ML17227A625

Proposed Tech Specs 4.5.2.d.1,reflecting Removal of Shutdown Cooling auto-closure Interlock Surveillance Requirement

ML17227A625
Person / Time
Site:	Saint Lucie
Issue date:	10/21/1992
From:	FLORIDA POWER & LIGHT CO.
To:
Shared Package
ML17227A624	List: ML17227A623 ML17227A625
References
NUDOCS 9210260315
Download: ML17227A625 (25)

Text

St. Lucie Unit 1 Docket No. 50-335 Proposed License Amendment Removal of Shutdown Cooling Auto-Closure Interlock Surveillance Re uirement ATTACHMENT 1 St. Lucie Unit 1 Marked-up Technical Specification Page T/S 3/4 5-4 92ioi~oii5 9aio2i PDR F', 'DR ADOCK 05000335 J

EMERGENCY CORE COOLING SYSTEMS SURVEILLANCE RE UIREMENTS 4.5.2 Each ECCS subsystem shall be demonstrated OPERABLE:

a. At least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> by verifying that the following valves are in the indicated positions with power to the valve operators removed:

r Valve Number Val've Function Val ve Posi tion

l. V-3659 1. Mini-flow l. Open isolation

2. V-3660 2. Mini-fTow 2. Open isolation

b. At least once per 31 days by:

l. Verifying that each valve (manual, power operated or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

c. By a visual inspection which verifies that no loose debris (rags, trash, clothing, etc.) is present in the containment which could be transported to the containment sump and cause restriction of the pump suctions during LOCA conditions. This visual inspection shall be per'formed:.

1. For all accessible areas of the containment prior to establishing CONTAINMENT INTEGRITY, and

2. Of the areas affected within containment at the completien of containment entry when CONTAINMENT INTEGRITY is established.

d. At least once per 18 months by:

3 . ~e+l~g-aetom&4c-4scka44on-of-@he-shutdown-coo44ng

~@stem-from-the-Reac-te~~n4-System-when-the-Reao4.or

~~@4-Sys4ear-pr essence-46-above-800-ps+g.

2. A visual inspection of the containment sump and verifying that the subsystem suction inlets are not restricted by debris and that the sump components (trash racks, screens, etc.) show no evidence of structural distress or corrosion.

Verifying proper operation of the open permissive interlock (OPI) and the valve open/high SDCS pressure alarms for isolation valves V3651, V3652, V3480, V3481.

ST. LUCIE - UNIT 1 3/4 5-4 Amendment No. 9O

0 4~ L -. ~

1tlua4a\w' Aa ~ 'm s

St. Lucie Unit 1 Docket No. 50-335 Proposed License Amendment Removal of Shutdown Cooling Auto-Closure Interlock Surveillance Re uirement ATTACHMENT 2 SAFETY ANALYSIS Introduction Florida Power and Light Company (FPL) proposes to remove the auto-closure interlock (ACI) from the shutdown cooling system (SDCS) suction valves at St. Lucie Unit No. 1. The current design provides an ACI and an open permissive interlock (OPI) on each of the isolation valves to reduce the probability of inadvertent connection of the reactor coolant system (RCS) to the SDCS when the RCS pressure is above the design pressure of the suction line (300 psig). Motor-Operated Valves (MOVs) V3480 and V3481 for the 1A suction line, and V3651 and V3652 for the 1B suction line, are in series and are controlled by these interlocks. Each pair of MOVs creates a double barrier to isolate the SDCS suction line from the RCS. The OPI, which is not affected by the proposed ACI deletion, prevents the SDCS suction isolation valves from being opened when the RCS is already pressurized. The ACI is designed to close the SDCS suction isolation valves when the RCS pressure increases above 300 psig. An alarm currently exists for each train of valves to warn the control room operator whenever a SDCS suction isolation valve is not completely closed and the RCS pressure is greater than the setpoint.

Removal of the SDCS ACI feature addresses Commission concerns regarding the potential for failure of the ACI circuitry which could cause inadvertent isolation of the SDCS with subsequent loss of shutdown cooling capability during cold shutdown and refueling operation. In addition, the proposed modification is consistent with the recommendations of Generic Letter 88-17, "Loss of Decay Heat Removal."

The proposed removal of ACI features requires a change in the St.

Lucie Unit No. 1 Technical Specifications (TS). Specifically, TS 4.5.2.d.l will be modified to delete the surveillance of the ACI and add a surveillance of the OPI and the isolation valves'larm function.

