2CAN109801, Forwards Addl Info in Support of risk-informed Inservice Insp Pilot Application Submitted in Licensee 970930 & s.Pilot Plant Application Is to Be Used as Alternative, Per 10CFR50.55(a)(3)(i),to Certain ASME Requirements

Forwards Addl Info in Support of risk-informed Inservice Insp Pilot Application Submitted in Licensee 970930 & s.Pilot Plant Application Is to Be Used as Alternative, Per 10CFR50.55(a)(3)(i),to Certain ASME Requirements

ML20154L430
Person / Time
Site:	Arkansas Nuclear
Issue date:	10/08/1998
From:	Vandergrift J ENTERGY OPERATIONS, INC.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
2CAN109801, NUDOCS 9810190295
Download: ML20154L430 (104)

Text

_ . . . . . ~ _ _ _ -_.-__-m._-~ _ . - - _ _ ._ . _ _ __ _ _ ..._- .. _ _._ , _ .__ _ . . ,

c ~(

IL Entergy operations,Inc.

144d SA 333 RussdMle, AR 72801 Tel 501858-5000 l

l October 8,1998 2CAN109801' U. S. Nuclear Regulatory Commission Document Control Desk Mail Station OPI-17 Washington, DC 20555

Subject:

Arkansas Nuclear One - Unit 2 Docket No. 50-368 License No. NPF-6 Additional Information in Support of the Risk-Informed Inservice Inspection Pilot Application j Gentlemen:

Entergy Operations submitted the results of the risk-informed inservice inspection (ISI) pilot plant application study for Arkansas Nuclear One, Unit 2 (ANO-2), to the NRC by letters dated. September 30,1997 (2CAN0997%), and March 31,1998 (OCAN039809). The pilot plant application is to be used as an alternative, per 10CFR50.55(a)(3)(i), to certain ASME Code requirements for the remainder of ANO-2's second inspection interval (ending March 25,2000) and.for the subseqoent third inspection interval. A meeting was held with the NRC Staff to discuss the ongoing review of the application on September 9 and 10,1998.

During the meeting, draR responses to NRC questions on the application were discussed. The  ;

NRC Staff transmitted these questions in the meeting summary dated September 25,1998 (2CNA099801). Entergy Operations final responses to the Staff's questions are attached.

7 As discussed in the NRC's September 25,1998, letter, a risk-informed inservice inspection is /

planned for the next ANO-2 refueling outage that is currently scheduled to commence on January 8,1999.

Operations by focusing The risk-informed inservice inservice inspections on risk significant inspection will beradiation areas and reducing a benefit to En exposure. - The NRC Staff will also benefit from this by providing a basis for more risk-informed regulations. Entergy Operations considers the NRC's expeditious actions to support this pilot application as a positive movement toward relieving the industry of non-safety significant burden. It is recognized that our formal response to these questions has taken

. longer to complete than envisioned during our meeting of September 9 and 10,1998.

l - However, we believe that the overall conclusions reached in this meeting are unchanged and support a timely approval of the pilot application by December 30,1998.

l 9810190295'981bO8 PDR ADOCK 05000368 G PDR L

1

. .- ... . . _ . _. _. - _ _ . _ _ _ _ _ _ _.__. ~.._ __ _ . _ _ . _ . - . - - .

U. S. NRC October 8,1998 8CAN109801 Page 2 of 2

' Should you have any questions regarding this submittal, please contact me, i

! V truly yours c

~

./ f y andergrift

i Dir , Nuclear Safety JDy/ d a ment ec

Mr. Ellis W. Merschoff Regional Administrator U. S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-8064 NRC Senior Resident Inspector Arkansas Nuclear One P.O. Box 310 London, AR 72847 Mr. William D. Reckley NRR Project Manager Region IV/ANO-1 & 2 U. S. Nuclear Regulatory Commission NRR Mail Stop 13-H-3 One White Flint North 11555 Rockville Pike Rockville, MD 20852 l.

l y

. ._ _ _ _ _ _ _ _ _ _ _ _ . _ . . _ _ . . _ _ _ _ . _ _ . ~ _ _ _ _ _ _ _ . _ _ _ _ . . _ . _ _ _ _ _

Attachment to 2CAN109801 j Page1of102 Entergy Operations Response to N'RC Questions on Risk-Informed Inservice Inspection Pilot Plant Application NRC Question No.1 The licensee's submittal does not clearly define an overall basis for the proposed alternative, but instead provides discrete risk evaluations for separate systems, and refers to guidance from other documents such as Code Case N-578 and EPRI TR-106706 as bases for the methodology used for individual risk evaluations. The licensee should submit an overview that encompasses all system risk evaluations and includes or describes:

a) A comparison of the total number of examinations under the existing ASME XI program and the proposed alternative, categorized by ASME Class and plant system.

b) The extent of change to overall plant risk as a result of implementing the proposed alternative examinations, relative to existing ASME XI examination requirements.

(Question 27.0provides more details on this subject) c) A detailed technical justification that provides a basis for assuring the structural integrity of all piping components affected by the proposed alternative.

Entergy Operations Response The Arkansas Nuclear One, Unit 2 (ANO-2) risk-informed inservice inspection (RI-ISI) pilot application submittal consists of an evaluation of the following piping systems.

• High pressure safety injection (HPSI) e Reactor coolant system (RCS) e Chemical and volume control system (CVCS) e Containment spray system (CSS) e Low pressure safety injection (LPSI)/ shutdown cooling e Emergency feedwater (EFW)

Main feedwater (MFW)

• . Main steam system (MSS) e Service water system (SWS)

Nondestructive examination (NDE) requirements for piping components are currently contained in the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code,Section XI, Categories B-F, B-J, C-F-1 and C-F-2. These requirements are limited to Code Class I and Class 2 piping. The ASME Section XI Code does not specify NDE requirements for ASME Code Class 3 piping, and non-Code piping is outside ASME's jurisdiction. Consequently,

Attachment to 2CAN109801 Page 2 of102 the examination program for piping contained in the current ANO-2 Inservice Inspection (ISI)

Program is limited to ASME Code Class 1 and Class 2 piping. I Entergy Operations has prepared an alternative risk informed (RI)-ISI program based upon ASME Code Case N-578 and the Electric Power Research Institute (EPRI) topical report TR-106706. Entergy Operations proposes to use this alternative, which provides an acceptable level of quality and safety, in lieu of the current examination program for piping in accordance with 10CFR50.55(a)(3)(i). This alternative is requested for the remainder of ANO-2's second inspection interval (ending March 25, 2000) and for the subsequent third inspection interval. It should be noted that the alternative RI-ISI developed program is not limited to ASME Code Class I and Class 2 piping, but also includes Class 3 and non-Code piping as well. Other non-related  ;

portions of the ASME Section XI Code will not be affected. l 1

The RI-ISI application at ANO-2 included the utilization of some methodology enhancements. )

The nature of these enhancements, and how they differ from the methodology requirements currently contained in EPRI TR-106706 and/or Code Case N-578, is discussed in the response to NRC question 4.0.

1(a) A comparison of the number of examinations required by the existing ASME Section XI Code ISI Program for piping and the proposed alternative RI-ISI program for piping is ,

provided in Table 1-1. It should be noted, Table 1-1 only reflects the number of l examinations required by ASME Section XI. This includes both the current program per the 1986 Edition and the proposed RIISI program per Code Case N-578. The augmented examination requirements of the existing ANO-2 Flow Accelerated Corrosion (FAC) Program, which the proposed RI-ISI program will continue to rely upon, are not reflected in Table 1-1. In addition, the augmented examination requirements of the existing ANO-2 Service Water Integrity Program are also not reflected in Table 1-1.

Lastly, Table 1-1 contains information only for those elements loaded in the datrbase (see response to NRC Question 6.0). As such, the system scope contents of this table differ from that presented in Table 2-1. The entire scope of the RI-ISI assessment is presented in Table 2-1 regardless of whether the elements are included in the database.

Attachment to 2CAN109801 Page 3 of102 Table 1-1  ;

RI-ISI Code Total High Risk Medium Risk Inw Risk I

Assessed Class Namsber Number Eleaseet Selections Museber EleasetSeiectimes Noenber Element Selections i

Piping of of Of Current Sectise XI RI-ISI Of C wrest Sectise XI RI-ISI Of Current sectise XI RI-ISI Systeens Piping Elemosets Eleaseats Vel /Ser Sur Only Vel Omiy Eleaseets Vel /Ser Sur Only Vet O nly Elemosets Vet /Ser Ser Only VoI Oudy 1

BFSI I 246 34 6 2 9 35 8 3 6 177 35 9 0 2 869 0 - - -

0 - - -

869 42 24 0 RCS 1 307 45 10 3 12 240 36 40 25 22 6 0 0 i

CVCS 1 114 10 2 6 4 83 0 14 9 21 0 5 0 l 2 70 0 - - -

0 - - -

70 0 0 0  !

CSS 2 374 0 - - -

33 0 0 4 341 21 0 0  :

LPSI I 24 11 3 1 3 3 0 0 0 10 4 0 0 t

2 350 0 - - -

184 14 1 19 166 10 0 0  !

EFW 2 93 0 - - -

26 0 0 3 67 0 0 0 ,

3 476 0 - - -

0 - - -

476 0 0 0 NNS 83 0 - - - 0 - - -

83 0 0 0 ,

MFW 2 65 65 12 0 6") 0 - - - 0 - - -

MSS 2 124 59 10 1 0") 0 - - -

65 3 1 0 i

i 3 68 'l - - - 0 - - -

68 0 0 0 >

s i

n

Attachment to 2CAN109801 Page 4 of102  ;

Table 1-1 (cont)

RI-ISI Code Tetel High Risk Mediese Risk Isar Risk Ah Class Neonber Naumber Eleanent Selectises Neonber Eiseneet Selections Neusber Eh Selections

• Fiping of of Of Current Section XI RI-ISI Of Carrent Sectise XI RI-ISI Of Current Secties XI RI-ISI Systeens Piping Eleonents Whts Vol/Sur Sur Only Val Only EW Val / Ser Sur Only Vol Only Eleaseets Val / Ser Sur Only Vel Only SWS 2 24 0 - - -

24 4 0 2 0 - - -

t 3 1197 318 0 0 13 563 0 0 40 + 2(') 316 0 0 5+2* ,

NNS 159 38 0 0 1 121 0 0 0 0 - - -

l l

Tcbie 1-1 Notes l (1) Both MFW and the MSS are susceptible to FAC and portions of MFW are additionally subject to thermal stratification (TASCS) and susceptible to crevice corrosion (CC). A total of 6 selections are included in the ANO-2 submittal for the MFW system due to the TASCS and  ;

CC concerns. Any additional selections for MFW and all selections for the MSS are addressed by the existing ANO-2 FAC Program.

(2) In addition to the 40 piping sections selected for volumetric examination, two additional sections of underground piping have been selected for inspection by remote visual means if other activities permit access to any portion of the line.

(3) In addition to the 5 piping sections selected for volumetric examination, two additional sections of underground piping have been selected for inspection by remote visual means if other activities permit access to any portion of the line.

i

Attachment to 2CAN109801 l Page 5 of102 l

l l 1(b) The Entergy response to this question is addressed in the response to NRC question 27.0.

1(c) The structural integrity of piping in nuclear power plants is assured by numerous factors. l These include:

e Highest quality design, materials and fabrication, with large safety margins and l

L other conservatisms, in accordance with the requirements of ASME Boiler and Pressure Vessel Construction Codes.

• Periodic ISI and pressure testing in accordance with the requirements of ASME l Section XI.

. Inherent toughness and design margins which ensure " leak-before-break" behavior for the large majority of systems and degradation mechanisms.

e Continued surveillance by the NRC and the industiy in general, in which the plant l operators are given broad notification of any incident with potential generic l consequences that occurs at any plant. Such notification is provided through NRC bulletins, infonnation notices and generic letters, industry LERs, and EPRI/NEI sponsored programs, and is oRen accompanied by requirements or recommendations to inspect or take other corrective action at potentially affected plants.

l The proposed revision to the ANO-2 ISI program, prepared in accordance with Code Case N-578 and EPRI TR-106706, affects only one of these factors, periodic inservice inspection in

accordance with ASME Section XI. The other factors will remain unchanged. Moreover, the alternative to the ISI program proposed in the submittal will result in an overall enhancement of the program, thus improving the assurance of structural integrity of the affected piping.

The original rules for ISI were introduced in 1971 for Class I systems, and were based largely on engineering judgement from prior pressure vessel and piping experience in fossil plants and l refining and petro-chemical facilities. At that time there was very limited experience with the operation or performance of nuclear power plant piping. Rules for inservice inspection of Class 2 '

and 3 piping followed shortly thereaRer, in 1978.

Code Case N-578 was approved by ASME Section XI in 1997, and reflects the experience gained in over 2300 reactor years of experience. This experience indicates that the overall structural integrity of nuclear plant piping has been excellent. Although there have been failures, and with few notable exceptions, those that have occurred have manifested themselves in the form of small leaks that have been detected by plant monitors, or during walk-downs and inspections. These failures have occurred due to degradation mechanisms which are well characterized and

understood. The industry has been able to identify the systems or portions of systems which are i susceptible to these damage mechanisms and to conduct augmented inspections and monitoring to I address each of these mechanisms. One lesson learned through this 2300+ reactor years of experience is that, the occurrence of these incidents of leakage or failure exhibited little l

__ _--__ _ _ _ _ __ _ _ _ _ _ _ _ . ~ _ . _ _ . _ . _ _ _ _ _ _ _ _ _ _ _

Attachment to 2CAN109801 Page 6 of102 correlation to the ASME Section XI selection rules for inservice inspection locations. Very few of the incidents were actually detected by the Section XI Code required inspections.

l Code Case N-578 implements an experience-based method of selecting piping segments at risk from the various degradation mechanisms that have actually been seen in operating plants, and i further enhances the selection criteria by factoring in the type of failure expected from each mechanism (large break or small leak) and the consequences of failure in each segment. The methodology is described in EPRI TR-106706. High inspection sampling percentages (25%) are assigned to piping segments with high failure potential and high consequences of failure, as well as to those with high consequences and medium faih.re potential and those with high failure potential and medium consequences. Moderate inspection sampling percentages (10%) are assigned to piping with high consequences and low failure potential, as well as those with medium failure potential and medium consequences and those with low consequences but high failure l potential. In this manner, inspection locations are based on known, industry failure mechanisms as well as the severity of the event which would be caused by a break at the location. Other l locations with medium consequences and low failure potential, or low consequences and medium or low failure potential, are not inspected, but will continue to be subject to periodic leakage  ;

testing as currently required by the Section XI Code. This method is in distinct contrast with the l current ASME Section XI ISI requirements, in which 25% of Class I welds, 7.5% of Class 2 welds, and 0% of Class 3 welds are subject to inspection. As discussed above, this selection criteria has been shown to have no correlation with actual occurrence ofleakage or failure, and the correlation with failure consequence is weak, since systems in the same Code Class can have distinctly different failure consequences.

The structural integrity benefits attributable to the Code Case N-578 ISI approach are further enhanced by the inspection-for-cause concept. Since inspection locations are identified because of susceptibility to specific damage mechanisms, inspection zones and procedures are customized to detect those damage mechanisms. Again, this is in distinct contrast to the current ASME Section XI requirements, in which no specific damage mechanism is identified, and the inspections must be more general in nature. The U.S. nuclear operating history includes several examples of welds containing degradation which were inspected, but the degradation was not detected by the routine

! Code inspections.

Finally, inherent in the Code Case N-578 approach is a requirement for monitoring the effectiveness of the program, and updating it if new degradation mwhanisms are detected, either in ANO 2 piping, or in piping in similar plants. The combination of these factors will ensure that the inservice inspections performed at ANO under the revised Code Case N-578 program will enhance the overall structural integrity of the piping, relative to the current ASME Section XI program. These inspections, in concert with the high quality ASME Code construction, the

' inherent ductility and leak-before-break characteristics of the piping materials, and the constant monitoring and surveillance of the performance of this piping industry-wide, will insure that the overall plant risk associated with pipe failures is acceptably low, and that the revised program

results in a decrease in such risk.

i l

{

i

Attachment to 2CAN109801 Page 7 of102 NRC Question No. 2.0 The licensee should provide documentation of the process for which systems were selected to be evaluated, and note which systems were reviewed and excluded from the RI-ISI scope.

Entergy Operations Response The original scope of the RI-ISI assessment for the ANO-2 pilot application was to include only those systems or portions thereof encompassed by the existing ANO-2 ISI Program. The scope was to include an assessment of ASME Class 3 piping that is within the boundaries of the existing ISI program, but not subject to NDE. As such, the originally proposed RI-ISI scope represented an increase over the current ISI program relative to the integrity management of system piping i pressure boundary.

1 For the ANO-2 pilot application, an assessment scope providing a one-to-one substitution for the I currently employed program was considered acceptable. However, Entergy Operations went far beyond the current Code NDE boundaries by expanding the RI-ISI assessment scope to include not only ASME Class 3 piping as indicated above, but subsequently Code exempt and non-Code piping as well. This expansion resulted in the scope effectively encompassing the selected systems in their entirety. The entire scope of the RI-ISI assessment is presented in Table 2-1 below.

Implementation of a RI-ISI approach for piping yields an inspection program which is intuitively superior to the inspection program currently employed. The integrity management of the piping systems for ANO-2 is presently accomplished through the application of existing ASME Code rules in conjunction with implementation of augmented inspection programs. This approach 4

currently provides an adequate level of safety for the ANO-2 plant. In recognition of this, application of a RI-ISI approach should be acceptable for any scope chosen at ANO-2.

In summary, the ANO-2 RI-ISI scope envelopes the existing ANO-2 ISI Program for pipirig and ,

extends beyond the current program boundaries to encompass the entire extent of the selected I systems regardless of piping classification. This expanded scope coupled with the application of the RI-ISI approach represents a significant improvement over the existing ISI program.

Attachment to 2CAN109801 Page 8 of 102 Table 2-1 Piping ASME Class 1 ASME Class 2 ASME Class 3 Non-ASME Systems Cumet RI-ISI Current RI-ISI Current RI-ISI Current RI-ISI In ISI Assessed ISI Assessed ISI Assessed ISI Assessed Scope Exams Exams Exams Exams HPSI Yes Yes Yes Yes N/A N/A No* Yes RCS Yes Yes N/A N/A No* Yes N/A N/A CVCS Yes Yes No") Yes No* Yes N/A N/A CSS' N/A N/A Yes Yes N/A N/A N/A N/A LPSI Yes Yes Yes Yes N/A N/A N/A N/A EI<W N/A N/A No* Yes No* Yes No* Yes MFW N/A N/A Yes Yes N/A N/A No* Yes MSS N/A N/A Yes Yes No* Yes No* Yes SWS N/A N/A Yes Yes No* Yes No* Yes Table 2-1 Notes (1) The Class 2 portions of the chemical and volume control and emergency feedwater systems are exempt from ASME Section XI Code NDE requirements per IWC-1222(a) and IWC-1221(a), respectively. This piping was, however, considered in the scope of the RI-ISI i assessment.

(2) The Class 3 portions of the reactor coolant, chemical and volume control, emergency feedwater, main steam and service water systems are not subject to NDE requirements per the ASME Section XI Code. This piping was, however, considered in the scope of the RI-ISI assessment.

(3) The non-ASME Code portions of the high pressure safety injection, emergency feedwater, main feedwater, main steam and service water systems are outside the jurisdiction of the ASME Code and therefore, not subject to NDE requirements per Section XI. This piping was, however, considered in the scope of the RI-ISI assessment.

Systems which are not included in the ANO-2 ISI program, but are analyzed (explicitly or implicitly) in the ANO-2 probabilistic risk analysis (PRA), are discussed below:

Component Cooling Water (CCW) System This system is explicitly analyzed in the ANO-2 PRA. It provides cooling to reactor coolant pump seal and motor bearings, MFW pump lube oil coolers, and to instrument air compressors.

i Attachment to 2CAN109801 Page 9 of102 Loss of this system in the ANO-2 PRA model is assumed to be enveloped by a Loss of Power Conversion System (PCS) initiator (T2). The updated ANO-2 PRA model was run to check the plant response if the CCW system is lost following a turbine trip. The difference in the plant

, response was negligible, change in conditional core damage probability (A CCDP) < 1E-6.

Therefore, it was evaluated that this system has a low safety importance, and does not warrant inclusion in the ANO-2 RI-ISI Program. 4 Auxiliary Cooling Water (ACW) System

, This system is only implicitly included in the ANO-2 PRA model, through initiating event (IE) frequency (Loss of Power Conversion System). It provides cooling to condensate pumps and various turbine loads. It does not have an effect on the plant core damage frequency (CDF) and, therefore, has a low safety imponance, and does not warrant inclusion in the ANO-2 RI-ISI Program.

