ML20206H865

Forwards Request for Addl Info Re Util 851009 & 880928 Responses to 10CFR50.62,ATWS Rule.Response Requested within 90 Days of Ltr Date.Understands That Util Will Proceed W/ Implementation of ATWS Mods & Complete Mod by Next Outage

ML20206H865
Person / Time
Site:	Crystal River
Issue date:	11/18/1988
From:	Silver H Office of Nuclear Reactor Regulation
To:	Wilgus W FLORIDA POWER CORP.
References
TAC-59085, NUDOCS 8811230403
Download: ML20206H865 (11)

Text

'g .

o

\

y 0,, UNITED STATES I($"%eg NUCLEAR REGULATORY COMMISSION WASHINGTON, D C. 20555 5 j 8 November 18, 1988 k . . . . ,e

+

Docket No. 50-302 Mr. W. S. Wilgus Vice President, Nuclear Operations Florida Power Corporation ATTN: Manager, Nuclear Licensing P. O. Box 219 Crystal River, Florida 32629

SUBJECT:

CRYSTAL RIVER UNIT 3 - 10 CFR 50.62 (ATWS RULE) CONCEPTUAL DESIGN REVIEW AND REQUEST FOR INFORMATION (TAC NO. 59085)

The ATWS Rule (10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram [ATWS] Events for Light-Water-Cooled Nuclear Power Plants") requires improvements in the design and operation of commercial nuclear power facilities to reduce the likelihood of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.

The requirements for Babcock & Wilcox (B&W) plants, such as Crystal River Unit 3 (CR-3), are to provide a diverse scram system (DSS) and diverse ATWS Mitigation System Actuation Circuitry (AMSAC). Paragraph (c)(6) of the Rule requires that information sufficient to demonstrate compliance with these requirements be submitted to the Office of Nuclear Reactor Regulation (NRR).

By letter to you dated June 30, 1988, the staff requested that within 90 days you address the design requirements in that letter and in the generic Safety Evaluation enclosed therewith, and that you proceed immediately with implementa-tion of ATWS modifications at CR-3. The staff's letter of September 7,1988, to L. C. Stalter summarized the meeting with the B&W ATWS Owners Group on August 17, 1988. It noted that the staff would review each plant-specific conceptual design package, and subsequently would prepare a Safety Evaluation upon receipt of a more detailed design package. Issuance of the Safety Evaluation would not necessarily precede implementation of ATWS modifications. The Septenter 7,1988 letter also stated that after receipt of approval of the conceptual design, each plant should install the ATWS equipment during its next refueling outage. Your submittal of September 28, 1988, constituted the conceptual design package.

Based on our review of your October 9,1985 and September 28, 1988 submittals, and on subsequent clarifying discussions, additional information, as discussed in the enclosed "Request for %dditional Information," is required to allow us to determine full compliance with the Commission's regulations, g p m%: 4 P

W. S. Wilgus November 18, 1988 The principal remaining concern is that feeding AMSAC signals into the Emer-gency Feedwater Initiation and Control (EFIC) system may not satisfy the requirements of 10 CFR 50.62 and may alter the design basis of the EFIC system.

During the meeting scheduled for November 29, 1988 we hope to clarify this and other matters through a discussion of the details of your proposed design, the function of EFIC, its interfaces with AMSAC and the reactor trip system, and to the extent possible the remaining additional information requested in the enclosure.

Our review did not encompass all interfaces of the required ATWS equipment with other plant systems to assure that the original design is not compromised. As part of your efforts on ATWS. you should perform such a review in accordance with the requirements of 10 CFR 50.59.

Subject to resolution of our concerns in the near future, it is our understanding that you will proceed with implementation of the ATWS redifications and complete them at the next refueling outage in 1989 in accordance with 10 CFR 50.62. We request that the final design package for DSS and AMSAC, including the requested additional information, be submitted to tha flRC staff within 90 days of the date of this letter.