Discussion The SDCS is designed to achieve and maintain a cold shutdown condition by removing residual energy from the RCS and decay heat from the reactor core. While the RCS has a design pressure of 2500 psia, the SDCS components have a design pressure of 500 psig or less. Since two piping systems of different design pressures are connected, suitable isolation capability must be provided when the RCS is being operated at high pressure. To ensure that isolation of the SDCS will remain in effect after any credible failure has occurred, two isolation devices in series are provided for each of the two SDCS suction lines (V3480 and V3481 for the 1A suction line, and V3651 and V3652 for the 1B suction line).

When the SDCS is in use, the system becomes an extension of the reactor coolant pressure boundary. Since a number of pressurization sources exist within or are connected to the high-pressure RCS, the low-pressure SDCS must be protected against postulated pressurization transients when the systems are connected. To accomplish this, each SDCS suction line is provided with a relief valve (i.e., V3468 and V3483). Note that these relief valves do not provide protection of the reactor coolant pressure boundary against brittle fracture due to pressurization at low temperature. At St. Lucie Unit 1, only the Power Operated Relief Valves (PORVs) are used for Low Temperature Overpressure Protection (LTOP).

Overpressure protection of the SDCS is based on those transients postulated to occur during normal SDCS operation. The suction line relief valves are not intended to protect the SDCS against over-pressurization as a result of being inadvertently exposed to full RCS pressure during power operation. A relief device with the capacity to protect against this event would not be practical.

Should the SDCS be exposed to RCS pressure during power operation, the SDCS could rupture at a point outside the containment causing an interfacing system loss-of-coolant accident (ISLOCA).

Appropriate alarms and two instrumentation interlocks are used to reduce the probability of the inadvertent connection of the RCS to the SDCS when the RCS is pressurized. These interlocks are generally described in Reactor Systems Branch Technical Position RSB 5.1.'he first interlock is designed to prevent opening the SDCS isolation valves when RCS pressure is above the SDCS design pressure. This feature is known as the open permissive interlock, or OPI. It protects against the spectrum of events which result from the SDCS suction isolation valves being opened when the RCS is already pressurized above the SDCS design pressure. The proposed design modification does not involve any change to this interlock.

The second interlock automatically provides a close signal to the isolation valves when RCS pressure exceeds the ACI,set point of 267 psia, ensuring that the SDCS suction will not exceed 300 psig (per TS 4.5.2.d.1.). Therefore, should these valves be inadvertently left open during RCS heatup and pressurization, the SDCS isolation valves would automatically close. This feature is known as the

auto-closure interlock, or ACI. ,Removal of ACI is being proposed as a way to decrease the probability of loss of shutdown cooling events.

As previously described, it is necessary to have two valves in series to form a reactor coolant pressure boundary so that no single failure can result in complete loss 'of this barrier. The double barrier is established by the operator closing both valves on each SDCS suction line when going from SDCS operation to steam generator cooling during plant heatup. Failure to establish this double barrier is possible due to a failure of the valve, valve operator, valve controls, or by operator error. A potential operator error is the closure of only one valve followed by RCS

'ressurization. It is this operator error that ACIs (and alarms) are intended to guard against. The interlock cannot guard against hardware malfunctions.

The design of the ACI presents an optimization issue between two competing safety functions. When the SDCS is needed, the suction valves must remain open. Failures resulting in valve closure are a safety concern due to the loss of decay heat removal.

Conversely, when ACI action is required, failures which leave the valves open adversely impact safety by overpressurizing the SDCS.

The industry has experienced a number of spurious valve closure events caused at least in part by the presence of the ACI. A frequent cause of spurious ACI action is accidental or intentional de-energization of a power supply resulting from maintenance work performed during refueling outages. The ACI circuit can be actuated after losing any of several power supplies. A second cause for spurious valve closure is an ACI actuation following receipt of an invalid high RCS pressure signal due to testing that is usually performed during refueling outages.

Resolution of issues related to loss of shutdown cooling events has been a topic of increasing concern to both the NRC and the industry for several years. Studies have identified spurious operation of ACI as the most frequent cause of reported loss of SDCS events between 1976 and 1983.

Spurious operation of ACI has two potential impacts. The most immediate result of valve closure is loss of SDCS flow and corresponding loss of decay heat removal from the core.

SDCS is not quickly restored, If the the resultant RCS temperature rise can result in pressurization of a closed system or loss of fluid through boiling if the reactor vessel head is removed for refueling. The second result of valve closure may be significant damage to the SDCS pumps (i.e. the 1A and 1B Low Pressure Safety Injection Pumps) due to loss of suction. This event is serious due to the potential for complicating the short-term recovery of core cooling and the longer repair time.

