ML17227A625

Proposed Tech Specs 4.5.2.d.1,reflecting Removal of Shutdown Cooling auto-closure Interlock Surveillance Requirement

ML17227A625
Person / Time
Site:	Saint Lucie
Issue date:	10/21/1992
From:	FLORIDA POWER & LIGHT CO.
To:
Shared Package
ML17227A624	List: ML17227A623 ML17227A625
References
NUDOCS 9210260315
Download: ML17227A625 (25)

Text

St.LucieUnit1DocketNo.50-335ProposedLicenseAmendmentRemovalofShutdownCoolingAuto-ClosureInterlockSurveillanceReuirementATTACHMENT1St.LucieUnit1Marked-upTechnicalSpecificationPageT/S3/45-492ioi~oii59aio2iPDRADOCK05000335F','DRJ EMERGENCYCORECOOLINGSYSTEMSSURVEILLANCEREUIREMENTS4.5.2EachECCSsubsystemshallbedemonstratedOPERABLE:a.Atleastonceper12hoursbyverifyingthatthefollowingvalvesareintheindicatedpositionswithpowertothevalveoperatorsremoved:ValveNumberl.V-3659rVal'veFunction1.Mini-flowisolationValvePositionl.Open2.V-36602.Mini-fTowisolation2.Openb.Atleastonceper31daysby:l.Verifyingthateachvalve(manual,poweroperatedorautomatic)intheflowpaththatisnotlocked,sealed,orotherwisesecuredinposition,isinitscorrectposition.c.Byavisualinspectionwhichverifiesthatnoloosedebris(rags,trash,clothing,etc.)ispresentinthecontainmentwhichcouldbetransportedtothecontainmentsumpandcauserestrictionofthepumpsuctionsduringLOCAconditions.Thisvisualinspectionshallbeper'formed:.1.ForallaccessibleareasofthecontainmentpriortoestablishingCONTAINMENTINTEGRITY,and2.OftheareasaffectedwithincontainmentatthecompletienofcontainmententrywhenCONTAINMENTINTEGRITYisestablished.d.Atleastonceper18monthsby:3.~e+l~g-aetom&4c-4scka44on-of-@he-shutdown-coo44ng~@stem-from-the-Reac-te~~n4-System-when-the-Reao4.or~~@4-Sys4ear-pressence-46-above-800-ps+g.2.Avisualinspectionofthecontainmentsumpandverifyingthatthesubsystemsuctioninletsarenotrestrictedbydebrisandthatthesumpcomponents(trashracks,screens,etc.)shownoevidenceofstructuraldistressorcorrosion.Verifying(OPI)andisolationproperoperationoftheopenpermissiveinterlockthevalveopen/highSDCSpressurealarmsforvalvesV3651,V3652,V3480,V3481.ST.LUCIE-UNIT13/45-4AmendmentNo.9O 04~L-.~1tlua4a\w'Aa~'ms St.LucieUnit1DocketNo.50-335ProposedLicenseAmendmentRemovalofShutdownCoolingAuto-ClosureInterlockSurveillanceReuirementATTACHMENT2SAFETYANALYSISIntroductionFloridaPowerandLightCompany(FPL)proposestoremovetheauto-closureinterlock(ACI)fromtheshutdowncoolingsystem(SDCS)suctionvalvesatSt.LucieUnitNo.1.ThecurrentdesignprovidesanACIandanopenpermissiveinterlock(OPI)oneachoftheisolationvalvestoreducetheprobabilityofinadvertentconnectionofthereactorcoolantsystem(RCS)totheSDCSwhentheRCSpressureisabovethedesignpressureofthesuctionline(300psig).Motor-OperatedValves(MOVs)V3480andV3481forthe1Asuctionline,andV3651andV3652forthe1Bsuctionline,areinseriesandarecontrolledbytheseinterlocks.EachpairofMOVscreatesadoublebarriertoisolatetheSDCSsuctionlinefromtheRCS.TheOPI,whichisnotaffectedbytheproposedACIdeletion,preventstheSDCSsuctionisolationvalvesfrombeingopenedwhentheRCSisalreadypressurized.TheACIisdesignedtoclosetheSDCSsuctionisolationvalveswhentheRCSpressureincreasesabove300psig.AnalarmcurrentlyexistsforeachtrainofvalvestowarnthecontrolroomoperatorwheneveraSDCSsuctionisolationvalveisnotcompletelyclosedandtheRCSpressureisgreaterthanthesetpoint.RemovaloftheSDCSACIfeatureaddressesCommissionconcernsregardingthepotentialforfailureoftheACIcircuitrywhichcouldcauseinadvertentisolationoftheSDCSwithsubsequentlossofshutdowncoolingcapabilityduringcoldshutdownandrefuelingoperation.Inaddition,theproposedmodificationisconsistentwiththerecommendationsofGenericLetter88-17,"LossofDecayHeatRemoval."TheproposedremovalofACIfeaturesrequiresachangeintheSt.LucieUnitNo.1TechnicalSpecifications(TS).Specifically,TS4.5.2.d.lwillbemodifiedtodeletethesurveillanceoftheACIandaddasurveillanceoftheOPIandtheisolationvalves'larmfunction.

