ML17228B190

Joint Applications Rept for Safety Injection Tank Aot/Sti Extension.

ML17228B190
Person / Time
Site:	Saint Lucie
Issue date:	05/31/1995
From:	ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY, ASEA BROWN BOVERI, INC., C-E OPERATING PLANTS OWNERS GROUP
To:
Shared Package
ML17228B188	List: ML17228B187 ML17228B189 ML17228B190
References
CE-NPSD-994, NUDOCS 9506280128
Download: ML17228B190 (34)

Text

COMBUSTION ENGINEERING OWNERSGROUPCENPSD-994W/PSLl~PSLl~'lLINc%eHS

%laBIE63.21)JointApplications ReportforSafetyInjection TankAOT/STI.Extension FinalReportGEOGTASK836preparedfortheC-EOWNERSGROUPMay1995eCopyright 1995Combustion Engineering, Inc.AllrightsreservedABBCombustion Engineering NuclearOperations 9506280128 950621PDRADOCK05000335PPDRllewElDQDliQQDQD LEGALNOTICEThisreport'was preparedasanaccountofworksponsored bytheCombustion Engineering OwnersGroupandABBCombustion Engineering.

NeitherCombustion Engineering, Inc.noranypersonactingonitsbehalf:A.makesanywarrantyorrepresentation, expressorimpliedincluding thewarranties offitnessfora,particular purposeormerchantability, withrespecttotheaccuracy, completeness, orusefulness oftheinformation contained inthisreport,orthattheuseofanyinformation, apparatus, method,orprocessdisclosed inthisreportmaynotinfringeprivately ownedrights;orB.assumesanyliabilities withrespecttotheuseof,orfordamagesresulting fromtheuseof,anyinformation, apparatus, methodorprocessdisclosed inthisreport.Combustion Engineering, Inc.

TABLEOFCONHPG'SSectionPage1.0LISTOFTABLESPURPOSE2.0SCOPEOFPROPOSEDCHANGESTECHNICAL SPECIFICATIONS 23.04.0BACKGROUND SUhQUlARY OFAPPLICABLE TECHNICAL SPECIFICATIONS 5.06.04.1StandardTechnical Specifications 4.2,"Customized" Technical Specifications SYSTEMDESCRIPTION ANDOPERATING EXPERIENCE 5.1SystemDescription 5.2Operating Experience TECHNICAL JUSTIFICATION FORAOTFZCZENSION 6.1Statement ofNeed6.2Assessment ofDeterministic Factors9106.2.1Thermal-Hydraulic Considerations 6.2.2Radiological ReleaseConsiderations 6.3Assessment ofRisk1011136.3.16.3.26.3.36.3.46.3.56.3.6OverviewAssessment of"AtPower"RiskAssessment ofTransition RiskAssessment ofShutdownRiskAssessment ofLargeEarlyReleaseSummaryofRiskAssessment 1314202323246.4Compensatory Measures24 TABLEOFCONTENTS(cont'd)SectionPage7.08.09.0.10.06.5Technical Justification forAOTExtension forPlantOperation withaFunctionally OperableSIT6.5.1SITTaggedINOPHVLBLE duetoLevelandPressureInstrumentation Malfunction 6.5.2SITBoronConcentration OutofRangeJUSTIFICATION FORSURVEILLANCE TESTIN'IERVAL (ST/MODIFICATION PROPOSEDMODIFICATIONS TONUREG-1432 SUMMITRYANDCONCLUSIONS 9.1Functionally INOPERABLE SIT9.2Functionally OPERABLESITREFERENCES 252525262728282829ATI'ACHMENT A"Mark-up" ofNUREG-1432 SECTIONS3.5.1&B3.5.1A-1TableLISTOFTABLESREQUIREDENTRYINTOLCOACTIONSTATEMENTS DUETOSITMALFUNCTIONS FORCEPWRsPage6.3.2-16.3.2-26.3.3-1CEOGPROPOSEDAVERAGECDFsTRANSITION RISKCONTRIBUTIONS FORSITCM1922CEOGAOTCONDITIONAL CDFCONTRIBUTIONS FORSITs-CM18 SafetyInjection Tank(SIT)ROT/STIExtension 1.0PUNG.'OSE Thisreportprovidestheresultsofanevaluation ofspecificrelaxations intheexistingSafetyInjection Tank(SIT)boronsurveillance requirements andtheAllowedOutageTime(AOT).Theserequirements andAOTarecontained withinthestandardand"customized" technical specifications foranylicensedCENSSS.Atwotieredextension oftheexistingSITAOT(typically 1hour)to24hoursforanon-functional SIT,and72hoursfora"tagged"inoperable SITthatcanotherwise completeitssafetyfunctionisrequested inordertoprovidetheplantwithsufficient timetodiagnoseandpotentially repairminorSITsystemmalfunctions atpower.Theabilitytoperformthiscorrective maintenance atpowercanenhanceplantsafetybyavertinganunplanned plantshutdown.

Also,technical specification relaxation withregardtoboronmonitoring issoughtinordertoallowbetterutilization ofplantresources byreducingthenumberofunnecessary surveillance actions.Thisrelaxation hasbeenpreviously recommended bytheNRCinNUREG-1366 (Reference 1).Justification oftheserequestsarebasedonareviewandassessment ofplantoperations, deterministic anddesignbasisconsiderations, andplantrisk,aswellaspreviousgenericstudiesandconclusions drawnbyNRCstaffandcontained withinNUREG-1366 (Reference 1)andNUREG-1432, Revision0(Reference 2).Theevaluation discussed inthisreportconcludes thattherequested Technical Specification modifications areeitherriskneutralorenhanceoverallplantsafety.ThisrequestforAOTextension isconsistent withtheobjectives andtheintentoftheMaintenance Rule(Reference 3).TheMaintenance Rulewillbethevehiclewhichcontrolstheactualmaintenance cyclebydefiningunavailability performance criteriaandassessing maintenance risk.TheAOTextension willallowefficient scheduling ofmaintenance withintheboundaries established byimplementing theMaintenance Rule.TheCEplantsareintheprocessofimplementing theMaintenance Rule,andarepresently settingtargetsforunavailability ofsystemsandtrains.Therefore, thiseffortisseenastimely,supportive andintegraltotheMaintenance Ruleprogram.

2.0 SCOPEOFPROPOSEDCHANGESTOTECHNICAL

SPECIFICATION Theproposedtechnical specification changesaddressrevisingtheexistingrequirements fortheoperation oftheSafetyInjection Tanks(SITs).Specifically, theproposedchangestothetechnical specification requirements are:Ingeneral,extendAOTforasingleINOPKl4kBLE SITfrom1hourto24hours.Foroperating modeswhereatleastthreeoftheSlTsarerequiredtobeOPERABLE, extendtheAOTfollowing adiagnosis ofasingleinoperable SITfrom1hourto24hours.(2)WhenasingleSITisINOPERABLE andthatINOPERABILITY isduetoeithermalfunctioning SITwaterlevelinstrument indication ormalfunctioning SITnitrogenoverpressure pressureindication, orinadequate boronconcentration, extendtheAOTfollowing thediagnosis ofthesingleINOPF24L,BLE SITfrom1hourto72hours.Thistechnical specification changewithregardtoSITinstrumentation failureswasrecommended inSection7.4ofICJREG-1366, AumlaorWatervlrhnIrvillceRirmnWR.Therelaxationintheboron concentration AOThasalreadybeenadoptedintheImprovedStandardTechnical Specifications.

Thischangewouldaddanewconditional Limiting'Condition ofOperation requirement thatwouldaddressthecasewhereasingleSlTisinoperable ANDtheaffectedSIT'sinoperability iscausedbymalfunctioning waterlevelinstrumentation, malfunctioning pressureinstrumentation, orboronconcentration.

(TheaffectedSITisotherwise capableofperforming itsintendedfunction.)

Thecompletion timeforrestoring theoperability oftheaffectedSITwillbe72hours.Modifyboronconcentration technical specification surveiHance testinterval(STI)Eliminate technical specifications surveillance requirements thatrequireverification ofboronconcentration ofsafetyinjection tankinventory afteravolumeincreaseof1%ormoreifthemakeupwaterisfromtherefueling waterstoragetank(RWST)andtheRWSTboronconcentration isequalto,orgreaterthantheminimumboronconcentration oftheSIT.Thischangeinsurveillance testrequirements hasalreadybeenadoptedintheImprovedStandardTechnical Specifications (ISTS).

