ML17313A631

Safety Evaluation Supporting Amends 118 to Licenses NPF-41, NPF-51 & NPF-74,respectively

ML17313A631
Person / Time
Site:	Palo Verde
Issue date:	10/02/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML17313A629	List: ML17313A628 ML17313A630 ML17313A631 ML17313A632
References
NUDOCS 9810090401
Download: ML17313A631 (20)

Text

gp,R RE0g Cy ClO g

~O

+**<<+

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C; 2055$ 4001 SAFETY EVALUATIONBYTHE FFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENTNO 118 TO FACILITYOPERATING LICENSE NO. NPF-41 MENDMENTNO. 118 TO FA ILITYOPERATIN LI ENSE NO. NPF-ND AMENDMENTNO 118 TO FACILITYOPERATING LICENSE NO. NPF-74 RIZONA PUBLIC SERVICE COMPANY ET AL PALO VERDE NUCLEAR GENERATING STATION UNITNOS. 1 2 AND D

CKET NOS. STN 50-528 STN 0-529 AND STN 5 -

0

'.0 INTRODUCTION By letters dated June 13 and August 16, 1995, Arizona Public Service Company (APS or the licensee) requested changes to the Technical Specifications (Appendix A to Facility Operating License Nos. NPF-41, NPF-51, and NPF-74) for Palo Verde Nuclear Generating Station (PVNGS), Units 1, 2 and 3 for the safety injection tanks (SITs), with additional information submitted by the licensee through the Combustion Engineering Owners Group (GEOG), on June 14, 1996. The Arizona Public Service Company submitted this request on behalf of itself, the Salt River Project Agricultural Improvement and Power District, Southern California Edison Company, El Paso Electric Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority.

The proposed changes would modify the technical specifications (TS) to extend the allowed outage times (AOTs) for a single inoperable SIT from one. hour to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and for a single SIT inoperable specifically due to malfunctioning SIT water level or nitrogen cover pressure instrumentation inoperability from one hour to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The June 13, 1995, application also included proposed TS changes extending the AOTs for the low pressure safety injection systems and the emergency diesel generators.

By letter dated September 6, 1998, the licensee withdrew the proposed TS changes for these two systems since the NRC had identified that a configuration risk management program would need to be added to the TS.

By letter dated June 9; 1998, the licensee supplemented its original submittal, providing the proposed TS pages related to the SITs in the format used in the improved TS, which was approved by the staff for PVNGS on May 20, 1998.

The June 9, 1998, and September 6, 1998, letters do.not change the initial no significant d

25, 1995 (60 FR 54715 ).

98i009040i 98i002 PDR ADQCK 05000528 P

PDR

2.0 BACKGROUND

Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights.

In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it:

"expects that licensees, in preparing their Technical Specification related submittals, willutilize any plant-specific PSA [probabilistic safety assessment] 'r risk survey and any available literature on risk insights and PSAs.

~.. Similarly, the NRC staff willalso employ risk insights and PSAs in evaluating Technical Specifications related submittals.

Further, as a part of the Commission's ongoing program of improving Technical Specifications, it willcontinue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements."

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, "Technical Specifications," in July 1995 (60 FR 36953).

In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decisionmaking and regulatory efficiency (60 FR.42622).

The PRA policy statement included the following points:

The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should'be as realistic as practicable and appropriate supporting data should be publicly available for review.

In August 1995, the GEOG submitted several Joint Application Reports for the staffs review.

Two of the CEOG Joint Application Reports provided justifications for extensions of the TS AOTs for SITs and for the low pressure safety injection (LPSI) system. 'he justifications for these extensions are based on a balance of probabilistic considerations, traditional engineering considerations, including defense-in-depth, and operating experience.

Risk assessments for all of the Combustion Engineering (CE) plants are contained in the reports. The staff first reviewed I

PSA and PRA are used interchangeably herein.