DiscussionTheSDCSisdesignedtoachieveandmaintainacoldshutdownconditionbyremovingresidualenergyfromtheRCSanddecayheatfromthereactorcore.WhiletheRCShasadesignpressureof2500psia,theSDCScomponentshaveadesignpressureof500psigorless.Sincetwopipingsystemsofdifferentdesignpressuresareconnected,suitableisolationcapabilitymustbeprovidedwhentheRCSisbeingoperatedathighpressure.ToensurethatisolationoftheSDCSwillremainineffectafteranycrediblefailurehasoccurred,twoisolationdevicesinseriesareprovidedforeachofthetwoSDCSsuctionlines(V3480andV3481forthe1Asuctionline,andV3651andV3652forthe1Bsuctionline).WhentheSDCSisinuse,thesystembecomesanextensionofthereactorcoolantpressureboundary.Sinceanumberofpressurizationsourcesexistwithinorareconnectedtothehigh-pressureRCS,thelow-pressureSDCSmustbeprotectedagainstpostulatedpressurizationtransientswhenthesystemsareconnected.Toaccomplishthis,eachSDCSsuctionlineisprovidedwithareliefvalve(i.e.,V3468andV3483).Notethatthesereliefvalvesdonotprovideprotectionofthereactorcoolantpressureboundaryagainstbrittlefractureduetopressurizationatlowtemperature.AtSt.LucieUnit1,onlythePowerOperatedReliefValves(PORVs)areusedforLowTemperatureOverpressureProtection(LTOP).OverpressureprotectionoftheSDCSisbasedonthosetransientspostulatedtooccurduringnormalSDCSoperation.ThesuctionlinereliefvalvesarenotintendedtoprotecttheSDCSagainstover-pressurizationasaresultofbeinginadvertentlyexposedtofullRCSpressureduringpoweroperation.Areliefdevicewiththecapacitytoprotectagainstthiseventwouldnotbepractical.ShouldtheSDCSbeexposedtoRCSpressureduringpoweroperation,theSDCScouldruptureatapointoutsidethecontainmentcausinganinterfacingsystemloss-of-coolantaccident(ISLOCA).AppropriatealarmsandtwoinstrumentationinterlocksareusedtoreducetheprobabilityoftheinadvertentconnectionoftheRCStotheSDCSwhentheRCSispressurized.TheseinterlocksaregenerallydescribedinReactorSystemsBranchTechnicalPositionRSB5.1.'hefirstinterlockisdesignedtopreventopeningtheSDCSisolationvalveswhenRCSpressureisabovetheSDCSdesignpressure.Thisfeatureisknownastheopenpermissiveinterlock,orOPI.ItprotectsagainstthespectrumofeventswhichresultfromtheSDCSsuctionisolationvalvesbeingopenedwhentheRCSisalreadypressurizedabovetheSDCSdesignpressure.Theproposeddesignmodificationdoesnotinvolveanychangetothisinterlock.ThesecondinterlockautomaticallyprovidesaclosesignaltotheisolationvalveswhenRCSpressureexceedstheACI,setpointof267psia,ensuringthattheSDCSsuctionwillnotexceed300psig(perTS4.5.2.d.1.).Therefore,shouldthesevalvesbeinadvertentlyleftopenduringRCSheatupandpressurization,theSDCSisolationvalveswouldautomaticallyclose.Thisfeatureisknownasthe auto-closureinterlock,orACI.,RemovalofACIisbeingproposedasawaytodecreasetheprobabilityoflossofshutdowncoolingevents.Aspreviouslydescribed,itisnecessarytohavetwovalvesinseriestoformareactorcoolantpressureboundarysothatnosinglefailurecanresultincompleteloss'ofthisbarrier.ThedoublebarrierisestablishedbytheoperatorclosingbothvalvesoneachSDCSsuctionlinewhengoingfromSDCSoperationtosteamgeneratorcoolingduringplantheatup.Failuretoestablishthisdoublebarrierispossibleduetoafailureofthevalve,valveoperator,valvecontrols,orbyoperatorerror.ApotentialoperatorerroristheclosureofonlyonevalvefollowedbyRCS'ressurization.ItisthisoperatorerrorthatACIs(andalarms)areintendedtoguardagainst.Theinterlockcannotguardagainsthardwaremalfunctions.ThedesignoftheACIpresentsanoptimizationissuebetweentwocompetingsafetyfunctions.WhentheSDCSisneeded,thesuctionvalvesmustremainopen.Failuresresultinginvalveclosureareasafetyconcernduetothelossofdecayheatremoval.Conversely,whenACIactionisrequired,failureswhichleavethevalvesopenadverselyimpactsafetybyoverpressurizingtheSDCS.TheindustryhasexperiencedanumberofspuriousvalveclosureeventscausedatleastinpartbythepresenceoftheACI.AfrequentcauseofspuriousACIactionisaccidentalorintentionalde-energizationofapowersupplyresultingfrommaintenanceworkperformedduringrefuelingoutages.TheACIcircuitcanbeactuatedafterlosinganyofseveralpowersupplies.AsecondcauseforspuriousvalveclosureisanACIactuationfollowingreceiptofaninvalidhighRCSpressuresignalduetotestingthatisusuallyperformedduringrefuelingoutages.ResolutionofissuesrelatedtolossofshutdowncoolingeventshasbeenatopicofincreasingconcerntoboththeNRCandtheindustryforseveralyears.StudieshaveidentifiedspuriousoperationofACIasthemostfrequentcauseofreportedlossofSDCSeventsbetween1976and1983.SpuriousoperationofACIhastwopotentialimpacts.ThemostimmediateresultofvalveclosureislossofSDCSflowandcorrespondinglossofdecayheatremovalfromthecore.IftheSDCSisnotquicklyrestored,theresultantRCStemperaturerisecanresultinpressurizationofaclosedsystemorlossoffluidthroughboilingifthereactorvesselheadisremovedforrefueling.ThesecondresultofvalveclosuremaybesignificantdamagetotheSDCSpumps(i.e.the1Aand1BLowPressureSafetyInjectionPumps)duetolossofsuction.Thiseventisseriousduetothepotentialforcomplicatingtheshort-termrecoveryofcorecoolingandthelongerrepairtime.SinceACIisasignificantcontributortolossofSDCSeventsatotherplants,FPLisproposingremovalofthefeaturefromSt.