3.0 BACKGROUND

InresponsetotheNRC'sinitiative toimproveplantsafetywhilegrantingrelieftoutilities fromthoserequirements thataremarginaltosafety,theCEOGhasundertaken aprogramofobtaining relieffromoverlyrestrictive technical specifications.

Aspartofthisprogram,severaltechnical specification AOTsandSTIswereidentified forjointaction.Thisdocumentaddresses theSITportionofthisTask,andprovidessupportformodifying theSITAOTandimplementing theNUTMEG-1366 "lineitemimprovement" withregardtoboronconcentration monitoring.

Thisreportprovidesgenericinformation supporting thesechangesaswellasthenecessary plantspecificinformation todemonstrate theimpactofthesechangesforeachoftheCEplants.Thesupport/analytical materialcontained withinthedocumentisconsidered applicable toallCEOGmemberutilities regardless ofthecategory/type oftheirPlantTechnical Specifications.

4.0 SUMGQtYOFAPPLICABLE

TECHNICAL SPECIFICATIONS Therearethreedistinctcategories ofTechnical Specifications atCENSSSplants.ThefirstcategoryiscalledtheStandardTechnical Specifications.

ThroughFebruary1995,NUREG-0212, Revision03commonlyreferredtoas"Standard Technical Specifications" hasprovidedamodelforthegeneralstructure andcontentoftheapprovedtechnical specifications atallotherdomesticCENSSSplants.Thesecondcategorycorresponds totheImprovedStandardTechnical Specifications (ISTS)guidancethatisprovidedinNUEEG-1432, Revision0,datedSeptember 1992.Alicensing amendment submittal tochangetheTechnical Specifications forSanOnofreNuclearGeneration StationUnits2&3toimplement thisguidancewassubmitted totheNRCinDecember1993.Additionally, licensing amendment submittals arebeingdeveloped thatwillmodifythetechnical specifications forPalisades Stationtoimplement theISTSguidance.

Thethirdcategoryincludesthosetechnical specifications (TSs)thathavestructures otherthanthosethatareoutlinedineitherNUREG-0212 (Reference 4)orNUREG-1432 (Reference 2).TheseTSsaregenerally referredtoas"customized" technical specifications.

TheCENSSSplantsthatcurrently have"customized" technical specifications are:Palisades Station,MaineYankeeStation,andFt.CalhounStation.Eachofthesethreecategories ofTechnical Specifications includessimilaroperating requirements fortheSafetyInjection Tanks(SITs).4.1StandardTechnical Specifications Currently NUTMEG-0212, Revision03specifies thefollowing requiredactionswhenasingleSITis"INOPERABLE":

ITY'ODESI,2d3~AI+~a.Withonesafetyinjection tankinoperable, exceptasaresultofaclosedisolation valve,restoretheinoperable tanktoOPERABLEstatuswithinonehourorbeinatleastHOTSTANDBYwithinthenext6hoursandinHOTSEPTI'DOWN withinthefollowing 6hours.b.Withonesafetyinjection tankinoperable duetotheisolation valvebeingclosed,eitherimmediately opentheisolation valveorbeinatleastHOTSTANDBYwithinonehourandbeinHOTSHVZDOWNwithinthenext12hours.

TheguidanceofNUREG1432Section3.5.1relaxestheserequirements fromNUREG-0212 inthefollowing ways:1.Theallowedoutagetimeforasingleinoperable SITduetothatSIT'sboronconcentration beingoutsidethespecified bandisextendedfrom1hourto72hours.2.Theallowedoutagetimeforasingleinoperable SITduetofactorsotherthanboronconcentration (including indication thattheSIT'sisolation valveisnotfullyopen)isextendedfrom"immediate" restoration to1hour.AmongthefactorsthatcanresultinasingleSITnotbeingtechnically "OPERABLE" arethefollowing factors:a)Malfunctions ofpressuretransmitters, pressuresensinglines,andpressuremonitoring circuitry, b)Malfunctions ofleveltransmitters, levelsensinglines,andlevelmonitoring circuitry.

InSection7.4ofNUREG-1366, theNRCstaffstatesthatanSIT(an"accumulator"

)wouldbe"available tofulfillitssafetyfunction" attimeswhentheSIT("accumulator"

)is"technically inoperable" duetothe"inoperability ofwaterlevelandpressurechannels".

4.2Customized Technical Specifications Similarrequirements tothoseidentified inSection4.1existforplantswithcustomized technical specifications.

However,theformatofthetechnical specification maybedifferent asmaybethedetailedrequirement.

Themostnoteworthy difference inthisareaisthatforMaineYankee.SITAllowedOutageTimesatthisplantallowasingleSITtobetechnically inoperable forupto4hoursandisolatedforuptoonehour.

5.0SYSTEMDESCRlI.TIONANDOPERATING EXPI<2EENCE 5.1SystemDescription ThefunctionoftheSafetyInjection Tank(SIT)systemistorefloodthereactorcorewithboratedwaterfollowing alargebreakLOCA.Therelatively quickresponseofthesystemanditspassivenatureservetoreliablyminimizecoredamageuntiltheSIpumpscanprovideadequatewaterforreactorcooling.EachSITtrainhasonesafetyinjection tankconnected toanRCScoldleg.Thetankisfilledwithboratedwaterandpressurized bynitrogencovergas.SITinjection occursanytimeRCSpressuredropsbelow'over gaspressure.

Thedischarge pipingofeachtankincludesacheckvalvefollowedbyanisolation MOVwhichremainsopenduringnormaloperation.

Beyondthesevalves,anRCSpressureboundarycheckvalveexistsalongtheinjection pathwayforeachtankDefinition ofOPERABLESITIngeneral,Technical Specification LimitingConditions ForOperation (LCOs)requirethatallSITsbeOPPOSABLE whenevertheplantisinpoweroperation (ModeI),transitioning topoweroperation (Mode2)orinMode3withRCSpressuregreaterthanorequaltoadesignated value.ThisLCOisbasedontheassumption thatwhentheplantisinanyofthesemodesofoperation, theSITsmusthavethesamefunctionability thatwouldberequiredforaLOCAatfullratedthermalpower.InordertoavoidentryintotheLCOactionstatement, allSITsmustbeOPERABLE.

Whentheplantisinanyoftheselistedmodesofoperation, anSITisconsidered OPERABLEwhenthefollowing conditions exist:.1)2)3)4)5)theassociated isolation valveisfullyopen,electricpowerhasbeeninterrupted tothemotorfortheassociated isolation valve,waterinventory inthetankiswithintheassumedbandtheboricacidconcentration ofthewaterinventory ofthetankiswithintheassumedband,thenitrogencoverpressurewithinthetankiswithintheassumedband.Inthepast,ajustification fortheshortallowedoutagetimeforasingleSIThasbeenthattheperceived severityoftheconsequences ofnothavingallSITsavailable toprovidepassiveinjection duringadesignbasisLOCAwarranted theseverityofthisrequirement.

However,thisshortSITAOTdurationwasbasedsolelyonengineering judgmentandnotonanyquantitative assessment ofrisk.

Whileitisnottheintentofthisdocumenttowidenthetechnical specification OPERABILITY limitsfortheSIT;itisimportant tonotethatforselectedparameters, theassessment ofSITOPERABILITY isratherstringent.

TheSIToperational parameters aresetbythedesignbasislicensing LargeBreakLOCAanalysis.

SincetheSITisapassivedeviceandprovidesalimitedfunction, operability hasbeenrestricted tomeanthattheequipment initialconditions arewithinabandsupported byAppendixKdesignbasisanalyses.

Inreality,theequipment candeviateconsiderably frombothinventory andpressurerequirements withoutcompromising theabilityoftheplanttoadequately respondtoaLOCA.Inventory requirements areoverstated.

AppendixKanalytical modelsarederivedsoastoover-estimate amountofliquidlostoutthebreakandtounderestimate theresidualinventory intheRVlowerplenum.Consequently, inventory discharge requirements areconservatively setatahighlevel.Thenitrogencoverpressureessentially establishes thetimingoftheinventory injection.

Thiswouldmodestlyinfluence thetransient andperhapsresultinamarginalfuelhotspottemperature increase.

