the operational status of the Spray Systems.

Objective To define those limiting conditions for operation of the Spray Systems I necessary to assure safe unit operation.

Specification A. A unit's Reactor Coolant System temperature or pressure shall not be made to exceed 350°F or 450 psig, respectively, unless the following Spray System conditions in the unit are met:

1. Two Containment Spray Subsystems, including containment spray pumps, piping, and valves shall be OPERABLE.

2. Four Recirculation Spray Subsystems, including recirculation spray pumps, coolers, piping, and valves shall be OPERABLE.

3. The refueling water storage tank shall contain at least 387, 100 gallons of borated water at a maximum temperature of 45°F.

The boron concentration shall be at least 2300 ppm but not greater than 2500 ppm.

4. The refueling water chemical addition tank shall contain at least 4,200 gallons of solution with a sodium hydroxide concentration of at least 17 percent by weight but not greater than 18 percent by weight.

5. All valves, piping, and interlocks associated with the above components which are required to operate under accident conditions shall be OPERABLE.

Amendment Nos.

TS 3.4-2

6. The total uncollected system leakage from valves, flanges, and pumps located outside containment shall not exceed the limit specified by Specification 4.5.B.4.

8. During POWER OPERATION the requirements of Specification 3.4.A may be modified to allow a subsystem or the following components to be inoperable. If the components are not restored to meet the requirements of Specification 3.4.A within the time period specified below, the reactor shall be placed in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . If the requirements of Specification 3.4.A are not satisfied within an additional 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months the reactor shall be placed in COLD SHUTDOWN within the next 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

1. One Containment Spray Subsystem may be inoperable, provided immediate attention is directed to making repairs and the subsystem can be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. One outside Recirculation Spray Subsystem may be inoperable, provided immediate attention is directed to making repairs and the subsystem can be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. One inside Recirculation Spray Subsystem may be inoperable, provided immediate attention is directed to making repairs and the subsystem can be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

4. The total uncollected system leakage from valves, flanges, and pumps located outside containment can exceed the limit stated in Specification 4.5.8.4, provided immediate attention is directed to making repairs and uncollected system leakage is returned to within limits within 7 days.

5. Refueling Water Storage Tank volume, temperature, and boron concentration may be outside the limits of Specification 3.4.A.3 provided they are restored to within their respective limits within one hour.

Amendment Nos.

TS 3.4-3

The spray systems in each reactor unit consist of two separate parallel Containment Spray Subsystems, each of 100 percent capacity, and four separate parallel Recirculation Spray Subsystems, each of 50 percent capacity.

Each Containment Spray Subsystem draws water independently from the refueling water storage tank (RWST). The water in the tank is cooled to 45°F or below by circulating the water through one of the two RWST coolers with one of the two recirculating pumps. The water temperature is maintained by two mechanical refrigerating units as required. In each Containment Spray Subsytem, the water flows from the tank through an electric motor driven containment spray pump and is sprayed into the containment atmosphere through two separate sets of spray nozzles. The capacity of the spray systems 1 to depressurize the containment in the event of a Design Basis Accident is a function of the pressure and temperature of the containment atmosphere, the service water temperature, and the temperature in the refueling water storage tank as discussed in the Basis of Specification 3.8.

Each Recirculation Spray Subsystem draws water from the common containment sump. In each subsystem the water flows through a recirculation spray pump and recirculation spray cooler, and is sprayed into the containment atmosphere through a separate set of spray nozzles. Two of the recirculation spray pumps are located inside the containment and two outside the containment in the containment auxiliary structure.

With one Containment Spray Subsystem and two Recirculation Spray Subsystems operating together, the spray systems are capable of cooling and depressurizing the containment to subatmospheric pressure in less than 60 minutes following the Design Basis Accident. The Recirculation Spray Subsystems are capable of maintaining subatmospheric pressure in the containment indefinitely following the Design Basis Accident when used in conjunction with the Containment Vacuum System to remove any long term air in leakage .

Amendment Nos.

TS 3.4-4 In addition to supplying water to the Containment Spray System, the refueling water storage tank is also a source of water for safety injection following an accident. This water is borated to a concentration which assures reactor shutdown by approximately 5 percent ~k/k when all control rod assemblies are inserted and when the reactor is cooled down for refueling.

Total system uncollected leakage is controlled to limit offsite doses resulting from system leakage after a loss-of-coolant accident.

References UFSAR Section 4 Reactor Coolant System UFSAR Section 6.3.1 Containment Spray Subsystem UFSAR Section 6.3.1 Recirculation Spray Pumps and Coolers UFSAR Section 6.3.1 Refueling Water Chemical Addition Tank UFSAR Section 6.3.1 Refueling Water Storage Tank UFSAR Section 14.5.2 Design Basis Accident UFSAR Section 14.5.5 Containment Transient Analysis Amendment Nos.

TS 3.7-1

3.7 INSTRUMENTATION SYSTEMS Operational Safety Instrumentation Applicability Applies to reactor and safety features instrumentation systems.

Objectives To ensure the automatic initiation of the Reactor Protection System and the Engineered Safety Features in the event that a principal process variable limit is exceeded, and to define the limiting conditions for operation of the plant instrumentation and safety circuits necessary to ensure reactor and plant safety.

Specification A. During on-line testing or in the event of a subsystem instrumentation channel failure, plant operation at RATED POWER shall be permitted to

B.

continue in accordance with Tables 3.7-1 through 3.7-3.

The Reactor Protection System instrumentation channels and interlocks shall be OPERABLE as specified in Table 3.7-1.

C. The Engineered Safeguards Actions and Isolation Function Instrumentation channels and interlocks shall be OPERABLE as specified in Tables 3.7-2 and 3.7-3, respectively.

D. The Engineered Safety Features initiation instrumentation setting limits shall be as stated in Table 3.7-4.

E. The explosive gas monitoring instrumentation channel shown in Table 3.7-5(a) shall be OPERABLE with its alarm setpoint set to ensure that the limits of Specification 3.11.A.1 are not exceeded.

1. With an explosive gas monitoring instrumentation channel alarm setpoint less conservative than required by the above specification, declare the channel inoperable and take the action shown in Table 3.7-5(a).

Amendment Nos.

TS 3.7-2

2. With less than the minimum number of explosive gas monitoring instrumentation channels OPERABLE, take the action shown in Table 3.7-5(a). Exert best efforts to return the instruments to operable status within 30 days and, if unsuccessful, prepare and submit a Special Report to the Commission (Region 11) to explain why this inoperability was not corrected in a timely manner.

3. The provisions of Specification 3.0.1 are not applicable. II F. The accident monitoring instrumentation listed in Table 3.7-6 shall be OPERABLE in accordance with the following:

1. With the number of OPERABLE accident monitoring instrumentation channels less than the Total Number of Channels shown in Table 3.7-6, items 1 through 9, either restore the inoperable channel(s) to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

2. With the number of OPERABLE accident monitoring instrumentation channels less than the Minimum OPERABLE Channels requirement of Table 3. 7-6, items 1 through 9, either restore the inoperable channel(s) to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

3. The provisions of Specification 3.0.3 are not applicable. II G. The containment hydrogen analyzers and associated support equipment shall be OPERABLE in accordance with the following:

1. Two independent containment hydrogen analyzers shall be OPERABLE during REACTOR CRITICAL or POWER OPERATION.

a. With one hydrogen analyzer inoperable, restore the inoperable analyzer to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Amendment Nos.

TS 3.7-3

b. With both hydrogen analyzers inoperable, restore at least one analyzer to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

NOTE: Operability of the hydrogen analyzers includes proper operation of the respective Heat Tracing System.

