ML17227A625

Proposed Tech Specs 4.5.2.d.1,reflecting Removal of Shutdown Cooling auto-closure Interlock Surveillance Requirement

ML17227A625
Person / Time
Site:	Saint Lucie
Issue date:	10/21/1992
From:	FLORIDA POWER & LIGHT CO.
To:
Shared Package
ML17227A624	List: ML17227A623 ML17227A625
References
NUDOCS 9210260315
Download: ML17227A625 (25)

Text

St.LucieUnit1DocketNo.50-335ProposedLicenseAmendment RemovalofShutdownCoolingAuto-Closure Interlock Surveillance ReuirementATTACHMENT 1St.LucieUnit1Marked-up Technical Specification PageT/S3/45-492ioi~oii5 9aio2iPDRADOCK05000335F','DRJ EMERGENCY CORECOOLINGSYSTEMSSURVEILLANCE REUIREMENTS 4.5.2EachECCSsubsystem shallbedemonstrated OPERABLE:

a.Atleastonceper12hoursbyverifying thatthefollowing valvesareintheindicated positions withpowertothevalveoperators removed:ValveNumberl.V-3659rVal'veFunction1.Mini-flow isolation ValvePositionl.Open2.V-36602.Mini-fTowisolation 2.Openb.Atleastonceper31daysby:l.Verifying thateachvalve(manual,poweroperatedorautomatic) intheflowpaththatisnotlocked,sealed,orotherwise securedinposition, isinitscorrectposition.

c.Byavisualinspection whichverifiesthatnoloosedebris(rags,trash,clothing, etc.)ispresentinthecontainment whichcouldbetransported tothecontainment sumpandcauserestriction ofthepumpsuctionsduringLOCAconditions.

Thisvisualinspection shallbeper'formed:.

1.Forallaccessible areasofthecontainment priortoestablishing CONTAINMENT INTEGRITY, and2.Oftheareasaffectedwithincontainment atthecompletien ofcontainment entrywhenCONTAINMENT INTEGRITY isestablished.

d.Atleastonceper18monthsby:3.~e+l~g-aetom&4c-4scka44on-of-@he-shutdown-coo44ng

~@stem-from-the-Reac-te~~n4-System-when-the-Reao4.or

~~@4-Sys4ear-pr essence-46-above-800-ps+g.

2.Avisualinspection ofthecontainment sumpandverifying thatthesubsystem suctioninletsarenotrestricted bydebrisandthatthesumpcomponents (trashracks,screens,etc.)shownoevidenceofstructural distressorcorrosion.

Verifying (OPI)andisolation properoperation oftheopenpermissive interlock thevalveopen/high SDCSpressurealarmsforvalvesV3651,V3652,V3480,V3481.ST.LUCIE-UNIT13/45-4Amendment No.9O 04~L-.~1tlua4a\w' Aa~'ms St.LucieUnit1DocketNo.50-335ProposedLicenseAmendment RemovalofShutdownCoolingAuto-Closure Interlock Surveillance ReuirementATTACHMENT 2SAFETYANALYSISIntroduction FloridaPowerandLightCompany(FPL)proposestoremovetheauto-closureinterlock (ACI)fromtheshutdowncoolingsystem(SDCS)suctionvalvesatSt.LucieUnitNo.1.ThecurrentdesignprovidesanACIandanopenpermissive interlock (OPI)oneachoftheisolation valvestoreducetheprobability ofinadvertent connection ofthereactorcoolantsystem(RCS)totheSDCSwhentheRCSpressureisabovethedesignpressureofthesuctionline(300psig).Motor-Operated Valves(MOVs)V3480andV3481forthe1Asuctionline,andV3651andV3652forthe1Bsuctionline,areinseriesandarecontrolled bytheseinterlocks.

EachpairofMOVscreatesadoublebarriertoisolatetheSDCSsuctionlinefromtheRCS.TheOPI,whichisnotaffectedbytheproposedACIdeletion, preventstheSDCSsuctionisolation valvesfrombeingopenedwhentheRCSisalreadypressurized.