The reporting and/or recordkeeping requirements contained in this letter affect

! fewer than 10 respondents; therefore, OMB clearance is not required under P.L.96-511.

Sincerely, Original signed by ETourigny for Harley Silver, Project Manager Project Directorate 11-2 Division of Reactor Projects-I/II Office of fluclear Reactor Regulation

Enclosure:

As stated cc w/ enclosure:

See next page DISTRIBUTI0ft 4

pocket ttle- HSilver NRC & Local PDRs OGC (for info only)

PDII-2 Rdg. EJordan, 3302 Mf:BB SVarga, 14/E/4 BGrines,9/A/2 Glaines,14/H/3 ACRS(10)

DMiller AThadani, 7/E/4 GHolahan,13/E/4 HBerkow

[ TAC HO. 59085/LTR.]

• See previous concurrence I LA:PDII-2* PH:PDII-2* D:PDII-2* SAD /r (A J pS W-DHiller HSilver:bd HBerkow GHo a ori 1

j 11/17/88 11/17/88 11/17/88 /Mffdah'i 11/ /188 11////88 A

4 GUa as 11/ /88

Mr. W. S. Wilgus Crystal River Unit No. 3 thclear Florida Power Corporation Generating Plant cc:

Mr. R. W. Neiser State Planning and Development Senior Vice President Clearinghouse and General Counsel Office of Planning and Budget Florida Power Corporation Executive Office of the Governor '

P. O. Box 14042 The Capitol Building St. Petersburg, Florida 33733 Tallahassee, Florida 32301 ftr. P. F. McKee Mr. F. Alex Griffin, Chairman Director, Nuclear Plant Operations Board of County Comissioners Florida Power Corporation Citrus County P. O. Box 219 110 North Apopka Avenue Crystal River, Florida 32629 Inverness, Florida 36250 Mr. Robert B. Borsum Mr. E. C. Simpson Babcock & Wilcox Director, Nuclear Site Nuclear Power Generation Division Florida Power Corporation Support 1700 Rockville Pike, Suite 525 P.O. Box 219 Rockville, Maryland 20852 Crystal River, Florida 32629 Resident Inspector ,

U.S. Nuclear Regulatory Comission 15760 West Powerline Street Crystal River, Florida 32629 Regional Administrator, Region 11 V.S. Nuclear Regulatory Comission 101 Marietta Street fl.W., Suite 2900 Atlanta, Georgia 30323 Jacob Daniel Nash Office of Radiation Control Departrnent. of Health and Rehabilitative Services 1317 Winewood Blvd.

Tallahassee, Florida 32399-0700 Administrator Department of Environmental Regulation Power Plant Siting Section State of Florida 2600 Blair Stone Road Tallahassee, Florida 32301 Attorney General Department of Legal Affairs The Capitol Tallahassee, Florida 32304 '

s ENCLOSURE CRYSTAL RIVER UNIT 3 10 CFR 50.62 (ATWS RULE)

REQUEST FOR ADDITIONAL INFORMATION Introduction and Discussion On July 26, 1984, the Code of Federal Regulations (CFR) was vnended to include the ATWS Rule (Section 10 CFR 50.62, "Requirements for Reduction of Risk from Anticipated Transients Without Scram [ATWS] Events for Light-Water-Cooled Nuclear Power Plants"). An ATWS is an expected operatior.41 transient (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power), which is c : companied by a failure of the Reactor Trip Cystem (RTS) to shut down the reac;or. The ATWS Rule requires specific improvements in the design and ope ation of commercial nuclear power facilities to reduce the likelihood of f'.tlure to shut down the reactor fullowing anticipated transients and to 1'tigate the consequences of an ATWS event.