Instrument Air (IA) System l

This system is explicitly analyzed in the ANO-2 PRA. It provides power to feedwater control and steam dump bypass control. h dependency of steam dump bypass valves on IA is not quanti 6ed in the PRA, due to the redundancy of the air header and the backup accumulator associated with each valve. Lou of this system in the ANO-2 PRA model is assumed to be enveloped by a Loss of PCS initiator (T2). It is noted in the ANO-2 PRA that the IA system does not play a more significant role as an initiator due to the practice of designing safety system components to fail-safe on loss ofIA. The updated ANO-2 PRA model was run to check the plant response ifIA is lost following a turbine trip. The difference in the plant response was negligible (A CCDP < IE-6). Therefore, it was evaluated that this system has a low safety importance, and does not warrant inclusion in the ANO-2 RI-ISI Program.

Auxiliary Feedwater(AFW) System h auxiliary motor-driven feed pump in ANO-2 is part of the main feedwater system. It is used to supply feedwater to the steam generators during plant startup and shutdown conditions. This pump was conservatively, not explicitly, modeled in the ANO-2 PRA. However, credit has been taken for this " system" through operator recovery actions. W updated ANO-2 PRA model was run to check the plant responses if those recoveries can not be credited, given a plant trip. The difference in the plant response was not significant (A CDF = 2E-6/yr), which corresponds to a risk achievement wonh (RAW) of 1.3. Wrefore, it was evaluated that this system has a low safety significance, and does not warrant inclusion in the ANO-2 RI-ISI Program.

i i

i i

i

Attachment to 2CAN109801 Page 10 of102 NRC Question No. 3.0 l

Currently, it is unclear which portions of the Code are intended to be replaced by the licensee's proposed alternative, as the related and non-related portions of the Code have not been specified.

Code Case N-578, referenced by the licensee, provides a more thorough alternative which better defines the implementation of a RI-ISI program. Is the proposed alternative, in essence, to implement Code Case N-5787 If so, this needs to be stated in the licensee's overview described in question 1.0. If not, the licensee needs to provide details regarding the implementation of the proposed alternative, including all deviations from Code requirements. In addition, the licensee needs to address any changes in the current licensing basis (CLB) and confirmation that existing augmented examinations will not be impacted by the proposed alternative.

Entergy Operations Response Clarification of the proposed alternative is provided in the response to NRC Question No.1.0.

The current licensing basis for ANO-2 pertaining to the integrity management of piping includes .

implementation of the following plant augmented examination programs. Table 3-1 provides an l l overview of the impact of the proposed alternative on these augmented programs.

I i

I i

l t

e i

I

-. .. . = . . - _ ~. - - . . - _ . _ . . - - _

Attachment to 2CAN109801 Page 11 of102 Table 3-1 Current Augmented Programs Impact of RI-ISI Alternative l Branch Technical Position MEB 3-1, The current ANO-2 ISI Program defmes a "no break zone"

" Postulated Rupture Locations in Fluid augmented examination program in response to MEB 3-1.

Systems Inside and Outside Contamment" His augmented program is not impacted by the proposed alternative.

l

• NRC Bulletin 88-08, "%ermal The current ANO-2 ISI Program includes augmented l Stresses in Piping CanW to exammations performed in response to these various NRC l Reactor Coolant Systems," issued bulletins and notice. The EPRI RI-ISI process Supplements 1,2 and 3 defmes an explicit set of attributes to consider in assessing the potential existence of a degradation mechanism. The

• NRC P/alletin 88-11," Pressurizer ggf g  ;

Surge Lme Thermal Stratification addressed in these NRC documents were inputs considered

• NRC Information Notice 93-020, in the development of the EPRI degradation mechanism l

" Thermal Fatigue Cracking of criteria. As such, these concerns are inherently considered Feedwater Piping to Steam Generators" in the application of the EPRI RI-ISI process.

Consequently, the RI-ISI program supercedes these

• IE Bulletin 79-17, " Pipe Cracks m.

augmented programs.

Stagnant Borated Water Systems at PWR Plants" Flow Accelerated Corrosion Program This augmented program is not impacted by the proposed alternative.

Service Water Integrity Program An integrity management program for the senice water system presently exists to monitor for degradation from localized corrosion. The program will be reviewed to assess l ey impacts caused by the RI-ISI Program.

1 l

l I

i i

__ ._ _ _ . . . . m._.____ -____ . - _._ _ .. ._ .. .. _ _ _ _ _ _ _ _ _ . _ . _

i Attachment to 2CAN109801 Page 12 of102 NRC Question No. 4.0 In the transmittal letter for RI-ISI submittals for ANO-2, the licensee stated that "The ANO-2 I study was performed consistent with ASME Code Case N-578, Risk-basedRulesfor Class 1, 2, )

and 3 Piping, utilizing the EPRI risk-informed inservice inspection methodology." The licensee should describe whr.e any differences between the EPRI methodology (Reference 12) and Code Case N-578 (Refecanca 13) guidance would have impacted the findings. For example, although l ANO-2 did not identify any pipe segments belonging to Risk Category 1, N-578 would require l inspection of 50% of the total number of elements in this category, and 25% of Risk Category 2 and 3 elements, while the EPRI methodology would require inspection of 25% of the total number elements in Risk Categories 1,2, and 3. Describe the statistical and/or technical bases for l pert'orming examinations on 25% of high risk (Category 1, 2, and 3) segments,10% of medium risk (Category 4 and 5) segments, and no examinations on low risk (Category 6 and 7) segments.

l Entergy Operations Response EPRI TR-106706 and ASME Code Case N-578 were issued for use by plants interested in applying risk-informed inservice inspection technology with the intent of updating these l documents with the lessons learned from the pilot studies. The RI-ISI application at ANO-2 included the utilization of some methodology enhancements. The nature of these enhancements, and how they differ from the methodology requirements currently containef. % EPRI TR-106706 and/or Code Case N-578, are discussed below by subject area.

l Consequence Evaluation Lessons learned from the consequence evaluation that will impact revisions to EPRI l

TR-106706 and/or ASME Code Case N.578 are described in Table 4-1.

l I

l l l

l l

l

l I Attachment to 2CAN109801 l Page 13 of102 Table 4-1 l

l ANO 2 RI-ISI Application

• EPRI Methodology" Code Case N-578 l Table 2-2, used to rank coraequences when a Table 3.2, to be revised in Incorporated into draft pipe break results in a loss of a single or the new EPRI Report (and Ver. N578-1 A j multiple train (no initiator), was extended to Table 3.4).

l include "A Half Train" (mean unavailability of l IE-1). %c new Table 2-2 includes 0,0.5,1, 1.5,2,2.5,3 and >3.5 traans his increased raniang sensitivity.

l

(Table 2-3 is also rewriticsi to reflect the j existence of"A Half Train").

In Table 2-4, I active and I passive failure are Table 3.3, to be revised in Incorporated into draft i the new EPRI Report, and Ver. N578-1A evaluated as " Medium"(instead of" Low"). In general, it is preferable to use plant-specific the plant-specific failure rates for isolatum valves, and determme evaluation to be discussed.

the rank based on the actual values.

Isolation of the break is explicitly evaluated Isolation potentialis Isolation included in (possibility of detection and actxm), and identified as an impostant I-3.2.1 FMEA, (c).

included in the analysis as a mitigating option partin the consequence (a backup train), analysis (Section 3.1).

Plant-specific safety functions are explicitly Safety Functions are Not discussed.

included in the analysis, discussed in connection with Table 3.2, Section 3.2.2.

• Table numbers are taken from the service water evaluation. ,

" Table numbers are taken from EPRI TR-106706. I I

1 Degradation Mechanism Assessment  !

In 1996, EPRI contracted with Structural Integrity Associates (SIA) to conduct an independent  !

review of the degradation mechanisms and associated attributes described in EPRI TR-106706.

This review was documented in SIA Report SIR-96-097. Although different in arrangement, SIR-96-097 is very similar in content to the original list of mechanisms presented in Table 4-1 of EPRI TR-106706. The following are highlights of the differences between the tables in these two documents. l t

i e

, Attachment to 2CAN109801 Page 14 of102 e Corrosion cracking, primary water stress corrosion cracking and intergranular stress corrosion cracking (from Table 4-1 of EPRI TR-106706) were combined under one general topic called

" Stress Corrosion Cracking" in SIR-%-097 with the following subsections:

Intergranular Stress Corrosion Cracking - boiling water reactor (BWR)

Intergranular Stress Corrosion Cracking - pressurized water reactor (PWR)

Trcasgranular Stress Corrosion Cracking External Chloride Stress Cracking Corrosion Primary Water Stress Corrosion Cracking I

1 This rearrangement is more in line with the industry terminology and also consistent with that '

ofsister Code Case N-560.

e A general category called " Localized Corrosion" was proposed with the following subsets

Microbiologically Influenced Corrosion (MIC)

Pitting  ;

4 Crevice Corrosion l Both MIC and crevice corrosion were covered in Table 4-1 of EPRI TR-106706. Pitting is I the only new mechanism in SIA Report SIR-96-097 which was not in Table 4-1 of EPRI  ;

TR-106706. This mechanism is very similar in its attributes to MIC and for all practical purposes is well represented by MIC. It was only added because of the potential for pitting to recur without the presence ofliving organisms or organic material.

. Additional details were provided for the criteria for TASCS to help the user perform the evaluation expeditiously.

o The operating temperature for stainless steel was changed from 200*F to 270'F consistent with the recommendations in the EPRI fatigue management handbook.

e The operating temperature for MIC was changed from 20' - 120*F to <l50*F consistent with industry experience.

• Additional attributes and details were provided for intergranular stress corrosion cracking (IGSCC) in PWRs. A temperature requirement was added in addition to requirements for material susceptibility and tensile stresses. These additional attributes are well established in the industry as the prerequisite for the occurrence ofIGSCC.

t - As stated earlier, it is the intention of EPRI and ASME Section XI to incorporate lessons learned from the pilot plant applications into the next revision of EPRI TR-106706 and Code Case N-578.

I

l Attachment to 2CAN109801 Page 15 of102 As with the current Section XI sampling percentages, explicit statistical bases were not  ;

developed. The technical bases for the RI-ISI sampling percentages are founded in historical evidence which is provided in the following paragraphs and supports the belief that RI-ISI will l provide an effective integrity management program consistent with the goals of Reg Guide 1,174.

1 From a historical perspective, several papers have been published in the literature discussing the I developments of ASME Section XI since the inception of the Code in 1970. In general the inspection program philosophy, sampling population criteria, and the random nature ofinspection element selection have not changed substantially in the past 20 years. The current AShE Section ,

XI examination requirements are summarized in Table 4-2 below, Table 4-2

% Weld Population Examined Leak Test Nondestructive Examination Class 1 100 % 25% for NPS > 1" '

Class 2 -HPSI Only 100 % 7 %% for NWT > 1/5" and NPS 2 2" through NPS S 4" Class 2- Other Systems 100 % 7 %% for NWT 2 3/8" and NPS > 4" Class 3 100 % None Non-Code 'None None

' It should be noted that there are no Risk Category I segments in ANO-2.

The Section XI inspection rules were established only for ASME Class 1, Class 2, and Class 3 piping. No examination requirements were included for other piping outside of these classifications. This piping, sometimes referred to as "non-Code" piping, is usually designed to non-nuclear ANSI B31.1 design standards. Its recognized that there are some instances where non-Code piping may in fact provide an important safety function.

All Class 1, 2 and 3 piping receive system leakage tests at nominal operating pressures and temperatures either each refueling outage (Class 1) or each inspection period (Class 2 and 3).

Volumetric and surface NDE are specified for Class 1 and Class 2 piping only. No volumetric or surface NDE is required for Class 3 piping. In addition, some Class 1 and 2 piping is exempt from NDE. The Class 1 NDE requirements apply to all pipe sizes greater than 1" nominal pipe size (NPS). The Class 2 NDE requirements are dependent upon nominal wall thickness (NWT) and NPS as indicated in Table 4-2 above. Based on the NWT criteria, dependent upon plant design, entire systems or portions thereof may not be subject to examination. As discovered in the ANO-2 pilot application, the results of the RI-ISI assessment would expand the scope of Class 2 piping examined to include piping previously not subject to NDE per current Code

Attachment to 2CAN109801 ,

Page 16 of102  !

requirements.

The examination population specified for Class 1 and 2 piping in Section XI is based on a prescribed percentage of the total number of pressure retaining welds (inspection elements) within that piping classification. For Class 1 piping,25% of all the welds are examined each 10 year inspection interval. For Class 2 piping the sampling criteria is reduced to 71/2%.

In July 1995, the ASME Section XI Task Group on ISI Optimization published their performance study ofinservice inspection requirements for Class 1, Category B-J pressure retaining welds in piping. This study examined the performance ofISI programs in 50 operating plants comprising several hundred years of reactor operation. The results of this study concluded that for Class I piping, if the inspection locations were selected using a risk-informed process, the inspection population could be reduced from the current 25% of the pressure retaining welds to 10%

without sacrificing program quality or safety. This study conciuded that if improved damage j mechanism specific inspection methods and procedures are also implemented, the program quality and reactor safety willimprove.

In order to be confident that the new RI-ISI program will maintain or improve the risk reduction benefits associated with piping inservice inspection, the EPRI inspection strategy employed was designed to meet the following goals.  :

1

• The criteria applied to define minimum inspection populations needs to be simple and '

straightforward so that it can be consistently applied regardless of the design. This type approach will benefit not only the industry, but also the regulator. Therefore, a simple percentage criteria applied to the total number of elements in each risk category was selected.

• The sampling population criteria needs to be sensitive to the type of degradation mechanism present. For some mechanisms, the inspection population needs to be based on performance trending and degradation rate predictions. This is especially true for degradation mechanisms such as FAC. For degradation mechanisms such as IGSCC in BWRs, plant owners have established programs that service experience has proven to be an effective approach; therefore, these inspection strategies should continue to be implemented.

• The examination distribution should be weighted toward those pipe segments in the higher risk categories. Therefore, the sampling criteria in the HIGH risk region categories shall be greater than that for the MEDIUM risk region categories.

• The element selection process and examination methods employed should be designed to ensure that the overall success rate, probability of detection (POD), is improved. This implies that the failure and rupture frequencies under the new program will be reduced.

Attachment to

! 2CAN109801 l Page 17 of102 l l

As such, the element sampling criteria proposed in EPRI TR-106706 and implemented in the I Code Case N-578 pilot application studies is summarized below.

• All piping shall continue to receive system leakage tests regardless of the risk category.

l e All piping segments subject to IGSCC (BWRs) and flow accelerated corrosion (FAC) will I continue to be inspected according to the Owner's existing programs.

• The minimum percentage of examinations in each risk category for piping segments not subject to the degradation mechanisms noted in 2 above is shown in Table 4-3 below.

Table 4-3 Risk Category Risk Region  % Element Selections  % Leak Test 1 HIGH 25 % 100 %

2 HIGH 25 % 100 %

3 HIGH 25 % 100 %

l 4 MEDIUM 10 % 100 %

5 MEDIUM 10% 100 %

l 6 LOW NONE 100 %

l 7 LOW NONE 100 %

For Class 1 piping in MEDIUM risk region categories, a minimum of 10% of the elements will be l inspected. This is designed to be equivalent to the recommendations provided by the ASME l Section XI Task Group on ISI Optimization. Class I piping in the HIGH risk region shall continue to be sampled at 25% of the elements in each category.  ;

Class 2 piping in MEDIUM or HIGH risk regions will be subject to increased inspections as the sampling is increased from 71/2% to 10%, or 25%, respectively.

Class 3 and non-Code piping in MEDIUM or HIGH risk regions will be subject to increased inspections as the sampling is increased from 0% to 10%, or 25%, respectively.

l l

l

Attachment to 2CAN109801 i Page 18 of102 l NRC Question No. 5.0 In the licensee's October,1995 response to question 15 of the RAI regarding the IPE submittal, it was stated that, although the ACC EDG was not credited in the submittal, it would be credited in the "ANO-2 living PRA model". In the January,1997 response to Question 1 of the RAI regarding the AOT extension submittal, it was indicated that the IPE PRA submitted in response to GL 88-20 was still the current model. The licensee's current risk-informed (RI) ISI submittal refers to ANO-1 PRA 94-R-2005-01, Rev. O, August 1992. As discussed in RG 1.174, the engineering analyses used to support RI applications should be based on the as-built and as-r;perated plant. Please;

a. Discuss the process used to determine if, and when, plant procedural or hardware changes should be incorporated into the PRA or, at least, into the risk insights used to support the conclusions of the RIISI submittal.

b. Confirm that all plant and procedural changes which could impact the risk insights used to ,

support the conclusions of the submittal have been evaluated and incorporated if necessary.

Entergy Operations Response l

a) The ANO probabilistic safety assessment (PSA) plant models are being maintained as "living models". The PSA model referenced in the ISI submittal has been superceded by a later model, specifically, Calculation 97-R-1010-02, Rev. O. This model is based on the plant (i.e., plant procedures and hardware) as of March 19, 1993. The plant model is currently undergoing another update. The process is periodic, focuses on plant changes, and, just as in the development of the original individual plant examination (IPE) model, uses engineering judgment to determine the exact scope of which plant changes should and which should not be added to the model.

The EPRI RI-ISI methodology is based on a defense in depth approach rather than a detailed exercise of the PSA model. Thus, the current status of PSA model does not affect the conclusions generated via the use of the EPRI RI-ISI methodology. However, the PSA model was used to validate the overall EPRI risk-informed process. The latest version of the ANO-2 PSA model was employed in this validation process and these results support the conclusions or the EPRI RI-ISI methodology. See Response 16.0 for additional information regarding this validation.

b) A review of plant changes, as reflected on the applicable plant piping isometric drawings, has been accomplished to identify any with potential impact on the RI-ISI submittal conclusions. This effort consisted of a review of any revisions made to isometric drawings referenced in each system calculation. Based on this review, no changes were identified to the plant configuration represented in the ANO-2 submittal that would have an impact on the current RI-ISI evaluation conclusions.

Anehment to 2CAN109801 Page 19 of102 Entergy Operations will perform a comprehensive review of procedural and other input changes between the initial submittal date and actual program implementation to assess their potential impact coincident with NRC issuance of the RI-ISI program safety evaluation report (SER). This assessment will be completed prior to its use. In this manner, the conclusions of the RI-ISI program will be verified to remain accurate at the point of program implementation. Following approval of the program, Entergy Operations will implement administrative controls to monitor the various plant parameters used as inputs in the risk analysis.

Attachment to 2CAN109801 Page 20'of102 NRC Question No. 6.0 Each system evaluation begins with a mtem boundary discussion. This discussion involves parts I

of the system "containing welds that were not entered in the data base." One interpretation of the l discussions in the sub-sections is that segments (containing the welds) are screened out of further evaluation based on a variety ofjustifications:

a. Many segments in the screening analyses (e.g., 3.2.4, EFW) are identified as belonging to category 7 and, "since no element selections are needed for low risk-significant segments,

! the welds for this line were not entered in the database." Are all category 7 welds l excluded from the database? What are the implications of not being entered into the data l l base? That is, are welds in the data base subject to a different level of review, controls, or l l other process than welds not in the data base? In particular, are welds included in the data base but ant selected for ISI inspections treated differently from welds excluded from the data base?

b. The justifications for screening segments out from further detailed evaluation is not clear.

. In most cases (for example the CS system), the screening evaluations seem very similar to l the detailed evaluations in " Consequence Information Report" sheets in the Appendices to each system. That is, there is a consequence determination based on the risk significance of the functions lost (including an occasional reference to the number of back-up trains remaining) and a statement that there are no degradation mechanisms. The major difference between the screening evaluations and the detailed evaluations seems to be the lack of secondary effect (e.g. equipment failure arising from the spacial relationship between the equipment and the ruptured pipe) in the screening evaluation. Screening l evaluations are usually based on conservative assumptions, however, not considering secondary effects does not appear to be conservative. Please provide the guidelines that were used to determine when segments could be screened out in the system boundary section and therefore not included in the detailed evaluation.

c. One justification for screening out some major pipe runs (e.g., main steam downstream of the MSIVs and feedwater lines upstream of 2CV-1073/23-2) includes the statement that,

" risk informed ISI does not support granting relief to elements within the plant FAC Program, the welds for these lines were not included in the database." This statement is unclear. Risk informed ISI is intended to identify areas which, based on risk considerations, should be subjected to increased inspections. Furthermore, both of these ruptures are stated to be risk benign yet both have the potential to rapidly create severe environments in the auxiliary building unless automatic and planned operator actions are successful. Please re-evaluate these lines;

1) without depending on the fact that the lines are in the FAC program,

^

2) identifying the secondary effects of a properly isolated break, and

3) including some evaluation of the likelihood and subsequent consequence of the failure to properly isolate the break.

