ML20099M394

Safety Evaluation Supporting Amend 122 to License NPF-49

ML20099M394
Person / Time
Site:	Millstone
Issue date:	12/28/1995
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20099M382	List: ML20099M379 ML20099M394
References
NUDOCS 9601030362
Download: ML20099M394 (17)

Text

..--.- -.. -.

t@"%q\\

UNITED STATES p

g j

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 2006H001 o

'+4.....,o SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION.

RELATED TO AMEN 0 MENT NO.122 TO FACILITY OPERATING LICENSE NO. NPF-49 NORTHEAST NUCLEAR ENERGY COMPANY. ET AL.

MILLSTONE NUCLEAR POWER STATION. UNIT NO. 3 DOCKET NO. 50-423

1.0 INTRODUCTION

By letter dated May 1,1995, the Northeast Nuclear Energy Company (the licensee), submitted a request for changes to the Millstone Nuclear Power Station, Unit No. 3 Technical Specifications (TS). The requested changes would revise the TSs to extend the interval for performance of selected surveillances to coincide with a 24-month operating cycle.

Specifically, TS that specify an 18-month surveillance will be changed to state that these surveillances are to be performed at least once each refueling interval (i.e.,

j 24-months). Guidance on the proposed TS changes was provided by NRC Generic Letter (GL) 91-04, " Changes in Technical Specification Surveillance Intervals to Accommodate a 24-Month Fuel Cycle" dated April 2, 1991.

2.0 EVALUATION Millstone Unit 3 shutdown for.the fifth refueling outage on April 14, 1995, j

and started in Cycle 6 on June 7, 1995. During the outage, the core was reloaded with fuel designed for a nominal 24 months of operation. To permit operation with this longer fuel cycle, the licensee has or will be proposing to modify the frequency for those surveillance requirements that are normally i

performed once per fuel cycle.

The current Millstone 3 TS specify that these surveillances be performed "at least once per 18 months." The licensee will be proposing that all such surveillance frequencies be changed to "at least once each refueling interval."

The subject application is the first of a group of submittals which the licensee has submitted. This submittal addresses the definition for a refuelir,g interval, the BASES for extending surveillance intervals and the eight sections of the TS listed below.

Section 1.0 of the TS defines the terms used throughout the document. Table 1.1 " FREQUENCY NOTATION" lists the frequency for surveillances identified by 9601030362 951228 PDR ADOCK 05000423 P

PDR

. various symbols.

For those surveillances designated by the letter "R", the frequency is currently specified as "at least once per 18 months." The licensee proposed to further define "R" as " REFUELING INTERVAL" and specify the frequency as "At least once per 24 months." This is identical to the suggested wording in the second paragraph of GL 91-04 and is acceptable.

Section 4.0.2 of the TS states that "Each Surveillance Requirement shall be performed within the specified time interval with a maximum allowable extension not to exceed 25% of the surveillance interval. This requirement is not being changed. As discussed in GL 91-04, the provision to extend surveillances by 25% of the specified interval would extend the time limit for completing the "R" surveillances from the existing limit of 22.5 months to a maximum of 30 months. The licensee is proposing to revise the BASES for Specification 4.0.2 to delete reference to an 18-month surveillance interval and specify that the surveillances be performed at least once each refueling interval. The proposed change to the BASES is acceptable.

In accordance with the guidance in GL 91-04, for each of the proposed changes in surveillance intervals listed below, the licensee has reviewed the historical plant maintenance and surveillance results to support their conclusion that extending the surveillance intervals has a small effect on safety.

In this application, the licensee is proposing to change one or more of the surveillance requirements associated with the following eight sections of the TS-Section 3.1.2.2 - Reactivity Control Systems - Flow Path Operating Section 3.1.3.3 - Reactivity Control Systems - Position Indication System - Shutdown Section 3.1.3.4 - Reactivity Control Systems - Rod Drop Time Section 3.3.3.3 - Instrumentation - Seismic Instrumentation Section 3.3.3.8 - Instrumentation - Loose-Part Detection System

.Section 3.6.2.1 - Containment Systems - Depressurization and Cooling Systems - Containment Quench Spray System Section 3.6.2.2 - Containment Systems - Recirculation Spray System Section 3.6.3 - Containment Systems - Containment Isolation Valves 2.1 Reactivity Control Systems - Flow Path Operatina 2.1.1 Desian Among other functions, the Chemical and Volume Control System provides safety grade backup systems for emergency boration of the primary coolant to bring the plant to cold shutdown.