52Operating Experience Operating experience hasdemonstrated thatmanyofthecausesofSITinoperability canbediagnosed andcorrected withinseveralhoursofdiscovery butlongerthanaperiodofonehourfromidentification.

Inseveralinstances, diagnosis ofout-of-specification conditions haveleadtoplantshutdowns.

AlistofeventsthatinvolvedanSITandrequiredentryintoassociated LCOactionstatements isprovidedinTable5.3-1forCEPWRs.Thereviewofthisoperating experience aswellasageneralreviewofexistingPRAstudiesledtoquestioning thepremisethatatransition toalowermodewithin1hourofthediscovery ofafactormakingoneSITinoperable wouldprovidegreaterreactorsafetythanrepairing thisfactorwiththeplantatpower.Infact,aletterfromtheNRCtoHoustonLight&Power(Reference 9)providesanapprovedcasewheretheallowedoutagetimeforasinglesafetyinjection tank[accumulator]

wasextendedfrom1hourto12hours.Asignificant justification forthisextension wasthattheresulting changeinthecalculated valuesofexpectedandmaximumcoredamagefrequency werenegligible.

Previousdeterminations oftheallowedoutagetimeforasingleSafetyInjection TankatCENSSSplantshavebeenbasedonengineering judgement usingasoundhiowledge oftheroleofeachoftheSITsintheplantdesignbasis.Anynewdetermination ofthisallowedoutagetimeusingprobabilistic riskanalysismustalsoincludethisconsideration.

Table5.2-1REQUISXDEN'IRYINTOLCOACTIONSTATEMENTS DUETOSITMALFUNCTIONS FORCEPWRsSanOnofre2SanOnofre2SanOnofre3PaloVerde2MiHstone2SanOnofre2SanOnofre3SanOnofre3DateofEvent8/29/841/28/867/25/877/17/866/29/8112/23/831/25/832/5/83Description ofEventNitrogenCoverPressureexceededthelimitsofLCO3.5.1,twoSITSweredeclaredinoperable andLCO3.0.3wasinvoked.PressureLimitExceeded, LCO3.0.3entered.LCO3.5.1enteredduetoSITlevelinstrumentation.

UnitinMode4(hotstandby)whenTechSpecLCO3.0.3enteredduetofour(4)SITsdeclaredINOPERABLE becausehighlevellimitwasexceededbasedonwiderangelevelindication.

Duringroutinepoweroperation, inconsistency foundbetweenSITVolumerequiredbyTSLCO3.5.1.Bandtheindication available todetermine SITOperability.

SITs007and010exceededtheirnitrogenpressurelimitwhileSIT008wasbeingfille.EnteredLCO3.0.3.Duringroutinenitrogenpressurization ofSIT008,reliefvalvelifted(failedtoreseatfollowing overpressurization).

Tankpressuredroppedbelowallowable limitsofLCO3.5.1andactionstatement Awasinvoked.SITtankvolumeandpressureoutsideallowable limitsofLCO3.5.1andactionstatement Awasinvoked.

6.0 TECHNICAL

JUSTIFICATION FORAOTEXTENSION Thissectionprovidesanintegrated.

assessment oftheproposedextension oftheSITAOTfromitscurrently definedvalueof1hourto24hours.ThisproposedAOTwouldbeapplicable intheevent.anSITisdetermined tobeINOPERABLE andthecauseoftheinoperability has~nbeendiagnosed asbeingcausedsolelybymalfunctioning levelorpressuremeasurement instrumentation (Seeitem1ofSection2).Adiscussion oftheAOTextension forcircumstances wheretheSITistaggedINOPERABLE (basedonTechnical Specifications Criteria) butisotherwise functional ispresented inSection6.5.6.1Statement ofNeedAswasbrieflymentioned inSection5.2,therepairofcertainfactorsthatresultinthe"inoperability" ofasinglesafetyinjection tankcanbecompleted withinarelatively shortperiodofnomorethan24hours.Operating experience hasdemonstrated thattherepairofsuchfactorstakeslongerthantheexisting1hourallowedoutagetimethatistypicalofexistingTechnical Specifications forCENSSSplantsthathavenotimplemented theguidanceofNUREG-1432.

Thesectionsthatfollowshowthatthecontinued implementation oftheexisting"1hour"AOTmayresultinunnecessary plantshutdowns.

Sincetheincreased riskofoperating withasingleSIToutofserviceisnegligible (asdescribed inthefollowing sections),

theassociated plantmaneuvertoashutdowncondition willlikelyincreaseplantriskabovethatwhichwouldotherwise existiftherepairofthecauseofthe"inoperability" wascompleted atpower.Atwenty-four hourAOTwasconsidered sufficient forthediagnosis ofapotential SITINOPERABLE condition andminorcomponent repair.Additionally, Section7.4ofNUREG-1366 identifies caseswhereentriesintocontainment havebeenmadeatpowertorecalibrate asingleSITwaterlevelorpressuretransmitter whilearedundant, independent instrument remainedoperable.

Inthesecases,thecontainment entrywasmadeinanticipation ofasituation wherebothinstruments weresimultaneously inoperable, resulting inanallowedoutagetimethatwasinsufficient forremaining atpowerwhileperforming repairsandrecalibrations.

WithalongerdurationAOTforbothredundant instrument

channels, therewouldbelessneedforcontainment entriesatpowersolelyfortherecalibration ofasinglewaterlevelorpressurechanneltransmitter.

6.2Assessment ofDeterministic Factors6.2.IThermal-Hydnmlic Considemtions Thefunctions oftheSafetyInjection Tanks(SITs)aretosupplywatertothereactorvesselduringtheblowdownphaseofalossofcoolantaccident(LOCA),andtoprovideinventory tohelpaccomplish therefillphasethatfollowsthereafter.

TheblowdownphaseofalargebreakLOCAistheinitialperiodofthetransient duringwhichtheRCSdepartsfromequilibrium conditions, andheatfromfissionproductdecay,hotinternals, andthevesselcontinues tobetransferred tothereactorcoolant.Theblowdownphaseofthetransient endswhentheRCSpressurefallstoavalueapproaching thatofthecontainment atmosphere.

TherefillphaseofaLOCAfollowsimmediately aftertheblowdownphase.Thecoreattheendoftheblowdownphaseisessentially inadiabatic heatup.Intherefillphase,thebalanceoftheinventory intheSITsisavailable tohelpfillthelowerplenumandthereactorvesseldowncomer tore-establish acoolantlevelatthebottomofthecoreandthentosupportrefloodofthecorewiththeadditionofsafetyinjection water.EachSITisapressurevesselpartially filledwithboratedwaterandpressurized withnitrogengas.EachSITisapassivecomponent, sinceitisintendedtoperformitsdesignfunctionwithoutoperatororcontrolaction.EachSITwillstarttodischarge itscontentstotheRCS,ifRCSpressuredecreases belowtheSITpressure.

EachSITispipedintoonereactorcoolantsystem(RCS)coldlegviatheinjection linesutilizedbytheSafetyInjection (HPSIandLPSI)system.EachSITisisolatedfromtheRCSbyamotoroperatedisolation valveandtwocheckvalvesinseries.Theassociated motoroperatedisolation valveforeachSITisnormallyopen,withpowerremovedfromthevalvemotortopreventinadvertent closurepriortoorduringanaccident.

Additionally, eachoftheseisolation valvesisinterlocked withthepressurizer pressureinstrumentation channelstoensurethatthevalveswillautomatically openasRCSpressureincreases aboveSITpressureandtopreventinadvertent closurepriortoanaccident.

Eachofthesevalvesalsoreceivesasafetyinjection actuation signal(SIAS)toopen.Thesefeaturesensurethatthesevalvesmeettherequirements oftheInstitute ofElectrical andElectronic Engineers (IEEE)Standard279-1971for"operating bypasses" andthattheSITswillbeavailable forinjection withoutrelianceonoperatoraction.Thenitrogengasandwatervolumes,nitrogengaspressures, andoutletpipesizesforeachSITareselectedtoallowtheSITstogetherwiththeHPSIandLPSIsystemstorecoverwaterinventory inthecorebeforesignificant cladmeltingorzirconium waterreactioncanoccurfollowing aLOCA.10 TheSITcapacityisestablished suchthattheSITsprovideadequateinventory tothedowncomer andfacilitate thecorerecoveryandrefillprocess.Inparticular, passiveinjection byallbutoneoftheSITsiscreditedindesignbaseanalysisforlargebreakLOCAsthatareinitiated atfullratedthermalpowerconditions.