CE NPSD-994, Joint Application Report for Safety Injection Tank AOT/STI Extension," May 1995, and CE NPSD-995, Joint Application Report for Low Pressure Safety Injection System AOT Extension, May 1995.

the Joint Application Reports and then reviewed the licensee's plant-specific amendment request which incorporated the Joint Application Reports by reference.

Arkansas Nuclear One, Unit 2 (ANO-2) had been the lead.CE plant for.the SIT and LPSI system TS changes.

The staff performed an in-depth review of the ANO-2 PRA methodology relating to these changes, as, the lead plant for all of the GEOG. Therefore, a portion of the review of the PVNGS amendment request was based on a comparison of the PVNGS PRA results with those from ANO-2.

In addition, one of the proposed changes would revise the TS controlling the SITs to incorporate recommendations and suggestions from Generic Letter (GL) 93-05, "Line-Item Technical Specifications Improvements.to Reduce Suweillance Requirements for Testing During Power Operations."

3.0 PROPOSED CHANGE

3.1 TS 3.5.1 - Safety Injection Tanks - Operating The licensee proposes extending the TS completion time for one SIT that is inoperable for the inability to verify level or pressure from 1 to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The licensee also proposes extending the TS completion time for one SIT that is inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This TS section is applicable in MODES 1 and 2, and MODES 3 and 4 with pressurizer pressure equal to or greater than 1837 psia.

'.2 TS 3.5.2 - Safety Injection Tanks - Shutdown The licensee proposes extending the TS completion time for one required SIT that is inoperable for the inability to verify level or pressure from 1 to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The licensee also'proposes extending the TS completion time for one required SIT that is inoperable for reasons other than boron concentration being outside of limits or the inabilityto verify level or pressure from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

This TS section is applicable in MODES 3 and 4 with pressurizer pressure less than 1837 psia.

The staff evaluated the licensee's proposed amendment to the TS using a combination of traditional engineering analysis, PRA methods, and a review of operating experience.

The staff's traditional analysis evaluated the capabilities of the plant to mitigate design basis events with one SIT inoperable.

The staff then used insights derived from the use of PRA methods to determine the risk significance of the proposed changes.

The results of these evaluations were used in combination by the staff to determine the safety impact of extending the AOTs for one inoperable SIT.

Ck t

4.1 Justification for Proposed Changes 4.1.1 SIT Cpm letion Tim from1.t 72 H urs when SIT is Ino erabte Due to Inabili to Veri Level or Pressur The NRC issued GL 93-05 on September 27, 1993, and recommended that licensees add a condition to the SIT-TS for the case where one SIT is inoperable due to the inoperability of water level and pressure 'channels in which the completion time to.restore the SIT to operable status would be 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

GL 93-05 stated that the NRC staff and industry efforts to develop new standard TS recognized that SIT instrumentation operability'was not directly related to the capability of the SITs to perform their safety function. Therefore, surveillance requirements for SIT pressure and level instrumentation were relocated from the new standard TS and the only surveillance that was retained was that surveillance required to confirm that. the parameters-defining SIT operability are within their specified limits. At the time of the development of the standard TS, the staff did not include a separate condition in the SIT TS for a SIT inoperable due to the inability to verify level or pressure, as was recommended in GL 93-05. However, the staff believes this is appropriate based on the analysis-done during the development of NUREG-1366, "Improvements to Technical Specifications Surveillance Requirements," which formed the basis for the issuance of GL 93-05.

4.1.2 SITCom letion Time from1 to 24 Hourswhen SITis Ino er bleforOther'R s ns Industry operating experience has demonstrated that many of the causes of SIT inoperability have been diagnosed and corrected within a relatively short period, but one that is often longer than the existing 1-hour completion time. In several cases, the diagnosis of an inoperable SIT has resulted in plant shutdowns.

lfa single SIT were to be diagnosed as inoperable for reasons other than boron concentration being outside of limits (which is already addressed under a separate Action with a 72-hour completion time), TS 3.5.1, Action B, would allow 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for operators to restore the. SIT to operability. Ifthe action were not completed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the plant would have to be placed in MODE 3 within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and pressurizer pressure brought to less than-1837 psia within the next.12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, in accordance with Action C. TS 3.5.2 would then require the plant to be placed in MODE 5 within its specified completion times. The extension of the existing SIT completion time from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should provide the licensee with sufficient time in which to diagnose and possibly repair minor SIT system malfunctions at power, thereby averting an unplanned plant shutdown.