Paragraph (c)(6) of the Rule requires that information suf#icient to demon-strate compliance with the requirements of the Rule be submitted to the Direc-tor, Office of Nuclear Reactor Regulation. The ATWS Rule requirements for Babcock & Wilcox (B&W) plants, such as Crystal River Unit 3 (CR-3), are to provide a diverse scram system (OSS), and diverse (from the existing reactor trip system) ATWS n.itigation system actuation circuitry (AMSAC).

Based on review of the information provided with FPC letters dated October 9, 1985 and September 28. 1988 and in subsequent clarifying discussions, this request for adoitional information is needed to allow the staff to determine whether the CR-3 design fully cortplies with the A1WS Fule requirements of hardware diversity, electrical independence, and reliability and testability at power. This information should include simplified block diagrams showing OSS and AMSAC circuit components with a description of manufacturer, model, principle of operation (e.g., electro-mechanical, solid state, etc.), mode of operation (e.g., energize or de-energize to trip, etc.), power supplies (e.g.,

AC or DC, operating voltages, etc.), and identification and location of all Class 1E/non-Class 1E system interfaces.

The principal function of the DSS at CR-3 is to prevent an ATWS by tripping the reactor if, for any reason, the rods fail to drop in response to a Reactor Protection System (RPS) trip. The DSS must function to provide a reactor trip, diverse from the existing Reactor Trip Systen (RTS), for all ATWS tran-sients that require a reactor trip (in addition to AHSAC actions) to prevent the potential for oamage to, or overpressurization of, the Reactor Coolant System (RCS).

The AMSAC must function to actuate emergency feedwater (EFW) and trip the turbine on ATWS transients, where required, to prevent serious RCS overpres-surization, to maintain fuel integrity, and to meet 10 CFR radioactivity release requirements. Considerations for avoidance of inadvertent actuation dictate that there be at

,' ~

2 least two channels, powered from separate sources and coupled with appropriate coincidence capability. The ATWS transients of concern for the BWOG plants have been shown to be a complete loss of main feedwater (LMFW) and the loss of offsite power (LOOP) leading to LMFW,

.he following discussion and associated questions are applicable to the FPC "conceptual design" for the DSS and AliSAC at CR-3.

Diversity from the Existino RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC diversity are such that the "primary input signals will be  ;

diverse from existing protection systems from the sensor output." Also, the 1 logic "system shall be diverse from existing protection systems," except that "certain plent-specific configurations may require enabling signals and power supply interconnections with existing protection systems." The output of the DSS "will degate SCRs using relays different from RPS SCR degate relays." The AMSAC "dctuation devices will be shared with existing systems."

For the DSS, equipment diversity to the extent reasonable and practicable to minimize the potential for common cause (mode) failures is required from the sensors to and including the components used to interrupt control rod power.

For the A!! SAC, equipment diversity to the extent reasonable and practicable to minimize the potential for comon cause (mode) failures is required from the sensors to, but not including, the final actuation device.

It is the staff's understanding that FPC's "conceptual design" for the DSS at CR-3 will use the RG 1.97 Rosemount pressure transmitters with Foxboro Model Spec 200 signal conditioning equipment, while the RTS uses Rosemount pressure transmitters with Bailey liodel 880 signal conditioning equipment. Since diversity of sensors is not required, the use of Rosemount transmitters for both the DSS and RTS appears to be acceptable. Also, the use of Foxboro signal conditioning for the DSS and Bailey signal conditioning for the RTS '

appears to provide adequate diversity.

It is also the staff's understanding that FPC's "conceptual design" for the i AliSAC at CR-3 will use fission chambers for indication of reactor power levels and Rosemount transmitters with Bailey Meter Co. Model 820 buffer modules to detect a complete loss of main feedwater flov, while the RTS uses ion chambers j to determine reactor power and does not use main feedwater flow as an input '

signal. Therefore, diversity of sensors and signal conditioning equipment appears to be adequate for the CR-3 AMSAC "conceptual design."