Boric acid (3.6 weight percent) can be supplied I

h

! 4 i

l from the boric acid tanks to the suction of the charging pumps via several different flow paths.

It is delivered to the reactor coolant system through the normal charging line and the reactor coolant pump seal injection lines.

(The ECCS high head safety injection headers provide a backup path for boration.) There are two boric acid tanks, each of which have 24,000 gallons of useable capacity and which hold 3.6 to 4.1 weight percent boric acid solution. The boric acid normally would be pumped to the suction of the charging pumps by one of the two boric acid transfer pumps, each of which is rated for 75 gpa at 235 feet of head.

If both pumps were not available, the solution can flow by gravity from the boric acid tanks to the suction of the charging pumps. Borated water can also be supplied to the charging pumps from the reactor water storage tank.

2.1.2 Technical Specification Chanae Limiting Condition for Operation 3.1.2.2 requires that at least two of the above boron injection flow paths shall be operable, which could be the flow path from the boric acid storage system via a boric acid transfer pump and a charging pump or the two flow paths from the refueling water storage tank and the charging pumps.

Surveillance Requirements 4.1.2.2.c and 4.1.2.2.d currently state that at least two of the required flow paths shall be demonstrated OPERABLE:

c.

At least once per 18 months during shutdown by verifying that 1

each automatic valve in the flow path actuates to its correct position on a Safety Injection test signal; and d.

At least once per 18 months by verifying that the flow path required by Specification 3.1.2.2a. delivers at least 33 gpm to the RCS.

The license proposes to change the surveillance interval from 18 months to each refueling interval and to delete the words "during shutdown."

2.1.3 Justification for the Chanae a

In accordance with GL 91-04, the licensee evaluated the equipment performance over the last four operating cycles, including a review of surveillance results, preventative maintenance records and the frequency and types of corrective maintenance.

The review indicated that the automatic valves in the 'A' and 'B' trains actuated as required in response to the safety injection test signal in each case, except two. These two failures were attributed to " procedural deficiencies." The results of the retests, after correction of the procedural deficiencies, were deemed satisfactory. A review of past surveillances indicated that, in each of the cases, the pumps delivered at least 33 gpa of flow to the reactor. Corrective maintenance work performed on the valves during the last four cycles involved minor packing leaks, actuation coil overheating / aging, actuator overthrust, and relay failure.

In each of the

. cases, repairs were able to be performed with no adverse impact on plant operation.

In addition, the types of failures that were observed and the number of occurrences were not indicative of a recurring problem.

Corrective maintenance work performed on the pumps during the last four cycles involved low oil levels, oil leaks, and breaker linkage bent.

In each of the cases, repairs were able to be performed with no adverse impact on plant operation.

In addition, the types of failures that were observed and the number of occurrences were not indicative of a recurring problem.

Based on past performance and the maintenance history of the components in the boron injection system, there is reasonable confidence that extending the surveillance frequency from 18 to 24 months will not degrade the ability of this system to perform the intended function. The proposed changes to surveillance requirements 4.1.2.2.c.and 4.1.2.2.d are acceptable.

As noted above, the licensee proposes to delete the words "during shutdown" in 2.1.2.c.

Generic Letter 91-04 stated that licensees may omit the TS qualification that surveillances be. performed "during shutdown." Because the terms " Hot" and " Cold" shutdown are defined in the TSs as operating modes or conditions, the restriction to perform certain surveillances during shutdown could be misinterpreted. The generic letter noted that if the performance of a refueling interval surveillance during plant operation would adversely affect safety, the licensee should postpone the surveillance until the plant is shutdown for refueling or in a condition or mode consistent with safe conduct of that surveillance.

In the application, the licensee stated that they agreed with this position.

Deletion of the term "during shutdown" is in accordance with the recommendation in GL 91-04 and is acceptable.

2.2 Reactivity Control Systems-Position Indication System - Shutdown 2.2.1 Desian The existing Millstone Unit 3 Digital Rod Position Indication (DRPI) system measures rod position by use of two trains of coils mounted at discrete axial intervals around the control rod drive housing. As a rod transits the coil region, a perturbation is created in the electromagnetic flux generated by each coil and causes a change in the applied voltage to the coil. The voltage signal is converted to rod position which is indi<,ated at the main control board DRPI panel and is also transmitted to the plant computer.