C. The provisions of Specification 3.0.3 are not applicable. II Instrument Operating Conditions During plant operations, the complete instrumentation system will normally be in service. Reactor safety is provided by the Reactor Protection System, which automatically initiates appropriate action to prevent exceeding established limits. Safety is not compromised, however, by continuing operation with certain instrumentation channels out of service since provisions were made for

this in the plant design. This specification outlines the limiting conditions for operation necessary to preserve the effectiveness of the Reactor Protection System when any one or more of the channels is out of service.

Almost all Reactor Protection System channels are supplied with sufficient redundancy to provide the capability for channel calibration and test at power.

Exceptions are backup channels such as reactor coolant pump breakers. The removal of one trip channel on process control equipment is accomplished by placing that channel bistable in a tripped mode (e.g., a two-out-of-three circuit becomes a one-out-of-two circuit). The Nuclear Instrumentation System (NIS) channels are not intentionally placed in a tripped mode since the test signal is superimposed on the normal detector signal to test at power. Testing of the NIS power range channel requires: (a) bypassing the dropped-rod protection from NIS, for the channel being tested, (b) placing the ~TIT avg protection channel set that is being fed from the NIS channel in the trip mode, and (c) defeating the power mismatch section of T avg control channels when the appropriate NIS channel is being tested. However, the Rod Position System and remaining NIS channels still provide the dropped-rod protection. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Amendment Nos.

TS 3.7-4

- Instrumentation has been provided to sense accident conditions and to initiate operation of the Engineered Safety Features.(1)

Safety Injection System Actuation Protection against a loss-of-coolant or steam line break accident is provided by automatic actuation of the Safety Injection System (SIS) which provides emergency cooling and reduction of reactivity.

The loss-of-coolant accident is characterized by depressurization of the Reactor Coolant. System and rapid loss of reactor coolant to the containment. The engineered safeguards instrumentation has been designed to sense these effects of the loss-of-coolant accident by detecting low pressurizer pressure to generator signals actuating the SIS active phase. The SIS active phase is also actuated by a high containment pressure signal brought about by loss of high enthalpy coolant to the containment. This actuation signal acts as a backup to the low pressurizer pressure actuation of the SIS and also adds diversity to protection against loss of coolant.

Signals are also provided to actuate the SIS upon sensing the effects of a steam line break accident. Therefore, SIS actuation following a steam line break is designed to occur upon sensing high differential steam pressure between the steam header and steam generator line or upon sensing high steam line flow in coincidence with low reactor coolant average temperature or low steam line pressure.

The increase in the extraction of RCS heat following a steam line break results in reactor coolant temperature and pressure reduction. For this reason, protection against a steam line break accident is also provided by low pressurizer pressure actuating safety injection.

Protection is also provided for a steam line break in the containment by actuation of SIS upon sensing high containment pressure.

Amendment Nos.

TS 3.7-5

SIS actuation injects highly borated fluid into the Reactor Coolant System in order to counter the reactivity insertion brought about by cooldown of the reactor coolant which occurs during a steam line break accident.

Containment Spray The Engineered Safety Features also initiate containment spray upon sensing a high-high containment pressure signal. The containment spray acts to reduce containment pressure in the event of a loss-of-coolant or steam line break accident inside the containment. The containment spray cools the containment directly and limits the release of fission products by absorbing iodine should it be released to the containment.

Containment spray is designed to be actuated at a higher containment pressure than the SIS. Since spurious actuation of containment spray is to be avoided, it is initiated only on coincidence of high-high containment pressure sensed by 3 out of the 4 containment pressure signals.

Steam Line Isolation Steam line isolation signals are initiated by the Engineered Safety Features closing the steam line trip valves. In the event of a steam line break, this action prevents continuous, uncontrolled steam release from more than one steam generator by isolating the steam lines on high-high containment pressure or high steam line flow with coincident low steam line pressure or low reactor coolant average temperature. Protection is afforded for breaks inside or outside the containment even when it is assumed that there is a single failure in the steam line isolation system.

Feedwater Line Isolation The feedwater lines are isolated upon actuation of the SIS in order to prevent excessive cooldown of the Reactor Coolant System. This mitigates the effects of an accident such as a steam line break which in itself causes excessive coolant temperature cooldown. Feedwater line isolation also Amendment Nos.

TS 3.7-6 reduces the consequences of a steam line break inside the containment by stopping the entry of feedwater.

Auxiliary Feedwater System Actuation The automatic initiation of auxiliary feedwater flow to the steam generators by instruments identified in Table 3.7-2 ensures that the Reactor Coolant System decay heat can be removed following loss of main feedwater flow. This is consistent with the requirements of the "TMl-2 Lessons Learned Task Force Status Report," NUREG-0578, item 2.1.7.b.

Setting Limits

1. The high containment pressure limit is set at about 10% of design containment pressure. Initiation of safety injection protects against loss of coolant(2) or steam line break(3) accidents as discussed in the safety analysis.

2. The high-high containment pressure limit is set at about 23% of design containment pressure. Initiation of containment spray and steam line isolation protects against large loss-of-coolant(2) or steam line break accidents(3) as discussed in the safety analysis.

3. The pressurizer low pressure setpoint for safety injection actuation is set substantially below system operating pressure limits. However, it is sufficiently high to protect against a loss-of-coolant accident as shown in the safety analysis. (2)

4. The steam line high differential pressure limit is set well below the differential pressure expected in the event of a large steam line break accident as shown in the safety analysis. (3)

5. The high steam line flow differential pressure setpoint is constant at 40%

full flow between no load and 20% load and increasing linearly to 110%

of full flow at full load in order to protect against large steam line break accidents. The coincident low Tavg setting limit for SIS and steam line isolation initiation is set below its HOT SHUTDOWN value. The coincident Amendment Nos.

TS 3.7-7 steam line pressure setting limit is set below the full load operating pressure. The safety analysis shows that these settings provide protection in the event of a large steam line break. (3)

Accident Monitoring Instrumentation The operability of the accident monitoring instrumentation in Table 3. 7-6 ensures that sufficient information is available on selected plant parameters to monitor and assess these variables during and following an accident. On the pressurizer PORVs, the pertinent channels consist of redundant limit switch indication. The pressurizer safety valves utilize an acoustic monitor channel and a downstream high temperature indication channel. This capability is consistent with the recommendations of Regulatory Guide 1.97, "Instrumentation for Light Water Cooled Nuclear Power Plants to Assess Plant Conditions During and Following an Accident," December 1975, and NUREG-0578, "TMl-2 Lessons Learned Task Force Status Report and Short Term Recommendations." Potential accident effluent release paths are equipped with radiation monitors to detect and measure concentrations of noble gas fission products in plant gaseous effluents during and following an accident.

The effluent release paths monitored are the process vent stack, ventilation vent stack, main steam safety valve and atmospheric dump valve discharge and the AFW pump turbine exhaust. These monitors meet the requirements of NUREG 0737.

Instrumentation is provided for monitoring (and controlling) the concentrations of potentially explosive gas mixtures in the Waste Gas Holdup System. The operability and use of this instrumentation is consistent with the requirements of General Design Criteria 60, 63 and 64 of Appendix A to 10 CFR Part 50.

Containment Hydrogen Analyzers Indication of hydrogen concentration in the containment atmosphere is provided in the control room over the range of zero to ten percent hydrogen concentration.

Amendment Nos.

TS 3.7-8 These redundant, qualified hydrogen analyzers are shared by Units 1 and 2 with instrumentation to indicate and record the hydrogen concentration.

A transfer switch is provided for Unit 1 to use both analyzers or for Unit 2 to use both analyzers. In addition, each unit's hydrogen analyzer has a transferable emergency power supply from Unit 1 and Unit 2. This will ensure redundancy for each unit.

