DCL-04-180, License Amendment Request 04-08 Revision to Technical Specification 3.4.10, Pressurizer Safety Valves.

License Amendment Request 04-08 Revision to Technical Specification 3.4.10, Pressurizer Safety Valves.

ML050060133
Person / Time
Site:	Diablo Canyon
Issue date:	12/31/2004
From:	Becker J Pacific Gas & Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
DCL-04-180, OL-DPR-80, OL-DPR-82
Download: ML050060133 (45)

Text

Pacic& Gas and Electric Company James R.Becker Diablo Canyon Power Plant Vice President-Diablo Canyon PO. Box 56 Operations and Station Director Avila Beach, CA 93424 December 31, 2004 805.545.3462 PG&E Letter DCL-04-180 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Docket No. 50-275, OL-DPR-80 Docket No. 50-323, OL-DPR-82 Diablo Canyon Units 1 and 2 License Amendment Request 04-08 Revision to Technical Specification 3.4.10, "Pressurizer Safety Valves" In accordance with 10 CFR 50.90, enclosed is an application for amendment to Facility Operating License Nos. DPR-80 and DPR-82 for Units 1 and 2 of the Diablo Canyon Power Plant, respectively. The enclosed license amendment request (LAR) proposes to revise Technical Specification (TS) 3.4.10, "Pressurizer Safety Valves."

The proposed change adds a separate Action and associated Completion Times for one or more inoperable pressurizer safety valves (PSV) for the condition where the valves are inoperable solely due to loop seal temperatures being outside of design limits. Currently, when a PSV is in such a condition, it is conservatively declared inoperable and TS 3.4.10 Condition A is entered, which has a Completion Time of 15 minutes. A Completion Time of 15 minutes provides insufficient time for restoring a PSV loop seal temperature to within limits. Failure to meet the 15-minute Completion Time requires entry into Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and Mode 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The new Action will provide Completion Times of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for exceeding the high temperature limit, and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (MODES 1 and 2) or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (MODES 3 and 4) for exceeding the low temperature limit. This change will allow adequate time, and increased flexibility, for operators to return the loop seal temperature to within limits and avoid an unplanned shutdown or cooldown. In addition, two new PSV loop seal temperature surveillance requirements are proposed to assist in assuring PSV operability.

This LAR represents a risk-informed licensing change. The proposed change meets the criteria of Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," for risk-informed changes.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance ifC Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde

• South Texas Project

• Wolf Creek

Document Control Desk PG&E Letter DCL-04-180 December 31, 2004 Page 2 contains a description of the proposed change, the supporting technical analyses, and the no significant hazards consideration determination. Enclosures 2 and 3 contain marked-up and retyped (clean) TS pages, respectively. Enclosure 4 contains TS Bases changes, for information only, that will be implemented pursuant to TS 5.5.14, "Technical Specifications Bases Control Program," at the time this amendment is implemented.

PG&E has determined that this LAR does not involve a significant hazards consideration as determined per 10 CFR 50.92. Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of this amendment.

The change proposed in this LAR is not required to address an immediate safety concern. However, approval is requested by September 1, 2005, to support the Unit 1 thirteenth refueling outage currently scheduled to start October 24, 2005.

PG&E requests the license amendment be made effective upon NRC issuance, to be implemented within 90 days from the date of issuance.

If you have any questions or require additional information, please contact Stan Ketelsen at 805-545-4720.

Sincerely, James R. ecker Vice President - Diablo Canyon Operations and Station Director jerl /3664 Enclosures cc: Edgar Bailey, DHS Bruce S. Mallett David L. Proulx Diablo Distribution cc/enc: Girija S. Shukla A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• ComanchePeak

• DiabloCanyon

• PaloVerde . SouthTexasProject

• WolfCreek

PG&E Letter DCL-04-180 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION

) Docket No. 50-275 In the Matter of ) Facility Operating License PACIFIC GAS AND ELECTRIC COMPANY) No. DPR-80

)

Diablo Canyon Power Plant ) Docket No. 50-323 Unit 1 and 2 ) Facility Operating License

) No. DPR-82 AFFIDAVIT James R. Becker, of lawful age, first being duly sworn upon oath says that he is Vice President - Diablo Canyon Operations and Station Director of Pacific Gas and Electric Company; that he has executed license amendment request 04-08 on behalf of said company with full power and authority to do so; that he is familiar with the content thereof; and that the facts stated therein are true and correct to the best of his knowledge, infor an belief.

James R. ecker Vice President - Diablo Canyon Operations and Station Director Subscribed and sworn to before me this 3 1 st day of December2004.

Notary Public County of San Luis Obispo State of California

Enclosure 1 PG&E Letter DCL-04-180 EVALUATION

1.0 DESCRIPTION

This letter is a request to amend Operating Licenses DPR-80 and DPR-82 for Units 1 and 2 of the Diablo Canyon Power Plant (DCPP), respectively.

This license amendment request (LAR) proposes to revise Technical Specification (TS) 3.4.10, "Pressurizer Safety Valves," to add a separate Action and associated Completion Times (CT) for one or more inoperable pressurizer safety valves (PSV) for the condition where the valves are inoperable solely due to loop seal temperatures being outside of design limits.

Currently, when a PSV is in such a condition, it is conservatively declared inoperable and TS 3.4.10 Condition A is entered, which has a CT of 15 minutes. A Completion Time of 15 minutes provides insufficient time for restoring a PSV loop seal temperature to within limits. The new Action will provide CTs of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for exceeding the high temperature limit, and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (MODES 1 and 2) or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (MODES 3 and 4) for exceeding the low temperature limit. In addition, two new PSV loop seal temperature surveillance requirements are proposed to assist in assuring PSV operability.

2.0 PROPOSED CHANGE

The proposed changes would revise TS 3.4.10 as follows:

TS 3.4.10: New Condition A is added that states: uOne or more pressurizer safety valve(s) inoperable due to loop seal temperature being outside design limits." The Required Actions (and CTs) are "Restore valve(s) to OPERABLE status if loop seal temperature is: A.1 Above design limit (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), OR A.2 Below design limit in MODES 1 or 2 (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), OR A.3 Below design limit in MODES 3 or4 (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />)."

TS 3.4.10 current Condition A is relettered "B" and revised to state: "One pressurizer safety valve inoperable for reasons other than Condition A."

Required Action A.1 is relettered 'B.1."

TS 3.4.10 current Condition B is relettered UC" and the first sentence revised to state: "Required Action and Completion Time for Condition A or B not met."

The second sentence is revised to state: uTwo or more pressurizer safety valves inoperable for reasons other than Condition A." Required Actions B.1 and B.2 are relettered "C.1" and "C.2," respectively.

TS 3.4.10, Surveillances, are revised by adding new surveilla'nce requirements SR 3.4.10.2, "Verify loop seal temperatures are within limits,"

with a Frequency of 31 days, and SR 3.4.10.3, "Perform a CHANNEL 1

Enclosure 1 PG&E Letter DCL-04-180 CALIBRATION of each loop seal temperature instrument," with a Frequency of 24 months.

Enclosures 2 and 3 contain marked-up and retyped (clean) TS pages, respectively. Enclosure 4 contains TS Bases changes, for information only, that will be implemented pursuant to TS 5.5.14, 'Technical Specifications Bases Control Program," at the time this amendment is implemented.

3.0 BACKGROUND

PSV Loop Seal Function Loop seals are provided in the PSV inlet piping to maintain PSV body temperature below the vendor recommended limits. This prevents PSV seat leakage that can result from spring relaxation with increased temperature.

However, the water in the loop seals must be maintained at a minimum temperature to allow it to flash to steam when a PSV lifts. Because of the low density and low mass flow rate, PSV steam relief imposes minimal loading on the discharge piping ensuring acceptable pipe stresses. Conversely, if cooler water is maintained in the loop seals, it may not flash completely, and a water and steam mixture could be discharged when the PSV lifts. Because of the higher density and higher mass flow rate, PSV relief of water and steam would impose increased loading and could result in unacceptably high pipe stresses on the discharge piping which could render the PSVs inoperable.

Analysis and Operating History In November 1982, a Westinghouse piping analysis identified that the PSV loop seals needed to be at an elevated temperature to reduce downstream pipe loads during a PSV discharge. Therefore, loop seal insulation was designed and installed, and loop seal temperatures were verified during initial startup testing to meet the minimum value of 2600 F established by Westinghouse to assure PSV operability.

During subsequent plant operation, DCPP and the nuclear industry experienced PSV seat leakage and setpoint drift. Pacific Gas and Electric (PG&E) Company determined that a predominant factor for PSV setpoint drift was high nozzle loading which resulted from thermal expansion of the inlet piping containing the loop seals. A corrective action was to modify the loop seal insulation to decrease valve body and pipe support temperature while maintaining the minimum loop seal temperature.