Panel indication for.each rod consists of one display card with 39 light emitting diodes (LEDs) arranged vertically.

The 39 LEDs represent six-step intervals from rod at bottom (0) step to rod full out at six step intervals from rod at bottom to rod full out (228) steps.

2.2.2 Technical Specification Chanae The Reactivity Control System - Position Indication System - Shutdown, Section 4.1.3.3 Surveillance Requirements of the Millstone Unit 3 TS states "Each of the above required digital rod position indicator (s) shall be determined to be

' l OPERABLE by verifying that the digital rod position indicators agree with the demand position indicators within 12 steps when exercised over their full-range of rod travel at least once per 18 months." The licensee proposes to change the surveillance interval from 18 months to each Refueling Interval.

2.2.3 Justification for the Chanae j

f The licensee evaluated equipment performance over four operating cycles that included a review of surveillance results, preventive maintenance records, and frequency and type of corrective maintenance and found that the DRPI system performance was within expected bounds. No major corrective or preventive maintenance activities were performed on the DRPI system. A random failure identified in a rod deviation card during the last Millstone Unit 3 operating cycle (June 19,1994) did not indicate a recurring problem and did not adversely impact the performance assumptions used to support the proposed refueling extension. The staff reviewed the above failure as reported in Licensee Event Report (LER)94-009 issued on August 2,1994, and a similar failure at Millstone Unit 3 that occurred on February 3, 1988, reported in LER 88-007 issued on March 4, 1988, and agrees with the licensee's conclusion that these failures are rare and randon, and do not adversely impact on the proposed refueling interval surveillance extension. The staff's review of the NRC's records did not reveal any other DRPI system failures at Millstone Unit 3.

Based on the above, the staff finds the proposed change in TS surveillance frequency from 18 to 24 months to be acceptable.

2.3 Reactivity Control - Rod Dron Time 2.3.1 Desian The measure of control rod drop time is made by connecting the existing Millstone Unit 3 Automatic Rod Drop Test Cart (ARDTC) to the DRPI system and Control Rod Drive System in accordance with approved plant procedures. The ARDTC is a microprocessor-based system which is used to unlatch a preselected group of rods and measure the rod drop times.

2.3.2 Technical Snecification Chance Millstone Unit 3 TS Surveillance Requirement 4.1.3.4.c states "The rod drop time for the full-length control rods be demonstrated through measurement prior to reactor criticality:

a.

For all rods following each removal of the reactor vessel

head, b.

For specifically affected individual rods following maintenance on or modification to the Control Rod Drive system which could affect the drop time of those specific rods, and

. c.

'At least once per 18 months."

The licensee is proposing to extend the frequency of Surveillance Requirement-4.1.3.4.c from at least once every 18 months to at least once each refueling interval (i.e., 24 months).

2.3.3 Justification for the Chanae The licensee has evaluated the control rod drive system equipment performance over four operating cycles that included review of surveillance results, preventive maintenance records, and frequency and type of corrective maintenance and found that the change to the frequency of surveillance for rod drop time required by Surveillance Requirement 4.1.3.4.c will not degrade the ability of the control rods to perform their safety function. The surveillance results indicated that for each test conducted to verify that rod drop time was in compliance with Surveillance Requirement 4.1.3.4.c, the results have been within the acceptance criterion of less than or equal to 2.7 seconds from beginning of decay of stationary gripper coil voltage to dashpot entry. The staff's review of NRC records did not identify any Millstone Unit 3 events concerning unacceptable control rod drop times.

Based on the above, the staff finds the proposed change in the frequency of TS Surveillance Requirement 4.1.3.4.c from 18 to 24 months to be acceptable.

2.4 Seismic Monitorina Instrumentation 2.4.1 Desian The existing Millstone Unit 3 seismic monitoring instrumentation system is nonsafety related and uses both mechanical and electronic equipment to detect and record the amplitude (acceleration) and frequency of a seismic event.

It performs no automatic safety functions. The installed systems comply with the recommendations of Regulatory Guide 1.12, " Instrumentation for Earthquakes (and ANSI /ANS-2.2-1978 Earthquake Instrument criteria For Nuclear Power Pl ants). " The seismic information is measured and recorded and can be compared to the design basis requirements of structures, systems and components of Millstone Unit 3 to determine whether the design basis has been exceeded. The system functions automatically upon the detection of a seismic event and is used.by plant operators to determine conditions which could be limiting with regard to continued plant operations following a seismic event and/or,to restart following a seismic event. The following are the seismic monitoring instruments and their location at the Millstone Unit 3 facility:

a.