Attachment to j 2CAN109801 Page 21 of102 i

! Entergy Operations Response a) The RI-ISI evaluation was performed on a system by system basis in acccrdance with the EPRI guideline. This guideline specifies that pipe elements (i.e., welds) within low-risk l significant segments would not be selected for inspection. Low risk significant segments l are defined as Risk Category 6 or 7. Risk Category 6 segments are defined as piping j segments whose failure would result in a Medium consequence impact on prevention of I core damage and the potential for such failure is low (i.e., no degradation mechanisms), or j j piping segments whose failure would result in a Low consequence impact on prevention of i core damage and there is a medium potential (i.e., small leak degradation mechanism) for

! such failure. Likewise, Risk Category 7 segments are defined as piping segments whose j failure would result in a Low consequence impact on prevention of core damage and the i potential for such failure is low, or piping segments whose failure would have no impact

{ on prevention of core damage regardless of the failure potential.

i j

In general, all welds contained within pipe segments of the system main flow path (s) required for core damage mitigation were entered into the database. The welds contained in pipe segments that interfaced with the main flow path (s) were also evaluated to

determine their risk significance A screening process was performed for the interfacing

pipe segments (i.e., lines) to determine if their risk significance could be characterized as l Risk Category 6 or 7. If the welds within the interfacing lines were characterized as Risk

Category 6 or 7, they were not entered into the database because they would be l automatically excluded as candidates for inspection.

i All Risk Category 7 welds were not excluded from the database. Only pipe segments that interfaced with the main flow paths and assessed as low risk significance (i.e., Risk Category 6 or 7) were not entered into the database Regardless of their risk categorization, welds contained in pipe segments of the main flow path (s) were entered into the database.

In summary, all welds within the system boundaries are assessed in a similar manner, whether or not they are entered into the database. The database is used as a tool to track risk-significant (Risk Category 5 and above) welds which are potential candidates for inspection. The welds which are not candidates for Section XI inspections are still exposed to walkdown visual inspections, etc. There are no implications of not being entered into the database Welds excluded from the database are not treated any differently than other low risk significant welds. The purpose of their exclusion was to avoid unnecessary entry into the database.

b) An initial screening of the piping segments within the system boundaries was performed as part of the consequence evaluation. In performing the initial screening, the direct and indirect (including secondary effects) impact of a pipe segment failure was qualitatively assessed to determine its risk significance. As noted in response to question 6(a), the

l l Attachment to l

2CAN109801 Page 22 of102 initial screening was generally performed for piping segments that interfaced with the main flow path (s). Pipe segments characterized as Risk Category 6 or 7, as a result of the initial screening process, were excluded from further detailed evaluation simply to lessen the

, time and effort required for unnecessary documentation. Such pipe segments are not t considered as candidates for inspection. The guidelines and justifications used in the initial screening process are provided below.

The piping segments that are screened from detailed evaluation are identified in the l " System Boundary" sxtion of the system submittals. Piping segments that were not l

included as part of the initial screening process are evaluated in detail in Appendix A of i

the system submittals These piping segments are identified in Table 1 of the " System Boundary" section of the system submittals and were subjected to the detailed " full" analysis.

The following guidelines or justifications were used to identify the piping segments screened from further evaluation, thus the associated welds were not entered into the database (see response to 6a above). Generally, the screening was performed on piping segments that interfaced with the system main flow paths, and satisfied conditions defined below:

, e The potential of a leak occurring in the pipe segment was low (i.e., no degradation mechanisms were identified), and e The postulated failure of the pipe segment would not result in an initiating event (including secondary effects of the failure) as defined in the ANO-2 IPE, and l e The postulated failure occurs in a pipe segment that is not required to accomplish or j support any of the safety functions following a design basis event, including secondary effects, and e There is a high degree of confidence that the postulated failure would be detected and l isolated, if the pipe segment is not normally isolated. Isolation is credited if the l following conditions are satisfied:

The valve used to isolate the break is located high enough above the floor to preclude becoming inoperable due to flooding. Valves within close proximity of the break location are environmentally qualified or protected against spraying orjet impingement.

The flood initiation room is equipped with level indicators that alarm in the control room to alert the operator of an impending flood, or the room is

sufficiently large such that a significant amount of water will not accumulate and pose a flood hazard to equipment within the room.

-wg- g - - *-w e

l Attachment to 2CAN109801 1 Page 23 of102 l

[ . The postulated failure occurs in a piping segment that is included in ANO-2's existing FAC Program and there are no additional degradation mechanisms identified within the segment.

c) Entergy Operations agrees that the intent of the aforementioned sections of the ANO-2 submittal is unclear. RI-ISI is intended to identify those locations requiring inspection and to identify the inspection (s) appropriate for those locations. What was meant by the i aforementioned section in the ANO-2 submittal was that those locations within the main I

steam and main feedwater systems outside of the Section XI ISI boundary are currently incorporated within the existing ANO-2 FAC Program. This program identifies those locations susceptible to FAC and identifies the appropriate inspections and inspection frequencies for those locations. Implementation of this program at ANO-2 has manifested itself in analytical prediction of wear / wastage, component inspections (generally many times more frequent than the ten year Section XI interval), and, as necessary, a recalibration of the prediction models, as well as component repair when wear / wastage may encroach upon minimum wall criteria.

i A review of the applicable piping segments was conducted to determine whether or not  ;

there are other potential degradation mechanisms within these segments. For the segments of concern, a degradation mechanism evaluation was performed using the 1 criteria presented in Table 5 of the system submittals. The evaluation concluded that FAC l is the only potential degradation mechanism present within these particular line segments.

I 1

l

.m . _ ,_ .- _m _ - _ _ _ _ _ . . . - . _ . _ _ . . ~ . . _ . _ . _ _ _ _ _ . _ . ~

Attachment to 2CAN109801 '

Page 24 of102 NRC Question No. 7.0 Reference 1, Section 3.3, item 3 states that motor operators are iudged to be a few feet higher than the valves themselves which appear to be close to the floor (i.e. 2 feet above elev. 360'). It is further stated that a mimher of HPSI valves and the containment spray valves are separated such that there should always be a discharge path for these systems. Why is it necessary to make assumptions regarding position and number?

Entergy Operations Response The HPSI, LPSI, and CSS line injection valves are located in Room 2084 at elevation 360'-0" of the reactor auxiliary building. Other safety related valves located within this aren m ' clude the 4 HPSI hot leg injection valves, the SWS line isolation valves for containment cooling units  !

2VCC-2A and 2VCC-2B, the shutdown cooling line isolation valve and the EFW distribution valves to acam generator 2E-24A. All safety related valves within this area are located two and a half feet or higher above the floor.

The Internal Flood Screeaing Study that was performed for ANO-2 conservatively assumed that all equipment within the flood initiation zone (i.e., Room 2084) is inoperable. Because the HPSI, LPSI, and CSS line injection valves are located in Room 2084, the assumption used in the Flood Screening Study was re-=====1. During the system walkdown that was performed as part of the l evaluation, it was observed that the valves for each of the safety-related systems are strategically located such that it is unlikely a postulated pipe break would impact all valves within the system.

The valve trains are located sufficiently far apart to minimize the impact of spraying or jet impingement, and the' valves are located high enough above the floor to preclude their inoperability due to flooding.

It should be noted that the terms " appear", " judged", and "a number" in the submittal were not intended to imply that assumptions were made regarding position and number. These were used because judgments were made during the walkdowns on the potential effect of a component's location relative to a postulated pipe break in each room.

r

Attachment to 2CAN109801 Page 25 of102 NRC Question No. 8.0 The staff has been unable to identify general guidelines used when performing the flooding and other secondary effects analysis. Some of the specific assumptions we have found are listed below along with an associated question. Does the licensee have any general guidelines regarding secondary effect assumptions?

The analysis assumes that the door into room 2073 will fail when the water level reaches 3 to 5 feet and presumably credits this failure as a means oflimiting the spatial interaction of a flooding event. Credit for a door failing open is also included in HPSI-C-27's consequence, and other studies, e.g., the Chemical Volume and Control system analysis, Section 4.0, item B, credit is taken for non-water tight doors being forced open in the event of flooding in that room, which prevents water levels from reaching key electrical equipment in the room. Under what conditions is it acceptable to assume that a door fails open? Reviewers of the IPE flooding analyses have taken the position that failure of the door should not be credited as a means of relieving flood accumulation unless it is specifically designed to fail at a particular flood height or calculations have been performed with sufficient margin to prove failure will indeed occur.

Reference 1, Section 3.3, item 4 states that MCCs at El 354 (Room 2073) and El 335 (Room 2040) are . assumed to fail if water accumulates to a height of 6" at the MCCs and that accumulation to 6" cannot occur at elevation 354 due to a large floor grating. Please indicate if and how the critical MCC flood height was confirmed. While a steady state flood height of 6" on elevation 354 may not be possible, has consideration been given to wave effects? This may be particularly pertinent following the flood propagation from room 2084 after the intervening door fails with several feet of water behind it (as postulated in the analysis, see previous comment).

ANO-2's IPE only discounts damage to junction boxes if they are flood proof. Reference 1, Section 3.3 , item 6 states that damage to junction boxes is discounted in this analysis since most are at least a few feet off the floor and they appear to be tight and sealed. Why is the failure of junction boxes not systematically evaluated as a secondary effect based on their position and the potential environment? A general assumption should be supported in terms of applicable design standards.

Entergy Operations Response to ist Paragraph in assessing the spatial interactions (i.e., flooding and other secondary effects) caused by a pipe break, the Internal Flood Screening Study for ANO-2 was used along with supplemental information obtained during the system walkdowns. The Internal Flood Screening Study assumed the failure of all equipment within the flood initiation zone. This assumption was modified to reflect additional information obtained during the system walkdown. For example, flood zone RAB-2040-JJ (tank rooms, pump rooms and corridors) is very large and has several compartments. The walkdown revealed that it was not possible for a pipe break occurring in the southern section of this room to cause a spatial interaction with equipment at the northern section of the room. Only equipment within close proximity of the pipe break was assumed to be

Attachment to 2CAN109801 Page 26 of102 impacted by spraying or jet impingement. The large area precludes the accumulation of a significant amount of water and minimizes the threat of flooding.

Entergy Operations Response to 2nd Paragraph The Room 2084 flood scenario is supported as follows:

• Valve operators are 3 feet or more above the floor elevation (see Table 8-1).

• There is a propagation path out of Room 2084 through doors that open in the direction of propagation flow (see Figures 8-1 and 8-2). The door that opens out into Room 2073 is latched, but is unlikely to retain much more than 3 feet of water (this was based on walkdown observations and judgment that the door would buckle and/or the latch would break). Ac ANO-2 evaluation estimates that 5 feet of water is necessary to fail the door, i however, this is considered conservative based on walkdown observations; 3 feet is still judged to be a more realistic assumption. The following items also support a reasonable likelihood of success even without door failure.

• The piping in this room is most likely to fail during a demand challenge The critical MOVs in this room receive an open signal due to a challenge demand (see Table 8-1) that fails the pipe. For piping breaks in systems that get challenged by a LOCA condition, SIAS and CCAS signals, the MOVs are expected to be open (desired position for mitigation) prior to any potential flooding impact. Piping breaks in other systems are discussed below.

• EFW pipe breaks are assumed to occur on demand during non LOCA conditions (e.g.,

loss of feedwater); then, if EFW fails and feedwater/ condensate and AFW are not recovered within about 30 minutes, the HPSI MOVs are opened per EOPs in the Once Through Cooling (OTC) mode of operation. These HPSI MOVs (see Table 8-1) are approximately 3 feet above the floor. Based on EFW pump capacities and floor areas it takes at least 40 minutes to flood these MOVs; this conservatively does not credit water loss through the drains and under or around doors. Also, there is margin in this time because one HPSI MOV is 4 feet above the floor (2CV-5102-2 in Table 8-1). Therefore, the likelihood of flooding all HPSI MOVs before going to OTC is low. It takes a special scenario which assumes a double ended rupture with two EFW pump run out flow, door does not fail, and MOVs are flooded before operators isolate the break or align OTC.

• The shutdown cooling suction MOV is not required to open in the PSA model except for steam generator tube rupture initiators. This is a long term requirement which is conservatively modeled in the PSA, but it is not important. Flooding of these MOVs would not significantly impact analysis.

• The HPSI hot leg injection MOVs are modeled in the PSA and are not important.

Flooding of these MOVs would not significantly impact analysis.

Attachment to 2CAN109801 Page 27 of102 e The CVCS letdown MOV is normally open; failure to close has no impact on PSA or i analysis, and it also receives a containment isolation signal.

Entergy Operations Response to 3rd Paragraph .

1 During the system walkdown, it was noted that the motor control center (MCC) cabinets of concern are floor mounted. Based on the type of cabinet, it was assumed that all electrical equipment within the MCC cabinet are mounted at least 6" from the bottom of the cabinet. It was also assumed that the accumulation of standing water of 6" or greater would cause the electrical equipment within the MCC cabinet to short and then fail. Further inspection confirmed that the MCC cabinets are mounted on sills of I % " high, and the lowest mounted electrical equipment within the cabinet (i.e., the bus bar and switch / indicating lights) is located at least 6" above the mounting sills. It was also confirmed that the cabinets are rated as NEMA Class I and NEMA Enclosure type 1 A which are designed to provide some degree of protection against dirt and dust infiltration. All cabinet doors are gasketed, and although not designed to be water-tight the gaskets can provide some protection against water infiltration into the cabinets.

The outflow of water from the initiating flood zone (i.e., RAB-2084-DD) will propagate to the adjacent flood zone where the MCC 2B62 is located. The likely propagation path will be through the entrance door of room 2084 to a platform area with steps leading to flood zone RAB-2073-DD where the MCC is located. Since the MCC is not located in the vicinity of the door to flood zone RAB-2084-DD, the outflow of water fans out and will travel approximately 32 feet before reaching the wall between the reactor auxiliary building and the turbine building. On reaching the wall, the flow will reverse direction and travel along the corridor of flood zone l RAB-2073-DD to the southern end where the gratings are located. Because the outflow of water l fans out and travels 32 feet before it changes direction, waves will be minimized and their impact  ;

on the MCC will be insignificant. It should also be noted that the MCCs provide power to several  ;

valves in the ECCS injection lines. If the pipe break occurs during an actual demand (i.e.,

accident condition), the valves powered by the MCCs would be repositioned to their recumd positions prior to any shorting of MCC equipment. The failure of the MCC would hat no impact on the ability to deliver makeup to the RCS.

Entergy Operations Response to 4th Paragraph Junction boxes were not evaluated because they do not include spliced cables. They serve as a pull point for cable runs. Terminal boxes are similar to junction boxes, except that they contain spliced cables. Although the terminal boxes within the auxiliary building are equipped with gaskets, they are not designed to be water tight. The gaskets minimize the intrusion of water into the terminal boxes that can occur from spraying. Environmentally qualified (EQ) terminal boxes can withstand the effects of a High Energy Line Break (HELB) condition, including a steam environment but not the submergence in water.

l l

l Attachment to 2CAN109801 Page 28 of102 The system walkdown did not identify any terminal boxes that were mounted on the floor.

Terminal boxes were observed to be mounted at least 2 feet from the floor. The propagation of water from the break initiation zone to other areas, or the size of the room is large enough to i l

minimizes the accumulation of a significant amount of water. The terminal boxes are located high

! enough above the floor to minimize their inoperability due to flooding. l l

l l

l 1

. Attachment to 2CAN109801 Page 29 of102 TABLES-1 I

Motor Operated Valves in Room 2084  !

4 Valve Normal System Figure Description Actuation Motor Height i Position Signal Above Floor (in) 2CV-1025-1 Closed EFW EFW FIG. 5-3B Discherp MOV frena EFW MDP 2P7B (to SG A) EFAS 86 (p.56)  !

2CV-1026-2 Closed EFW EFW FIG. 5-3B Discherp MOV from EFW TDP 2P7A (to SG A) EFAS 83 (p.56) 2CV-1037-1 Open EFW EFW FIG. 5-3C Discharp MOV funn EFW TDP 2P7A (to SG A) EFAS 83 (p.57)  !

2CV-1038-2 Open EFW EFW FIG. 5-3C Discharp MOV freen EFW MDP 2P7B (to SG A) EFAS 83 (p. 57) 2CV-1511-1 Closed SW SW FIG. 5-4 (p. 58) SW Comem==nent Coolers A, frosa Hender 1, "IN" CCAS 37 2CV-1519-1 Closed SW SW FIG. 5-4 (p. 58) SW came=== ear Coolers A, fnun Hender 1,"OUT" CCAS 47 .j

! 2CV-4823-1 Open CVCS CVCS FIG. 3 (p. 27) Leadown Isolanon CIAS 33 i 2CV-5015-1 Closed HPSI HPSI FIG. 3 (p. 44) HPSI Hender #1 toImp A SIAS 35 HPSI FIG. 6 (p. 47)  :

2CV-5016-2 Closed HPSI HPSI FIG. 3 (p. 44) HPSI Hender #2 to Lacy A SIAS 37 l HPSI FIG. 6 (p. 47) I

2CV-5017-1 Closed LPSI LPSI FIG. 7 (p. 44) LPSI to Loop A SIAS 54 2CV-5035-1 Closed HPSI HPSI FIG. 2 (p. 43) HPSI Header #1 toImp B SIAS 36

! HPSI FIG. 6 (p. 47) _

2CV-5036-2 Closed HPSI HPSI FIG. 2 (p. 43) HPSI Hender #2 to Imop B SIAS 36 l HPSI FIG. 6 (p. 47) 2CV-5037-1 Closed LPSI LPSI FIG. 8 (p. 45) LPSI to Imop B SIAS 51 j 2CV-5038-1 Closed LPSI LPSI MG. 3 (p. 40) SDC Stumon None 81 l 2CV-5055-1 Closed HPSI HPSI HG. 5 (p. 46) HPSI Hender #1 toImop C SIAS 38 HPSI MG. 6 (p. 47)  !

I 2CV-5056-2 Closed HPSI HPSI MG. 5 (p. 46) HPSI Header #2 to Loop C SIAS 37 j HPSI FIG. 6 (p. 47) j

{ 2CV-5057-2 Closed LPSI LPSI FIG. 7 (p. 44) LPSI to IAap C SIAS 42

. 2CV-5075-1 Closed HPSI HPSI HG. 4 (p. 45) HPSI Header #1 to Imp D SIAS 36 HPSI FIG. 6 (p. 47) t i

I,

~_ . . _ _ . ..

Attachment to 2CAN109801-Page 30 of102 TABLE 8-1 (cost)

Motor Operated Valves in Room 2084 Valve Normal System Figure hip;on Actuation Motor Height Position Signal Above Floor (in) 4 2CV-5076-2 Closed HPSI IFSI RG. 4 (p. 45) HPSIHeader #2 toImp D SIAS 48  ;

HPSI RG. 6 (p. 47) 2CV-5077-2 Closed LPSI LPSI FIG. 8 (p. 45) LPSI to Loop D SIAS 42 2CV-5101-1 Ma=wl HPSI HPSI RG.12 (p. 53) Hot W HPSI Header #1 to SDC Secnon (HLI) None 48

~

2CV-5102-2 Closed HPSI HPSI RG.12 (p. 53) Hot 14 HPSI Header #2 to SDC Secuan(HL2) None 50 2CV-5612-1 Closed CSS 5-4B CSS 2P35A Discharge MOV to spray manies (A) SIAS 64 i 2CV-5613-2 Closed CSS 5-4B CSS 2P35B Discharge MOV to spray mozzles (B) SIAS 61 i

.i k

Attachment to 2CAN109801

Page 31 of102 i

i Figure 8-1 Ro >m 2084 i

eL tr >

12CV-50171.t i Valve Designator Legend i2Cv s1s2a 1 -E EFW

-S SDC i 2cvais.iu i 4 pg; 4

-C CSS 12cv s3s-i.si

-H HPSI

!  :; l;cs i

j g. 12cvat% ta l 1

I 2cv40562a I i

j i2cv.151St-W l 3 ncv.3m7.i.t i i ru13it.1.w i Reactor Building i

] I 2cv-51011fij l

i 2cva13-2c 1 j l 2CV 5102-2M I  !

12CV.102G2-E I 1 [ p,gg7,94 l

12cy.102514 I I 2Cva7s1M i 12CV.103&2+J

[' l 2Cva7&2H I sc=a Door  ? Room 2084 F '

) Upper South Piping i E Penetration Room

N g i

Spent Fuel Latch NN sc==Dow l Cooling Heat No M

! Exchanger 2E 27 El q

29 360'

. Security ,

Ventilation  !

Door '

Duct Lakh Elevator L J 2M5

<y J-

, 27 , >

El. 354'

• I

Attachment ts 2CAN109801 Page 32 of102 ng a wm : e .: c ..,x

'..N.4fiyyf,ffhKI. h*Vrmy$MNS?DQi[?jf

$ eT - .

97d$74?$ #f%#e d $/hd % % ? I

' Room 2084 Upper Reactor South Building Piping Penetration Area

~

_ l -

, 1 i

h NYkE$$Y2flM Wikpygp.3m

%;;w .

pQ A ;3 Room 2151 Fuel Pool Area

_ 2M5l .