TheACIisdesignedtoclosetheSDCSsuctionisolation valveswhentheRCSpressureincreases above300psig.Analarmcurrently existsforeachtrainofvalvestowarnthecontrolroomoperatorwheneveraSDCSsuctionisolation valveisnotcompletely closedandtheRCSpressureisgreaterthanthesetpoint.

RemovaloftheSDCSACIfeatureaddresses Commission concernsregarding thepotential forfailureoftheACIcircuitry whichcouldcauseinadvertent isolation oftheSDCSwithsubsequent lossofshutdowncoolingcapability duringcoldshutdownandrefueling operation.

Inaddition, theproposedmodification isconsistent withtherecommendations ofGenericLetter88-17,"LossofDecayHeatRemoval."

TheproposedremovalofACIfeaturesrequiresachangeintheSt.LucieUnitNo.1Technical Specifications (TS).Specifically, TS4.5.2.d.l willbemodifiedtodeletethesurveillance oftheACIandaddasurveillance oftheOPIandtheisolation valves'larm function.

Discussion TheSDCSisdesignedtoachieveandmaintainacoldshutdowncondition byremovingresidualenergyfromtheRCSanddecayheatfromthereactorcore.WhiletheRCShasadesignpressureof2500psia,theSDCScomponents haveadesignpressureof500psigorless.Sincetwopipingsystemsofdifferent designpressures areconnected, suitableisolation capability mustbeprovidedwhentheRCSisbeingoperatedathighpressure.

Toensurethatisolation oftheSDCSwillremainineffectafteranycrediblefailurehasoccurred, twoisolation devicesinseriesareprovidedforeachofthetwoSDCSsuctionlines(V3480andV3481forthe1Asuctionline,andV3651andV3652forthe1Bsuctionline).WhentheSDCSisinuse,thesystembecomesanextension ofthereactorcoolantpressureboundary.

Sinceanumberofpressurization sourcesexistwithinorareconnected tothehigh-pressureRCS,thelow-pressure SDCSmustbeprotected againstpostulated pressurization transients whenthesystemsareconnected.

Toaccomplish this,eachSDCSsuctionlineisprovidedwithareliefvalve(i.e.,V3468andV3483).Notethatthesereliefvalvesdonotprovideprotection ofthereactorcoolantpressureboundaryagainstbrittlefractureduetopressurization atlowtemperature.

AtSt.LucieUnit1,onlythePowerOperatedReliefValves(PORVs)areusedforLowTemperature Overpressure Protection (LTOP).Overpressure protection oftheSDCSisbasedonthosetransients postulated tooccurduringnormalSDCSoperation.

ThesuctionlinereliefvalvesarenotintendedtoprotecttheSDCSagainstover-pressurization asaresultofbeinginadvertently exposedtofullRCSpressureduringpoweroperation.

Areliefdevicewiththecapacitytoprotectagainstthiseventwouldnotbepractical.

ShouldtheSDCSbeexposedtoRCSpressureduringpoweroperation, theSDCScouldruptureatapointoutsidethecontainment causinganinterfacing systemloss-of-coolant accident(ISLOCA).

Appropriate alarmsandtwoinstrumentation interlocks areusedtoreducetheprobability oftheinadvertent connection oftheRCStotheSDCSwhentheRCSispressurized.

Theseinterlocks aregenerally described inReactorSystemsBranchTechnical PositionRSB5.1.'hefirstinterlock isdesignedtopreventopeningtheSDCSisolation valveswhenRCSpressureisabovetheSDCSdesignpressure.

Thisfeatureisknownastheopenpermissive interlock, orOPI.ItprotectsagainstthespectrumofeventswhichresultfromtheSDCSsuctionisolation valvesbeingopenedwhentheRCSisalreadypressurized abovetheSDCSdesignpressure.

Theproposeddesignmodification doesnotinvolveanychangetothisinterlock.

Thesecondinterlock automatically providesaclosesignaltotheisolation valveswhenRCSpressureexceedstheACI,setpointof267psia,ensuringthattheSDCSsuctionwillnotexceed300psig(perTS4.5.2.d.1.).