• WF.P LucieUnitNo.1.TheNRChasencouragedremovalofACIinGenericLetter88-17.Inthatdocument,theNRCsuggeststhatutilitiesseekingremovalofACIconsidertheapproachtakenbyPacificGasandElectricinremovingtheACIfromtheDiabloCanyonUnits.SafetAssessmentCombustionEngineering(CE)hasevaluatedtheimpactofremovingtheACIfromtheSDCS.TheanalysiswasperformedtodeterminethechangeinISLOCAfrequency,thechangeinSDCSunavailability,andtheimpactonmitigatinglow-temperatureoverpressureeventsduetotheremovalofACI.ThisevaluationaddressessevenguidelinesforACIremovalrecommendedbytheNRCinamemorandumfromB.H.Sharon(Chief,ReactorSystemsBranch)datedJanuary28,1985.Insummary,thefollowingdiscussiondescribeshoweachofthesevenitemsaremet.ItshouldbenotedthatthisdiscussionparallelsthatacceptedbytheNRCforDiabloCanyonandWaterford3.1~MeansavailabletominimizeaLOCAoutsidecontainment.TheSt.LucieUnit1designprovidesforadoublebarrierbetweentheRCSandtheSDCS.Thedesignprovidesaveryhighprobabilitythatatleastonebarriercanbeestablishedandmaintainedunderanypostulatedcondition.Proceduralcontrols,training,alarmsandtheOPIfunctionminimizethepotentialthattheoperatorwillfailtoachievedoubleisolationduringnormalheatupandpressurizationoftheReactorCoolantSystem(RCS),ordefeatitonceestablished.Additionally,theSDCSisprotectedagainstruptureduringanattemptednormalheatupandpressurizationoftheRCSwiththeSDCSsuctionvalvesopenbytheSDCSsuctionreliefvalves.CEprovidedagenericreviewandevaluationofremovingtheACIfunctionasameanstoimproveSDCSreliability.ThisevaluationboundedtheconfigurationatSt.LucieUnitNo.l.ThepresentSDCSconfigurationatSt.LucieUnitNo.1includestwoSDCSsuctionvalvesinseries;thevalveshaveACI,OPIandavalvepositionalarm.Usinggenericprobabilityvaluesandmethodology,CEdemonstratedthatA'CIremovalandincorporationofcertainchangestotheexistingalarmresultsinanegligibleincrease(0.098%)inthefrequencyofInterfacingSystemLossofCoolantAccident(ISLOCA).AmoredetaileddiscussionoftheISLOCAprobabilityisincludedintheresponsetoItem7below.2~AlarmstoalerttheoperatorofanimproperlypositionedSDCSsuctionvalve.AlarmsareprovidedinthemaincontrolroomtoinformtheoperatorifanyoftheSDCSsuctionvalvesarenotfullyclosedwhenRCSpressureisabovetheSDCSoperatingpressure.Thesealarms,locatedonthemaincontrolboards,are t4 annunciatortypewhichprovideoperatorswithbothflashinglightsandaudiblesignals.OperatingprocedureswillcontaintheappropriateresponsetothealarmsanddirecttheoperatortostopincreasingRCSpressureandclosethesuctionvalvesasrequired.Thealarmsetpointswillbetestedatleastonceevery18monthstoensurereliability.Therequirement,forthistestisincludedintheproposedTechnicalSpecification4.5.2.d.1.surveillance.Thealarmsaredesignedtoannunciateuponalarmrelayfailure.3~Verificationoftheadequacyofreliefvalvecapacity.Asapartoftheoriginalsystemdesignprocess,calculationswereperformedtoensurethatthereliefdevicesintheSDCSsuctionlineshadadequatecapacitytopreventoverpressurizingtheSDCSduringpostulatedevents,asdescribedinFSARSection6.3.2.2.6.d.CEreviewedthesecalculationsandconfirmedthatACIwasnotcreditedintheselectionoflimitingeventsormitigationoftheresultingtransients.Therefore,thecalculationsremainapplicablewiththeACIremoved.4~MeansotherthanACItoensurethatbothisolationvalvesareclosed.ThecircuitryforthealarmsdescribedinItem2abovewillbemodifiedtoprovideinputtothealarmforvalvepositionindependentofthevalvecontrolsandpositionindication.Theplant'soperatingproceduresandannunciatorresponseprocedureswillberevisedasrequiredtodirecttheoperatortoverifyvalvepositionandtaketheappropriateactionsifthevalveisnotclosedwhenhighpressureisalarmed(i.e.abovetheSDCSsetpoint).CautionswillbeprovidedasnecessarytodirecttheoperatortonotpressurizetheRCSaboveSDCSdesignpressureunlessbothoftheSDCSsuctionvalvesareclosed.Thesemeanswillensurethatthedoublebarrier(i.e.,twoisolationvalvesinseriesoneachSDCSsuctionline)isestablisheduponheatup.5.AssurancethattheOPIisnotaffectedbyACIremoval.TheOPIfunctionwillbemaintainedinitspresentform,andthisinterlockwillbetestedatleastonceper18monthstoverifyoperability,perTS4.5.2.d.l.6.AssurancethatvalvepositionindicationwillremainavailableinthecontrolroomafterACIremoval.Thevalvepositionindicationcircuit,willbemodifiedtoprovideasafetygradepowersupplyindependentofthevalve'scontrolpower.Thisindicationwillbepresentevenwhen 4Q.Alrrr valveoperationislockedoutduringpoweroperation.Valvepositionindicationisprovidedonthemaincontrolboardandonthecomputerdisplaylocatedinthemaincontrolroom.Additionalindicationthatthevalveisclosedwillbeprovidedbythelackofanalarmat.anypressureabovethealarmsetpoint.7~AssessmentoftheeffectofACIremovalonSDCSavailabilityandlow-temperatureoverpressureevent.AnanalysisoftheimpactofremovingtheACIfromtheSDCSwasperformedtodeterminethechangein:1)InterfacingSystemLOCA(ISLOCA)frequency,2)ThechangeinSDCSunavailability,and3)TheimpactonmitigatingLTOPeventsduetoremovaloftheACI.TheanalysisconsideredboththepresentandproposedconfigurationsoftheSDCS.ThepresentconfigurationconsidersSDCSsuctionvalveswithACIandvalvepositionalarm.TheproposedconfigurationconsiderstheSDCSsuctionvalveswithACIremoved,thesamevalvepositionalarmsetpointinthecontrolroom,andincorporationofnecessaryoperatinginstructionstoensureappropriateoperatorresponsetothevalvepositionalarmistaken.FaulttreeanalysiswasemployedindeterminingtheISLOCAfrequencyandtheSDCSunavailabilityforbothconfigurations.Thebasisfortheconstructionandevaluationofthenecessaryfaulttreemodels,thebasisforquantifyingfrequenciesforISLOCAandSDCSunavailability,andhumanerrorprobabilitiesisdocumentedintheCEevaluation.TheNRChaspreviouslyapprovedACIremovalforseveralplantsutilizingthisapproach,includingWaterford,SanOnofre,andDiabloCanyon.ISLOCAFrequencyResultsTheanalysisresultsforISLOCAfrequencyarepresentedbelow:SDCSConfiurationISLOCAFreuenc1.