Text

Issuance of Amendment Nos. 191, 191, and 191, Revise Technical Specification 3.7.4, Atmospheric Dump Valves (Advs)
	ML13080A331
Person / Time
Site:	Palo Verde
Issue date:	04/11/2013
From:	Jennivine Rankin; Plant Licensing Branch IV
To:	Edington R; Arizona Public Service Co
	Rankin J
References
	TAC ME6566, TAC ME6567, TAC ME6568
	Download: ML13080A331 (40)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON. D.C. 20555-0001 April 11, 2013 Mr. Randall K. Edington Executive Vice President Nuclearl Chief Nuclear Officer Mail Station 7602 Arizona Public Service Company P.O. Box 52034 Phoenix, AZ 85072-2034

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 ISSUANCE OF AMENDMENTS TO REVISE TECHNICAL SPECIFICATION 3.7.4, "ATMOSPHERIC DUMP VALVES (ADVS)" (TAC NOS. ME6566, ME6567, AND ME6568)

Dear Mr. Edington:

The Commission has issued the enclosed Amendment No. 191 to Renewed Facility Operating License No. NPF-41, Amendment No. 191 to Renewed Facility Operating License No. NPF-51, and Amendment No. 191 to Renewed Facility Operating License No. NPF-74 for the Palo Verde Nuclear Generating Station, Units 1, 2, and 3, respectively. The amendments consist of changes to the Technical Specifications (TSs) in response to your application dated June 22, 2011, as supplemented by letters dated December 9, 2011, January 27, 2012, and January 30, 2013.

The amendments revise TS 3.7.4, "Atmospheric Dump Valves (ADVs)." Specifically, the amendments revise the Limiting Condition for Operation for TS 3.7.4, with corresponding revisions to the TS Conditions, Required Actions, and Completion Times associated with one or more inoperable ADV lines.

R. Edington - 2 A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely, Jennivine K. Rankin, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. STN 50-528, STN 50-529, and STN 50-530

Enclosures:

1. Amendment No. 191 to NPF-41

2. Amendment No. 191 to NPF-51

3. Amendment No. 191 to NPF-74

4. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-528 PALO VERDE NUCLEAR GENERATING STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 191 License No. NPF-41

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, EI Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated June 22, 2011, as supplemented by letters dated December 9, 2011, January 27,2012, and January 30,2013, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I;

8. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

-2

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and Paragraph 2.C(2) of Renewed Facility Operating License No. NPF-41 is hereby amended to read as follows:

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 191, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

3. This license amendment is effective as of the date of issuance and shall be implemented within 90 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-41 and Technical Specifications Date of Issuance: Apr; 1 11, 2013

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-529 PALO VERDE NUCLEAR GENERATING STATION, UNIT 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 191 License No. NPF-51

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, EI Paso Electric Company, Southern California Edison Company, PubJic Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated June 22, 2011, as supplemented by letters dated December 9, 2011, January 27, 2012, and January 30,2013, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the CommiSSion; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and Oi) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 2

-2

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and Paragraph 2.C(2) of Renewed Facility Operating License No. NPF-51 is hereby amended to read as follows:

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 191, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

3. This license amendment is effective as of the date of issuance and shall be implemented within 90 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-51 and Technical Specifications Date of Issuance: Apr; 1 11, 2013

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50*530 PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 191 License No. NPF-74

1. The Nuclear Regulatory Commission (the CommisSion) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, EI Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated June 22, 2011, as supplemented by letters dated December 9, 2011, January 27,2012, and January 30,2013, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 3

- 2

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and Paragraph 2.C(2) of Renewed Facility Operating License No. NPF-74 is hereby amended to read as follows:

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 191, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

3. This license amendment is effective as of the date of issuance and shall be implemented within 90 days of the date of issuance.

FOR THE NUCLEAR REGULATORY COMMISSION Michael T. Markley, Chief Plant Licensing Branch IV Division of Operating Reactor licensing Office of Nuclear Reactor Regulation Attachment Changes to the Renewed Facility Operating License No. NPF-74 and Technical Specifications Date of Issuance: Apr; 1 11, 2013

ATTACHMENT TO LICENSE AMENDMENT NOS. 191, 191, AND 191 RENEWED FACILITY OPERATING LICENSE NOS. NPF-41, NPF-51. AND NPF-74 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530 Replace the following pages of the Renewed Facility Operating Licenses Nos. NPF-41, NPF-51, and NPF-74, and Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Renewed Facility Operating License No. NPF-41 REMOVE INSERT 5 5 Renewed Facility Operating License No. NPF-51 REMOVE INSERT 6 6 Renewed Facility Operating License No. NPF-74 REMOVE INSERT 4 4 Technical Specifications REMOVE INSERT 3.7.4-1 3.7.4-1

-5 (1) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power), in accordance with the conditions specified herein.

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 191, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3) Antitrust Conditions This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed license.

(4) Operating Staff Experience Requirements Deleted (5) Post-Fuel-Loading Initial Test Program (Section 14, SER and SSER 2f Deleted (6) Environmental Qualification Deleted (7) Fire Protection Program APS shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility, as supplemented and amended, and as approved in the SER through Supplement 11, subject to the following provision:

APS may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

The parenthetical notation following the title of many license conditions denotes the section of the Safety Evaluation Report and/or its supplements wherein the license condition is discussed.

Renewed Facility Operating License No. NPF-41 Amendment No. 191

- 6 (1) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power) in accordance with the conditions specified herein.

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 191, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3) Antitrust Conditions Thi.s renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed operating license.

(4) Operating Staff Experience Requirements (Section 13.1.2, SSER 9)*

Deleted (5) Initial Test Program (Section 14, SER and SSER 2)

Deleted (6) Fire Protection Program APS shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility, as supplemented and amended, and as approved in the SER through Supplement 11, subject to the following provision:

APS may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(7) Inservice Inspection Program (Sections 5.2.4 and 6.6, SER and SSER 9)

Deleted The parenthetical notation following the title of many license conditions denotes the section of the Safety Evaluation Report and/or its supplements wherein the license condition is discussed.

Renewed Facility Operating License No. NPF-51 Amendment No. 191

-4 (4) Pursuant to the Act and 10 CFR Part 30,40, and 70, APS to receive, possess, and use in amounts required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Pursuant to the Act and 10 CFR Parts 30, 40, and 70, APS to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C. This renewed operating license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power), in accordance with the conditions specified herein.

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 191, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3) Antitrust Conditions This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed operating license.

(4) Initial Test Program (Section 14, SER and SSER 2)

Deleted (5) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 171, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

Renewed Facility Operating License No. NPF-74 Amendment No. 191

ADVs 3.7.4 3.7 PLANT SYSTEMS 3.7.4 Atmospheric Dump Valves (ADVs)

LCO 3.7.4 Four ADV lines shall be OPERABLE.

APPLICABILITY : MODES 1, 2. and 3, MODE 4 when steam generator is being relied upon for heat removal.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. - - -NOTE---

Separate A.1 Restore ADV line to 7 days Conditi on entry OPERABLE status, is all owed for each SG.

One required ADV line inoperable.

B. Two or more ADV lines B.1 Restore one ADV line 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months inoperable with both to OPERABLE status on ADV lines inoperable each SG.

on one or more SGs.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time not met. -AND 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C.2 Be in MODE 4 without reliance on steam generator for heat removal.

PALO VERDE UNITS 1,2.3 3.7.4-1 AMENDMENT NO. lee. 191

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 191. 191, AND 191 TO RENEWED FACILITY OPERATING LICENSE NOS. NPF-41. NPF-51, AND NPF-74 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

PALO VERDE NUCLEAR GENERATING STATION, UNITS 1,2. AND 3 DOCKET NOS. STN 50-528, STN 50-529, AND STN 50-530

1.0 INTRODUCTION

By application dated June 22,2011 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML11182A908), as supplemented by letters dated December 9,2011, January 27,2012, and January 30,2013 (ADAMS Accession Nos. ML11356A088, ML12046A649, and ML13037A384, respectively), Arizona Public Service Company (APS, the licensee) requested changes to the Technical Specifications (TSs) for Palo Verde Nuclear Generating Station (Palo Verde), Units 1, 2, and 3. The supplemental letters dated December 9, 2011, January 27, 2012, and January 30, 2013, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the U.S. Nuclear Regulatory Commission (NRC) staff's original proposed no significant hazards consideration determination as published in the Federal Register on October 4, 2011 (76 FR 61394).

The proposed change would revise TS 3.7.4, "Atmospheric Dump Valves (ADVs)." Specifically, the amendments revise the Limiting Condition for Operation for TS 3.7.4, with corresponding revisions to the TS Conditions, Required Actions, and Completion Times associated with one or more inoperable ADV lines. The proposed change would require four ADV lines to be operable in MODES 1,2, and 3, as well as in MODE 4 when a steam generator (SG) is relied upon for heat removal.

2.0 REGULATORY EVALUATION

2.1 System Description The ADVs are a part of the Palo Verde main steam supply system. Along with one ADV per main steam line, the main steam supply system includes main steam piping from the SG nozzles to the main turbine stop valves, one main steam isolation valve (MSIV) per main steam Enclosure 4

-2 line, and five main steam safety valves (MSSVs) per main steam line (Palo Verde Updated Final Safety Analysis Report (UFSAR), Section 10.3.2).