Indication of Unit 1 and Unit 2 hydrogen concentration is provided on the Unit 1 Post Accident Monitoring panel and the Unit 2 Post Accident Monitoring panel, respectively. Hydrogen concentration is also recorded on qualified recorders.

In addition, each hydrogen analyzer is provided with an alarm for trouble/high hydrogen content. These alarms are located in the control room.

The supply lines installed from the containment penetrations to the hydrogen analyzers have Category I Class IE heat tracing applied. The heat tracing system receives the same transferable emergency power as is provided to the containment hydrogen analyzers. The heat trace system is de-energized during normal system operation. Upon receipt of a SIS, after a preset time delay, heat tracing is energized to bring the piping process temperature to 250 +/- 10°F within 20 minutes. Each heat trace circuit is equipped with an RTD to provide individual circuit readout, over-temperature alarm, and control the circuit to maintain the process temperatures.

The hydrogen analyzer heat trace system is equipped with high temperature, loss of D.C. power, loss of A.C. power, loss of control power, and failure of automatic initiation alarms.

Non-Essential Service Water Isolation System The operability of this functional system ensures that adequate intake canal inventory can be maintained by the Emergency Service Water Pumps.

Adequate intake canal inventory provides design service water flow to the recirculation spray heat exchangers and other essential loads (e.g., control room area chillers, charging pump lube oil coolers) following a design basis loss of coolant accident with a coincident loss of offsite power. This system is common to both units in that each of the two trains will actuate equipment on

each unit.

Amendment Nos.

TS 3.7-9 References (1) UFSAR - Section 7.5 (2) UFSAR - Section 14.5 (3) UFSAR - Section 14.3.2 Amendment Nos.

TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Permissible functional Unit or Channels Channels To Trip Bypass Conditions Operator Action

1. Manual 2 2 1 1

2. Nuclear Flux Power Range 4 3 2 Low trip setting at P-10 2

3. Nuclear Flux Intermediate Range 2 2 1 P-10 3

4. Nuclear Flux Source Range P-6

a. Below P Note A 2 2 1 4

b. Shutdown - Note B 2 1 0 5

5. Overtemperature LlT 3 2 2 6

6. Overpower LlT 3 2 2 6

7. Low Pressurizer Pressure 3 2 2 P-7 7

8. Hi Pressurizer Pressure 3 2 2 7 Note A - With the reactor trip breakers closed and the control rod drive system capable of rod withdrawal.

Note B - With the reactor trip breakers open.

1-3 ti) w I

...J I

1--'

0

C TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Permissible Functional Unit Of Channels Channels To Trip Bypass conditions Operator Action

9. Pressurizer-Hi Water Level 3 2 2 P-7 6

10. Low Flow 3/loop 2/loop in 2/loop in P-8 6 each oper- any oper-ating loop ating loop 2/loop in P-7 any 2 oper-ating loops

11. Turbine Trip

a. Stop valve closure 4 1 4 P-7 12

b. Low fluid oil pressure 3 2 2 P-7 6

12. Lo-Lo Steam Generator 3/loop 2/loop in 2/loop in 7 Water Level each oper- any oper-ating loop ating loops

13. Underfrequency 4KV Bus 3-1/bus 2 2 P-7 6

14. Undervoltage 4KV Bus 3-1/bus 2 2 P-7 7

15. Safety Injection (SI) Input 2 2 1 8A From ESF

16. Reactor Coolant Pump 1/breaker 1/breaker 1 P-8 9 Breaker Position per oper- 2 P-7 10 1-3 00 atingloop w

....i I

I-'

l r'

TABLE 3.7-1 REACTOR TRIP INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Permissible Functional Unit Of Channels Channels To Trip Bypass Conditions Operator Action

17. Low steam generator water 2/loop-level and 1/loop-level 1/loop-level 7 level with steam/f eedwater 2/loop-flow and 2/loop- coincident flow mismatch mismatch flow mismatch with 1/loop-or 2/loop-level f low mismatch and 1/loop-flow in same loop mismatch

18. a. Reactor Trip Breakers 2 2 1 8

b. Reactor Trip 2 1 1 Bypass Breakers - Note C

19. Automatic Trip Logic 2 2 1 11

20. Reactor Trip System Interlocks - Note D

a. Intermediate range neutron 2 2 1 13 flux, P-6

b. Low power reactor trips block, P-7 Power range neutron flux, P-1 O 4 3 2 13 and Turbine impulse pressure 2 2 1 13

c. Power range neutron flux, P-8 4 3 2 13

d. Power range neutron flux, P-10 4 3 2 13

e. Turbine impulse pressure 2 2 1 13 Note C - With the Reactor Trip Breaker open for surveillance testing in accordance with Specification Table 4.1-1 (Item 30)

Note D - Reactor Trip System Interlocks are described in Table 4.1-A

__J

' l TS 3.7-13 TABLE 3.7-1 (Continued)

TABLE NOTATION ACTION STATEMENTS ACTION 1. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and/or open the reactor trip breakers.

ACTION 2.A. With the number of OPERABLE channels equal to the Minimum OPERABLE Channels, POWER OPERATION may proceed provided the following conditions are satisfied:

1. The inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the redundant channel(s} per Specification 4.1.

3. Either, THERMAL POWER is restricted to~ 75% of RATED POWER and the Power Range, Neutron Flux trip setpoint is reduced to~ 85% of RATED POWER within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ; or, the QUADRANT POWER TILT is monitored at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Amendment Nos.

TS 3.7-14 I TABLE 3.7-1 (Continued)

4. The QUADRANT POWER TILT shall be determined to be within the limit when above 75 percent of RATED POWER with one Power Range Channel inoperable by using the moveable incore detectors to confirm that the normalized symmetric power distribution, obtained from 2 sets of 4 symmetric thimble locations or a full-core flux map, is consistent with the indicated QUADRANT POWER TILT at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

2. B. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, be in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ACTION 3. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement and with the THERMAL POWER level:

a. Below the P-6 (Block of Source Range Reactor Trip) setpoint, restore the inoperable channel to. OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint.

b. Above the P-6 (Block of Source Range Reactor Trip) setpoint, but below 10% of RATED POWER, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above 10% of RATED POWER.

c. Above.10% of RATED POWER, POWER OPERATION may continue.

Amendment Nos.

TS 3-7-15 I TABLE 3.7-1 (Continued)

ACTION 4. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement and with the THERMAL POWER level:

a. Below the P-6 (Block of Source Range Reactor Trip) setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 setpoint.

b. Above the P-6 setpoint operation may continue.

ACTIONS. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, verify compliance with the Shutdown Margin requirements within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter.

ACTION 6.A. With the number of OPERABLE channels equal to the Minimum OPERABLE Channels requirement, REACTOR CRITICAL and POWER OPERATION may proceed provided the following conditions are satisfied:

1. The inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels per Specification 4.1.

6. B. With the number of OPERABLE channels one less than required by the Minimum OPERABLE Channels requirement, be. in HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Amendment Nos.

~-

. ~- .

TS 3.7-16 I

ACTION 7.

TABLE 3.7-1 (Continued)

With the number of OPERABLE channels equal to the Minimum OPERABLE Channels, REACTOR CRITICAL and POWER OPERATION may proceed provided the following conditions are satisfied:

1. The inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

2. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.1.

ACTION 8.A. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In conditions of operation other than REACTOR CRITICAL or POWER OPERATIONS, with the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or open the reactor trip breakers within the next hour. However, one channel may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing per Specification 4.1 provided the other channel is OPERABLE.

8. B. With one of the diverse trip features (undervoltage or shunt trip device) inoperable, restore it to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or declare the breaker inoperable and apply Action 8.A.

