ML20206F404
| ML20206F404 | |
| Person / Time | |
|---|---|
| Site: | Arkansas Nuclear  |
| Issue date: | 10/31/1988 |
| From: | ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY, ARKANSAS POWER & LIGHT CO. |
| To: | |
| Shared Package | |
| ML20206F401 | List: |
| References | |
| NUDOCS 8811210130 | |
| Download: ML20206F404 (61) | |
Text
[
l ATWS RULE 10CFR50.62 REQUE!1 FOR EXEMPTION FOR ARKANSAS NUCLEAR ONE UNIT 2 SUBMITTED BY ARKANSAS POWER & LIGHT COMPANY October, 1988 l
l Prepared By ARKANSAS POWER & LIGHT COMPANY C-E POWER SYSTEMS COMBUSTION ENGINEERING, INCORPORATED i
esit:10130 881103 l
PDR ADOCK 05000348 p
FEH.
j
(
ABSTRACT This submittal provides the basis and supporting documentation to request exemption from a requirement of Title 10 of the Code af Federal Regulations Section 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants" for Arkansas Nuclear One Unit 2 (ANO 2).
The submittal will address the requirements of Title 10 of the Code of Federal Regulations Section 50,12 "Specific Exemptions", in terms of exemption from the ATWS Oule and address issues posed by the Nuclear Regulatory Commission concarning r request for exemption from the ATWS rule.
Arkansas Power and Light Company (AP&L) proposes to install at ANO 2, a Diverse Scram System which is diverse from the existing Reactor Trip System.
These modifications will also provide a turbine trip, as required by the ATWS rule, that is diverse and independent from the existing Reactor Trip System.
The installation of this Diverse Reactor Trip System alone will be demonstrated to achieve ATWS risk reduction in a cost-effective manner, which is the underlying purpose of
(
Title 10 of the Code of Federal Regulations, Section 50.62.
AP&L is l
requesting in this submittal exemption from the portion of Title 10 of the l
Code of Federal Regulations Section 50.62 that requires equipment diverse from the reactor trip system to initiate the emergency feedwater system I
under conditions indicative of an ATVS.
(i) i
TABLE OF CONTENTS SECTION TITLE PAGE Abstract i
Table of Contents 11 List of Tables fit i
List of Figures iv List of Abbreviations v
1.0 Introduction 1
2,0 Detailed Evaluation of the ATWS Rule 15 Requirement for Diverse EFAS 3.0 Diverse Scram System 34 4.0 Diversity of the Existing EFAS From the DSS 47 5.0 Diverse Turbine Trip 49 I
- 6. 0 Summary and Conclusions 50 1
l
[
1 1
l l
(11) i
6 i
LIST OF TABLES TABLE TITLE PAGE 2-1 Impact (Cost) to Implement New Safety 01 Grade Diverse EFAS f
1
\\
r 1
I t
l l
l i
6 (iii)
f LIST OF FIGURES FIGURE TITLE PAGE 2-1 ANO 2 EFAS Logic Diagram 32 2-2 (Deleted) 2-3 (Deleted) 2-4 Integration of a New, Separate, Diverse, 33 and Independent EFAS and MS!S with the Existing PPS (iv)
LIST OF A6BREVIATIONS ACRS Advisory Committee on Reactor Safeguards ANO 2 Arkansas Nuclear One Unit 2 ASME American Society of Mechanical Engineers AP&L Arkansas Power & Light ATWS Anticipated Transients Without Scram B&W Babcock and Wilcox C-E Combustion Engineering, Inc.
CEA Control Element Assembly CEDMCS Control Element Drive Mechanism Centrol System CEOG Combustion Engineering Owners' Grcup CFR Code of Federal Regulations CPC Core Protection Calculato.-
CPI CompLter Products. Inc.
s' DSS Diverse Scram System CHF Common Mode Failure DNBR Departure Nucleate Boiling Ratio DTT Diverse Turbine Trip EFWS Emergency Feedwater System E-M Electro-Mechanics EFAS Emergency Feedwater Actuation System FSAR Final Safety Analysis Review G-E General Electric HPPTS High Pressurizer Pressure Trip Setpoint LP&L Louisiana Power and Light MFIV Main Feedwater Isolation Valve MFWS Main Feedwater System MSIS Math Steam Isolation System MSIV Main Steam Isolation Valve MSLB Main Steam Line Break NRC Nuclear Regulatory Commission /"Commission" PPS Plant Protection System PSV Primary Safety Valve P
Probability of a Severe Anticipated Transient Witnout Scram ATWS (v)
a QA Quality Assurance RCP Reactor Cooling Pump RCS Reactor Cooling System RPS Reactor Protective System RTS Reactor Trip System SCF.
Southern California Edison Company SONGS 2 & 3 San Onofre Nuclear Generating Station Unit 2 and 3 SG Steam Generator i
SGLL Steam Generator Low Level TT Turbinc Trip VIR Value Impact Ratio WSES 3 Waterford Steam Ele $tric Station Unit 3 E
l e
l l
l l
i i
i (vi; I
l
}>/,{
k.,
1.0 INTRODUCTION
1.1 PURPOSE This submittal provides information to support and requests an exemption from a portion of Title 10 of the Code of Federal Regulations (CFR)-Section 50.62 (10CFR50.62), "Requirements for i
Reduction of Risk from Anticipated Transients Withour. Scram (ATW.s Events for Light-Water-Cooled Nuclear Power Plants," as it pertains to Arkansas Nuclear One Unit 2 (ANO 2).
Specifically, exemption is requested under Title 10 of the Code of Faderal Regulations, Section 50.12 (10CFR50.12) from the requirement that ANO 2 have equipment which is diverse and independent from the reactor trip system to automatically initiate the emergency feedwater system (EFWS) under conditions which are indicative of an.'$nticipated Transient Without Scram (ATWS).
1.2 BACKu0VND
\\
1.2.1 10CFR50.62 Requirements On July 26, 1984 the Code of Federal Regulations was amended to include Section 10CFR50.62, "Requirements for Reduction of Risk from Anticipated Transient Without Scram (ATVS) Events for Light-Water-Cooled Nuclear Power Plants." The requirements of 10CFR50.62, henceforth referred to as the ATWS Rule, as they pertain to ANO 2 are as fo11cws:
"...(c) Requirements.
(1) Each pressurized water reactor must have equipment from sensor output to final actuation device, that is diverse ftom the reactor trip system, to autortatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS.
This equipment must be designed to perform its function in a reliable manner and be ir,dr. pendent 1
m (from sensor output to the final actuation device) from the existing reactor trip system.
(2) Each pressurized water reactor manufactured by Combustion Engineering or by Babcock and.Wilcox must have a diverse scram system from the sensor output to interruption of power to the control rods.
This scram system must be designed to perform its function in a reliable manner and be independent from the existing reactor trip system (from sensor output to interruption of power to the control rods...
(6) Information sufficient to demonstrate to the Commission the adequacy of items in paragraphs (c)(1) through (c)(5) of this section si.11 be submitted to the Director, Office of Nuclear Reactor Regulation.
(d) Implementation.
By 180 days after the issuance of the QA guidance for non-safety related components each licensee shall develop and submit to the Director of the Office of Nuclear Reactor Regulation, a proposed schedule for meeting the requirements of paragraphs (c)(1) through (c)(5) of this section.
Each shall include an explanation of the schedule along with a justification if the schedule calls for final implementation later than the second refueling outage after July 26, 1984, or the dite of issuance of a license authorizing operation above 5 percent of full power.
A final schedule shall then be mutually agreed upon by the Commission and liceasee."
1 Uderly_t,ng,Purposeof10CFR50.62 in 1.2.2 From its inception, 10CFR50.62 was justified by the Commission on a value/ impact (i.e., benefit / cost) basis as a means to reduce the probability of common mode failures (CMF) affecting the RTS and certain systems that are relied upon to mitigate an ATWS event.
A Commission letter, hencefortt referred to as SECY-83-293, provides i
rs
=
detailed background for the Rule.
This letter, Reference 1.5.1.,
states on page 5, "The (NRC) staff believes that the final rule..., if r.:ade effective, would substantially reduce the ATWS risk in a cost effective manner and assure an acceptable level of risk from ATWS events."
The Statement of Considerations for 10CFR50.62 indicates that the purpose of the ATWS rule is to reduce the probability of common mode failures in the system that would prevent or mitigate an ATWS event.
Value/ impact analyses were an important consideration in the formulation of the Rule.
The Statement of Considerations contains a section entitled "Basis for Final Rule as Promulgated by the Commission" (49FR26037, 26038).
The requirement for diverse and independent emergency feedwater actuation and diverse Turbine Trip is justified by the Commission based on its stated belief that, "It has a highly favorable value/ impact for Westinghouse plants and a marginally favorable value/ impact for Combustion Engineering and Babcock and kilcox plants." The following paragraph of this section discusses the requirements for a Diverse Scram System (055) in C-E, B&W, and G-E plants.
This section states, "It (the DSS) has a favorable value/ impact from the Staff's analysis.
However, the principal reasons for requiring the feature are to assure emphash on accident prevention and to obtain the resultant decre Je in potential common cause failure paths in the trip system." 1 SECY-83-293 stresses the importance of engineering judgment in the formulation of the Rule. of SECY-83-293 on page 7 states, "It is also realized that doing value/ impact calculations is somewhat subjective in arriving at the optimal level of fix, due to uncertainty in probsbilistic assessments and in the co.t estimates for the modification.