Local temperature instrumentation was installed because of a concern regarding the potential loss of the loop seals as a result of PSV leakage. This instrumentation was used to ensure the loop seals were still present and that 2

Enclosure 1 PG&E Letter DCL-04-180 the PSVs remained operable. The instrumentation did not provide for remote continuous temperature monitoring.

In 1998, it was noted that loop seal temperatures for one of the Unit 1 PSVs and two of the Unit 2 PSVs were consistently below the minimum loop seal temperature requirement of 2600 F specified in the reactor coolant system (RCS) design criteria memorandum. An assessment was done to substantiate that the lower loop seal temperatures did not impact PSV operability, and to validate a new lower limit of 217'F. Periodic monitoring was initiated to verify adequate loop seal temperatures, and the operators were given instructions to immediately restore any loop seal temperature that dropped below this limit.

During this period, PG&E's focus was on maintaining minimum loop seal temperatures when the RCS was at steady state operating conditions.

However, on December 11, 1998, while investigating low PSV loop seal temperatures during a forced outage (Licensee Event Report (LER) 2-1998-005-00, dated December 31, 1998), PG&E engineers recognized that the minimum loop seal temperatures may not have been maintained during the heatup following a unit shutdown. PG&E engineers determined from a review of previous heatup data that on several occasions the loop seal temperatures were below 217 0F. PG&E reported this condition in LER 2-1998-006-00, dated January 19,1999, and provided supplemental information in LER 2-1998-006-01, dated July 23,1999. Controls were initiated to ensure that the loop seal temperature requirements would be met for all modes of applicability. Those controls require monitoring of loop seal minimum temperature prior to increasing RCS cold leg temperature above the low temperature overpressure protection (LTOP) arming temperature, and partial draining of the loop seals during heatup and cooldown, if required, in order to establish the proper PSV inlet temperature.

Upgrade of Power-Operated Relief Valves (PORVs)

The pressure relief capability for both units was recently enhanced by upgrading the Instrument Class II portion of the PORV automatic actuation circuitry to enable crediting automatic actuation of the PORVs for spurious operation of the safety injection (SI) system. The associated TS changes were issued as part of License Amendments 171 (Unit 1) and 172 (Unit 2),

dated July 2, 2004.

Purpose of Proposed Amendment The existing CT does not allow adequate time to correct the condition. In addition, the short time allowed challenges Operations personnel to evaluate plant conditions and prepare for unit shutdown in a controlled fashion.

3

Enclosure 1 PG&E Letter DCL-04-180 The design of the PSV loop seal drain valves did not anticipate the function of throttling at high differential pressures. The drain valves were designed for tight shutoff and to allow for draining when the system was depressurized.

The drain valves have developed leakage in the past when used for the partial draining of the loop seal piping. When leak-by conditions exist, they increase the loop seal temperatures and require additional monitoring by control room operators. Leaking valves have either been replaced or additional isolation valves have been added to minimize leakage. These corrective actions do not preclude further leakage developing in the future.

The volume of the loop seal is small, on the order of 8 gallons. There are no indications of loop seal level, other than loop seal temperature, which is a lagging indicator. At a differential pressure of 350 psid or higher, the potential for completely draining the loop seal exists. If this were to happen in a required mode, the PSV would be declared inoperable.

The proposed change will allow adequate time, and increased flexibility, for operators to return the loop seal temperature to within limits and avoid an unplanned shutdown or cooldown.

Risk-Informed Licensing Change This LAR represents a risk-informed licensing change. The proposed change meets the criteria of Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and RG 1.177, "An Approach for Plant-Specific, Risk-informed Decisionmaking: Technical Specifications," for risk-informed changes.

As discussed in RG 1.177, acceptable reasons for requesting TS changes fall into the following categories, all of which apply to this LAR:

Improvement to operational safety: A change to the TS can be made due to reductions in the plant risk or a reduction in the occupational exposure of plant personnel in complying with the TS requirements.

Consistency with risk basis in regulatory requirements: TS requirements can be changed to reflect improved design features in a plant or to reflect equipment reliability improvements that make a previous requirement unnecessarily stringent or ineffective. TSs may be changed to establish consistently-based requirements across the industry or across an industry group.

Reduce unnecessary burdens: The change may be requested to reduce unnecessary burdens in complying with current TS 4

Enclosure 1 PG&E Letter DCL-04-180 requirements, based on operating history of the plant or the industry in general. This includes extending CTs 1) that are too short to complete repairs when components fail with the plant at-power, 2) to complete additional maintenance activities at-power to reduce plant down time, and 3) provide increased flexibility to plant operators.

4.0. TECHNICAL ANALYSIS 4.1 Impact on Defense-In-Depth and Safety Margins In addition to discussing the impact of the changes on plant risk, the traditional engineering considerations need to be addressed. These include defense-in-depth and safety margins. The fundamental safety principles on which the plant design is based cannot be compromised. Design basis accidents are used to develop the plant design. These are a combination of postulated challenges and failure events that are used in the plant design to demonstrate safe plant response. Defense-in-depth, the single failure criterion, and adequate safety margins may be impacted by the proposed change and consideration needs to be given to these elements.

Impact on Defense-in Depth The proposed change needs to meet the defense-in-depth principle, which consists of a number of elements. These elements and the impact of the proposed change on each follow:

• A reasonable balance among prevention of core damage, prevention of containment failure and consequence mitigation is preserved.

The PSVs, in conjunction with the reactor protection system, provide overpressure protection for the RCS. The PSVs are designed to prevent system pressure from exceeding the system safety limit, 2735 psig, which is 110 percent of the design pressure. One or more PSVs with loop seal temperatures outside design limits will still lift on demand. The PSV discharge piping is designed to accept steam flow. Low loop seal temperature is a concern because discharge could result in water or water/steam mixture rather than steam entering the discharge piping causing damage. High temperature could cause the valve setpoint to drift low. Providing an extended CT for returning loop seal temperature to within limits has a small impact on Core Damage Frequency (CDF), a small impact on consequence mitigation, and a negligible impact on Large Early Release Frequency (LERF). The proposed change does not significantly degrade the ability of one barrier to fission product release and compensate with an improvement of another. The balance between prevention of core damage and prevention of containment failure and 5

Enclosure 1 PG&E Letter DCL-04-180 consequence mitigation is maintained. Furthermore, no new accidents or transients are introduced with the proposed change and the likelihood of an accident or transient is not impacted.

• Over-reliance on programmatic activities to compensate for weaknesses in plant design.

The plant design will not be modified with the proposed change. All safety systems, including the PSVs, will still perform their design functions, and there will be no additional reliance on additional systems, procedures, or operator actions. The calculated risk increase for the CT changes is very small and additional control processes are not required to be put into place to compensate for any risk increase.

• System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system.

In addition to the three PSVs required by TS 3.4.10 for RCS overpressure protection, TS 3.4.11 requires each PORV and associated block valve to be operable. The two Class I PORVs and one non-Class I PORV function to minimize challenges to the PSVs.

To provide redundant indication and alarms in the control room, each PSV loop seal line is provided with two temperature instruments. As part of this LAR, two new surveillance requirements are proposed for TS 3.4.10 requiring verifying loop seal temperatures are within limits every 31 days, and performance of a channel calibration every 24 months on the loop seal temperature instruments. These will provide added assurance of PSV operability.

There is no impact on the redundancy, independence, or diversity of the pressure relief components (PSVs and PORVs) or on the ability of the plant to respond to an RCS overpressure condition with diverse systems.

The redundant and diverse relief valve designs will not be changed. The relief valves are reliable components and will remain reliable after the proposed changes are implemented.

• Defenses against potential common cause failures are maintained and the potential for introduction of new common cause failure mechanisms is assessed.

Defenses against common cause failures are maintained. The CT extensions requested are not so significant that any new common cause failure mechanisms would occur. In addition, the operating environment 6

Enclosure 1 PG&E Letter DCL-04-180 for these components remains the same; therefore, new common cause failure modes are not expected. The number, design, and types of valves used for RCS overpressure protection remain the same with these changes so the overpressure protection system maintains the potential against common cause failures.

• Independence of barriers is not degraded.

The barriers protecting the public and the independence of these barriers are maintained. Assessment of maintenance activities per 10 CFR 50.65 ensures that multiple systems will not be out of service simultaneously during the extended CTs that could lead to degradation of these barriers, and an increase in risk to the public. In addition, the extended CTs do not provide a mechanism that degrades the independence of the fuel cladding, RCS, and containment barriers.

• Defenses against human errors are maintained.

No new operator actions related to the CT extensions are required to maintain plant safety. No changes to current operating, or maintenance procedures are required due to these changes. Two new surveillance requirements are proposed to ensure equipment reliability, but they are not expected to have any impact on operational errors. The increase in CTs provides additional time and flexibility to allow operators to establish the proper PSV inlet temperature without requiring an unplanned shutdown or cooldown.