The breaker shall not be bypassed while one of the diverse trip features is inoperable except for the time required for performing maintenance to restore the breaker to OPERABLE status.

Amendment Nos.

TS 3.7-17 I TABLE 3.7-1 (Continued)

ACTION 9. With one channel inoperable, restore the inoperable channel to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or reduce THERMAL POWER to below the P-8 (Block of Low Reactor Coolant Pump Flow and Reactor Coolant Pump Breaker Position) setpoint within~the next 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Operation below P-8 may continue pursuant to ACTION 10.

ACTION 10. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, operation may continue provided the inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION 11. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In conditions of operation other than REACTOR CRITICAL or POWER OPERATIONS, with the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or open the reactor trip breakers within the next hour. However, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.1 provided the other channel is OPERABLE.

ACTION 12. With the number of OPERABLE channels less than the Total Number of Channels, operation may continue provided the inoperable channels are placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION 13. With the number of OPERABLE channels less than the Minimum OPERABLE Channels requirement, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or be in at least HOT

SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Amendment Nos.

TABLE 3.7-2 ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Permissible Operator Functional Unit Of Channels Channels To Trip Bypass Conditions Actions

1. SAFETY INJECTION (SI)

a. Manual 2 2 1 21

b. High containment pressure 4 3 3 17 C. High differential pressure 3/steam line 2/steam line 2/steam line Primary pressure less 20 between any steam line on any than 2000 psig, except and the steam header steam line when reactor is critical

d. Pressurizer low-low pressure 3 2 2 Primary pressure less 20 than 2000 psig, except when reactor is critical

e. High steam flow in 2/3 steam lines coincident with low T avg or low steam line pressure

1) Steam line flow 2/steam line 1/steam line 1/steam line Reactor coolant T avg 20 any two lines less than 543° during heatup and cooldown

2) Tavg 1/loop 1/loop 1/loop Reactor coolant T avg 20 any two loops any two loops less than 543° during heatup and cooldown

3) Steam line pressure 1/line 1/line any 1/line any Reactor coolant T avg 20 two loops two loops less than 543° during heatup and cooldown 1-3 en

f. Automatic actuation logic 2 2 1 14 w

~

I I-"

00

TABLE 3.7-2 (Continued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS Minimum Total Number OPERABLE Channels Permissible Operator Functional Unit Of Channels Channels To Trip Bypass Conditions Actions

2. CONTAINMENT SPRAY

a. Manual 1 set 1 set 1 set* 15

b. High containment pressure 4 3 3 17 (Hi-Hi)

c. Automatic actuation logic 2 2 1 14

3. AUXILIARY FEEDWATER

a. Steam generator water level low-low

1) Start motor driven pumps 3/steam 2/steam 2/steam 20 generator generator generator any 1 generator

2) Starts turbine driven pump 3/steam 2/steam 2/steam 20 generator generator generator any 2 generators

b. RCP undervoltage starts 3 2 2 20 turbine driven pump

c. Safety injection - start See #1 above (all SI initiating functions and requirements) motor driven pumps

d. Station blackout - start 1/bus 1/bus 2 21 motor driven pumps 2 transfer 2 transfer buses/unit buses/unit

Must actuate 2 switches simultaneously

TABLE 3. *ntinued)

ENGINEERED SAFEGUARDS ACTION INSTRUMENT OPERATING CONDITIONS

. (

Minimum Total Number OPERABLE Channels Permissible Operator functional Unit Of Channels Channels To Trip Bypass Conditions Actions AUXILIARY FEEDWATER (continued)

e. Trip of main feedwater 2/MFW pump 1/MFWpump 2-1 each 21 pumps - start motor MFWpump driven pumps

f. Automatic actuation logic 2 2 1 22

4. LOSS OF POWER

a. 4.16 kv emergency bus 3/bus 2/bus 2/bus 20 undervoltage (loss of voltage)

b. 4.16 kv emergency bus 3/bus 2/bus 2/bus 20 undervoltage (degraded voltage)

5. NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low intake canal level 4 3 3 20

6. ENGINEERED SAFEGUARDS ACTUATION INTERLOCKS - Note A

a. Pressurizer pressure, P-11 3 2 2 23

b. Low-low Tavg, P-12 3 2 2 23

c. Reactor trip, P-4 2 2 1 24

7. RECIRCULATION MODE TRANSFER

a. RWST Level - Low 4 3 2 25 t-3 en

b. Automatic Actuation Logic 2 2 1 14 w and Actuation Relays

..J I

N Note A- Engineered Safeguards Actuation Interlocks are described in Table 4.1-A 0

TABLE 3.7-3 INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Minimum Total Number OPERABLE Channels Permissible Operator functional Unit Of Channels Channels To Trip Bypass Conditions Actions

1. CONTAINMENT ISOLATION

a. Phase I

1) Safety Injection (SI) See Item #1, Table 3.7-2 (all SI initiating functions and requirements)

2) Automatic initiation logic 2 2 1 14

3) Manual 2 2 1 21

b. Phase 2

1) High containment pressure 4 3 3 17

2) Automatic actuation logic 2 2 1 14

3) Manual 2 2 1 15

c. Phase 3

1) High containment pressure 4 3 3 17 (Hi-Hi setpoint)

2) Automatic actuation logic 2 2 1 14

3) Manual 1 set 1 set 1 set* 15

2. STEAMLINE ISOLATION

a. High steam flow in 2/3 lines See Item #1.e Table 3.7-2 for operability requirements coincident with 2/3 low T avg or 2/3 low steam pressures w

I

Must actuate 2 switches simultaneously ...J I

I\)

I-'

TABLE 3.7-3 (Continued)

INSTRUMENT OPERATING CONDITIONS FOR ISOLATION FUNCTIONS Minimum Total Number OPERABLE Channels Permissible Operator functional Unit Of Channels Channels To Trip Bypass Conditions Actions STEAMLINE ISOLATION (continued)

b. High containment pressure 4 3 3 17 (Hi-Hi setpoint)

c. Manual 1/steamline 1/steamline 1/steamline 21

d. Automatic actuation logic 2 2 1 22

3. TURBINE TRIP AND FEEDWATER ISOLATION

a. Steam generator water-level 3/steam 2/steam 2/in any one 20 high-high generator generator steam generator

b. Automatic actuation logic 2 2 1 22 and actuation relay

c. Safety injection See Item #1 of Table 3.7-2 (all SI initiating functions and requirements) w

TS 3.7-23 I TABLES 3.7-2 AND 3.7-3 TABLE NOTATIONS ACTION 14. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . One channel may be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing per Specification 4.1, provided the other channel is OPERABLE.

ACTION 15. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the next 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

ACTION 17. With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and the Minimum OPERABLE-Channels requirement is met. One additional channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.1.

ACTION 19. With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION 20. With the number of OPERABLE channels one less than the Total Number of Channels, REACTOR CRITICAL and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

b. The Minimum OPERABLE Channels requirement is met; however, the inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels per Specification 4.1.

Amendment Nos.

TS 3.7-24 I TABLES 3.7-2 ANDS 3.7-3 (Continued)

TABLE NOTATIONS ACTION 21. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirements, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

ACTION 22. With the number of OPERABLE channels one less than the Minimum OPERABLE Channels requirement, be in at least HOT SHUTDOWN within 1O hours and reduce pressure and temperature to less than 450 psig and 350° within the next 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months ; however, one channel may be bypassed for up to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for surveillance testing per Specification 4.1 provided the other channel is OPERABLE.

ACTION 23. With the number of OPERABLE channels less than the Minimum OPERABLE Channels requirement, within one hour determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or be in at least HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION 24. With the number of OPERABLE channels less than the Total Number of Channels, restore the inoperable channels to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or reduce pressure and temperature to less than 450 psig and 350°F within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

ACTION 25. With the number of OPERABLE channels one less than the Total Number of Channels, place the inoperable channel in the bypassed condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months or be in HOT SHUTDOWN within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . One additional channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.1.