The three units at Palo Verde are very similar in design. Each unit has two steam generators.

Each steam generator has two main steam lines. Each main steam line has one ADV. Hence, there are a total of four ADVs on each unit.

UFSAR Section 10.3.2.2.4, "Atmospheric Dump Valves," states, in part, that Atmospheric dump valves, one per main steam line, are provided to allow cooldown of the steam generators when the main steam isolation valves are closed, or when the main condenser is not available as a heat sink. Each atmospheric dump valve is sized to hold the plant at hot standby while dissipating core decay heat or to allow a flow of sufficient steam to maintain a controlled reactor cooldown rate.

2.2 ARRlicable Regulatory Requirements Section 50.36, "Technical specifications," of Title 10 of the Code of Federal Regulations (10 CFR) contains the requirements for the content of TS. Pursuant to 10 CFR 50.36, TSs are required to include items in the following five specific categories related to station operation:

(1) safety limits, limiting safety system settings, and limiting control settings; (2) limiting conditions for operation (LCOs); (3) surveillance requirements (SRs); (4) design features; and (5) administrative controls.

The regulations in 10 CFR 50.36(c)(2) state that LCOs are the lowest functional capability or performance level of equipment required for safe operation of the facility.

In general, there are two classes of changes to technical specifications: (1) changes needed to reflect contents of the design basis (technical specifications are derived from the design basis),

and (2) voluntary changes to take advantage of the evolution in policy and guidance as to the required content and preferred format of technical specifications over time. This amendment deals with the first class of change, namely, a change that reflects a change to reflect the design basis for the ADVs.

In determining the acceptability of revising TS 3.7.4, the NRC staff used plant-specific licensing basis information as well as the accumulation of generically approved guidance in NUREG-1432, "Standard Technical Specifications, Revision 4, Combustion Engineering Plants," April 2012 (ADAMS Accession No. ML12102A165). The NRC staff may grant a licensee's request to revise the TSs, provided that the NRC staff's plant-specific review supports a finding of continued adequate safety because: (1) the change is editorial, administrative, or provides clarification (Le., no requirements are materially altered); (2) the change is more restrictive than the licensee's current requirement; or (3) the change is less restrictive than the licensee's current requirement, but nonetheless still affords adequate assurance of safety when judged against current regulatory standards.

In its letter dated June 22, 2011, the licensee stated, in part, that "the safety analyses in the

[Palo Verde] UFSAR credit the ADVs as dual use components that fulfill both heat removal and

-3 containment isolation design basis safety functions." The licensee identified 10 CFR Part 50, Appendix A, General Design Criteria (GDCs) 34 and 57 as applicable.

GDC 34, "Residual heat removal," states that:

A system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded.

Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for on site electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

GDC 57, "Closed system isolation valves," states that:

Each line that penetrates primary reactor containment and is neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere shall have at least one containment isolation valve which shall be either automatic, or locked closed, or capable of remote manual operation. This valve shall be outside containment and located as close to the containment and located as close to containment as practical. A simple check valve may not be used as the automatic isolation valve.

In consideration of the above GDCs, the ADVs playa significant role in four design basis events. These include (1) the loss-of-coolant accident (LOCA) long-term cooling (LTC) analysis, (2) steam generator tube rupture (SGTR), (3) natural circulation cooldown, and (4) main steam and feedwater line breaks. The specific role of the ADV in each of these events is discussed and evaluated further in the Technical Evaluation.

NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," (SRP) Section 10.3, "Main Steam Supply System," requires that a single failure of an active component shall not preclude a safety-related function during normal and accident conditions. The licensee has identified a more limiting single failure of the control system that affects more than one ADV. The licensee must assure the LCO requires sufficient ADVs to be operable to perform the safety function when considering the most limiting single failure. Section 10.3 also requires the main steam system to have the capability to operate ADVs remotely from the control room so that the reactor can be taken to cold shutdown on safety-grade components. The licensee is requesting to continue power operation for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months in a TS Condition with all four ADVs inoperable.

The SRP Section 15.2.1-15.2.5, "Loss of External Load; Turbine Trip; Loss of Condenser Vacuum; Closure of Main Steam Isolation Valve (BWR); and Steam Pressure Regulator Failure (Closed)," states, in part, that "An incident of moderate frequency should not generate an aggravated plant condition without other faults occurring independently." The SRP uses the

-4 term AOOs (anticipated operational occurrences) to refer to the events that are categorized in Regulatory Guide (RG) 1.70, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants," November 1978 (ADAMS Accesison No. ML011340122), and in RG 1.206, "Combined License Applications for Nuclear Power Plants (LWR Edition)," June 2007 (ADAMS Accession No. ML070720184), as incidents of moderate frequency (Le., events that are expected to occur several times during the plant's lifetime). SRP 15.0 states that "an AOO should not generate a postulated accident without other faults occurring independently or result in a consequential loss of function of the RCS [Reactor Coolant System] or reactor containment barriers."

The NRC staff reviewed the licensee's proposed LCO, associated remedial actions, and supporting safety analyses, to determine whether the proposed revision to the specification will provide adequate protection to the health and safety of the public.

3.0 TECHNICAL EVALUATION

3.1 Description of Changes By letter dated June 22, 2011, the licensee stated, in part, that:

The proposed LAR revises the Limiting Condition for Operation (LCO) for TS 3.7.4 as follows:

From: One ADV line per steam generator (SG) shall be OPERABLE To: Four ADV lines shall be OPERABLE The ACTIONS table associated with TS 3.7.4 is revised as follows:

1. Condition A Completion Time (CT) is modified:

From: 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months To: 7 days

2. Condition A is also modified by adding the following:

NOTE - Separate Condition entry is allowed for each SG

3. Condition B is modified as follows:

From: Two required ADV lines inoperable To: Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs

4. Condition B Required Action (RA) B.1 is modified as follows:

From: Restore one ADV line to OPERABLE status To: Restore one ADV line to OPERABLE status on each SG

- 5 These changes to TS 3.7.4 are proposed to ensure that the number of ADV lines maintained in an operable condition will allow each unit to be safely shut down after a design basis event concurrent with a loss of offsite power and the most limiting single failure. The modified LCO ensures that single failure requirements are satisfied for mitigation of design basis accidents.

3.2 NRC Staff Evaluation 3.2.1 Requirements of 10 CFR 50.36 The NRC staff evaluated the licensee's proposed changes against the applicable regulatory requirements of 10 CFR 50.36 and compared the proposed changes to NUREG-1432. The licensee proposed changing the LCO statement from "One ADV line per steam generator shall be OPERABLE" to "Four ADV lines shall be OPERABLE." The NRC staff evaluated the proposed change to the LCO statement for TS 3.7.4 and determined that the changes are more restrictive than current requirements. Therefore, the proposed change to the LCO statement is acceptable because the LCO would still require the lowest functional capability or performance level of the ADVs required for safe operation of the facility. Therefore, the NRC staff determined that the new LCO meets the requirements of 10 CFR 50.36.

The licensee proposed revising Condition A by adding a note, which states "Separate Condition entry is allowed for each SG." Per TS 1.3, "Completion Times," the note would allow Condition A to be entered separately for an inoperable ADV line on each SG, and CTs tracked on a per line basis. If an ADV line were declared inoperable, Condition A would be entered and its CT would start. If a subsequent ADV line on the opposite SG were then declared inoperable, Condition A would be entered for each ADV line and separate CTs start and are tracked for each line. The NRC staff evaluated the proposed note for Condition A. The current requirements do not allow separate condition entry and would require entry into Condition B for two inoperable ADVs lines. Condition B has a shorter, more restrictive CT than Condition A.

The staff determined that the change is less restrictive than current requirements because the licensee would have more time to operate if an ADV line on each SG becomes inoperable. By letter dated June 22, 2011, the licensee provided justification for the change by referring to the 7-day CT for one inoperable ADV line in NUREG-1432. The licensee stated, in part, that:

The plant configuration allowed by the proposed separate condition entry ensures one OPERABLE ADV line per SG and continues to support the analytical assumptions for limiting faults .... , and other design basis events with a coincident LOP [loss of power] or actuation of a MSIS [main steam isolation signal], and assuming no single failure as provided in Generic Letter 80-30, Clarification Of The Term "Operable" As It Applies To Single Failure Criterion For Safety Systems Required By TS, dated April 10, 1980 ...

The NRC staff concludes that while the proposed note is less restrictive, it still affords adequate assurance of safety when judged against current regulatory standards found in NUREG-1432, and is, therefore, acceptable.

The licensee proposed revising Condition A by changing the CT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days. The staff evaluated the proposed changes to Condition A and determined that the change is less

- 6 restrictive than current requirements. By letter dated June 22, 2011, the licensee stated that NUREG-1432 contains a 7-day CT and provided the following additional justification:

Each SG has two main steam lines, each of which has an ADV line, MSIV, and five safety grade MSSVs. There are no cross-tie vulnerabilities and no common failure points between the two main steam lines associated with each SG. The redundancy and reliability provided by this configuration supports a 7-day CT.

When one ADV line is inoperable, the other ADV line on the associated SG is still available for design basis event mitigation, and anyone ADV line has the capacity to safely remove heat from the RCS. In addition, any operable ADV lines on the other SG are also available for design basis event mitigation.

