ML062760367

Application for Technical Specification Change Regarding Main Steam Isolation Valves (LCO 3.7.2)

ML062760367
Person / Time
Site:	Palo Verde
Issue date:	09/26/2006
From:	Mauldin D Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-05574-CDM/SAB/RJR
Download: ML062760367 (33)

Text

10 CFR 50.90 LAM David Mauldin Mail Station 7605 Palo Verde Nuclear Vice President Tel: 623-393-5553 PO Box 52034 Generating Station Nuclear Engineering Fax: 623-393-6077 Phoenix, Arizona 85072-2034 102-05574-CDM/SAB/RJR September 26, 2006 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Units 1, 2 and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Application for Technical Specification Change Regarding Main Steam Isolation Valves (LCO 3.7.2)

Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) hereby requests to amend Operating Licenses NPF-41, NPF-51, and NPF-74 for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3, respectively. The proposed amendment would modify technical specification (TS) requirements for the main steam isolation valves (MSIV) Limiting Condition for Operation (LCO) 3.7.2 by adding Conditions, Required Actions and Completion Times for the MSIV actuator trains. These changes are considered to be necessary based on a proposed NRC staff interpretation that results in declaring an MSIV inoperable with one actuator train inoperable. The completion time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for an inoperable MSIV is not commensurate with the safety significance of a single inoperable actuator train, therefore, new Conditions, Required Actions and Completion Times for inoperable actuator trains are being proposed. is the notarized affidavit for the proposed amendment. Enclosure 2 provides the description and assessment of the proposed change. Attachment I to the Enclosures provides TS pages marked up to show the proposed change and provides the retyped TS pages. Attachment 3 provides the TS Bases pages marked up to show the proposed change.

In accordance with the PVNGS Quality Assurance Program, the Plant Review Board and Offsite Safety Review Committee have reviewed and concurred with this proposed amendment. By copy of this letter, this submittal is being forwarded to the Arizona Radiation Regulatory Agency (ARRA) pursuant to 10 CFR 50.91 (b)(1).

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance

/i UDI Callawav 0 Comanche Peak 0 Diablo Canyon

• Palo Verde 0 South Texas Proiect

• Wolf Creek

ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Application for Technical Specification Change Regarding LCO 3.7.2, Main Steam Isolation Valves Page 2 APS requests approval of the proposed amendment on an expedited basis (within 60 days), with an implementation period of 10 days after approval. The expedited approval date is requested assuming the proposed NRC interpretation is issued causing a 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> action statement to be entered for the inoperability of one actuator train.

No commitments are being made to the NRC by this letter. Should you have any questions, please contact Thomas N. Weber at (623) 393-5764.

Sincerely, D/41eý 4-"ý JML/SAB/RJR/

Enclosures:

1. Notarized Affidavit

2. APS' Evaluation of Proposed Change to LCO 3.7.2, Main Steam Isolation Valves Attachments:

1. Proposed Technical Specification Changes (mark-up)

2. Proposed Technical Specification Pages (retyped)

3. Changes to TS Bases Pages cc:

B. S. Mallett M. B. Fields G. G. Wamick A. V. Godwin T. Morales NRC Region IV Regional Administrator NRC NRR Project Manager NRC Senior Resident Inspector for PVNGS Arizona Radiation Regulatory Agency (ARRA)

Arizona Radiation Regulatory Agency (ARRA)

ENCLOSURE 1 NOTARIZED AFFIDAVIT STATE OF ARIZONA

)) SS.

COUNTY OF MARICOPA )

I, David Mauldin, represent that I am Vice President Nuclear Engineering, Arizona Public Service Company (APS), that the foregoing document has been signed by me on behalf of APS with full authority to do so, and that to the best of my knowledge and belief, the statements made therein are true and correct.

David Mauldin Swom To Before Me This,76 Day Of

.2006.

OFF0ICIAL SEAL Christy L. Arter Commission #188400 NOTARY PUBLIC - STATE ofARIZOt(A MARICOPA COUNTY MY COMM. EXPIRES Auust 20,2010 Nota6 Public Notary Commission Stamp E.1-1

ENCLOSURE2 Arizona Public Service Company's Evaluation

Subject:

Proposed Change to LCO 3.7.2, Main Steam Isolation Valves

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Determination 5.2 Applicable Regulatory Requirements/Criteria 6.0 ENVIRONMENTAL EVALUATION 7.0 PRECEDENT

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) hereby requests to amend Operating Licenses NPF-41, NPF-51, and NPF-74 for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3, respectively. The proposed amendment revises Technical Specification 3.7.2, "Main Steam Isolation Valves (MSIVs)," to include specific requirements (Conditions, Required Actions, and Completion Times) for the MSIV actuator trains. Additionally, surveillance requirement (SR) 3.7.2.1 is being revised to clearly identify that each MSIV actuator train is required to be tested to support the operability of the associated MSIV.