Therefore, the Task Force used 1
Unless otherwise stated, hereinaf ter, "diverse" means diverse from the reactor trip system, and "independent" means independent from the reactor trip system.
3
value-impact calculations only as an aid to evaluate the ATWS rule alternatives." Page 9 of Enclosure D continues, "When value-impact results were borderline, the Task Force relied much more on engineering judgment to determine whether an alternative should or should not be included in the ATWS rule."
Although the Commission has stated the value/ impact calculations are not the only basis for its rule making, they have rejected requirements for plant hardware modification that had an unfavorable value/ impact ratio (i.e., significantly less than one) and were judged to not contribute significantly to ATWS risk
.aeduction.
For example, Enclosure D to SECY-83-293 (pages 2, 31, and 48) indicates that for C-E and B&W plants the Commission computed a value/ impact ratio of 0.44 for installing extra primary safety valves.
The Federal Register, Statement of Considerations accompanying 10CFR50.62 contains a section entitled, "Adding Extra Safety Valves or Burnable Poisons", which indicates that the Commission did not recommend that the Rule require the installation of more safety valves because, "...the value/ impact is unfavorable for this alternative for existing (C-E and B&W) pl ante,.
These plants all have large dry containments and will be most able to mitigate the radiological consequences from an ATWS."
Based on both the Statements of Considerations for the Rule and SECY-83-293, it is concluded that the purpose of the ATWS Rule is to reduce the probability of a severe ATWS event in a cost-effective manner by reducing the susceptibility of the RTS to common mode failures. 2 2
Consistent with the criterion provided in Reference 1.5.2 and Section 5.5 of Enclosure D to SECY-83-293, a "severe ATWS" event is defined as an ATWS that results in a RCS pressure greater than 3200 psia.
The Commission assumes that an ATWS event which results in RCS pressures in excess of ASME Level C pressure, about 3200 psia, will lead to an unacceptable plant enndition.
4
1.2.3 Previous Submittals to the Commission Regarding EFAS Diversity Since 1984, there has been an ongoing dialogue between the Combustion Engineering Owners' Group (CEOG) and the Commission regarding the level of diversity that presently exists between the EFAS and the RTS.
In the months following the issuance of the ATWS rule, there were several meetings and telephone conversations between the Commission and the CEOG ATWS Subcommittee.
The position of the CEOG ATWS Subcommittee was tnat the existing level of EFAS diversity satisfies the ATVS Rule and that plant modifications to increase the level of diversity would not be cost beneficial.
As a result of these interactions, the CEOG submitted CEN-315 (Reference 1.5.3) to the Commission.
CEN-315 provided information on plant specific designs and diversity features that are generic to the C-E design to support the CEOG's position.
Reference 1.5.4 provided the Commission's evaluation of CEN-315.
Based on the information provided, the Commission's preliminary conclusion was that ANO 2, SONGS 2 & 3, and WSES 3 did not appear to satisfy the ATWS rule requirement for a diverse and independent EFAS.
This conclusion was based on the Commission's observation that many of the EFAS components did not appear to have acequate diversity and the EFAS power supplies did not appear to be independent.
In Reference 1.5.4 ho'.<ever, the Commission also stated that any other diversity considerations would be reviewed on a plant specific basis.
In response to Reference 1.5.4, CEN-349 (Reference 1.5.5) was submitted to the Commission.
CEN-349 provided detailed information about the diversity betwewn EFAS and RTS for ANO 2, SONGS 2 & 3, and WSES 3.
In evaluating EFAS diversity, CEN-349 considered the three RTS functions (i.e., high pressurizer pressure trip, core protection calculators, and steam generator low level trip) which would have to fail in order for an overpressure ATWS to occur.
CEN-349 demonstrated that all of the 5
m
EFAS components (except for the bistable and matrix relays) were diverse from their counterparts in the RTS.
CEN-349 stated, however, that the design of the PPS provides a degree of protection against common mode failures of Distable relays disabling both the EFAS and RTS that is comparable to the protection which would be provided by diverse components. At a minimum, the right combination of 24 out of 48 bistable relays or 24 out of 72 matrix relays in the EFAS and the RTS functions of interest (high pressurizer pressure trip, core protection calculators, and steam generator low level trip) would have to fail in the "no trip" state to prevent both reactor trip and EFWS actuation.
Due to the nature of the PPS logic, for some failure combinations, up to 44 out of 48 bistable relays, and 62 dut of 72 matrix relays, could simultaneously fail in the no trip condition without causing a failure of both the reactor to trip and the EFWS to actuate.
CEN-349 stated further that, although the EFAS and RTS power supplies are not independent, their design also protects against common mode failures.
All PPS power supplies have two circuits, one providing power and the other supplying overvoltage protection, that are diverse and independent of one another.
It would require the simultaneous occurrence of two different types of common mode failure, one causing an overvoltage condition on the power circuit and the other causing a failure of the overvoltage protection circuit, in order for a power supply failure to cause both a failure of the RTS to trip the reactor and a failure of the EFAS to actuate EFWS.
Reference 1.5.6 provided the Commission's response to CEN-349.
It stated that ANO 2, SONGS 2 & 3, and WSES 3 did not satisfy the ATWS rule requirement for EFAS diversity because the bistable relays and matrix relays in the EFAS are identical to their counterparts in the RTS.
In addition, the power supplies in the 6
l
r EFAS and RTS are'not independent.
Reference 1.5.6 therefore concluded that either:
(1) diversity and independence must be provided in the areas where they are lacking, or (2) an exemption from the ATWS rule must be requested in accordance with the provisions of 10CFR50.12.
Reference 1.5.6 provided guidance regarding the information which should be provided to support an exerption.
This is summarized in subsection 1.3.2 of this submittal.
- 1. 3 CRITERIA FOR EXEMPTION t-
.1. 3.1 10CFR50.12 Requirements i
Title 10 of the Code of Federal Regulations Section 50.12 (10CFR50.12) states:
"(a) The Commission may, upon application by any interested person or upon its own initiative, grant exemptions from the requirements of the regulations of this part which are -
(1) Authorized by law, will not present an undue risk to the t
public health and safety, and are consistent with the common l
defense and security and are otherwise in the public interest.
i (2) The Commission will not consider granting an exemption unless l
special circumstances are present."
I 10CFR50.12 lists several categories of special circumstances.
The ATWS Rule requirement for a diverse EFAS falls into special circumstance (ii) which is as follows:
1 7
a
"(ii) Application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule."
1.3.2 Commission Guidance As stated earlier, the Commission provided guidance in Reference 1.5.6 for requesting exemption from the ATWS rule requirement for a diverse EFAS.
This guidance has been interpreted as what the Commission views as an adequate exemption request must demonstrate to satisfy special circumstance category (ii) in 10CFR50.12.
The Commission's guidance is as follows:
l
"(1) The main rationale for using identical components in the case of the bistable relays and the matrix relays appears to be the specialized nature of the existing C-E plant protection system design requirements.
It is stated that replacement of some of the existing relays with a diverse counterpart is not "reasonable or practicable." Neither CEN-315 nor CEN-349 provide sufficient information to support this claim (neither does CEN-315 or CEN-349 provide specific information demonstrating that it is not reasonable nr practicable to install a totally new. separate, independent, and diverse EFW actuation system that would avoid this "specialized" problem).
The justification for not providing diversity and independence in this area must include either the prohibitive costs of adding such a system (for the safety benefit gained), or the competing risks (i.e., the increase in risk due to the addition of the new system), or both."
"(2) As noted by the Rule and the ACRS and cited in CEN-315, significant emphasis should be placed on the preventive aspects, e.g., the diverse scram system.
8
i W.
Justification to support an argument for the use of some identical components in both the existing scram system and the auxiliary feedwater actuation system should include a detailed discussion of the diverse scram system and its design and' operational features, that demonstrates it is an extremely reliable, preventive system and that it is totally diverse and independent from the existing RTS.
(Note:
This may require installing a diverse scram system which goes significantly beyond the minimum requirements specified for this system in the rule.) Include a discussion of the reliability assurance and maintenance and surveillance programs planned for the diverse scram system to ensure that it remains a highly reliable operable system throughout the life of the plant."
"(3) Although the Rule specifically requires that the auxiliary feedwater actuation be diverse and independent from the existing reactor trip system (emphasis added), there is some potential benefit to having an auxiliary feedwater actuation system diverse and independent from the new (diverse) scram system.
Proviue a detailed discussion of the diversity and independence provided between these two functions."
"(4) Part 2 of the ATWS mitigating feature is the turbine trip function.
Provide a discussion of the turbine trip function and its design and operational features which demonstrate that it is an extremely reliable mitigative feature and that it is diverse and independent from the reactor trip function (either the existing reactor trip system or the diverse scram system or both)."
[ NOTE:
At ANO 2, the "auxiliary feedwater actuation system" discussed above is the same a* demergency feedwater actuation system" (EFAS).]
4 9
a 1.4 OVERVIEW 0F THE BASIS FOR A; 0 2 EXEMPTION 1/
AP&L believes that the underlying risk reduction purpose of the ATWS rule can be achieved by installing a reliable DSS with an inherently diverse Turbine Trip (TT) at ANO 2.
The existing EFAS need not be modified or supplemented to achieve the intent of 10CFR50.62.