TheotherSITisassumedtobeineffective duetothebreaklocation.

Theperformance ofSITsiscalculated inaccordance withAppendixKto10CFR50and,togetherwiththeHPSIandLPSIsystems,ensuresthatthefollowing Emergency CoreCoolingSystem(ECCS)acceptance criteriaof10CFR50.46aresatisfied:

a.Maximumfuelelementcladdingtemperature is(2200DegreesFahrenheit; Maximumcladdingoxidation is(0.17timesthetotalcladdingthickness beforeoxidation; C.Maximumhydrogengeneration fromazirconium waterreactionis(0.01timesthehypothetical amountthatwouldbegenerated ifallofthemetalinthecladdingcylinders surrounding thefuel,excluding thecladdingsurrounding theplenumvolume,weretoreact;andd.Thecoreismaintained inaeoolablegeometry.

Theabovecriteriawereestablished inordertodefineadeterministic acceptance criteriathatmaybeusedbyregulators injudgingtheacceptability ofagivenEmergency CoreCoolingSystem.Themethodology isdefinedinAppendixKto10CFR50.Thismethodology conservatively represents LOCA.thermohydraulic andhydrodynamic phenomenology tocalculate fuelpeakcladtemperature.

Asaresult,thismethodology overstates therealistic minimumequipment requirements foradequateresponsetoanevent.RecentbestestimateanalysesforatypicalPWR(Reference 5)confirmed thatforlargebreakLOCAs,coremeltcanbeprevented byeithertheoperation ofoneLowPressureSafetyInjection (LPSI)pumportheoperation ofoneHighPressureSafetyInjection (HPSI)pumpandasingleSIT.Whilethepreciseequipment setforanyspecificCEPWRmayvary,thedesignbasisrequirement for1LPSItrain,1HPSItrain,andallSITstoavertacoremeltcondition isveryconservative.

6.2.2Radiological ReleaseConsiderations Thedesignbasiscalculation ofradiological consequences ofthelargeLOCAarebasedonacombination ofveryconservative assumptions.

Thedesignbasisforradiological releasesfollowing aLOCAissetforthin10CFR100,"ReactorSiteCriteria",

anddetailedinSRP15.6.5(Reference 6).Inpractice, the10CFR100radiation releasecriteriaareachievedviarelianceonthe1962"sourceterm"outlinedintheAtomicEnergyCommission Technical Information

Document, TID-14S44, "Calculation ofDistanceFactorsforPowerandTestReactors" (Reference 7).This"SourceTerm"wasnotconsistent withthelowlevelofcoredamageexpectedwithaLargeLOCA.Instead,theSourceTermwasveryconservatively definedbasedonasubstantial meltdownofthecore,andfissionproductreleasetothecontainment.

11 Overthepast30years,substantial information hasbeendeveloped updatingourknowledge aboutfissionproductreleaseandtransport duringPWRsevereaccidents.

Thisinformation isrefiected inthenewNRCsourcetermdefinedinNUREG-1465 (Reference 8).Assimilation ofthisinformation suggeststhatevenwhenthedichotomy ofacoremeltdrivensourcetermisretained, theestimateoftheLargeLOCAfissionproductreleasesbasedonReference 7considerably overpredicts theseverityofthefissionproductreleasetothepublic.Thisconclusion isbasedonthefollowing:

1)Current'licensing methodsassumefissionproductarereleasedtothecontainment immediately upontheonsetoftheLOCA.Infact,onlygasesresidingwithinthefuelgap(approximately 5%ofthetotalvolatilefissionproductinventory) willbereleasedatthepointofcladrupture(earlyinthetransient).

Theremainder ofthefissionproductswillenterthecontainment overtheperiodofonehalfhourormore.2)Currentlicensing methodsassumethecomposition oftheiodineenteringthecontainment ispredominantly elemental (aswasthenbelievedtobethephysicalsituation).

Spraysarelesseffective inremovingelemental iodinethaniodineintheparticulate form.Itisourcurrentunderstanding thattheiodineispredominantly (greaterthan95%)releasedintothecontainment intheformofCsIwhichisparticulate.

Thus,sprayeffectiveness andgravitational settlingwouldbeenhancedandairbornereleasesfromcontainment woulddecrease.

Thus,evenifaLargeLOCAweretooccurwithouttherequisite designbasisnumberofSITs,theactualfissionproductreleaseswouldbeexpectedtobewellwithintheexisting10CFR100criteria.

Thisissueisfurtherconsidered inaprobabilistic framework inSection6.3.5.12 6.3Assessment ofRisk6.3.1OverdewThepurposeofthissectionistoprovideanintegrated assessment oftheoverallplantriskassociated withadoptionoftheproposedAOTextension.

Themethodology usedtoevaluatetheSITAOTextension wasbasedinpartonadraftversionofthe"Handbook ofMethodsforRisk-BasedAnalysesofTechnical Specifications, Reference 10.Asguidancefortheacceptability ofaTechnical Specification modification, itwasnotedthatanyproposedTechnical Specification change(andtheultimatechangepackage)shouldeither:(1)beriskneutral,OR(2)resultinadecreaseinplantrisk(via"risktrade-off considerations"),

OR(3)resultinanegligible (tosmall)increaseinplantrisk.(4)beneededbytheutilitytomoreefficiently and/ormoresafelymanageplantoperations.

Astatement ofneedhasbeenprovidedinSection6.1.Thissectionaddresses theriskaspectsoftheproposedAOTextension.

Inthisevaluation, ariskassessment oftheSITAOTextension isperformed withrespecttoassociated "atpower"and"transition" risks.Section6.3.2providesanassessment oftheincreased riskassociated withcontinued operation withasingleSIToutofservice(OOS).Theevaluation ofthe"atpower"riskincrement resulting fromtheextendedSITAOTwasevaluated onaplantspecificbasisusingthemostcurrentindividual plant'sProbabilistic SafetyAnalysis(PSA)modelfortheirrespective baselines.

Plantspecificevaluations wereperformed byeachparticipating utility.Resultsoftheseevaluations werethencomparedusingappropriate riskmeasuresasprescribed inReference 10.Section6.3.3providesanassessment ofriskoftransitioning theplantfromMode1intoalowermode(e.g.Mode4).The"atpower"riskassessment providesonlyonefacetoftheplantrisk.Forthisevaluation, continuation ofatpoweroperation withtheLCOactionstatement iscomparedwiththeriskofproceeding withaplantshutdown.

Alowerboundtothistransition riskwasevaluated bymodifying thereactortripcoremeltscenarioforarepresentative CEPWR.Basedonthisanalysis, acoredamageprobability fortheplantshutdownwasestablished andcomparedtothesingleAOTriskassociated withcontinued operation.

13 Forcompleteness, theimpactoftheextendedAOTontheplantlargeearlyreleasefractionisqualitatively assessed.

Theassessment includesanevaluation oftheeventsleadingtolargeearlyfissionproductreleasesandtheroleoftheSITintheinitiation and/ormitigation ofthoseevents.Thisassessment ispresented inSection6.3.5.6.3.2Assessment of"AtPower"RiskMethodology Thissectionprovidesanassessment oftheincreased riskassociated withcontinued operation withasingleSIToutofservice(OOS).Theevaluation ofthe"atpower"riskincrement resulting fromtheextendedSITAOTwasevaluated onaplantspecificbasisusingthemostcurrentindividual plant'sProbabilistic SafetyAnalysis(PSA)model.Plantspecificevaluations wereperformed byeachparticipating utility.Resultsoftheseevaluations werethencomparedusingthefollowing riskmeasures(fromReference 10):AverageCoreDamageFrequency (CDF):TheaverageCDFrepresents thefrequency ofcore-damage occurring.

InaPSAmodel,theCDFisobtainedusingmeanunavailabilities forallstandby-system components.

CoreDamageProbability (CDP):TheCDPrepresents theprobability ofcore-damage occurring.