Amendment Nos.

TABLE 3.7-4

ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING Functional Unit Channel Action Setting Limit 1 High Containment Pressure (High Containment a) Safety Injection ~ 5 psig Pressure Signal) b) Containment Vacuum Pump Trip c) High Press. Containment Isolation d) Safety Injection Containment Isolation e) F.W. Line Isolation 2 High-High Containment Pressure (High-High a) Containment Spray ~ 10.3 psig Containment Pressure Signals) b) Recirculation Spray c) Steam Line Isolation d) High-High Press. Containment Isolation 3 Pressurizer Low-Low Pressure a) Safety Injection ~ 1,700 psig b) Safety Injection Containment Isolation c) F.W. Line Isolation 4 High Differential Pressure Between a) Safety Injection ~ 150 psig Steam Line and the Steam Line Header b) Safety Injection Containment Isolation c) F.W. Line Isolation 5 High Steam Flow in 2/3 Steam Lines a) Safety Injection ~ 40% (at zero load) of full steam flow

~ 40% (at 20% load) of full steam flow

~ 110% (at full load) of full steam flow b) Steam Line Isolation c) Safety Injection Containment Isolation d) F.W. Line Isolation Coincident with Low T avg or ~ 541°F Tavg Low Steam Line Pressure ~ 500 psig steam line pressure w

I

....i I

!'.J U'I

TABLE 3.7-4 ENGINEERED SAFETY FEATURE SYSTEM INITIATION LIMITS INSTRUMENT SETTING Functional Unit Channel Action Setting Limit 6 AUXILIARY FEEDWATER

a. Steam Generator Water Level Low-Low Aux. Feedwater Initiation ~ 5% narrow range S/G Slowdown Isolation

b. RCP Undervoltage Aux. Feedwater Initiation ~ 70% nominal

c. Safety Injection Aux. Feedwater Initiation All S.I. setpoints

d. Station Blackout Aux. Feedwater Initiation ~ 46.7% nominal

e. Main Feedwater Pump Trip Aux. Feedwater Initiation N.A.

7 LOSS OF POWER

a. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separation and 75 (+/-1.0)% volts with a (Loss of Voltage) Diesel start 2 (+5, -0.1) second time delay

b. 4.16 KV Emergency Bus Undervoltage Emergency Bus Separation and 90 (+/-1.0)% volts with a (Degraded Voltage) Diesel start 60 (+/- 3.0) second time delay (Non CLS, Non SI) 7 (+/- .35) second time delay (CLS or SI Conditions) 8 NON-ESSENTIAL SERVICE WATER ISOLATION

a. Low Intake Canal Level Isolation of Service Water flow to 23 feet-6 inches non-essential loads 9 RECIRCULATION MODE TRANSFER

a. RWST Level-Low Initiation of Recirculation Mode Transfer System

~

18.93%

19.43% 1~

w

..J I

N

TABLE 3.7-5 AUTOMATIC FUNCTIONS OPERATED FROM RADIATION MONITORS ALARM Automatic Function Monitoring Alarm Setpoint Monitor Channel At Alarm Conditions Requirements u.c11cc 1 . Component cooling water radiation Shuts surge tank vent valve See Specification Twice Background monitors HCV-CC-100 3.13

2. Containment particulate and gas Trips affected unit's purge supply See Specificatoin Particulate :::; 9 x 1o-9 monitors (RM-RMS-159 & fans, closes affected unit's purge 3.10 Gas:::; 1 x 10-5 RM-RMS-160, RM-RMS-259 & air butterfly valves (MOV-VS-1 OOA, RM-RMS-260) B, C & Dor MOV-VS-200A, B, C & D)

3. Manipulator crane area monitors Trips affected unit's purge supply See Specification :::; 50 mrem/hr (RM-RMS-162 & RM-RMS-262) fans, closes affected unit's purge 3.10 air butterfly valves (MOV-VS-100A, B, C & Dor MOV-VS-200A, B, C & D)

I

-.J I

l',J

-.J

___ _J

TABLE 3.7-S(a)

EXPLOSIVE GAS MONITORING INSTRUMENTATION Minimum Total No. OPERABLE Instrument of Channels Channels 1 . Waste Gas Holdup System Explosive Gas Monitoring System Oxygen Monitor 1 1 1 ACTION 1 - With the number of OPERABLE channels less than required by the Minimum OPERABLE Channels requirement, operation of this waste gas hold up system may continue provided grab samples are collected at least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and analyzed within the following 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

1-3 en w

I

....i I

I'->

co

TABLE 3.7-6 ACCIDENT MONITORING INSTRUMENTATION Instrument Total No. Of Channels Minimum OPERABLE Channels

1. Auxiliary Feedwater Flow Rate 1 perS/G 1 perS/G

2. Inadequate Core Cooling Monitor

a. Reactor Vessel Coolant Level Monitor 2 1

b. Reactor Coolant System Subcooling Margin Monitor 2 1

c. Core Exit Thermocouples 2 (Note 2) 1 (Note 2)

3. PORV Position Indicator 2/valve 1/valve

4. PORV Block Valve Position Indicator 1/valve 1/valve

5. Safety Valve Position Indicator (Primary Detector) 1/valve 1/valve

6. Safety Valve Position Indicator (Backup Detector) 1/valve 0

7. Containment Pressure 2 1

8. Containment Water Level (Narrow Range) 2 1

9. Containment Water Level (Wide Range) 2 1 1O. Containment High Range Radiation Monitor 2 1 (Note 1, b and c only) 11 . Process Vent High Range Effluent Monitor 2 2 (Note 1, a, b, and c)

12. Ventilation Vent High Range Effluent Monitor 2 2 (Note 1, a, b, and c)

13. Main Steam High Range Radiation Monitors (Units 1 and 2) 3 3 (Note 1, a, b, and c)

14. Aux. Feed Pump Steam Turbine Exhaust Radiation Monitor 1 1 (Note 1, a, b, and c)

Note 1: With the number of operable channels less than required by the Minimum OPERABLE Channels requirements

a. Initiate the preplanned alternate method of monitoring the appropriate parameter(s), within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months

b. Either restore the inoperable channel to operable status within 7 days of the event, or

c. Prepare and submit a Special Report to the commission pursuant to specification 6.2 within 30 days following the event outlining the action taken, the cause of the inoperability and the plans and schedule for restoring the system to operable.

Note 2: A minimum of 2 core exit thermocouples per quadrant are required for the channel to be operable.

TABLE 4.1-1 (Continued)

MINIMUM FREQUENCIES FOR CHECK, CALIBRATIONS, AND TEST OF INSTRUMENT CHANNELS Channel Description .Qhec!s Calibrate I.e.st Remarks

10. Rod Position Bank Counters S(1,2) N.A. N.A. 1) Each six inches of rod motion 0(3) when data logger is out of service

2) With analog rod position

3) For the control banks, the bench-board indicators shall be checked against the output of the bank overlap unit

11. Steam Generator Level s R M

12. Charging Flow N.A. R N.A.

13. Residual Heat Removal Pump Flow N.A. R N.A.

14. Boric Acid Tank Level *D R N.A.

15. Recirculation Mode transfer

a. Refueling Water Storage Tank Level-Low s R M

b. Automatic Actuation Logic and N.A. N.A. M Actuation Relays

16. Volume Control Tank Level N.A. R N.A.

17. Reactor Containment Pressure-CLS *D R M(1) 1) Isolation valve signal and spray signal

18. Boric Acid Control N.A. R N.A.

19. Containment Sump Level N.A. R N.A.

1-3

20. Accumulator Level and Pressure s R N.A. en

~

21. Containment Pressure-Vacuum s R N.A.

f--'

Pump System I

-.J

22. Steam Line Pressure s R M L_ -=--

MINIMUM FREQUENCY FOR EQUIPMENT TESTS FSAR SECTION DESCRIPTION FREQUENCY REFERENCE

19. Primary Coolant System Functional 1 . Periodic leakage testing (a) on each valve listed in Specification 3.1.C.7a shall be accomplished prior to entering power operation II condition after every time the plant is placed in the cold shutdown condition for refueling, after each time the plant is placed in cold shutdown condition for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months if testing has not been accomp-lished in the preceeding 9 months, and prior to returning the valve to service after maintenance, repair or replacement work is performed.