In accordance with the Commission's guidance, this submittal will demonstrate that an exemption from the requirement for an EFAS which is diverse and independent from the existing RTS is
. justified for the following reasons:
1.4.1 It is not reasonable or practicable to comply with the ATWS rule requirement for an EFAS that is diverse and independent from the RTS because:
(a) The cost of replacing the existing ANO 2 EFAS with a totally 2
new, independent, and diverse EFAS is estimated to be approximately $3,200,000 per reactor. This would provide an
~7 incremental reduction of the ATWS risk of 9 x 10 severe ATWS event per reactor year, with a value of $270,000 per reactor (assuming that the remaining life of the plant is 30 years).
The OSS and TT, on the other hand, provide a
-5 reduction in risk of about 5.3 x 10 Thus, once the DSS with its inherent diverse TT is installid, the cost of replacing the existing EFAS with a new diverse and independent EFAS would far outweigh the value of the incremental decrease in ATWS risk.
(b) It is not reasonable or practicable to replace the existing EFAS bistable and matrix relays with diverse counterparts and make the existing EFAS power supplies independent of the RTS power supplies.
Due to the specialized nature of the PPS in ANO 2, diverse replacement bistable relays and matrix relays would have to be custom designed and custoin built to fit 10
=
within ngid phy:ical and functional constraints and qualified for use 10 a Class 1E safety system.
In order to insta'l independent EFAS power supplies, additional station battesies with the associated equipment would have to be instal?ed or the equipment would need to be powered from an existirg source using qualified isolators.
In addition to the i.ctual hardware, the cost of maintenance, surveillance, arid replacement over the life of the plant must also be considered.
This approach has been evalua;.ed by the NSS$ vendor and is not considered a viable solution.
Although a precise cost estimate has not been determined, a conservative estimate of one quarter of the cost of replacing the EFAS has been placed on this approach.
This would put the cost at approximately
$800,000 per unit.
Based on the evaluation performed by the Commission in SECY-83-293, the value/ impact ratio of this modification is comparable to other alternatives which were deemed by the Commission as not cost beneficial in achieving the underlying purpose of the ATWS Rule.
However, it is probable that the cost will be much higher than the conservative estimate of $800,000 per unit, due to the additional costs associated with designing diverse equipment, and the qualification of this equipment and significant hardware and complex wiring modifications required to accommodate the new equipment.
The initial design effort is a relatively small part of a plant modific ation of this nature.
A large part of the cost is associatej with the installation and testing of the new equipment.
The incremental reduction in ATWS risk associated with these changes would be 9 x 10'7 severe ATWS event per reactor year, with an estimated value of $270,000 over the remaining life of the plant, which is estimated to be 30 years.
Thus, once the DSS with its inherent diverse TT is installed, the cost to install diverse bistable and matrix 11
c relays and independent power suppli9s in the EFAS is comparable to the alternatives previously discounted by the Commission as a non-cost-effective means of decreasing the ATWS risk.
(c) Instaliation of a new system (in addition to the existing EFAS) to initiate EFW under conditions indicative of an ATWS would also not be a cost beneficial way of reducing the ATWS risk.
The EFAS system in ANO 2 includes logic that initiates EFW following a steam generator low level (SGLL) condition.
In addition, the 1cgic identifies a steam generator as being ruptured based on the pressures in the steam generators and prohibits the flow of EFW to a ruptured steam generator.
The conditions that are indicative of an ATWS (i.e., high pressurizer pressure, SGLL, and high pressurizer level) can also be indicative of some secondary system pipe breaks.
Therefore, the new system would have to include logic to identify and block EFW flow to the ruptured steam generator.
Also, since the new system would initiate and isolate EFW in parallel with the existing EFAS, measures would have to be taken to assure that the new system and the existing system were not providing conflicting signals (e.g., one system providing a signal to provide EFW while the other system was providing a signal to isolate EFW).
Since the existing EFAS is a four channel Class 1E system, the new system would have to be a Class 1E system with four channels.
Thus, the new system would be as expensive as the totally new, independent, and diverse EFAS discussed in item 1(a).
As was discussed in item 1(b), the cost of such a system far outweighs the benefits.
1.4.2 The DSS design that will be installed at ANO 2 will be an extremely reliable preventive system.
The DSS reliability assurance, maintenance, and surveillance programs will enhance the DSS reliability over the life of the plant.
12
.c
,r, 4
1.4.3 The EFAS diversity and independence from the 055 will provide protection against a common mode failure that prevents the reactor
.from tripping and the EFW from actuating under conditions
. indicative of an ATWS.
1.4.4 Due to the nature of the existing turbine trip circuitry, the DSS will provide an inherently diverse TT function.
This will be diverse and independent from the RTS and will trip the turbine under conditions indicative of an ATWS.
Items 1.4.1 through 1.4.4 (above) are discussed in detail in the following sections (2.0 through 5.0).
13
- 1. 5 REFERENCES FOR SECTION 1
^
1.5.1 SECY-83-293, "Amendments to 10CFR50 Related to Anticipated Transients Without Scram (ATWS) Events", July 19, 1983.
1.5.2 NUREG 460, "Anticipated Transients Without Scram for Light Water Reactors", March 1980.
1.5.3 September 18, 1985 letter from R.W. Wells (CEOG) to Fauste Rosa (NRC), "CEN 315 Summary of the Diversity Between the Emergency Feedwater Actuation System for C-E Plants."
1.5.4 August 4, 1986 letter from D.M. Crutchfield (NRC) to R.W. Wells (CEOG), "NRC Staff Evaluation of CEN-315, Summary of the Diversity Between the Reactor Trip System and the Emergency Feedwater Actuation System."
1.5.5 December 30, 1986 letter form M.0. Medford (SCE) to G.W. Knighton (NRC), "CEN-349 Response to the NRC's Evaluation for CEN-315 for San Onofre Nuclear Generating Station Units 2 and 3, Arkansas Nuclear One Unit J. and Waterford Steam Electric Station Unit 3."
c 1.5.6 Letter from G.W. Knighton (NRC) to K.P. Baskin (SCE) and J.C.
Nolcombe (SDG&E), "NRC Evaluation of CEN-315 and CEN-349."
b I
i 1
14
2.0 DETAILED EVALUATION OF THE ATWS RULE _R_EQUIREMENT FOR 01 VERSE EFAS
2.1 INTRODUCTION
Poteraially, there are three wcys to ostisfy the ATWS rule requirement for a diverse and independent EFAS.
These are:
Replacing the existing EFAS with a new system that is totally diverse, independent, and separate from the RTS, or Replacing the existing EFAS bistable relays and matrix relays with components that are diverse from their counterparts in the RTS and replacing the EFAS power supplies with equipment that is independent from the RTS power supplies, or Installing a new system, in addition to the existing EFAS, to initiate auxiliary feedwater under conditions indicative of an ATWS.
An evaluation of each of these options is presented in the following sections.
2.2 EVALUATION OF REPLACING THE EXISTING EFAS WITH A TOTALLY NEW, DIVERSE, SEPARATE, AND INDEPENDENT EFAS 2.2.1 Overview and Description of EFAS The ATWS rule requirement for a diverse and independent EFAS could be satisfied by removing the existing EFAS from the Plant Protection System (PPS) cabinet and replacing it with a new EFAS that is diverse and independent, and located in a separate cabinet.
Before evaluating this approach, it is appropriate to describe the emergency feedwater system (EFWS) and the EFAS logic.
The EFWS and EFAS are complex safety related systems configured to meet 15
design requirements that go beyond considerations of the ATWS rule.
The EFAS for a C-E designed plant performs the following functions:
Determines that flow from the MFWS to the steam generator (s) is insufficient based on low steam generator level, Identifies that a steam generator pressure boundary is ruptured and prevents EFW flow to the ruptured generator based on low steam generator pressure or on steam generator differential pressure.
Starts EFW pumps, Opens the valves necessary to provide a flow path to the intact steam generator (s).
Provides SG overfill protection from EFW and controls SG level.
Figure 2-1 depicts the EFAS logic used at ANO 2.
Additionly, the EFAS intera;ts with the Main Steam Isolation System (MSIS) signal on a c)mponent level.
To illustrate this interaction, postulate that a large non-isolatable secondary pipe break were to occur in stear generator 1 (SG1).
An MSIS signal would be generated when a low pressure condition occurred in either steam generator.
Upon MSIS generation, output contacts from the MSIS actuation relays would close the Main Feedwater Isolation Valves (MFIVs) and Main Steam Isolation Valves (MSIVs) to both steam generators.
As the event progresses, an EFAS-2 signal would be generated (note that an EFAS-1 signal would not be generated due to the low pressure condition in SG1).
Output contacts from the EFAS relays would block, at the equipment level, the signal from the MSIS actuation relays contacts to close the 16
EFW isolation valve associated.with steam generator 2 (SG2).
This would enable EFW to be aelivered to SG2.
Replacing the existing EFAS would involve relocating the EFAS and the MSIS function in a new cabinet that is separate from the existing PPS.
This would be required in order to retain the existing interaction of the EFAS-1, EFAS-2, and MSIS signals on the actuated component level.
Figure 2-4 illustrates the integration of the new cabinet with the existing system.
This modification would provide an EFAS that is diverse and independent from the RTS.
1 2.2.2 Impact (Cost _),
The approximate anticipated cost of installing a new diverse and independent system to replace the existing EFAS is $3,200,000.
1 These costs are summarized in Table 2-1.
The costs include the cost associated with the removal of the EFAS and MSIS functions i
from the existing PPS cabinet.
The components that are removed would be replaced with equipment which is diverse from the RTS components and located in a new cabinet that is physically i
separate and independent from the existing RTS.
The EFAS and MSIS actuation devices located in the existing auxiliary relay cabinet would remain unchanged.