Triaxial Time-History Accelerographs Containment Mat Containment Wall Emergency Diesel Generator Mat in Diesel fuel Oil Vault

. Aux. Building Wall near the charging pump cooling surge tank b.

Triaxial Peak Accelerographs Containment Safety Injection Accumulator Tank Safety Injection Accumulator Discharge Line Aux Building Charging Pumps Cooling Surge Tank c.

Triaxial Seismic Trigger Control Room - Horizonal

.Olg

• and.09g **

Control Room - Vertical

.006g

• and.06g **

d.

Triaxial Response-Spectrum Recorders Control Room - Spectrum Analyzer

• Steam Generator Support - Self-Contained Recorder Unit activated by signal from Triaxial Accelerograph located at the Containment mat.

Unit activated by signal from Triaxial Accelerograph located at the Containment mat and is connected to reactor control room annunciator.

The triaxial peak recording accelerographs (b) are used to provide qualitative seismic motion data to compare against analog seismic instrumentation and are considered to be the lowest order with respect to the level of data reliability when compared to the time history accelerographs (a) and the response spectrum recorders (d).

2.4.2 Technical Snacification Chanae Selsmii: Ins,trumentation Surveillance Requirement 4.3.3.3.1 of Millstone Unit 3 Technical Specifications states that "Each of the above required seismic monitoring instruments [shown in Table 3.3-7] shall be demonstrated OPERABLE by the performance of the CHANNEL CHECK, CHANNEL CALIBRATION, and ANALOG CHANNEL OPERATION TEST at the frequencies shown in Table 4.3-4."

Table 4.3-4 lists the instrument channel calibration as R which the licensee proposes to change from "At least once per 18 months" to "At least once per 24 months".

I v

. 2.4.3 Justification for the Chanae The licensee has reviewed the seismic equipment surveillance, preventative and corrective maintenance records over the last four fuel cycles. The review indicated that the seismic instruments responded as required when tested with approved procedures and no significant corrective maintenance activities were performed on this equipment.

The licensee also stated that additional assurance of the operability of the seismic monitoring instrumentation system is provided by the monthly channel check and the semi-annual analog channel operational test during power operations for those instruments identified in Table 4.3-4 except for the Triaxial Peak Accelerographs and the Triaxial Self-Contained Recorder at the Steam Generator Support.

The latter instruments are calibrated during a refueling outage and are only used to provide qualitative seismic motion data for comparison against analog seismic instrumentation.

The staff's review of NRC records identified one Millstone Unit 3 event concerning an incorrect range for the Triaxial Peak Accelerograph-Safety Injection Accumulator Discharge Line. The incorrect range was identified on September 5, 1991, during a calibration documentation review as part of the investigation into the reliability of the Triaxial Peak Accelerographs. This event is documented in LER 91-024 issued on October 7, 1991, and LER 91-024-01 issued on December 31, 1991. A Special Report, MP-91-756, dated September 25, 1991, was sent by the licensee to the NRC, entitled " Millstone Nuclear Power Station, Unit No. 3 Inoperable Seismic Monitoring Instrumentation."

The instrument was installed as a replacement on March 18, 1987. The TS Table 3.3-7 listed a measurement range of i lg and the installed instrument had a range of 2g. An instrument with a range of Ig was installed on September 6, 1991, to comply with the TS. However, further review indicated i

that an instrument with a range of 2g is more suitable.

Therefore, on November 7, 1991, an instrument with a range of 2g was installed and a TS change was submitted. This range is in accordance with the current TS Table 3.3-7.

This occurrence has no effect on the proposed surveillance test frequency extension as the range of the instrument does not impact surveillance frequency. Based on the above, the staff finds the proposed change in the frequency of TS Surveillance Requirement 4.3.3.3.1 from 18 to 24 months to be acceptable.

2.5 Loose-Part Detection Instrumentation System 2.5.1 Design The primary purpose of the existing Millstone Unit 3 loose-part detection program is the early detection of loose metallic parts in the primary system.

Early detection can provide the time required to avoid or mitigate damage to or malfunctions of safety-related primary system components.