Therefore, shouldthesevalvesbeinadvertently leftopenduringRCSheatupandpressurization, theSDCSisolation valveswouldautomatically close.Thisfeatureisknownasthe auto-closure interlock, orACI.,RemovalofACIisbeingproposedasawaytodecreasetheprobability oflossofshutdowncoolingevents.Aspreviously described, itisnecessary tohavetwovalvesinseriestoformareactorcoolantpressureboundarysothatnosinglefailurecanresultincompleteloss'ofthisbarrier.Thedoublebarrierisestablished bytheoperatorclosingbothvalvesoneachSDCSsuctionlinewhengoingfromSDCSoperation tosteamgenerator coolingduringplantheatup.Failuretoestablish thisdoublebarrierispossibleduetoafailureofthevalve,valveoperator, valvecontrols, orbyoperatorerror.Apotential operatorerroristheclosureofonlyonevalvefollowedbyRCS'ressurization.

ItisthisoperatorerrorthatACIs(andalarms)areintendedtoguardagainst.Theinterlock cannotguardagainsthardwaremalfunctions.

ThedesignoftheACIpresentsanoptimization issuebetweentwocompeting safetyfunctions.

WhentheSDCSisneeded,thesuctionvalvesmustremainopen.Failuresresulting invalveclosureareasafetyconcernduetothelossofdecayheatremoval.Conversely, whenACIactionisrequired, failureswhichleavethevalvesopenadversely impactsafetybyoverpressurizing theSDCS.Theindustryhasexperienced anumberofspuriousvalveclosureeventscausedatleastinpartbythepresenceoftheACI.AfrequentcauseofspuriousACIactionisaccidental orintentional de-energization ofapowersupplyresulting frommaintenance workperformed duringrefueling outages.TheACIcircuitcanbeactuatedafterlosinganyofseveralpowersupplies.

AsecondcauseforspuriousvalveclosureisanACIactuation following receiptofaninvalidhighRCSpressuresignalduetotestingthatisusuallyperformed duringrefueling outages.Resolution ofissuesrelatedtolossofshutdowncoolingeventshasbeenatopicofincreasing concerntoboththeNRCandtheindustryforseveralyears.Studieshaveidentified spuriousoperation ofACIasthemostfrequentcauseofreportedlossofSDCSeventsbetween1976and1983.Spuriousoperation ofACIhastwopotential impacts.Themostimmediate resultofvalveclosureislossofSDCSflowandcorresponding lossofdecayheatremovalfromthecore.IftheSDCSisnotquicklyrestored, theresultant RCStemperature risecanresultinpressurization ofaclosedsystemorlossoffluidthroughboilingifthereactorvesselheadisremovedforrefueling.

Thesecondresultofvalveclosuremaybesignificant damagetotheSDCSpumps(i.e.the1Aand1BLowPressureSafetyInjection Pumps)duetolossofsuction.Thiseventisseriousduetothepotential forcomplicating theshort-term recoveryofcorecoolingandthelongerrepairtime.SinceACIisasignificant contributor tolossofSDCSeventsatotherplants,FPLisproposing removalofthefeaturefromSt.

• WF.P LucieUnitNo.1.TheNRChasencouraged removalofACIinGenericLetter88-17.Inthatdocument, theNRCsuggeststhatutilities seekingremovalofACIconsidertheapproachtakenbyPacificGasandElectricinremovingtheACIfromtheDiabloCanyonUnits.SafetAssessment Combustion Engineering (CE)hasevaluated theimpactofremovingtheACIfromtheSDCS.Theanalysiswasperformed todetermine thechangeinISLOCAfrequency, thechangeinSDCSunavailability, andtheimpactonmitigating low-temperature overpressure eventsduetotheremovalofACI.Thisevaluation addresses sevenguidelines forACIremovalrecommended bytheNRCinamemorandum fromB.H.Sharon(Chief,ReactorSystemsBranch)datedJanuary28,1985.Insummary,thefollowing discussion describes howeachofthesevenitemsaremet.Itshouldbenotedthatthisdiscussion parallels thatacceptedbytheNRCforDiabloCanyonandWaterford 3.1~Meansavailable tominimizeaLOCAoutsidecontainment.