Since ACI is a significant contributor to loss of SDCS events at other plants, FPL is proposing removal of the feature from St.

W F.

P

Lucie Unit No. 1. The NRC has encouraged removal of ACI in Generic Letter 88-17. In that document, the NRC suggests that utilities seeking removal of ACI consider the approach taken by Pacific Gas and Electric in removing the ACI from the Diablo Canyon Units.

Safet Assessment Combustion Engineering (CE) has evaluated the impact of removing the ACI from the SDCS. The analysis was performed to determine the change in ISLOCA frequency, the change in SDCS unavailability, and the impact on mitigating low-temperature overpressure events due to the removal of ACI. This evaluation addresses seven guidelines for ACI removal recommended by the NRC in a memorandum from B. H.

Sharon (Chief, Reactor Systems Branch) dated January 28, 1985. In summary, the following discussion describes how each of the seven items are met. It should be noted that this discussion parallels that accepted by the NRC for Diablo Canyon and Waterford 3.

1~ Means available to minimize a LOCA outside containment.

The St. Lucie Unit 1 design provides for a double barrier between the RCS and the SDCS. The design provides a very high probability that at least one barrier can be established and maintained under any postulated condition. Procedural controls, training, alarms and the OPI function minimize the potential that the operator will fail to achieve double isolation during normal heatup and pressurization of the Reactor Coolant System (RCS), or defeat it once established.

Additionally, the SDCS is protected against rupture during an attempted normal heatup and pressurization of the RCS with the SDCS suction valves open by the SDCS suction relief valves.

CE provided a generic review and evaluation of removing the ACI function as a means to improve SDCS reliability. This evaluation bounded the configuration at St. Lucie Unit No. l.

The present SDCS configuration at St. Lucie Unit No. 1 includes two SDCS suction valves in series; the valves have ACI, OPI and a valve position alarm. Using generic probability values and methodology, CE demonstrated that A'CI removal and incorporation of certain changes to the existing alarm results in a negligible increase (0.098%) in the frequency of Interfacing System Loss of Coolant Accident (ISLOCA). A more detailed discussion of the ISLOCA probability is included in the response to Item 7 below.

2 ~ Alarms to alert the operator of an improperly positioned SDCS suction valve.

Alarms are provided in the main control room to inform the operator if any of the SDCS suction valves are not fully closed when RCS pressure is above the SDCS operating pressure.

These alarms, located on the main control boards, are

t 4

annunciator type which provide operators with both flashing lights and audible signals. Operating procedures will contain the appropriate response to the alarms and direct the operator to stop increasing RCS pressure and close the suction valves as required. The alarm set points will be tested at least once every 18 months to ensure reliability. The requirement, for this test is included in the proposed Technical Specification 4.5.2.d.1. surveillance. The alarms are designed to annunciate upon alarm relay failure.

3 ~ Verification of the adequacy of relief valve capacity.

As a part of the original system design process, calculations were performed to ensure that the relief devices in the SDCS suction lines had adequate capacity to prevent overpressurizing the SDCS during postulated events, as described in FSAR Section 6.3.2.2.6.d. CE reviewed these calculations and confirmed that ACI was not credited in the selection of limiting events or mitigation of the resulting transients. Therefore, the calculations remain applicable with the ACI removed.

4 ~ Means other than ACI to ensure that both isolation valves are closed.

The circuitry for the alarms described in Item 2 above will be modified to provide input to the alarm for valve position independent of the valve controls and position indication.

The plant's operating procedures and annunciator response procedures will be revised as required to direct the operator to verify valve position and take the appropriate actions the valve is not closed when high pressure is alarmed (i.e.

if above the SDCS set point). Cautions will be provided as necessary to direct the operator to not pressurize the RCS above SDCS design pressure unless both of the SDCS suction valves are closed. These means will ensure that the double barrier (i.e., two isolation valves in series on each SDCS suction line) is established upon heatup.

5. Assurance that the OPI is not affected by ACI removal.

The OPI function will be maintained in its present form, and this interlock will be tested at least once per 18 months to verify operability, per TS 4.5.2.d.l.

6. Assurance that valve position indication will remain available in the control room after ACI removal.

The valve position indication circuit, will be modified to provide a safety grade power supply independent of the valve's control power. This indication will be present even when

4Q

.A l r

rr

valve operation is locked out during power operation. Valve position indication is provided on the main control board and on the computer display located in the main control room.