The loose-part detection (monitoring) system (LPMS) is an impact monitoring system which i

functions by detecting the acceleration (vibration) caused by the impact of foreign objects (failed or weakened components or an item inadvertently left in the primary system during refueling or maintenance) on the reactor vessel internal structure or on associated piping.

Regulatory Guide 1.33 " Loose-Part

. Detection Program" recommends a system capable of automatically detecting loose parts that weigh between 0.25 and 30 pounds and impact with an energy of 0.5 ft-lbs or more on the inside surface of the reactor coolant pressure boundary within 3 feet of a sensor.

The LPMS is a nonsafety-related system and is not credited in any design basis accident because it performs no automatic safety functions.

2.5.2 Technical Specification Chance Surveillance Requirement 4.3.3.8 of the Millstone Unit No. 3 TS states "Each channel of the Loose-Part Detection System shall be demonstrated operable by performance of:

a.

a channel check at least once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, b.

an analog channel operation test at least once per 31 days, and c.

A channel calibration at least once per 18 months."

The licensee proposes to change 4.3.3.8.c to remove "per 18 months" and replace with "each refueling interval" (i.e., 24 months).

2.5.3 Justification for the Chanae The licensee has reviewed the LPMS equipment surveillance, preventative and corrective maintenance records over the last four fuel cycles.

The review indicated that some failures have occurred, but none of these failures were attributed to instrument drift associated with calibration frequency.

The failures were random component malfunctions and cable / wire degradation.

The staff reviewed failures associated with the LPMS addressed in the following reports:

LER 87-010-00 dated April 3, 1987 LER 87-010-01 dated February 10, 1988.

Special Report to the NRC dated August 25, 1989 when two of twelve channels failed on July 16, 1989, and were declared inoperable due to continuous alarming.

Special Report to the NRC dated November 15, 1994 for failures that occurred on October 24, 1994.

Special Report to the NRC dated April 11, 1995 for failures that occurred on March 15, 1995.

The staff agrees with the licensee that the above failures were random component failures and cable / wiring degradation and are not related to instrument drift associated with calibration frequency.

In each case, a redundant channel was available to detect loose-parts during the time the failed channel was inoperable.

e Further assurance of system operability is provided by the TS channel check, conducted once per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and the analog channel operational test conducted once per 31 days.- The licensee has scheduled replacement of the LPMS during the next refueling outage with an upgraded impact monitoring system similar in operation to the current system. Based on the above, the staff finds the proposed change in the frequency of TS Surveillance Requirement 4.3.3.8.c from 18 to 24 months to be acceptable.

2.6 Containment Ouench Sorav System and Recirculation Sorav System At Millstone Unit 3, the systems provided for containment heat removal consist of:

1) the quench spray system (QSS) and 2) the containment recirculation system (CRS). These systems are described in chapter 6.2.2 of the Final Safety Analysis Report (FSAR). The containment heat removal systems are designed to reduce the containment pressure following a break in either the primary or secondary piping system inside the containment. Heat is transferred from the containment' atmosphere to the QSS and the recirculation spray system (RSS), which is a spray subsystem of the CRS. The spray water goes to the containment sump, where the CRS transfers the heat to the service water system via its heat exchangers. Additionally, the QSS, currently in conjunction with the spray additive system, is responsible for the removal of iodine from the containment atmosphere following a design basis accident (DBA) in containment.

The QSS consists of two 360 spray headers inside the containment that are fed via two full capacity pumps and automatic valves.

The suction source for the QSS pumps is the refueling water storage tank (RWST).

The pumps and automatic valves in the QSS are activated by a containment depressurization actuation 1

(CDA) signal on high containment pressure. The QSS is capable of performing its intended safety function even with a single failure of an active component.

The CRS is comprised of two redundant subsystems.

Each of these subsystems possess two 50 percent capacity coolers, two 50 percent capacity pumps, automatic isolation valves, and share two 360 spray headers.

The four pumps take suction from a common containment sump, and pump water through the coolers, up the risers, to the spray headers. The two pumps in each subsystem are connected to different spray headers, but share the same emergency bus.

Failure of one emergency bus will not prevent the delivery of sufficient containment recirculation flow, because only one subsystem would be lost.

Each spray header is fed by two risers which take suction from one of the coolers in each of the subsystems.

The QSS and CRS are not normally operated during reactor operation.

During normal operation, the QSS and CRS are dry.

The systems are isolated and the pumps are on standby.