Core-damage probability isapproximated bymultiplying core-damage frequency byatimeperiod.Conditional Core-Damage Erequency (CCDig:TheConditional CDFistheCoreDamageFrequency (CDF)conditional uponsomeevent,suchastheoutageofequipment.

Itiscalculated byre-quantifying thecutsetsafteradjusting theunavailabilities ofthosebasiceventsassociated withtheinoperable equipment.

IncreaseinCoreDamageFrequency (hCDg:TheincreaseinCDFrepresents thedifference betweentheCCDFevaluated foronetrainofequipment

~navailabl minustheCCDFevaluated foronetrainofequipment nooufrtetrmaintenance

.FortheSITs:hCDE=Conditional CDF+srrm~~>>-Conditional CD'iTuocoaftorTfitowhereCDF=CoreDamageFrequency (peryear)SingleAOTRiskContribution:

TheSingleAOTRiskcontribution istheincrement inriskassociated withatrainbeingunavailable overaperiodoftime(evaluated overeitherthefullAOT,orovertheactualmaintenance duration).

Intermsofcoredamage,theSingleAOTRiskContribution istheincreaseinprobability ofcore-damage occurring duringtheAOT,oroutagetime,givenatrainisunavailable fromwhenthetrainisnot outfortestormaintenance.

Thevalueisobtainedbymultiplying theincreaseintheCDFbytheAOToroutagetime.SingleAOTRisk=4CDFx~where,4CDF=IncreaseinCoreDamageFrequency (peryear),andr=fullAOToractualmaintenance duration(years)YearlyAOTRiskContributio:

TheYearlyAOTriskcontribution istheincreaseinaverageyearlyriskfromatrainbeingunavailable accounting fortheaverageyearlyfrequency oftheAOT.Itisthefrequency ofcore-damage occurring peryearduetotheaveragenumberofentriesintotheLCOActionStatement peryear.Thevalueisestimated astheproductoftheSingleAOTRiskContribution andtheaverageyearlyfrequency (f)ofenteringtheassociated LCOActionStatement.

Therefore:

YearlyAOTRisk=SingleAOTRiskxfwheref=frequency (events/year)

Incremental changesintheseparameters areassessedtoestablish theriskimpactoftheTechnical Specification change.Calculation ofConditional CDF,SingleandYearlyAOTRiskContributions EachCEOGutilityuseditscurrentProbabilistic SafetyAnalysis(PSA)modeltoassesstheConditional CDFbasedonthecondition thatoneSITisunavailable.

Eachplantverifiedthattheappropriate basiceventsarecontained inthePSAcutsetsusedtodetermine theAOTriskcontributions.

Thisverification wasperformed asthefirsttaskincalculating theConditional CDFs.IfbasiceventshadbeenfilteredoutofthePSAcutsets,oneofthetwomethodsdescribed belowwereusedtoensurethecalculation ofConditional CDFwascorrectorconservative:

Selectthebasiceventforthefailuremodeofthecomponent withthehighestfailureprobability torepresent thetrainifthetest/maintenance failuremodeofthecomponent hadbeenfilteredout;or2.Retrievecutsetscontaining relevantbasiceventsatthesequencelevelandmergethemwiththefinalPSAcutsets.15 TheConditional CDFgiven1SITis~n'mphilIwasobtainedbyperforming thefollowing steps:Setthebasiceventprobability forthefailuremodeforacomponent intheunavailable SITtrainequalto1.00,2.Setanybasiceventprobabilities forotherfailuremodesforthattrainequalto0.0,and3.Requantify thePSAcutsets.TheConditional CDFgiven1SITisnfrrmaintenan wasobtainedbysettingthebasiceventprobability forthefailuremodeforoneSITequalto0.0andrequantifying thePSAcutsets.ThisConditional CDFwaseffectively equaltothebaselineCDF(CDFresulting fromtheplant'scurrentPSAmodel)fortheSITsforallCEplants.Itwasexpectedthattheresultswouldbesymmetric forselecting anyoneofthefourSITstobeoutformaintenance.

However,incaseswheredifferent modelingassumptions ordatawereassociated witheachSIT,thentheConditional CDFswereevaluated foreachSIT,andthemostconservative resultwasused.TheConditional CDFwasthenusedtocalculate theincreaseinCDFandthentheSingleAOTRiskContribution (Conditional CDFxfullAOT)foreachplant.TheSingleAOTwascalculated basedonthefullAOTduetotheshortdurationoftheAOT;i.e.,nothinglessthanfullAOTwasassumedformaintenance durationforboththecurrentandproposedSingleAOTRiskcalculations.

TheSingleAOTRiskContribution wasthenusedtocalculate theYearlyAOTRiskContribution (SingleAOTRiskxfrequency).

Maintenance frequency wasnotexpectedtochangebasedonanextendedAOT,sothemaintenance frequency fortheproposedAOTisthesamefrequency asthecurrentAOT.Thefrequency usedfortheYearlyAOTRiskContribution calculation is0.35peryear(totalforallSITs).ThisvalueisbasedonactualdataforentryintotheSITLCOActionStatement forarepresentative CEplantandiseitherconservative oraccurateforeachCEplant.Table6.3.2-1providestheConditional CDFs,andtheSingleandYearlyAOTRiskContributions foreachplant.16 Calculation ofAverageCDFInordertocalculate theAverageCDFfortheextendedSITAOT,anewvalueforSITunavailability duetotest/maintenance wasestablished, whichaccounted fortheperformance ofon-linecorrective maintenance assuminga24hourmaintenance duration(i.e.,thefullproposedSITAOT).ThePSAcutsetswerethenrequantified basedonthisnewunavailability toobtaintheAverageCDFforthenewSITunavailability of24hoursperyear.ThisnewAverageCDFwasthencomparedtothebasecasevaluefromtheplant'sPSAmodel.Table6.3.2-2providestheproposedAverageCDFandthebaseAverageCDFforeachplant.ResultsTheresultsfromeachplantwereassimilated, andtheSingleAOTandYearlyAOTRiskswerecalculated foreachplant.Tables6.3.2-1and6.3.2-2presenttheresultsofthesecasesonaplantspecificbasis,andsummarizes'he SITAOTCDFcontributions foreachplant.Theseriskcontributions includetheConditional CDFs,IncreaseinCDF,SingleAOTandYearlyAOTrisks,andcurrentandproposedAverageCDFs.Differences inresultsareprimarily duetovariations inLargeLOCAinitiating eventfrequency andtheassociated successcriteria.

PlantsthatusedtheLargeLOCAdeterministic successcriteria(i.e.;allSITsrequiredtomitigateLargeLOCA)combinedwithahighLargeLOCAinitiating eventfrequency (e.g.,5.0E-04peryear)inthePSAresultedinanoverlyconservative estimation ofSITimportance.

Evenforplantswithmorestringent successcriteria, theresultsoftheanalysesindicatethattheSingleandYearlyAOTRiskContributions arenegligible orsmallforallplantsbyextending theSITAOTfrom1to24hours,andtheAverageCDFisvirtually unchanged.

17 Table6.3.2-1CEOGAOTCONDITIONAL CDFCONTRIBUTIONS FORSITs-Corrective Maintenance PARAMETER ANO-2CalvertFortMainoMillstono Palisades CliffsCalhounYankee*21&2PaloSanVczdeOnofm1,2Ec32&,3St.Lucia1St.LucioWaterford 23SITSuccessCriteria3of43of4**3of3tounbmkcnlegs1of2tounbmkenlegs2of3tounbmkcnlegs3of3tounbmkcnlegs**2of3tounbmkcnlegs3of4tounbmkenlegs3of43of43of3tounbmkenlegsPzescntAOThzs11PmposcdAOT,hzs2424Conditional CDF,peryr4.12E455.53E44(1SITunavailable)

Conditional CDF,pcryr 3.28E452.11E44(1SH'otoutformaintenance) 2.18~7AOE451.18E457.40E453.41E455.47E454.88E453.41E455.15E454.74E454.02E442.74E452.2E442.2E442.14E452.35E456.53E45InczeaseinCDF,peryr8.3&E463.42E441.00E45negligible ncgligiblo 3.20E461.40E463.75E44'4.99E45N.OE-OOSingleAOTRisk(basedon9.57E-103.90E48CurrentfullAOT)1.14E49negligible ncgligiblo 3.65E-101.60E-104.28E482.3E482.3E485.70E49;.-:,':Siii'gl'e';.'p~-;.Rishi"'{based ion"".'".""-.2'30BWe KR37E4V""""