Impact on Safety Margins One or more PSVs declared inoperable solely due to loop seal temperatures being outside design limits will still lift on demand. Low temperature is a concern because discharge could result in water or a water/steam mixture rather than steam entering the discharge piping causing damage. High temperature could cause the valve setpoint to drift low. However, in both cases, the PSVs will still lift to perform their safety function.

The PSVs fulfill the RCS overpressure protection function as required by the American Society of Mechanical Engineers (ASME) Code Section III, for all applicable Modes of operation. The DCPP design basis requirements for RCS overpressure protection are established in WCAP-7769 Rev. 1, 'Topical Report Overpressure Protection for Westinghouse Pressurized Water Reactors," June 1972, which documents the compliance with the overpressure protection requirements of the ASME Boiler and Pressure Vessel Code Section III NB-7300 and NC-7300. WCAP-7769 establishes the PSV relief capacity to be consistent with the ASME Section III requirement to 7

Enclosure 1 PG&E Letter DCL-04-180 maintain the RCS pressure less than 110 percent of the design value for the most limiting transient that occurs during normal operating conditions.

WCAP-7769 and the ASME Code Section III do not discuss or define Modes of operation as established in TS as a function of RCS temperature.

However, since the limiting RCS overpressure analysis is a loss of load / loss of normal feedwater event from full power operating conditions, this establishes Mode 1 as the limiting TS mode of operation with respect to relief capacity. Similarly, the PSV loop seal hydraulic load design and associated loop seal temperature requirements, are also established based on the maximum relief discharge capacity for a Mode 1 limiting loss of load / loss of normal feedwater event. Since the DCPP TS require that all three PSVs (and their associated loop seals) be operable in Modes 1 and Mode 2, the PSV relief capacity remains bounded by the WCAP-7769 analysis and meets the ASME Code requirements for these Modes.

In the unlikely event an actual RCS overpressure transient occurs, causing one or more PSVs to lift during a time loop seal temperatures are below design requirements, and the discharge piping is damaged, and the PSVs do not reseat, the resulting loss-of-coolant accidents (LOCA) will still be bounded by Final Safety Analysis Report Update (FSARU) accident analyses.

Therefore, the proposed change results in no impact on safety margins.

4.2 Assessment of Impact on Risk A probabilistic risk assessment (PRA) has been performed using the NRC's three-tier approach described in RG 1.177. The three tiers consist of:

Tier 1 - PRA Capability and Insights Tier 2 - Avoidance of Risk-Significant Plant Configurations, and Tier 3 - Risk-informed Configuration Risk Management 4.2.1 Tier 1: PRA Capability and Insights PRA Capability The scope, level of detail, and quality of the Diablo Canyon PRA (DCPRA) are sufficient to support a technically defensible and realistic evaluation of the risk change from this proposed CT extension. The DCPRA used in this evaluation addresses internal, seismic and fire events at full power. The internal and seismic models were used directly; the fire model required additional evaluation for the purpose of these calculations. The DCPRA is performed for Unit 1, but it is equally applicable to DCPP Unit 2 because the two units are essentially identical.

8

Enclosure 1 PG&E Letter DCL-04-180 The DCPRA is based on the original 1988 Diablo Canyon PRA that was performed as part of the long term seismic plan (LTSP). The DCPRA-1988 was a full scope Level 1 PRA that evaluated internal and external events.

The DCPRA was subsequently updated to support the Individual Plant Examination (IPE) (1991) and the Individual Plant Examination for External Events (IPEEE) (1993). Since 1993, several other updates have been made to incorporate plant and procedure changes, update plant specific reliability and unavailability data, improve the fidelity of the model, incorporate Westinghouse Owners Group (WOG) peer review comments, and support other applications, such as on-line maintenance and risk-informed in-service inspection.

Prior to the IPE submittal, the model was enhanced to include the probability of a loss of offsite power (LOOP) subsequent to non-LOOP initiating events.

Other improvements to the PRA model, since the IPE, that affect this submittal include:

• Incorporation of the sixth diesel generator installed in 1993

• Upgraded auxiliary saltwater system modeling to make it more consistent with the station blackout submittal

• Allowed credit for cross-tie of vital 4-kV buses (i.e., one diesel generator (DG) feeds loads on two vital buses)

• Added 500-kV switchyard model, to supplement 230-kV switchyard

• Added more detailed modeling for transient-induced LOCA from LOOP, including effects of the third PORV

• Updated initiating event frequencies to reflect data from NUREG-5750 The DCPRA was recently enhanced to support the analysis of the DG CT extension from 7 days to 14 days (once per cycle per DG). This extension was approved by License Amendments 166 (Unit 1) and 167 (Unit 2), dated April 20, 2004. The most significant change made was to the reactor coolant pump (RCP) seal LOCA model. The updated DCPRA now uses the Rhodes RCP Seal Model as defined in NUREG/CR-5167 "Cost/Benefit Analysis for Generic Issue 23: Reactor Coolant Pump Seal Failure," Appendix A, dated April 1991, to characterize the RCP seal performance on loss of cooling and seal injection. The Rhodes model has been accepted by the NRC.

The DCPRA includes an evaluation of containment performance. A simplified LERF model, based on the Level 2 PRA, is used for calculating LERF for internal, seismic and fire scenarios.

The DCPRA is a living PRA, which is maintained through a periodic review and update process.

9

Enclosure 1 PG&E Letter DCL-04-180 Peer review certification of the DCPRA, using the WOG Peer Review Certification Guidelines, was performed in May 2000. A team of independent PRA experts from U.S. nuclear utility PRA groups and PRA consultant organizations carried out this Peer Review Certification. This intensive peer review involved about two person-months of engineering effort by the review team and provided a comprehensive assessment of the strengths and limitations of each element of the PRA. On the basis of its evaluation, the Certification Team determined that, with certain findings and observations addressed, the quality of all elements of the PRA would be sufficient to support risk significant evaluations with defense-in-depth input relative to the requested CT extension. All of the findings and observations from this assessment, which the review team indicated were important or which involved risk elements that are needed to evaluate the proposed CT extension, were dispositioned. As a result, a number of modifications were made to the PRA model prior to its use to support these proposed changes.

A major enhancement was the reanalysis and updating of the pre and post initiating event human reliability assessments.

As a result of the sound basis of the original model as documented in NUREG-0675 (Supplemental Safety Evaluation Report (SSER) No. 34) and NUREG/CR-5726, the considerable effort to incorporate the latest industry insights into the PRA, self-assessments, and certification peer reviews, PG&E is confident that the results of the risk evaluation are technically sound and consistent with the expectations for PRA quality set forth in RG 1.177 and 1.174.

Fire and Other External Events A fire analysis was conducted as part of the original DCPP PRA (DCPRA-1988) The NRC reviewed the LTSP and issued SSER No. 34 accepting DCPRA-1988. The Fire PRAwas updated to support the 1993 IPEEE. Other than control room (CR) and cable spreading room (CSR) fire scenarios, the Fire PRA quantifies the CDF associated with most internal fire initiating events using the same linked event tree models as the internal and seismic events analyses. Separate event trees using conservative assumptions were developed for evaluating CR and CSR fire scenarios.

Based on a review of the fire initiators, it is judged that, other than the fire-induced LOOP initiating event, none of the other fire-induced initiating events would result in a primary side over-pressurization. The quantitative impact of these fire-induced LOOP events are incorporated into the values provided in the calculation file.

The evaluation of high winds, external floods, and other external events, which was done as part of the IPEEE, revealed no potential vulnerabilities.

10

Enclosure 1 PG&E Letter DCL-04-180 The proposed extension to the CT for the PSVs has negligible effect on the risk profile at DCPP from other external events.

RG 1.177 requires the evaluation of the proposed change on the total risk (i.e., on-line and shutdown risk). This evaluation only quantifies the risk associated with being either in Mode 1, 2, 3, or 4 with one or more inoperable PSVs, if the valves are inoperable solely due to loop seal temperatures being outside the design limits for a time period greater than that allowed by the current TS (15 minutes). This is conservative since the risk of the TS-driven shutdown is not used to balance the risk of the proposed extended CT.

Methodology The general methodology of evaluating the proposed change involves identifying the areas of concern relating to the PSV loop seal when in an out-of-specification (OOS) design limit condition and quantifying its impact on risk.

The areas of concern are creating a new initiating event (IE), an increase in the frequency of an existing IE(s), and impact on the consequence of an IE.

New IE Based on an engineering and transient analysis review, PG&E determined that an OOS loop seal temperature condition would not introduce a new IE.