2.0 PROPOSED CHANGE

Technical Specification 3.7.2 specifies operability and surveillance requirements (SR) for the MSIVs. Currently, these specifications do not address or provide specific requirements (Conditions, Required Actions, and Completion Times) for the MSIV actuator trains. These changes are considered to be necessary based on the NRC staff interpretation that SR 3.7.2.1 requires both actuator trains for a single MSIV to be surveillance tested. These changes are considered to be necessary based on a proposed NRC staff interpretation that results in declaring an MSIV inoperable with one actuator train inoperable. The completion time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for an inoperable MSIV is not commensurate with the safety significance of a single inoperable actuator train.

Declaring an MSIV inoperable and having to enter the Condition and Required Action for an inoperable valve due to a single inoperable actuator train is unnecessarily restrictive because inoperability of one of the two redundant actuator trains associated with each MSIV does not, by itself, make that valve incapable of closing since the remaining OPERABLE actuator train can effect valve closure on demand. Therefore, APS proposes the following changes to TS 3.7.2:

Limiting condition for operation (LCO) 3.7.2 is revised to include the actuator trains in the LCO and will now state that "Four MSIVs and their associated actuator trains shall be OPERABLE."

Two new Conditions A and B are added to TS 3.7.2 to address inoperable MSIV actuator trains. The existing Conditions that address inoperable MSIVs are relabeled such that those Conditions would become Conditions C through F. The proposed new Conditions related specifically to the MSIV actuator trains address inoperable actuator trains as follows:

1. New Condition A would address the condition of one MSIV actuator train on an MSIV inoperable (i.e., one Train A or one Train B). The proposed Required Action for this Condition would require restoring the inoperable actuator train to OPERABLE status within 7 days. Additionally, this Condition is preceded by a Note stating that a separate Condition entry is allowed for each MSIV.

E.2-1

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves

2. New Condition B would address the situation when the Required Action and associated Completion Time of Required Action A are not met, or two MSIV actuator trains are inoperable on the same MSIV (i.e., Train A and Train B). The Required Action proposed for this Condition is to immediately declare the affected valve inoperable. This action would then require entry into Condition C (previously Condition A).

A revision to SR 3.7.2.1 is added to clearly identify that each MSIV actuator train is required to be tested to verify that each train actuates the MSIV to the isolation position on an actual or simulated actuation signal.

Proposed revisions to the TS Bases are also included in this application. The changes to the affected TS Bases pages will be incorporated in accordance with TS 5.5.14, Technical Specifications Bases Control Program, after NRC approval of the proposed amendment.

3.0 BACKGROUND

On August 21, 2006, the NRC Project Manager from the Wolf Creek Nuclear Plant communicated that the NRC interpretation of Wolf Creek's SR 3.7.2.2 requires the MSIV actuator trains to be surveillance tested. Since SR 3.0.1 requires SRs to be met, the failure to meet the surveillance, whether such failure is experienced during the performance of the surveillance or between performances of the surveillance, shall be a failure to meet the LCO. Therefore, the failure of an actuator train is a failure to meet the SR, which results in LCO 3.7.2 not being met. The result is an MSIV must be declared inoperable absent any specific Conditions associated with the MSIV actuator trains. This NRC interpretation would apply to Palo Verde due to a similar design.

At Palo Verde one MSIV is installed in each of the four main steam lines (2 per steam generator) outside the containment and downstream of the main steam safety valves (Figure 1). The MSIVs prevent uncontrolled blowdown from more than one steam generator in the event of a postulated design basis accident. The MSIVs are 28-inch gate valves with redundant actuator trains (A and B). An actuator train consists of a pneumatic-hydraulic accumulator, an air reservoir, solenoid valves, shuffle valves and the main steam and feedwater isolation system (MSFIS) circuitry. The instrumentation and controls of one actuator train are physically and electrically separate and independent of the instrumentation and controls of the other actuator train. Either actuator train can independently perform the safety function to fast-close the MSIV on demand.

The MSFIS is part of the Engineered Safety Features Actuation System (ESFAS). The MSFIS consists of two independent trains of equipment which provide for the operation of the MSIVs and the economizer Feedwater Isolation Valves (FWIVs). Each MSFIS train has a cabinet of logic which receives handswitch, valve position, and protection E.2-2

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves system inputs, and which in turn controls solenoid valves. These solenoid valves control MSIV operation.

Each MSFIS train logic cabinet contains the controls for six valve actuator trains: one of the two that is on each of the four MSIVs, and the single actuator train on each of two FWIVs. The MSIVs each have two actuator trains, one driven by Train A MSFIS and one driven by Train B MSFIS. Either actuator train on an MSIV can close the valve independent of the other actuator train. The FWIVs have only one actuator train and are not part of this request.

The MSFIS control logic has one safety function and several auxiliary functions for the valves it controls. The auxiliary functions are manually initiated and are primarily used for testing e.g. fast close, slow close, slow open etc. The safety function is to propagate the Main Steam Isolation Signal (MSIS) from the Auxiliary Relay Cabinets during postulated plant events. The MSIS is generated by either low steam generator pressure, high steam generator level, or high containment pressure. An MSIS in either MSFIS train will cause an unrestricted fast-close of the MSIVs and FWIVs controlled by that train. This will also happen on a loss of 125v DC vital bus power to either MSFIS logic cabinet or on loss of control power from either cabinet to the solenoid valves.