TheSt.LucieUnit1designprovidesforadoublebarrierbetweentheRCSandtheSDCS.Thedesignprovidesaveryhighprobability thatatleastonebarriercanbeestablished andmaintained underanypostulated condition.

Procedural

controls, training, alarmsandtheOPIfunctionminimizethepotential thattheoperatorwillfailtoachievedoubleisolation duringnormalheatupandpressurization oftheReactorCoolantSystem(RCS),ordefeatitonceestablished.

Additionally, theSDCSisprotected againstruptureduringanattempted normalheatupandpressurization oftheRCSwiththeSDCSsuctionvalvesopenbytheSDCSsuctionreliefvalves.CEprovidedagenericreviewandevaluation ofremovingtheACIfunctionasameanstoimproveSDCSreliability.

Thisevaluation boundedtheconfiguration atSt.LucieUnitNo.l.ThepresentSDCSconfiguration atSt.LucieUnitNo.1includestwoSDCSsuctionvalvesinseries;thevalveshaveACI,OPIandavalvepositionalarm.Usinggenericprobability valuesandmethodology, CEdemonstrated thatA'CIremovalandincorporation ofcertainchangestotheexistingalarmresultsinanegligible increase(0.098%)inthefrequency ofInterfacing SystemLossofCoolantAccident(ISLOCA).

Amoredetaileddiscussion oftheISLOCAprobability isincludedintheresponsetoItem7below.2~Alarmstoalerttheoperatorofanimproperly positioned SDCSsuctionvalve.AlarmsareprovidedinthemaincontrolroomtoinformtheoperatorifanyoftheSDCSsuctionvalvesarenotfullyclosedwhenRCSpressureisabovetheSDCSoperating pressure.

Thesealarms,locatedonthemaincontrolboards,are t4 annunciator typewhichprovideoperators withbothflashinglightsandaudiblesignals.Operating procedures willcontaintheappropriate responsetothealarmsanddirecttheoperatortostopincreasing RCSpressureandclosethesuctionvalvesasrequired.

Thealarmsetpointswillbetestedatleastonceevery18monthstoensurereliability.

Therequirement, forthistestisincludedintheproposedTechnical Specification 4.5.2.d.1.

surveillance.

Thealarmsaredesignedtoannunciate uponalarmrelayfailure.3~Verification oftheadequacyofreliefvalvecapacity.

Asapartoftheoriginalsystemdesignprocess,calculations wereperformed toensurethatthereliefdevicesintheSDCSsuctionlineshadadequatecapacitytopreventoverpressurizing theSDCSduringpostulated events,asdescribed inFSARSection6.3.2.2.6.d.

CEreviewedthesecalculations andconfirmed thatACIwasnotcreditedintheselection oflimitingeventsormitigation oftheresulting transients.

Therefore, thecalculations remainapplicable withtheACIremoved.4~MeansotherthanACItoensurethatbothisolation valvesareclosed.Thecircuitry forthealarmsdescribed inItem2abovewillbemodifiedtoprovideinputtothealarmforvalvepositionindependent ofthevalvecontrolsandpositionindication.

Theplant'soperating procedures andannunciator responseprocedures willberevisedasrequiredtodirecttheoperatortoverifyvalvepositionandtaketheappropriate actionsifthevalveisnotclosedwhenhighpressureisalarmed(i.e.abovetheSDCSsetpoint).Cautionswillbeprovidedasnecessary todirecttheoperatortonotpressurize theRCSaboveSDCSdesignpressureunlessbothoftheSDCSsuctionvalvesareclosed.Thesemeanswillensurethatthedoublebarrier(i.e.,twoisolation valvesinseriesoneachSDCSsuctionline)isestablished uponheatup.5.Assurance thattheOPIisnotaffectedbyACIremoval.TheOPIfunctionwillbemaintained initspresentform,andthisinterlock willbetestedatleastonceper18monthstoverifyoperability, perTS4.5.2.d.l.

6.Assurance thatvalvepositionindication willremainavailable inthecontrolroomafterACIremoval.Thevalvepositionindication circuit,willbemodifiedtoprovideasafetygradepowersupplyindependent ofthevalve'scontrolpower.Thisindication willbepresentevenwhen 4Q.Alrrr valveoperation islockedoutduringpoweroperation.