The costs include the engineering effort and required documentation, the raceway installation, hardware, l
the installation of the diverte EFAS, and account for I
construction, cost of capital and escalation to in-service dollars.
l 2.2.3.
Value (Benefit)
The regulatory analysis for the ATWS Rule, which is described in Enclosures C and D of SECY-83-293 (Reference 2.S.1), used j
simplified event trees for estimating the severe ATWS frequency probability (PATWS) associated with two major types of ATVS f
I events; turbine trip and non-turbine trip events.
In order to i
l 17 I
i
I,,
c e
evaluate the value associated with the plant modifications required by the ATWS Rule, the methodology used in the regulatory analysis to arrive at the final ATWS rule has been examined.
The purpose of this evaluation was to establish the benefit of the ATWS Rule modifications as they relate to a cost / benefit analysis for performing the modifications while considering the Commission comments from meetings and telephone conversations concerning the risk reduction basis of the ATWS Rule.
Reference 2.5.2 details this evaluation.
Based on the analysis performed in Reference 2.5.2 the following conclusions have been made:
Installation of the DSS and the inherent OTT accounts for over 98% of the achievable risk reduction from a severe ATWS, Accountirg for the uncertainties does not change the conclusion that installation of the DSS and the inherent DTT accounts for over 98% of the achievable risk reduction from a severe ATWS, The installation of a diverse EFAS accounts for less than 2%
of the achievable risk reduction, and The value of installing a diverse EFAS to mitigate the consequences of a severe ATWS, based on the decrease in risk reduction is $270,000.
These results will be used in the following sections to evaluate the value and impact of installing a diverse EFAS.
18
2.2.4 Value/ Impact Analysis The Value/ Impact Ratio (VIR) is defined as:
Diverse EFAS Value in Dollars VIR (Eq. 2-1)
=
Diverse EFAS Impact in Dollars Using the EFAS value computed in Reference 2.5.2, and the EFAS 6
cost of $3.2 x 10, Equation 2-1 beccmes:
$270,000 VIR
=
= 0.084 (Eq. 2-2) 6
$3.2 x 10 It should be noted that the VIR computed for a diverse EFAS (0.084) is significantly less than the VIR computed by the Commission for extra safety valves (0.44).
The Commission rejected a requirement for installation of extra safety valves in existing C-E plants because of the unfavorable VIR.
Therefore, incorporation of a diverse EFAS is not a cost effective approach if the DSS with its inherently diverse TT (DTT) is installed.
As such, the installation of a new EFAS that is totally diverse, independent, and separate from the RTS would not serve the underlying purpose of 10CFR50.62 to reduce the ATWS risk in a cost effective manner.
2.3 EVALUATION OF COMPLIANCE BY INSTALLING DIVERSE EFAS BISTABLE AND MATRIX RELAYS AND INDEPENDENT EFAS POWER SUPPLIES 2.3.1 Overview The existing EFAS would satisfy the ATWS rule if the existing bistable relays and matrix relays were replaced with diverse components and the EFAS power supplies were replaced with independent components.
This modification would provide an EFAS that is diverse and independwat from the RTS.
This section 19
a
(
i
. examines the modifications required to provide diversity within the existing Plant Protection System Cabinet.
2.3.2 Impact Cost Diverse Bistable and Matrix Relays and Independent Power Supplies The first step in achieving diversity within the existing PPS cabinet is to eliminate shared circuitry.
It is necessary to provide separate-inputs and separete bistables for steam generator level and variable setpoint cards for steam generator pressure.
The circuits would then be separate but not diverse.
There are two different methods which can be used to provide the diversity.
The first method would be to replace the components of the EFAS bistables and matrix relay cards with comparable components from a
~different vendor.
This would achieve only the diversity of manufacturer.
This approach has been assessed as inadequate by the Commission to reduce the risk of common mode failures.
The second method would require diverse designs, i.e, operational principle, etc., for the bistable, the variable setpoint card, the bistable relay card and the matrix relay card.
This would achieve q
a higher level of diversity which would be acceptable and in compliance with the rule.
This approach would require a redesign l
of the existing PPS internal logic cards and involve complex wiring changes with provisions to prevent the interchange of RPS/EFAS components during the surveillance and maintenance of the components.
Due to the specialized nature of the PPS in ANO 2, the replacement of diverse bistable relays and matrix relays would require a custom design and manufacture to fit within rigid physical constraints and meet strict functional requirements.
The existing i
components in the EFAS circuitry were designed and qualified to meet the stringent requirements of IEEE-279 and IEEE-384 at the time of their ifcensic,g and their installation in the plants.
In a
20
o s
order to replace these components a similar qualification program must be performed.
With regard to the independence of power supply within the existing PPS cabinet, each cabinet receives vital AC power from a separate bus. Within the cabinet various power supplies are used to convert the AC power to DC power.
Achievement of diversity and independence of power supply within the existing PPS cabinet is constrained by the fact that there'is only one source of vital AC power per channel.
Modification of the PPS cabinet internal power distribution and physical layout in order to provide separate and independent RTS and EFAS functions would be extremely complex, if at all possible, In summary, an evaluation and analysis of the potential solution to providing separate and diverse hardware for the RPS/EFAS major safety related electronic components within the PPS cabinet is not considered a viable means to meeting the literal interpretation of the ATWS rule.
The bases for this conclusion are as follows:
1)
The existing Plant Protection System was designed and configured to comply with multiple and overlapping requirements including IEEE-384 and IEEE-279.
Therefore, any new components must also be designed and configured to meet the same requirements, in addition to diversity and the more restrictive independence criteria of the ATils Rule.
2)
The modification of the PPS cabinet to conform to literal compliance with the ATWS Rule is complex; it would be extremely difficult, if not impossible, to assure that new failure modes and effects are not introduced, as well as achieving the desired risk reduction objective of ATWS.
3)
Modification to the PPS cabinet to provide diversity and independence will introduce human factor concerns, due to design differences, and vill thereby increase the 21
E probability of operator and surveillance errors.
Consequently, little, if any, improvement in safety or risk redurtion would be expected to be realizable.
4)
The addition of diverse qualified components and sources of power supplies is not considered a viable solution to the ATWS rule.
[
The costs associated with the approach of providing diversity in the PPS cabinet include the following components:
Design of diverse components, Qualification of the diverse components, Installation of the diverse components, Design of wiring changes to supply independent power
- supplies, Rewiring of existing power supplies to provide independence (if at all possible),
Training of staff in the maintenance and operation of the new equipment, Changes to the maintenance documentation, Changes to the Technical Specifications, Potential changes to the Surveillance Requirements in the Technical Specifications due to the new equipment.
Since this approach has been evaluated and is not const$ red a viable solution to compliance with the ATWS Rulo, cost of such a modification has not been precisely determined.
However, assume that a conservative cost of the modifications was one quarter of f
that of replacing the existing EFAS with a totally diverse and I
independent EFAS.
This would put the estimated cost of providing
[
diversity within the PPS at approximately $800,000.
22 l
' 2. 3. 3 Value (Benefit)
Using the Commission's methodology, the effect on P I
ATWS replacing the existing EFAS bistable relays and matrix relays with diverse components and installing independent EFAS power supplies would be the same as replacing the existing EFAS with a new EFAS that is totally diverse, independent, and separate from the RTS.
~7 Thus, the incremental ATWS risk reduction would be 9 x 10 severe ATWS events per reactor year, the same as calculated in Appendix A.
The value, therefore, would be $270,000.
2.3.4 Value/ Impact The VIR would be (equation 2-1):
Diverse EFAS Value in Dollars VIR
=
Diverse EFAS Impact in Dollars I
Using one quarter of the EFAS value computed in Reference 2.5.2, and the estimated conservative cost of providing diversity in the l
PPS cabinet, of $800,000, Equation 2-1 becomes:
$270,000 VIR 0.42 (Eq. 2-3)
=
=
$800,000 I
It should be noted that this VIR (0.42) is virtually equivalent to l
the VIR (0.44) computed by the Commission for extra safety valves.
l As was noted previously, the Commission rejected a requirement for installation of extra safety valves in existing C-E plants because of the unfavorable V!R.
Therefore, replacing the existing EFAS bistable relays and matrix relays with diverse replacements and installing EFAS is not cost effective if the DSS with its inherently diverse TT is implemented.
As such, the installation of diverse bistable and matrix relays and independent power supplies in the EFAS would not serve the underlying purpose of 10CFR50.62 to reduce the ATVS risk in a cost effective manner.
23
2.4 EVALUATION OF COMPLIANCE BY INSTALLING A REDUNDANT EFAS THAT IS DIVERSE AND INDEPENDENT FROM THE RTS Another potential approach for complying with the ATWS rule is the installation of a new system (in addition;to the existing EFAS) to initiate EFW under conditions indicative of an ATWS.
This section will examine two options for implementing this approach:
Installing a redundant control grade EFAS Installing a redundant safety grade EFAS The 1
,t option creates competing risks. While the second option has a highly unfavorable VIR and also imposed competing risks.
2.4.1 Installing a Redundant Control Grade EFAS In previous discussions with the Commission, some Staff members suggested that it may be possible to install a relatively inexpensive system (e.g., a one or two channel con +.rol grade system) that uses simple logic to initiate EFW under conditions indicative on an ATWS.
This would, however, impose competing risks.
As was discussed earlier, the EFW System and EFAS are complex safety related systems configured to meet design requirements that go beyond considerations of the ATWS rule.
The EFAS monitors steam generator levels to determine if flow from the MFWS to the steam generators is sufficient to maintain adequate steam generator inventory.