Figures 2 and 3 depict this information.

E.2-3

i (rypflca. 5 per Man Steam Une)

Emegency Aux. Feed.

FE-11131 1123 N-Train Aim. Feed T~ur~ne(M)

IT "n

m Secondary Chen*ry (SCy SanmpUng Wet Layup (via SC)

Blowdown (SC)

FW FW Line Auxwary Steam Supply Steamn Bypaas (8 SSCV9.

61oCondsnawr2oA~nm.)

Molalwa Separator Refleaera (NISRS)

Mi 0

0 0 -C 0 M 03 0 0 00

-03 (D (D 0)(1 FIGURE 1-1 MAIN STEAM SYSTEM NORMAL POWER PRODUCTION CONFIGURATION (TYPICAL FOR 2 STEAM GENERATORS)

Feedwater Pump Tuine Supply (low load on upset only)

Gland Steam (GS) Supply (low load only)

.ft HP Tune ('

Bold lines are In use for this configuration.

See page 5 for abbrevlations and acronyms Palo Verde Nuclear Generating Station Design Basis Manual - SG System. Revision 020 Page 19 of 150

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves MSIV/MFIV Functional Diagram FIGURE 2 E.2-5

MSIV LOGIC (Fast Closed)

RM.I IFad Clowe:

i~~~~~~~~~~~~~~~~~

-seells DDeegz -wvsrm oasooMSVA n

(ml)TRAN UjY F

G H

'A' Oeow*Kge 1X De-energize,

'W Do-energized, W 4-way drllted tD 'Crow Dver euiu

• Azwirmoral~ignd tD %h*PWc TrainA -Fast Close x

(Armmueto nio vave oeo)Train B-Neutral

• (On PwuP VA onikmouay pump)

Fast Okue N"M~

• n 8l10VISowclose X - Solenoid Energized sos

• k ma

(

>U Antedl I r Regul~

N~

(A1 c0 N10 car

-a, M

<0 A

E0 For~~~Am IDuatu nl

)

°

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves

4.0 TECHNICAL ANALYSIS

Consistent with other Technical Specifications, the proposed Completion Times for inoperable MSIV actuator trains are based on a hierarchy of Conditions such that shorter Completion Times are specified for increasingly degraded conditions. Each MSIV actuator train is a redundant system that by itself can effect closure of its MSIV when required. As such, each MSIV is treated separately from the other MSIVs in regards to the failure of a single actuator train. This is evidenced by the inclusion of a new Note stating that a separate Condition entry is allowed for the first failed actuator train on each MSIV.

Conditions addressing inoperable actuator trains are specified first in TS 3.7.2, i.e.,

before the Conditions that are currently in place for addressing inoperability of the MSIVs themselves. The intent is that when an actuator train is declared inoperable, the applicable Condition for the inoperable actuator train would be entered. Condition B is entered for a failure to meet the Required Action for Condition A in the Completion Time allowed or for a second failed actuator train on the same MSIV, the MSIV would be declared inoperable so that the condition addressing inoperability of the MSIV (Condition C, previously Condition A) would be entered.

This hierarchy still allows immediate entry into Condition C if a common component (such as the valve piston, stem, or packing) fails and causes the MSIV to be inoperable.

The major considerations in determining Completion Time are:

" The redundancy of the actuator trains.

" The fail-closed design of the PVNGS MSIVs.

" The safety analysis assumption of one MSIV failing to close when required.

" A probabilistic risk assessment (PRA) was performed to bound the risk associated with Completion Times for concurrent inoperable MSIV actuator trains. This evaluation was not used to establish the proposed Completion Times (for proposed Conditions A and B), but it was used to gauge the acceptability of the Completion Times being proposed, which were based on engineering judgment and consistency with other TSs, as described above. The PRA evaluation used the Regulatory Guide 1.174 and Regulatory Guide 1.177 metrics to determine a maximum Completion Time.

Justification for the Completion Times to be specified for Required Actions A.1 and B.1 are provided below:

1. Condition A - With one MSIV actuator train on an MSIV inoperable (i.e., one Train A or Train B), a Completion Time of 7 days for Required Action A.1 is reasonable because of the redundant actuator train design. Since the actuator trains are redundant, the affected valve is still capable of closing on demand (assuming no additional failures) using the remaining OPERABLE actuator train. The proposed 7-E.2-7

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves day Completion Time takes into account the design redundancy, the fail-closed design of the PVNGS MSIV's, the accident analysis assumption that only 3 of 4 MSIVs close in the accident, a reasonable time for repairs, and the low probability of a design basis accident occurring during this period. This Completion Time is consistent with Required Action A.1 of TS 3.7.5, "Auxiliary Feedwater (AFW)

System," in MODE 1 which provides a 7-day Completion Time to restore one inoperable steam supply to the turbine driven AFW pump. The basis for this Completion Time is the redundancy of the steam supply for the turbine driven pump.