(Currentconfiguration)1.1188x10'/yearSDCSsuctionvalveswithACIandalarm-2.(Proposedconfiguration)SDCSsuctionvalveswithalarmonly1.1199x10'/yearBecausetheISLOCAfrequencyisgovernedbythecombinedcatastrophicfailure(grossleakagewithoutpositionindication)ofbothsuctionvalves,thereisonlyanegligibleincrease(.098%)inISLOCAfrequencyduetoremovaloftheACI.BasedonearlierNRCinput(tobediscussedbelow)sensitivityanalyseswereperformedtodeterminetheimpactofoperat'or AlJ' errorassumptionsonISLOCAfrequency.BasecaseoperatorerrorprobabilitieswerevariedbyfixedfactorsandISLOCAfrequencyquantifiedwitheachvariation.SincetheISLOCAfrequencyisgovernedbythecatastrophicfailureofbothvalves(ratherthanfromtheoperatorfailingtocloseavalve),thechangeinfrequencywasfoundtobeinsensitivetothevariationsofoperatorerrorprobabilities.InperformingISLOCAanalysesitwasassumedthattheexistingalarmwastestedateachrefueling.AsensitivityanalysiswasperformedtodeterminethepotentialimpactofthisassumptiononISLOCAfrequency.Testintervalsrangingfrom30daysto20yearswereusedforthesensitivityanalysis.ThefrequencyofISLOCAwasfoundtoberelativelyinsensitivetohowoftenthealarmwastested.Asmallincreaseinfrequencyisobservedwhenthetestintervalis5yearsormore.Theproposedchangemaintainsarefuelingoutagetestscheduleforthealarms.Itshouldbenotedthatwithanalarmpresent,asinthecurrentSt.LucieUnitNo.1design,ACIisanegligiblecontributortoreactorsafety.ThedominantcontributortoISLOCAfrequencyisacatastrophicfailureofbothSDCSsuctionisolationvalveswiththereactoratpower.NeitherACInoralarmscanprovidedefenseagainstsuchafailure,noristhattheintendedfunction.Furthermore,thealarmoffersprotectionagainst.equipmentfailures(suchastheSDCSisolationvalvesfailingtoclose);theACIdoesnot.TheCEgenericevaluationdeterminedthatanISLOCAviatheSDCSsuctionlineswhiletheplantisatpowercanoccurbythefollowingmechanisms:a)b)c)d)Bothisolationvalvesinseriesareleftopen;Onemotoroperatedvalveisleftopen,andthesecondmotoroperatedvalveinseriesruptures;Thesecondmotoroperatedvalveisleftopen,andthefirstmotoroperatedvalveinseries'ruptures,or;Bothvalvesrupture.Mechanisma)isnotacredibleinitiatorforanISLOCA.Ifbothvalvesareleftopenduringreactorheatup,theSDCSreliefvalve,locateddownstreamofthetwovalves,willopentorelievetheincreasingpressureanddischargereactorcoolanttothewastemanagementsystemholduptanks.Thesetpointofthereliefvalveis300psig.Uponreliefvalveactuation,indicationsofincreasingholduptanklevelanddecreasingreactorcoolantsystem(RCS)orvolumecontroltanklevelwillalerttheoperatorthattheRCSpressureboundaryhasnotbeensecuredduringheatup.DuetotheseindicationsandtheeffectsofthereliefvalvedischargeuponRCSpressure,heatupwillbesuspendeduntiltheRCSpressureboundaryisestablishedbyclosingtheSDCSsuctionvalves.Leavingbothvalvesinseriesopenisnotconsideredcredible.