Steam generator inventory may, however, be insufficient as a result of a secondary side pipe break.
The EFAS, therefore, monitors steam generator pressure and steam generator differential pressure to identify a ruptured steam generator.
If a low pressure (i.e a pressure less than a fixed value) condition is detected in a steam generator, that steam 24
r -
1 generator is identified as ruptured.
Similarly, i'
.;h differential steam generator pressure is detected, tne steam generator with low pressure is identified as ruptured.
EFW flow to a ruptured steam generator would impose two potential risks.
First, during an excess heat removal by the secondary system event such as a main steam line break (MSLB), it could potentially increase the rate of heat removal and exacerbate the rapid cooldown of RCS.
Second, it could potentially cause EFW to be diverted away from the intact steam generator where it might be needed to remove energy from the primary system.
The EFAS logic, therefore, locks out EFW to a ruptured steam generator.
The conditions that are indicative of an ATWS (i.e., high pressurizer pressure, SGLL, and high pressurf zer level) can also be indicative of some secondary system pipe breaks.
During a large, non-isolatable secondary pipe break, which is part of the plant design basis, both steam generators would blow down through the break and depressurize until a main steam isolation signal was generated on low steam generator pressure.
In addition, the plant would be expected to trip on a valid signal, which, depending on the specifics of the transient, might be high pressurizer pressure, low steam generator level, low DNBR, or low pressurizer pressure.
The main steam isolation valves would close, causing i
the intact steam generator to repressurize.
The ruptured steam generator would continue to blow down through the break, and hence i
depressurize.
In addition, a low level condition would certainly occur in the ruptured steam generator, and probably in the intact steam generator as well.
As such, the Class 1E EFAS would be expected to generate a valid signal to block EFW flow to the ruptured steam generator, while the simple control grade EFAS would be expected to generate a contradictory signal to feed the ruptured steam generator.
Therefore, the new system would also have to include logic to identify and lock out EFW flow to a
(
ruptured steam generator.
t 25 t
i i
Installation of a more complex control grade system, which incorporated logic to identify and lock out EFW flow to a ruptured steam generator, would also pose problems.
Signals from the two EFASs (the existing safety grade system and the backfit of the control grade system) would have to be integrated at the component (e.g., pumps and valves) level.
There are four options for I
integrating the signals from the two systems:
(1) giving the l
signals from the two systems equal weight, (2) giving the signal from the control grade system preference, (3) giving the signal l
from the safety grade system preference, or (4) installing additional hardware with logic to differentiate between valid and l
faulty signals.
Some background information is useful for understanding the implications of each of these options.
Even if the control grade EFAS were to incorporate logic to identify and block EFW flow to a i
ruptured steam generator, there are credible scenarios which could i
result in the control grade system producing signals which would contradict the safety grade EFAS signals.
These scenarios would include (1) spurious failures of the control grade system (2) failures of the control grade system due to a harsh containment environment during an inside containment high energy line break, or (3) different signal errors in the two systems.
The first option, giving equal weight to the signals from the
[
safety grade and the control grade system, woulc be unacceptable.
Whenever a low level condition occurs in a steam generator, the l
valves in the piping that provide a finw path for the EFW must be f
either open (if the steam generator associatea with the valves is f
intact) or shut (if the steam generator associated with the valves is runtured).
If these valves received signals to open from one EFAS and simultaneously received contradictory signals to shut f
from the other EFAS, in the absence of logic to give one set of l
signals preference over the other, there would be no assurance of I
the valves assuming the correct position.
This would be detrimental to plant safety, f
i 26 h
f
Options (2) and (3) involve giving the signalt, from one EFAS preference over the signals from the other EFAS.
If the control grade EFAS signals were preferred, however, this would be equivalent to replacing the safety grade EFAS with a control grade system.
Giving the signals from the safety grade EFAS preference would defeat the purpose of installing the control grade EFAS.
Thus, neither of these options is acceptable.
l The fourth option involves implementing logic to differentiate between valid and faulty EFAS signals.
If this logic were in a control grade system, it would allow the action of a control grade system to override the safety grade EFAS, which would not be acceptable.
A safety grade system that would validate signals from the existing and supplemental FFASs would have to monitor steam generator level to identify when steam generator inventory was insufficient, and use steam generator differential pressure to l
differentiate between a ruptured and fntact steam generator.
This signal validation system would have to be as reliable as the existing EFAS, because it would be capable of overriding the existing system.
Hence, it would have to consist of at least threa, and preferably four channels.
Thus the signal validation system would have to be a complex safety grade system that duplicates most of the capabilities of the existing EFAS.
As such, it would be as costly as the new, independent, and diverse f
EFAS which is discussed in Subsection 2.2.
Subsection 2.2.4 i
demonstrates that the VIR of such a system is much less than one, indicating that its installation wouid not serve the underlying purpose of 10CFRSO.62 to reduce the ATVS risk in a cost effective r
manner.
In addition, a plant with two systems (one safety grade
[
and one control grade) that serve identical functions, and a third l
system designed to validate the signals from the other two i
systems, might t,e susceptible to systems interactions that are difficult to analyze and potentially detrimental to plant safety.
[
Thus, the insta11atic,n of a control grade EFAS to supplement the i
i existing EFAS would impose competing risks, and as such, the fourth option is not justified.
27 r
~, - - -. _ - -..,
2.4.2 Installing a Redundant Safety G*ade EFAS To prevent a signal from the existing four channel Class IE EFAS being overridden by a signal from a less reliable system, any EFAS that supplements the existing EFAS would have to be a Class 1E system with four or more channels.
Thus, the new system would be as expensive as the tr/.tl1y new. independent, and diverse EFAS discussed above in i u o Subsection 2.2.
As was discussed in Subsection 2.2.4, Cia VIR of such a system is much less than 1, indicating that 5ts installation would not serve the underlying purpose of 10CFRSO.62 to reduce the ATWS risk in a cost effective manner.
In addition, installation of a second safety grade EFAS would impose umpeting risks.
If a second Class 1E EFAS were installed, it would be controlling the same hardware (i.e., pumps and valves) as the existing EFAS.
This gives rise to tne question, "How should the signals from the two systems be integrated on the hardware level?"
An underlying assumption of the ATWS Rule is that a common mode j
failure disabling a redundant safety grade system is a credible eve n t,.
Suppose one of the EFAS correctly ident)fied a steam generator as being intact and in need of EFW as indicated by a low level condition.
It would send signals to a set of valves to open and thereby provide a EFW flow path to the steam generator.
Due to a common mode failurn, however, the other EFAS identified the same steam generator as ruptured and therefore sent contradictory signals to tho same valves to close and block EFW flow to that i
If the signals from both systems received equal i
preference, there would be no assurance of the valves actually opening as they should.
If the signal from the existing EFAS were given preference, this would defeat the purpose of installing the second EFAS.
If signals from the new EFAS were given preference.
then there would be no point in retaining the existing system.
28 1
Thus, based on considerations of competing risks and VIR, installation of a new, redundant EFAS that is diverse a independent of the e.: sting EFAS is not justified.
29
r,
,.,e' O
l
^
2.5 REFERENCES
FOR SECTION 2 2.5.1 SECY-83-293, "Amendments to 10CFR50 Related to Anticipated Transients Without Scram (ATWS) Events, July 19, 1983, 1
2.5.2 EPRI NP-2230, "ATWS:
A Reappraisal:
Part 3:
Frequency of Anticipated Transients", January, 1982.
i b
r k-l 30
TABLE 2-1 IMPACT (C0ST) TO IMPLEMENT NEW SAFETY GRADE DIVERSE EFAS a
COST t
i i
RACEWAY (CONDUIT AH9 CABLE) INSTALLATION
$ 200,000 i
HARDWARE AND INSTALLATION 2,125,000 i
SNGINEERING AND HOME OFFICE 325,000 l
t l
CONSTRUCTION AND COST OF CAPITAL 325,000 e
ESCALATION TO IN-SERVICE DOLLARS 225,000
(
i
[
TOTAL CAPITAL COST (IN SERVICE DOLLARS)
$3,200,000 1
i I
I I
i
?
31 t
Figure 2-1 ANO 2 EFAS Logic Diagram Patss Patse Levat ETAS LOGIC Pats 6 Pats:
Ltytt so.e sca so.: tav so. Low so.: ss.:
so.: Low so. Low
[41Slg gj
[a
[AitlCl0 W ttSTA6LES~
4 JCJ (AlB[C
[AitlCiDj k
Ts I
If IF Is If l
l t/4 CothCtDthCE LOC 6C l
l l
l t /4 C0lhCIDENCE LO4tC l l
idANUAL MANUAL MANUAL MAleUAL e84t h0TE 3 TO A JrAlaar '. !! -
I TO AUYlltaaf ht L ar CAlut.t f
'im
%~
- g*
.4%
PPS CABINtf
.+%,!a htL Af,Cabiht ?
{
6"
- g. g A i3A,.sti4A AullLI ARY AELAf CAbrNET *A" 3 tA stey esa WANUAL
'5fLICTivt 2/4 l
[$tLICTtyt2/4l WANUAL A ET I
~~
ang gp, ng CouPot4f Mi CON f hot, kg CINCUlil 4.
Auto
- sto, WTO
' START em,
yt,,
opt e, etosc t+)
I s4*l EWE ACENCY Ff tDeaf tR teetRetteCY Fttow&TER 90 3 tut 4c(NCY Ftt0waf ER VALV E (ll'A' PutfP *a*
VALYtt$)"A*
($tt leOf t 1)
(Sit leOft al (Set leQTE 1)
.d% (p ourent 4t44 (t) J closes is ourrNT L.evv g'-)
- 2..