The Condition Note is appropriate because the Palo Verde safety analysis as discussed in Section 15.1.5 of the Updated Final Safety Analysis Report (UFSAR) assumes the failure of one MSIV to close on demand. Condition B requires a single MSIV with both actuator trains inoperable to be declared inoperable to support the Palo Verde safety analysis.

2. Condition B - Required Action and associated Completion time of Condition A not met, or two MSIV actuator trains inoperable on the same MSIV (i.e., Train A and Train B), it is appropriate to immediately declare the valve inoperable since having both actuator trains inoperable would constitute a condition that renders the affected MSIV incapable of closing on demand.

A revision to SR 3.7.2.1, is added to clearly identify that each MSIV actuator train is required to be tested to support the operability of the associated MSIVs.

A probabilistic risk assessment (PRA) was performed to bound the risk associated with Completion Times for concurrent inoperable MSIV actuator trains. This evaluation was not used to establish the proposed Completion Times (for proposed Conditions A and B), but it was used to gauge the acceptability of the Completion Times being proposed, which were based on engineering judgment and consistency with other TSs, as described above. The PRA evaluation used the Regulatory Guide 1.174 and Regulatory Guide 1.177 metrics to determine a maximum Completion Time. The condition of unavailability of one-of-two hydraulic actuator trains on each of the four MSIVs concurrently was modeled. This condition represents the minimum reliability of SG isolation capability intended to be addressed. Results of the evaluation showed that the condition may exist indefinitely (separate Condition entry for one inoperable actuation train on up to 4 MSIVs); thus the proposed Completion Time for Condition A is very conservative when compared to the PRA evaluation.

5.0 REGULATORY ANALYSIS

This section addresses the standards of 10 CFR 50.92 as well as the applicable regulatory requirements and acceptance criteria.

E.2-8

-APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves 5.1 No Significant Hazards Consideration Determination This license amendment request proposes to revise Technical Specification (TS) 3.7.2, "Main Steam Isolation Valves (MSIVs)" to incorporate the MSIV actuator trains into the Limiting Condition for Operation (LCO) and provide associated Conditions and Required Actions. Additionally, Surveillance Requirement (SR) 3.7.2.1 is being revised to clearly identify that each MSIV actuator train is required to be tested to verify that each actuates the MSIV to the isolation position on an actual or simulated actuation signal.

Arizona Public Power Company (APS) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "issuance of amendment," Part 50.92(c), as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response

No The proposed changes to incorporate requirements for the MSIV actuator trains do not involve any design or physical changes to the facility, including the MSIVs and actuator trains themselves. The design and functional performance requirements, operational characteristics, and reliability of the MSIVs and actuator trains remain unchanged. Therefore, there is no impact on the design safety function of the MSIVs to close (as an accident mitigator), nor is there any change with respect to inadvertent closure of an MSIV (as a potential transient initiator). Since no failure mode or initiating condition that could cause an accident (including any plant transient) evaluated in the Palo Verde Nuclear Generating Station (PVNGS)

Updated Final Safety Analysis Report (UFSAR) described safety analyses is created or affected, the change cannot involve a significant increase in the probability of an accident previously evaluated.

With regard to the consequences of an accident and the equipment required for mitigation of the accident, the proposed changes involve no design or physical changes to the MSIVs or any other equipment required for accident mitigation. With respect to MSIV actuator train Completion Time, the consequences of an accident are independent of equipment Completion Time as long as adequate equipment availability is maintained. The proposed Condition A Note takes into account the redundancy of the actuator trains and the accident analysis assumption that only 3 of 4 MSIVs close in the accident. Adequate equipment availability would therefore continue to be available and Condition C for an inoperable MSIV would continue to support the Palo Verde safety analysis. On this basis, the consequences of applicable analyzed accidents (such as a main steam line break) are not significantly impacted by the proposed changes.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously analyzed.

E.2-9

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response

No.

The proposed changes to incorporate requirements for the MSIV actuator trains do not involve any design or physical changes to the facility, including the MSIVs and actuator trains themselves. No physical alteration of the plant is involved, as no new or different type of equipment is to be installed. The proposed changes do not alter any assumptions made in the safety analyses, nor do they involve any changes to plant procedures that could cause a new or different kind of accident from any previously evaluated are being introduced.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response

No.

The proposed change to incorporate requirements for the MSIV actuator trains does not alter the manner in which safety limits or limiting safety system settings are determined. No changes to instrument/system actuation setpoints are involved.

The safety analysis acceptance criteria are not impacted by this change and the proposed change will not permit plant operation in a configuration outside the design basis.

Therefore, the proposed change does not involve a significant reduction in the margin of safety.