Impact on the Frequency of an Existing IE The presence of the low PSV loop seal temperature condition during normal operation does not by itself lead to an accident or transient event and therefore has no impact on the frequency of an existing IE.

An elevated PSV body temperature due to a high loop seal temperature could cause valve spring relaxation and a change of the physical dimension of the valve components, which could lower the valve lift setpoint. The temperature effect on relief valve setpoint drift has been evaluated and the results indicate that a setpoint drift of 1 percent to 3 percent can be expected if the PSV loop seal temperature increases from a nominal operating temperature of 2500 F to an above design limit value of greater than 5000F. Considering a 3 percent setpoint drift (and 1 percent acceptable setpoint tolerance to the lower end per TS) the PSV lift point still has a sufficient margin above the normal operating RCS pressure. It is unlikely that a PSV would open inadvertently during normal operation, causing a reactor trip, safety injection or other existing IE.

11

Enclosure 1 PG&E Letter DCL-04-180 Impact on Consequences Low PSV loop seal water temperature is of concern if the PSVs are challenged to lift in response to a postulated RCS overpressurization and if the PORVs fail to relieve RCS pressure. Potential water hammer during PSV actuation could damage the PSV discharge piping and prevent the PSVs from reclosing. The consequence of such an event is a LOCA. The size of the LOCA depends on the number of PSVs that fail to reclose and the size of the opening. It is judged that assigning a medium break LOCA is the most realistic and conservative consequence on the basis that:

• Given a postulated RCS overpressurization event and subsequent PORV failure(s), the probability of a single PSV being challenged, opening and failing to reclose is expected to be much higher than that of multiple PSVs simultaneously failing to reclose.

• In this analysis it is assumed that the failure probability of a PSV to reclose is 1.0. Therefore the assumed consequence is conservative.

• The conditional core damage probability of a large LOCA is slightly higher than that of a medium LOCA (refer to Results and Conclusions, and Sensitivity Analysis, below). However, this slightly higher conditional core damage probability is offset by the conservative assumption that the probability of any PSV to fail to reclose is 1.0 (previous bullet).

• In the DCPP PRA model, more accident mitigating systems are required to function to mitigate the consequences of a medium LOCA than a large LOCA, particularly high pressure injection systems. An analysis based solely on a large LOCA, even though it provides a slightly higher risk estimate, would not account for the importance of the reliability of the additional mitigating systems required for a medium LOCA.

High PSV loop seal temperature is of concern if the PSVs are challenged before the PORVs in response to a postulated RCS overpressurization due to the PSV setpoint drifting below the PORVs. Under such a scenario, there is a potential for a PSV to fail to reseat after initial opening. Unlike a PORV, which has a corresponding upstream isolation valve, a failed open PSV is unisolable and would constitute a LOCA. Similar to the low loop seal temperature case, the most realistic and conservative LOCA is considered a medium LOCA. As discussed above, with about 4 percent setpoint drift (3 percent drift due to temperature and 1 percent for TS acceptable tolerance to the lower end of the setpoint), the PSV lift point will be just above the setpoint of the PORVs. It is judged that there is an about equal probability for either a PSV or a PORV initially being challenged during a RCS overpressurization event.

12

Enclosure 1 PG&E Letter DCL-04-180 For a PSV to lift, a rapid or unchecked heat (power) input or mass increase to the RCS is required. The impact of such events on risk was evaluated and quantified using the following steps.

1) Review the internal seismic and fire initiating events to identify initiators that could result in RCS pressurization and consequential PSV challenge at each applicable operating Mode (i.e., 1, 2, 3 or 4).

2) a) For the low PSV loop seal temperature case, calculate the probability of the PORVs not being available or failing to relieve the RCS pressure following the initiating events identified in Step 1.

b) For the high PSV loop seal temperature case, calculate the probability of a PSV failure to reseat after initial opening to relieve the RCS pressure following the initiating events identified in Step 1.

3) Develop PRA models to reflect the scenarios postulated in Step 2, which could lead to a medium LOCA IE.

4) Run the models to calculate the increase in CDF and LERF contribution due to a stuck open PSV and resulting medium LOCA event.

5) Calculate the risk impact of the proposed change using the RG 1.177 risk metrics described below and compare them to the acceptance criteria.

Risk Metrics ACDFAVE = change in the annual average CDF due to any potential increased unavailability of PSVs that could result from the increased CT for PSVs. This risk metric is compared against the criteria of RG 1.174 to determine whether a change in CDF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFBASE.

ALERFAVE = change in the annual average LERF due to any potential increased unavailability of PSVs that could result from the increased CT for PSVs. Similar to ACDFAVE, RG 1.174 criteria were also applied to judge the significance of changes in this risk metric.

ICCDP = incremental conditional core damage probability with PSV(s) out of service for an interval of time equal to the proposed CT (i.e., 12, 24, or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />). This risk metric is used as suggested in RG 1.177 to determine whether a proposed CT has an acceptable risk impact.

13

Enclosure 1 PG&E Letter DCL-04-180 ICLERP = incremental conditional large early release probability with PSV(s) out of service for an interval of time equal to the proposed CT. Similar to ICCDP, RG 1.177 criteria were also applied to judge the significance of changes in this risk metric.

The above risk metrics were quantified using the equations provided below.

Change in CDF/LERF The change in the annual average Unit 1 CDF, ACDFAVE, was evaluated by computing the following equation. Note, that since the DCPRA model applies to both Unit I and 2, the results of the following calculations apply to both units:

ACDFAvE = TLoOS x(CDFOOs - CDFBASE) (Equation 1) where the following definitions apply:

(OEA= Annualized fraction of time that PSV is expected to be unavailable as a result of the increased CT.

Toos= Additional time per year (TyIR)that PSV is expected to be unavailable as a result of the increased CT.

CDFOOS= Annual average CDF with the PSV loop seal OOS.

CDFBASE= Baseline annual average CDF with average unavailability of PSVs consistent with the current TS CT. This is the CDF resulting from the current baseline DCPRA for Unit 1.

(CDFOOs - CDFBAsE) = Change (i.e., increase) in CDF due to the PSV loop seal being OOS for a whole year.

A similar approach was used to evaluate the change in the average LERF (ALERFAVE).

ALERFAVE = TOO' x (LERFOOs -LERFBAsE) (Equation 2) 4 E= YEAR 14

Enclosure 1 PG&E Letter DCL-04-180 where the following definitions were applied:

LERFOOs = LERF evaluated from the PRA model for Unit 1 with PSVs unavailable.

LERFEAsE =Baseline annual average LERF with average unavailability of PSVs consistent with the current TS CT. This is the LERF result of the current baseline DCPRA.

(LERFOOs-LERFBAsE) = Change (i.e., increase) in LERF due to the PSV loop seal being OOS for a whole year.

Incremental Conditional Probabilities The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using their definitions in RG 1.177. The ICCDP values are dimensionless probabilities used to evaluate the incremental probability of a core damage event over a period of time equal to the extended CT. This should not be confused with the evaluation of ACDFAVE, in which the CDF is based on expected unavailability. However, the endstate frequencies used to calculate ICCDP/ICLERP are the same as those used to calculate the change in CDF/LERF as described in the previous section.

The ICCDP is calculated by multiplying the change in CDF by the proposed TS CT. Therefore, ICCDP= (CDFOOS - CDFBAsE)x CT (Equation 3)

Similarly, ICLERP is defined as follows.

ICLERP = (LERFIs - LERFBAsE)x CT (Equation 4) where CT is the proposed TS CT (i.e., 12, 24, or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />).

Assumptions/Assertions

1. The extended TS CT would be used to get the loop seal temperature within the design limit by taking compensatory/corrective measures.

2. In Modes 1 and 2, the low loop seal temperature condition will be most likely resolved by changing the containment fan cooling unit (CFCU) configuration and allowing loop seal temperatures to stabilize or by manual draining of affected loop seal(s) to thermally agitate the water seal. The expected (or realistic) time for being outside design limits was 15

- Enclosure I PG&E Letter DCL-04-180 estimated to be 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, which includes changing the CFCU configuration and allowing temperatures to stabilize while preparing for a containment entry, manual draining of affected loop seals, and allowance for temperature stabilization. Based on previous experience, this low loop seal temperature condition is not expected to occur more than once per year. Therefore the expected mean outage time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> per year is a reasonable estimate.

In Modes 3 and 4, it is expected to take longer to raise the seal temperature above the low limit because of low pressurizer steam temperature, greater heat loss to the containment atmosphere, and potential multiple entries to the containment for draining of the loop seal(s). The expected time to restore the required loop seal temperature was estimated to be 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Between two units, an average of one Mode 3 or 4 shutdowns per year is expected. The expected mean outage time is therefore 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> per year.