"'."'74B4&".:>

.>m..':.ih"'c%i:neghgib1o'".'."n'cghgiblo',""

,'&8!77E49@

P3',"84Bj8.':g

~::1!03B46;:,:

'j~@l3Z 847~YearlyAOTRisk,pcryr3.35E-101.37E48(basedonCurrentfullAOI).QQE-10negligiblo DowntimeFrequency, peryr0.35s***0.35****0.35****Q35sss>>Q35sasaQ35sssanegligiblo 1.2&E-105.59E-11035ssse1.50E48Q35sasaQ35ssse&E49Q35essa1.99E49YearlyAOTRisk,pcryr8.04E493.2&E47(basedonProposedfullAOT).59E-09negligiblo ncgligiblo 3.07E491.34E493.59E471.9E471.9E474.78E48*SITswczonotmodeledinPSA,impactjudgednegligible duotosuccessczitcziac*Successcriteriavariesbasedondetailsofscenario*ca4houzsforSIToutofspeo<<as*Basedonactualdataforzepzescntativo CEplant18 Table6.3.2-2CEOGPROPOSEDAVERAGECDFSPARAMETER ANO-2CalvertCliffs1&,2FortMaineCalhounYankee*Millstone 2Palisades PaloVerde1,2%3SanOnofm28@3St.LucioISt.Lucio2Waterford 3SITSuccessCriteriaPresentAOThrsPmposcdAOT,hrsProposedDowntime, hrs/yr3of4.3of4s*3of3tounbmkenlegsIof2tounbrokenlegs2of3tounbmkenlegsAssume243of3tounbmkcnIcgas*2of3tounbmkcnlegs3of4tounbmkenlegs3of43of43of3tounbmkenlegsAverageCDF,pcryr(PSAcase)AverageCDF,peryr(Pmposcd) 3.28E4)53.28E452.II'.18'.40E4)5 2.IIEMI.ISEES7AOE453.41E453.4IE455.ISED4.74E4)52.74E455.16E454.74E452.85E452.14E452.4E4152.35E451.54E452.6E451.56E45*SITswerenotmodeledinPSA,impactjudgednegligible duetosuccesscriteria**Successcriteriavariesbasedondetailsofscenarioas*4hoursforSIToutofspec19 6.3.3Assessment ofTraiisition RiskForanygivenAOTextension, thereistheoretically an"atpower"increaseinriskassociated withit.Thisincreasemaybenegligible orsignificant.

Acompleteapproachtoassessing thechangeinriskaccountsfortheeffectsofavoidedshutdown, or"transition risk".Transition Riskrepresents theriskassociated withreducingpowerandgoingtohotorcoldshutdownfollowing equipment failure,inthiscase,oneSITbeinginoperable.

Transition riskisofinterestinunderstanding thetradeoffbetweenshuttingdowntheplantandrepairing theSITwhiletheplantcontinues operation.

Theriskoftransitioning from"atpower"toashutdownmodemustbebalancedagainsttheriskofcontinued operation andperforming corrective maintenance whiletheplantisatpower.Toillustrate thispoint,arepresentative CEPWRhasperformed ananalysisfortransition riskassociated withoneinoperable SIT.Themethodology andresultsobtainedbythisplantarepresented belowandareconsidered generically applicable totheotherCEplants.Thephilosophy behindthetransition riskanalysisisthatifaplantcomponent becomesunavailable, theCDFwillincreasesincelessequipment isnowavailable torespondtoatransient ifoneweretooccur.However,aslongastheplantremainsatpower,thisCDFisconstant.

Atthepointintimethatadecisionismadetoshutdown,theCDFincreases sincea"transient" (manualshutdown) hasnowoccurred, andtheequipment isstilloutofservice.TheCoreDamageProbability (CDP)associated withtheriskofplanttransition fromplantfullpoweroperation toshutdownisobtainedbymodifying the"uncomplicated reactortrip"coredamagescenariointhePSAmodel.Inthisevaluation theincremental riskisdominated bytheincreased likelihood oflossofmainfeedwater andtherelianceonauxiliary (and/oremergency) feedwater toavertacoredamageevent.Acutseteditorwasusedtoadjustcutsetsrepresenting manualshutdownormiscellaneous planttripstoreflecttheCDPassociated withaforcedshutdownassumingoneSITisoutofserviceandrequantifying thePSAcutsets.Conservatisms thathadbeenincludedinthebasePSAmodelweredeletedtoreflectthegreatercontrolthattheplantstaffhasintheshutdownprocess.Specifically, thebaselinePSAmodelassumedtotallossofmainfeedwater (MFW)within30minutesofreactortrip.Inthetransition

analysis, MPiVwasassumedtoberecoverable following failureofAuxiliary Feedwater.

Ahumanerrorprobability (valueof0.1)wasaddedtocutsetsthatcontained nobasicevents,including humanactions,thatwouldcauseMFWtobeunavailable.

Thedurationofthetransition processwasassumedtobe12hours(6hourstohotstandbyand6hourstohotshutdown).

Additional humanerrorsthatwouldbeassociated withadetailedportrayal oftheshutdownprocessandtheentryintoshutdowncoolingwerenotincludedinordertoestablish aconservative lowerboundassessment ofthetransition risk.Errorsofcommission, suchasdiversion ofRCSflowduringSDCvalvealignment, arealsonotconsidered inthisanalysis.

20 Sucherrorswouldaddtothedisadvantages oftheshutdownalternative, andtherefore, toincludethemwouldbenon-conservative forthepurposeofthiscomparison.

Basedontheabovemethodology theCDPassociated withthelowermodetransition wascalculated fortherepresentative planttobe1.00E-06.

Resultsoftransition riskanalysescanbegeneralized fortheotherCEPWRsbyassumingthattheratiooftheCDPforTransition RisktothebaselineAverageCDFisconstantforallplants.ThebaselineCDFswereselectedratherthantheConditional CDFsfortheratiobetweentheotherCEplantsbecausetheanalysisfortherepresentative plantindicated thattransition riskwas,moreafunctionofLossofMFWratherthanafunctionofthespecificequipment outofservice.Resultsoftransition riskanalysescanbegeneralized fortheotherCEPWRsbyassumingthattheratiooftheCDPforTransition RisktothebaselineAverageCDFisconstantforallplants.Thatis,5CDP~~=(CDF~/CDF

~*hCDP~fpgzpf)where:~CDPmgCDF~CDFCD'orrygaatIncremental riskduetomodetransition forplantBaselineCDFforplantRepresentative plantbaselineCDFIncremental riskduetomodetransition forrepresentative plantThetransition riskmaybeusedtoevaluatetherelativerisksofperforming SlTrepairatpowertothatofperforming thesamerepairatsomelowermode.Theriskofcontinued operation forthefulldurationoftheAOTisboundedbythesingleAOTriskforCM.Thecomparable riskofthealternate maintenance optioninvolvesconsideration offourdistinctriskcomponents:

(1)Riskofremaining atpowerpriortoinitiating thelowermodetransition.

Thisriskwillvarydepending ontheabilityofthestafftodiagnosetheSITfault.(2)Riskoflowermodetransition.

Thisriskisaccumulated overashorttimeinterval(approximately 12hours).(3)Riskofcontinued lowermodeoperation withanimpairedSIT.Inthismode,thereactorisshutdownandthecoreisgenerating decaypoweronly.However,risksinthismoderemainsignificant.

Depending ontheparticular operational mode,resources tocopewithplanttransients willtypically belessthanatpower.Thesemodesarecharacterized bydecreased restrictions onsystemoperability, longertimesfor21 operatorrecoveryactions,lowerinitiating frequency forpressuredriveninitiators (suchasLOCA)andagreaterfrequency forplanttransients suchasthoseinitiated bylossofoffsitepowerandlossofmainfeedwater.

(4)RiskofreturntopowerThepowerascension procedure isawellcontrolled transient.