1 I!llilllll i l l l

l MCC 2B62 Room 2073 l l l Access Area i 1

Turbine Building Figure 8-2

Attachment to 2CAN109801 Page 33 of102 1

NRC Question No. 9.0 l

Reference 1, Section 3.3, item 10. Please provide a sample hydraulic calculation to validate that '

the assumption regarding drainage rates via doors and floor drains is adequate to prevent flood accumulation following <4" service water line breaks.

Entergy Operations Response The intent of the hydraulic calculation regarding a 4" service water line break was to determine whether or not the resulting pressure in the affected service water loop would decrease below the low pressure alarm setpoint. The hydraulic calculation performed was not intended to validate the i adequacy of the floor drains in preventing equipment flooding.

According to the Flooding Screening Study, the flow rate resulting from a 4" nominal diameter service water line break is 4,147 gpm. This flow rate is significantly greater than the capacity of a floor drain. Even with multiple drains in a room, the floor drains themselves would not adequately accommodate a 4" service water line break. However, depending on the break location, either the non-water tight doors will be forced opened and allow the water to propagate to other areas or the room is large enough to prevem the accumulation of a significant amount of j water in the flood initiation zone.

1 Attachment to 2CAN109801 Page 34 of102 NRC Question No.10.0 Reference 1, . Table 5-1. Please indicate why the consequence analysis for the first 10 pipe sections in this table do not address the "no isolation case." Is this because failure to isolate does i not result in additional damage to mitigating systems? l 1

Entergy Operations Response Yes, for these piping sections, there are no additional spatial impacts on mitigating systems for the "no isolation case."

l l

l 1

t h

Attachment to 2CAN109801 Page 35 of102 NRC Question No.11.0 Some segment evaluations (HPSI-C-27) include the statement, " propagation from the General Access Area to the ECCS pump rooms is not a concern because the pathways are isolated by SAIS." Other evaluations (LPSI-C-11) include a statement that the ventilation dampers close on SAIS isolating the propagation path to the ECCS pump rooms. Are these the same statements?

l Please explain this SAIS-generated, flood prepagation path isolation.

i Entergy Operations Response I These statements are intended to mean the same thing. The following summarizes:

. The lowest elevation in the reactor auxiliary building (RAB) is at floor El 317.

Propagation to this elevation is into the common corridors (general access area and tendon access area). A stairwell and floor drains provide propagation paths. An annunciator in the control room provides high sump indications.

e At floor El 317 there are three emergency core cooling system (ECCS) rooms (ECCS A, ECCS B, and HPSI C). Each of these rooms is water tight with a heavy waterproof door and conductance type level detectors that alarm in the control room. There are ventilation penetrations into these rooms from the corridor; at El 328 to HPSI C and El 329 to both ECCS A and B rooms. These penetrations isolate automatically on a safety injection signal. The operators are also instructed to isolate these penetrations in responding to high sump level annunciator.

The isolation of the ECCS rooms is described in the ANO-2 RI-ISI analysis, but it is not credited in any of the consequence evaluations.

The ventilation penetrations are located several feet above the floor of the ECCS rooms, and the accumulation of a significant amount of water is required before propagation through the ventilation penetrations may occur.

Flooding analysis has shown that:

e if a break occurs in ECCS Room A or B, it would take more than 230,000 gallons of '

water to reach the ventilation penetrations prior to spill out in the General Access area, and e if a break occurs in the general access area, it would take more than 280,000 gallons of l water (350,000 gallons, if ECCS Room C is included) to reach the ventilation penetration l pnor to spill out into the ECCS Rooms A and B.

i It is highly likely that the flood source would be isolated before 230,000 gallons of water is spilled. If isolation cannot be successfully accomplished in the ANO-2 RI-ISI analysis, it is l

Attachment to 2CAN109801 '

Page 36 of102 ,

assumed that draining more than half of the refueling water tank (250,000 gallons) outside the containment will cause the containment sump recirculation to fail. Therefore, any flooding l assumptions about ECCS rooms are not bounding in the consequence analysis of the breaks in ECCS systems. This is because draining 250,000 gallons into ECCS Room A or B, or the general access area is considered to disable all ECCS/ recirculation.

If the flooding is initiated from a SW piping break, where the refueling water tank (RWT) is not of concern, the flooding of ECCS rooms is analyzed and isolation of the dampers is not credited.

This is also discussed in Section 3.3, Assumptions 13,14, and 15, in the Yankee Nuclear Services Division Calculation No. NSD-018, " Consequence Evaluation of ANO-2 EFW, Containment Spray, and Main Steam & Feedwater System Piping."

Note: Evaluation of LPSI segments LPSI-C-06, -07, -08, -11, and -12 seems to credit the closure of ventilation dampers, but the flooding of rooms is considered in the analysis (a more precise description of the consequences is given for similar breaks in LPSI-C-05 and LPSI-C-10).

Attachment to r 2CAN109801 l Page 37 of102 i

! NRC Question No.12.0 Reference 1, Figure 2-1 summarizes the ISI methodology including the effects ofisolation. In this l figure, and in Table 5-1, the ability to isolate is always treated as the equivalent to one backup t

train. The licensee submittal departs from the EPRI methodology (Reference 12) by taking credit l for the operators probability of failing to isolate a break in a pipe segment as being equivalent to having a " backup train" of a mitigating system for use in the consequence ranking process. This is based on a determination (Reference 14) that operator human error probability (HEP) for failing  ;

to perform corrective actions in response to adequate control room indications is ~1E-2, which is similar to the unreliability of an unaffected back up train being less than or equal to IE-2 (Reference 9, Section 4.1.16). It appears that trains which are judged as not meeting this reliability criterion are treated as being equivalent to 0.5 trains (Reference 1, Table 3-1).

Thus, while automatic isolation features will probably meet the reliability criterion for one back up train with some degree of confidence, isolation features requiring operator actions may not, if subjected to a detailed human reliability analysis. As noted in the submittals, less time is available for operator response and higher stress is placed on the operators in actual demand situations to detect the break and isolate the failure before the core uncovers. In the Service Water Analysis (Reference 1, Section 8), "Several ' low' and ' medium' consequence analysis results depend upon successful operator actions to identify the broken pipe and isolate it before additional impacts occur."

i It is therefore requested that additional information be provided which justifies the manual isolation events as being equivalent to one I train (that is, unreliability less than 0.01) in the context of this analysis. This information should be provided for all events for which isolation is credited, or bounding evaluation (s) may be performed and the characteristics of each action related to the boundary evaluation (s). This information should include the usual data and analysis required to develop an unreliability for a human action. It was noted that items a. and b. below are often included in the current descriptions, and items c. and f. are sometimes given. Items d., i e., and g. are generally not given in the current descriptions. I

a. Indication of event

b. Alarm Response Procedure (e.g., is investigation required before taking action)

c. Location of isolation action (i.e., control room or local)

d. Time available for isolation after investigation

e. Time to implement isolation

f. Procedural guidance

g. Any possible dependencies between isolation action and actions credited in accident mitigation l As noted in Section 8.0 of the Service Water analysis, the licensee states "It may be appropriate to l utilize the training simulator and/or operator interviews to discuss some of the scenarios and confirm that the analysis is not too optimistic and/or to identify procedural improvement." The

Attachment to 2CAN109801 Page 38 of102 licensee should conduct these evaluations to ensure consequence rankings were appropriate, especially considering those cases where actual demands were postulated based on LOCA events.

Entergy Operations Response

, i This response is answered in 2 parts. In the first part, the philosophy associated with the EPRI methodology regarding an order of magnitude approach to ranking consequences is summarized This is important because it reduces the amount of detailed analysis, while at the same time providing a safety improvement to the present ISI process. Specifically, a detailed human reliability analysis was not judged necessary. The second part of the response addresses the specifics of the question.

Order of Magnitude Ranking & the Human Actions The EPRI methodology indicates that isolability and recovery should be considered (Section 3.2.2, Page 3-6), but it does not explicitly say how to credit isolability, including the human contribution. However, it became clear during the pilot applications that credit for isolation should be taken. Otherwise, the importance ranking could be unrealistic. Ranking an isolable pipe segment as "High" with other "High" segments which can not be isolated could potentially have

an impact on the fidelity of the results (assuming that there is a real opportunity and value to isolability). Consistent with good engineering analysis practices, we considered the consequences of both success and failure to isolate, when appropriate.

With regard to the quantitative aspects of backup trains and the EPRI metledology, it was the intent of the methodology to be an order of magnitude approach. As seen in the methodology, a backup train is treated as having a value of approximately lE-2. Again, it became clear during the pilot applications (e.g., checking unavailability against the plant IPE) that certain systems / functions were either closer to 0.1 or between IE-2 and IE-4 (IE-3) and etc. Although we believe that choosing the optimistic 1 train or 2 trains for these cases does not have a significant impact on the overall objectives, a half train (0.1) or one and a ht!f train (IE-3) case was sometimes considered when estimating the consequence ranking. (Also, see our response to NRC question 17.0).

In the case of human actions relative to isolating a pipe segment, for the most part, these are actions not quantified in the plant IPE. Consistent with the intent of the overall methodology, this was treated with an order of magnitude approach. In general, a detailed human reliability analysis was not performed. In most cases, if there is a reasonable opportunity for detection with procedural guidance, or an obvious operator response, the operator was credited as one backup train (IE-2). This is judged reasonable for several reasons:

• If we allowed no credit for the operator when there is a real opportunity, the importance of the pipe would potentially be unnecessarily high and the fidelity of the ranking would be

, significantly reduced.

1- c - - . - -

Attachment to 2CAN109801 Page 39 of102 e The consequence analysis methodology assumes that the pipe break size is equivalent to the pipe diameter relative to impact (i.e., flow diversion and potential spatial impacts).

Although sensitivity studies have not been performed on this conservative assumption, we believe that there are smaller breaks that could still impact the system with potential spatial impacts, but provide more time for the operators. In other words, a more detailed analysis that considered a spectrum of pipe break sizes would likely benefit the operators on average.

• In standby systems, the pipe break is assumed to occur during an accident demand (e.g.,

LOCA) which has the potential to significantly impact human reliability, at least in the short term. The potential for leakage detection before the demand depends on the degradation mechanism and is a complicated subject, but assuming that it occurs during the accident is clearly conservative. Also, human reliability is dependent on the type of demand For example, human failure probability for the IE-4/yr large LOCA may be

>0.01 (or even >0.1), but this, in combination with the IE-4 challenge, would provide a Medium consequence. On the other hand, the IE-2/yr small LOCA gives more time for the operators to recover and human failure probability is < 0.01. Again, a more detailed demand analysis would likely benefit the operators.

In summary, it is felt that the present analysis provides a reasonable level of detail and significantly improves past analyses.

Additional Information for Credited Manual Isolation Events Manual isolation event credit was employed as follows:

For all isolation actions credited in the ANO-2 RI ISI evaluation:

• There is a control room alarm to which the operator will respond to by investigating or taking actions to identify the leak.

• Parts of the HPSI injection lines inside containment are exceptions (Consequence Segments HPSI-C-18, -19, -20, and-21). For those segments, there are other indications credited in the analysis, and defined in Table 12-2.

. Each alarm's response is directed by the corresponding procedure.

. All isolation actions can be taken from the control room.

Note: There are a few cases where the local isolation can be performed in order to restore an affected train. Those isolation actions are not credited.

Attachment to 2CAN109801 Page 40 of102 The interaction between mitigation of an unrelated initiating event and isolation was always considered in evalua:ing isolation possibility. For the initiators that create the high stress situations, like LOCAs, this interaction was also discussed with the plant.

Manual isolation events are mainly credited in four out of nine ANO-2 systems: HPSI, CSS, EFW and SWS. Additional information to justify crediting isolation for those systems is given below.

HPSI Operator isolation is credited in the majority of HPSI consequence segments (38 out of 46).

Most often, the isolation is the only credited backup train, assuming LOCA demand, which results in a " Medium" consequence rank. Locations of the break are in the east and west ECCS rooms, HPSI-C rooms, south piping penetration area and general access area. The HPSI injection lines are also in the containment.

Analyzed isolation failure and corresponding timings are given below:

Failure of HPSI, during SLOCA, due to inadequate flow; time to isolate is 44 minutes (time to restore HPSI flow before core uncovery)

Failure due to the flooding of ECCS rooms; time to flood all ECCS equipment estimated to be enveloped by the time to lose half of the RWT inventory (in the worst case, takes over 300,000 gallons to flood all ECCS equipment which is more than half of the RWT inventory)

Failure due to the loss of RWT inventory outside of the containment; time to lose half of RWT inventory is estimated to be over 140 minutes.

For the worst HPSI break outside of containment:

(a)&(b) For the breaks outside the containment, indication and alarm response procedures are No 1 and No 5 in Table 12-1.

(c) All breaks can be isolated from the control room (d) After alarm, the diagnosis process will start and an operator would be dispatched to investigate the cause. It should take approximately 5 minutes to determine the cause of the alarm and report to the control room. Therefore, time available for isolation, after diagnosis is close to 40 minutes.

(e) Once the leak source has been determined, the control room could isolate the leak in less than 10 minutes (f) Given in Table 12-1, and LOCA EOP 2203.003.

Attachmenm 2CAN109801 Page 41 of102 (g) No mitigating actions are credited ifisolation is not successful. Establishing HPSI flow is a priority during this type of event.

Operators need 15 minutes to isolate the break, while they have 44 minutes available. Crediting this action as one backup train is therefore reasonable.

For the HPSI breaks inside containment, it will be more difficult to diagnose the break. But isolation failures are reduced, because the loss of RWT and flooding of ECCS equipment are not an issue. The operator has to rely on his diagnostic skills. Available information is defined in '

Table 12-2.

Attachment to l 2CAN109801 l Page 42 of102 i

t l TABLE 12-1 ALA'RMS AND RESPONSE PROCEDURE No. ALARM ANNUNCIATOR ANNUNCIATOR CORRECTIVE ACTION (ACA) 2K15-Al

1. RAB Sump LevelHi 2203.012W

2. ESF Room Ievel Hi 2K12-H8 2203.012L

3. EFW Room Level Hi 2K12-H9 2203.012L

4. Turbine Building Level Hi 2K12-J8,19 2203.012L

5. Waste Drain Tank (2T20) Level Hi 2K15-A2,A3 2203.012W A) 2P7A Main Steam Pressure Lo 2K05-K8 2203.012E B) SW Header Pressure Low (loop 1) 2K06-A6 2203.012F SW Header Pressure Imv (loop 2) 2K05-A6 2203.012E C) CS Pumps Flow 2K05-El 2203.012E 2K06-El 2203.012F D) EFW Pumps Flow and Discharge 2K07-F9 2203.012G Pressure Low 2K07<i9, H9 Other Relevant Procedures:

Standard Post Trip Actons (SPTA) EOP 2202.001 l

LOCA EOP 2202.003 l Standard Attachments EOP 2202.010 i

Securing CCW 2202.010 Att. 6 l

Attachment to

- 2CAN109801 Page 43 of102 TABLE 12-2 ADDITIONAL INDICATION FOR HPSI BREAKS e Inappropriately High HPSI Injection Flow: I

> The main HPSI header flow instrumentation

=> The HPSI injection line flow instrumentation.

e ' Low HPSI Pump Discharge Pressure -

(RCS pressure)

• SIAS Pump Flow Verification - HPSI Flow Curve e Disconnect between RWT Inventory and HPSI Pump Known Capacity e Disconnect between ECCS System Flows and 'RCS Inventory Response

. The pressure alarm used to monitor back-leakage of the injection check valves would l not be annunciated as expected when HPSI pumps are running and RCS pressure is l greater than 750 psig.

TABLE 12-3 )

SUMMARY

OF HOW ISOLATION OF HPSI BREAKS OUTSIDE CONTAINMENT DEPENDS ON THE DEMAND LOCA Demand Exposure Controlling Success Criteria Credit to HEP Needed (events / year) Tinw(year) for Medium Consequence Small (SE-3) 0.25 In=Aa==*a flow, time to core damage is ~44 min 0.08 Medium (1E-3) 0.25 Loss of RWT outside containment. If Medium 0.40 LOCA inside containment is greater than HPSI flow outside, HPSI break must be isolated after transfer to recirculaten (i.e., at least % RWT inventory inside contamment). Time to recirculation is 30 minutes Large (IE-4) 0.25 Same as Medium LOCA except time to < l .0 recirculation is less than 30 minutes

-. . . - . _ _ - . - . - - . - - - ~ _ . . - - - _ - _ - - - - . - - - . - . _ .

I Attachment ts 2CAN109801 Page 44 of102 l

css Operator isolation is credited in 80% of CSS consequence segments (24 out of 30). ORen the isolation is the only credited backup train, assuming LOCA demand which results in the

" Medium" consequence rank. Location of the assumed breaks are in east and west ECCS rooms, south piping penetration area, and general access area. 3 For a bounding break in an emergency safety feature (ESF) room, analyzed isolation failure and corresponding timings are given below:

Failure due to the flooding of ECCS rooms; time to flood ECCS equipment (enveloped by the time to lose half of the RWT inventory).

L Failure due to the lost of the RWT inventory outside of the containment; time to lose half of the RWT inventory estimated to be 60 minutes for CSS discharge piping.

(a)&(b) For the CSS break, indication and alarm response procedures are No. 2 and (C) in Table 12-1.

l (c) All breaks can be isolated from the control room.

l (d) After the alarm, an operator would be dispatched to investigate the cause. It would be doubtful that the entry into the room would be possible due to flooding, given the aize of the pipe rupture. Time for all of the action will be estimated in (e).

(e) The ACA for low CSS header flow will direct isolation of the spray pump l

discharge isolation valve. The ACA for ESF room level gives general directions to l isolate all piping in the room. According to plant analysis, this can take up to 30 minutes, depending on other complications.

(f) Given in Table 12-1, and LOCA EDP 2202.003.

(g) No mitigating actions are credited if the isolation is not successful.

Operators need 30 minutes to isolate the break, and they have 60 minutes available. Crediting this

! action as one backup train is therefore reasonable.

The time to lose the RWT inventory could be shorter for some larger piping on the suction side.

In this case, this piping is normally under the RWT head pressure, and it is more likely that it

, would leak during normal operation rather than during demand. The isolation in these cases was credited as one backup train.

i l

_- -. . . . . - - . - .- - .-- . ~ . - - - - - - - - . - - . -

Attachment to 2CAN109801 Page 45 of102 EFW Operator isolation is credited in more than 50% of EFW consequence segments (14 out of 25).

Isolation of the break was not the only backup train available for these cases (2 or 3 backups available). Assuming a " Loss of PCS" demand, the consequence rank is either " Medium" (2 backup train) or " Low" (more than 2 backup trains). Location of the assumed breaks are in EFW pump areas and north and south penetration areas. The EFW lines are also in the containment.

The isolation failures of the most concern are; Loss of feed to SGs; available time to restore cooling is at least 30 minutes.

Flooding of MCC 2B52, which influences availability of one train of "Once Through Cooling" (CST will not flood ECCS Rooms). Time to flood MCC 2B52 is estimated to be greater than one hour.

For demand failure cases:

(a) & (b) The break indication and alarm response procedures are No. 3 and (D) in Table 12-1, (c) Most breaks can be isolated from the control room.

(d) During assessment of safety functions in 2202.010, Standard Post Trip Action (SPTA), the operator will check EFW flow. It would take 5 to 10 minutes before this point in the SPTA was reached. An operator would be dispatched to investigate the cause of the alarms and should report back to the control room within 5 minutes.

(e) According to the plant analysis, an additional 5 minutes or less would be required to secure the pump and isolate the break.

(f) Given in Table 12-1 and SPTA 2202.010.

(g) This mitigating action can interfere with mitigating action of aligning "Once Through Cooling." The dependency is not considered to be significant, because the operators will be concentrated on re-establishing the heat removal function.

Operators need 20 minutes or less to isolate the break, they have a minimum of 30 minutes available. Crediting this action as one backup train is therefore reasonable.

.~ - .- - - . - . - . _ . - . --. .. . . . - . . - . . - . _ . - -

Attachment to I 2CAN109801 Page 46 of102 SWS l Operator isolation is credited in 75% of SWS consequence segments (37 out of 49). In half of ,

those segments, isolation is the only credited backup train. If a reactor trip occurs as a result of I losing a SWS train, only one available backup train leads to the "High" consequence rank. If "LOCA" or "LOSP" are assumed demands, the corresponding consequence rank is " Medium".

The locations of the break are in the reactor auxiliary building, turbine auxiliary building, turbine  !

building, yard and containment.

The isolation failure of the most concern is the flooding of the ECCS areas; time to flood ECCS l

equipment is estimated to be about 30 minutes.

i l

The below analysis is for breaks either in the ESF room or general access area:

(a)&(b) For this break, indication and alarm response procedures are No. I and 2 and B) in Table 12-1.

i (c) Breaks can be isolated from the control room.

(d) Operating crew should be able to determine that the SWS line has ruptured based on the above indication, in a very short time (about I minute). It would take 5 minutes to investigate, discover, and report the leak. Therefore, at least 20 minutes are left for action.