3. In Modes 1 and 2, the combined frequency of all anticipated transients without scram (ATWS) initiating events is on the order of 1E-08 based on the nominal reactor trip failure probability of 1E-05 and the manual trip failure probability of 6.8554E-04. Even with a very conservative assumption of a conditional core damage probability (CCDP) value of 1.0 for the ATWS events, its CDF contribution compared to that of the stuck open PSVs is small. Therefore the ATWS events are not considered in this analysis.

4. The calculations for change in CDF conservatively neglect the decrease in the CDF contribution that would result from avoiding a TS-driven shutdown required by the current TS CT.

5. In Modes 3 and 4, all PRA-credited components, with the exception of the turbine-driven auxiliary feedwater (TDAFW) pump, would be available.

The TDAFW pump is expected to be undergoing testing, which starts in Mode 4.

6. In Mode 4 and before reaching 1000 psig in the primary side, the accumulators are isolated (i.e., they will not automatically actuate).

However, since accumulators are not credited in this analysis (i.e., the CCDP for a medium LOCA is not affected by accumulator availability), the impact of their automatic actuation is not significant.

7. In Mode 3 and before reaching 1915 psig in the primary side, the automatic pressurizer low-pressure Si signal and the low steamline pressure Si signals are blocked. This analysis uses the CCDP for the at-power scenarios. Therefore, the reduction in the reliability of the Si actuation (due to SI actuation blocking) is judged to be compensated by the decrease in the human error probability (HEP) for manual actuation since (due to lower pressure and temperature) there is more time 16

Enclosure 1 PG&E Letter DCL-04-180 available for operator actuation. However, conservatively the HEP estimate is not changed for this evaluation.

8. In Modes 3 and 4 during startup, the reactor is already in a subcritical condition and there is no potential ATWS, so there is no risk impact.

9. In Modes 3 and 4, the DCPP at-power PRA model asserts that the LOOP and the load-rejection-failure initiating events also result in primary side pressurization. However, in Modes 3 and 4 with the rods inserted, the LOOP initiator does not result in RCS pressurization and the load-rejection-failure initiator does not apply.

10. In Modes 3 and 4, the uncontrolled rod cluster control assembly withdrawal, uncontrolled boron dilution, and loss of feedwater do not cause sufficient power or mass increase to challenge the PSVs because there is sufficient time for operators to diagnose and correct these conditions.

11. In Modes 3 and 4, the inadvertent closure of one or all of the main steam isolation valves (MSIVs) cannot cause a sufficient heat increase to challenge the PSVs without failures of additional equipment such as 10 percent steam dump valves and main steam safety valves.

12. It is assumed that the typical outage duration (i.e., Modes 5, 6 and no mode) is approximately 34.3 days (based on the data from the last 5 refueling outages) and that between Units I and 2 on average there is one refueling outage per year. Therefore the average duration that a unit is in Modes 1 through 4, T.R, is 330.7 days (365 - 34.3 = 330.7) or 7937 hours0.0919 days <br />2.205 hours <br />0.0131 weeks <br />0.00302 months <br />. The unit unavailability contribution from non-refueling outages is typically small and not accounted for.

13.A high PSV loop seal temperature condition (>5000 F) could only occur when the RCS is at or near its normal operating temperature in Modes 1, 2 and 3. A review of the PSV loop seal operating experience at DCPP shows that there have been two high temperature OOS incidents in the last 4 years for both units. On this basis, an expected mean outage time of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> per year is assumed.

14.An OOS high loop seal temperature (i.e., >500'F) could cause a setpoint of a PSV to drift to near but still above the setpoint of the PORVs. An equal probability for either a PSV or a PORV initially being challenged during a RCS overpressurization event is assumed.

15. PG&E performed an informational analysis using the DCPP RETRAN loss of load model for a loss of offsite power, turbine trip and the immediate reactor trip event. This was judged to be the most limiting heat input event 17

Enclosure 1 PG&E Letter DCL-04-180 to RCS pressure challenging a PSV. The results of the analysis showed that one PORV was sufficient to prevent any challenge to a PSV.

If the reactor does not trip immediately (with a 2 second delay) as assumed in the analysis, it is likely that even with the successful manual reactor trip by operators, the PORVs could not prevent an RCS over pressurization and a challenge to a PSV. The frequency of a PSV being challenged due to the failure of the automatic reactor trip function (1E-05) is small as compared to that due to the failure of the PORVs upon a successful reactor trip (5E-03). Therefore as a bounding assumption, the failure probability of a PORV to open is used to cover all successful reactor trip sequences. The ATWS events are screened out based on their low frequency (Assumption No. 3).

Input

1. The expected mean PSV outage time due to a low loop seal temperature OOS condition, Toos, is 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> per year in Modes l and 2, and 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> per year in Modes 3 and 4.

2. The expected mean PSV outage time due to a high loop seal temperature OOS condition is 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> per year in Modes 1, 2, and 3.

3. The typical duration of each operating mode is estimated based on the actual duration data from the last 5 outages. The Mode 2 duration during a shutdown is not readily available and is substituted with the startup Mode 2 duration.

Mode Duration Time Fraction (TF)

(hours) 1 7728 0.8822 2 88 0.0105 3 24 0.00274 4 97 0.01107 others 823 0.0935 Calculation

1) Identify initiators that could result in RCS overpressurization.

All internal, fire and seismic initiators were reviewed to identify those that could have the potential to challenge PSVs due to a rapid or unchecked heat (power) input or mass increase to the RCS.

18

Enclosure 1 PG&E Letter DCL-04-180 Mode 1 Based on review of initiators and the assumptions discussed in previous section, the following lEs have been identified as having the potential to challenge PSVs in Mode 1.

• core power excursion

• LOOP (including fire-induced)

• load rejection

• steam line break

• loss of main feedwater

• inadvertent Si

• inadvertent closure of one MSIV

• inadvertent closure of all MSIVs

• all ATWS lEs (The ATWS lEs are not included in the calculation because of their minor contribution to the CDF as discussed in Assumption No. 3)

Mode 2 All the initiating events identified for Mode 1 are applicable in Mode 2, except all ATWS events for the same reason discussed above.

Modes 3 and 4 The following lEs have the potential to challenge PSVs in Modes 3 and 4.

• steam line break

• inadvertent Si 2a) For the low loop seal temperature case, calculate the probability of the PORVs not being available or failing to relieve the RCS pressure.

This is the probability that the pressurizer PORVs are not available or fail to relieve pressure following the lEs listed above. The only planned activity that removes the PORVs from service is functional testing following transition from the LTOP mode of operation to normal operation. However, this test contains a precaution that only one PORV be tested at a time. The test sequence closes the block valve, manually strokes the PORV, and then reopens the block valve. Additionally, the test is accomplished in a very short period of time.

The minimum number of PORVs required to prevent the challenge to the PSVs depends on available decay heat, type of initiating events, 19

Enclosure 1 PG&E Letter DCL-04-180 availability of other accident mitigation structures, systems, and components (SSCs), etc. As discussed in Assumption No. 15, one PORV is sufficient for most accident initiators and scenarios to prevent the challenge to a PSV.

Some accident scenarios however would require more than one PORV to prevent the challenge to a PSV, while some would challenge a PSV regardless of the availability of the PORVs. These accident scenarios involve a combination of the events and conditions such as a LOOP, failed or delayed reactor trip, and a loss or degradation of the secondary heat removal function, or failure to terminate an inadvertent Si with a LOOP. The frequency of such scenarios is judged to be small (i.e., in orders of 1E-05) as compared to that of the scenarios which challenge a PSV solely due to the failure of a PORV to open (i.e., 5E-03). Instead of using two different frequencies/probabilities of a PSV being challenged for different sets of scenarios, the PORV failure probability, which is more limiting (i.e., bounding) value, is applied to all accident initiators and scenarios.

Therefore, The probability of the PSVs being challenged, Psvc, is calculated by as follows:

PSVC = PPORV Where, PpoRv is the probability of a PORV failing to open; at least 2 PORVs are available.

Note that the PORV failure to reclose is not addressed here since this failure mode does not impact the PSV condition of concern.

2b) For the high loop seal temperature case, calculate the probability of a PSV failure-to-reseat after initial opening.

EPRI Technical Report, 1011047, "Probability of Safety Valve Failure-to-Reseat Following Steam and Liquid Relief', provides the most recent estimation of a PSV failure-to-reseat probability.

At DCPP the inlet-piping configuration of a PSV includes the loop seal, of which temperature is above 5000 F for this analysis. The initial discharge medium through a PSV should depend on types of the initiators. The initiators involving a thermally induced RCS overpressurization event would likely result in a discharge of steam, while rapid and unchecked high pressure emergency core cooling 20

Enclosure I PG&E Letter DCL-04-180 system (ECCS) injection events could lead to an initial discharge of liquid via a PSV. For most initiating events, the degree of subcooling during a liquid discharge is judged to be less than 1000 F.