When MSIVs are open and offsite power is available, the SBCS [Steam Bypass Control System], although not safety grade, is available as the preferred method of heat removal, to direct steam to the condenser, the atmosphere or both.

The safety grade MSSVs, located upstream of the MSIVs, would automatically open to provide SG overpressure protection and would remain available for RCS heat removal regardless of the availability of offsite power.

Although not credited in the UFSAR Chapter 15 accident analyses, operators may utilize a non-safety related local manual hand wheel on the ADV to open and close an inoperable ADV line if the area is habitable.

The [Palo Verde] Emergency Operating Procedures (EOPs) provide guidance to operate the ADVs manually.

There is a low probability of an accident which would require ADV line operation to occur during the proposed 7-day CT.

Operating experience indicates that the proposed 7 -day CT is sufficient to restore inoperable ADV lines to OPERABLE status.

The NRC staff concludes that while the proposed CT change is less restrictive, it still affords adequate assurance of safety when judged against current regulatory standards found in NUREG-1432, which ensures that at least one ADV line on each SG will be operable while in Condition A Therefore, the proposed change is acceptable.

The licensee proposed revising Condition B from "Two ADV lines inoperable" to 'Two or more ADV lines inoperable with both ADV lines inoperable on one or more SGs." The licensee also proposed revising the Required Action B.1 for Condition B from "Restore one ADV line to OPERABLE status" to "Restore one ADV line to OPERABLE status on each SG." The NRC staff evaluated the proposed changes to Condition B and determined that the change provides clarification (i.e., no requirements are materially altered) because the change would not change

-7 the configuration allowed by the current Condition B. Although Condition B is not a material change from its current technical specifications, the NRC staff reviewed the licensee's justification for the allowed CT of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for the potential loss of safety function in order to determine if it were appropriate to retain this CT. That review is discussed in Sections 3.2.2 and 3.2.3 of this safety evaluation.

The NRC staff evaluated the licensee's proposed changes against the applicable regulatory requirements of 10 CFR 50.36. The NRC staff also compared the proposed changes to NUREG-1432. The NRC staff determined that all the proposed changes afford adequate assurance of safety when judged against current regulatory standards found in NUREG-1432.

Therefore, the NRC staff concludes that the proposed changes are acceptable and in compliance with 10 CFR 50.36. Compliance with other regulatory requirements is discussed below.

3.2.2 Defense-in-Depth Review In the event two or more ADVs are inoperable, the safety function of the ADVs may no longer be available. Therefore, the licensee must demonstrate there is an approved alternate method available to mitigate accidents and transients, or shutdown the plant in accordance with TS 3.0.3. To support this amendment, the licensee is proposing that the Steam Bypass Control System (SBCS) atmospheric relief valves are an acceptable alternative to provide the cooldown safety function when the ADVs are not available.

3.2.2.1 General Criteria for Defense in Depth to Support a Deterministic Evaluation A deterministic evaluation must demonstrate an adequate defense-in-depth strategy, which provides for multiple means to accomplish safety function. A defense-in-depth strategy should meet the intent of the GDC and other applicable standards. In addition, a defense-in-depth strategy must account for impact on barriers which prevent core damage or containment failure, for uncertainties in equipment and human performance, and for the potential for unknown failure mechanisms, while maintaining the ability to mitigate the consequences of the specific design basis accidents and transients.

The licensee has provided an evaluation and analyses to show that the plant can respond to design basis accidents without ADVs and without compromising either the fuel cladding barrier or the containment The licensee performed analyses of the significant accidents which credit the ADVs. The accidents the licensee evaluated were a steam generator tube rupture, main steam line break, and a main feedwater line break. The analyses show that alternate operator actions can be successful in mitigating the accidents, if the ADVs are not available. The analyses show that reasonable time exists for the operator to perform these alternate actions.

Also, existing emergency procedures provide guidance for the operators to perform these alternate actions. The licensee demonstrated that the equipment to be used in lieu of the ADVs will remain accessible during these accident scenarios.

If the ADVs are inoperable, the licensee does not plan on using any special programmatic activities as compensatory measures. The licensee is expected to ensure that the redundant equipment credited for use as defense in depth is available when the ADVs are inoperable. The TS specification does not specifically identify which redundant equipment is required when the

- 8 ADVs are inoperable. The licensee would rely on the licensed reactor operator's knowledge of the plant systems and the available equipment in order to only enter a TS Action Statement if the alternate equipment is available, so that the plant does not enter into an unanalyzed condition. As a precaution, the licensee will initiate procedural controls as stated in its letter dated January 30, 2013:

In addition, procedure 51 DP-90M03, Site Scheduling, Appendix B, is planned to be enhanced to contain a statement ensuring ADV work is to be scheduled when SBCS valves 1007 and 1008 are available and that SBCS valves 1007 and 1008 are to be scheduled only when ADVs are operable.

The licensee has not identified any additional compensatory actions when entering the TS Condition for multiple ADVs inoperable.

The licensee does not plan on entering the TS Condition with all ADVs inoperable. To support this amendment, the licensee has constructed demonstration analyses to evaluate design basis events in combination with multiple component ADV failures. The demonstration analyses show that the plant can sustain a design basis event with all ADVs inoperable, if appropriate and timely operator actions are taken using alternative plant equipment that is not currently credited in the design basis.

In order to allow continued plant operation in a degraded condition, the NRC staff must determine if the licensee has an adequate defense-in-depth strategy to assure the ADVs safety function remains available by alternate equipment. In its letter dated January 3D, 2013, the licensee provided an evaluation showing that "system redundancy, independence, and diversity are maintained, commensurate with the expected frequency and consequences of challenges to the system."

3.2.2.2 Evaluation of the Atmospheric SBCS valves as a Defense-in-Depth Alternative for the ADVs The credited safety function performed by the ADVs is to release energy from the steam generators, thereby providing a means in which to cool down the RCS. In order to provide an adequate defense in depth in the absence of ADVs, the licensee must provide a suitable replacement valve that will be available and capable of relieving an equivalent amount of steam.

The licensee reports that the atmospheric SBCS valves and the ADVs are nearly equivalent.

Therefore, the licensee proposes that the atmospheric SBCS relief valves provide an alternate method that will remain available to perform this function, if all the ADVs are inoperable, even in the event off site power is unavailable.

The ADVs are described in UFSAR Section 10.3.2.2.4 and in UFSAR Table 10.1-1. The UFSAR states that each plant has two steam generators, with two main steam lines from each of the steam generators. There is one ADV on each main steam line, for a total of four ADVs per plant. The ADVs are the American SOCiety of Mechanical Engineers Boiler and Pressure Vessel Code (ASME Code),Section III, Code Class 2, installed to Seismic Category I, and capable of a minimum flow of 950,000 pounds per hour (Ib/hr). The ADVs provide a means to release energy from the steam generators when the main condenser is not available. The ADVs have a Seismic Category I. standby, air accumulator in the event that the normal

- 9 instrument air system is not available. The accumulator is sized for providing 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of operation at hot standby, plus an additional 9.3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months of operation in order to cool the RCS down to cold shutdown conditions under natural circulation. The ADVs are normally closed, and have no automatic response or operation. The ADVs are strictly manual valves, with remote and locally controlled valve actuators. They can be manually remotely operated from the main control room and the remote shutdown panel. The licensee stated that the ADV control circuits are designed such that no single electrical failure can result in the spurious opening of more than one valve. However, there is a limiting single failure of a control power, which makes two ADVs inoperable, one on each steam generator. The ADVs can be manually operated locally if the remote capability is lost. To operate manually, an operator first ensures the instrument air is isolated, and an equalizing valve on the positioner is place in manual. A manual override shaft connected to the actuator shaft enables an operator to use a manual hand wheel to open and close the valve as needed. The licensee provided instructions in procedures that 19 turns would be approximately 10 percent open.

UFSAR Sections 7.7.1.1.5 and 7.7.1.2.5 describe the SBCS. The SBCS at Palo Verde has eight turbine bypass valves. Six of these SBCS valves release steam to the condenser and two SBCS valves release steam to the atmosphere. If the main condenser is not available, then six of the SBCS valves will not be available. However, the remaining two, which dump steam to atmosphere, will remain available as long as MSIV or its bypass valve remain open.

The atmospheric SBCS valves are similar in design to the ADVs. They both are electro-pneumatic, 12-inch globe drag valves. An ADV can pass 1.47 x 106 pounds mass per hour (lbm/hr) whereas a SBCS atmospheric relief valve can pass 1.36 x 106 Ibm/hr. The atmospheric SBCS valves have similar valve actuators as the ADVs but have different controls.

Manual operation of the atmospheric SBCS valves is similar to the ADVs.

The licensee's evaluation shows how the atmospheric SBCS valves will remain available to mitigate an accident in the event the ADVs were all inoperable. The licensee pointed out that the redundant equipment, atmospheric SBCS valves, is in a different location than the ADVs.

The two atmospheric SBCS valves are located in the turbine building whereas the ADVs are located in the main steam support structure. Therefore, in the event the ADVs are inoperable or inaccessible in the main steam structure, the plant operators would still have an opportunity to access the atmospheric SBCS valves in the turbine building. Therefore, the independence of physical barriers is not degraded.