(e) AOP 2203.022 provides directions to locate and isolate the leak. AOP 2203.022 would be performed in conjunction with LOCA Emergency Operating Procedure (EOP) 2202.003. The first isolation valves are in the flooded area, and the entire train of SWS may need to be isolated. An additional 15 minutes to secure the SWS loop would be required to stop the leak.

(f) Given in Table 12-1, AOP 2203.022 (g) No major dependencies.

Operators need less than 25 minutes to isolate the break, and they have 50 minutes available.

Crediting this action as one backup train is therefore reasonable.

Other Specifics l

Reference 1, Table 3-1 does not include the probability of human failure to isolate. This table

, includes mitigating systems / trains from the IPE which may include operator actions needed for the system / train success. AFW does include the operator, and it is assumed to dominate; because of dependencies, including the operator, only one half train was credited. Turbine EFW is assumed to be dominated by equipment unavailability.

l

l Attachment to 2CAN109801 Page 47 of102 l Operator Response Time In order to further confirm the postulated five minute operator response time, an operator was dispatched from the control room to an ECCS pump room by the shift superintendent.

Dispatching from the control room represents the furthest distance and most time consuming route which would typically be encountered by a waste control or control room operator to reach the ECCS rooms at the lowest level of the reactor auxiliary building. The waste control operator was told only that an ECCS room level alarm had annunciated and that he was to investigate and report back to the control room (i.e., he was not aware that he was being timed or that this was not a real alarm). Upon entering the ECCS room and finding no indication ofleakage he exited the pump room to the general area of the elevation and opened the manual drain valve from the ECCS pump room drainage pit to drain any water accumulated in the line. He then reclosed the valve, reentered the pump room to reconfirm his observation, exited the pump room and proceeded to call the control room from the phone in the general area of this elevation to report his findings. That entire process took 5 minutes, 27 seconds. It is estimated that if he had reported back upon completing the initial observation in the pump room (which he certainly I would have done if there had been leakage), that the response time would have been four to four and one-half minutes. This exercise is considered to provide a very good representation of a j typical response and is no doubt conservative in that a higher sense of urgency would no doubt be present in responding to this alarm during a LOCA or other abnormal event.

2

Attachment to 2CAN109801 Page 48 of102 l NRC Question No.13.0 i

As noted in the previous question, the licensee's submittal takes credit for the probability of isolation failure as being equivalent to having a backup mitigating system train even when no actual system trains are available. For example, the consequence analysis for HPSI pipe segment HPSI-C-01 (Reference 4) indicates that for the case where the postulated failed segment remains unisolated, the HPSI would fail and no backup systems to mitigate core damage are available. As noted in Section 4.0 of the submittal for the HPSI system, the Level 1 PRA success criteria requires that HPSI flow must be established within 44 minutes of LOCA occurrence to preclude the core from being uncovered. Conservative estimates of operator response time to isolate the postulated line breaks during a LOCA demand is 30 to 35 minutes. Assuming failure to isolate as a backup train allows the subsequent consequence ranking to be " medium" rather than "high" in this case.

In the Service Water analysis (Reference 1) for some segments, e.g., SW-C-08, credit is taken for two such independent operator actions to isolate the break (to prevent loss of all Service Water) and/or recover other plant systems. Consideration of these operator actions as equivalent to two separate backup trains results in a " medium" consequence assessment for this pipe segment. A similar assessment is used to justify a medium consequence for Shutdown Cooling piping (Reference 5). The licensee should provide further analysis for these human actions to ensure that HEPs would not result in higher probability of failure than the IE-2 (for the HPSI case noted above) and IE-4 (for Service Water and SDC) values assumed by considering these actions as equivalent backup trains, for each segment where probability of failure to isolate has been credited. Please address this in terms of the reliability of the individual actions and the potential dependencies between these actions.

Entergy Operations Response The operators isolating a break before additional consequences occur is a mitigating capability of the plant. In some cases, mitigating systems / trains contain only hardware and in other cases they contain both hardware and human actions.

As described in the response to NRC question 12.0, an order of magnitude approach, using IE-2 for operator failure, was used when there is indication and either guidance or obvious mitigating operator actions. The HPSI break inside containment HPSI-C-01 is also discussed in the previous response. No human dependencies were identified with this operator action and others in the IPE, because failure is conservatively assumed to cause core damage.

A lE-4 value was used for SW-C-08 because the break is in the turbine building (with no propagation impacts on safeguards systems) and has a loss of cooling impact which is judged to provide additional time and opportunity for the operators. The first opportunity exists inunediately after low service water header pressure and sump alarms alert the operators. If isolation does not occur, operating equipment and their respective areas will heat-up providing additionalindication.

l

. . - - - - - - . - _ - - - _ - ~ - .-. - - - _ - .. - . - . -_ - -.

i Attachment to 2CAN109801 Page 49 of102 i

I The above analysis, which assumes two recovery actions is conservative, since it assumed that both trains of EFW would fail due to the loss of room cooling following the loss of SW. This is l not the case, since in the updated ANO-2 PRA EFW was not considered to fail on the loss of

room cooling or on the loss of SW. Per Table 3-1 of the analysis, the availability of both trains of i

! EFW provida 1.5 trains of backup. Since operator isolation of SW MOV 2CV-1530-1 or l operator isolation of 2CV-1531-2 will ru tore the operability of SW Loop II and will restore the "Once Through Cooling" capability, taking credit for either operator isolation as only one additional train results in 2.5 backup trains. The availability of 2.5 backup trains results in a

" Medium" consequence assessment for this pipe segment.

! It should be noted that the statement in Table 2-3 ofNSD-023 (i.e., use the higher of Table 2-1 or l Table 2-3 rankings) suggests that the consequence rank of"High" should be used rather than

" Medium", since T7 is ranked "High" in Table 2-1. However, this note is not applicable to this scenario, since the T7 initiator modeled in the PRA differs from that of the SW lou due to a pipe break in segment SW-C-08. The differences are in the recovery actions and the number of SW pumps available for recovery. Note: Table 2-3 should further state that using Table 2-1 only applies to initiators which are identical to those modeled in the PRA.

The loss of shutdown cooling assessment is based on a review of potential shutdown configurations to obtain confidence that the " Medium" consequence identified for the at-power analysis is also reasonable for shutdown events. If a pipe break during shutdown results in an initiating event, a IE-4 CCDP is estimated for mitigation of" Loss of Shutdown Cooling" events.

Note: Table 2-1, for evaluation of initiating events only applies to events at power. Since mitigating this event is dependent on operator, it is also necessary to confirm a value of IE-4 for the human actions. Two states and two types of scenarios were considered for each state. The following summarizes each state:

State 1: Initial Alignment to SDC - RCS temperature and pressure are most severe and a potential pipe break is judged most likely to occur during this demand challenge. Operator anticipation and attentiveness is also judged to be high during this evolution; thus, two opportunities for recovery were assessed for this state: " isolated early" and " isolated late".

A reliable " isolated early" is based on operator being attentive during this initial alignment.

Isolation may be required very quickly (within minutes) with RCS at shutdown cooling entry conditions. Loss of Shutdown Cooling Procedure 2203.029 identifies entry condition alarms and directs isolation at Step 4. Given " isolated early" fails and given only 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> into an outage (i.e., about the earliest SDC entry conditions are reached), core uncovery is expected to occur about 30 minutes after the RCS inventory falls to the level of the bottom of the hot leg. Operator action to assure a makeup source to the core is likely in this time frame.

I State 2: Cold Shutdown or Refueling - RCS temperature and pressure are more benign and a potential pipe break is judged less likely based on the previous demand challenge. Operator

i l

l Attachment to 2CAN109801 Page 50 of102 anticipation or attentiveness may be lower during certain steady state conditions (e.g., no major evolution changes such as mid-loop operation).

The analysis and timing depends on the specific plant configuration (e.g., mid-loop versus refuel l cavity full). Given that the plant is not at mid-loop, the same recoveries as in State 1 apply. l However, if the refueling cavity is full, the operator has a long time to isolate the break before the refueling cavity is drained. And, given that the decay heat is lower than for State 1, there is more time for operator recovery after the RCS drains to the bottom of the hot leg. At midloop, early isolation is probably irrelevant, because the difference in level between mid-loop and the bottom of the hot leg is relatively small. However, during mid-loop operation, two makeup trains are required to be operable. Thus, two trains of recovery are available. Availability of makeup trains during shutdown is discussed in detail in the response to NRC question 24.

l

Attachment ts l 2CAN109801 Page $1 of102 NRC Question No.14.0 Reference 1. The submittal uses the ANO-2 IPE model to predict CCDP for pipe ruptures causing only an initiating event. The IPE model makes several assumptions in developing the SW logic model. For example, the following is assumed:

a) 2P4A and 2P4C are running and 2P4B is in standby, j b) 2P4A and 2P4B are aligned to loop I supplying Auxiliary Cooling Water (ACW), '

c) 2P4C is supplying loop II and isolated from loop I and ACW.

Please explain how these assumptions were factored in when predicting CCDP for SW pipe ruptures.

Entergy Operations Response A different configuration from the one assumed in the IPE is shown in Reference 1 Figure 5-1; Pump B is aligned to toop II instead ofloop I. However, all different alignments of SWS pumps were considered in the consequence analysis (see, for example, the response to question 10.0). If L the different configurations were not considered, consequence SW-C-02A in Figure 5-1 would be ranked " Low" instead of" Medium."

Also, it should be noted that use of the ANO-2 IPE model to predict CCDP for ruptures cJng an initiating event should be adjusted to account for the fact that recovery modeled in the IPE may not apply for certain pipe breaks. CCDPs for initiators T8 and T9 in Reference 1 are close to a " Low" consequence (~1E-6), but are definitely a " Medium" consequence when recovery of a lost loop is not allowed. This was confirmed by considering the number of backup trains available (see Reference 1 Table 5-1). For example, with loss of a service water loop (initiators T8 or T9), j one train of EFW and one train of the emergency core cooling system (once-through cooling) are available, and the power conversion system can be recovered in many cases This was judged to i provide at least 2 backup trains necessary for a " Medium" consequence rank. This was later confirmed with an IPE calculation.

t

. . - . . . - -. . . - . - , _- - _ _ - . . - _ ~ - _ _ - - - _ .

Attachment to 2CAN109801 Page 52 of102 NRC Question No.15.0 Reference 1. In Figure 3-1, "A Simplified Success Criteria for Transients," the operator's action to initiate once-through cooling (feed and bleed) is credited as a train. The success criterion defined for the function of"RCS and Core Heat Removal" departs from the formulation presented in IPEs functional event tree structures. As noted in the SRP and in the EPRI guidance, systems should be evaluated for each plant safety function (e.g., reactivity control, RCS inventory, decay .

heat removal, etc.) Only the Service Water submittal provided an analysis of the critical plant l safety functions and associated success criteria. A discussion of the critical safety functions and i

success criteria is necessary to allow determination of the number of available mitigating trains during the consequence evaluation. The following considerations or clarifications should be l evaluated by the licensee in regard to plant safety functions and success criteria:

a) Is it fair to say that in the licensee's methodology, a backup train represents a success path? What is the definition of a backup train in the methodology? How does a backup train relate to the function of the train / system considered lost?

b) Since each of the submittals are provided as stand-alone documents, each should contain a discussion of the pertinent critical safety functions and success criteria with respect to the system being evaluated.

i c) Simplified success criteria diagrams should be provided in each submittal similar to that provided by Figures 3-1 A and 3-1B in the Service Water analysis. The simplified success criteria diagrams should more clearly define which critical safety functions are being represented and how the block diagram redundant success paths relate to backup trains noted in Service Water Table 3-1. (Assumed System and Train Backup).

d) Table 3-1 is confusing in that it contains system / function / trains that are noted as not being used in the analysis, yet appear in the success criteria figures (e.g., SDBCS/Cond in Figure 3-1 A, and LPSI A&B and SDC recovery in Figure 3-1B.)

e) Are two 0.5 trains, e.g., turbine EFW and AFW credited as equivalent to one backup train?

Entergy Operations Response a) Yes, a backup train represents a functional success path. A backup train for a certain function is a train available for mitigating events which challenge the same function.

Usually, it is the safety function (s) that is affected by the pipe break that is most important and chosen for the analysis.

b) A list of critical safety functions is provided as enclosure NSD-018 supplied in the first ANO RI-ISI submittal and in NSD-023 in the second submittal. Each of these critical safety functions is described in these documents. These descriptions include which plant

Attachment to 2CAN109801 Page 53 of102 systems / actions provide which safety function. Figures 3-1A and B in these documents

- depict these success criteria graphically. These critical safety functions are generically applicable to a'l systems in the scope of the RI-ISI submittal. For further clarification, a more detailed breakdown of these critical safety functions is provided below.

• Reactivity Control - This safety function is required to shutdown the neutron power production in the core. Reactivity control can be accomplished by removing power to the control rods thus enabling them to fall into the reactor core. This safety function is not explicitly included in the consequence evaluation. Although this safety function is required l immediately upon demand to terminate neutron power production, a pipe failure is judged i

more likely to cause a reactor trip rather than prevent the reactor from tripping.

• RCS/ Core Heat Removal - This safety function involves the transfer of heat from the primary system. This safety function can be accomplished by transferring heat from the primary system to the secondary system via the steam generators or by direct heat removal from the reactor core via Once Through Cooling (OTC), also known as " Feed and Bleed".

l For transients, the secondary heat removal systems, which include use of the steam l generators with either the main feedwater, emergency feedwater, or auxiliary feedwater systems, can provide the RCS/ Core Heat Removal function. For transients, if the RCS/ core heat removal function is successful via success of the secondary heat removal systems, then the plant response to the transient is considered a success. If the secondary heat removal systems are not available, operator actuation of the HPSI system and  ;

opening of a pressurizer vent path (ECCS vent or LTOP path) will depressurize the RCS l to allow HPSI injection and will provide an RCS heat removal path. This mode of  ;

l RCS/ core cooling is known as Once Through Cooling (OTC). For this success path, both the RCS Inventory Control and the Long Term Inventory Control / Heat Removal functions are also required. These functions are described below.

Similar to transients, for small LOCAs, the RCS/ core heat removal function is provided by either the secondary heat removal systems or OTC. But, unlike transients, for small LOCAs, successful RCS/ core heat removal either via a secondary heat removal system or via OTC still requires RCS inventory control and long term inventory control / heat removal functions to succeed The RCS/ core heat removal function is not considered for medium or large LOCAs, since for taese LOCAs the break is large enough to both disrupt secondary heat removal and to depressurize the RCS without the need to open either the ECCS vent or LTOP valves.

Like small LOCAs, both RCS inventory control and long term inventory control / heat removal functions are required for medium and large LOCAs.

i e RCS Inventory Control - This safety function involves achieving and maintaining the level of the reactor coolant to prevent the core from being uncovered. This safety function applies only during the injection phase of HPSI/LPSI operation. The long term inventory I

I Attachment to 2CAN109801 Page 54 of102 l control / heat removal function, discussed further below, addresses core cooling during the l

recirculation phase of HPSI operation.

For transients involving OTC, for small LOCAs, and for medium LOCAs, RCS inventory control is provided by one of three HPSI pumps drawing suction from the RWT For large LOCAs, RCS inventory control is provided by one of two LPSI pumps, one of three HPSI pumps, and by three of four SIT tanks.

• Long Term RCS Inventory Control / Heat Removal - This safety function involves maintaining the level of the reactor coolant to prevent the core from being uncovered during the recirculation phase of HPSI operation. Success of this function involves heat l removal from the recirculating water in order to assure the long term operation of ECCS j equipment and containment integrity.

During the recirculation phase (or long term inventory control / heat removal phase) of l operation, the inventory collected in the containment sump is used to naintain adequate l level in the RCS. One of three HPSI pumps is used in this mode of operation. In addition to the HPSI pump, one of two containment spray pumps in conjunction with the associated shutdown cooling heat exchanger is used to provide RCS and containment heat removal. One of two containment spray pumps and two of four containment cooling units can also be used for continued RCS and containment heat removal.

• Containment Integrity - This safety function involves the isolation of the affected flow path to prevent the loss of reactor coolant outside the containment. For success, at least one containment barrier must remain intact.

This critical safety function is treated separately from the others. To maintain the consequence category determined from the above functions, at least one containment barrier must be available or there must be margin in the number of available mitigating trains. Otherwise the consequence category is adjusted.

As noted above, the critical functions are included in the simplified success diagrams shown as Figures 3-1 A and B in the NSD-018 and NSD-023 documents. These figures are identical and generically applicable to all systems in the scope of the RI-ISI submittal.

The figures provide the system success criteria. For further clarification, Figures 15-1 and 15-2 are provided below. These figures are expanded versions of Figures 3-1 A and B in NSD-018 and -023 and more clearly depict the relationship between critical functions and systems which support these functions.

c) As noted above, simplified success diagrams were provided as Figures 3-1 A and B in enclosure NSD-018 supplied in the first ANO RI-ISI submittal and in NSD-023 in the second submittal. These figures are generically applicable to all systems in the scope of 1

the submittal. For further clarification, Figures 15-1 and 15-2 are provided below. These figures are expanded versions of Figures 3-1 A and B in NSD-018 and -023 and more l

. . -. _ . ~ - - . _ - - - . . . - - - . - . - . - . . . _ . - - . - . -

Attachment to 2CAN109801 l Page 55 of102 l clearly depict the relationship between critical functions and systems which support these functions.

d) For completeness, some capabilities not used in the analysis are shown both in Table 3-1 and Figures 3-1A and 3-1B. In addition, there are typos in the table. The following provides clarification:

• LPSI A and LPSI B are credited as 1 backup train each in the analysis. Table 3-1 incorrectly says they are not used.

. "SDBCS/Cond" was not used in the analysis as shown in Table 3-1. Most piping either causes a LOCA (e.g., RCS), was analyzed in response to a LOCA (e.g., CSS, HPSI, LPSI), or was analyzed in response to loss of the power conversion system (e.g., EFW).

For these cases, use of and recovery of PCS was not credited. In Figure 3-1 A, l "SDBCS/Cond" is shown with MFW, but SDBCS/Cond was not credited. Also, SDBCS  !

in Figure 3-1B is not credited. In the service water analysis, PCS was credited and associated with MFW.

l

• "SDC Recovery" in Figure 3-1B is not credited in the analysis. However, loss of shutdown cooling during plant shutdown was considered in the analysis.

• Also, in Table 3-1, HPSI (gate H001) and Containment Spray (gate Y001) are supposed to represent both trains of each system. The number of backup trains for each should be 2 instead of 1. The explanations in Table 3-1 should also be deleted since these systems are automatic.

e) In the evaluations, two half trains are credited as one equivalent backup train.

l t

i

1 1

i Attachment to l 2CAN109801 l Page 56 of102  !

Figure 15 1: NSD.018/023 Figure 3.l A Modified to Include Critical Safety Functions i RCScore RCS h Long Term Inventory Control / i

Heat Removal Irwentory ] Heat Removal j i Control  ;

L i

o WW or i N 808CS/Cond 1

1 Maior  !

4 ' l EFW j 1 Transiert  ! > Success s Tutine  !

7 EFW i i

l AFW  ;

I 4 .

i i

HPSI"N -!

4 - 1 ECCS HPSI "N CSS"N I

)_ vwee 9 Racirc 3 -

OPER HPSI '8" g -

3 _

i LTOP CSS "B" i

i.

3 vwen

-> HPSI "B" R.cire -3 .,

i

! l t l 1

.!............. .....................J...................!.................................!

Attachment to 2CAN109801 Page 57 of102 Figure 15 2: NSD.018/023 Figure 3.lB Modified to include Critical Safety Functions i RCS/ Core i RCS Long Term inventory i j Heat Rwnwet i Inventory Control / l l Control Host Removal j e

Mein s  ;

"~T Feedwater i e

HPSI "A"  ;

ww Y ~

i N EFW HPSI "A" CSS "A" i

9 g,,,,, -+ -

Turtiene x HPSI *S" _

EFW '

SLOCA p

HPSI *8" CSS "B" AFW 3 Recirc 4 -

--Y HPSI "C" 9 -

ECCS (1) OPER Y Vents Y SDBCS OPER y

s SDC ~

' Recovery i LTOP  ;

& Vents 1  !

! l  !

i...................................J................................................e

! RCS I Long Term inventory Control / !

I l Inventory Control Host Removal j i e i HPSI "A" i i Y -

i i l  !

LPSI "A"  ! HPSI "A" CSS "A"  !

Y (1)

~ '

+ Recirc ~+ ~

MLOCA i HPSI "B" LLOCA  ;

5. Success

LPSI "B" HPSI "B" CSS "B"

@ (1)

-@ Recirc -3 ,

e i

HPSI "C" i i Y ~

l l i i  !  !

i  !  !