==

Conclusion:==

Based on the above evaluation, APS concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria The regulatory basis for TS 3.7.2, "Main Steam Isolation Valves (MSIVs)," is the isolation of main steam flow from the secondary side of the steam generators following a high energy line break (HELB). Closure of the MSIVs terminates flow from the unaffected (intact) steam generators. The MSIVs prevent uncontrolled blowdown from more than one steam generator. Closing the MSIVs isolates each steam generator E.2-10

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves from the others, and isolates the turbine, Condenser Steam Dump System, and other auxiliary steam supplies from the steam generators.

The MSIVs close on a main steam isolation signal generated by either low steam generator pressure, high steam generator level or high containment pressure. The MSIVs are designed to fail closed on loss of control or actuation power. The MSIVs may also be actuated manually. The MSIVs isolate nonsafety related portions of the main steam supply system from the safety related portions. In the event of a main steam line break inside containment, the MSIVs close automatically. Closure of the MSIVs ensures that no more than one steam generator can supply the postulated break. The steam line to the auxiliary feedwater pump turbine is connected to a cross-connecting header upstream of the MSIV to ensure a supply of steam to this turbine when the steam generators are isolated.

The safety related functions of the MSIV actuator trains are to close an MSIV within the specified time frame and to ensure that no more than one steam generator can supply a postulated break. A single failure of any actuator train component cannot prevent the redundant actuator train from performing its safety function. Adding requirements for the MSIV actuator trains provides appropriate limits on out-of-service times for an MSIV actuator train, with consideration given to the redundant actuator train design, while also assuring adequate availability. At the same time, it provides operability requirements appropriate to the MSIV actuator trains which avoid having to unnecessarily or prematurely declare an MSIV inoperable when an actuator train is inoperable and thus have to take action that is unnecessarily restrictive. This also avoids an unnecessary transient and plant shutdown thus minimizing potential safety consequences and operational risks.

Applicable General Design Criterion (GDC):

The portion of the main steam supply system from the steam generators to the MSIVs is safety related and is required to function following a design basis accident (DBA), and to achieve and maintain the plant in a safe shutdown condition.

GDC 2, "Design bases for protection against natural phenomena," requires that the safety related portion of the Main Steam Supply System and Condensate and Feedwater System be protected from the effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, and external missiles.

GDC 4, "Environmental and dynamic effects design bases," requires that the Main Steam Supply System and Condensate and Feedwater System be designed to remain functional after a safe shutdown earthquake or to perform its intended function following postulated hazards such as internal missiles, or pipe break.

GDC 34, "Residual heat removal," requires that component redundancy be provided for the Main Steam Supply System and Condensate Feedwater System so that safety E.2-11

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves functions can be performed, assuming a single active component failure coincident with the loss of offsite power.

The proposed TS change does not affect the MSIVs or the associated actuator train design and compliance with the above regulatory requirements and criteria. Therefore, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the approval of the proposed change will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL EVALUATION APS has evaluated the proposed amendment and determined that the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

7.0 PRECEDENT On June 16, 2006, a similar change, Callaway Plant, - License Amendment to add the actuator trains to LCO 3.7.2 on MSIVs (TAC NO. MC7212) was approved. The differences between Callaway Amendment No. 172 and the APS request are:

" APS is only requesting the addition of two new Conditions.

" APS is requesting a longer Completion Time for new Condition A.

" The addition of the Condition A Note in the APS request allows for a separate Condition entry for the first failed actuator train on each MSIV.

APS has made a revision to Surveillance Requirement 3.7.2.1 to verify each actuator train actuates the MSIV to the isolation position on an actual or simulated signal.

" The Palo Verde MSIVs are designed to fail-closed.

" The Palo Verde safety analysis assumes one MSIV fails to close.

On August 25, 2006, Wolf Creek Nuclear Operating Corporation submitted letter WM06-0033, "Docket No. 50-482: Revision to Technical Specification (TS) 3.7.2, 'Main Steam Isolation Valves (MSIVs),' and TS 3.7.3, 'Main Feedwater Isolation Valves (MFIVs),"'

requesting similar changes as proposed by APS. The differences between the Wolf Creek request and the APS request are:

e APS is only requesting the addition of two new Conditions.

E.2-12

- APS' Evaluation of the Proposed Changes to LCO 3.7.2, Main Steam Isolation Valves

" The addition of the Condition A Note in the APS request allows for a separate Condition entry for the first failed actuator train on each MSIV.

" The Palo Verde MSIVs are designed to fail-closed.

" APS' request is for the MSIVs only.

E.2-13

Attachment I Proposed Technical Specification Changes (mark-up)

Pages:

3.7.2-1 3.7.2-2

MSIVs 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs)

LCO

3.7.2 APPLICABILITY

MODE 1, MODES 2, 3. and deactivated.

rACTIONS 4 except when all MSIVs are closed and CONDITION REQUIRED ACTION COMPLETION TIME 61 One MSIV inoperable in X.1 Restore MSIV to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> MODE 1.

OPERABLE status.

Required Action and 8.1 Be in MODE 2.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Associated Completion Time of Condition \\

not met.

G NOTE------

Separate Condition entry is allowed for each MSIV.