Since risk analyses demonstrate that the increased risk of operating with a single SIT out of service is negligible, increasing the completion time can be beneficial by possibly avoiding unplanned shutdowns associated with an inoperable SIT.

Unnecessary plant shutdowns associated with the outage of non-risk-significant equipment are undesirable because MODE changes have the potential to increase the risk above that of steady-state operation.

II 0

\\

~

4.2 Traditional Engineering Evaluation 4.2.1 Current Traditional Anal si The performance of all of the emergency core cooling system (ECCS) components, including the SITs, is calculated in accordance with 10 CFR Part 50, Appendix K, such that the ECCS ensures that the acceptance criteria of 10 CFR 50.46 are satisfied.

These criteria were established in order to define deterministic acceptance criteria that could be used to judge the acceptability of a given ECCS design.

The methodology defined in Appendix K conservatively represents loss-of-coolant-accident (LOCA) thermohydraulic and hydrodynamic phenomenology to calculate fuel peak clad temperature.

As a result, the methodology may well overstate the minimum equipment requirements for an adequate response to an event..

.2, The SITs are passive pressure vessels partially filled with borated water and pressurized with a cover gas (nitrogen) to facilitate injection into the reactor vessel during the blowdown phase of a large break LOCA. This action provides inventory to assist. in accomplishing the refill stage following blowdown. The SITs also provide reactor coolant system (RCS) makeup for a small break LOCA.

Each SIT is piped into an associated RCS cold leg via an ECCS line also utilized by HPSI and LPSI. Each SIT is isolated from the RCS during full pressure operations by two series check valves.

Each SIT also has a normally deenergized open motor-operated isolation valve utilized to isolate the SIT from the RCS during normal cooldown and depressurization evolutions.

Each of these valves receive a safety injection actuation signal to open.

The SIT gas pressure and volume, water volume, and outlet pipe size are designed to allow three of the four SITs to inject the inventory necessary to keep cladding temperature and zirconium-water reaction within design assumptions following a design basis LOCA. The design assumes the loss of inventory from one SIT through the'LOCA break.

LimitingCondition for Operation (LCO) 3.5.1 requires that all SITs be operable whenever the plant'is in MODES 1 and 2, or MODES 3 and 4 with pressurizer pressure greater than or equal to 1837 psia. The LCO is based on the assumption that when the plant is in any of these MODES of operation, the SITs. must have the same functionality that would be required for a LOCA at full rated thermal power. LCO 3.5.2 requires 3 or 4 SITs to be operable, depending on the available water volume in each SIT, whenever the plant is in MODES 3 and 4 with the pressurizer pressure less than 1837 psia. When the plant is in any of the applicable MODES, a SIT is considered operable when the following conditions exist:

~

The associated isolation valve is fullyopen.

Electric power has been interrupted to the motor for the associated isolation valve.

Water inventory in the tank is within the assumed band.

~

The boric acid concentration of the water inventory of the tank is within the assumed band.

~

The nitrogen cover pressure within the tank is within.the assumed band.

In the past, a justification for the short completion time for one inoperable SIT has been that the perceived severity of the consequences of not having all SITs available to provide passive injection during a design basis LOCAwarranted the severity of the requirement to return the SIT to operable status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or shut down the unit. However, the current SIT completion time was based solely on engineering judgment and did not take into consideration a quantitative assessment of risk.

The SIT operational parameters are set by the design basis licensing large break LOCA analysis.

Since the SIT is a passive device and provides a limited function, operability has been restricted to mean that the equipment's initial conditions are within a band supported by 10 CFR Part 50, Appendix K, design basis analysis.