Attachment to 2CAN109801 Page 58 of102 NRC Question No.16.0 Reference 1. Has there been any activity to establish that the ranking results predicted by Tables 2-1 and 2-3 are internally consistent? The method of assigning consequence ranking is either purely quantitative (Table 2-1) or qualitative (Table 2-3) as in the following:

a) If the impact of pipe failure results in one of the plant specific IEs, the consequence category is determined based on CCDP predicted by ANO-2 IPE (Table 2-1).

b) If the impact of pipe failure results in both IE, as weli as loss of mitigating system (s), the rules defined in Table 2-3 are used to determine the consequence category.

Has the licensee attempted to predict the CCDP for case b. type events by requantifying the IPE ,

model and comparing the results with those produced by application of Table 2-37 Entergy Operations Response The ranking results from application of the EPRI methodology (Tables 2-1, 2-2, and 2-3) are internally consistent with the latest version of the ANO-2 PRA (i.e., the ANO-2 EOOS Model).

A number of cases have been run as summarized below.

4 Key initiating events were run to check the consequence rankings used in Table 2-1 of the EPRI methodology. The results of these checks are shown in Table 16-1, below.

Pipe segments which do not cause an initiating event but which fail in response to a demand were quantified to check the consequence rankings used in Table 2-2 of the EPRI methodology. The results of these checks are shown in Table 16-2, below.

Pipe segments which cause an initiating event and whose failure adversely affect the plant mitigation capability were quantified to check the consequence rankings used in Table 2-3 of the EPRI methodology. The results of these checks are shown in Table 16-3, below.

Table 16-1 Examples ofInitiator Impact (Table 2-1) Validation With ANO-2 PRA Consequence Initiator isolation Additional Impacts on PRA Model CCDP RI ISI (1/yr) Consequence Rank Small LOCA S=1 None None 4E-4 HIGH Turbine Trip Tl=1 None None 4E-7 LOW Loss of PCS T2=1 None None 7E-7 MEDIUM Reactor Trip T6=1 None None 3E-7 LOW

, ,w , m. ., - , , , --- - - ,

Attachment to 2CAN109801 Page 59 of102 Table 16-2 Examples of Demand Impact (Table 2-2) Validation With ANO-2 PRA l Consequence Isolation Additional CDF Base Exposure CCDP RJ-ISI Impacts on (1/yr) CDF (yr) Consequence PRA Model (llyr) Rank l HPSI-C-03A Succouds 2CV56301, 9E 5 8E-6 0.25 2E-5 MEDIUM l (Credit for 2P89C l 1 train:

! Isol or j HPSI-B) l HPSI C 05 Succeeds 2P60A, IE-4 8E-6 0.25 2E-5 MEDIUM l (Credit for 2P35A, i

1 train: 2P89A,2P89C l Isol or ECCS-B) l Table 16-3 Examples ofInitiator and Demand Impact (Table 2-3) Validation With ANO-2 PRA l

l Consequence Initiator Isolauon AdditionalImpacts on PRA Model CCDP RI-ISI (1/yr) Consequence

! Rank SW-C-01 A T8=1 None 2P4A,2CVl4181, T8PREREC 3E-5 MEDIUM SW-C-06A T8=1 Smwwk 2B52,2P4A,2CV14181, T8PREREC 3E-5 Fails 2T3,2P4A,2CVl4181, T8PREREC 6E 6 MEDIUM

, , . , _ (=6E-4*ISOL) l

l Attachment to 2CAN109801 Page 60 of102 NRC Question No.17.0 l

l The Service Water submittal and the rest of the system submittals differ in use of the EPRI methodology for consequence rankings. Systems analyzed for other than Service Water used i EPRI Table 3.2 for assigning consequence categories while Service Water used a similar but i derived table (Table 2-2). Rankings using either table would be similar except that in Service Water Table 2-2, the number of unaffected backup trains includes the consideration of 0.5 trains.

Consideration of 0.5 trains would reduce the consequence ranking for some segments. For example, for an infrequent challenge (DB Cat III), all year exposure, EPRI Table 3.2 would result in a medium ranking for two backup trains but a high ranking for only one backup train. Table 2-2 in the Service Water analysis would also produce these same rankings for the same number of available trains, but if 1.5 trains are credited, a medium ranking is obtained rather than a high ranking, which would be the case for less than two backup trains. The licensee should clarify why two separate approaches were necessary and provide a discussion of where 0.5 trains were credited, if any, which resulted in a lesser consequence ranking.

1 Entergy Operations Response EPRI Table 3.2 was the first attempt to provide a simplified way to rank consequences when a pipe break results in a loss of a single or multiple train (no initiators). In this table only " full" backup trains were credited (mean unavailability of IE-2). As the pilot studies were performed, it was evaluated that not all trains in the plant can be credited as a " full train," and a " half train" concept (mean unavailability of IE-1) was introduced. Table 2-2 in the SWS submittal is the latest version of the original EPRI Table 3.2. Two tables are used in the submittal because the evaluations performed were done so in different timeframes. The approaches are the same, but the application of Table 3.2 would result in more conservative results.

Even though two of ANO-2 mitigating systems are credited as a half train (turbine EFW and auxiliary feed water), the half train value was not called upon in the ANO-2 evaluation. Table 2-2 is introduced in the SWS evaluation, but a " half train" case was not identified. Most of the breaks in SWS lead to an initiating event, and therefore, Tables 2-1 and 2-3 were used. Out of 51 SWS consequence segments,16 are evaluated using Table 2-2. After assuming a loss of coolant accident (LOCA) challenge, three segments are evaluated crediting two backup trains, six segments are evaluated crediting one backup train, and one segment was evaluated with no credit for a backup train. Six other segments are evaluated assuming a loss of offsite power (LOSP) challenge and crediting one backup train. Therefore, the difference between Tables 3.2 and 2-2 is not relevant in the SWS evaluation.

t I

s f

i I

Attachment to 2CAN109801 l Page 61 of102 l

l NRC Question No.18.0 l Table 2-1 in the Service Water analysis (Reference 1) differs from Table 1 in the other submittals for assigning consequence categories for ANO-2 pipe failures that result in an initiating event. In Table 2-1, a consequence range is provided but the first consequence shown in the range is l assumed in the analysis. Using this assumption, the tables would agree except for initiating events l T1, T4, and T6, where a low consequence is assumed in Table 2-1, but a medium consequence is assumed in Table 1, for the same initiators. The licensee should verify that use of the low consequence ranking for the Service Water analysis did not result in low Risk Category rankings for segments that might have ranked higher had the medium consequence ranking been used.

Entergy Operations Response Initiators T1, T4, and T6 (Turbine Trip, Excessive Feedwater and Reactor Trip) were not used in the Service Water analysis summarized in Reference 1, Table 5-1. Therefore, the " Low" l consequence identified in Table 2-1 had no impact on the sersice water evaluation.

However, T6 was used in the main steam analysis for consequence segments MS-C-03A, 03B, 04A,04B,05, and 06. The " Low" consequence assigned for these segments was based on the low CCDP reported for T6 (3.0E-6) combined with the judgment that this initiator is among the i most benign of the plant initiators. Quantification of the latest version of the ANO-2 PRA 1 confirmed that the T6 CCDP is less than IE-6.

I i

. - , _ - . . -. -- - . ~ - -.. . . . -

Attachment ts 2CAN109801 Page 62 of102 NRC Question No.19.0

' Reference 1.1 Based on the data presented in Reference 11, the baseline CDF for ANO-2 is 3.28E-5. The conditional CDF when one train of HPSI is unavailable is 2.19E-4. This implies

that by removing one HPSI train from the ANO-2 design, the CDF 'mcreases by a factor of almost 7 indicating the importance of the HPSI role in accident mitigation. Now consider' transients T1 and T8. According to Table 2-1 of Reference I we have the following data:

I IE CCDP TI: Turbine trip 3.0E-6 I 4

T8: Loss of SW train A 2.8E-6 One expects the CCDP for T8 to be higher than that of T1. This is because; i

s. T8 is a transient event with common cause impacts on one train of ECCS that includes a ,

i HPSI train and, i j b. Operation of HPSI in feed and bleed mode is credited in the IPE for mitigation of transient .

events.  !

Please explain why the CCDP associated with T8 is smaller than that of T1.

Entergy Operations Response

) The CCDP associated with T8 (Loss of SW Train A) is smaller than that of T1 (Turbine Trip),

j because the ANO-2 PSA model accounts for the operator recovery action to start the normally a

available standby SW pump prior to a reactor / turbine trip which would occur aner the loss of the running SW pump. This recovery is based on the model assumption that the loss of a single SW loop is effectively the loss of a single pump (since the SW pump is the only single active component in each SW loop). Successful recovery prevents the occurrence of a plant trip. If the

recovery were not applied then, indeed, the CCDP value for T8 would be much greater than the i

CCDP for T1.

l

_ - - - ~ - - . . ---. _- -- - . . . . .

Attachment to 2CAN109801 Page 63 of102  ;

r  !

NRC Question No. 20.0 l Related to the issue above: The IPE assumes that the HPSI pump cooling is only required in the I l re-circulation mode of operation following a LOCA. Please address the validity of this assumption in relation to the data presented in Table 3-2 of Reference 1. I Entergy Operations Response

! The RI-ISI assessment utilized the IPE, HPSI Upper Level Document (aka DBD) and the System ,

Training Manual. The assumption that the HPSI pumps require cooling only in the longer term l (i.e., recirculation mode of operation) was also maintained in the RI-ISI evaluation. Table 3-2 of i Reference 1 identifies service water functional dependencies. Impacts on HPSI in this table refer l to longer term impacts (i.e., during recirculation mode of operation) and not on HPSI in its injection mode.

l i

1 I

- . - . . . . -_ . _ , . _ . . _ . - , - . = = -

I I

l Attachment to l 2CAN109801 Page 64 of 102 NRC Question No. 21.0 ,

Reference 4. In Section 4.1.12, the unreliability of a typical equipment backup train is defined as 1.0E-2. The unreliability estimates for two and three backup trains are also provided. It appears that these estimates do not account for possible support system dependencies or for common cause failure of backup trains. Please describe how support system dependencies and CCFs between trains are identified and accounted for.

Entergy Operations Response The unavailability estimates used in the ANO-2 evaluation do take into consideration dependent l l (comnan cause) failures between two trains, by assuming CCDP values for the corresponding i system. For example, in Table 3-1, Reference 1, HPSI is credited as one train, even though three pump trains are available (HPSI A, HPSI B, and HPSI C). Similarly, this is true for recirculation I and contsinment spray. This is based on the actual system unavailability value, which accounts i for com.non cause and dWmcy between trains. In the above cases, it is assumed that the operator action, common for all trains, dominates system unavailability. Common cause failures among different systems are only analyzed if they are created by the spatial impact of the analyzed >

pipe break. Otherwise, they are not accounted for.

Similarly, support system dependency is considered if a support system is impacted by the pipe break. For example, if a train of SW is lost, all systems which depend on that train of SW for cooling would be considered lost. Also, it should be noted that the loss of a major support system almost always leads to an initiating event, and the corresponding CCDP would account for all dependencies.

Support system dependency in the ANO-2 RI-ISI analysis can potentially be important in crediting backup systems for secondary heat removal function where multipl: diverse trains are credited. This dependency on the different support systems is analyzed below:

Attachment to 2CAN109801 Page 65 of102 Train (s) Dependencies (other than electrical)

MFW(1 Train) CCW/SW - MFW pumps lube oil cooling and condensate pump motor bearings cooling ACW/SW - Condenser vacuum pump seal cooling IA - MFW control valves and condenser vacuum pump AFW (0.5 Train) IA - AFW control valves for discharge through MFW only; note that these valves can be operated manually and note that AFW ,

flow can be alternatively directed to the SGs via EFW valves I which do not depend on IA. l EFW(1.5 Trains) SW- the least preferred of four EFW suction sources. Thus, the loss of SW was dismissed as a contributor to EFW failure.

OTC (1 Train) SW-HPSI pump lube oil cooling NOTE: IA depends on component cooling water /SW for compressors cooling SW, as a continuously running system with 3 pumps, can at least be conservatively credited as 1 train. A search was conducted of every consequence in the ANO-2 RI-ISI submittal where there l were three trains (or more) of secondary heat removal credited. The cases found are given below:

A) In MS System: AFW, EFW, MFW (PCS)- credited as 3 trains B) In EFW System: AFW, EFW, OTC - credited as 3 trains '

l By analyzing the support system dependencies, the following conclusions can be made:

I Case A: AFW, EFW, and MFW still can be credited as 3 trains: .

l AFW (with manual valve operation, 0.5 train), EFW (1.5 trains), and at least one train of SW (1 train) l Case B: AFW, EFW, OTC also can be credited as 3 trains: l AFW, EFW, and SW, see previous case.

The support system dependency does not affect the results in the ANO-2 consequence evaluation.

Note that breaks which affect SW operation are explicitly considered in the analysis.

Attachment to 2CAN109801 Page 66 of102 NRC Question No. 22.0 According to the IPE results summarized in Reference 1, Table 2-1, the CCDP for SGTR is 9.8E-

6. Since this value is less than 1.0E-4, the assigned consequence category is MEDIUM. Please address the following issues:

a. Is there any pipe rupture that affects the mitigation of SGTR events especially with respect to isolation of the affected SG7

b. The CCDP for SGTR is low because IPE assumes a very low probability (6.5E-6) for the event " failure to isolate affected SG". The value is substantially lower than the representative isolation failure probability assumed in your analysis (i.e.,1.0E-2). The staff evaluation of your IPE noted that human error quantification was a " weakness" in your study. How is the impact of the IPE assumptions assessed in your risk ranking?

Entergy Operations Response a) A steam generator tube rupture (SGTR) initiating event is not assumed to occur coincident with another initiating event. The frequency of coincident initiator events is low or approaching low depending on the initiator. Systems required to mitigate a tube rupture initiator (e.g., EFW and HPSI) were considered in the RI-ISI analyses. These analyses concluded that breaks in HPSI or EFW systems while responding to a SGTR are not expected to impact steam generator isolation for the following reasons:

• Paths supplying the steam generator contain check valves (2FW-5A to steam generator A and 2FW-5B to steam generator B); since these check valves are inside the containment, steam generator (SG) isolation is highly likely. In addition, redundant main feedwater isolation valves in series with these check valves are located in reactor auxiliary building: 2CV-1023-2 (in Room 2092) and 2CV-1023-1 (in Room 2081) are in series with 2FW-5A and 2CV-1073-2 (in Room 2092) and 2CV-1074-1 (in Room 2081) are in series with 2FW-5B. EFW piping to steam generator A is located in Room 2084 and EFW piping to steam generator B is located in Room 2081, but it was assessed unlikely that a break in either of these piping lines would impact the feedwater motor operated valves (MOVs) in these rooms. Even ifit could, the redundant isolation valves outside these rooms are unaffected by the EFW pipe break.

• The main steam isolation valves (MSIVs) are located in the steam pipe area (Room 2155) spatially separated from EFW and HPSI piping.

b) It is recognized that the treatment of human errors has a very significant impact on the assessed risk. The treatment of human errors, however, is not an exact science but more of an art, since a realistic approach to modeling human actions does not currently exist.

Attachment to 2CAN109801 Page 67 of 102 As such, the treatment of human error quantification is a weakness in all IPEs. Thus, the statement that human error quantification was a " weakness" is not plant-specific.

l Regarding the specific issue of the rr.latively low probability for "failing to iso? ate affected l SG", credit was taken in the ANO-1 PSA for the automatic closure of valves downstream i of the MSIVs (i.e., event QOTHERSDBC with a probability of 2.25E-2). Thus, if the l MSIV on the affected SG fails to close on demand, these downstream valves will l automatically isolate the SGs under most conditions. It should be noted that closure of l these valves is dominated by hardware failure rather than a human error. It appears that most other PSA models did not credit the use of this isolation capability. Human failure contributes to the failure of this event only if power is lost to either of two steamline isolation valves (both MOVs) prior to their automatic closure. The low probability of losing power to these MOVs during a SGTR event, the manual operability of these MOVs, the operator awareness of these MOVs and the long time available to perform this closure operation strongly indicate the relative contribution of human failure contribution to the " failure to isolate the affected SG" is small and the credit taken in the ANO-2 PSA for the closure of valves downstream of the MSIVs is appropriate.

Note: It could appear that SGTR is a more challenging initiator for HPSI in the " demand" configuration than a small LOCA, especially because there is the issue of containment bypass.

This is not the case, because in the ANO-2 PRA model of SGTR, HPSI is only challenged if:

l

• the operator fails to depressuri2.e RCS (stops the leak), or e heat removal on the secondary side fails Since both of those events are not likely, the HPSI challenge frequency due to SGTR would be much smaller than a small LOCA challenge frequency, even if the containment bypass is to occur.

Also, HPSI is the necessary mitigating train for a small LOCA (no other backup trains).

i

Attachment to 2CAN109801 Page 68 of102 NRC Question No. 23.0 To determine how often the mitigating fbnction of the system / train, affected by a pipe rupture, is needed. Tables 2-2 of the submittal requires mapping of the system / train to one of the three dedgn basis IE categories:

Category II (anticipated operational occurrence)

Category III(infrequent event)

Category IV (unexpected event)

For example, a postulated pipe failure in the HPSI system is mapped to Category IV events, implying the function of HPSI is expected for mitigation of LOCAs only. It is common that PRA models take credit for systems beyond their intended design. For example, the ANO-2 IPE takes credit for HPSI in mitigation of transient events, some of which belong to IE Categories II and III. How does the licensee account for the credits taken for a system function in mitigation of multiple IE categories?

Entergy Operations Response The ANO-2 evaluation accounts for system fimetion in mitigating multiple IEs by evaluating all cases and selecting the most limiting one for the final evaluation. As stated in the question, HPSI is a good example for the above case. Examples of the screening evaluation are given below:

Example 1) HPSI can be used to n igate T1, T2, and T6, which are all Category II events. The most limiting number of backup systems is for initiator T2 (Loss of Power Conversion System),

where backup systems include: EFW (motor and turbine) and AFW (total of two trains, given that HPSI, and therefore, once-through cooling is lost).

Example 2) HPSI is used to mitigate small or medium LOCAs, which are Category IV events. In this case, HPSI is the only backup train for high pressure makeup.

Based on Table 2-2, Reference 1, a Category 11 event with 2 backup trains, leads to a " Medium" consequence rank (for "between test" exposure time). Example 2 above, a Category IV event with no backup train, which would lead to a "High" consequence rank, is obviously more critical.

In general, as expected, plants are better protected against more frequent events. In Table 2-2, Reference 1, the difference between two IE categories is worth one extra backup train. In this case, there are two extra backup trains to mitigate an " anticipated transient." Also, the most limiting case for a system is always the case where the system itselfis the only backup train.

. .. .. . - . . - - - - - - -. . . - - - = - _ _ _ -.

Attachment to

, 2CAN109801 Page 69 of102 1

NRC Question No. 24.0 In the consequence analysis of LPSI SDC pipes (reference 5), the submittal credits the ANO-2 procedures in maintaining adequate redundancy during the midloop operation. For example, in the analysis of pipe segment LPSI-C-02, the submittal assumes the existence of two backup trains to provide makeup during midloop operation. Please elaborate on the nature of backup systems during midloop operation.

. Entergy Operations Response The requirements for mid-loop and other shutdown configurations are identified in the ANO-2 Shutdown Operations Protection Flan (SOPP). The ANO-2 SOPP is a living document and is updated to meet the specific requirements of each refueling outage. The ANO-2 SOPP would also be utilized for any non-refueling outage requiring special plant protection considerations such as mid-loop operation.

The ANO-2 SOPP utilizes NUMARC 91-06, " Guidelines for Industry Actions to Assess Shutdown Management" in the development of requirements to satisfy the " defense in depth" philosophy. Specifically, the backup trains, systems' or flowpaths available are identified and appropriately protected. The plant manager's approval is required to intentionally align the safety systems such that less than the SCORE card minimum is available. A SCORE card is a status sheet used to communicate the following:

I e The minimum requirements for each safety system for that period of the outage.

• Protected equipment.

i i

e Equipment available to Operations for maintaining control of plant safety functions.  !

I

• Equipment not available for use (i.e. the maintenance window is open).

The ANO-2 SOPP general requirements are as follows:

• The outage schedule will not intentionally violate the logic paths illustrated in the safety system scheme drawings without appropriate approval.

• Operations personnel should verify the availability of minimum required equipment for the currera refueling condition once per shift, e The current plant status, including the availability of safety systems, should be communicated on a regular basis to personnel who may affect plant safety. Higher risk

. evaluations should also be conveyed including any appropriate precautions or compensatory action necessary during these schedule periods.

Attachment to -

2CAN109801 l Page 70 of 102 1

e Special precautions should be taken and pre-job briefings should be conducted (including an Operations representative) for activities taking place on protected equipment (systems).

• Safety system equipment that is removed from service for maintenance or testing should be returned to service as soon as the maintenance or testing is completed. When the equipment is returned to service, the availability of the equipment and/or system should be assured by post maintenance testing (if plant conditions allow), monitoring of key parameters, verification of alignment, and/or administrative control by Operations as appropriate.

• Operator training should be performed on the shutdown safety issues described herein. To l the extent practicable, simulator training for shutdown conditions should also be l performed.