Operator actions are required to operate the primary equipment, ADVs, and the redundant equipment, atmospheric SBCS valves. Whenever operator actions are credited, then human errors may be introduce that may adversely affect the ability to mitigate the consequences of the event. The licensee's defenses against human errors are maintained through procedures, training, and peer checking, as the NRC staff observed during the audit conducted onsite during the week of November 26,2012. 1 The licensee's evaluation of its defense in depth found no operational changes were necessary based upon current operator responses. Hence, no Gibson, L. K., U.S. Nuclear Regulatory Commission, letter to Randall K. Edington, Arizona Public Service Company, "Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - Regulatory Audit Summary and Request for Additional Information Regarding License Amendment Request to Revise Technical Specification 3.7.4, "Atmospheric Dump Valves (ADVS)" (TAC Nos. ME6566, ME6567, and ME6568),"

dated December 13, 2012 (ADAMS Accession No. ML12342A383).

- 10 additional human errors may have been possibly introduced. However, the licensee has opted to make some enhancements to existing emergency operating procedures that would clarify operational alternative actions in the event of a steam generator tube rupture or excess steam demand events. Therefore, the licensee's position is that no additional specific defenses need to be added in order to ensure human errors do not occur when using the required or alternate equipment.

In order to assure an adequate defense-in-depth strategy, the licensee must assure that any common cause failures that render all the ADVs inoperable will not affect the availability of the atmospheric SBCS valves. In doing so, the license must have an adequate defense against potential common-cause failures and assess the potential of new common-cause failures mechanisms. By letter dated January 30, 2013, the licensee stated, in part, that System redundancy, independence, and diversity are maintained commensurate with the expected frequency and consequences of challenges to the system.

Specifically, restrictions will be in place to preclude simultaneous equipment outages that may challenge the principles of redundancy and diversity.

The licensee's proposed TS Bases Note states, in part: "Entry into Condition B for all four ADV lines simultaneously inoperable is not intended for voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable." The licensee does not plan any anticipated operational changes that could introduce any new common cause failures modes not previously considered.

Lastly, the licensee has not identified any adverse weather or abnormal plant conditions that would preclude entering the TS Condition for ADVs being inoperable.

During some design basis events, the licensee must initiate a cooldown of the RCS within a short period of time. The safety-related MSSVs can remove sufficient decay heat from the RCS in order to maintain a hot shutdown condition. However, the safety valves cannot cool down the RCS past a hot shutdown condition. The ADVs are the primary safety-related means to accomplish an RCS cooldown. Without the ADVs, the licensee must be able to accomplish the safety function with a reliable and available alternate means in a timely manner. The licensee proposed that the two atmospheriC SBCS valves will be available to release steam from the steam generator in order to cool down the Res.

The time required to begin a cooldown of the RCS can be a critical factor in several accidents and transients. Therefore, the atmospheric SBCS valves need to be available immediately and remain available throughout the event. The atmospheric SBCS valves are downstream of the MSIVs, and there are certain accident sequences and procedure steps that close the MSIVs.

With the MSIVs closed, the SBCS valves will be unavailable. However, if the MSIVs were to close, the licensee stated that operators can open the MSIV bypass valves either remotely using its air actuator from the control room, or locally using its manual valve actuator.

The atmospheric SBCS valves are not safety-related. However, the plant is designed so that the two atmospheric SBCS valves will still have control power, instrument power, and pneumatic power following a loss-of-offsite power event. The licensee stated that upon of a loss-of-offsite power event, operators should be able to remotely operate both the atmospheriC SBCS valves and MSIV bypass valves for a minimum of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months from the control room, which the licensee

- 11 believes is sufficient time to station an operator locally at the atmospheric S8CS valves to operate them manually, if necessary.

Similar to the ADVs, the S8CS are normally operated remotely using plant instrument air.

However, the atmospheric S8CS valves do not have backup air cylinders like the ADVs. The plant instrument air system does have a back up nitrogen tank that can provide sufficient gas for the entire plant instrument air system for an extended period of time. 8y letter dated January 30, 2013, in response to the NRC staff's request for additional information (RAI) dated December 13, 2012 (ADAMS Accession No. ML12342A383), the licensee stated that the normal capacity of the non-class, low-pressure nitrogen storage tank can be expected to supply sufficient gas for operators to continue to remotely operate the MSIV bypass valves and the two atmospheric S8CS valves for a minimum of 5.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The licensee's evaluation of the 120 Volts alternating current (VAC) instrument power to the atmospheric S8CS valves explains how it is supplied by an uninterruptible power supply, which can be energized by either a non-class and class power supply. This redundancy ensures instrument power will still be provided in the event of a loss-of-offsite power event. Also, the licensee's evaluation shows that the station batteries will continue to supply control power to the S8CS for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The direct current (DC) bus powers the DC distribution panels, which powers the auxiliary relay cabinets, which provide control power to atmospheric S8CS valves. In addition to the batteries, DC power is normally maintained by battery chargers energized from the emergency alternating current (AC) buses. DC battery backup for the atmospheric S8CS valves can provide a minimum of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of control power in the control room, which the licensee believes to be a sufficient amount of time to station an operator in the field to manually control the required atmospheric S8CS valves as needed. In its letter dated January 3D, 2013, the licensee stated, in part, that, In the event that S8CS valves 1007 and 1008 are not operable from the control room boards, procedural guidance (41/42/430P-1/2/30P01, Manual Operation of Air Operated Valves, Appendix 8) exists for local manual operation.

Even though electrical power and instrument air are available to the atmospheric S8CS valves, there must be a flow path from the steam generators. In between the atmospheric S8CS valves and the steam generators are the MSIVs, which have a bypass line and valve that is normally closed. In its letter dated January 30,2013, the licensee stated in part, that The worst case steam flow path consists of flow through one MSIV bypass line and subsequently through the two atmospheric S8CS valves that release to atmosphere. This flow path will be sufficient to cooldown the plant after approximately 40 minutes.

- 12 The MSIV bypass valves are air operated and have remote manual capability from the control room. However, the licensee identified an issue with operators being able to open them solely from the control room. The licensee is currently making modifications to the plant to allow operators to open the MSIV bypass valves from the main control room. In its letter dated January 30, 2013, the licensee provided the following status on the modifications:

Currently Unit 2 has new actuators on SG-169 and SG-183 and can be opened from the control room without additional operator actions. For Units 1 and 3, there is currently an administrative clearance (electrical only), that would need to have a single disconnect switch closed, to allow operation from the control room.

Unit 1 is scheduled to receive new actuators for the MSIV bypass valves in the Spring 2013 outage, and Unit 3 in the Fall 2013 outage, which will make Units 1 and 3 the same as Unit 2, such that the MSIV bypass valves SG-169 and SG-183 could be opened from the control room, with no additional operator actions required outside the control room.

The licensee has provided an evaluation showing that the atmospheric SBCS valves should remain available for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months based upon station batteries supplying the DC bus. The licensee also provided an additional defense-in-depth strategy in the event the ADVs are all unavailable, and the licensee cannot operate the atmospheric SBCS valves immediately (e.g., a main steam isolation signal closed the MSIVs, closing the flow path from the steam generators to the atmospheric SBCS valves). In the meantime, the licensee assured the NRC that sufficient time can be afforded by the MSSVs to sustain the plant in a stable condition for at least 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , affording sufficient time to begin implementation of its defense-in-depth strategy in the event the ADVs are all unavailable. In its letter dated January 27, 2012, the licensee stated, in part, that The demonstration analyses described in the APS response to NRC Request ...

demonstrate that the MSSVs may be used to maintain a [Palo Verde] unit in a safe hot standby condition for at least four hours following a postulated design basis event, thus providing time for implementation of EOP or another alternative strategy.

In the event the atmospheric SBCS valves are not immediately available, then the licensee assures there is an available drain path from the steam generators that operators can use to ensure the level in the steam generator does not reach overfill conditions. By letter dated January 30, 2013, in response to the NRC staffs RAls dated December 13, 2012, the licensee provided the following explanation of this draining operation:

The SGTR emergency procedure, 40EP-9E004, provides detailed instructions and contingency actions for operators to cool down, isolate, and control water level in the ruptured SG. With regard to SG water level control, the procedure includes steps that provide operators with three options for controlling long-term level: by back-flow to the RCS; by draining the SG to the main condenser through the SG blowdown system; or by steaming through the main steamline isolation bypass valves. Operators routinely train with this emergency procedure.

- 13 The ability to drain the steam generator does not directly support the RCS cooldown function provided by the ADVs and SBSC valves, but the draining does provide an additional layer of defense in depth. As part of the defense-in-depth strategy, the licensee-proposed use of the steam generator drain valves to maintain level in the steam generators should prevent an over-fill condition from occurring while the operators restore the ability to cool down with the atmospheric SBCS valves.