Valvepositionindication isprovidedonthemaincontrolboardandonthecomputerdisplaylocatedinthemaincontrolroom.Additional indication thatthevalveisclosedwillbeprovidedbythelackofanalarmat.anypressureabovethealarmsetpoint.7~Assessment oftheeffectofACIremovalonSDCSavailability andlow-temperature overpressure event.AnanalysisoftheimpactofremovingtheACIfromtheSDCSwasperformed todetermine thechangein:1)Interfacing SystemLOCA(ISLOCA)frequency, 2)ThechangeinSDCSunavailability, and3)Theimpactonmitigating LTOPeventsduetoremovaloftheACI.Theanalysisconsidered boththepresentandproposedconfigurations oftheSDCS.Thepresentconfiguration considers SDCSsuctionvalveswithACIandvalvepositionalarm.Theproposedconfiguration considers theSDCSsuctionvalveswithACIremoved,thesamevalvepositionalarmsetpointinthecontrolroom,andincorporation ofnecessary operating instructions toensureappropriate operatorresponsetothevalvepositionalarmistaken.Faulttreeanalysiswasemployedindetermining theISLOCAfrequency andtheSDCSunavailability forbothconfigurations.

Thebasisfortheconstruction andevaluation ofthenecessary faulttreemodels,thebasisforquantifying frequencies forISLOCAandSDCSunavailability, andhumanerrorprobabilities isdocumented intheCEevaluation.

TheNRChaspreviously approvedACIremovalforseveralplantsutilizing thisapproach, including Waterford, SanOnofre,andDiabloCanyon.ISLOCAFrequency ResultsTheanalysisresultsforISLOCAfrequency arepresented below:SDCSConfiurationISLOCAFreuenc1.(Currentconfiguration) 1.1188x10'/yearSDCSsuctionvalveswithACIandalarm-2.(Proposed configuration)

SDCSsuctionvalveswithalarmonly1.1199x10'/yearBecausetheISLOCAfrequency isgovernedbythecombinedcatastrophic failure(grossleakagewithoutpositionindication) ofbothsuctionvalves,thereisonlyanegligible increase(.098%)inISLOCAfrequency duetoremovaloftheACI.BasedonearlierNRCinput(tobediscussed below)sensitivity analyseswereperformed todetermine theimpactofoperat'or AlJ' errorassumptions onISLOCAfrequency.

Basecaseoperatorerrorprobabilities werevariedbyfixedfactorsandISLOCAfrequency quantified witheachvariation.

SincetheISLOCAfrequency isgovernedbythecatastrophic failureofbothvalves(ratherthanfromtheoperatorfailingtocloseavalve),thechangeinfrequency wasfoundtobeinsensitive tothevariations ofoperatorerrorprobabilities.

Inperforming ISLOCAanalysesitwasassumedthattheexistingalarmwastestedateachrefueling.

Asensitivity analysiswasperformed todetermine thepotential impactofthisassumption onISLOCAfrequency.

Testintervals rangingfrom30daysto20yearswereusedforthesensitivity analysis.

Thefrequency ofISLOCAwasfoundtoberelatively insensitive tohowoftenthealarmwastested.Asmallincreaseinfrequency isobservedwhenthetestintervalis5yearsormore.Theproposedchangemaintains arefueling outagetestscheduleforthealarms.Itshouldbenotedthatwithanalarmpresent,asinthecurrentSt.LucieUnitNo.1design,ACIisanegligible contributor toreactorsafety.Thedominantcontributor toISLOCAfrequency isacatastrophic failureofbothSDCSsuctionisolation valveswiththereactoratpower.NeitherACInoralarmscanprovidedefenseagainstsuchafailure,noristhattheintendedfunction.