• Plant personnel, including contractors and others temporarily assigned to support the outage, should be trained in areas that are applicable to their particular role in outage activities ar.d that contribute to the safe conduct of the outage.

• Integrated scheduling techniques provide assurance of plant and personnel safety. An example of the more specialized considerations is the control of containment integrity.

The procedure, OP - 1015.008, and scheduling maintains the breach of containment controls while mostly scheduling techniques maintain containment cooling system requirements for habitability and building pressurization concerns.

. Before final approval, a review of the outage schedule from a safety perspective will be done by an unencumbered safety group to provide added assurance that the outage can be conducted in a safe manner. Major outage activities shall be controlled and implemented in accordance with the approved schedule.

• Surveillance testing activities associated with safety systems should be incorporated into the detailed outage schedule.

Additionally, the ANO-2 SOPP key safety functions are ensured by specific requirements. Those requirements ofinterest to the current subject include those for decay heat removal and inventory control. Those requirements are as follows.

Decay Heat Removal e Work on systems used for decay heat removal (including spent fuel cooling) and their attendant support systems should be scheduled in detail and not allowed to float during the outage.

• Areas around protected systems and their power supplies should be secured and controlled by physical barriers with s:gns that require personnel to contact the control room prior to

1 Attachment to 2CAN109801 Page 71 of 102 entry. Special precautions should be taken and pre-job briefmgs should be conducted for activities taking place within these secured areas.

e Operations crew briefings should be conducted prior to any activity that could affect decay heat removal system operations.

• When the RCS is closed, at least one SG, an associated RCP, and the pressurizer (heaters / level) should be kept available as a method of decay heat removal. This should include the motor operated emergency feedwater pump, a supply of feedwater, and the associated atmospheric steam dump flow path.

• The SDC system motor operated suction valves from the RCS should not be cycled unless the SGs are capable of removing decay heat.

• During reduced inventory conditions, testing or maintenance that could affect reactor decay heat removal should not be performed on any of the protected SDC trains. If work is required, a contingency plan shall be in place prior to removing the system from service.

• Attention is given to the sensitive issue of maintaining an RCS vent path in reduced l

, inventory. This was accomplished with two (2) considerations taken into account. l l

a) Do not enter reduced inventory during periods of high decay heat loads directly following plant shutdown.

b) Maintain an adequate RCS vent path in the event of a loss of SDC by the use of non-restrictive covers.

e To ensure adequate cooling is available for SDC, SW maintenance is scheduled by loops

to coincide with the appropriate safety system maintenance window.

e To take credit for the refueling canal as a heat sink the level in tha canal must be greater than 23 feet above the fuel. This level converted to an elevation as marked on the canal wall is 389' 0" per OP-2502.001. For additional conservatism and for easy memorization this level has been called the 390' elevation in the SOPP.

Iny.talpry Control e The outage schedule shall delay entering reduced inventory during periods of high decay heat loads directly following plant shutdown to allow the RCS metal to stabilize at an i ambient (shutdown cooling) temperature along with the reduction of decay heat l generation. Time spent in reduced inventory conditions shall be minimized.

4

Attachment to 2CAN109801 Page 72 of102

• Operations crew briefings should be conducted prior to any activity that could change RCS or SFP inventory.

• One flow path which meets the required make-up flowrate as calculated by the LOSDC2 program shall be operable except when in reduced inventory, then two flow paths shall be operable in accordance with OP - 1015.008. During reduced inventory conditions at least one flow path shall be a HPSI flow path and shall be powered by both an emergency (must be an EDG) and an off-site power source even when only one flow path is required.

Maintenance on alternate flow paths should be performed in an expeditious manner and the flow path returned to service in a timely fashion.

• When the RCS is open at least one sump flow path to the ECCS suction should be maintained available. The LLRT of the sump lines should be performed as efficiently as possible and the system returned to service expeditiously. Particular emphasis will be placed on the protected train.

For clarification the following definition is provided in the SOPP for "mid-loop" operation; Generic Letter 88-17 defines "mid-loop" as: "The condition that exists whenever the Reactor Coolant System water levelis lower than the top of theflow area at thejunction of the hot legs with the reactor vessel." For ANO-2, this is approximately elemtion 371'. Restrictions placed on "mid-loop" operations by Generic Letter 88-17 are met at ANO-2 prior to draining the RCS below elemtion 375'.

As an example, during the most recent ANO-2 refueling outage (2R12), the following excerpt from the SOPP scorecard for a "mid-loop" evolution identifies the required available makeup sources /flowpaths:

1 Attachment to 2CAN109801 ,

Page 73 of 102 l

.t. . Y.. . ' m.it.. . ,

r . 12R12; , , . . . . . , . --

.'_, '3

, ,, ~

...& ,._ -..-.m m 4

%b iSYSTEMATIC CONTROL OF OUTAGE RISK EVOLUTIONS; < n b J

'ESCORE CARD'2A--SAFETY FUNCTION SYSTEMS AVAILABILITYM >

Avauetne Optkms

• Protected Opt 6ons l l Out of Service Credit to 880 DN3

[A. MAINTENANCE OF HEAT REMOVAL: (FIG. 4.2.1.A) A B l C D l El

1. SPENT FUEL POOL COOUNG (MIN 1 OF 3) 'AFPGA/ l' $FPCS 1 T*awM

2. REACTOR COOLANT SYSTEM (MIN 2 OF 5) l S/G A l S/0 8 ERDeA" >8 4

>300' l l lB. MAINTENANCE OF INVENTORY: (FIG. 4.2.2.A) A B l C l D I E I

1. RCS MAKEUP SOURCE (MIN 1 OF 3) MI21sa? % Ta 6 BlIMAE 1

2. RCS MAKEUP FLOW PATHS (MIN 2 OF 4) EkmanATasaAE . h63

3. SFP MAKEUP FLOW PATH (MIN 1 OF 5) ;2P30f;j'[ [I] hl [p jh -

l l

l As evidenced by the stated requirements and this example, sufficient backup traa.s are identified during "mid-loop" and other shutdown configurations to support the credit taken in the analyses.

Additionally, the ANO-2 SOPP incorporates the guidance provided by NUMARC 91-06 to ensure the availability of the components, trains, or systems designated to provide the required

" defense in depth".

Attachment to

2CAN109801

Page 74 of102 NRC Question No. 25.0 i

j Your analysis is based on the assumption of a single pipe failure. Please describe how you considered any degradation mechanism in conjunction with other events (such as water hammer)

, which might cause a common cause failure of several pipes. In addition, the EPRI methodology

! requires that licensee's elevate the risk ranking of piping segments where a potential for water i hammer also exists. If the determination for water hammer potential is made as a result of administrative controls being applied versus engineered safety functions, then some probability for water hammer should be considered. This may impact the ultimate risk ranking of several piping segments. The licensee should describe what appropriate measures have been put in place to p eliminate water hammer from consideration in applicable piping systems.

Entergy Operations Response 4 Water hammer events that have occurred in systems at ANO-2 within the scope of the RI-ISI assessment have been aggressively investigated and substantive corrective actions taken to j 1 prevent reoccurrence, usually in the form of plant modifications in addition to changes in i operational and/or maintenance practices. Administrative controls beyond normal good operating j J

practice are not typically relied upon to prevent water hammer from occurring.

i l Plant staff evaluate industry water hammer events as they are reported for applicability to ANO-2. j

! This evaluation may include procedure reviews, drawing reviews, service history reviews, i

! operator interviews, and system walkdowns. The evaluation can result in corrective actions i

including operational or maintenance procedure changes, training, or plant modification.

2 i

ANO-2 has also reviewed and taken into consideration the information provided in EPRI l TR-106438, " Water Hammer Handbook for Nuclear Plant Engineers and Operators," dated May ,

1996. This document, which provides a comprehensive compilation and analysis of water j i hammer events in U.S. plants, indicates that most water hammer events occurred in the early l stages of plant operation. As experienced was gained in the operation of the plants, water hammer i events have progressively reduced in the industry at large. This is consistent with the experience i at ANO-2, as documented below, j As reported in EPRI TR-106438, the most susceptible systems to water hammer in PWRs that are within the scope of the ANO-2 RI-ISI assessment are main feedwater and emergency feedwater.

The main steam system is also considered moderately susceptible. All other systems are significantly less prone to water hammer As explained in detail below, no water hammer events  !

have occurred at ANO-2 in the main feedwater system and only one event has occurred in the emergency feedwater system. This one event occurred in 1989. This demonstrates the ability of the plant to manage water hammer even for those systems which generic industry experience suggests are most susceptible.

In general, the determination of the susceptibility of a given system to water hammer is more dependent upon plant specific operational service history than generic industry data. This is in

1 I

Attachment to )

2CAN109801 Page 75 of 102 contrast with the potential susceptibility of a system to a degradation mechanism. The system conditions which cause or promote the existence of a degradation mechanism are in general very similar from plant-to-plant. As such, the ultimate determination of the potential presence of a degradation mechanism should primarily be based on industry service experience. In the case of a l damage mechanism such as IGSCC, even though its presence may have never been identified at a particular plant, it could still very well be active due to system environmental conditions.

i In assessing the potential for a water hammer event though, a greater measure of variability exists l between plants. The potential for a water hammer event is solely a function of a plant's unique I system configuration and operational / maintenance practices. The configuration and operationally l sensitive nature of the water hammer phenomenon is substantiated by the ANO-2 service history.

l When coupled with consideration of industry service experience with this phenomenon as ,

described above, none of the systems within the scope of the RI-ISI assessment have been l identified as prone to water hammer. Following is a short synopsis for each RIISI esW I l system addressing historical or potential water hammer events and the corrective actions taken. I I

l High Pressure Safety Injection l

No water hammer events have been identified in the high pressure safety injection system since l initial operation. Based on the extensive operating history without incident, water hammer was eliminated from additional consideration in the high pressure safety injection system.

Reactor Coolant System No water hammer events have been identified in the reactor coolant system since initial operation.

Based on the extensive operating history without incident, water hammer was eliminated from l additional consideration in the reactor coolant system.

Chemical and Volume Control System No water hammer events have been identified in the chemical and volume control system since initial operation. Based on the extensive operating history without incident, water hammer was eliminated from additional consideration in the chemical and volume control system.

Containment Spray System No water hammer events have been identified in the containment spray cooling system since initial operation. Based on the extensive operating history without incident, water hammer was eliminated from additional consideration in the containment spray system.

i E

e

Attachment to 2CAN109801 Page 76 of102 Low Pressure Safety injection / Shutdown Cooling System No water hammer events have been identified in the low pressure safety injection / shutdown cooling system since initial operation. Based on the extensive operating history without incident, water hammer was eliminated from additional consideration in the low pressure safety injection /

shutdown cooling system.

Emergency Feedwater System A single potential water hammer event occurred in the emergency feedwater system in early 1989 This event occurred due to omission of a procedural step. Reoccurrence has been precluded by

, increased attention in the ues of procedural adherence. In the subsequent almost ten years of operation since this event, no reoccurrence has been identified. Because this system is routinely I

tested and the piping is utilized for auxiliary feedwater during startup and shutdown, adequate opportunity is considered to exist such that if susceptible conditions existed for repeat occurrences, such an occurrence would have been identified. Water hammer was therefore eliminated from additional consideration in the emergency feedwater system.

Main Feedwater System 1 No water hammer events have been identified in the main feedwater system since initial operation.

Based on the extensive operating history without incident, water hammer was eliminated from additional consideration in the main feedwater system.

Main Steam System Two distinct areas of the main steam system were initially susceptible to water hammer. Initial plant design allowed condensate to collect upstream of the atmospheric dump valves and resulted in water hammer type events when the atmospheric dump valves were opened in response to plant conditions. The plant was modified to eliminate the water collection point and further water i hammer events were precluded. No reliance on administrative controls was utilized in the solution to this problem. The other area of susceptibility was the main steam supply to the emergency feedwater pump steam turbine. Due to system design and less than adequate steam trap maintenance and operation, repeated water hammer type events occurred upon steam turbine j start. The responses to this water hammer scenario included modification of the piping system to eliminate the piping low point, which served as a collection point for condensation. Maintenance and operational practices of associated steam traps were also improved in response to the events.

Based on the plant modification and the subsequent time frame since the modification with no repeat occurrences, the initiators for the water hammer events are considered to have effectively been eliminated. Additionally, the events were detectable during routine starts of the steam turbine and would not have escaped detection if the condition remained. Water hammer was therefore eliminated from additional consideration in the main steam system.

Attachment to 2CAN109801 Page 77 of102 Servlee Water System A portion of the service water system was identified as susceptible to water hammer. The resolution involved modification of the service water supply to the reactor building coolers and associated operating procedures. No occurrence of water hammer has been identified since modification of the system. Based on the plant modification and no occurrence of water hammer since installation of the modification, water hammer was eliminated from additional consideration in the service water system.

l

1 Attachment to 2CAN109801 Page 78 of102 NRC Question No. 26.0 It is difficult to locate in the submittal any pipe failure which has been evaluated with regards to LERF. RG-1.174 requires that risk informed decisions include considerations of LERF. The EPRI methodology includes guidelines regarding LERF consideration through categorizing potential unisolated LOCAs outside of containment as described in Table 3.3 of EPRI TR-106706 (Reference 12). The staff is still reviewing this approach to determine its acceptability. Please describe how ANO-2 includes LERF considerations and identify those j segments which have been evaluated with regards to LERF. l Entergy Operations Response j i

In the ANO-2 RI ISI analysis, containment bypass was a concern in the evaluation of the HPSI, I LPSI, CSS, and CVCS systems. )

l The possibility of bypassing containment, after a switchover to the sump recirculation, was specifically evaluated in the following consequence segments:

• CSS-C-06A & CSS-C-06B, isolation is provided only by one MOV: 2CV-5647-1/2CV-5648-2. Consequence rank was adjusted from " Medium" to "High" as a result.

• LPSI-C-06/LPSI-C-11/HPSI-C-05/HPSI-C-13/HPSI-C-14, isolation can be accomplished by closing one of two MOVs; for Train A: 2CV-5647-1 or 2CV-5649-1, for Train B:

2CV-5648-2 or 2CV-5650-2. Consequence rank was " Medium".

• Possible bypass of the containment was also analyzed in the letdown piping (consequence j segment CVCS-C-08). Isolation is provided by two active barriers, MOVs 2CV-4820-2 ]

and 2CV-4821-1. The consequence rank was " Medium". I i

e Bypass of the containment atmosphere was analyzed in consequence segments CSS-C-13A, CSS-C-13B, CSS-C-17A, and CSS-C-17B. Isolation is by one passive barrier, Check Valve 2BS-5A or 2BS-5B. Since the bypass does not lead to a LOCA ,

outside containment, it was evaluated that, given the presence of a passive containment )

barrier, it is not necessary to change the consequence rank based on CCDP.

LOCA outside containment in the HPSI and LPSI injection loops was not explicitly considered. l The consequences due to the breaks in those loops, outside containment, are already ranking j "High" (LPSI) or " Medium" (HPSI), based on CCDP. Consideration of possible LOCAs outside l containment, with at least two isolation means available, would not change that rank. l 1

l i

Attachment to 2CAN109801 Page 79 of102 NRC Question No. 27.0 RG 1.174 requires that the change in risk resulting from a risk informed application be assessed I and meet Principle 4, "When proposed changes result in an increase in core damage frequency i and/or risk, the increases should be small and consistent with the intent of the Commission's  ;

Safety Goal Policy Statement". Such an assenment should consider the aggregate impact of the requested change on the plant's risk. CDF and LERF could be used as a surrogate for the Safety i Goals. A decrease in risk always meets the intent of Principle 4. A quantitative bounding analysis that shows that the acceptance guidelines are satisfied is acceptable, however the assessment need i not be quantitative. Any assessment should discuss the specific changes requested, the potential l impact of these changes on risk, and any compensatory measures that will be applied that might affect the risk impact. If the assessed change in risk is greater than approximately lE-06/yr (CDF) or IE-07/yr (LERF), the discussion of the acceptability of the change should include consideration of the current, baseline risk at the plant. In section 7 of the HPSI system submittal, j the licensee makes reference to use of an algorithm to compute failure probability to enable an assessment to be performed of the effectiveness of the risk-informed developed program as compared to the existing Code program, but the results of this assessment were not included. The licensee should provide this assessment as well as those for the other system evaluations so that l overall risk impact of the RI-ISI proposed program could be compared with that for the existing Section XI program. Please provide a discussion on how the requested change in ANO-2's ISI program satisfies Principic 4 in RG 1.174.

Entergy Operations Response Due to the similarities between NRC Questions 1.0(b) and 27.0, a combined response was prepared as presented below.

A risk evaluation was performed for each system assessed in the ANO-2 pilot application study, and the results are summarized in Table 27-1. This table provides a complete accounting of all 337 segments that were included in the submittal. For the nine RI-ISI assessed systems (containment spray, chemical and volume control, emergency feedwater, high pressure safety injection, low pressure safety injection, main feedwater, main steam, reactor coolant and service water), the numbers in the columns labeled " Volumetric Inspection Status" refer to the number of segments in which locations were added, removed, or unchanged with respect to the current inspection program.

This evaluation is geared towards identifying the allocation of segments into High, Medium, and Low risk regions of the EPRI risk ranking matrix, and to then determine for each of these risk classes what inspection changes are proposed for each of the locations in each segment. The changes include changing the number and location ofinspections within the segment and in many cases improving the effectiveness of the inspection to account for the findings of the RI-ISI degradation mechanism assessment. For example, for locations subject to thermal fatigue, inspection locations have an expanded volume and the exanimation is focused to enhance the probability of detection during the inspection process.

~

Attachment ts 2CAN109801 Page 80 of102 1

As can be seen in Table 27-1, with few exceptions, each system has a larger number of segments proposed with increased inspection locations than reduced in=mion locations. For the 9 systems

==*aad in the RI-ISI scope, the 137 segments located in High or Medium risk regions can be

grouped as follows

I-

! Added Removed Same No.

I4 cations Locations ofLocations 57 29 51 I Hence, the potential for risk reductions is obviously greater than that for ' risk increases In ;

addition, it should be noted that element selections included in the RI-ISI program are focused at l

specific locations that have the relatively greatest potential for damage, and the inspections are specifically geared to look for the specific degradation mechanisms that are identified in the '

RI-ISI proce .

4 Additionally, examination of this table for specific system results provides the following insights:

3 'e For the CSS, CVCS, and EFW there were no segments in the High or Medium risk regions. proposed for reduced inspections. By contrast, each of these systems have segments in these regions proposed for er aced inspections. It is clear that the net risk impact for these systems is a net safety lx ae6t.

e For LPSI and SWS, there were a few segments in the High and Medium risk regions

proposed for reduced inspection locations, but many more in these regions proposed for enhanced inspections.

• For MFW and MS, the predominant damage mechanism is FAC. While a few segments l

, are proposed for reduced inspections in the High risk region for these systems, the risk of I pipe rupture throughout these systems is dominated by FAC induced failures. Since the I existing plant FAC program will be continued, no significant risk increases are expected.

a For the RCS and HPSI, which contain a relatively large fraction of the population of Class

'I and 2 welds, the assessment indietad the greatest potential for risk increases from

reducing inspection locations in High or Medium risk segments. A factor offsetting the ,

perspective from counting segments with increased and decreased inspections is the fact that the RI-ISI inspections for thermal fatigue are expected to be more effective than '

current Section XI inspections for this mechanism.

As an additional means of au*aning the positive impact of the RI-ISI program, the changes in the ANO-2 inspection program are summarized by risk category in Tables 27-2 and 27-3.

j

_. . ~--- . . - - . . . . - _ - - . . _-- - .-. . .. - - . .

4 Attachment to 2CAN109801 Page 81 of 102 i As can be seen from Table 27-3 the proposed change is expected to result in a decrease in risk, because the number ofinspections in both "High" and " Medium" risk regions has increased The j only reduction ofinspections occurs in Category 6, a " Low" risk region.

J 4 In order to address containment performance issues, a systematic search was made for segments

, in any of the RI ISI systems at ANO-2 in which inspection locations were reduced and that have a role to play in containment bypass or containment isolation.

j There were four segments in the HPSI system proposed for reduced inspections that if mptured in combination with multiple isolation valve failures could produce a potential bypass condition.

i These four segments were classified as Low risk and were proposed for reduced volumetric r sequences (pipe ruptures and isolation valve failures) inspection. However, the frequency o such

was found to be negligible in relation to the large early release fraction (LERF) screening criterion

~

4 of 1 X 10 per year for each system. There were no other segments with potential bypass implications in which reduced inspections were proposed.

]i The containment spray system had a total of seven Low risk segments proposed for reduced volumetric inspections. These segments and all the others in the CSS have no damage .

a mechanisms identified. The CDF and the LERF associated with the CSS are expected to exhibit a I net reduction due to the fact that there are four Medium risk segments proposed for enhanced  ;

inspections and these enhancements are expected to far outweigh the potential increases from the i l low risk segments in questions. Due to the weak importance of the CSS in contributing to LERF

} in the first place the possible impacts of pipe inspection changes on LERF from the CSS are l expected to be insignificant and if quantified would be a net reduction in LERF for this system.