Additional indication that the valve is closed will be provided by the lack of an alarm at. any pressure above the alarm set point.

7 ~ Assessment of the effect of ACI removal on SDCS availability and low-temperature overpressure event.

An analysis of the impact of removing the ACI from the SDCS was performed to determine the change in: 1) Interfacing System LOCA (ISLOCA) frequency, 2) The change in SDCS unavailability, and 3) The impact on mitigating LTOP events due to removal of the ACI.

The analysis considered both the present and proposed configurations of the SDCS. The present configuration considers SDCS suction valves with ACI and valve position alarm. The proposed configuration considers the SDCS suction valves with ACI removed, the same valve position alarm set point in the control room, and incorporation of necessary operating instructions to ensure appropriate operator response to the valve position alarm is taken.

Fault tree analysis was employed in determining the ISLOCA frequency and the SDCS unavailability for both configurations.

The basis for the construction and evaluation of the necessary fault tree models, the basis for quantifying frequencies for ISLOCA and SDCS unavailability, and human error probabilities is documented in the CE evaluation. The NRC has previously approved ACI removal for several plants utilizing this approach, including Waterford, San Onofre, and Diablo Canyon.

ISLOCA Frequency Results The analysis results for ISLOCA frequency are presented below:

SDCS Confi uration ISLOCA Fre uenc

1. (Current configuration) 1.1188 x 10'/year SDCS suction valves with ACI and alarm

-2. (Proposed configuration) 1.1199 x 10'/year SDCS suction valves with alarm only Because the ISLOCA frequency is governed by the combined catastrophic failure (gross leakage without position indication) of both suction valves, there is only a negligible increase (.098%) in ISLOCA frequency due to removal of the ACI.

Based on earlier NRC input (to be discussed below) sensitivity analyses were performed to determine the impact of operat'or

Al J'

error assumptions on ISLOCA frequency. Base case operator error probabilities were varied by fixed factors and ISLOCA frequency quantified with each variation. Since the ISLOCA frequency is governed by the catastrophic failure of both valves (rather than from the operator failing to close a valve), the change in frequency was found to be insensitive to the variations of operator error probabilities.

In performing ISLOCA analyses it was assumed that the existing alarm was tested at each refueling. A sensitivity analysis was performed to determine the potential impact of this assumption on ISLOCA frequency. Test intervals ranging from 30 days to 20 years were used for the sensitivity analysis.

The frequency of ISLOCA was found to be relatively insensitive to how often the alarm was tested. A small increase in frequency is observed when the test interval is 5 years or more. The proposed change maintains a refueling outage test schedule for the alarms.

It should be noted that with an alarm present, as in the current St. Lucie Unit No. 1 design, ACI is a negligible contributor to reactor safety. The dominant contributor to ISLOCA frequency is a catastrophic failure of both SDCS suction isolation valves with the reactor at power. Neither ACI nor alarms can provide defense against such a failure, nor is that the intended function. Furthermore, the alarm offers protection against. equipment failures (such as the SDCS isolation valves failing to close); the ACI does not.

The CE generic evaluation determined that an ISLOCA via the SDCS suction lines while the plant is at power can occur by the following mechanisms:

a) Both isolation valves in series are left open; b) One motor operated valve is left open, and the second motor operated valve in series ruptures; c) The second motor operated valve is left open, and the first motor operated valve in series 'ruptures, or; d) Both valves rupture.

Mechanism a) both valves are is not left a credible initiator for an ISLOCA.

open during reactor heatup, the SDCS If relief valve, located downstream of the two valves, will open to relieve the increasing pressure and discharge reactor coolant to the waste management system holdup tanks. The set point of the relief valve is 300 psig. Upon relief valve actuation, indications of increasing holdup tank level and decreasing reactor coolant system (RCS) or volume control tank level will alert the operator that the RCS pressure boundary has not been secured during heatup. Due to these indications and the effects of the relief valve discharge upon RCS pressure, heatup will be suspended until the RCS pressure boundary is established by closing the SDCS suction valves.

Leaving both valves in series open is not considered credible.

• ~

I 4

~ q '

The frequency of an ISLOCA related to the two SDCS suction lines can then be estimated based upon an equation utilizing the remaining three mechanisms:

(Equation 1) F (ISL) = 2 * (aQ, + aQ, + aQ,) where:

F (ISL) Frequency of ISLOCA via SDCS suction lines, per year a Catastrophic failure rate for motor operated valves ( 2. 716 x 10~/year)

QI Probability that the first motor operated valve in series is not closed Q2 Probability that the second motor operated valve in series is not closed Q3 Probability that the second motor operated valve fails given that first motor operated valve has failed Two cases, with and without ACI, were analyzed:

Case 1 (Current configuration): Alarm and ACI.