One or more MSIVs inoperable in MODE 2,

3. or 4.

9 4.1 AND 2;

Close MSIV.

Verify MSIV is closed.

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Once per 7 days Required Action and associated Completion Time of Condition I not met.

E 0/ 1 AND 2

Be in MODE 3.

Be in MODE 5.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 36 hours PALO VERDE UNITS 1,2.3 3.7.2-1 AMENDMENT NO. 44--ý 158

Insert for TS 3.7.2 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME NOTE-------

Separate Condition entry is allowed for each MSIV A. One MSIV actuator train A.1 Restore MSIV actuator 7 days on an MSIV inoperable, train to OPERABLE status B. Required Action and B.1 Declare the MSIV Immediately associated Completion inoperable.

Time of Condition A not met.

OR Two MSIV actuator trains are inoperable on the same MSIV.

MSIVs 3.7.2 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1 NOTE Not required to be performed prior to entry into MODE 3.

Verify closure time of each MSIV is In accordance

4.6 second on an actual or simulated with the actuation sig al.

Inservice Testing Program PALO VERDE UNITS 1,2,3 3.7.2-2 AMENDMENT NO. +ii`

Proposed Technical Specification Changes (Re-typed))

Pages:

3.7.2-1 3.7.2-2

MSIVs 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Main Steam Isolation Valves (MSIVs)

LCO

3.7.2 APPLICABILITY

Four MSIVs and their associated actuator trains shall be OPERABLE.

MODE 1.

MODES 2, 3, and 4 except when all MSIVs are closed and deactivated.

I ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. ------- NOTE-------- A.1 Restore MSIV actuator 7 days Separate Condition train to OPERABLE status entry is allowed for each MSIV One MSIV actuator train on an MSIV inoperable.

B.

Required Action and B.1 Declare the MSIV Immediately associated Completion inoperable.

Time of Condition A not met.

OR Two MSIV actuator trains are inoperable on the same MSIV.

C. One MSIV inoperable in C.1 Restore MSIV to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> MODE 1.

OPERABLE status.

D. Required Action and D.1 Be in MODE 2.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Associated Completion Time of Condition C not met.

(continued)

PALO VERDE UNITS 1,2,3 3.7.2-1 AMENDMENT NO.4-W

MSIVs 3.7.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E.

---

NOTE-------- E.1 Close MSIV.

4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Separate Condition entry is allowed for AND each MSIV.

E.2 Verify MSIV is Once per 7 days closed.

One or more MSIVs inoperable in MODE 2.

3. or 4.

F. Required Action and F.1 Be in MODE 3.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time of Condition E AND not met.

F.2 Be in MODE 5.

36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.7.2.1

---

NOTE---------------

Not required to be performed prior to entry into MODE 3.

Verify closure time of each MSIV is In accordance

< 4.6 seconds with each actuator train on with the an actual or simulated actuation signal.

Inservice Testing Program PALO VERDE UNITS 1.2,3 3.7.2-2 AMENDMENT NO. 4-14, Changes to Technical Specification Bases Pages Pages:

B 3.7.2-1 B 3.7.2-2 No Changes B 3.7.2-3 B 3.7.2-4 B 3.7.2-5 B 3.7.2-6

MSIVs B 3.7.2 B 3.7 PLANT SYSTEMS B 3.7.2 Main Steam Isolation Valves (MSIVs)

BASES BACKGROUND The MSIVs isolate steam flow steam generators following a MSIV closure terminates flow steam generator.

from High from the secondary side of the Energy Line Break (HELB).

the unaffected (intact)

One MSIV is located in each main steam line outside, but close to, containment.

The MSIVs are downstream from the Main Steam Safety Valves (MSSVs),

atmospheric dump valves, and auxiliary feedwater pump turbine steam supplies to prevent their being isolated from the steam generators by MSIV closure.

Closing the MSIVs isolates each steam generator from the other, and isolates the turbine, Steam Bypass Control System, and other auxiliary steam supplies from the steam generators.

he MSIVs close on a main steam isolation signal generated by either low steam generator pressure, high steam generator level or high containment pressure.

The MSIVs fail closed on loss of control or actuation power.

The MSIS also actuates the Main Feedwater Isolation Valves (MFIVs) to close.

The MSIVs may also be actuated manually.

A description of the MSIVs is found in the FSAR, Section 10.3 (Ref. 1).

APPLICABLE SAFETY ANALYSES The design basis of the MSIVs is established by the containment analysis for the large steam line break (SLB) inside containment, as discussed in the CESSAR, Section 6.2 (Ref. 2).

It is also influenced by the accident analysis of the SLB events presented in the UFSAR, Section 15.1.5 (Ref. 3).

The design precludes the blowdown of more than one steam generator, assuming a single-active component failure (e.g., the failure of one MSIV to close on demand).

The limiting case for the containment analysis is the hot zero power SLB inside containment with a loss of offsite power following turbine trip, and failure of the MSIV on the affected steam line to close.