It is the staff's understanding that FPC's "conceptual design" for the DSS and AMSAC logic circuitry at CR-3 will use Bailey Meter Co. Model 820 equipment, while the RTS logic circuitry is Bailey Metc.r Co. Model 880. The FPC "concep- 7 tual design" for CR-3 indicates the Model 820 equipment operates in a -10 to i

+10 volt signal range while the Model 880 equipment operates in a 0 to +10 ,

volt range. This differentiation alone does not ensure that diversity is I achieved between the RTS and the DSS /AMSAC for the CR-3 logic circuitry.

Adequate diversity is best achieved by the use of components from different manufacturers / manufacturing processes, the use of mechanical versus electronic ,

devices, AC versus DC equir'nent, or equipment employing different princiales ,

of operation. Therefore, FPC must further determine how diversity is aciieved between the /odel 820 and Model 880 equipment and include this information in the CR-3 final plant-specific submittal.

. 3 It is the staff's understanding that the type of relays used to interrupt power to the control rod drives for the DSS have not been determined, but will be from a manufacturer different than Potter and Brumfield which manufactures the relays used in the RTS. It is also the staff's understanding that FPC's "conceptual design" for the AMSAC will use Potter and Brumfield relays to provide a turbine trip, while the existing RTS uses G.E. Model HEA relays.

For the final plant-specific CR-3 design FPC should not only consider dif-ferent relay manufacturers, but should also consider the other methods pre-  !

vicusly stated in this section for ensuring diversity for the DSS end AMSAC equipment.

The FPC "conceptual design" for CR-3 states that "the RTS and AMSAC logic trip inputs will both use the circuitry resident in the EFIC system cabinett, to start the Emergency Feedwater Pumps and Control Emergency Feedwater flow Dy modulating the Emergency Feedwater control valves." This is in conflict with the requirement for AHSAC diversity and independence up to the final actuation device (i.e., the circuit breakers for emergency feedwater pumps and the motor contactors for emergency feedwater control valves represent the final actuation devices). Therefore, the final plant-specific CR-3 design provided by FPC should address this conflict and describe in detail how diversity and independence is achieved between the RTS and AMSAC if portions of the Emergency Feedwater Initiation and Control (EFIC) system are shared.

Electrical Independence from the Existing RPS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC electrical independence are such that "the system will be ,

electrically independent frem existing protection systems, except fer power supplies and certain enabling signals which will be appropriately isubted."

Electrical independence of the DSS from the existing RTS should be provided from the sensor output up to and including the final actuation device.

Electrical independence of the AMSAC systems from the existing RTS should be provided from the sensor output up to, but not including, the final actuation device. I r

It is the staff's understanding that FPC's "conceptual design" for the DSS /APSAC at CR-3 shows power being supplied via a 480-volt bus with its own independent (i.e., not associated with the RTS) non-Class 1E battery, rectifier, and  !

charger providing 120 VAC to the ATWS circuitry. It is also the staff's '

understanding that the "conceptual design" for the CR-3 AMSAC ties the AMSAC to the EFIC system upstream of the final actuation device and that the EFIC and .

the RTS both share the same vital AC power. Thus, portions of the AMSAC do share vital AC power with the RTS. This design appears to be in conflict with Option 1 as described in the September 7, 1988 letter from G. Holahan (NRC) to L. C. Stalter (BWOG) and clearly falls into the Option 2 criteria "if EFIC is powered through 120 VAC RTS buses." Consequently, FPC must identify all DSS and AMSAC system components for CR-3 that %;ive power from sources that ere also used to provide power to the existint '

If RTS power supplies are used, information , ;t be provided to demonstrate that faults within the DSS or AMSAC circuits cannot degrade the reliability /

integrity of the existing RTS below an acceptable level. Information must also be provided to demonstrate that the potential for a connon mode failure affecting the RTS power distribution system that could compromise both the RTS and ATWS prevention / mitigation functions simultaneously is highly unlikely.

e 4 This information should include an analysis that addresses both degraded voltage and frequency conditions (e.g., overvoltage and undervoltage; the effects of degraded voltage / frequency conditions over time must be considered if such conditions can go undetected).