Analytical models ofAppendix K to 10 CFR Part 50 are devised so as to overestimate the amount of liquid lost from the break and to underestimate the residual inventory in the reactor vessel lower plenum.

Consequently, inventory discharge requirements are conservatively set at a high level. Extending the completion time from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for one SIT that is inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure willallow time for the licensee to correct minor problems with a SIT. Considering the short time frame that a SIT is allowed to be out-of-service, the low likelihood of a large break LOCA during this short time frame, and the potential risk associated with plant shutdowns, extending the SIT completion time willallow defense-in-depth to be maintained while not significantly affecting overall safety margins assumed in the design basis analysis.

The current PVNGS TS do not differentiate between a SIT that is inoperable due to tank inventory or nitrogen gas pressure discrepancies and a SIT whose inventory or gas pressure cannot be verified due solely to malfunctioning water level instrumentation or pressure instrumentation.

Because these instruments provide no safety actuation, it is reasonable to extend the completion. time to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> under these conditions since the SIT is available to perform its safety function during this time. This change is consistent with the staffs recommendations in GL 93-05.

4.3 Evaluation of the PRA Used to Su o

he Pro osed S

han es The staff uses a three-tiered approach to evaluate the risk associated with proposed TS changes of this type. The first tier evaluates the PRA model and the impact of the completion time extensions for the SITs on plant operational risk. The second tier addresses the need to preclude potentially high risk configurations, should additional equipment outages occur during the time when one SIT is out of service. The third tier evaluates the licensee's configuration risk management program to ensure that the applicable plant configuration willbe appropriately assessed from a risk perspective before entering into or during the proposed AOTs. Because the SIT sequence modeling is relatively independent of that for other systems, the staff

concludes that application of Tier 3 to the proposed SIT AOT is not necessary.

Each tier and the associated findings are discussed below.

4.3.1 Cros Com ari on A r

After completing a detailed evaluation for the tentative approval of SIT and LPSI TS AOT extensions for Arkansas Nuclear One, Unit 2 (ANO-2), the original GEOG lead plant for the risk-informed TS pilot-project, the staff used a cross comparison approach to consider the viabilityof similar AOT relaxations for other participating GEOG plants, including PVNGS. The pilot technical evaluation report'sed in support of the staffs draft safety evaluation for ANO-2'ocused on:

the process adopted by the GEOG to assess single AOT risk, the identification of ANO-2 accident sequences in which credit was taken for SITs and

LPSI, independent verification of the single AOT risk [essentially equivalent to incremental conditional core damage probability (ICCDP)'], and determination of the significance of single AOT risk relative to an acceptance guideline value.

The objective of this cross comparison evaluation is to use insights derived from the ANO-2 technical evaluation to examine the validityof the conclusions drawn in the joint submittals.

Because a common methodology was employed by the GEOG to quantify AOT risk and because CE plants generally have similar design characteristics, the staff concludes that the findings of the lead pilot plant evaluation will be generally applicable to other CE plants. The staff confirmed that differences in the underlying PRA models are chiefly attributed to:

minor design differences, operational differences, success criteria assumptions, and common cause failure P-factor assumptions.

The cross comparison draws on information contained in the GEOG Joint Application Reports, the licensees'esponses to the staff's requests for additional information, the licensees'ndividual plant examinations (IPEs) performed in response to Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities," and the corresponding IPE evaluations performed by the staff.

SCIE-NRC-318-97, Technical Evaluation of Combustion Engineering Owners Group (GEOG) Joint Application for Safety Injection Tanks and Low Pressure Safety Injection System Allowed Outage Time (AOT)

Extension, July 21, 1997.

SECY-97-095, Probabilistic Risk Assessment Implementation Plan Pilot Application for Risk-Informed Technical Specifications, April30, 1997.

'CCDP

= [(conditional CDF with the subject equipment out of service) - (baseline CDF with nominal expected equipment unavailabilities)] X (duration of single AOT under consideration).