3.2.2.3 Defense-in-Depth Conclusion The licensee has provided an evaluation proposing the use of the two atmospheric SBCS valves as a reliable and available alternate means to cool down the RCS in the event all ADVs were inoperable. The NRC staff performed an extensive technical review of the evaluation and analyses, including an onsite audit. The NRC staff concludes that the licensee has shown that that the atmospheric SBCS valves are equivalent in size and function to the ADVs; hence, they can perform the same function as an ADV, if available. The licensee has provided detailed information showing the atmospheric SBCS valves will continue to have remote manual function in the event of a loss-of-offsite power event for at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months using DC power, uninterruptible power supply AC power, and backup nitrogen gas. The licensee has provided information on procedures showing that a plant operator can respond after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to operate the atmospheric SBCS valves locally manually, as necessary, to continue to function beyond the 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The licensee has also provided information demonstrating that the flow path from the steam generators can be maintained through the MSIV bypass lines in the event the MSIVs go closed.

Based on the above, the NRC staff concludes that as long as the atmospheric SBCS valves remain available, then they can provide an alternate means to cool down the RCS in the event the ADVs are not available.

3.2.3 Design Basis Event Review By letter June 22, 2011, the licensee stated that the following events require ADVs for mitigation:

The loss-of-coolant accident (LOCA) long-term cooling (LTC) analysis,

Residual heat removal (RHR), and

The steam generator tube rupture (SGTR).

The NRC staff reviewed the Palo Verde UFSAR and determined that the ADVs also play an important role in main steam and feedwater line breaks.

The proposed LCO will require all four ADVs to be operable, but will allow up to one ADV on each SG to be inoperable for up to 7 days. The proposed LCO will also allow as many as all four ADVs to be inoperable for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The NRC staff review of the design basis events establishes that: (1) the proposed LCO is consistent with the existing UFSAR safety analyses, and (2) the plant has adequate defense in depth to mitigate the affected design basis events, should Palo Verde enter the proposed conditions associated with the LCO.

- 14 The licensee provided supplemental analyses to justify the proposed Conditions, Required Actions, and CTs. The NRC staff reviewed the supplemental analyses in detail, and found it sufficient for completion of the NRC staff review.

3.2.3.1 LOCA LTC Analysis By letter dated June 22,2011, the licensee stated the following with respect to the LOCA LTC analysis:

The LOCA LTC analysis in UFSAR Section 6.3.3.4 evaluates post-LOCA mitigation strategies that will maintain the core at safe temperatures and avoid the precipitation of boric acid in the core region. The LTC analysis credits two mitigation strategies depending upon break size. If the break is sufficiently small, the Reactor Coolant System will eventually refill and successful operation of the shutdown cooling system will be assured. If the break is large enough to prevent refill of the RCS, then long-term cooling will be afforded by simultaneous hot and cold side injection. Regardless of the mitigation strategy employed, the analysis assumes that plant operators will open one ADV per SG within one hour post LOCA to release steam from the SGs and initiate cooldown. The design basis event combination for this analysis includes an initiating break, a loss of offsite power, and a single failure of an active component. Consideration of the single failure criterion implies that the ADV TS LCO should require more than two OPERABLE ADVs (Le., one per SG).

The proposed LCO will ensure that accounting for a potential failure in which a fault in the ADV control circuits renders one ADV on each SG inoperable, an ADV on each SG remains operable to fulfill the analyzed LTC function. The NRC staff determined that the proposed LCO is acceptable, because as 10 CFR 50.36 requires, the LCO specifies the lowest functional capability or performance level of equipment required for the safe operation of the facility.

Furthermore, because the LTC analysis does not assume that ADVs are required until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months following the event, the NRC staff determined that the proposed Conditions, Required Actions, and CTs are acceptable with respect to the LTC analysis, because there is suitable time to determine an alternate to using the ADVs, in the event that ADVs are not available in the event of a LOCA.

3.2.3.2 Residual Heat Removal The licensee's June 22, 2011, submittal states the following with respect to the RHR requirements 2 :

The BTP [NUREG 0800, "Standard Review Plan (SRP) for the Review of Safety Analysis Reports for Nuclear Power Plants," Branch Technical Position] RSB 2 At the time Palo Verde was licensed, Branch Technical Position (BTP) Reactor Systems Branch (RSB) 5-1, "Oesign Requirements of the Residual Heat Removal System," was in use. Since then, the SRP has been revised, and the BTP numbering has also been revised. Applicable guidance is currently contained in SRP Chapter 5.4.7, "Residual Heat Removal (RHR) System," and in BTP 5-4, "Design Requirements of the Residual Heat Removal System."

- 15

[Reactor Systems Branch] 5-1 scenario is described in UFSAR Appendix 5C.

The functional requirements of BTP RSB 5-1 ensure that the cooldown can be accomplished within a reasonable time after reactor shutdown using only safety grade systems (described in NRC guidance provided by Table 1 of the RSB 5-1 for Class 2 plants). Following a reactor trip, the plant must have the capability to maintain Hot Standby conditions for at least four hours prior to commencement of a cooldown. The credited systems must function using either onsite electrical power system operation (assuming offsite power is not available) or offsite electrical power system operation (assuming onsite power is not available) and assuming a single failure. Systems must be capable of remote operation from the control room although limited operator action outside of the control room is acceptable to mitigate the effects of postulated single failures.

By letter dated January 27, 2012, in response to the NRC staff's RAI dated August 31,2011 (ADAMS Accession No. ML112430084), the licensee provided additional clarification regarding the role of the ADVs with respect to fulfilling RHR requirements. The ADVs become important in the event the plant is required to cool down under natural circulation conditions (e.g., an extended loss-of-offsite power causes the reactor coolant pumps to trip).

The ADVs serve two purposes during a natural circulation cooldown. The licensee stated that the natural circulation cooldown analysis assumes that ADVs are first opened within approximately 500 seconds of the initiation of a natural circulation cooldown event, but that this early operation is intended to limit repeated cycling of the MSSVs. In this early use, the ADVs are opened to maintain pressure just below the lowest MSSV opening pressure setpoint. The second use for the ADVs is to throttle them open and initiate an RCS cooldown. This use of the ADVs occurs at 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months into the sequence. The licensee's letter dated January 27,2012, also stated that one ADV per SG was required to accomplish this controlled cooldown function.

Because the LCO requires all four ADVs to be operable, and the limiting single failure with respect to the ADV is a control malfunction that renders two ADVs, one on each SG, inoperable, the NRC staff determined that the proposed LCO specifies the lowest functional capability or performance level of equipment required for the safe operation of the facility, consistent with 10 CFR 50.36 requirements.

Since the early use of the ADVs is to limit MSSV cycling, it is clear that, should all ADVs be unavailable, the MSSVs would still limit the SG shell-side pressure. In addition, the ADVs are not required to commence a cooldown until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months into the natural circulation cooldown event.

In the event the ADVs are inoperable, an operator action to manually open the ADVs, or to identify another means to depressurize the SG can be undertaken. Based on these considerations, the NRC staff concludes that that the proposed Conditions, Required Actions, and CTs are acceptable with respect to the RHR analyses.

3.2.3.2.1 Defense-in-Depth Evaluation for Natural Circulation Cooldown Per the requirements of BTP RSB 5-1 [4], a licensee is required to have sufficient safety-related systems that following a reactor trip from full power, can maintain hot standby conditions for at least 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and then cool down the RCS from normal operating temperature to cold shutdown conditions within a reasonable time. Plant systems must be capable of supporting a natural

- 16 circulation cool down to shutdown cooling entry conditions using only the TS minimum values of nitrogen gas contained in the ADV accumulators and water available in the condensate storage tank. The BTP restricts use to only safety grade systems that satisfy GDCs 1 through 5 and will function using onsite emergency electrical power. The systems must be capable of remote operation from the control room; however, limited operator action outside of the control room may be acceptable to mitigate the effects of postulated single failures. In addition, the plant must assume a limiting single failure.

The licensee initially intends to remove RCS heat using the main steam safety relief valves and ADVs. In the event of a limiting single failure making two ADVS inoperable, one on each steam generator, there would still be one operable ADV on each steam generator. The licensee is proposing a TS Condition which permits all four ADVs to be inoperable up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Therefore, to continue to meet BTP 5-1[4] requirements, the licensee must have an available and reliable alternate for the ADVs as an acceptable defense in depth.

The licensee proposes the use of the two atmospheric SBCS valves as a reliable and available alternate for the ADVs. However, these atmospheric SBCS valves are non-class whereas the BTP requires the use of safety-related equipment. In the event of loss-of-offsite power, all non-class instrument and control power is lost. In addition, since the air compressors are powered from a non-class power supply, the normal instrument air system which provides the motive force for the SBCS valve actuators is also lost.

The licensee proposes that the two atmospheric SBCS valves will remain available for immediate use remotely for a limited time during a loss-of-offsite power event. The control power for the atmospheric SBCS valves comes from the DC bus, and the instrument AC is powered from an uninterruptible power supply that receives power from non-class and class power supplies. Also, the licensee's evaluation of the nitrogen backup to the instrument air system determined it will provide at least 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of operation for the atmospheric SBCS valves.

The licensee states that 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is sufficient time to get operators stationed at the SBCS valves to operate manually if needed. Thus, the licensee concludes that the atmospheric SBCS valves are a reliable and available alternative for the ADVs.

However, the atmospheric SBCS valves are non-safety-related. The BTP requires use of safety-related components. Therefore, without the ADVs, the licensee does not satisfy the criteria for being able to accomplish an RCS cooldown with only safety-related equipment. The licensee proposes the non-safety-related atmospheric SBCS valves are an adequate alternative. Even though the atmospheric SBCS valves are non-safety-related, the licensee has designed them to be highly reliable. NRC staff approval is required to use of the atmospheric SBCS valves as an acceptable alternative for the ADVs when in the TS Condition with all four ADVs inoperable.