$1-ARM 4 A c urah4 T St M (+) j S To P4 s p o u r(N T L e w (-)
3.
M ANJ AL, ALTu44 ica41 GR84 R h'M L ' '*PS 8 "
8 *9 's N W '" '"
6 32
Q Figure 2-4 Integration of a New, Separate, Diverse, and Independent EFAS and MSIS with the Existing PPS
- m. 8
- 6. l
%.8
- h. l G
t.
teitii g m si n.
Emiest
'4ttstf 48 IJ 1 gg o
9 4 ;L
(*'**
o
- g ;
we t r,. i w4 we 54 1 ts.
u.
a,. i s:.,
is.i su tre su su ss ss v.
essi sw.
ents *wis setts sis::
it.
ss.:
a,tt u.o i
l e.g t s em:
I r
r
- f. 4
- 2. 4
- fa te s ti e 2/4 g
i as t :.;..
, a.x. m yi..
ra, m
~,
t a.i t ti.g stias.,
a.
ii.,, n i le4 s as ta (freie a 6 frei. la taste astsaie e alttiaal st?. aft:a 6xit l
9 9
f Ois
__ teu e tes> 9 t
f a 6ei.ete[me++ea46 ~
[
r,... a,,...
7 b
b t
t l
33 I
3.0 DIVERSE SCRAM SYSTEM 3.1 OVERVIEW The Commission analysis of the ATWS risk reduction due to the plant modifications associated with the installation of a DSS assumed a decrease in the RPS Electrical component of the risk
-5
-6 analysis from 2.0 x 10 to 2.0 x 10 This analysis assumed a 05S availability of 90%.
The proposed 055 designs are expected to exceed this availability goal.
Therefore, the DSS designs which will be ;mplemented will result in a greater decrease in ATWS risk th>J that which was considered by the Commission.
i This Section will discuss the design detail of the Diverse Scram l
System under consideration by AP&L.
The discussion will concentrate on the aspects of the proposed DSS designs which l
conform to or exceed the requirements of the ATWS Rule and i
Commission guidance for complying with the ATWS Rule.
i 3.2 ARKANSAS NUCLEAR ONE UNIT 2 3.2.1
@eneral Description AP&L intends to implement the ANO 2 DSS design as a control grade f
system by using new pressurizer pressure transmitters on existing l
taps to provide signals to the DSS in a two-out-of-four trip
\\
logic.
The components for the 055 actuation logic and means of i
interrupting power to the CEDMCS will be diverse from the existing RPS.
[
While a two channel system is adequate to meet the requirements of
[
10CFRSO.62. AP&L has elected to install a four channel system in ordcar to:
l I
I l
i 34
[
., ~ - - - - - - - -. - - - - - - - - --
Enhance the reliability of overall plant operation, Reduce the potential for spurious trips, Reduce the potential for errors during operational testing.
o Improve and simplify the interface with other 4-channel systems.
The 055 design will use high pressurizer pressure as the parameter indicative of an ATWS.
The trip setpoint will be greater than the RPS High Pressurizer Pressure Trip Setpoint (HPPTS) and less than the Primary Safety Valve (PSV) set pressure which is given in the Technical Specifications.
The 055 HPPTS is greater than the existing RCP HPPTS permitted by the Technical Specification in order to avoid unnecessary reactor scrams.
The 05S HPPTS is less than the minimum PSV set pressure permitted by the Technical Specifications in order to prevent a delay in the jeneration of a trip signal caused by the opening of the PSVs.
The ATWS/ DSS Main Signal Path consists of four measurement i
channels, four two-out-of-four logics and two trip paths.
Each measurement channel consists of a pressure transmitter sensor, a signal conditioner, and an alarm block and a timer block which ate part of the configured function block of a Foxboro Spec. 200 Micro control module.
Each of the four two-out-of-four logics, which is also a configured function block of the Foxboro Spec. 200 Micro Module, activates one of the tro trip paths to open an M-G set output l
This occurs when any two of the four inputs from the four measurema.it channels reach the high-high pressurizer pressure f
setpoint simultaneously. Activation of channel 1 and/or 3 of the two-out-of-four logic energizes the trip path #1 relay which cpens the M-G Set #1 output contactor, while activation of channel 2 I
and/or 4 of the two-out-of-four logic energizes the trip path #2 relay to open the M-G Set #2 output contactor.
t
I Opening of the M-G Set #1 and #2 output contactors interrupts the three phase power to the CEDMCS and trips the reactor.
Activation of both trip paths is required to initiate a reactor trip.
Once j
the trip is actuated, it is sealed until manually reset at the DSS
- panel, k
In summary, the 055 for ANO 2 was designed to be a highly reliable system which meets or exceeds the requirements of 10CFR50.62.
It provides the ATWS prevention features in terms of providing an alternate trip function on conditions which are indicative of an ATWS and minimizes the potential for common cause failure of the trip function by satisfying the diversity and independence requirements prescribed by the ATWS rule.
3.2.2 Conformance to Commission Guidance
~
Supplementary information (49FR26043, 26044) is provided with the Federal Register notification of the ATWS rule.
This supplementary information includes Commission guidance concerning
[
the degree of diversity from the RTS which is required of the DSS j
and mitigating systems. The guWnca statas that equipment diversity to minimize the potential for CHF is required from the I
sensor output to and including the components used to interrupt
(
control rod power for the DSS.
Therefore, all DSS instrument channel components (excluding sensors and signal conditioning equipment upstream of the bistables) and logic channel components, l
and all DSS actuation devices must be diverse from the RTS in accordance with the published guidance.
This includes i
establishing electrical independence from the existing RTS. The areas of guidance are as follows:
j i
1)
Safety Related (IEEE-279) i 4
2)
Redundancy c
3)
Diversity from the RTS 4)
Electrical Independence from the existing RTS l
[
[
36 i
i i
5)
Physical Separation from the existing RTS 6)
Environmental Qualification 7)
Seismic Qualification 8)
Quality Assurance for Test, Maintenance, and Surveillance 9)
Safety Related (IE) Power Supply
- 10) Testability at Power
- 11) Inadvertent Actuation In these areas the Commission establishes the criteria for such things as diversity, testability, etc. for a DSS design that they feel will comply with 10CFR50.62.
Though not formally required, these guidelines are integrated into the design for the ANO 2 DSS design as discussed below.
3.2.2.1 Safety Related Commission -
Not required but the implementation must be such that the existing protection system continues to meet all applicable safety related criteria.
The OSS is a control grade system which utilizes safety related isolation.
All existing FSAR design criteria for associated cir-cults will be maintained as well as the reliability level for a two-out-of-four (with channel bypass) trip logic.
3.2.2.2 Redundancy Commission -
Not Required Redundancy alone does not preclude CMF occurrences.
Consequently, no requirements are made on redundancy of the DSS.
The design, however, is to be reliable, and should minimize the possibility for spurious action.
AP&L has elected to install a four channel system to enhance the reliability of the overall plant operatioa by reducing the potential for spurious trips and reducirg the 37
O potential for errors during operational testing.
The potential of spurious trips is further reduced in the ANO 2 DSS design by:
The introduction of a timer circuit in the trip logic to filter out short duration transients, The use of energize to trip circuits to exclude the activation of a trip by component failures.
3.2.2.3 Diversity From the Existing Reactor Trip System j
Commission -
Equipment diversity to the extent reasonable and practicable to minimize the potential for common cause failures is required from the sensors to and including the components used to interrupt I
control rod power.
Circuit breakers from different manufacturers alone is not sufficient to provide the required diversity for the interruption of j
control rod power.
The sensors need not be of a diverse design or manufacturer. Existing protection l
system instrument-sensing lines inay be used.
l Sensors and instrument-sensing lines should be selected such that adverse intera:tions with l
existing control systems are prevented.
[
In the guidance the Commission provides details on how component diversity can be achieved.
It states that diversity can be achieved by incorporating as many of the following methods as possible.
Among these methods are:
Use of components from different manufacturers Use of electro-mechanical devices versus electronic devices Use of energize versus deenergize-to-actuate trip status Use of AC versus DC power sources 38
The fr.. lowing subsections provide a discussion of the diversity between the existing RTS and the DSS on a component by component basis.
3.2.2.3.1 Sensors Although not required by the ATWS rule, the ANO 2 DSS design will employ four capacitance detection pressure transmitters to provide signals to the four 055 channel inputs.
The sensing lines of these transmitters are connected to the existing pressure sensing lines through instrument valves and share instrument lines with an existing RPS pressure transmitter.
The DSS transmitters are separate from the existing RPS pressure transmitters in that the OSS transmitters circuits are completely independent of existing RPS instrument loops.
Additionally the 055 transmitters are qualified for Class 1E application and are Quality Class II and Seismic Category I in design.
The sensor design which is to be used in the ANO 2 DSS is separate and independent from the existing RPS sensors and therefore, exceeds the requirements of 10CFR50.62.
3.2.2.3.2 Bistables and Bistable Relays The ANO 2 DSS design does not specifically use bistable or bistable relay components in its design.
The DSS trip path, following the sensor output, is a foxboro Spec 200 Micro Control Module.
The Foxboro Spec 200 Micro Control Module is a computer based control device which is configured to perform the following functions.