If alarms are relied upon to provide early detection of degraded voltage /

frequency conditions, the infnrmation provided shculd include the specific alarm (s) and the setpoint value(s). Information thould also be included regarding the limiting voltage / frequency values for which the affected circuits / components have been analyze'/ 'emonstrated to still be capable of performing their intended functions. A discussion of the periodic surveillance / testing performed to verify operability of the alarm circuits should also be provided.

In addition, even tr. . J c i Class 1E to non-Class 1E isolators used in the DSS and AMSAC at CR-3 have seen previously reviewed and accepted by the staff for use in the EFIC, RG 1 *7, and SPDS equipment, FPC must make a determination that the new DSS /AMSAC al/ W ations are bounded by the previously documented testing and so state in the final CR-3 plant-specific submittal.

The FFC "conceptv1 design" for the DSS /AMSAC electrical independence require-ments at CR-3 arrears to be in accordance with the ATWS Rule requirements except in the area of the sharing of power supplies. Thus, for the staff to make a final determination of gomplete acceptance, the CR-3 plant-specific information requested above must be provided for staff review.

Physical Separ,ation from Existing RpS In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and Ah AC are such that "channel separation shall be provided in accordance wie.i plant-specific requirements for routing non-safety signals."

To allow the staff to determine if this part of the CR-3 design complies fully with the current approved plant design requirements, specific details on component location and physical separation should be supplied in the plant-specific submittal.

Environmental Qualification (EQ) and Quality Assurance (QA) for Testing 2 Maintenance, and Surveillance, In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that "equipment shall be qualified for a normal environment in accordance with plant-specific EQ program requirements; quality assurance measures are to be provided on a plant-specific basis equal to or better than the requirements promulgated by HRC's Generic QA guidance letter, GL 85-06."

It is the staff's understanding that the CR-3 "conceptual design" provides environmental specifications for the locations of ATWS equipment and that this

, equipment should remain within the control complex boundaries and should be subject to essentially the same environment as that specified for Zone #43 Elevation 108 feet. It is also the staff's undarstanding that the ATWS System will be controlled in accordance with the general requirements of the FPC l Quality Program in a manner similar to that currently used for other nonsafety-related systens and equipment. Testing, maintenance, and any specified surveillances will be conducted and controlled in accordance with I

, 5 approved procedures. Collectively, the controls applied to the ATWS System will meet or exceed the "Quality Assurance Guidance For ATWS Equipenent That is Not Safety-Related," as set forth in Gcneric Letter 85-06.

The approach to the EQ and QA requirements identified above appears to be aCCep;able. It should be noted that the EQ and QA programs will be audited periodically during NRC regional inspections to assure continued compliance.

During the life of commercial light-water-cooled nuclear power plant, many components reach their end of life and must be replaced, including components installed in the RTS, DSS, and AMSAC. In its plant-specific submittal FPC should provide a description of the measures / programs impleinented for CR-3 to assure that the equipment diversity provided in accordance with the ATWS Pule will be maintained during component repair, replacement, and modifications and/or design changes, etc. throughout the life of the plant.

Safety-Related (1E) Power Supplies In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC are such that a "safety-related power supply is not required." However, "operability during Loss of Offsite Power is required."

Although the use of safety-related (1E) power supplies is not required for the DSS and AMSAC systems, the logic and actuation device power for the DSS and logic power for the AMSAC designs must be from an instrument power supply independent from the power supplies for the existing RPS. In this regard, it is the staff's understanding that the CR-3 "conceptual design" for DSS and A!! SAC provides for power to be supplied b off-site power with a battery, inverter, and charger to provide 120 VAC power to the ATWS logic circuitry.