The Palo Verde units were designed before the guidance in BTP RSB 5-1[4] was issued. The Palo Verde design does not meet all the requirements of BTP RSB 5-1 [4]. Since the Palo Verde design was completed and the construction permit was docketed before the original issuance of BTP RSB 5-1 [4], partial implementation of the functional requirements was permitted for Palo Verde as a "Class 2" plant. Exceptions were taken for portions of the chemical and volume control system (CVCS), which constitutes the primary method for reactivity control, reactor coolant makeup, and RCS pressure control during the cooldown to

- 17 shutdown cooling (SDC) entry conditions. To achieve an acceptable level of reliability, Palo Verde committed to a number of engineering and administrative controls as described in UFSAR Section 9.3.4.4.5, "Natural Circulation Cooldown."

As provided in the SRP, exceptions to the requirements have been granted to Palo Verde as a Class 2 plant, in part, because the overall design provides an acceptable level of reliability.

Reliability is provided by some non-safety design features that are not credited directly in the analysis. The NRC staff has accepted "limited" operator action outside of the control room to mitigate the consequences of postulated single active failures, considering that only onsite or offsite power is available. Based upon the information provided by the licensee, a review of the plant design, and an audit of operator actions and procedures, the NRC staff concludes that the use of the atmospheric SBCS valves provides a reasonable level of assurance that the licensee can perform a natural circulation cooldown using the two atmospheric SBCS valves to perform the safety function of the ADVs.

3.2.3.3 Main Steam and Feedwater Line Breaks Although the licensee's letter dated June 22, 2011, did not identify the ADVs as significant in the mitigation of the main steam and feedwater line break events 3 , the NRC staff requested additional information about both events, because the ADVs may be used, following either scenario, to assist in post-event plant cooldown. The final paragraph of UFSAR Section 15.1.5.2, "Sequence of Events and System Operation," states that Operator action is not credited in the MSLB safety analyses until 30 minutes following event initiation. At that time, it is assumed that plant operators will take action to initiate a controlled plant cooldown to SDC entry conditions, for example by manually establishing AFW [Auxiliary Feed Water] flow and a steaming path through the ADVs associated with the unaffected SG.

Since neither the feedwater line break (FWLB) nor the main steam line break (MSLB) accident analyses credit the ADVs, the NRC staff did not determine that the proposed LCO is directly applicable; however, since a condition is proposed, in which all four ADVs may be out of service for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the NRC staff requested that the licensee address the long-term recovery aSSOCiated with both events with respect to the potential unavailability of all ADVs.

3.2.3.3 Main Steam Line Break - Additional Review By letter dated January 27, 2012, the licensee stated that the MSLB analysis had been repeated 4

using the CENTS code, using a case that was based on the MSLB analYSis contained in the current licensing basis. This supporting analYSis was performed assuming that the ADVs were 3 ADVs are not significant with respect to mitigating the immediate effects of either event. The UFSAR safety analyses demonstrate that neither event would cause the plant to exceed fuel cladding integrity, or RCS pressure boundary, safety limits; if the analyses predict that such limits would be exceeded, the analyses must demonstrate that the radiological consequences are acceptable. These analyses do not credit the ADVs.

4 CENTS is an interactive computer code for simulation of the nuclear steam supply system and related systems. It is described in WCAP-15996, "Technical Description Manual for the CENTS Code,"

November 2005 (ADAMS Accession No. ML053290341).

- 18 not available, and it simulated 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of elapsed time following the MSLB. The analysis indicated that, following an increase in RCS pressure and temperature, the pressurizer safety valves (PSVs) and MSSVs cycle to keep primary and secondary pressures below applicable design limits. The analysis terminates after 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , and therefore assumes that operators will commence a plant cooldown prior to that point. The licensee stated that this analysis confirmed that there was no unacceptable degradation of margin relative to the applicable acceptance criteria.

By letter dated January 30,2013, the licensee provided additional detail concerning the supplemental MSLB analysis. Specifically, the licensee provided the resl.Jlts of the analysis, the sequence of events, and transient plots of key system parameters.

Table 2-1 of the licensee's letter dated January 30, 2013, provided the results of the supplemental MSLB analysis. The table indicated that the maximum RCS pressure did not exceed 2563 pounds per square inch absolute (psia); this is an acceptable result because the RCS pressure safety limit is 2750 psia. The peak pressurizer water volume remained below 1451 cubic feet with the PSVs open 5 , and below 1765 cubic feet with the PSVs closed. These results indicate that the PSVs will not pass liquid water, and that the pressurizer does not enter a water-solid condition. Main steam pressure, minimum departure from nucleate boiling ratio (DNBR), and peak fuel linear heat rate results were also well within the applicable acceptance criteria.

The plots associated with the MSLB analysis show that the immediate effect of the MSLB is a reduction in RCS pressure due to the excessive cooling associated with the steam flow out the break. There is an increase in RCS pressure that follows the reactor trip and actuation of the mitigating systems, and it appears that the PSVs cycle to relieve RCS pressure during the first 30 minutes. Following that, the RCS pressure continues to fluctuate below the PSV setpoint, indicating that the RCS pressure is coupled to the intact SG, which is cycling on safety valves.

After its initial depletion, the pressurizer steadily fills with liquid until about 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months following the event, at which point it stabilizes.

The supplemental MSLB analysis performed by the licensee demonstrates that the plant will respond acceptably to an MSLB event, even in the case where the MSLB occurs while the plant is in Condition B associated with LCO 3.7.4, with all four ADVs inoperable. Based on the above, the NRC staff concludes that the proposed revision to the LCO and associated Conditions, Required Actions, and CTs are acceptable with respect to the long-term recovery from an MSLB.

3.2.3.3.2 Feedwater Line Break - Additional Review The licensee's letter dated January 27, 2012, indicates that the limiting heat removal event is the FWLB. As analyzed in the UFSAR, the event credits an operator action to open an ADV 10 percent on the intact SG from the control room 20 minutes after the event initiates. The letter also discussed the results of a supplemental FWLB analysis that was performed using similar assumptions and analytic methods, with the exception that the ADV was not assumed to open.

5 The licensee applies an acceptance criterion of 1697 cubic feet for maximum pressurizer liquid volume while PSVs are open to ensure that water does not pass through the PSVs, a condition which could prevent the PSVs from re-seating and thus lead to unisolable RCS leakage.

- 19 The supplemental analysis demonstrated that the plant recovered acceptably from the FWLB without the ADV, By letter dated January 30, 2013, the licensee provided additional information concerning the supplemental FWLB analysis, Specifically, the licensee provided the results of the analysis, the sequence of events, and transient plots of key system parameters.

Table 3-1 of the licensee's letter dated January 30, 2013, provided the results of the supplemental FWLB analysis and showed that applicable acceptance criteria were met. The maximum RCS pressure was maintained below 120 percent of the design pressure, with significant margin. The pressurizer pressure with PSVs also remained within PSV operability criteria. In addition, pressurizer water volume results showed that water was not relieved through the PSVs, and that a water-solid condition in the pressurizer would not occur.

The licensee also provided system transient plots for the supplemental FWLB analyses. The pressurizer pressure reached a peak at approximately 30 minutes, after which the pressure steadily decreased. The intact SG stabilized within the first 5 minutes, with secondary pressure controlled by the MSSVs. These results indicate that no analytic acceptance criteria are exceeded and, based on this consideration, the NRC staff concludes that the results are acceptable.

As discussed in Section 3.2.3.3.2.1 of this safety evaluation, the FWLB analysis credits an operator action to secure the charging pumps 20 minutes following the initiation of the FWLB.

The supplemental FWLB analysis performed by the licensee demonstrates that the plant will respond acceptably to an FWLB event, even in the case where the FWLB occurs while the plant is in Condition B associated with LCO 3.7.4, with all four ADVs inoperable. Based on the above, the NRC staff concludes that the proposed revision to the LCO and associated Conditions, Required Actions, and CTs are acceptable with respect to the long-term recovery from an FWLB.

3.2.3.3.2.1 Defense-in-Depth Evaluation for Feedwater Line Break In order to successfully mitigate a main feed line break inside containment, the accident analysis credits plant operators taking actions to limit pressurizer level in order to avoid going solid in the pressurizer or causing water entrainment in the steam release through the safety valves. The PSVs are not designed for a liquid release and may subsequently fail if water is allowed to pass through the safety valves. Therefore, operator intervention is required to prevent the pressurizer from going solid during a feedline break accident.

A feedline break results in a sudden RCS cooldown and depressurization. After the initial depressurization, there is a subsequent RCS heatup and repressurization. During the RCS depressurization phase, safety injection continues to add inventory to the RCS until the RCS pressure reaches safety injection pump shut-off head of approximately 1900 pounds per square inch gauge (psig). After reaching 1900 psig, the charging pumps will continue to add inventory to the RCS. Residual heat from the fuel heats the RCS back up, causing the pressurizer level to rise.