• ~I4~q' ThefrequencyofanISLOCArelatedtothetwoSDCSsuctionlinescanthenbeestimatedbaseduponanequationutilizingtheremainingthreemechanisms:(Equation1)F(ISL)=2*(aQ,+aQ,+aQ,)where:F(ISL)aQIQ2Q3FrequencyofISLOCAviaSDCSsuctionlines,peryearCatastrophicfailurerateformotoroperatedvalves(2.716x10~/year)ProbabilitythatthefirstmotoroperatedvalveinseriesisnotclosedProbabilitythatthesecondmotoroperatedvalveinseriesisnotclosedProbabilitythatthesecondmotoroperatedvalvefailsgiventhatfirstmotoroperatedvalvehasfailedTwocases,withandwithoutACI,wereanalyzed:Case1(Currentconfiguration):AlarmandACI.Case2(Proposedconfiguration):Alarmonly.ThesamealarmcharacteristicshavebeenassumedforCase2asCasel.VariableQ,hasthesamevalueforbothCases.FaulttreeanalysesareusedtodetermineQ~andQ.becausebothareMOVs,Q,=Q,.Theresultsare:Q>QzQ3Case11.00x10'.00x10~2.04x10'iCase21.10x10~1.10x10~2.04x10Inallcases,Q,isthedominantterm.Thisterm,representingcatastrophicfailureofbothinitiallyclosedvalves,contributesover99>ofthetotalISLOCAriskforCases1and2.TheincreasesinvariableQ,andQ,forCase2comparedtoCase1areminorandquantifytheeffectsofACIremovalsincethesamealarmcharacteristicsareassumedforbothcases.Case1F(ISL)=1.1188x10'yearCase2F(ISL)=1.1199x10'year(Equation2)4changeinISLOCAfrequencywithACIremoved:FISL-case2-FISL-easelF(ISL-easel)4changeinISLOCAfrequencywithACIremoved=0.098%

SDCSUnavailabilityResultsFortheSDCSunavailabilityanalysis,thepresenceorabsenceofavalvepositionalarmisimmaterial.Forthetwoconfigurationsofconcern,SDCSunavailabilitywasevaluatedforfailuretoprovideshutdowncoolingduringshutdownconditions.Theevaluationincludesfailuretostartandfailuretooperategiventhatthesystemhasstarted.Theresultsarepresentedbelow:SDCSConfiurationSDCSUnavailabilit1.(Presentconfiguration)SDCSsuctionvalveswithACI5.05x10~2.(Proposedconfiguration)3.08x10~SDCSsuctionvalveswithACIremovedTheremovalofACIrepresentsa39%decreaseinSDCSunavailabilityduringrefuelingoperations.EffectonLowTemperatureOverpressureProtection(LTOP)DuringlowRCStemperature(e.g.shutdowncooling)operations,thereactorvesselmaterialismorebrittlethanduringnormaloperation.Becauseofthebrittlenessofthevesselmaterialatlowtemperatures,overpressurizationoftheRCSduringlowtemperatureoperationisofconcern.St.LucieUnitNo.1employstwopressurizerPowerOperatedReliefValves(PORVs)withsufficientcapacitytomitigateLTOPeventsthatmayoccurduringlowRCStemperatureoperations.InordertoboundtheLTOPanalysisassumptions,theTechnicalSpecificationLimitingConditionsofOperation(LCO)requiredisablingcertainpumps(i.e.chargingpumpsorHighPressureSafetyInjectionPumps)tominimizeinadvertentactuation,andlimitReactorCoolantpumpstartsbasedonprimarytosecondarytemperaturedifferential.AlthoughtheSDCSreliefvalveswouldbeavailabletoprovideadditionalreliefcapacityduringanLTOPevent,creditforthesevalvesisnottakenintheanalysisforLTOPmitigationatSt.LucieUnit1.TherelativelyslowstroketimeoftheSDCSsuctionvalvesduringclosureislikewisenotcreditedintheLTOPanalysis.LTOPisthereforeindependentoftheSDCSsuctionlinesatSt.LucieUnitNo.1.BecausethePORV'sprovideLTOP,removalofACIfromtheSDCSsuctionvalvesdoesnotadverselyaffectLTOPperformanceoravailability.TheNRCidentifiedanumberoftransients(industrywide)thatwereinitiatedbyinadvertentclosureoftheSDCSsuctionvalves.RemovalofACIdecreasestheunavailabilityoftheSDCSbyreducingtheprobabilityofinadvertentlyclosingthe.SDCSsuctionvalves.Thus,theprobabilityofapressuretransientduetochargingpumpflowwithoutanyletdownflow