Based on the EPRI data, and DCPP PSV configuration for liquid relieving initiating events, the failure probability is estimated as follows:

Pliuid Pliquid FirstRelief +Pliquid SubsquentReliefs

= 2.52E-02 + 5.OE-03

= 3.OE-02 Similarly, for the steam relieving initiating events, the failure probability is estimated as follows:

steam steam-firelief steam SubsquentReliefs

=2.2E-02 + 1.6E-03

=2.36E-02 These failure-to-reseat probabilities of the PSVs are reduced by half to reflect the assumption that only about 50 percent of RCS overpressurization events would lead to a challenge to the PSVs (Assumption No. 14).

3) PRA model development In 2002, Model DEGLAR was developed based on the DCPP baseline model for the DG CT extension from 7 days to 14 days. DEGLAR is updated with the most current database. The top events and top event based initiators are re-quantified and a new master frequency file is created. The base model was further modified to reflect the postulation that a PSV with its loop seal temperature in OOS condition would fail to reclose if challenged and consequently it would result in a medium LOCA.

The result of this model represents an increase in the CDF and LERF (i.e., ACDF or ALERF) due to the medium LOCA induced by stuck open PSVs.

4) Calculate the change in CDF and LERF using the PSV models.

The PSV model is an "at-power" model with normal power operation SSC configuration and average test and maintenance unavailability. In Modes 1 and 2, all PRA credited components are assumed to be available.

21

Enclosure 1 PG&E Letter DCL-04-180 As stated in Assumption No. 5, in Modes 3 and 4 the TDAFW pump is expected to be undergoing testing and assumed to be unavailable.

However, the impact of the unavailable TDAFW pump is insignificant as the medium LOCA caused by stuck open PSVs implies the feed-and-bleed method as the primary decay heat removal mechanism. The CCDP in Modes 3 and 4 is similar to that in Modes 1 and 2. The difference in the CDF/LERF between the operating modes, as shown below, primarily comes from the difference in the set of the initiating events considered in such modes.

Applicable Model Name ACDF ALERF Modes Low Loop 1 and 2 PSVL1 2 1.3384E-04 5.3424E-08 Seal Temp 3 and 4 PSVL34 1.1278E-05 2.2033E-09 High Loop 1 and 2 PSVH12 3.2537E-04 1.2848E-07 Seal Temp 3 and 4 PSVH34 3.4076E-05 6.6771 E-09 Note: As discussed above, the results of these model runs represent incremental risk contribution due to a failure of a PSV to reseat.

5) Calculate the RG 1.174 and 1.177 Risk Metrics Change in CDF/LERF Using Equations 1 and 2, the changes in the annual average CDF and LERF are calculated as follows:

ACDFA VE = ACDFLOwTempOOS +ACDFHighTempOOS

[AC odesl and2 fodes3and4 LowTempOOS

[XCDFfodesIand2 + ACDFAWI 3 ]HighTempOOS

= [{( TOOS x ACDF]+ T+o x ACDF1 +

TYEAR Afodesland2 YEAR AJodes3and4 Low~empOOS E{(Too0 TYER x ACDF}

Mfodes Iand 2

+ f( ToOs YATR

)xACDF1 ]

Afode3 High empOOS

= 12hr x 1 .3 3 8 4 E -04 +(4 )x 11278E 05s +

XI37937hr) 4E 7 937hr) J LowTempOOS 3/zr (3/zr1

.737hr hrJ x 3.2537E -04 + 7937hr x 3.4076E -

t7E 05 S High-empoos

=4.06E - 07 22

Enclosure 1 PG&E Letter DCL-04-180 Similarly, by substituting ALERF in place of ACDF, ALERFAVE = ALERFITwrempoos + ALERFHighTempOOS (12h ) x 5.3424E - 08 + 48/zr )x2.2033E -091 +

=t7937hr) 7937hr) JLoTempOOS

___ __ ( 3 /zr I )x1.2848E-07+ 3 Ix6.6771E-09 7937hrj 7937zrgempOOS

=1.45E-10 Incremental Conditional Probabilities (ICP)

The ICPs are calculated based on Equations 3 and 4 with an additional parameter, TF, which is introduced to account for the difference in the duration of applicable operating modes. The values of TF are estimated in the Input section above.

Loop Seal Low Temperature OOS ICCDP = ACDF x [CT x TF]fodes land 2 + A CDF x [CT xTF fodes3and4

= 1.3384 E - 04 x (24hr) x ( ly )x (o. 8822 +o0.oios) +

8760 hr)

= 3.29E - 07 Similarly, ICLERP = ALERF x [CT x TF ]Ifodesand2 + ALERP x [CT x TF ]lkfodes3and4

= 5.3424E - 08 x (24hr) x lyr)x (0-8822+0.0105)+

2.2033E-09 x (72/zr) x( 8760h )x (0.00274 + 0.01107)

=1.31E-10 23

Enclosure 1 PG&E Letter DCL-04-180 Loop Seal High Temperature OOS ICCDP= ACDF x [CT x TF lodesland2 + ACDF x [CT x TF ]Wfode3

=32537E-04x(12r)8760h x (o.8822+0.0105)+

3.4076E -05 x (12hr)x (yr ) xO.00274

~8760hzr)

=3.98E- 07 ICLERP = ALERF x [CTx TF ].f1odes and2 + ALERF x [CT x TF L.1ode3

= 1.2848E -07 x (12hr)x (lyr ) (0-8822+0-0105)+

(8760hr) 6.6771E -09 x(12hzr)x lI1r Dx 0.00274

= 1.57E-10 Results And Conclusion The table below lists the results of the risk metrics along with their RG 1.174 and RG 1.177 acceptance criteria.

OQS RG 1.174/1.177 Results Condition Risk Metric Acceptance Based on Criteria Medium LOCA Low and ACDFAVE 1.OE-06 4.06E-07 High Loop Seal Temp.

Low and ALERFAvE I.OE-07 1.45E-1 0 High Loop Seal Temp.

Low Loop ICCDP 5.OE-07 3.29E-07 Seal Temp. ICLERP 5.OE-08 1.31 E-10 High Loop ICCDP 5.OE-07 3.98E-07 Seal Temp. ICLERP 5.OE-08 1.57E-10 The calculated risk metric values based on medium LOCA scenarios are all within acceptable limits and therefore from the risk informed perspective, the proposed change to the CT for the PSVs has a small impact on overall plant risk.

24

Enclosure 1 PG&E Letter DCL-04-180 Sensitivity Analysis The risk metric results based a large LOCA are provided below for comparison. As expected, assuming a large LOCA for the cases of multiple PSVs failing results in a slightly higher estimated risk. However, the difference is small and the conclusion of this analysis is not affected.

QOS RG 1.174/1.177 Results Condition Risk Metric Acceptance Based on Criteria Large LOCA Low and ACDF4f 1.OE-06 4.23E-07 High Loop Seal Temp.

Low and ALERFvE1 I.OE-07 1.45E-1 0 High Loop Seal Temp.

Low Loop ICCDP 5.OE-07 3.40E-07 Seal Temp. ICLERP 5.OE-08 1.31 E-10 High Loop ICCDP 5.OE-07 4.12E-07 Seal Temp. ICLERP 5.OE-08 1.57E-10 Risk Insights The following risk insights are observed during the analysis and review of the results. Some insights are provided to emphasize the key assumptions/assertions used in the analysis.

• The most risk significant loop seal configuration is a PSV being out of service due to a high loop seal temperature in Modes 1 and 2.

• An increase of the loop seal temperature from normal 2500F to above 500'F could lower the lift setpoint of a PSV by about 3 percent (4 percent if it includes 1 percent for the TS allowed setpoint uncertainty). This brings the PSV setpoint close to that of the PORVs. Under such condition, a PSV could be challenged before the PORVs during an RCS overpressurization event.

• Any maintenance or testing activities that could significantly affect the RCS pressure relief function (e.g., PORV testing or maintenance) or the RCS inventory control functions (e.g., high pressure ECCS injection) should be minimized while the PSV loop seal temperature is OOS.

25

Enclosure 1 PG&E Letter DCL-04-180

• Operations should continue with the current practice of addressing the PSV loop seal low temperature condition; quickly reestablish the temperature within limits by reconfiguring the CFCU cooling units and/or bleeding off the loop seal piping.

• Any activities that could result in an inadvertent SI should not take place while any PSV loop seal temperature is OOS.

4.2.2 Tier 2: Avoidance of Risk-Significant Plant Configurations The objective of the second tier, which is applicable to CT extensions, is to provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when equipment is out of service. If risk-significant configurations do occur, then enhancements to TSs or procedures, such as limiting unavailability of backup systems, increased surveillance frequencies, or upgrading procedures or training, can be made that avoid, limit, or lessen the importance of these configurations.