- 20 If the feedline break is inside containment, then the increase in containment pressure will cause an automatic main steam isolation signal actuation. With the MSIVs closed, the atmospheric SBCS valves will not be available. If all ADVs are inoperable, then the plant operators will not have an adequate means of controlling the subsequent RCS heatup. The only heat removal mechanism available will be the MSSVs on the intact steam generator. In the analysis of a feedline break, the licensee credits operators opening an ADV within 20 minutes to stop the subsequent RCS heatup. In the event the ADVs are all unavailable, the plant operating procedures do not give any guidance to the operators to open the MSIV bypass valves and use the atmospheric SBCS valves to stop the RCS heatup. However, the licensee has performed a supplemental analysis showing the plant response without having any operable ADVs. As an alternative, the licensee's analysis shows that if operators can secure all charging pumps within 20 minutes, then the pressurizer will not over-fill. Current operating procedures do not specifically direct the operators to secure the charging pumps.

In response to a feedline break, plant procedures direct operators to control RCS pressure using pressurizer spray. Since there are no operating reactor coolant pumps, normal pressurizer spray is not available. Therefore, operators must use the discharge of a charging pump through the alternate pressurizer spray. Hence, the operators cannot secure all charging pumps indefinitely. This operator demand conflicts with the alternative action credited in the supplemental safety analysis to secure all charging pumps within 20 minutes. The supplemental analysis does not assume the alternate pressurizer spray line is available. During a site audit, NRC staff observed operator performance in the simulator mitigating a feedline break. The operators demonstrated cycling the charging pumps on to control pressurizer pressure with auxiliary spray. This action did not cause the pressurizer to over-fill. The licensee provides additional supporting information that showed there was no challenge to the limit on water level that would lead to water entrainment in the steam released through the PSVs.

Therefore, the NRC staff concludes that plant operators can successfully mitigate a feedwater line break with all ADVs inoperable without sustaining any additional damage to the plant or challenging any equipment design limits.

3.2.3.4 Steam Generator Tube Rupture By letter dated June 22,2011, the licensee stated the following with respect to the SGTR with a COincident loss-of-offsite power (LOP) and single failure (SF):

In the SGTRLOPSF analysis in UFSAR Section 15.6.3.3, the radiological consequences are maximized by assuming a loss of offsite power which results in the closure of the MSIVs, a coincident iodine spike, and a single failure that results in one ADV on the affected SG being in a failed open position. In this event scenario, after a reactor trip, the operator opens one ADV on each SG to initiate unit cooldown; however, it is assumed that the ADV on the affected SG fails open. The operator then closes the ADV on the unaffected SG to prevent an excessive cooldown rate. In this scenario, as required, the operator reopens the ADV on the unaffected SG to continue the cooldown of the unit to SDC entry conditions. The SGTRLOPSF analysis is considered the bounding licensing basis for a SGTR event, and the maximum radiological consequences from that event remain within the Nuclear Regulatory Commission (NRC) 10 CFR 100 limits. In December 1984, the NRC staff accepted APS's SGTRLOPSF

- 21 reanalysis for [Palo Verde] that utilized the 10 CFR 100 dose limit guidelines in NUREG-0857, Safety Evaluation Report Related to the Operation of Palo Verde Nuclear Generating Station Units 1, 2, and 3.

The licensee has proposed to revise LCO 3.7.4 to require all four ADVs to be operable. By letter dated June 22, 2011, the licensee stated the following with respect to the single failure vulnerability that the revised LCO would address, relative to the SGTR event:

... [A1 potential single failure involving the ADV control circuits could potentially render two ADVs (i.e., one on each SG) incapable of being opened remotely ...

The licensee's letter dated June 22, 2011, stated that one ADV per SG is credited to mitigate design basis events. Because the LCO requires all four ADVs to be operable, and the limiting single failure with respect to the ADV is a control malfunction that renders two ADVs, one on each SG, inoperable, the NRC staff determined that the proposed LCO specifies the lowest functional capability or performance level of equipment required for the safe operation of the facility, and is consistent with 10 CFR 50.36 requirements.

In an RAI dated August 31, 2011, the NRC staff also requested that the licensee provide additional information to justify its proposed Condition B, in which all four ADVs may be inoperable for up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , with respect to the SGTR event. In its response dated January 27,2012, the licensee stated that an SGTR event had been evaluated, assuming that control room operation of the ADVs was not available. The analysis used the CENTS computer code, and was performed using similar methods to those used for the licensing basis SGTR analyses described in the UFSAR. Several differences in the initial conditions and modeling were identified, however:

An initial SG water level reflective of full power operating conditions was used in order to maximize the potential for SG overfill, rather than to maximize tube uncovery,

The nodalization used for the demonstration analysis was more detailed in the reactor vessel downcomer and the SG tubes, when compared to the licensing basis analyses, and

The licensee used the Henry-Fauske correlation to calculate choked flow through the ruptured tube, whereas the licensing basis analysis used a homogenous equilibrium model.

- 22 The licensee stated that the following conclusions were drawn from the analysis:

The SGs maintained margin to overfill conditions,

Peak primary and secondary coolant system pressures remained within design limits,

There was no indication of fuel failure, and

Predicted radiological consequences remained acceptable.

By letter dated January 30, 2013, the licensee provided additional detail regarding the SGTR analysis initiated from proposed LCO 3.7.4 Condition B. The supplemental information included tables and transient plots of the SGTR analyses, and comparisons between the Homogeneous Equilibrium Model (HEM) and Henry-Fauske break flow models.

The licensee provided a table of results and acceptance criteria for the SGTR. This table showed that the peak RCS pressure remained well below the 110 percent design limit. This is an expected result, since an SGTR results in coolant leakage from the primary system. The peak SG pressure approached its design limit of 1397 psia, with a peak result of 1354 psia.

Radiological consequences did not exceed 20 percent of the applicable acceptance criteria for the 4-hour duration of the analyzed event.

The peak secondary pressure occurs at 624 seconds following the initiation of the tube rupture, immediately after the turbine trip and loss-of-offsite power. Secondary pressure is controlled thereafter by MSSV cycling.

The water level in the ruptured SG reaches its peak at 239 minutes, which is very close to the end of the analyzed event. However, the licensee provided a plot of SG level versus time to show that the level in the ruptured generator is trending to a stable condition at that time.

Additionally, this time is 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months following the inception of the event. It is expected that the licensee would be evaluating and taking compensatory measures at this time to enhance RCS and secondary cooling in order to minimize liquid ingress into the ruptured SG.

The licensee's supplement dated January 30, 2013, also included RCS subcooling, plotted as a function of time. The RCS subcooling does not drop below 10 degrees Fahrenheit (OF), and slowly increases for the first 1.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months following the event. After that, the subcooling remains steadily between 25 OF and 50 OF, cycling with the RCS pressure fluctuations through the event.

This information is a reasonable indication that fuel cladding thermal limits are not exceeded, and thus that fuel cladding integrity is maintained as indicated in the licensee's letter dated January 27, 2012.

The licensee provided information to establish the acceptability of the use of the Henry-Fauske break flow model. By letter dated January 30, 2013, in response to NRC RAI 1.b dated December 13, 2012, the licensee stated that the implementation of both the HEM and the Henry-Fauske models had been approved by the NRC in various revisions of the CENTS licensing topical report. In addition, the licensee provided plots comparing the HEM and Henry-Fauske models. The first was a generalized plot that showed critical mass flux as a

- 23 function of enthalpy for both models. The second plot showed instantaneous break flow as a function of time for three cases. This included the licensing basis analysis (SGTRLOPSF) with the HEM, the SGTRLOPSF with the Henry-Fauske model, and the SGTR demonstration analysis using the Henry-Fauske model. Both plots indicated that there was reasonable agreement between the two models. Based on the reasonable agreement and the prior NRC staff approval of each modeling approach, the NRC staff determined that the use of the Henry Fauske break flow model is acceptable, despite the licensing basis safety analysis having been performed using the HEM break flow model.

Based on the above, the NRC staff concludes that the licensee's supplemental SGTR analysis demonstrated that the consequences of an SGTR initiated from LCO 3.7.4 Condition Bare acceptable.

3.2.3.4.1 Defense-in-Depth Evaluation for Steam Generator Tube Rupture In order to successfully mitigate a steam generator tube rupture, the plant operators must quickly reduce the RCS pressure below the steam generator pressure. Prior to depressurizing the RCS, operators must first commence a rapid RCS cooldown to obtain an adequate subcooling margin. Plant procedures direct operators to steam both steam generators to reduce RCS temperature in order to gain and maintain a sufficient RCS margin to saturation.

Eventually, the operators will depressurize the RCS below the secondary steam generator pressure.

The licensee credits the use of the ADVs as the safety-related means to perform the required RCS cool down. In this amendment, the licensee is requesting a TS Condition for all ADVs to be unavailable. While in this condition with no ADVs available, the NRC staff still requires the licensee to provide a reliable means to perform aRCS cooldown in the event of an SGTR with a coincidental loss-of-offsite power. The licensee's defense-in-depth strategy is that the atmospheric SBCS valves would be available to conduct the required RCS cooldown.

In the event of a loss-of-offsite power, the normal method of releasing steam from the steam generator to the main condenser using the six condenser SBCS valves is not available.