Furthermore, thealarmoffersprotection against.equipment failures(suchastheSDCSisolation valvesfailingtoclose);theACIdoesnot.TheCEgenericevaluation determined thatanISLOCAviatheSDCSsuctionlineswhiletheplantisatpowercanoccurbythefollowing mechanisms:

a)b)c)d)Bothisolation valvesinseriesareleftopen;Onemotoroperatedvalveisleftopen,andthesecondmotoroperatedvalveinseriesruptures; Thesecondmotoroperatedvalveisleftopen,andthefirstmotoroperatedvalveinseries'ruptures, or;Bothvalvesrupture.Mechanism a)isnotacredibleinitiator foranISLOCA.Ifbothvalvesareleftopenduringreactorheatup,theSDCSreliefvalve,locateddownstream ofthetwovalves,willopentorelievetheincreasing pressureanddischarge reactorcoolanttothewastemanagement systemholduptanks.Thesetpointofthereliefvalveis300psig.Uponreliefvalveactuation, indications ofincreasing holduptanklevelanddecreasing reactorcoolantsystem(RCS)orvolumecontroltanklevelwillalerttheoperatorthattheRCSpressureboundaryhasnotbeensecuredduringheatup.Duetotheseindications andtheeffectsofthereliefvalvedischarge uponRCSpressure, heatupwillbesuspended untiltheRCSpressureboundaryisestablished byclosingtheSDCSsuctionvalves.Leavingbothvalvesinseriesopenisnotconsidered credible.

• ~I4~q' Thefrequency ofanISLOCArelatedtothetwoSDCSsuctionlinescanthenbeestimated baseduponanequationutilizing theremaining threemechanisms:

(Equation 1)F(ISL)=2*(aQ,+aQ,+aQ,)where:F(ISL)aQIQ2Q3Frequency ofISLOCAviaSDCSsuctionlines,peryearCatastrophic failurerateformotoroperatedvalves(2.716x10~/year)

Probability thatthefirstmotoroperatedvalveinseriesisnotclosedProbability thatthesecondmotoroperatedvalveinseriesisnotclosedProbability thatthesecondmotoroperatedvalvefailsgiventhatfirstmotoroperatedvalvehasfailedTwocases,withandwithoutACI,wereanalyzed:

Case1(Currentconfiguration):

AlarmandACI.Case2(Proposed configuration):

Alarmonly.Thesamealarmcharacteristics havebeenassumedforCase2asCasel.VariableQ,hasthesamevalueforbothCases.Faulttreeanalysesareusedtodetermine Q~andQ.becausebothareMOVs,Q,=Q,.Theresultsare:Q>QzQ3Case11.00x10'.00x10~2.04x10'iCase21.10x10~1.10x10~2.04x10Inallcases,Q,isthedominantterm.Thisterm,representing catastrophic failureofbothinitially closedvalves,contributes over99>ofthetotalISLOCAriskforCases1and2.Theincreases invariableQ,andQ,forCase2comparedtoCase1areminorandquantifytheeffectsofACIremovalsincethesamealarmcharacteristics areassumedforbothcases.Case1F(ISL)=1.1188x10'yearCase2F(ISL)=1.1199x10'year(Equation 2)4changeinISLOCAfrequency withACIremoved:FISL-case2

-FISL-easel F(ISL-easel) 4changeinISLOCAfrequency withACIremoved=0.098%

SDCSUnavailability ResultsFortheSDCSunavailability

analysis, thepresenceorabsenceofavalvepositionalarmisimmaterial.

Forthetwoconfigurations ofconcern,SDCSunavailability wasevaluated forfailuretoprovideshutdowncoolingduringshutdownconditions.

Theevaluation includesfailuretostartandfailuretooperategiventhatthesystemhasstarted.Theresultsarepresented below:SDCSConfiurationSDCSUnavailabilit 1.(Presentconfiguration)

SDCSsuctionvalveswithACI5.05x10~2.(Proposed configuration) 3.08x10~SDCSsuctionvalveswithACIremovedTheremovalofACIrepresents a39%decreaseinSDCSunavailability duringrefueling operations.

EffectonLowTemperature Overpressure Protection (LTOP)DuringlowRCStemperature (e.g.shutdowncooling)operations, thereactorvesselmaterialismorebrittlethanduringnormaloperation.

Becauseofthebrittleness ofthevesselmaterialatlowtemperatures, overpressurization oftheRCSduringlowtemperature operation isofconcern.St.LucieUnitNo.1employstwopressurizer PowerOperatedReliefValves(PORVs)withsufficient capacitytomitigateLTOPeventsthatmayoccurduringlowRCStemperature operations.