,~gliVlm54AV (e.g.throughtheSDCSsuctionline)isalsoreduced.TheprobabilityofLTOPchallengeswouldthenbereducedwithouttheACI,thusenhancingplantsafety.NRCInputInJanuary1989,theCEOwnersGrouphelditsannualmeetingwithNRCmanagementandtechnicalstaff.AtthatmeetingremovaloftheACIwasdiscussedinsomedetail.TheNRC(AshokThadani)requestedthatsubmittalforACIremovalspecificallyaddresstwoissuesrelatedtoISLOCA:1)thesensitivityoftheanalysestoassumptionsaboutoperatorerrorrates,and2)areviewofthesignificanceoftheDecember1987Biblis-AISLOCAprecursorevent.Asnotedabove,sensitivitystudiesofoperatorerrorrateassumptionswereperformedaspartoftheISLOCAfrequencydeterminations.ItwasfoundthatthechangeinISLOCAfrequencywasinsensitivetooperatorerrorrateassumptions.Theinsensitivityisattributedtothedominantfailuremechanismbeingcatastrophicfailureofbothsuctionvalves.AreviewoftheBiblis-APNReventshowsthattheoperatortriedtocloseamispositionedpressureisolationvalvethatshouldhavebeenclosedpriortoheatup.Theoperatortriedtomanipulatethepressureonthemispositionedvalvebyopeningasecondvalve.Indoingso,apathfromtheRCStotheatmospherewasestablishedresultinginashortdurationrelease.TheSt.LucieUnitNo.1SDCSsuctionvalves(pressureisolationvalves)cannotbeopenedbytheoperatorwhileRCSpressureisaboveshutdowncoolingentryconditions.Theopenpermissiveinterlocks(OPI)preventsuchactionsbytheoperator.TheseinterlockswillremainasanintegralpartoftheSDCSsuctionvalves.Therefore,thesequenceofeventsinvolvingoperatoractionsthatoccurredatBiblis-AisnotexpectedtooccuratSt.LucieUnitNo.1.Theanalysisofthe7itemsidentifiedbytheNRCdemonstratesthattheremovaloftheACIprovidesanetimprovementinplantsafety,because:1)ISLOCAfrequencyisnegligiblyincreased(0.0984);2)SDCSunavailabilityissignificantlyreduced(39~),and;3)LTOPperformanceoravailabilityisnotaffected,howevertheprobabilityofLTOPchallengeswouldbereduced.10 0.fP'f'cfJ'4 St.LucieUnit1DocketNo,50-335ProposedLicenseAmendmentRemovalofShutdownCoolingAuto-closureInterlockSurveillanceReuirementATTACHMENT3DETERMINATIONOFNOSIGNIFICANTHAZARDSCONSIDERATIONThestandardsusedtoarriveatadeterminationthatarequestforamendmentinvolvesnosignificanthazardsconsiderationareincludedintheCommissionsregulations,10CFR50.92,whichstatethatnosignificanthazardsconsiderationsareinvolvedifoperationofthefacilityinaccordancewiththeproposedamendmentwouldnot(1)involveasignificantincreaseintheprobabilityorconsequencesofanaccidentpreviouslyevaluated;or(2)createthepossibilityofnewordifferentkindofaccidentfromanyaccidentpreviouslyevaluated;or(3)involveasignificantreductioninamarginofsafety.Eachstandardisdiscussedasfollows:(1)Operationofthefacilityinaccordancewiththeproposedamendmentwouldnotinvolveasignificantincreaseintheprobabilityorconsequencesofanaccidentpreviouslyevaluated.TheremovaloftheSDCSACIwasevaluatedgenericallybyCEintermsofthefrequencyofanISLOCA,theavailabilityoftheSDCS,andtheeffectonoverpressuretransients.St.LucieUnit1wasenvelopedinthisCEeffort.Thereisanegligibleincrease(0.0984)inthecalculatedprobabilityofanISLOCAeventassociatedwithACIremoval;however,thisnegligibleincreaseiscounteredbyasignificantdecrease(394)intheunavailabilityoftheSDCS.Suchdecreaseinunavailabilityisduetothereductioninspuriousactuationoftheisolationfunction.ThepresentLTOPsystemwillremainavailabletomitigateadesignbasispressuretransient.ThePORVsarethedevicesreliedupontorelievepressure,nottheSDCSreliefvalves.RegardingSDCSoverpressurization,itis.truethattheACIinitiatesanautoclosureoftheSDCSsuctionvalvesonhighRCSpressure.OverpressureprotectionoftheSDCSisprovidedbytheSDCSreliefvalveandnotbytheslow-actingsuctionvalvesthatisolatetheSDCSfromtheRCS.ThesoledesignbasisoftheACIistominimizethechanceforoperatorerrorinfailuretoestablishadoublebarrierbetweentheRCSandSDCSduringheatup.Thisinterlockwillbereplacedbyenhancementstooperatingprocedures.Thecurrentalarmswillretaintheiroriginalfunction.Theseimprovementsprovideacomparablemeasureofprotectionwithouttheriskofspuriousisolation.Therefore,the

proposedchangeswillnotincreasetheconsequencesofanaccidentpreviouslyanalyzed.(2)Operationofthefacilityinaccordancewiththeproposedamendmentwouldnotcreatethepossibilityofanewordifferentaccidentfromanyaccidentpreviouslyevaluated.AlarmsandprocedureswillinformtheoperatorstotaketimelyactionswhennecessarytherebyfulfillingthesamefunctionastheACI.Thealarmswillbecapableofdetectingequipmentfailures,whereastheACIprotectsonlyagainstoperatorerrorasstatedabove.Thechangetothefacilitywillbedisablingcurrentactivefunctionsandchangingcurrentalarmlogicandcircuitry.Thechangetothealarmandindicationisoneofindependence;thefunctionsofeachremainthesame.Noadditionsofequipmentaremadethatcouldcreatenewtypesoffailures.Forthesereasons,thepossibilityofanewordifferentkindofaccidentisnotcreated.(3)Useofthemodifiedspecificationwouldnotinvolveasignificantreductioninamarginofsafety.TheSDCSACIfunctionisnotaconsiderationinthemarginofsafetyforanyTechnicalSpecification.ItisaninterlockintendedtoincreasetheassuranceofSDCSisolation.RemovalofACIwillsignificantlyreducethepossibilityofspuriousSDCSisolationwhilethechangestoproceduresandalarmcircuitryinconjunctionwithretentionoftheOPIwillassureproperSDCSisolation.Forthesereasons,thischangewillnotinvolveasignificantreductioninthemarginofsafetyascurrentlydefinedintheTechnicalSpecifications.Basedupontheabove,wehavedeterminedthattheamendmentrequestdoesnot(1)involveasignificantincreaseintheprobabilityorconsequencesofanaccidentpreviouslyevaluated,(2)createthepossibilityofanewordifferentkindofaccidentfromanyaccidentpreviouslyevaluated,or(3)involveasignificantreductioninamarginofsafety,andthereforedoesnotinvolveanysignificanthazardsconsideration.

k~lY"Ih'f