However, Palo Verde is designed with two additional atmospheric SBCS valves downstream of the MSIVs that release to the atmosphere instead of the main condenser. As long as the MSIVs remain open, then the atmospheric SBCS valves will remain a viable option for the operators to use.

These two atmospheric SBCS valves are non-safety-related, air-operated relief valves that are equivalent in size to the ADVs. Instrument power to the valves comes from the emergency bus, and control power comes from the DC bus. In addition, the normal instrument air header has a supplemental nitrogen gas system with sufficient quantity to keep the instrument header pressurized for an extended period of time. With the backup air supply and electric power, the licensee proposes that the two atmospheric SBCS valves should be available to enable operators to conduct an RCS cooldown. Therefore, the licensee concludes that two atmospheric SBCS valves can be credited as an immediate alternative means to cool down the RCS if all of the ADVs are unavailable, assuming the MSIVs remain open, the supplemental nitrogen gas system keeps the instrument air header pressurized, and emergency power is provided to the atmospheric SBCS valves.

- 24 In the event the instrument air header becomes depressurized, or emergency power is lost to the atmospheric SBCS valves, the licensee explains that operators can take actions to manually operate the valves locally. If the MSIVs go closed, then the downstream main steam header may depressurize, making it difficult to reopen the MSIVs. However, the MSIVs have a bypass valve that can be operated remotely from the main control room using its air operator and emergency power. The licensee has calculated that the flow rate through the bypass lines using both atmospheric SBCS valves is sufficient to accomplish an RCS cooldown. By letter dated January 30, 2013, in response to the NRC staff's RAI on flow to the SBCS valves dated December 13, 2012, the licensee stated that The worst case steam flow path consists of flow through one MSIV bypass line and subsequently through the two SBCS valves that release to atmosphere.

This flow path will be sufficient to cooldown the plant after approximately 40 minutes.

Therefore, the licensee demonstrated that the atmospheric SBCS valves can provide an alternate means to cooldown the RCS using remote and local manual operations if the ADVs are unavailable, even if the MSIVs close or remote operation of the atmospheric SBCS valves becomes unavailable.

The licensee and the NRC staff realize that additional time is required to operate valves locally in the field. Unfortunately, time is a critical parameter during an SGTR for operators to depressurize the RCS below the steam generator pressure to stop the leak. Therefore, the operator must use a combination of releasing steam from the steam generators for cooldown and pressurizer spray for depressurization, while maintaining an adequate RCS subcooling margin. If the leakage from the RCS into the steam generator was allowed to continue indefinitely unabated, then the steam generator would over-fill, creating a liquid release out the relief valves. Currently, the radiological dose calculations do not include a liquid release. In addition, the additional weight of water in the main steam lines may cause the lines to fail.

Therefore, in the event the ADVs are unavailable and local manual operation of the atmospheric SBCS valves is required, it is imperative that operators initiate actions to control the water inventory level in the ruptured steam generator to avoid overfill or water entrainment in the steam releases. The licensee states that procedures exist for operators to use the steam generator blowdown system to drain water in order to control inventory level. Hence, the licensee has exhibited an additional defense in depth measure to control steam generator level.

The licensee's proposed defense-in-depth strategy, using the two atmospheric SBCS valves when the ADVs are not available, is reasonable. Based upon the review of the design, equipment, procedures, and required operator actions, the NRC staff concludes that there is reasonable assurance that the atmospheric SBCS valves will be available for use in the event the SBCS valves to the condenser and the ADVs are not available.

3.2.3.5 FWLB and SGTR Control Room Interventions Typically. licensing basis safety analyses do not assume early operator intervention because the safety analysis should demonstrate that mitigating systems, structures, and components are designed to provide for safe operation of the facility. By contrast, the supporting analyses

- 25 reviewed above were intended to show that defense-in-depth exists to preserve safety margins in the event that the plant is in LCO 3.7.4 Condition B. Therefore, the supporting analyses for these events demonstrated that the associated consequences would remain acceptable, provided ADVs are unavailable for remote control room operation. Each of these supporting analyses included assumptions regarding operator actions to mitigate the effects of the ADV unavailability.

The NRC staff included in its review of these supplemental analyses observations of simulator scenarios for both FWLB and SGTR, in which the ADV remote operation capability in the simulator was disabled. This activity was included as part of the review to obtain additional information concerning the as-analyzed operator response and its comparability to operator performance. The staffs review was accomplished by conSidering additional information provided in the licensee's letter dated January 30, 2013, which described the operating crew response to the simulator scenarios and compared the simulator response to the supplemental analyses that were discussed in the letters dated January 27,2012, and January 30,2013.

In the case of both the FWLB and the SGTR, the licensee explained how the simulator performance during either scenario differs from the demonstration analyses. In both cases, the simulator is run at nominal initial conditions instead of the bounding, more severe initial conditions associated with the supplemental safety analyses.

In the SGTR evaluation, the licensee observed that the CENTS results, such as the minimum and maximum SG water levels reached, tended to be more severe than the simulator analogue.

In the FWLB analyses, the CENTS code does not model pressurizer auxiliary spray, but operators use this feature, in combination with modulating the charging flow, in the simulator to control the RCS system response. The CENTS analysis assumed, instead, that RCS pressure was controlled simply by securing charging 'flow. The operator actions in the simulator, therefore, reduced the severity of the event in comparison to the CENTS analysis.

In both cases, however, the trends indicated in both the CENTS analyses and simulator analogues were generally consistent. The NRC staff concludes that this general consistency supports the conclusion that the operator interventions assumed in the CENTS analyses were reasonable.

The control room interventions observed by the NRC staff, and reflected in the licensee's RAI response dated January 30, 2013, showed that operator instructions provided in control room operating procedures serve to lessen the severity of licensing basis events that would typically require ADVs for mitigation, provided that the ADVs are unavailable. The NRC staff concludes, therefore, that this information shows that the CENTS analyses provided in support of LCO 3.7.4, Condition B, are a reasonable indication that there is sufficient defense-in-depth to maintain plant safety margins while the plant is in Condition B with all four ADVs inoperable.

3.3 Conclusion Based on the above, the NRC staff concludes that the licensee's proposed revision to TS 3.7.4 is acceptable. The LCO is consistent with 10 CFR 50.36 requirements in that it specifies the lowest functional capability or performance levels of equipment required for safe operation of

- 26 the facility, consistent with the Palo Verde UFSAR Chapter 15 safety analysis. In addition, the most incapacitating condition proposed by the licensee, in which all four ADVs may be unavailable, is supported by supplemental safety analyses demonstrating that immediate ADV actuation is not required, and adequate operating procedures that provide for the mitigation of licensing basis events using equipment other than the ADVs. Furthermore, based upon the review of the design, equipment, procedures, and required operator actions, the NRC staff concludes that there is reasonable assurance that the atmospheric SBCS valves will be available for use in the event that the SBCS valves to the condenser and the ADVs are not available.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Arizona State official was notified of the proposed issuance of the amendment. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on October 4,2011 (76 FR 61394). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: B. Parks S. Gardocki M. Hamm Date: Apri 1 11, 2013

REdington -2 A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely, IRA by Lauren K. Gibson forI Jennivine K. Rankin, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. STN 50-528, STN 50-529, and STN 50-530

Enclosures:

1. Amendment No. 191 to NPF-41

2. Amendment No. 191 to NPF-51

3. Amendment No. 191 to NPF-74

4. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION:

PUBLIC RidsNrrLAJBurkhardt Resource LPLIV r/f RidsNrrPMPaloVerde Resource RidsAcrsAcnw_MaiICTR Resource RidsOgcRp Resource RidsNrrDorlDpr Resource RidsRgn4MailCenter Resource RidsNrrDorlLpl4 Resource MHamm, NRR/DSS/STSB RidsNrrDssSbpb Resource BParks, NRR/DSS/SRXB RidsNrrDssScvb Resource SGardocki, NRR/DSS/SBPB RidsNrrDssStsb Resource Iw.

ADAMS Accession No. ML13080A331 E

NRRfDORULPL4/PM JRankin NRRfDORULPL4/PM LGibson NRRfDORULPL4/LA~RfDSS/SBPB/BC JBurkhardt Casto

b),[memo dated NRRfDSS/STSBlBC IRElliott DATE 3/25/13 3/25/13 3/25/13 i 3/4/13' ! 3114/13' OFFICE NRRfDSS/SRXBlBC (A) OGC NLO NRRfDORULPL4/BC NRRfDORULPL4IPM JRankin (LKGibson NAME SMiranda' JWachutka MMarkley for)

DATE 3/11/13 3/29/13 4/11/13 4/11113 OFFICIAL AGENCY RECORD

v t e Letter Sequence Approval
TAC:ME6566, (Approved, Closed) TAC:ME6567, (Approved, Closed) TAC:ME6568, (Approved, Closed)
Initiation Request, Request, Request Acceptance... Administration Questions 26 August 2011 26 August 2011 3 December 2012 31 August 2011 13 December 2012 Answers 9 December 2011 30 January 2013 Results Approval Other: ML12261A137
MONTHYEAR2012-01-27 [Table View]

ML13080A331

Text

SUBJECT:

Dear Mr. Edington:

Enclosures:

Attachment:

Attachment:

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

4.0 STATE CONSULTATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 CONCLUSION

Enclosures:

Navigation menu

Search