However, for the staff to make a final determination of acceptance, the exceptions noted in the diversity and independence sections concerning the use of EFIC equipment in the ATWS designs trust be addressed in detail.

Testability at Power Ire accordance with B&W Document 47-1159091-00, the ger.eric design requirements for DSS and AMSAC testability at power are such that "the system shall be testable at power, at power tests shall be performed at 6-month intervals with the complete system test being performd every refueling. The folicwing exceptions exist. The DSS input sensors and the ANSAC input sensors and final actuation devices will only be tested at refueling outages."

To ensure that the DSS circuits perform their safety functicns in a reliable manner, the circuits should be maintained and periodically tested at power in accordance with Technical Specification operability and surveillance require-ments or equivalent means.

It is the stoff's understanding that the portion of the CR-3 "conceptual design" that will allow testability at power is provided by the design of the DSS and AliSAC systems. These systems are designed so that both are 2 out of 2 logic actuated systems, and provisions are incorporsted which disable the second channel when a channel is placed in the test mude.

, 6 This approach appears to be in accordance with the above mentioned design requirements. However, the plant-specific submittal should also address the frequency of each test and time limits associated with channel testing, disabling of channels, actions to be taken if one channel has failed, etc.

Inadvertent Actuation In accordance with B&W Document 47-1159091-00, the generic design requirements for 053 and AMSAC to prevent inadvertent actuation are such that "the system shall be designed to minimize challenges to other safety systems by usinq at least two channels with appropriate coincidence logic; the use of two channels concurrent with the energize-to-trip design should minimize the number of inadvertent actuations."

To avoid the potential for inadvertent actuations of this nonsafety system, the system shall be designed so as not to revert to a 1-out-of-1 status during channel test. For systems designed using the minimum two-channel logic, this dictates that the system shall become inoperable during channel test.

It is the staff's understanding that the CR-3 "conceptual design" is in accordance with the above rnentioned design requirements.

Maintenance Bypasses, Operating Bypasses, Indication of Bypasses, and Means for Bypassing In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS and AMSAC bypassing are such that "the system shall incorporate a channel test capability; the test function should simultaneously test an input and output channel togetner from sensor to final actuation device."

System status during testing should be annunciated in the control room. The system should be designed to provide output to the control room inounted alarms for input channel trip conditions, output chMnel trip conditions, system trip, and test status. The system status will also be annunciated when the system is in the startup bypass mode / condition and reactor power *is less than 25% of rated full power.

It is the staff's understanding that the Cp-3 "conceptual design" concerning bypassing provides for disabling of a channel for maintenance, testing, repair or calibration by placing the other channel in test. Administrative controls will be provided to require pl:cing a DSS or AMSAC channel in test in order to provide control room annunciation any time work is to be performed which would disable operation of the other channel. These administrative controls will also prohibit personnel from working on more than one CSS or AMSAC channel simultaneously.

In addition, this design provides for automatically bypassing the AMSAC logic below a reactor power level of 25%. The DSS system does not require an operational bypass, and none is provided. The "conceptual design" also provides for indication of DSS and AMSAC status, including maintenance bypasses in the control room, with inputs to the sequence of events recorder. The sequence of events recorder displays alarm status to the operators via a color CRT mounted above the center of the main control board. The "conceptual design" provides these bypass capabilities for maintenance and test by using installed test modules. However, for the staff to make a determination of complete acceptance, FPC should assure that all items of concern addressed in the testability section of this report that are applicable to bypassing at CR-3 are discussed in the plant-specific submittal.

i ,

7 Completion of Protective Action In accordance with B&W Document 47-1159091-00, the generic design requirements for DSS (AMSAC is not addressed) to assure completion of the protective action once it has been initiated are such that "the DSS shall ine' " ate a trip lockup with manual reset capability in the output channele Ntivated by a true DSS trip." Therefore, the plant-specific OSS desit be such that, once initiated, the protective action at the system leve ;u completion.