Reference (10)conceptually discusses thatrisksassociated withthistransition aregreaterthanthoseassociated withatpoweroperation, butsignificantly belowthatassociated withtheinitiallowermodetransition (item2).Theanalysisoftransition riskpresented inthisreportquantifies onlytheriskoflowermodetransition (item2).ResultsTable6.3.3-1presentstheriskassociated withtransitioning theplanttoalowermodeforeachplant.Thenumbersinthetablerepresent onlythelowermodetransition riskcomponent ofthetransition sequence(item2).ForallCEplants,theriskassociated withthistransition portionisnearlyequaltoorexceedsthatriskthatwouldbeincurredfora24hour"atpower"(SingleAOTRiskfromTables6.3.2-1)SITmaintenance period.Whenthefullmodetransition processisconsidered, itisexpectedthatSITmaintenance atpowerforthefull24hourAOTisriskbeneficial forallCEPWRs.Table6.3.3-1TRANSITION RISKCONTRIBUTIONS FORSITCMCalvertCliffs1dh2FortCalhounStationMaineYankeeh6llstone 2Palisades PaloVerde1,28h3SanOnofre28h3St.Lucie1St.Lucie2Waterford 3Transition RiskContribution (ECDP)6.92E<74.45E462.49E-071.56E467.19E471.09M%1.00M)65.78E474.51E%7-4.96E%73.25E%722 6.3.4Assessment ofShutdownRiskShutdownriskbenefitswerenotcreditedfortheSITAOTExtension request.6.3.5Assessment ofLargeEarlyReleaseAreviewoflargeearlyreleasescenarios fortheCEPWRsindicates thatearlyreleasesariseasaresultofoneofthefollowing classesofscenarios:

1.Containment BypassEventsTheseeventsincludeinterfacing systemLOCAsandsteamgenerator tuberuptures(SGTRs)withaconcomitant lossofSGisolation (e.g.stuckopenMSSV).2.SevereAccidents accompanied bylossofcontainment isolation Theseeventsincludeanysevereaccidentinconjunction withaninitially unisolated containment.

3.Containment Failureassociated withEnergetic eventsintheContainment.

Eventscausingcontainment failureincludethoseassociated withtheHighPressureMeltEjection(HPME)phenomena including directcontainment heating(DCH)andhydrogenconflagrations/detonations.

Ofthethreereleasecategories, Class1tendstorepresent alargeearlyreleasewithpotentially direct,unscrubbed fissionproducts, totheenvironment.

Class2eventsencompass arangeofreleasesvaryingfromearlytolatethatmayormaynotbescrubbed.

Class3eventsresultinahighpressurefailureofthecontainment, typically immediately uponorslightlyafterreactorvesselfailure.DetailedLevel2analysesfortheplantcondition with1potentially inoperable SIThavenotbeenperformed.

However,assessment oftheexpectedchangeinthelargeearlyreleasefractionwasmadebyassessing theimpactofoneSITontheaboveeventcategories.

Basedonthisreview,itwasestablished thatinoperability ofoneSITwouldnotimpactClass1events.Theseeventsarecharacterized byanirrecoverable lossofreactorinventory alongwithanymakeupoutsideofcontainment.

Coredamagefortheseeventsisinevitable withoutacontinuous permanent makeupwatersource.Theavailability oftheSITsdoesnotsignificantly altertheeventprogression.

AsmallincreaseinClass2eventscouldoccurwhenanunmitigated largeLOCAoccursinconjunction withaninitially unisolated containment.

Significant fissionproductreleaseswouldnotoccurunless,thecontainment isunscrubbed (thatisspraysareinoperable).

Thislatercombination ofeventsisconsidered ofverylowprobability.

Class3eventsaredominated byRCStransients thatoccurathighpressure.

TheseeventsexcludethosewhereSITperformance wouldbecalledforandtherefore SITstatusisnotacontributor tothiseventcategory.

Itistherefore concluded thatincreased unavailability ofoneSITwillresultinanegligible impactonthelargeearlyreleaseprobability forCEPWRs.23 6.3.6SummaryofRiskAssessment Themajorcontributor todifferences inplantresultsfortheSITsissuccesscriteria.

Evenforplantswithmorestringent successcriteria, theresultsoftheanalysesindicatethatthereisonlyasmallincreaseinriskbyextending theSITAOTfromIto24hours.Theresultsofthisstudyalsoindicatethatperforming SITmaintenance atpowerversusatshutdowncanresultinadecreaseinoverallplantrisk.ThisisbecausetheCDPforcontinued operation oftheplantatpowerwithoneSITinoperable islessthantheCDPassociated withshuttingdowntheplant.Inoperability oftheSITwasfoundtonotsignificantly impactthethreeclassesofeventsthatgiverisetolargeearlyreleases.

Theseincludecontainment bypasssequences, severeaccidents accompanied bylossofcontainment isolation, andcontainment failureduetoenergetic eventsinthecontainment.

Itistherefore concluded thatincreased unavailability oftheSITwillresultinanegligible impactonthelargeearlyreleaseprobability forCEPWRs.Inconclusion, fromariskperspective, increasing theoutofservice(OOS)durationforasingleSIThasanegligible impactonriskfromeitheraninstantaneous orcumulative (yearly)basis.6.4Compensatory MeasuresInadditiontotheinformation described above,eachCEOGplantconsidered maintenance interactions orcompensatory actionsthatcouldbeperformed ifthechangeinriskduetotheextendedAOTwasnotriskneutral.BecauseoftheshortAOTfortheSITs,noextraordinary compensatory actionsweredetermined toberequiredwhenoneSITisoutofserviceformaintenance.

However,asforany"atpower"maintenance, thegoalsshouldbeexpediency andsafety.Therefore, operability oftheotherSITsshouldbeverifiedpriortotakingtheSITout-of-service.Also,talangoneSITout-of-service shouldnotcoincidewiththescheduled removalofadditional ECCSplantcomponents fromservice.24 6.5Technical Justification forAOTExtension forPlantOperation withaFunctionally "Operable" SITThissectionaddresses twolineitemrelaxations previously identified asgenerically acceptable inpreviousNRCdocuments.

Thesechangesaredefinedinitem2ofSection2,andallowanextendedAOTof72hoursforconditions wheretheSITisfunctional butanINOPERABLE tagisrequiredduetoeither:1)malfunctioning pressureorlevelinstrumentation or2)theSITboronconcentration isoutofthetechnical specification limit.Relaxation ofthisAOTduetoinoperable levelorpressureinstrumentation hasbeenrecommended forimplementation intotheTSsbytheNRCinReference 1.Therelaxation ofAOTrequirements duetoboronconcentration inasingleSIThasbeenreviewedgenerically bytheNRCandacceptedforusewithintheImprovedStandardTechnical Specifications (Reference 2).Ineithercase,theSITisfunctional andcanperformitsintendedfunctionthroughout theextendedAOT.TheseTSrelaxation requestsarediscussed below.6.5.1SITTaggedINOPER4BLE duetoLevelandPressureInstrumentation M~unction Section7.4ofNUREG-1366 (Reference 1)providesthefollowing non-riskrelatedjustification

.foraspecificAOTextension from1hourto72hoursforasingleSITwhenthatinoperability iscausedsolelybymalfunctioning levelinstrumentation orsolelybymalfunctioning pressureinstrumentation:

"Thecombination ofredundant levelandpressureinstrumentation

[foranyspecificSIT]mayprovidesufficient information sothatitmaynotbeworthwhile toalwaysattempttocorrectdriftassociated withoneinstrument ifthereweresufficient timetorepaironeintheeventthatasecondonebecameinoperable.

Becausetheseinstruments donotinitiateasafetyaction,itisreasonable toextendtheallowable outagetimeforthem.The[NRC]staff,therefore, recommends thatanadditional condition beestablished forthespecificcase,whereOneaccumulator isinoperable duetotheinoperability ofwaterlevelandpressurechannels,'n whichthecompletion timetorestoretheaccumulator tooperablestatuswillbe72hours.Whiletechnically inoperable, theaccumulator wouldbeavailable tofulfillitssafetyfunctionduringthistimeand,thus,thischangewouldhaveanegligible increaseonrisk."6.5.2SITBoronConcentration OutofRangeIntheImprovedStandardTechnical Specifications ofNUREG-1432, theallowedoutagetimeforoneSITisextendedfrom1to72hourswhenthe"inoperability" ofthesubjectSITisdueonlytotheboricacidconcentration ofthetank'scontentsbeingoutsidethespecified bandfor"OPERABILITY."

SectionB.3.5.1ofNUREG-1432 providesjustification forthisextension.