In the event of a loss-of-coolant accident or high energy line break within the containment, a CDA signal causes the motor-operated isolation valves in

i 4

i 4 the QSS and RSS to open automatically, the QSS pumps to start automatically, and the RSS pumps to start automatically after a time delay.

Complete tests of these systems cannot be performed while the plant is operating, because a safety injection signal would cause a reactor trip, feedwater isolation, and containment isolation. Therefore, a piecemeal approach is taken to demonstrate operability of the containment spray subsystems. Normally, the system tests are conducted during refueling outages, and select components (i.e., motor-operated valves and pumps) are tested during operation. Additionally, the actuation logic for the containment spray subsystems is checked periodically during reactor operation.

3.6.2 Technical Snecification Chanae i

Surveillance Requirement 4.6.2.1.c currently requires that each Containment Quench Spray subsystem be demonstrated OPERABLE at least once per 18 months during shutdown by:

1)

Verifying that each automatic valve in the flow path actuates to its correct position on a CDA test signal, and 2)

Verifying that each spray pump starts automatically on a CDA test signal.

Surveillance Requirements 4.6.2.2.c and 4.6.2.2.d require that each Recirculation Spray System shall be demonstrated OPERABLE:

c.

At least once per 18 months by verifying that on a CDA test signal, each recirculation spray pump starts automatically after a 660 20 second delay; d:

At least once per 18 months during shutdown, by verifying that each automatic valve in the flow path actuates to its correct position on a CDA test signal; The licensee is proposing to change the frequency of these surveillances to at least once each refueling interval (i.e., 24 months).

In addition, the phrase "during shutdown" in Surveillance Requirements 4.6.2.1.c and 4.6.2.2.d is being deleted to be consistent with the recommendation in GL 91-04.

(See discussion in 2.1.3. above).

3.6.3 Justification for the Chanae The licensee evaluated equipment performance over the last four operating cycles to determine the impact of extending the frequency of Surveillance Requirements 4.6.2.1.c, 4.6.2.2.c, and 4.6.2.2.d.

This evaluation included a review of surveillance results, preventive maintenance records, and the frequency and type of corrective maintenance.

. The reviews determined that no significant equipment failures for the QSS have occurred in the last four cycles.

The automatic valves for the QSS have actuated as required and the QSS pumps have started automatically in response to a CDA test signal.

There have been two failures of RSS motor-operated valves to actuate in response to a CDA test signal during the tests conducted for the last four cycles. 3RSS*MOV23A failed to actuate during the October 1993 test, due to an improper wiring connection. 3RSS*MOV238 failed to stroke completely closed during the March 1991 test. 3RSS*MOV238 was tested satisfactorily after limit switch adjustments were performed. Additionally, during the October 1993 test, 3RSS*MOV23C actuated but the limit switches gave an incorrect position indication.

The RSS pumps have started as required, except during the tests conducted in June 1987. During the June 1987 tests, the CDA signal was reset prior to the RSS pumps being sequenced to test.

The only preventive maintenance that is scheduled on an 18-month frequency for the QSS and RSS are lubrication of the motor-operated valves, breaker maintenance, and hypot testing of the motors and cables.

Extending the frequency for lubrication of the motor-operated valves is acceptable based on the surveillance history, the low frequency of operation, and the moderate ambient environmental conditions.

Extending the maintenance interval for the breakers is acceptable, because the extensions will not result in any additional' wear since the breakers are normally in the open position.

Extending the frequency for the hypot testing is acceptable, because experience has shown a very low failure rate in general when testing at 18-month intervals and no failures in the RSS system.

Corrective maintenance performed on the QSS motor-operated valves involved minor packing, gasket, and seat leakage, position indication adjustments, and adjustments to valve motor operator tripper fingers. Also, there have been repairs to rusty pins in the actuator linkage of motor-operated valves located outdoors.

For the RSS motor-operated valves, corrective maintenance has involved seat leaks, flange leaks, and limit and torque switch adjustments.

Corrective maintenance performed on the QSS and RSS pumps during the last four cycles involved minor leaks and oil level adjustments.

In each of these cases, the appropriate repair was made. Also, there was one incident of high vibration on the "B" train QSS pump in May 1989. This vibration was determined to be due to improper greasing of the motor inboard bearing. The problem was resolved and the pump was retested satisfactorily.

Based on the engineering review of equipment performance, preventive, and corrective maintenance history and the availability of quarterly inservice testing, there is reasonable assurance that extending the surveillance intervals will not reduce the availability or capability of these systems to perform their intended functions, if needed. The proposed changes are acceptable.