20. Containment Purge MOV Leakage Functional Semi-Annual (Unit at power or shutdown) II if purge valves are operated during interval (c)

21. Containment Hydrogen Analyzers a. Channel Check Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months II

b. Channel Functional Test Once per 31 days

c. Channel Calibration using Once per 92 days on staggered basis sample gas containing:

1 . One volume percent

(+/- 0.25%) hydrogen, balance nitrogen

2. Four volume percent

(+/- 0.25%) hydrogen, balance nitrogen

3. Channel calibration test will include startup and operation of the Heat Tracing System

22. RCS Flow Flow ~ 273,000 gpm Once per refueling cycle 14 II

23. RWST parameters a. Temperature .s. 45°F Once per shift

b. Volume~ 387,100gallons Once per shift 1-3 (a) To satisfy ALARA requirements, leakage may be measured indirectly (as from the performance of pressure indicators) if accomplished in accordance 00 with approved procedures and supported by computations showing that the method is capable of demonstrating valve compliance with the leakage ~

~~ ~

(b) Minimum differential test pressure shall not be below 150 psid. Ji (c) Refer to Section 4.4 for acceptance criteria. c.i

See Specification 4.1. D

ATTACHMENT 2 SURRY POWER STATION DISCUSSION AND SIGNIFICANT HAZARDS CONSIDERATION PROPOSED TECHNICAL SPECIFICATION CHANGES RECIRCULATION MODE TRANSFER FUNCTION

DISCUSSION OF CHANGES INTRODUCTION Operability, action, and surveillance requirements are being proposed for the recirculation mode transfer (RMT) function. In addition, administrative changes are being made in those sections affected by the proposed technical changes associated with the RMT function.

BACKGROUND The RMT function transfers Safety Injection System suction from the refueling water storage tank (RWST) to the containment sump when RWST water level is low. This ensures a continuous suction source and adequate net positive suction head (NPSH) to the Safety Injection System pumps. The original Surry Power Station design required manual initiation of RMT when a predetermined low RWST water level was indicated. An automatic RMT capability was installed during 1980 and 1981 in conjunction with several other design changes to the Containment Spray System.

These design changes were made to increase the effectiveness of the Containment Spray System in removing radioactive iodine from the containment atmosphere following a design basis accident. Automatic RMT, which is initiated by two of four channels sensing a low RWST level, shifts the suction of the Low Head Safety Injection System pumps to the containment sump to ensure NPSH for the Safety Injection System pumps and an adequate supply of water to the Containment Spray System during the entire period of containment depressurization.

Following implementation of the design changes, the Surry Technical Specifications were not revised to explicitly require automatic RMT capability. Technical Specifications 3.3 and 3.4 required operability of valves, piping, and interlocks for the*

Safety Injection and Spray Systems, respectively, but did not explicitly refer to the automatic RMT capability. Due in part to the lack of a direct and explicit requirement for the automatic RMT capability and the use of manual actions as an acceptable alternative to the automatic function, a violation of Technical Specifications (Licensee Event Report 281 /91-006) occurred on J1Jly 20, 1991. In order to prevent further violations and to ensure compliance with Generic Letter 91-18, "Information to Licensees Regarding Two NRC Inspection Manual Sections on Resolution of

Degraded and Nonconforming Conditions and on Operability," dated November 7, 1 of 12

1991, explicit operability, action, and surveillance requirements are proposed for the RMT function. The proposed requirements are consistent with WCAP 10271 and Supplements entitled "Evaluation of the Surveillance Frequencies and the Out of Service Times for the Engineered Safety Features Actuation System," and their associated NRC Safety Evaluation Report, dated February 22, 1989.

As a result of the 1981 Containment Spray System modifications discussed above, the minimum required RWST volume in the Technical Specifications was increased from 385,200 gallons to 387,100 gallons and a maximum volume limit of 398,000 gallons was added (License Amendments 59 and 71 ). A maximum volume was specified at that time due to the limitations established by a seismic evaluation. Subsequent to the required Technical Specification change in RWST volume, an extensive analysis was performed to confirm the seismic adequacy of the tank for any maximum volume. The analysis included both a linear finite element analysis of the tank embedment lugs or "chairs" and a non-linear finite element buckling analysis of the region around the inlet pipes as the limiting elements of the tank design. Modifications were subsequently made to the embedment bolt "chair" supports. The analysis concluded that the tank design was adequate throughout the range of RWST volume. The RWSTs can be filled to their maximum capacities (limited by overflow piping to approximately 398,000 gallons for Unit 1 and 399,000 gallons for Unit 2) with no structural concerns. With the implementation of these modifications, specifying a maximum RWST volume is no longer necessary and deletion of the maximum volume limit is proposed.

The capability of the spray systems to depressurize the containment in the event of a design basis accident is a function of the pressure and temperature of the containment atmosphere, service water temperature, and RWST water temperature. Technical Specification 3.4, Spray Systems, originally limited RWST water temperature to a maximum of 45°F, but allowed this limit to be exceeded provided that additional restrictions on containment temperature, containment pressure, and service water temperature were observed. The allowable operating envelope was depicted in Technical Specification Figure 3.8-1. This figure was later revised to limit RWST water temperature to 45°F under any circumstances. However, the text of Technical Specification 3.4 was not revised and still alludes to operation at RWST water temperatures greater than 45°F. To correct this inconsistency we are proposing to add an explicit RWST water temperature limit of 45°F to Technical Specification 3.4 and delete the remaining references to operation at RWST water temperature greater than 2 of 12

45°F. The 45°F RWST water limit is also being added to Technical Specification 3.3, Safety Injection System, since this is an initial condition assumed in the analysis of the loss of coolant accident.

Technical Specifications 3.3 and 3.4 presently require unit shutdowns under certain circumstances, but do not specify time limits for accomplishing the required shutdowns. We are, therefore, proposing to include time limits of six hours to place a unit in hot shutdown and an additional thirty hours to place a unit in cold shutdown, consistent with Technical Specification 3.0.1. Also, we are proposing to add a one hour Technical Specification Action Statement to take remedial action in the event that RWST volume, temperature, or boron concentration are outside the limits of Technical Specifications 3.3 and 3.4. If these parameters are not restored to allowable values within one hour, the unit is required to be in hot shutdown within the next six hours.

These changes permit immediate corrective action to address minor deviations from Technical Specification limits without entry into a Technical Specification Action Statement to shutdown the unit. This approach and the proposed changes are consistent with NUREG-0452, "Standard Technical Specifications for Westinghouse Pressurized Water Reactors," Revision 4.

The sections affected by the technical changes discussed above are being revised in their entirety to provide consistency in the terminology and format. For example, basis discussions are being clarified, defined words are being capitalized, and pages are being repaginated.