ITheAOTextensions definedinthissectionapplytotheidentification ofanINOPERABLE SITwhichremainsfunctionally capableofperforming itssafetyfunction.

Therearenocontradictions betweenthisargumentandrisk-related arguments forageneralAOTof24hoursthatarediscussed inSection6.

7.0 JUSTIFICATION

FORSURVEILLANCE TESTINTERVAL(STI)MODIFICATION Item3ofSection2(SCOPEOFPROPOSEDCHANGESTOTECHNICAL SPECIFICATIONS) proposestomodifythetechnical specifications associated withperforming boronconcentration observations whenthesourceofSITmakeupwaterisfromtheRWSTwithaknownboronconcentration thatisequaltoorgreaterthantheknownboronconcentration oftheSIT.Thistechnical specification changewasoriginally proposedbytheNRCinSection7.1ofNUREG-1366, Reference 1.Item3isconsidered generictoa11CEPWRs.TheCEOGtherefore endorsesarecommendation thatwhenplant-specific Technical Specifications areamendedtoimplement thecumulative guidanceofNUTMEG-1432, LCO3.5.1andSection8.1.4ofthisNUREG,theguidanceinSR3.5.1.4ofNUTMEG-1432 (Attachment A)shouldbeimplemented atthesametime.NUREG-0212, Revision03includesthefollowing requirement inSR4.5.1.1:"b.Atleastonceper31daysandwithin6hoursaftereachsolutionvolumeincreaseofgreaterthanorequalto(1)%oftankvolumebyverifying theboronconcentration ofthesafetyinjection tanksolution."

Thecomparable Surveillance Requirement inNUREG-1432, SR3.5.1.4states,"Verifyboronconcentration ineachSITis)t'1500]ppmand(l2800]ppm."Thespecified frequency forthissurveillance is:"31daysAND-NOTE--Onlyrequiredtobeperformed foraffectedSIT26 Oncewithin6hoursaftereachsolutionvolumeincreaseof>[1]%oftankvolumethatisnottheresultofadditionfromtherefueling watertank"Theremovaloftherequirement tosampletheaffectedSITsforboronconcentration within6hoursofavolumetransferfromtherefueling waterstoragetankissupported bythefollowing statement fromSection7.1ofNUTMEG-1366:

"Normalmakeuptoanaccumulator

[safetyinjection tank]comesfromtherefueling waterstoragetank(RWST)whichisalsoborated.Nodilutioncanbecausedbyaddingwaterfromthissourceaslongastheminimumconcentration ofboronintheRWSTisgreaterthanorequaltotheminimumboronconcentration intheaccumulator."

Section7.1ofNUREG-1366 goesontostate:"Recommendation Itshouldnotbenecessary tover'ifyboronconcentration ofaccumulator inventory afteravolumeincreaseof1%ormoreifthemakeupwaterisfromtheRWSTandtheminimumconcentration ofboronintheRWSTisgreaterthanorequaltotheminimumboronconcentration intheaccumulator, therecentRWSTsamplewaswithinspecification, andtheRWSThasnotbeendiluted."

Thebasescommentary concerning SR3.5.1.4ofNUIT-1432, Revision0supportsthisrecommendation whenitstatesthefollowing:

....SamplingtheaffectedSITwithin6hoursaftera1%volumeincreasewillidentifywhetherin-leakage hascausedareduction inboronconcentration tobelowtherequiredlimit.Itisnotnecessary toverifyboronconcentration iftheaddedwaterisfromtheRWT,becausethewatercontained intheRWTiswithintheSITboronconcentration requirements.

Thisisconsistent withtherecommendations ofNUTMEG-1366

..."8.0PROPOSEDMODIFICATIONS TONUREG-1432 Attachment AincludesproposedchangestoNUREG-1432 Sections3.5.1andB3.5.1thatcorrespond tothefindingsofthisreport.27

9.0 SUMMARYANDCONCLUSIONS

9.1Functionally INOPERABLE SITThePSAresultsfromeachoftheCEPWRsshowedthattheincrement inriskatpowerduetooneinoperable SITissmallforallplants.TherangeofresultsforSingleAOTRiskbasedonthefullproposedAOTof24hoursvariedfromnegligible to4.09E-08.

Themajorcontributor toanydifferences inplantresultsfortheSITsisthesuccesscriteriaassumedinthePSAmodeLIncomparison, theincrement inrisk'associated withtransitioning theplantfromatpowertoshutdownmodewithoneSITinoperable isontheorderof1.00E-06.

Theseresultsindicatethatthereisalowerrisktotheplantbyremaining atpowertoperformcorrective maintenance thantoshutdowntheplanttorepairtheinoperable SIT.Therefore, itisconcluded thatextending theAOTforoneinoperable SITfrom1to24hourswouldberiskbeneficial.

RecentbestestimateanalysesforatypicalPWR(Reference 5)confirmed thatforlargebreakLOCAs,coremeltcanbeprevented byeithertheoperation ofoneLowPressureSafetyInjection (LPSI)pumportheoperation ofoneHighPressureSafetyInjection (HPSI)pumpandasingleSIT.Whilethepreciseequipment setforanyspecificCEPWRmayvary,thedesignbasisrequirement for1LPSItrain,1HPSItrain,andallSITstoavertacoremeltcondition isveryconservative.

Whileitisnottheintentofthisdocumenttowidenthetechnical specification OPERABILITY

'imitsfortheSIT,itisimportant tonotethatforselectedparameters, theassessment ofSITOPERABILITY isratherstringent:

TheSIToperational parameters aresetbythedesignbasis.Operating experience hasdemonstrated thatmanyofthecausesofSITinoperability canbediagnosed andcorrected withinseveralhoursofdiscovery butlongerthanaperiodofonehourfromidentification.

Therestrictive natureofthepresentAOThasledtoanumberofentriesintotheLCOactionstatements andplantshutdowns.

ThisreportproposesthattheSITInoperable AOTbeextendedto24hours.Thistimeintervalisbelievedtobesufficient toenabletheplantpersonnel toproperlydiagnosethecauseoftheSITmalfunction andeffectminorrepairs.Anevaluation ofthedeterministic andprobabilistic effectsofextending theAOTto24hoursindicates thattheextension iseither"riskbenefiicial" oratleast"riskneutral".

9.2Functionally OPERABLESITTheCEOGendorsesarecommendation that,whenplant-specific Technical Specifications areamended,thecumulative guidanceofNUREG-1432 LCO3.5.1andNUREG-1432 SR3.5.1.4(Attachment A)shouldbeimplemented simultaneously.

,28 10.0REHHUPTCES 1.NUREG-1366, "Improvements toTechnical Specifications Surveillance Requirements",

December1992.2.3.4.5.NUREG-1432, "Standard Technical Specifications Combustion Engineering Plants",September 1992.10CFR50.65,AppendixA,"TheMaintenance Rule".NUREG-0212, "Revision 3,"Standard Technical Specifications forCombustion Engineering Pressurized WaterReactors",

July9,1982.LWW-02-094, LetterfromL.Ward(INEL)toDr.F.Eltawila(NRC),

Subject:

"UseofMAAPtoSupportUtilityIPEInVesselandEx-Vessel AccidentSuccessCriteria",

June1994.6.7.NUREG-0800, USNRCStandardReviewPlan,Rev.2,July1981.TID-14844, "Calculation ofDistanceFactorsforPowerReactorSites",USAEC,1962.8.NUREG-1465, "Accident SourceTermsforLightWaterReactors" (FinalDraft),August,1994.9.LetterfromSusanC.Black(NRC)toWilliamT.Cottle(HoustonLightEcPower),"Issuance ofAmendment Nos.59and47toFacilityOperating LicenseNos.NPF-76andNPF-80andRelatedRequests-SouthTexasProject,Units1and2(TACNos.M76048andM76049)",

March17,1994.10.NUREG/CR-6141, BNL-NUREG-52398, "Handbook ofMethodsforRisk-Based AnalysesofTechnical Specifications",

P.K.Samanta,I.S.Kim,T.Maiikamo, andW.E.Vesely,Published December1994.11."Technical Evaluation ofSouthTexasProject(STP)AnalysisforTechnical Specification Modifications, P.Samanta,G.Martinez-Guridi, andW.Vesely,Technical Report¹L-2591,January11,1994.29 t