InordertoboundtheLTOPanalysisassumptions, theTechnical Specification LimitingConditions ofOperation (LCO)requiredisabling certainpumps(i.e.chargingpumpsorHighPressureSafetyInjection Pumps)tominimizeinadvertent actuation, andlimitReactorCoolantpumpstartsbasedonprimarytosecondary temperature differential.

AlthoughtheSDCSreliefvalveswouldbeavailable toprovideadditional reliefcapacityduringanLTOPevent,creditforthesevalvesisnottakenintheanalysisforLTOPmitigation atSt.LucieUnit1.Therelatively slowstroketimeoftheSDCSsuctionvalvesduringclosureislikewisenotcreditedintheLTOPanalysis.

LTOPistherefore independent oftheSDCSsuctionlinesatSt.LucieUnitNo.1.BecausethePORV'sprovideLTOP,removalofACIfromtheSDCSsuctionvalvesdoesnotadversely affectLTOPperformance oravailability.

TheNRCidentified anumberoftransients (industry wide)thatwereinitiated byinadvertent closureoftheSDCSsuctionvalves.RemovalofACIdecreases theunavailability oftheSDCSbyreducingtheprobability ofinadvertently closingthe.SDCSsuctionvalves.Thus,theprobability ofapressuretransient duetochargingpumpflowwithoutanyletdownflow

,~gliVlm54AV (e.g.throughtheSDCSsuctionline)isalsoreduced.Theprobability ofLTOPchallenges wouldthenbereducedwithouttheACI,thusenhancing plantsafety.NRCInputInJanuary1989,theCEOwnersGrouphelditsannualmeetingwithNRCmanagement andtechnical staff.AtthatmeetingremovaloftheACIwasdiscussed insomedetail.TheNRC(AshokThadani)requested thatsubmittal forACIremovalspecifically addresstwoissuesrelatedtoISLOCA:1)thesensitivity oftheanalysestoassumptions aboutoperatorerrorrates,and2)areviewofthesignificance oftheDecember1987Biblis-AISLOCAprecursor event.Asnotedabove,sensitivity studiesofoperatorerrorrateassumptions wereperformed aspartoftheISLOCAfrequency determinations.

ItwasfoundthatthechangeinISLOCAfrequency wasinsensitive tooperatorerrorrateassumptions.

Theinsensitivity isattributed tothedominantfailuremechanism beingcatastrophic failureofbothsuctionvalves.AreviewoftheBiblis-APNReventshowsthattheoperatortriedtocloseamispositioned pressureisolation valvethatshouldhavebeenclosedpriortoheatup.Theoperatortriedtomanipulate thepressureonthemispositioned valvebyopeningasecondvalve.Indoingso,apathfromtheRCStotheatmosphere wasestablished resulting inashortdurationrelease.TheSt.LucieUnitNo.1SDCSsuctionvalves(pressure isolation valves)cannotbeopenedbytheoperatorwhileRCSpressureisaboveshutdowncoolingentryconditions.

Theopenpermissive interlocks (OPI)preventsuchactionsbytheoperator.

Theseinterlocks willremainasanintegralpartoftheSDCSsuctionvalves.Therefore, thesequenceofeventsinvolving operatoractionsthatoccurredatBiblis-AisnotexpectedtooccuratSt.LucieUnitNo.1.Theanalysisofthe7itemsidentified bytheNRCdemonstrates thattheremovaloftheACIprovidesanetimprovement inplantsafety,because:1)ISLOCAfrequency isnegligibly increased (0.0984);