~. _ _ _ _ _ _ _ _ _ _ _ _. _ _ _ _ _ _ -.. _ _ _

i 3.7 Contai-- t Isolation Valves 3.7.1 Q3113n The containment isolation systee is described in chapter 6.2.4 of the FSAR.

The containment isolation system isolates piping lines which penetrate the containment boundary to minimize the release of radioactive materials to the environment from postulated design basis accidents (DBA) within the containment. The valve arrangements ensure containment integrity, assuming a single failure, by providing at least two barriers between the atmosphere outside the containment and the atmosphere within the containment, the reactor coolant system, or systems that would become connected to the containment atmosphere or the reactor coolant system as result of, or subsequent to, a DBA.

3.7.2 Technical Soecification Chance Surveillance Requirement 4.6.3.2 currently requires that each containment isolation valve shall be demonstrated OPERABLE during the COLD SHUTDOWN or REFUELING MODE at least once per 18 months by:

i Verifying that on a Phase "A" Isolation test signal, each Phase a.

"A" isolation valve actuates to its isolation position, b.

Verifying that on a Phase "B" Isolation test signal, each Phase "B" isolation valve actuates to its isolation position, and Verifying that on a Containment High Radiation test signal, each c.

purge supply and exhaust isolation valve actuates to its isolation position.

The licensee proposes to change the surveillance interval from at least once per 18 months to at least once each refueling interval. The components covered by these surveillances are shown on Table 6.2-65 of the FSAR.

3.7.3 Justification for the Chance Equipment performance over the last four operating cycles was evaluated to determine the impact of extending the frequency of Surveillance Requirement 4.6.3.2.

This evaluation included a review of surveillance results, preventive maintenance records, and the frequency and type of corrective maintenance.

During the last four operating cycles, six surveillances have been performed on containment isolation valves that actuate in response to a Phase A isolation signal, and five surveillances have been performed on containment isolation valves that actuate to a Phase B isolation signal.

In these tests, only three failures of the valves to actuate to their design position have occurred. Valve 3SSR*CTV32 (solenoid-operated, globe valve used to isolate a 3/4" safety injection accumulator sample line) failed during the test

i I

, 4 conducted in May 1988 and valves 3RSS*MOV23A and 3RSS*MOV23B (motor-operated, butterfly valves used to isolate a 12" containment recirculation pump suction line) failed during the test conducted in October 1993 and March 1991, respectively. Given the number of tests, the reliability of the containment isolation valves is considered high.

Valve 3SSR*CTV32 is a 3/4" valve in the reactor plant sampling (SSR) system.

The valves in the SSR system are often affected by boron precipitation due to small clearances. When failure occurs these valves are replaced.

The failure of valve 3RSS*MOV23A to actuate was attributed to a blown fuse on the secondary side of the control power transformer. The valve was replaced during the fourth refueling outage due to excessive seat leakage. During valve installation, the wire in the limit switch was pinched and grounded.

This resulted in a fuse blowing during the valve actuation test.

3RSS*MOV238 failed to stroke completely closed during the March 1991 test. The valve was tested satisfactorily after the limit switch adjustments were performed.

There are other TS requirements, such as the quarterly inservice testing of these valves and the monthly automatic actuation logic tests that also demonstrate the operability of containment isolation valves.

Based on the maintenance s 4 performance history, the containment isolation valves are highly reliabla There is reasonable assurance that extending'the frequency of Surveillance Requirement 4.6.3.2 will not result in a deterioration in valve condition or performance.

The proposed TS change is acceptable.

3.8 Bases The Bases for Specification 4.0.2 discusses the extension of the time interval for surveillance requirements. The paragraph currently has a sentence which states that "it also provides flexibility to accommodate the length of a fuel cycle for surveillances that are performed at each refueling outage and are specified with an 18 month surveillance interval." The licensee proposed to substitute the sentence that "it also provides flexibility to accommodate the length of a fuel cycle for surveillances that are specified to be performed at least once each refueling interval." The proposed change to Bases 4.0.2 is acceptable.

3.9 Probabilistic Risk Asressment (PRA)

As discussed above, the licensee performed a comprehensive safety assessment of the proposed changes to the TSs based on past performance and the maintenance history of the components. Using the same deterministic approach, the NRC staff has determined that the changes are supported by existing failure data and are acceptable.