At zero power, the steam generator inventory and temperature are at their maximum, (continued)

PALO VERDE UNITS 1.2,3 B 3.7.2-1 REVISION 0

MSIVs B 3.7.2 10 CýýVq.e6 BASES APPLICABLE SAFETY ANALYSES (continued) maximizing the analyzed mass and energy release to the containment.

Due to reverse flow, failure of the MSIV to close contributes to the total release of the additional mass and energy in the steam headers, which are downstream of the other MSIVs.

With the most reactive control element assembly assumed stuck in the fully withdrawn position, there is an increased possibility that the core will become critical and return to power.

The core is ultimately shut down by the borated water injection delivered by the Emergency Core Cooling System.

Other failures considered are the failure of an MFIV to close, and failure of an emergency diesel generator to start.

The accident analysis compares several different SLB events against different acceptance criteria.

The large SLB outside containment upstream of the MSIV is limiting for offsite dose, although a break in this short section of main steam header has a very low probability.

The large SLB inside containment at hot zero power is the limiting case for a post trip return to power.

The analysis includes scenarios with offsite power available and with a loss of offsite power following turbine trip.

With offsite power available, the reactor coolant pumps continue to circulate coolant through the steam generators, maximizing the Reactor Coolant System (RCS) cooldown.

With a loss of offsite power, the response of mitigating systems, such as the High Pressure Safety Injection (HPSI) pumps, is delayed.

Significant single failures considered include:

failure of a MSIV to close, failure of an emergency diesel generator, and failure of a HPSI pump.

The MSIVs serve only a safety function and remain open during power operation.

These valves operate under the following situations:

a.

An HELB inside containment.

In order to maximize the mass and energy release into the containment, the analysis assumes that the MSIV in the affected steam line remains open.

For this accident scenario, steam is discharged into containment from both steam generators until closure of the MSIVs in the intact steam generator occurs.

After MSIV closure, steam is discharged into containment only from the affected steam generator, and from the residual steam in the (continued)

PALO VERDE UNITS 1,2,3 B 3.7.2-2 REVISION 0

MSIVs B 3.7.2 BASES APPLICABLE main steam header downstream of the closed MSIVs in SAFETY ANALYSES the intact loops.

(continued)

b.

A break outside of containment and upstream from the MSIVs.

This scenario is not a containment pressurization concern.

The uncontrolled blowdown of more than one steam generator must be prevented to limit the potential for uncontrolled RCS cooldown and positive reactivity addition.

Closure of the MSIVs isolates the break, and limits the blowdown to a single steam generator.

c.

A break downstream of the MSIVs.

This type of break will be isolated by the closure of the MSIVs.

Events such as increased steam flow through the turbine or the steam bypass valves will also terminate on closure of the MSIVs.

d.

A steam generator tube rupture.

For this scenario, closure of the MSIVs isolates the affected steam generator from the intact steam generator.

In addition to minimizing radiological releases, this enables the operator to maintain the pressure of the steam generator with the ruptured tube high enough to allow flow isolation while remaining below the MSSV setpoints, a necessary step toward isolating the flow through the rupture.

_So

-¥

e.

The MSIVs are also utilized during other events such as a feedwater line break.

These events are less limiting so far as MSIV OPERABILITY is concerned.

The MSIVs satisfy Criterion 3 of 10 CFR 50.36 (c)(2)(ii).

LCO This LCO requires that the MSI-Vin each of the four steam lines be OPERABLE.

The MSIVs are considered OPERABLE when the isolation times are within limits, and they close on an isolation actuation signal.

The MSIVs have redundant actuato~rtrl

,In This LCO provides assurance that the MSIVs will perform their design safety function to mitigate the consequences of accidents that could result in offsite exposures comparable to the 10 CFR 100 (Ref. 4) limits.

(continued)

PALO VERDE UNITS 1,2.3 B 3.7.2-3 REVISION 31

MSIVs B 3.7.2 BASES (continued)

APPLICABILITY I

The MSIVs must be OPERABLE in MODE 1 and in MODES 2, 3 and 4 except when all MSIVs are closed and deactivated when there is significant mass and energy in the RCS and steam generators.

When the MSIVs are closed, they are already performing their safety function.

In MODES 5 and 6, the steam generators do not contain much energy because their temperature is below the boiling point of water: therefore, the MSIVs are not required for isolation of potential high energy secondary system pipe breaks in these MODES.

With one MSIV inoperable in MODE 1. time is allowed to restore the component to OPERABLE status.

Some repairs can be made to the MSIV with the unit hot.

The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is reasonable, considering the probability of an accident occurring during the time period that would require closure of the MSIVs.

The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is consistent with that normally allowed for containment isolation valves that isolate a closed system penetrating containment.

These valves differ from other containment isolation valves in that the closed system provides an additional means for containment isolation.

N1 (continued)

PALO VERDE UNITS 1,2,3 B 3.7.2-4 REVISION 37

MSIVs B 3.7.2 BASES (continued)

ACTIONS (continued)

If the MSIV cannot be restored to OPERABLE within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the unit must be placed in a MODE in which the LCO does not apply.