0 4.3.2 Im act of SITs on Tier1 2 and 3 Re uirements Risk Measures The following factors are chiefly responsible for the differences in SIT AOT risks among the CE plants:

modeling for success criteria for SITs, initiating event (IE) frequency assumed for the initiators challenging the SITs, and credit for SITs in mitigating medium LOCAs.

The SIT single AOT risk for PVNGS is 3.84E-09, which is significantly below the acceptance guideline value of 5.0E-07published in DG-1065, "An Approach for Plant-Specific Risk-Informed Decisionmaking:

Technical Specifications," (62 FR 34321, June 25, 1997).

In addition, the change in the PVNGS updated baseline core damage frequency (CDF) (as reported in the GEOG Joint Application Report) due to the SIT AOT change was essentially zero (the CDF for both cases was 4.74E-05 per year). This essentially zero change in CDF is within the acceptance guidelines published in DG-1061, "AnApproach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis" (62 FR 34321, June 25, 1997).

In the context of integrated decisionmaking, the acceptance guidelines should not be interpreted as being overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable.

As such, the numerical acceptance guideline is an approximate value that provides an indication of the changes that are generally acceptable.

Furthermore, the uncertainties associated with PRA calculations preclude a definitive decision with respect to the acceptance of the proposed change based purely on the numerical results.

The intent in making the comparison of the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that the increase in risk is small and consistent with the intent of the

'ommission's Safety Goal Policy Statement.

The staff therefore concludes that the proposed change to the PVNGS SIT TS meets this principle.

The Tier 2 evaluation did not identify the need for any additional constraints or compensatory actions that, ifimplemented, would avoid or reduce the probability of a risk-significant configuration.

Because the SIT sequence modeling is relatively independent of that for other systems, the staff concludes that application of Tier 3 to the proposed SIT AOT is not necessary.

4.4

~INonitorin The licensee has stated through endorsement of the GEOG Joint Application Reports that the maintenance rule (10 CFR 50.65) willbe the vehicle that controls the actual equipment maintenance cycle by defining unavailability performance criteria for the SITs. The AOT extensions willallow efficient scheduling of maintenance within the boundaries established by implementing the maintenance rule. The effect of the AOT extensions should be considered if any adverse trends in meeting established performance criteria are identified for the SITs. The maintenance rule willthereby be the vehicle-that monitors the effectiveness of the AOT extensions.

Application of these implementation and monitoring strategies will help to ensure

that extension of TS AOTs for SITs does not degrade operational safety over time and that the risk incurred when a SIT is taken out of service is minimized.

5.0

SUMMARY

The staff has evaluated the licensee's proposed changes to TS 3.5.1 and 3.5.2 for compliance with regulatory requirements as documented in this evaluation and has determined that they are acceptable.

This determination is based on the following:

1.

The need to maintain reliable safety systems.

2..

Consideration of the design basis requirements for the SITs.

3.

Staff recommendations contained in GL 93-05 regarding SIT TS requirements..

4.

Interface considerations that ensure the risk incurred when a SIT is taken out of service is minimum.

5.

Performance monitoring through the maintenance rule to ensure that extension of TS AOTs for SITs does not degrade operational safety over time.

The staff therefore finds that the AOTfor one SIT that is inoperable for the inabilityto verify level or pressure may be extended to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the AOTfor one SIT that is inoperable for reasons other than boron concentration not within limits or inability to verify level or pressure may be extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, with a negligible impact on risk.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Arizona State officialwas notified of the proposed issuance of the amendments for the PVNGS units. The State official had no comments.

7.0 ENVIRONMENTAL ONSIDERATI The amendments change a requirement with respect to the installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure.

The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (60 FR 54715). Accordingly, the amendments meet the eligibilitycriteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

The Commission has concluded, based on the considerations discussed above, that (1) there is reasonable assurance that the health and safety of the public willnot be endangered by operation in the proposed manner,'2) such activities willbe conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments willnot be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor.

N. Gilles Date: October 2, 1998

II 0

II I1(

4