SPECIFIC CHANGES A maximum RWST water temperature of 45°F is being added to Technical Specification 3.3.A.1. Time limits, consistent with Technical Specification 3.0.1, for placing a unit in hot shutdown and then cold shutdown are being specified in Technical Specification 3.3.B. Also, Technical Specification 3.3.B.1 o is being added to provide -a one hour Technical Specification Action Statement to return RWST volume, temperature, or boron concentration to allowable values prior to entering a six hour Technical Specification Action Statement to shutdown the unit.

In Technical Specification 3.4.A.3, the maximum RWST volume is being deleted and a maximum RWST water temperature of 45°F is being specified. Technical 3 of 12

Specification 3.4.B.5 is being added to provide a one hour Technical Specification Action Statement to return RWST volume, temperature, or boron concentration to allowable values prior to entering a six hour Technical Specification Action Statement to shutdown the unit. This is consistent with the one hour Action Statement added in Technical Specification 3.3.B.10. RWST minimum and maximum boron concentration requirements are also being included in the Spray System Technical Specifications.

A time limit is being incorporated into Technical Specification Action Statement 3.4.B to place the unit in cold shutdown within thirty hours if the safety injection equipment cannot be returned to service within forty-eight hours after reaching hot shutdown. The thirty hour time limit is consistent with Technical Specification 3.0.1 and NUREG-0452, "Standard Technical Specifications for Westinghouse Pressurized Water Reactors,"

Revision 4.

Technical Specification 3.4.C, which permitted operation with RWST water temperature greater than 45°F, is being deleted consistent with the previous deletions of this provision.

The spray system operability requirement, "or the reactor shall not be made critical," is being removed as unnecessary. With the spray systems required to be operable above 350°F and 450 psig and Technical Specification 3.1.E requiring the reactor to be above 522°F for critical operation, the spray systems will be operable as assumed in the safety analysis. In addition, proposed Technical Specification changes submitted by letter dated October 8, 1991, will prohibit changing modes while in a Technical Specification 3.4 Action Statement which further eliminates the need for this statement.

Item No. 7, Recirculation Mode Transfer, is being added to Technical Specification Table 3.7-2. Operability requirements for the RWST level channels and actuation logic channels are being specified. A corresponding Technical Specification Action Statement is also being included for the RWST level channels. The operability requirements and Technical Specification Action Statements are consistent with WCAP 10271 and Supplements entitled "Evaluation of the Surveillance Frequencies and the Out of Service Times for the Engineered Safety Features Actuation System,"

and their associated NRC Safety Evaluation Report. Existing Action 14 of Technical Specification Table 3.7-1 applies when a AMT actuation logic channel is inoperable.

Action* 14 of Technical Specification Table 3.7-1 is the same action required for an 4 of 12

- J

inoperable Safety Injection System or Containment Spray System logic channel. The Limiting Instrument Settings for RMT actuation are also being added to Technical Specification Table 3.7-4.

The Basis Section for Accident Monitoring Instrumentation is being changed to accurately reflect the valve position indication devices for the pressurizer power operated relief valves (PORV). To meet environmental qualification requirements, redundant limit switches were installed to provide the required position indication. The Acoustic Monitoring System has been removed from the PORV discharge tail pipes. In addition, the PORV position indication operability requirements are being restated consistent with NUREG-0452, "Standard Technical Specifications for Westinghouse Pressurized Water Reactors," Revision 4.

The existing Technical Specification Surveillance Requirements for the RWST level instrumentation in Technical Specification Table 4.1 are being modified to clearly require channel functional testing and actuation logic testing on a monthly basis. The existing requirements for channel check and channel calibration, once per shift and each refueling, respectively, are not being changed. In addition, Surveillance

Requirements are being added to Technical Specification Table 4.1-2.A for RWST water temperature and volume.

Administrative changes are being completed to achieve consistency throughout the Technical Specifications. The following administrative changes are being proposed:

Technical Specification Section 1, Definitions Each defined word is being presented in capital letters. Defined words throughout the proposed Technical Specification are being capitalized.

- The word "condition" is being removed from the reactor operation definitions.

- The terms "Degree of Redundancy" and "Source Check" are being deleted.

These terms are no longer used in the Technical Specifications.

- The defined term "Logic Channel" is being changed to "AUTOMATIC ACTUATION LOGIC" to be consistent with the recent Technical Specification changes to Section 3.7, Instrumentation .

5 of 12

- The definition of CONTAINMENT INTEGRITY was changed in a proposed Technical Specification submitted to the NRC on June 1, 1992. These changes have double bars in the right margin.

Technical Specification Section 3.3, Safety Injection System

- Time limits are being included in Technical Specification 3.3.B to place the unit in hot shutdown (six hours) and then cold shutdown (thirty hours) if the Safety Injection System equipment is not returned to service within the allowed outage times. These times are consistent with Technical Specification 3.0.1.

- The phrase "out of service" is being changed to "inoperable" throughout Technical Specification 3.3.B.

- The footnotes for application of the increased boron concentration requirements are being deleted. Both units have implemented the increased boron requirement. (page 3.3-1)

- The word "uncollected" is being included in the Technical Specification Action Statement 3.3.B.9 for leakage.

- A typographical error in the Basis Section is being corrected. The appropriate Surveillance Section is Technical Specification 4.11. (page 3.3-6)

- The phrase "from initiating hot shutdown" is being changed to "after a unit trip from full power" in the Basis Section. (page 3.3-7)

- The word "availability" is being changed to "operability" in the Basis Section discussion of accumulator inleakage. (page 3.3-8)

- The phrase "motorized valve" is being changed to "motor operated valve" in the Basis Section description of the accumulators. Also, the phrase "safety injection" is being replaced with "accumulator injection" in the Basis Section discussion for the accumulators. (page 3.3-9)

- The units for the accumulator injection pressure are being changed from psig to psia. (page 3.3.9)

6 of 12

- '4 Technical Specification Section 3.4. Spray Systems

- The phrase "not less than" is being changed to "at least." (page 3.4-2)

- The footnotes for application of the increased boron concentration requirements are being deleted. Both units have implemented the increased boron requirement. (page 3.4-2)

The phrase "out of service" is being changed to "inoperable" throughout Technical Specification 3.4.B.

- The capacity of the RWST is being removed from the Basis Section discussion.

The Unit 1 and 2 tanks have different capacities.

- The reference to Specification 3.8-B in the Basis Section is being changed to the Basis Section of Specification 3.8.

- The references in the Basis Section are being changed from FSAR to UFSAR.

Technical Specification Section 3.7, Instrumentation Systems

- The Reactor Protection System is being included in the Objectives Section, as it is noted in the Applicability.

- The operability requirements for PORV position indication are being combined.

There will be only one line item in Table 3.7-6 requiring two channels per valve to be operable (Total Number of Channels) and one channel per valve to be operable (Minimum OPERABLE Channels). These changes do not alter the operability requirements for PORV position indication.

- A proposed Technical Specification was submitted by letter dated October 8, 1991, which modified both the general Limiting Conditions for Operation (Technical Specification 3.0) and Surveillance Requirements (Technical Specification 4.0). When approved, these changes will limit changing modes while in certain Technical Specification Action Statements and identify those Technical Specifications that are exempt from this requirement. The following

7 of 12

Technical Specifications are impacted by the previous submittal and are identified by double bars in the right margin.

The phrase "return to criticality from hot shutdown" is being changed to "REACTOR CRITICAL" in the containment hydrogen analyzer operability requirements of Technical Specification 3.7.F and the mode change exception is being included.

The mode change exception is being included with the accident monitoring instrumentation operability requirements in Technical Specification 3.7.G.

An exception to Technical Specification 3.0.1 for the explosive gas monitoring instrumentation operability requirements is being included in Technical Specification 3.7.E. In addition, a proposed change to the operability requirements for the explosive gas monitors was submitted on July 28, 1992, which impacts Technical specification pages 3.7-1,. 3.7-2, and Table 3.7-S(a).