To achieve this status, the nit must be placed in MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Condition would be entered.

The Completion Time is reasonable, based n operating experience, to reach MODE 2. and clos the MSIVs in an orderly manner and without challengin unit systems.

1 wA r

14 Condition Xis modified by a Note indicating Condition entry is allowed for each MSIV.

that separate Since the MSIVs are required to and 3, the inoperable MSIVs may OPERABLE status or closed.

Wher already in the position requirec safety analysis.

be OPERABLE in MODES 2 either be restored to closed, the MSIVs are I by the assumptions in the The 4 hour4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Completion Time is consistent with that allowed in Condition.

Inoperable MSIVs that cannot be restored to OPERABLE status within the specified Completion Time, but are closed, must be verified on a periodic basis to be closed.

This is necessary to ensure that the assumptions in the safety analysis remain valid.

The 7 day Completion Time is reasonable, based on engineering judgment, MSIV status indications available in the control room, and other administrative controls, to ensure these valves are in the closed position.

',ý.1 and If the MSIVs cannot be restored to OPERABLE status, or closed, within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply.

To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

(continued)

PALO VERDE UNITS 1.2,3 B 3.7.2-5 REVISION 0

MSIVs B 3.7.2 BASES (continued)

ACTIONS N.1 and Z2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from MODE 2 conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1*

REURMNS This SRyifie httecouetme of each MSIV is <-

4.6 second on an actual or simulated actuation signal.

The MSIV closure time is assumed in the accident and containment analyses.

This SR is normally performed upon returning the unit to operation following a refueling outage.

The MSIVs should not be full stroke tested at power.

The Frequency for this SR is in accordance with the Inservice Testing Program.

This Frequency demonstrates the valve closure time at least once per refueling cycle.

This test is conducted in MODE 3, with the unit at operating temperature and pressure, as discussed in the Reference 5 exercising requirements.

This SR is modified by a Note that allows entry into and operation in MODE 3 prior to performing the SR.

This allows a delay of testing until MODE 3, in order to establish conditions consistent with those under which the acceptance criterion was generated.

REFERENCES

1.

UFSAR, Section 10.3.

2.

CESSAR, Section 6.2.

3.

UFSAR, Section 15.1.5.

4.

10 CFR 100.11.

5.

ASME, Boiler and Pressure Vessel Code,Section XI, Inservice Inspection, Article IWV-3400.

PALO VERDE UNITS 1,2,3 B 3.7.2-6 REVISION 0

Bases 3.7.2 Bases Insert "A" The MSIV is a 28-inch gate valve with dual-redundant hydraulic actuator trains. Each MSIV has two redundant actuator trains. An actuator train consists of a pneumatic-hydraulic accumulator, an air reservoir, solenoid valves, shuttle valves and the main steam and feedwater isolation system (MSFIS) circuitry. The instrumentation and controls of one actuator train are physically and electrically separate and independent of the instrumentation and controls of the other actuator train. Either actuator train can independently perform the safety function to fast-close the MSIV on demand.

Bases Insert "B" An MSIV actuator is considered OPERABLE when it is capable of fast-closing the associated MSIV on demand and within the required isolation time. Operability includes having adequate accumulator pressure, adequate air pressure and the associated valve actuation logic (in the MSFIS Cabinet) able to fast close the MSIV. Since the MSIV actuator trains are independent, failure of one actuator train does not cause a failure of the other. Therefore, with only one actuator train operable the MSIV is still capable of performing its safety function. However, the MSIV actuator trains are no longer protected from a single failure and have lost redundancy.

Bases Insert "C" The LCO specifies OPERABILITY requirements for the MSIVs as well as for their associated actuator trains. The Conditions and Required Actions for TS 3.7.2 separately address inoperability of the MSIV actuator trains and inoperability of the MSIVs themselves.

A.1 Condition A is modified by a NOTE indicating that separate Condition entry is allowed for each MSIV.

With one MSIV actuator train on an MSIV inoperable (i.e., one Train A or one Train B),

action must be taken to restore the inoperable actuator train to OPERABLE status within 7 days. The 7-day Completion Time is reasonable in light of the dual-redundant actuator train design such that with one actuator train inoperable, the affected MSIV is still capable of closing on demand via the remaining OPERABLE actuator train. The 7-day Completion Time takes into account the redundant OPERABLE actuator train to the MSIV, reasonable time for repairs, and the low probability of an event occurring that requires the inoperable actuator train to the affected MSIV.

B.1 Condition B applies if the Required Action and associated Completion Time of Required Action A are not met, or two actuator trains are inoperable on the same MSIV.

Required Action B.1 provides assurance that the appropriate Action is entered for one MSIV inoperable. Failure of both actuator trains for a single MSIV results in the inability to fast close the affected MSIV on demand.

Bases Insert "D" Condition C is entered when one MSIV is inoperable in MODE 1, including when both actuator trains for one MSIV are inoperable. When only one actuator train is inoperable on one MSIV, Condition A applies.