The potential configurations that should be avoided while the PSVs are out of service due to their low loop seal temperature are 1) more than one inoperable PORV, 2) loss of RCS inventory control capability for a medium LOCA (e.g., more than two high pressure injection ECCS pumps out of service), and 3) activities that may result in a LOOP or inadvertent SI.

Adhering to the current TS requirements and procedures will prevent these types of risk-significant configurations from occurring. Therefore, there is reasonable assurance that risk-significant plant equipment configurations will not occur when PSV loop seal temperatures are OOS using the proposed TS changes. No other changes to the TSs or procedures, or any compensatory actions, are required as the result of this proposed LAR.

4.2.3 Tier 3: Risk-informed Configuration Risk Management The objective of the third tier is to ensure that the risk impact of out of service equipment is evaluated prior to performing any maintenance activity. As stated in RG 1.177, "a viable program would be one that is able to uncover risk-significant plant equipment outage configurations as they evolve during real-time, normal plant operation." The third-tier requirement is an extension of the second-tier requirement, but addresses the limitation of not being able to identify all possible risk-significant plant configurations in the second-tier evaluation.

DCPP has developed a process for online risk assessment and management.

Following the process and procedures ensures that the risk impact of equipment unavailability is appropriately evaluated prior to performing any maintenance activity or following an equipment failure or other internal or 26

Enclosure I PG&E Letter DCL-04-180 external event that impacts risk. DCPP Administrative Procedure AD7.DC6, "On-Line Maintenance Risk Management," provides guidance for managing safety function, probabilistic, and plant trip risks as required by 10 CFR 50.65(a)(4) of the Maintenance Rule. The procedure addresses risk management practices in the maintenance planning phase and maintenance execution (real time) phase for Modes 1 through 4. Appropriate consideration is given to equipment unavailability, operational activities such as testing, and weather conditions.

In general, risk from performing maintenance on-line is minimized by:

• Performing only those preventive and corrective maintenance items on-line required to maintain the reliability of SSCs.

• Minimizing cumulative unavailability of safety-related and risk-significant SSCs by limiting the number of at-power maintenance outage windows per cycle per train/component.

• Minimizing the total number of SSCs out of service at the same time.

• Minimizing the risk of initiating plant transients (trips) that could challenge safety systems by implementing compensatory measures.

• Avoiding higher risk combinations of out of service SSCs using PRA insights.

• Maintaining defense-in-depth by avoiding combinations of out of service SSCs that are related to similar safety functions or that affect multiple safety functions.

• Scheduling in train/bus windows to avoid removing equipment from different trains simultaneously.

In general, risk is managed by:

• Evaluating plant trip risk activities or conditions and mitigating them by taking appropriate compensatory measures and/or ensuring defense-in-depth of safety systems that are challenged by a plant trip.

• Evaluating and controlling risk based on probabilistic and key safety function defense-in-depth evaluations.

• Implementing compensatory measures and requirements for management authorization or notification for certain "high-risk" configurations.

Actions are taken and appropriate attention is given to configurations and situations commensurate with the level of risk as evaluated using AD7.DC6.

This occurs both during planning and real time (execution) phases.

For planned maintenance activities, an assessment of the overall risk of the activity on plant safety, including benefits to system reliability and performance, is currently performed and documented per AD7.DC6 prior to scheduled work. Consideration is given to plant and external conditions, the 27

Enclosure 1 PG&E Letter DCL-04-180 number of activities being performed concurrently, the potential for plant trips, and the availability of redundant trains.

Risk is evaluated, managed and documented for all activities or conditions based on the current plant state:

• Before any planned or emergent maintenance is to be performed.

• As soon as possible when an emergent plant condition is discovered.

• As soon as possible when an external or internal event or condition is recognized.

Compensatory measures are implemented as necessary and if the risk assessment reveals unacceptable risk, a course of action is determined to restore degraded or failed safety functions and reduce the probabilistic risk.

4.2.4 Conclusion The acceptability of the proposed CT extension for the PSVs is based upon both a deterministic evaluation and a risk-informed assessment. The risk assessment concluded that the increase in plant risk is small and consistent with the USNRC "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement" as interpreted by NRC Regulatory Guides 1.174 and 1.177.

To ensure the proposed extension of the PSV CT does not degrade operational safety over time, should the PSVs not meet their performance criteria, an evaluation is required as part of the maintenance rule. The evaluation will include prior related TS changes in its scope and appropriate corrective action will be taken including a change to the TS if necessary.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration PG&E has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, !'Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

This proposed change revises Technical Specification (TS) 3. 4.10, "Pressurizer Safety Valves," to add a separate Action and associated Completion Times (CTs) for one or more inoperable pressurizer safety 28

Enclosure 1 PG&E Letter DCL-04-180 valves (PSV) for the condition where the valves are inoperable solely due to loop seal temperatures being outside of design limits.

Currently, when a PSV is in such a condition, it is conservatively declared inoperable and TS 3.4.10 Condition A is entered which has a CT of 15 minutes. A CT of 15 minutes normally provides insufficient time for restoring a PSV loop seal temperature to within limits. The new Action will provide CTs of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for exceeding the high temperature limit and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (MODES 1 and 2) or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (MODES 3 and 4) for exceeding the low temperature limit. In addition, two new PSV loop seal temperature surveillance requirements are proposed to assist in assuring PSV operability.

Loop seals are provided in the PSV inlet piping to maintain PSV body temperature within vendor recommended limits. This prevents PSV seat leakage that can result from spring relaxation with increased temperature. However, the water in the loop seals must be maintained at or above a minimum temperature to allow it to flash to steam when a PSV lifts. Because of the low density and low mass flow rate, PSV steam relief imposes minimal loading on the discharge piping ensuring acceptable pipe stresses. However, if cooler water is maintained in the loop seals, it may not flash completely, and a water and steam mixture could be discharged when a PSV lifts. Because of the higher density and higher mass flow rate, PSV relief of water and steam could impose increased loading and could result in unacceptably high pipe stresses on the discharge piping which could render the PSVs inoperable and/or damage the discharge piping.

The concern with the PSV opening during liquid relief conditions or with the loop seal temperature outside design limits, is the ability to ensure the valve reseats properly and no leakage occurs after the valve closes. However, even under liquid relief conditions, PSVs are still capable of providing their required relief capacity.

Failure of the PSV to reseat following discharge would result in an unisolable reactor coolant system leak. The consequences of such a leak are bounded by existing Final Safety Analysis Report Update (FSARU) accident analyses. Probabilistic risk assessment methods and a deterministic analysis have been utilized to determine there is no significant increase in core damage frequency or large early release frequency.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

29

Enclosure 1 PG&E Letter DCL-04-180

2. Does the proposed change create the possibility of a new or different accident from any accident previously evaluated?

Response: No.

Failure of one or more PSVs to.reseat following discharge would result in an unisolable reactor coolant system leak. The consequences of such a leak are bounded by existing FSARU accident analyses and no new failure modes are introduced.

Therefore, the proposed change does not create the possibility of a new or different accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change is based upon both a deterministic evaluation and a risk-informed assessment.

The deterministic evaluation concluded that even with the loop seal temperature outside of design limits, causing one or more PSVs to be declared inoperable, the PSVs would still lift on demand to perform their safety function. Failure of one or more PSVs to reseat following discharge, resulting in an unisolable reactor coolant system leak, is an event bounded by existing FSARU accident analyses.

The risk assessment performed to support this license amendment request concluded that the increase in plant risk is small and consistent with the NRC's Safety Goal Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p. 42622, August 16, 1995 and guidance contained in of Regulatory Guides (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998.

Together, the deterministic evaluation and the risk-informed assessment provide high assurance that the PSVs will meet their design requirements.

30

Enclosure 1 PG&E Letter DCL-04-180 Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above evaluation, PG&E concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of uno significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria General Design Criterion 10 - Reactor design. The reactorcore and associated coolant, control, and protection systems shall be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.

General Design Criterion 15 - Reactor coolant system design. The reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences.

TS 3.4.10 requires three PSVs to be operable in Modes 1, 2, and 3, and portions of Mode 4 above the LTOP arming temperature. Mode 3 and portions of Mode 4 are conservatively included, although the design basis accidents in these modes may not require all three safety valves for protection.

As discussed above, PSVs fulfill the RCS overpressure protection function as required by the ASME Code Section 1II, for all applicable Modes of operation. Failure of one or more PSVs to reseat following discharge would result in an unisolable reactor coolant system leak.

The consequences of such a leak are bound by existing FSARU accident analyses.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security, or to the health and safety of the public.