Compares the input signal with the Alarm Block setpoint to generate a local state 1 output to activate the timer, 39
Timer Block Receives input from the alarm block and generates a local state 1 output if the logic state 1 status persists for a period of 200 msec, q
Bistable Block -
Provides channel trip status to indicating lights and to the Critical Function Monitoring System (CFMS) through the multiplexer when the timer block output changes to logic state 1, 2-out-of-4 Logic - heceives input from the timer output of each channel and generates a logic state 1 output when any two out of the four inputs are state 1.
The ATWS DSS receives power from two separate ANO 2 non-1E instrument AC power panels.
The logic power is supplied by four Foxboro power supplies each of which is modified for parallel operation with the diodes for reverse voltage protection.
The supplies are also modified to allow voltage monitoring prior to the diodes.
The logic power supplies for channels 1 and 2 operate in parallel and the logic power supplies for channels 3 and 4 operate in parallel.
Dual power supplies supply power to the multiplexer.
This power supply is manufactured by Computer Products,Inc.(CPI) Both of these power supplies have internally installed diodes and redundancy such that the output is parallel and diode shared.
In addition, these power supplies have provisions for voltage monitoring prior to the diodes. A second dual i 15 VDC power supply provides contact sense power to the CPI contact input cards.
The RPS and CPCs utilize Power Mate 12 VDC power supplies which take power from the AC Vital Bus.
40
Given this configuration of the DSS Control Module, it is concluded that total diversity exists between the existing RPS bistable and and bistable relay components, and the DSS.
Diversity exists in design principle, manufacturer and power I
supply.
i 3.2.2.3.3 Actuatien Device i
The final components of the DSS are four Foxboro Model N-2AO-L2C-R trip contactor output relay modules and M-G set trip relays 14CR
(
which are powered by the non-1E instrument AC power panels. 'The l
l M-G set power will be removed directly by operating a contactor
~
through the contactor holding coi1 control circuit with the M-G set L
trip relays.
The parallel device for the RTS is not a relay but l
rather a mechanical circuit breaker powered by an IE vital bus.
Therefore, diversity is well established between these *omponents.
I l
i l
3.2.2.4 Electrical Independence From the Existing Reactor Trip System l
l i
Commission -
Required from rensor output to the final actuation device at which point non-safety related circuits must be isolated from safety related
[
t circuits.
i l
The safety related sensors in the existing RTS will be isolated from the DSS using qualified isolators.
All other DSS logic.
}
actuation devices, etc. will be powered from a non-1E instrument AC f
power panel independent from the Class IE PPS power.
3.2.1.5 Physical Separation From the Existing Reactor Trip System Commission -
Not required, unless redundant divisions and channels in the existing reactor trip system are not physically separated.
The implementation must be such that separation criteria applied to the existing protection system are not violated.
41
o L
f r
i Although not required, physical separation from the existing RTS is provided for the 05S.
Separate cabinets will house the electronics associated with the 055.
This equipment will be located in the CEDMCS equipment room.
This crea was selected
[
because it was outside the control room, it hs& air conditioning, it was close to the M-G sets and close to the penetration area,-
l and it is a separate security zone that would reduce the possibility for tampering, i
f 3.2.2.6 Environmental Qualification f
Commission-For anticipated operational occurrences only, i
not for accidents.
I E
Equipment will be rated for the environment for which it will be installed.
I
[
3.2.2.7 Seismic Qualification l
l Commission -
Not required.
l Although the Commission's equipment qualification guidance states j
that the 055 does not require seismic qualification, the DSS will be l
Seismic Category II and the pressure transmitters will be Seismic
(
Category I design, if final evaluations support these needs, f
3.2.2.8 Quality Assurance for Test, Maintenance, and Surveillance Commission -
The Commission has released a generic letter j
(85-06, April 16, 1986) in which is provided th9
(
explicit Quality Assurance (QA) guidance required i
i 42
by 10CFR50.62. While Appendix B is viewed as a useful reference in which to frame the Commission's guidance for non-safety related ATWS equipment, it does not meet the intent of the ATWS QA program.
The equipment encompassed by 10CFR50.62 is not j
required to be safety related; therefore, less stringent QA guidance is acceptable.
This letter incorporates a lesser degree of stringency by
[
eliminating requirements for involving parties outside the normal line organization and l
requirements for a formalized program and detailed.
record keeping for all quality practices.
l Testing of the DSS will be performed prior to installation and operation when appropriate to demonstrate that the non-safety ATVS equipment conforms to its design specifications.
Additionally, f
the ATWS equipment will be periodically tested to ensure that the i
surveillance requirements are satisfied (as per 3.2.3.2 and 1
3.2.3.3).- The measuring and test equipment which will be used to
[
determine the acceptability of work or process status will be i
controlled and calibrated or adjusted at specific intervals in accordance with reviewed and approved procedures.
Although the above program is sufficient to support the
[
reliability of the 055, consideration was given to inclusion of the DSS test requirement in the ANO 2 Technical Specifications.
On February 6, 1987, the Commission published in the Federal f
Register (Voluce 52, Number 25. Page 3788), an interim statement on the proposed Policy Statement on Technical Specification
(
Improvements for Nuclear Power Reactors.
In this statement the Commission states that the Technical Specifications are to address only the structures, systems, and components required to function j
or actuate during an accident or transient as described in Chapter 15 of the FSAR. The DSS clearly is not credited in the accident I
analysis and therefore, can not be considered as part of the f
l primary success path.
As such, the incorporation of a DSS testing
[
i 43
requirement into the ANO 2 Technical Specifications would be in direct contradiction to the Commission's Technical Specification Improvement Program, and, therefore, is not considered.
3.2.2.9 Safety Related Power Supply Commission -
Not required, but must be capable of performing safety functions with loss of offsite power. Logic power must be from an instrument power supply independent from the power supplies for the existing reactor trip system.
Existing RTS sensor and instrument channel power supplies may be used provided the possibility of common mode failure is prevented.
Power to the DSS is from 2 channels of instrument AC power sources with internal batteries capable of operating the system in excess of 15 minutes.
At ANO 2, instrument AC power is emergency diesel generator backed power that is totally separate and independent from the vital AC power source (4 channel) used for the existing Reactor Trip System.
The Control Rod Drive System M-G set power will be used to actuate the final device; if CRDH power is available (to hold rods), it will also be available to trip using the DSS final device, 3.2.2.10 Testability at Power Commission -
Required AP&L has made provisions in the design of the DSS to permit periodic testing of DSS equipment. On-line testing will be provided to allow functional testing of one selected channel at a time.
Testing of the 2/4 logic matrix and final trip actuation will be done during plant shutdown or prior to startup.
44
3.2.2.11 Inadvertent Actuation P
Commission-The design should be such that the frequency of inadvertent reactor trip and challen;;es to other safety systems is minimized.
l AP&L will employ a DSS that includes the use of four channels operating on a two-out-of-four logic, reliable power supplies, and f
testing to support a satisfactory level of quality assurance fea-
[
tures. In addition to the logic design, the DSS also incorporates a timer block which will further reduce the possibility of inadvertent actuation.
t These design features are considered by AP&L to be sufficient to I
minimize the frequency of inadvertent actuation and challenges to I
other safety systems.
i 3.2.3 Reliability Assurance, Maintenance and Surveillance 3,2.3.1 Reliability Assurance Program f
i The ANO 2 DSS has been designed to be a reliable system.
The l
combination of the Maintenance and Surveillance Programs outlined r
in the following sections ensure that the system will be reliable l
and perform the preventive function for which it was designed, i
3.2.3.2 Maintenance Program I
l The DSS has been designed so that it can be tested on-line.
The t
on-line tests which will be perfortaed include periodic calibration L
and functional testing.
This maintenance program will become part of the Station's surveillance program.
l 3.2.3.3 Surveillance Program 45
The DSS is not covered by the Technical Specifications.
- However, a surveillance program will be established by the Station to test the DSS to ensure its operability.
Although a formal surveillance program has not yet been established, it is anticipated that the following test program will be installed:
Daily Channel Check Monthly Functional Test Calibration at Refueling Intervals 3.2.4 Conclusion i
The ANO 2 DSS design is highly reliable.
It has a very high level of diversity and is completely separate from and independent of the the RTS. Additionally, although not required by 10CFR50.62, the ANO 2 DSS design exceeds the ATWS rule requirements and 4
guidance in that it incorporates four new diverse pressure transmitters to further increase the level of diversity of the DSS and further reduce the potential for cocoon mode failure.
Using the Commission's methodology and accounting for the effects of uncertainties, it'has been demonstrated that the DSS with its diverse TT accounts for 98% of the ATWS risk reduction that could be obtained by installing all three systems required by the ATVS rule. Therefore, the installation of the DSS alone satisfies the i
underlying pu pose of 10CFR50.62 to reduce the ATWS risk in a cost effective manner.
46
a.
4.0 DIVERSITY OF THE EXISTING EFAS FROM THE DSS 4.1 OVERVIEW This section will provide a component by component comparison of the existing EFAS and the DSS design.
Reference will be made to the details of the DSS component design which were presented in Section 3 of this report.
4.2 ARKANSAS NUCLEAR ONE, UNIT 2 As was previously described in Section 3.2.1 of this report, AP&L intends to implement a control grade DSS for ANO 2.
The 055 will utilize four new pressurizer pressure transmitters to provide signals to the DSS in a two out of four trip logic.
This sectien will describe the diversity between the 055 and the existing EFAS components.
4.2.1 Sensors The first components in the EFAS circuitry are the sensors, The steam generator level sensors which are used by the EFAS are forced balanced transducers manufactured by Foxboro, while the 055 employs four capacitance detection transmitters whit.h are manufactured by Rosemount.