Northeast Nuclear Energy Company (NNECO) also supported the proposed TS changes with a probabilistic safety assessment.

In response to Generic Letter

~_

~.

. (GL) 88-20, NNEC0 submitted an Individual Plant Examination (IPE) on August 31, 1990. The basis for the licensee's IPE was a 1983 full-scope level 3 Probabilistic Safety Study (PSS) (which had been reviewed by the NRC) that had been periodically updated. The PSS contained a full range of both internal and external event probalistic safety assessment (PSA) models.

The NRC's staff evaluation of the IPE was transmitted to NNEC0 by letter dated May 5, 1992. The licensee's estimated core damage frequency (CDF) from postulated, internal events was 5.6E-5, which was about average at the time for Westinghouse 4-loop plants. There were no significant severe accident vulnerabilities identified.

Since the IPE submittal, the licensee has performed a major update to the PRA to reflect various plant modifications, improved procedures, revisions to the training provided to plant staff and increased use of plant specific data.

For example, the addition of a third air cooled diesel significantly reduced the contribution from postulated loss of offsite power and station blackout scenarios. On the other hand, a reassessment of the loss of service water as an initiator indicated that the implications of this support system might be a more significant contributor than originally estimated. While the order of some of the dominant accident sequences has changed as the PRA has been updated with time, the significant insights have not been greatly affected.

NNECO PRA personnel interact with engineering and operations personnel to assess the potential impacts of significant design and/or operational changes on the PRA result.

In the May 1, 1995, submittal the licensee discussed the possible effect of the proposed TS changes on the PRA models.

With respect to the proposed TS changes to the Quench Spray System (QSS) and the Recirculation Spray System (RSS), the licensee noted that the Millstone Unit 3 PRA models the QSS and RSS systems. The proposed changes to the surveillance frequency has no effect on the PRA availability models for the subject systems. The quarterly pump starts are credited in determining the pump failure to start probability. The quarterly valve tests are credited in determining the motor-operated valve failure to open or close probabilities.

Thus, the system component failure probabilities are not affected by the proposed changes. The availability model of the engineered safety feature actuation system for containment depressurization actuation (CDA) component actuation is unaffected by the 24-month fuel cycle, since the constituent components (i.e, bistables, logic circuits, output relays) are tested more frequently.

The licensee also assessed what the proposed TS change to the Reactor Coolant System (RCS) boration flowpath test intervals (4.1.2.2.c and 4.1.2.2.d) would have on the Millstone Unit 3 PRA using rather pessimistic event trees.

To quantify the effect, the fault exposure factor (FEF) of numerous component basic events were revised from six to eight to reflect the change to a 24-month fuel cycle (this assumes component demand failures are linear with

$ surveillance interval). Additionally, the fault factors of certain common cause basic events were revised.

The revisions have the following effect on the listed functions:

l 1.

Charging pump unavailability for Safety Injection:

7 percent increase 2.

Charging Pump unavailability for Sump Recirculation:

23 percent increase 3.

RCS Emergency Boration unavailability for ATWS: 6 percent increase The changes in the charging pump and the emergency boration unavailabilities are expected to result in a core melt frequency increase of approximately 1 percent. This change is considered insignificant.

The PRA groups evaluated the other proposed TS changes. The digital rod position indicators do not have an accident mitigation function and thus have a negligible effect on plant risk.

Extending the frequency for demonstrating the rod drop time likewise has a negligible effect. The seismic and loose-part detection system are instrumentation non-safety related systems that do not play an active role in accident mitigation and thus changing the surveillance frequency would not be expected to have an effect on the CDF.

The probabilistic safety assessment of the proposed changes to the TSs fully supports and complements the deterministic assessment. The changes in surveillance frequencies from 18 to 24 months result in no significant reduction in the margin of safety and are acceptable.

4.0 STATE CONSULTATION

4 In accordance with the Commission's regulations, the Connecticut State l

official was notified of the proposed issuance of the amendment. The State i

official had no comments.

5.0 ENVIRolMENTAL CONSIDERATION The amendment changes surveillance requirements. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding (60 FR 58402). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

I

4

~

! l

6.0 CONCLUSION

1 The Commission has concluded, based on the considerations discussed above, l

that:

(1) there is reasonable assurance that the health and safety of the l

public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor:

R. Clark F. Paulitz Date: December 28, 1995 l

_