Case 2 (Proposed configuration): Alarm only.

The same alarm characteristics have been assumed for Case 2 as Case l.

Variable Q, has the same value for both Cases. Fault tree analyses are used to determine Q~ and Q. because both are MOVs, Q, = Q,. The results are:

Case 1 Case 2 Q> 1. 00 x 1.10 x 10~

Qz x 10~

10'.00 1.10 x 10~

Q3 2. 04 x 10'i 2.04 x 10 In all cases, Q, is the dominant term. This term, representing catastrophic failure of both initially closed valves, contributes over 99> of the total ISLOCA risk for Cases 1 and 2. The increases in variable Q, and Q, for Case 2 compared to Case 1 are minor and quantify the effects of ACI removal since the same alarm characteristics are assumed for both cases.

Case 1 F(ISL) = 1.1188 x 10'year Case 2 F(ISL) = 1.1199 x 10'year (Equation 2) 4 change in ISLOCA frequency with ACI removed:

F ISL-case2 -F ISL-easel F(ISL-easel) 4 change in ISLOCA frequency with ACI removed = 0.098%

SDCS Unavailability Results For the SDCS unavailability analysis, the presence or absence of a valve position alarm is immaterial. For the two configurations of concern, SDCS unavailability was evaluated for failure to provide shutdown cooling during shutdown conditions. The evaluation includes failure to start and failure to operate given that the system has started. The results are presented below:

SDCS Confi uration SDCS Unavailabilit

1. (Present configuration) 5.05 x 10~

SDCS suction valves with ACI

2. (Proposed configuration) 3.08 x 10~

SDCS suction valves with ACI removed The removal of ACI represents a 39% decrease in SDCS unavailability during refueling operations.

Effect on Low Temperature Overpressure Protection (LTOP)

During low RCS temperature (e.g. shutdown cooling) operations, the reactor vessel material is more brittle than during normal operation. Because of the brittleness of the vessel material at low temperatures, over pressurization of the RCS during low temperature operation is of concern.

St. Lucie Unit No. 1 employs two pressurizer Power Operated Relief Valves (PORVs) with sufficient capacity to mitigate LTOP events that may occur during low RCS temperature operations. In order to bound the LTOP analysis assumptions, the Technical Specification Limiting Conditions of Operation (LCO) require disabling certain pumps (i.e. charging pumps or High Pressure Safety Injection Pumps) to minimize inadvertent actuation, and limit Reactor Coolant pump starts based on primary to secondary temperature differential.

Although the SDCS relief valves would be available to provide additional relief capacity during an LTOP event, credit for these valves is not taken in the analysis for LTOP mitigation at St. Lucie Unit 1. The relatively slow stroke time of the SDCS suction valves during closure is likewise not credited in the LTOP analysis. LTOP is therefore independent of the SDCS suction lines at St. Lucie Unit No. 1. Because the PORV's provide LTOP, removal of ACI from the SDCS suction valves does not adversely affect LTOP performance or availability.

The NRC identified a number of transients (industry wide) that were initiated by inadvertent closure of the SDCS suction valves. Removal of ACI decreases the unavailability of the SDCS by reducing the probability of inadvertently closing the

. SDCS suction valves. Thus, the probability of a pressure transient due to charging pump flow without any letdown flow

~

g li V

l m 54 A

V

(e.g. through the SDCS suction line) is also reduced. The probability of LTOP challenges would then be reduced without the ACI, thus enhancing plant safety.

NRC Input In January 1989, the CE Owners Group held its annual meeting with NRC management and technical staff. At that meeting removal of the ACI was discussed in some detail. The NRC (Ashok Thadani) requested that submittal for ACI removal specifically address two issues related to ISLOCA: 1) the sensitivity of the analyses to assumptions about operator error rates, and 2) a review of the significance of the December 1987 Biblis-A ISLOCA precursor event.

As noted above, sensitivity studies of operator error rate assumptions were performed as part of the ISLOCA frequency determinations. It was found that the change in ISLOCA frequency was insensitive to operator error rate assumptions. The insensitivity is attributed to the dominant failure mechanism being catastrophic failure of both suction valves.