The sensor design which is to be utilized in the ANO 2 055 is, therefore, diverse from the EFAS sensors.
Since 10CFR50.62 does not require diversity in the sensors, the proposed 055 design exceeds the requirements of 10CFR50.62 with regard to diversity between the 055 and the EFAS.
4.2.2 81 stables and Bistable Relays The next components in the circuitry are the bistables and bistable relays.
The bistables used by the EFAS are analog devices manufactured by E-M.
The DSS does not specifically use bistable or bistable relay components in its design.
As was 47
l l
I described in detail in Section 3.2.2.3.2, the DSS trip path following the sensor output is a Foxboro Spec 200 Micro Control Module.
The Foxboro Spec 200 Micro Control Module is a computer based control device which is configured to alarm, pressure switch, timing, bistable switching functions, and logic functions.
l Given this configuration of the 055 Control Module, it is concluded that total diversity exists between the existing ETAS bistable and bistable relay components and the DSS.
l l
4.2.3 Actuation Devices The final components are the actuation devices.
The actuation devices used by the EFAS are electro-mechanical rotary relays with multiple contacts manufactured by Potter-Brumfield.
The EFAS actuation devices are deenergize-to-trip status devices.
The DSS l
utilizes four Foxboro Model N-2A0-L2C-R trip contactor output l
relay mo: tules and Model 14CR M-G set trip relays. Additionally l
there are differentes in power supply; the DSS actuation devices are powered from the non-1E instrument AC power panels while the EFAS is powered by an IE vital bus.
4.2.4 Conclusions 1
The existing EFAS is totally diverse and separate from and independent of the DSS.
This provides a very high degree of 1
protection against a comon mode failure that causes a failure of i
the reactor to scram and the emergency feedwater to actuate following an anticipated transient. As such, installation of the DSS with its diverse TT achieves the underlying purpose of 10CFR50.62 to reduce the ATWS risk in a cost effective manner.
l l
l 48 L
5.0 DIVERSE TURBINE TRIP The implementation of a 055 provides a diverse Turbine Trip (TT).
Tho OSS will trip the reactor under conditions indicative of an ATWS.
When the 055 causes a reactor scram, it also causes the turbine to trip because the 055 interrupts power to the Control Element Assembly (CEA) coils upstream of the rod power bus undervoltage relays in the Control Element Drive Mechanism Control System (CEDMCS).
These relays actuate the turbine trip circuitry.
If a OSS is implemented, the existing TT becomes a diverse TT due to the diversity between the 05S and the existing RTS.
The dependence of the diverse TT upon OSS actuation means that the operating status of the 055 will reflect the operating status of the DTT, as well. Therefore the control room annunciators and other ATWS displays will similarly relay the information of the diverse TT status.
Thus, installation of the DSS will satisfy the 10CFR50.62 requirement that the plant will have equipment diverse from the RTS to automatically trip the turbine under conditions indicative of an ATWS.
This is accomplished because the circuitry required to satisfy the component diversity requirements for a diverse reactor scram is essentially the same as for the DTT.
Therefore, given the installation of a 055, adequate diversity exists between the DTT and the RTS for compliance with 10CFR50.62.
l l
l
(
49 l
t
o a-6.0
SUMMARY
AND CONCLUSIONS 6.1 SUPMARY 6.1.1 Purpose of 10CFR50.62 10CFR50.62 requires that ANO 2 have the following systems to supplement the existing RTS:
Diverse Scram System independent from the existing RTS.
Emergency Feedwater Actuation System diverse from the RTS.
Turbine Trip diverse from the RTS.
4 Based on the Statement of Considerations for the Rule and statements of the Comission in SECY-83-293, the underlying purpose of 10CFR50.62 is to reduce the probability of a severe ATWS event in a cost effective manner by reducing the probability of common mode failures in the reactor trip system, turbine trip system, and emergency feedwater actuation system.
6.1.2 Commission's Interpretation of the ATWS Rule Reports previously submitted to the Commission have demonstrated that all of the components in the existing EFAS at ANO 2 except for the bistable relays and matrix relays are diverse from their components in the RTS.
The design of the EFAS and RT'i, however, provides considerable protection against common mode failures of the bistable relays or matrix relays disabling both systems.
Similarly, although the EFAS power supplies are not independent, their design is such that it would require the simultaneous occurrence of two difference types of common mode failures (an overvoltage condition and failure of the overvoltage protection) 50
affectinglargenumbersofthesepowersuppliestopreventa reactor trip and the delivery of EFW to the steam generators.
l The Commission has completed its review of the submittal.
The j
Commission has stated that ANO 2 does not presently satisfy the ATWS rule requirement for EFAS diversity because the bistable
[
relays and matrix relays in the EFAS are identical to their counterparts in the RTS.
In addition, the power supplies in the EFAS and RTS are not independent.
t Based on this, AP&L concludes that the Commission interprets the f
ATVS rule to require complete diversity of all EFAS components i
from their counterparts in the EFAS and complete independence of EFAS power supplies, f
I 6.1.3 Why is it not Reasonable or Practicable to Comply with the
[
Commission's Interpretation of the ATWS Rule l
It is not reasonable or practicable to comply with the Commission's interpretation of the ATWS rule requirement for a I
system diverse and independent from the RTS to actuate emergency i
feedwater under conditions indicative of an ATWS.
There are l
potentially three ways to comply with the Commission's interpretation.
(1) Replacfng the existing EFAS with a totally new, independent.
I and diverte EFAS would cost $3,200,000.
This would not be
[
cost beneficial, as it would provide an incremental reduction N
of the ATWS risk of 9 x IO severe ATVS event per reactor year, with a value of $270,000 per rec-tor year.
i (2) Replacing the existing EFAS bistable and matrix relays with diverse counterparts and make the exiting EFAS power supplies indepr.ndent of the RTS power supplies has been reviewed by the NS$5 vendor and has been deemed not to be a viable alternative for compliance with the ATWS rule.
This is due 51
,e e
to complexity of the wiring changes required and the potential for human error in the maintenance of the new equipment.
For each reactor, the cost to install diverse replacement bistable and matrix relays and irdependent EFAS power suppites has been conservatively estimated at one quarter of the cost for installing a new EFAS system.
This includes the costs of the qualification and installation, and maintenance of the replacement components.
The incremental reduction in ATWS risk assorfated with these
~7 changes would be 9 x 10 severe ATWS even'. per reactor year, with an estimated value of $270,000 over the remaining life of the plant.
Based on this conservative estimate of the cost of providing diversity within the PPS cabinet, and considering the criteria used by the Commission in their discounting of other hardware modifications to reduce the risk of ATWS, obtaining the required diversity within the PPS cabinet is not considered cost beneficial in reducing the incremental risk of an ATWS.
(3) Installing a new system (in addition to the existing ERAS) to initiate EFW under conditions (qdicative of an ATVS would also not be a cost beneficial way of reducing the ATVS risk.
The ETAS is a four channel Class IE system that includes logic which initiates EFW following a steam generator low level condition, identifies a steam generator as being ruptured based on the pressures in the steam generators and locks out EFW to a ruptured steam generator.
The conditions that are indicative of an ATWS (i.e., high pressurizer pressure, SGLL, and high pressurizer level) can also be indicative of some secondary system pipe breaks.
To assure that a signal from the existing Class 1E EFAS was not over ridden by a contradictory signal from a control grade system, the supplemental EFAS would also have to be a four channel Class IE system.
Thus, the supplemental system would cost
$3.200,000, the same as the totally new, independent, and diverse FAS.
Again, this would not be cost beneficial.
l 52 t
o Thus, none of the potential ways to comply with the Commission's interpretation of the AfWS rule would serve the underlying purpose of 10CFR50.62 to reduce the ATWS ris4 in a cost effective manner.
Virtually all of the ATWS risk reduction that could be obtained by compliance is obtained by installing the DS$ with an inherently dtverse TT.
This has been demonstrated using the methodology and assumptions of the Commission's own regulatory analysis.
Additionally, the effect of uncertainties were fact.ored into the analysis.
6.1.4 Diverse Scram System The DSS design that will be installed at ANO 2 will be an extremely reliable preventive system.
The DSS reliability assurance, maintenance, and surveillance prJgrams will enhance the DSS reliability over the life of the plant.
6.1. 5 Diversity of the Existino EFAS from the DSS The EFAS diversity and independence from the 05S will provide protection against a cc-men mode failure that prevents the reactor from tripping and the EFW from actuating under conditions indicative of an ATWS.
6.1. 6 Diverse Turbine Trip Due to the nature of the existing turbine trip circuitry, the 055 will provide an inherently diverse TT function.
This will be diverse and independent f*om the RTS and will trip the turbine under conditions indicative of an ATVS, 53
6.2 EXEMPTION REQUEST AP&L proposes to implement a DSS with its inherently diverse TT.
l The 055 will be independent from the existing RTS.
Additionally, the EFAS is diverse from and independent of the 055.
The proposed l
course of action presents no risk to public health and safety l
since the plant modifications proposed to satisfy the Commission's l
interpret 2 tion of 10CFR50.62 all have a value/ impact ratio l
substantially less than 1.0 and further plant hardware modifications provide an insignificant reduction in the ATWS risk.
i As provided for by 10CFR50.12, AP&L hereby requests that the Commission grant an exemption for ANO 2 from the requirements of 10CFR50.62 for equipment diverse from the RTS to initiate the I
emergency feedwater system under conditions indicative of an ATWS.
l l
l l
l i
i l
i r
54
.