31

Enclosure 1 PG&E Letter DCL-04-180

6.0 ENVIRONMENTAL CONSIDERATION

PG&E has evaluated the proposed amendment and has determined that the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types, or significant increase in the amounts, of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

7.0 REFERENCES

1. PG&E Letter DCL-02-115, License Amendment Request (LAR) 01-08, "Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves; Pressurizer Safety Valve Loop Seal Temperature," dated September 24, 2002

2. PG&E Letter DCL-03-152, Response to NRC Request for Additional Information Regarding License Amendment Request 01-08, "Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves; Pressurizer Safety Valve Loop Seal Temperature," dated November 21, 2003

3. PG&E Letter DCL-04-022, Supplement 1 to License Amendment Request 01-08, "Credit for Automatic Actuation of Pressurizer Power Operated Relief Valves," dated March 4, 2004

4. "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p.42622, dated August 16, 1995

5. NRC Regulatory Guide 1.177, uAn Approach for Plant-Specific Risk-Informed Decisionmaking: Technical Specifications," August 1998

6. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment In Risk-informed Decisions On Plant-Specific Changes to the Licensing Basis, July 1998 32

Enclosure 2 PG&E Letter DCL-04-180 Proposed Technical Specification Page (Mark-up)

Pressurizer Safety Valves 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves LCO 3.4.10 Three pressurizer safety valves shall be OPERABLE with lift settings 2 2460 psig and

• 2510 psig.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 with all RCS cold leg temperatures > Low Temperature Overpressure Protection (LTOP) arming temperature specified in the PTLR.

__ _- _ _ -- _ - -_M-- - -

- , M v, T -- -_~

_ _____ c__

The lift settings are not required to be within the LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions. This exception is allowed for 54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

for reasons other than Condition A I..-

REQUIRED ACTION COMPLETION TIME A.1 Restore valve to 15 minutes OPERABLE status.

Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Be in MODE 4 with any 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> RCS cold leg temperatures < LTOP arming temperature specified in the PTLR.

'I for reaonns nther fh:nrnnditinn A SURVEILLANCE REQUIREMENTS I .... -v.I. _ ... I SURVEILLANCE FREQUENCY SR 3.4.10.1 Verify each pressurizer safety valve is OPERABLE in In accordance with accordance with the Inservice Testing Program. the Inservice Following testing, lift settings shall be within +/- 1%. Testing Program I 2 bInsert -

3.4-18 Unit 1 - Amendment No. 435 Diablo Canyon - Units I & 2 Unit 2 - Amendment No. 435

Insert 1 A. One or more pressurizer Restore valve(s) to safety valve(s) inoperable OPERABLE status if due to loop seal loop seal temperature is:

temperature being outside design limits. A.1 Above design limit. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> OR A.2 Below design limit in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> MODES 1 or 2.

OR A.3 Below design limit in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> MODE 3 or 4.

Insert 2 SR 3.4.10.2 Verify loop seal temperatures are within limits. l 31 days SR 3.4.10.3 Perform a CHANNEL CALIBRATION of each loop 24 months seal temperature instrument.

Enclosure 3 PG&E Letter DCL-04-180 Proposed Technical Specification Changes (Retyped)

Remove Page Insert Pages 3.4-18 3.4-18 3.4-1 8a

Pressurizer Safety Valves 3.4.10 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.10 Pressurizer Safety Valves LCO 3.4.10 Three pressurizer safety valves shall be OPERABLE with lift settings 2 2460 psig and

• 2510 psig.

APPLICABILITY: MODES 1, 2, and 3, MODE 4 with all RCS cold leg temperatures > Low Temperature Overpressure Protection (LTOP) arming temperature specified in the PTLR.

__ __[ml A__________

The lift settings are not required to be within the LCO limits during MODES 3 and 4 for the purpose of setting the pressurizer safety valves under ambient (hot) conditions. This exception is allowed for 54 hours6.25e-4 days <br />0.015 hours <br />8.928571e-5 weeks <br />2.0547e-5 months <br /> following entry into MODE 3 provided a preliminary cold setting was made prior to heatup.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more pressurizer Restore valve(s) to safety valve(s) inoperable OPERABLE status if due to loop seal loop seal temperature is:

temperature being outside design limits. A.1 Above design limit. 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> OR A.2 Below design limit in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> MODES 1 or 2.

OR A.3 Below design limit in 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> MODE 3 or 4.

B. One pressurizer safety B.1 Restore valve to 15 minutes valve inoperable for OPERABLE status.

reasons other than Condition A.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> I associated Completion AND Time for Condition A or B A I not met.

OR Two or more pressurizer C.2 Be in MODE 4 with any 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> safety valves inoperable for RCS cold leg reasons other than temperatures < LTOP Condition A. arming temperature specified in the PTLR.

3.4-18 Unit I - Amendment No. 435 Diablo Canyon - Units 1 & 2 Unit 2 - Amendment No. 43S

Pressurizer Safety Valves 3.4.10 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.4.10.1 Verify each pressurizer safety valve is OPERABLE in In accordance with accordance with the Inservice Testing Program. the Inservice Following testing, lift settings shall be within +/- 1%. Testing Program SR 3.4.10.2 Verify loop seal temperatures are within limits. 31 days SR 3.4.10.3 Perform a CHANNEL CALIBRATION of each loop 24 months seal temperature instrument.

Diablo Canyon - Units 1 & 2 3.4-1 8a Unit 1 - Amendment No. 435 Unit 2 - Amendment No. 435

Enclosure 4 PG&E Letter DCL-04-180 Changes to Technical Specification Bases Pages (For information only)

Pressurizer Safety Valves B 3.4.10 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP arming temperature, OPERABILITY of three valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection.

The LCO is not applicable in MODE 4 when any RCS cold leg temperature is

• LTOP arming temperature specified in the PTLR, or in MODE 5 because LTOP is provided. Overpressure protection is not required in MODE 6 with reactor vessel head closure bolts fully de-tensioned.

The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting.

The cold setting gives assurance that the valves are OPERABLE near their design condition. Only one valve at a time will be removed from service for testing. The 54-hour exception is based on 18-hour outage time for each of the three valves. The 18-hour period is derived from Bases Insert 1 operating experience that hot testing can be performed in this time frame.

ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take IB place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS Overpressure Protection System. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.

Q.1 and.8.2

/IftRequired Action of A.1 cannot be met within the required

/ompletion Time or if two or more pressurizer safety valves are inoperable, the plant must be brought to a MODE in which the requirement does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 with any RCS cold leg temperatures < LTOP arming temperature specified in the PTLR within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. With any RCS cold leg temperature at or (continued)

Diablo Canyon - Units 1 & 2 Revision 2

Pressurizer Safety Valves B 3.4.10 BASES ACTIONS .1 ang.2 (continued)

~ow LTOP arming temperature specified in the PTLR, overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by three pressurizer safety valves.

SURVEILLANCE SR 3.4.10.1 REQUIREMENTS SRs are specified in the Inservice Testing Program. The ASME Code, Section Xi (Ref. 4), requires that safety and relief tests be performed in accordance with ANSI/ASME OM-a-1 988 (Ref. 5.). No additional Bases Insert 2 requirements are specified. The surveillance specifies the lift settings o be within +/- 1% of nominal pressure of 2485 psig.

REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section IlIl.

2. FSAR, Chapter 15.

3. WCAP-7769, Rev. 1, June 1972.

4. ASME, Boiler and Pressure Vessel Code, Section Xi.

5. Operation and Maintenance Code, 1987 with OM-a-1 988 Addenda.

Diablo Canyon - Units 1 & 2 Revision 2

Bases Insert 1 A.1 Pressurizer safety valves are conservatively declared inoperable when their loop seal temperatures are outside the range of 217'F to 500'F, although the valves will still lift on demand. Low temperature is a concern because discharge could result in water or water/steam mixture rather than steam entering the discharge piping causing damage.

High temperature could cause the valve setpoint to drift low. Entry into Action A.1 for one or more pressurizer safety valve(s) inoperable does not require declaring any other pressurizer safety valves inoperable (such as for discharge piping concerns).

Completion Times of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for exceeding the high temperature limit and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (MODES 1 and 2) and 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (MODES 3 and 4) for exceeding the low temperature limit have been established using a risk-based evaluation as approved in License Amendments _ (Unit 1) and (Unit 2).

Bases Insert 2 SR 3.4.10.2 and SR 3.4.10.3 Operability of the pressurizer safety valves is determined, in part, by their associated loop seal temperatures. Accordingly, two surveillances have been established to assure that the loop seal temperatures are appropriately monitored. The completion times of 31 days for the temperature verification and 24 months for the CHANNEL CALIBRATION are judged to be acceptable based on operating experience.

The temperature verification required by SR 3.4.10.2 can be performed by using the installed loop seal temperature instruments, or other means.