- The spelling of "break" is being corrected in the Basis Section. (page 3.7-5)

- "Decay Heat" is being changed to "decay heat." (page 3.7-7)

- The references in the Basis Section are being changed from FSAR to UFSAR.

- The column titles are being changed to lower case letters in Technical Specification Tables 3.7-1 through 3.7-6. Therefore, only defined words throughout the Technical Specifications will be in capital letters. The column titles are also being corrected in the associated Technical Specification Action Statements.

- The entire Technical Specification Section 3.7 is being repaginated, which will allow for the deleting of unnecessary pages.

Technical Specification Section 4.1, Operational Safety Review

- The item numbers of Technical Specification Table 4.1-2A, page 4.1-9d, are changed to reflect the additional item added to this table in a propos~d Technical Specification change, dated June 28, 1991. These changes are

identified by double bars in the right margin.

8 of 12

SAFETY SIGNIFICANCE The major safety considerations were (a) the effect on RMT reliability with a failed level instrument in the bypass condition and (b) the effect on RWST integrity with the deletion of the maximum volume requirement.. The remainder of the proposed changes are administrative in nature and do not significantly affect plant operations.

Bypassing a failed RWST level instrument changes the RMT actuation logic from two-out-of-four channels to two-out-of-three channels sensing a low RWST level. Although the present Technical Specifications do not provide explicit operability requirements for RMT, continued operation with a level channel in bypass could be considered a decrease in the overall reliability of the automatic actuation, and therefore, an increase in the probability that RMT would fail to actuate on demand. It should be noted that with a level instrument in bypass, the capability to withstand a single active failure is still maintained. Further, continued plant operation with a RWST level instrument in bypass is consistent with NUREG-0452, "Standard Technical Specifications for Westinghouse Pressurized Water Reactors," Revision 4.

The existing Technical Specifications do not explicitly provide operability requirements for RMT or the RWST level instruments. Therefore, a failed RWST level instrument would require entering Technical Specification 3.0.1, shutting down the unit and placing the plant in an unnecessary transient. Conversely, placing a failed instrument in trip would increase the probability of a spurious RMT actuation. A spurious RMT actuation could cause loss of charging pump suction during normal operation or loss of safety injection suction during a design basis accident.

The RMT function and the RWST will continue to mitigate the consequences of a design basis loss of coolant accident in the same manner as before the proposed changes. Allowing continued plant operation with a RWST level instrument in bypass does not significantly change the level of protection afforded by the RMT function, while preventing unnecessary plant transients. Because bypassing a failed RWST level instrument changes the RMT actuation logic, which is conservatively assessed as increasing the probability of a malfunction of equipment important to safety, the proposed changes are designated as an unreviewed safety question pursuant to 10 CFR 50.59.

9 of 12

... ~

SIGNIFICANT HAZARDS CONSIDERATION Virginia Electric and Power Company has reviewed the proposed changes against the criteria of 10 CFR 50.92 and has concluded that the changes as proposed do not pose a significant hazards consideration. Specifically, operation of Surry Power Station in accordance with the proposed changes will not:

1. Involve a significant increase in the probability or consequences of any accident previously evaluated. The refueling water storage tank (RWST) and the recirculation mode transfer (RMT) function are not involved in the initiation of any accidents previously evaluated. Thus, the probability of such accidents is not increased. The RWST and the RMT function will continue to mitigate the consequences of a design basis loss of coolant accident in the same manner as before the changes. Although continued operation with a level channel in bypass could be considered a decrease in the overall reliability of the automatic actuation and, therefore, an increase in the probability of a malfunction of equipment important to safety, the difference in reliability between two-out-of-three logic and two-out-of-four logic is not considered to be significant to accomplish the RMT function. Futhermore, the ability to withstand a single failure is still maintained. Considering that no explicit operability requirements are stated in the present Technical Specifications for the RMT function, we conclude that there are no significant changes in the consequences of any accident due to this proposed change. Deletion of the maximum RWST volume has no effect on tank integrity in a seismic event since evaluation of the modified structure has shown it to be seismically adequate throughout its volume. Providing a one hour Technical Specification Action Statement to return RWST parameters to within specified values has no significant effect on accident consequences or the mitigation capability since the allowed time is short and the action ensures that deviations from Technical Specification limits are corrected promptly. The addition of explicit operability; action, and surveillance requirements for the RMT function does not affect the consequences of any accident but rather provides assurance that the function will not be rendered inoperable due to misinterpretation of the operability requirements. Placing a failed RWST level channel in the bypassed condition maintains the functional capability of RMT, even if a single active failure is assumed, while preventing an additional channel failure from causing spurious 1O of 12

RMT actuation. The administrative changes such as clarifying the maximum allowable RWST temperature and correcting or providing consistency in nomenclature do not affect plant operation and do not impact the probability or consequences of any previously analyzed accident. Likewise, specifying time limits to hot shutdown and cold shutdown in Technical Specifications 3.3 and 3.4 (rather than deferring to Technical Specification 3.0.1) is an administrative change, which does not increase the probability of occurrence or the consequences of an accident.

2. Create the possibility of a new or different type of accident from those previously evaluated. The original maximum RWST volume was included due to seismic considerations. Deletion of the maximum RWST volume has no effect on tank integrity in a seismic event since detailed evaluation of the modified structure has shown it to be seismically adequate at its maximum volume. Thus, eliminating the maximum volume requirement is administrative in nature. The proposed changes involve no permanent physical modifications. The proposed changes have no impact on plant design or operation. No new failure modes or accident precursors are introduced. Therefore, a new or different type of accident is not created.

3. Involve a significant reduction in a margin of safety. The proposed changes do not affect any setpoints or operating parameters. The proposed changes do not change any assumptions or analysis inputs. The RMT function continues to be required and provide a safety function. The time limit to correct RWST parameters does not cause a significant reduction in margin, as it directs prompt corrective action or unit shutdown which is consistent with Technical Specification 3.0.1. Filling the RWST to its maximum capacity does not have adverse effects on its structural integrity, and therefore, does not impact the accident analysis assumptions. Margins of safety are not reduced by the proposed changes.

Using the examples identified in the Federal Register, Vol 51, No. 44, of March 6, 1986 that are not considered likely to involve significant hazard considerations, the proposed changes are similar to examples (i), (ii), and (vi) .

11 of 12

Example (i) is "a purely administrative change to Technical Specifications: for example, a change to achieve consistency throughout the Technical Specifications, correction of an error, or a change in nomenclature." The proposed capitalizing of defined words, clarifying the basis discussions, including times for shutdown consistent with Technical Specification 3.0.1, and changing the acronym from FSAR to UFSAR in the references are purely administrative in nature.

Example (ii) is "a change that constitutes an additional limitation, restriction, or control not presently included in the Technical Specifications, e.g., a more stringent Surveillance Requirement." The proposed changes formally incorporate Limiting Conditions for Operation and Technical Specification Action Statements for both the RMT function and the RWST level channels.

Example (vi) is "a change which either may result in some increase to the probability or consequences of a previously-analyzed accident or may reduce in some way a safety margin, but where the results of the change are clearly within all acceptable criteria with respect to the system or component specified in the Standard Review Plan, e.g. , a change resulting from the application of a small refinement of a previously used calculational model or design methoc;t" Continued operation with a RWST level instrument in bypass could increase the probability of a malfunction of equipment important to safety. However, operation in this manner is consistent with NUREG-0800, Standard Review Plan and NUREG-0452, "Standard Technical Specifications for Westinghouse Pressurized Water Reactors," Revision 4.

12 of 12

ML18151A714

Text

Navigation menu

Search