A review of the Biblis-A PNR event shows that the operator tried to close a mispositioned pressure isolation valve that should have been closed prior to heatup. The operator tried to manipulate the pressure on the mispositioned valve by opening a second valve. In doing so, a path from the RCS to the atmosphere was established resulting in a short duration release.

The St. Lucie Unit No. 1 SDCS suction valves (pressure isolation valves) cannot be opened by the operator while RCS pressure is above shutdown cooling entry conditions. The open permissive interlocks (OPI) prevent such actions by the operator. These interlocks will remain as an integral part of the SDCS suction valves. Therefore, the sequence of events involving operator actions that occurred at Biblis-A is not expected to occur at St.

Lucie Unit No. 1.

The analysis of the 7 items identified by the NRC demonstrates that the removal of the ACI provides a net improvement in plant safety, because:

1) ISLOCA frequency is negligibly increased (0.0984);

2) SDCS unavailability is significantly reduced (39~), and;

3) LTOP performance or availability is not affected, however the probability of LTOP challenges would be reduced.

10

0 .

fP'f

'cf J '4

St. Lucie Unit 1 Docket No, 50-335 Proposed License Amendment Removal of Shutdown Cooling Auto-closure Interlock Surveillance Re uirement ATTACHMENT 3 DETERMINATION OF NO SIGNIFICANT HAZARDS CONSIDERATION The standards used to arrive at a determination that a request for amendment involves no significant hazards consideration are included in the Commission s regulations, 10 CFR 50.92, which state that no significant hazards considerations are involved operation of the facility if in accordance with the proposed amendment would not (1) involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) create the possibility of new or different kind of accident from any accident previously evaluated; or (3) involve a significant reduction in a margin of safety. Each standard is discussed as follows:

(1) Operation of the facility in accordance with the proposed amendment would not involve a significant increase in the probability or consequences of an accident previously evaluated.

The removal of the SDCS ACI was evaluated generically by CE in terms of the frequency of an ISLOCA, the availability of the SDCS, and the effect on overpressure transients. St. Lucie Unit 1 was enveloped in this CE effort. There is a negligible increase (0.0984) in the calculated probability of an ISLOCA event associated with ACI removal; however, this negligible increase is countered by a significant decrease (394)in the unavailability of the SDCS. Such decrease in unavailability is due to the reduction in spurious actuation of the isolation function.

The present LTOP system will remain available to mitigate a design basis pressure transient. The PORVs are the devices relied upon to relieve pressure, not the SDCS relief valves.

Regarding SDCS overpressurization, it is .true that the ACI initiates an autoclosure of the SDCS suction valves on high RCS pressure. Overpressure protection of the SDCS is provided by the SDCS relief valve and not by the slow-acting suction valves that isolate the SDCS from the RCS.

The sole design basis of the ACI is to minimize the chance for operator error in failure to establish a double barrier between the RCS and SDCS during heatup. This interlock will be replaced by enhancements to operating procedures. The current alarms will retain their original function. These improvements provide a comparable measure of protection without the risk of spurious isolation. Therefore, the

proposed changes will not increase the consequences of an accident previously analyzed.

(2) Operation of the facility in accordance with the proposed amendment would not create the possibility of a new or different accident from any accident previously evaluated.

Alarms and procedures will inform the operators to take timely actions when necessary thereby fulfillingthe same function as the ACI. The alarms will be capable of detecting equipment failures, whereas the ACI protects only against operator error as stated above.

The change to the facility will be disabling current active functions and changing current alarm logic and circuitry. The change to the alarm and indication is one of independence; the functions of each remain the same. No additions of equipment are made that could create new types of failures. For these reasons, the possibility of a new or different kind of accident is not created.

(3) Use of the modified specification would not involve a significant reduction in a margin of safety.

The SDCS ACI function is not a consideration in the margin of safety for any Technical Specification. It is an interlock intended to increase the assurance of SDCS isolation. Removal of ACI will significantly reduce the possibility of spurious SDCS isolation while the changes to procedures and alarm circuitry in conjunction with retention of the OPI will assure proper SDCS isolation. For these reasons, this change will not involve a significant reduction in the margin of safety as currently defined in the Technical Specifications.

Based upon the above, we have determined that the amendment request does not (1) involve a significant increase in the probability or consequences of an accident previously evaluated, (2) create the possibility of a new or different kind of accident from any accident previously evaluated, or (3) involve a significant reduction in a margin of safety, and therefore does not involve any significant hazards consideration.

k~ l Y"

Ih

'f