Return to operation should require subsequent deliberate p rator a: tion, e.g.,

mdnual reset of the tripped Circuits.

It is the staff's understanding that the FPC "conceptual design" for the 055 at CR-3 provides lockup of the DSS trip function such that reset of the 055 trip function requires manual operator action using Reset Switch S-1. It is also the staff's understanding that the AMSAC does not currently use a lockup trip function but that the plant-specific updated AMSAC design will incorporate trip lockup requiring manual operator action for reset. However, FPC should provide specific information which confirms that both the DSS and AMSAC at CR-3 are designed such that, upon receipt of a trip signal, the protective action goes to completion and deliberate operator action is required to reset the systems in order to comply with the ATWS Rule. In addition to the specific information on the system's design, FPC should include a discussion of any required operator actions.

Information Readout Although this item is not specifically addressed in B&W Document 47-1159091-00, it is the staff's understanding that FPC's "conceptual design" for CR-3 provides for indication of DSS and AMSAC system status both remotely (by means of the sequence of events recorder) and locally on the DSS and AMSAC test modules (by means of iiidicating lights). This type of design appears to be acceptable.

However, in the FPC plant-specific submittal for CR-3, more detailed information relating to how the operator is provided with accurate, complete, and timely information (i.e., what actuates or deactuates alarms, annunciators, lights, and what functions are performed by specific switches, etc.) pertinent to system status should be provided. In addition, FPC should provide a discussion of how good human factors engineering practices are incorporated into the design of ATWS prevention / mitigation system components located in the control room. The coordination of displays used to provide the status of ATWS syst, ms/

equipment to the operator with existing displays should be addressed specifically.

Safety-Related Interfaces In accordance with B&W Document 47-1159091-00, the generic design requirements for safety-related components / interfaces are such that "the DSS and AMSAC are not required to be safety related nor designed to meet IEEE 279, however riust be designed and engineered for high reliability to preclude unnecessary challenges to existing safety systems."

It is the staff's understanding that the FPC "conceptual design" for the CR-3 AMSAC does include interfaces with the existing reactor protection systems, as noted in the previous discussions of this report. These concerns (i.e.,

the sharing of power supplies via EFIC/AMSAC, and the adequacy of isolation devices used in these systems) must be adequately addressed in the plant-specific submittal in order for the staff to make a final decision regarding compliance of the CR-3 safety-related interfaces between the existing protection system and the DSS and AMSAC.

,O '

• I

,. l

. 8 I Technical Specifiestions i i

The staff, in its Technical Specifications Improvement Program, is presently evaluating the need for Technical Specification operability and surveillance ,

rzquirements. This evaluation includes those actions considered to be oppropriate to ensure that equipment installed per the ATWS Rule will be '

maintained in an operable condition when operability requirements cannot be met (i.e., limiting conditions for operation). In its Interim Comission

. Policy Statement on Technical Specification Improvements for Nuclear Power Plants [52 Federal Register 3778, February 6,1987), the Comission j established a specific set of objective criteria for determining which regulatory requirements and operating restrictions should be included in Technical Specifications. This aspect of the staff's review of the CR-3

design for compliance with the ATWS Rule remains open pending completion of t

the staff's review to determine whether and to what extent Technical

, Specifications are appropriate. The staff will provide guidance regarding the Technical Specification requirements for DSS and AMSAC at a later date.

Installation of ATWS prevention / mitigation system equipment should not be delayed pending the development or staff approval of operability and surveillance requirements for ATWS equipment.

i Suma ry In order for the staff to make a final determination on the CR-3 compliance

with the ATWS Rule and issue a Safety Evaluation, the additional information requested in the body of this document will be required. This additional information, as well as pertinent previously supplied information, should be

! submitted to the staff in a single ATWS system final design package. This will

] assure that on1 ' the most complete and up to date information is reviewed.

I i

4

. . ~ ,