2)SDCSunavailability issignificantly reduced(39~),and;3)LTOPperformance oravailability isnotaffected, howevertheprobability ofLTOPchallenges wouldbereduced.10 0.fP'f'cfJ'4 St.LucieUnit1DocketNo,50-335ProposedLicenseAmendment RemovalofShutdownCoolingAuto-closure Interlock Surveillance ReuirementATTACHMENT 3DETERMINATION OFNOSIGNIFICANT HAZARDSCONSIDERATION Thestandards usedtoarriveatadetermination thatarequestforamendment involvesnosignificant hazardsconsideration areincludedintheCommission sregulations, 10CFR50.92,whichstatethatnosignificant hazardsconsiderations areinvolvedifoperation ofthefacilityinaccordance withtheproposedamendment wouldnot(1)involveasignificant increaseintheprobability orconsequences ofanaccidentpreviously evaluated; or(2)createthepossibility ofnewordifferent kindofaccidentfromanyaccidentpreviously evaluated; or(3)involveasignificant reduction inamarginofsafety.Eachstandardisdiscussed asfollows:(1)Operation ofthefacilityinaccordance withtheproposedamendment wouldnotinvolveasignificant increaseintheprobability orconsequences ofanaccidentpreviously evaluated.

TheremovaloftheSDCSACIwasevaluated generically byCEintermsofthefrequency ofanISLOCA,theavailability oftheSDCS,andtheeffectonoverpressure transients.

St.LucieUnit1wasenveloped inthisCEeffort.Thereisanegligible increase(0.0984)inthecalculated probability ofanISLOCAeventassociated withACIremoval;however,thisnegligible increaseiscountered byasignificant decrease(394)intheunavailability oftheSDCS.Suchdecreaseinunavailability isduetothereduction inspuriousactuation oftheisolation function.

ThepresentLTOPsystemwillremainavailable tomitigateadesignbasispressuretransient.

ThePORVsarethedevicesreliedupontorelievepressure, nottheSDCSreliefvalves.Regarding SDCSoverpressurization, itis.truethattheACIinitiates anautoclosure oftheSDCSsuctionvalvesonhighRCSpressure.

Overpressure protection oftheSDCSisprovidedbytheSDCSreliefvalveandnotbytheslow-acting suctionvalvesthatisolatetheSDCSfromtheRCS.ThesoledesignbasisoftheACIistominimizethechanceforoperatorerrorinfailuretoestablish adoublebarrierbetweentheRCSandSDCSduringheatup.Thisinterlock willbereplacedbyenhancements tooperating procedures.

Thecurrentalarmswillretaintheiroriginalfunction.

Theseimprovements provideacomparable measureofprotection withouttheriskofspuriousisolation.

Therefore, the

proposedchangeswillnotincreasetheconsequences ofanaccidentpreviously analyzed.

(2)Operation ofthefacilityinaccordance withtheproposedamendment wouldnotcreatethepossibility ofanewordifferent accidentfromanyaccidentpreviously evaluated.

Alarmsandprocedures willinformtheoperators totaketimelyactionswhennecessary therebyfulfilling thesamefunctionastheACI.Thealarmswillbecapableofdetecting equipment

failures, whereastheACIprotectsonlyagainstoperatorerrorasstatedabove.Thechangetothefacilitywillbedisabling currentactivefunctions andchangingcurrentalarmlogicandcircuitry.

Thechangetothealarmandindication isoneofindependence; thefunctions ofeachremainthesame.Noadditions ofequipment aremadethatcouldcreatenewtypesoffailures.

Forthesereasons,thepossibility ofanewordifferent kindofaccidentisnotcreated.(3)Useofthemodifiedspecification wouldnotinvolveasignificant reduction inamarginofsafety.TheSDCSACIfunctionisnotaconsideration inthemarginofsafetyforanyTechnical Specification.

Itisaninterlock intendedtoincreasetheassurance ofSDCSisolation.

RemovalofACIwillsignificantly reducethepossibility ofspuriousSDCSisolation whilethechangestoprocedures andalarmcircuitry inconjunction withretention oftheOPIwillassureproperSDCSisolation.

Forthesereasons,thischangewillnotinvolveasignificant reduction inthemarginofsafetyascurrently definedintheTechnical Specifications.

Basedupontheabove,wehavedetermined thattheamendment requestdoesnot(1)involveasignificant increaseintheprobability orconsequences ofanaccidentpreviously evaluated, (2)createthepossibility ofanewordifferent kindofaccidentfromanyaccidentpreviously evaluated, or(3)involveasignificant reduction inamarginofsafety,andtherefore doesnotinvolveanysignificant hazardsconsideration.

k~lY"Ih'f