The greatest impact of the RI-ISI proposed changes on LERF would be the indirect effect of small reductions in CDF that would reduce the likelihood of severe accident challenges to the containment, as the direct impacts on containment isolation or bypass are insignificant.

In response to the information request on ANO-2's review and approval of the delta risk comparison provided during the September 10,1998, meeting, the following is provided.

Entergy Operations staff was intimately involved in the application of the EPRI RI-ISI methodology to ANO-2. This involvement assured that ANO-2 specific operating practices and design were incorporated into the ANO-2 submittal as well as identifying and recommending enhancements to the EPRI methodology. In addition, an independent, integrated plant review was also conducted of the final ANO-2 RI-ISI product.

Implementation of the EPRI RI-ISI approach for piping at ANO-2 has yielded an inspection program which is intuitively superior to the inspection program currently employed. Based upon our review and involvement in the process, comparison to other work in this arena and the non-quantifiable benefits of the proposed inspection for cause philosophy, Entergy Operations believes the proposed RI-ISI program represents an improvement over the existing ISI program. As such,

Attachment to 2CAN109801 Page 82 of102 l

l

'the assessment contained within this response is provided a the basis for demonstrating i

. compliance with Principle 4 of Reg. Guide 1.174. j 1

1 I-i l

l 1

l 1

I I

I l

l 1

I i

l 3

l l

__. _ . _ . _ ~ _ _ _ _ . _ . . . _ . __ . _ _ . . .. .

Attachment to 2CAN109801 -

Page 83 of102 i Table 27-1 Risk Evaluation of ANO-2 RI-ISI Pipe Segasents ar-ass .n; s.ym.mi smanimmes.

Ammmamed ' of--: Muk [ . Teemt hmmmage Vetumnserte e ehd=='  ;

sysesums seeimsmas ammk

~

W -  : Added - samm Nummer assessed nesk twennessme Asannemasse High 0 -

Ridt r=^=*== very likse r , no . -- increemos ese i CSS 31 Madnun 6 None 4 2 to leur ridt e  !

Inw 25 Name 15 7 High 2 TF 2 Rak r=a==== catain; no ruk inaense W CVCS 12 Meeuse 3 None 3 lew 7 None 7 Had 0 -

Radt r=a=*a= certain; no risk increase ponenhal EFW 29 ua=n 4 TF 2 2 Imw 25 None 25 High 5 TF 3 I I Radt =a=*== likely; W added m=.7 asynemas HPSI 119 Medumn 10 17,IGSCC.Nane 4 3 3 versus resnowed in 4 seynenes low 104 None 71 33 High I TF 1 Risk r=a=*== likely; i==r-* ens added in 6 seynens 1151 23 Medman 13 None 6 6 I waruus rummeved e i seynast few 9 None 2 7 '

Hid 3 TF FAC.CC 2 3 3 Sesoe FAC preyman is not changed no sayuncesa rudt MFW 3 Medumn 0 -

desage is likely inw 0 -

High 4 FAC 4 Same FAC preyssa is not changed no ayuncasa ridt I MSS 26 Mediuns 0 -

damage is hkely law 22 None 19 3 High 7 TF 3 2 2 Radt r-a=*-i panemhat for 10 seynsaan; risk sncrease RCS 40 Medmun 28 17,None 7 9 12 r==*-8 for 14 sapesets; 12 of 14 esynsses are mundian low 5 Nane 5 risk; ridth prownded by enhanced TT em High 8 COR E-C 4 4 Risk s=a=*a= likely; manne risk increase paesshal only SWS 49 Medumn 38 COR 17 18 3 for 3 seynsses

[

tow 3 COR 2 1 ALL High 35 Various 14 11 10 Overall risk :=a===== very likely, only 29 af 337 RI-ISI 337 Mednan 102 Various 43 40 19 seynsmes in apseenson .

SYSTEMS low 200 Various 2 148 50 Listed are numbers of segments with added locations, same number locations, or removed locations from the ISI program.

Attschment to 2CAN109801 Pcge 84 of102 Table 27-2: Summary of F. :, :_ : ' RI-ISE Program Venus the Current Section XI Program (Number of "-- --:' : per Risk Categorv)

IReh Rhk MedesmaRhk Immr Rhk RI-ISI Na New ithk Onegory 2 Rhk Omengary 3 Rhk Omengary 4 Rhk Cuengary 5 Risk Cmengary6 Rhk Omangary7 Asummmed of of Eammmmme Vetummmerter un.--.e Vehmmmerte y- an-.me Vehmmmmerte Fammes En.=.=.e Vehmmmeric Km=== h Venummererr- Ebenomme Vakummerter-symemens se -.-e. un m= Teamt Carriet RI-ISI Teemi Omrreme RI-Ist Teemi Omerent RI-ISI Teemi Omrrume RI-Ist Teemi Omrrums RI-Ist Teaml Omtrume RI-Ist CSS 31 374 - - - - - -

33 0 4 - - - 288 21 0 53 0 0 CYCS 12 184 10 2 4 - - - 83 0 9 - - - 81 0 0 10 0 0 EFW 29 652 - - - - - - - - -

26 0 3 276 0 0 350 0 0 HPSI 119 1115 34 6 9 - - - 8 0 2 27 8 4 1044 77 0 2 0 0 IE SI 23 374 11 3 3 - - -

187 14 19 - - -

176 14 0 - - -

Mrw 8 65 - - -

65 FAC+12 FAC+6 - - - - - ~ _ - - - - -

[24] FAC+4" FAC+6" [24] 4 6

[4)) FAC+8" _

[4)) 8 -

MSS 26 192 - - -

59 FAC+10 - - - - - - - 24 3 0 109 0 0 RCS 40 307 45 10 12 - - -

227 34 23 13 2 2 22 6 0 - - -

SW 49 1380 356 MIC 14" - - - - - - 708 MIC+4 42" 316 MIC 5" - - -

Total. 337 4643 456 21 28 124 FAC FAC 538 48 57 7 74 14 15 2227 129 0 524 0 0

• Total does not include locations in plant FAC and MIC pugrams.

FT In addition to being in the plant FAC program, these welds are inspected in the Section XI / RI-ISI program. They are evaluated as additional melds with the therinal fatigue damage snechanism (Category 5).

FN In addition to being in the plant FAC program, these welds are inspected in the Section XI progrun They are evaluated as additional welds with no degradation mechsman present (Category 6)-

M 7hese isLW are past of the RI-ISI program for MIC that will subsume the existing plant MIC program-

Attachment to 2CAN109801 Page 85 of 102 TABLE 27-3 Summan of Changes in Number ofInspections No.of No. of Cumat Proposed A Risk Risk Risk Section XI RI-ISI Inspections Region Region Category Inspections Inspections (New- Old) Total 1 N/A N/A N/A 21 28 +7 HIGH 47 3 FAC Program FAC Program 0 Applies Applies 4 48 57 +9 MEDIUM +10 5 14 15 +1 6 129 0 -129 LOW -129 7 0 0 0 1

- - . - . -- . - . . . . ~ - - . .- . .. _ .- .- . - -.

t

Attachment to

' l 2CAN109801 l Page 86 of102 NRC Questlos No. 28.0 RG 1.174 also discusses several other principles which should be addressed for each risk-i informed application;

a. The proposed change is consistent with the defense in depth philosophy.

p b. The proposed change maintains sufficient safety margins.

i

c. The impact of the proposed change should be monitored using performance strategies.

. Please describe how ANO-2's proposed change in the ISI program meets each of these principles.

i

} Enargy Operations Response a) The proposed change is consistent with the defense in depth philosophy. l i

The intent of the inspections mandated by ASME Section XI for piping welds is to identify conditions such as flaws or indications that may be precursors to leaks or ruptures in a system's pressure boundary. Currently, the process for picking inspection locations is based upon structural discontinuity and stress analysis results. As depicted in References 1, 2, 3 and 4, this method has been ineffective in identifying leaks or failures. EPRI TR-106706 and its implementation at ANO-2 provides a more robust selection process founded on actual service experience with nuclear plant piping failure data.

This process has two key independent ingredients, that is a determinetion of each location's susceptibility to degradation and secondly, an independent assessment of the consequence of the piping failure. These two ingredients not only assure defense in depth is maintained, but actually increased over the current process. First off, by evaluating a location's susceptibility to degradation, the likelihood of finding flaws or indications that may be precursors to leak or ruptures is increased. Secondly, the consequence assessment effort has a single failure criterion. As such, no mater how unlikely a failure scenario is, it is ranked High in the consequence assessment, and at worst Medium in the risk assessment (i.e., Risk Category 4), if as a result of the failure there is no mitigative equipment available to respond to the event. In addition, the consequence assessment takes into account equipment reliability, so that less reliable equipment is not credited as much a more reliable equipment.

b) The proposed change maintains sufficient safety margins.

The safety function ofinterest in the ANO-2 RI-ISI evaluation is that of system pressure boundary integrity. Listed below are those attributes necessary for fulfilling this requirement as well as the impact of the ANO-2 RI-ISI program on meeting the objective:

w. - - ~-- - - - - - + , , , . -

.- . .- - .... ~ . - - .__-.. . - - - -._- - . - . - - . . ~

l Attachment to

2CAN109801 l Page 87 of102 j Quality Design - No Change

Quality Fabrication - No Change i Quality Construction - No Change i

, Quality Testing - No Change j Quality Inspection -

Fewer inspections conducted at more appropriate locations using better techniques and as necessary expanded volumes. In addition, augmented inspection

, programs such as FAC and High Energy Line Break (HELB) will continue unchanged.

i j As can be seen from the above summary, those attributes that are critical in defining and i maintaining sufficient safety margins are unchanged, except for a subset of the pressure i boundary volumetric examinations. In this case, the augmented programs are unchanged j and the reduced number of volumetric Section XI exams are based upon an explicit

consideration of potential degradation and the accompanying ccgisquence of system j failure. As such, the new Section XI inspection locations are more appropriate and will j have enhanced inspections conducted.

t j c) The impact of the proposed change should be monitored using performance strategies.

5 Implementation of the ANO-2 RI-ISI program will be consistent with existing ASME

Section XI performance monitoring requirements. These are as follows:

a

• Pressure and leak testing of all category Class 1,2 and 3 piping components.

t i e Inspection results shall be compared to the preservice inspection and prior ISI.

• For flaws exceeding acceptance criteria (IWX-3500),

increase the number ofinspections to include those items scheduled for this and the next scheduled period, additional flaws - all items of similar design, size, and function, flaw - removed, repaired, replaced, or analytical evaluation, flaws accepted by analytical evaluation shall be examined for the next three inspection periods.

In addition to the above ASME Section XI monitoring and feedback mechanisms, ANO-2 has in place the following additional performance monitoring processes;

. - .. . ~ . . .. - -. .. .._. ..__ .-.- . - . . - . - . . - . . - -

l l

l Attachment to l~

2CAN109801 Page 88 of102

• Technical Specification 3.4.6.2 Unidentified reactor coolant leakage is limited Total reactor coolant leakage is limited

. Flow Accelerated Corrosion Program

j.

• High Energy Line Break Program e Containment Monitoring Radiation Temperature

- Pressure l REFERENCES

1. ASME White Paper 92-01-01 Rev.1, " Evaluation ofInservice Inspection Requirements for Class 1, Category B-J Pressure Retaining Welds in Piping" l

l 2. USNRC Generic Letter 89-08, " Erosion / Corrosion-Induced Pipe Wall Thinning" I

3. USNRC Generic Letter 89-13, " Service Water System Problems Affecting Safety-Related Equipment"

( 4. SKI Report %:20, " Piping Failures in United States Nuclear Power Plants: 1 % 1-1995" l

l l

i l

l

?

i 4

e

Attachment to 2CAN109801 Page 89 of102 NRC Question No. 29.0 Please elaborate on the reason for the initiating event screening process mentioned in Reference 1, Section 3.1.

Entergy Operations Response l This section only summarizes the initial review of the IPE results and what is important. This is done early in the analysis mainly to confirm the importance of support systems and provide an initial understanding of the main risk contributors. Every initiator, including LOCAs outside containment and internal floods, are explicitly considered in RI-ISI analysis.

l l

t I

a i

- - . _ _ - - . - - - .----_- - ---. .. - - .- _ ~. ...

Attachment to 2CAN109801 l Page 90 of102 l- NRC Question No. 30.0 Current plant wide risk informed applications (MRule, GQA, IST) all have an " expert panel" generally composed of technical experts from each key functional area who have the responsibility and authority for final review and approval of the findings. The expert panel may perform the work or only review the work, and meeting minutes are usually kept. Is there any type of review process such as this involved in the licensee's process? If not, how is the integrated analysis and recult judged acceptable and this judgement documented?

Entergy Operations Response l

The EPRI RI-ISI methodology is a process driven approach. As such, reviews performed of the ANO-2 application results consisted primarily of ensuring that the process was correctly and l comprehensively applied. A complete and thorough application of the EPRI process will result in l

an accurate risk categorization of piping segments. Consequently, the EPRI methodology is not l reliant upon an expert panel to identify risk significant segments that the process may have failed

to identify. 1 The review process utilized in the ANO-2 pilot application consisted of ti e following

e ABB Combustion Engineering (ABB-CE) functioned as the principal investigator for the l

! ANO-2 pilot project in the application of the EPRI RI-ISI methodology. ABB-CE was assisted in the performance of the risk analyses for certain systems by Yankee Atomic and StmeturalIntegrity Associates. The system risk evaluations were performed and documented in the form of calculations. As such, after preparation of the calculations, an independent review was performed and all comments resolved, before the calculations received final approval.

. To support the project, Entergy Operations assembled a dedicated team of plant staff with diverse experience in probabilistic risk assessment, operations, inservice inspection and structural analysis. The plant team's project support duties included the following: collection of required design inputs, responding to inquiries from the project principal investigators, resolution ofissues arising during the evaluations, participation in plant walkdowns to assess spatial interactions, review of plant service history relative to piping pressure boundary degradation occurrences, and a comprehensive review of the system calculations with primary focus on the technical accuracy and completeness of the system consequence evaluations and degradation mechanism assessments. This team, which interfaced with other plant staff personnel on an as needed basis, was an active participant in the application of the EPRI RI-ISI process, and ensured that plant specific knowledge and insights were factored into the risk evaluations.

l This team was ultimately responsible for verifying the technical content of the ANO-2 pilot

! application submittal. ANO Procedure A4.502, " Accuracy of Communications," provides a j process to document that complete and accurate information is submitted to the NRC. The

l l Attachment to 2CAN109801 l Page 91 of102 l process requires that the originator compile the documentation necessary to substantiate that l the information is true, accurate and complete. A verification is then performed to confirm that the documentation supports the statements made. The plant team performed this function.

! e The completed system calculations were additionally subjected to an independent, integrated plant review. This review was conducted to validate our contention that application of the EPRI process will successfully identify risk significant segments without the back-end utilization of an expert panel. This review did not reveal any new insights that changed the conclusions (i.e., segment risk categorizations) reached by application of the process.

As stated above, application of the EPRI process driven approach will yield appropriate results.

Application of this approach obviates the need for an expert panel to ensure the appropriate risk categorization of piping segments.

The point is illustrated by the following two key elements of the EPRI process driven approach.

1

• Application of the process ensures the identification and inspection of high consequence / low failure potential piping segments (i.e., Medium Risk - Category 4)

. Application of the process ensures the identification and inspection oflow consequence / high failure potential piping segments (i.e., Medium Risk - Category 5)

, Both of the above are accomplished without the reliance on an expen panel. To further illustrate l this point, this approach is contrasted with the following results from the Surry pilot application.

e 50% of the high safety significant segments were identified by the expert panel l e These segments had originally been determined to be oflow safay significance via the risk importance measure calculations e These segments were reassigned by the expert panel to be of high safety significance due solely to high cortiequences in the event of failure The two RI-ISI approaches (i.e., N-577 and N-578) simply employ different means to reach the same end. Whereas the N-577 approach is reliant upon an expert panel for the identification of such segments, the N-578 approach is not. The process itself ensures the identification of all risk significant segments.

t a

1 I

l i

Attachment to 2CAN109801 Page 92 of102 NRC Question No. 31.0 Qualification of nondestructive examination (NDE) systems (personnel, procedures and equipment) is an important element of a RI-ISI program. In the system risk evaluations, the licensee states: "An inspection for cause process shall be implemented utilizing examination methods and volumes defined specifically for the degradation mechanism postulated to be active at the inspection location." As with any " inspection for cause" methodology, the reliability of examinations should be optimized to the desired confidence levels for the risk-informed inspection process to be effective. Highly reliable NDE systems can be provided through the use of NDE performance demonstration programs. It is unclear how NDE methods, procedures and personnel will be qualified at ANO-2. Provide a detailed technical discussion describing how the NDE I performed to support the RI-ISI program will be qualified, and the reliability subsequently I enhanced.

Entergy Operations Response In general, the NDE in question are volumetric examinations (i.e., ultrasonic examinations).

Effective January 1,1998, Entergy Operations at Arkansas Nuclear One uses only ultrasonic examination (UT) personnel that meet the qualification requirements of the 1992 Edition of ASME Section XI, Appendix VII, " Qualification of Nondestructive Examination Personnel for Ultrasonic Examination." Additionally, only UT personnel that have successfully completed the practical examinations of the PDI (Performance Demonstration Initiative) administered by the EPRI NDE Center, for the specific application areas, (e.g., carbon steel, austenitic steel, IGSCC, etc.) are used for ASME Section XI ultrasonic examinations. This practical performance demonstration is the most comprehensive qualification for UT personnel. It is used as the practical examination required by Appendix VII and to meet contractor screening requirements for UT at Entergy Operations' nuclear sites.

The PDI assures that UT personnel have experienced a variety of examination problems and the associated difficulties of flaw detection and discrimination. This test enhances the skills of the UT personnel and provides a measurable scale of the reliability of those skills.

Attachment to l 2CAN109801 Page 93 of102 NRC Question No. 32.0 I It appears that the licensee's alternative includes Examination Categories B-F, B-J, C-F-1 and C-l F-2. In later editions of the Code (1989 Addenda), Examination Category B-F is specifically for l " Pressure Retaining Dissimilar Metal Welds in Vessel Nozzles". Considering that the trend of the Code is to classify B-F welds as part of vessel nozzles, what is the justification for including these welds in the RI-ISI program for piping?

l l l Entergy Operations Response I

In the current ANO-2 ISI Program, which is written to the 1986 Edition of the ASME Section XI Code, there are a total of twenty-eight Category B-F dissimilar metal welds, of which twenty- l three are piping dissimilar metal welds, and five are vessel nozzle dissimilar metal welds. In the l ANO-2 RI-ISI submittal, the element selections include fourteen of these dissimilar metal weld locations. Of the fourteen, thirteen are piping dissimilar metal welds and one is a vessel nozzle dissimilar metal weld. It should be noted that since the hot and cold legs are carbon steel, there l are no dissimilar metal weld connections to the reactor vessel or steam generator inlet and outlet l nozzles. All five of the vessel nozzle dissimilar metal weld locations are located on the pressurizer l (surge nozzle, spray nozzle and three safety nozzles).

In the 1989 Addenda of the ASME Section XI Code, piping dissimilar retal welds were relocated from Category B-F to Category B-J. The requirements for Category Is-J since the 1977 Edition through the current 1998 Edition include the mandatory selection of all dissimilar metal welds. In j the 1989 Addenda, ASME corrected the inconsistency of having Category B-J mandate the examination selection of piping dissimilar metal welds contained in Category B-F by relocating these requirements to Category B-J. This Code change was made strictly to more clearly l delineate these requirements and has no technical bearing on the content or use of Code Case l N-578. Consequently, Entergy Operations believes the inclusion of vessel nozzle dissimilar metal welds in the scope of the RI-ISI assessment is appropriate.

Note: The current ANO-2 ISI Program contains no relief requests for Category B-F, dissimilar metal welds.

l l

l

Attachment to

2CAN109801 l Page 94 of102 l

NRC Question No. 33.0

The inspection for cause strategy used in the proposed alternative should define when the

inspections are to be performed. Scheduled inspection frequencies should be consistent with  !

l relevant degradation rates and should be sufficiently short such that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed. It appears that examination frequencies are based on current Section XI scheduling i requirements (once every ten years). The licensee shouldjustify the inspection frequencies for the postulated degradation mechanisms contained in the proposed alternative.

Entergy Operations Response The basic intent of the EPRI RI-ISI approach is that the ten year inspection interval required by i the current Section XI program supplemented with augmented inspections for specific degradation mechanisms provide an acceptable level of quality and safety. l l Many years of operating experience have indicated in relative terms which of the mechanisms listed in EPRI TR-106706 have aggressive initiation and growth rates. The inspection schedules

for mechanisms such as IGSCC (BWRs) and FAC are based on the NRC's mandated inspections

) or plants own inspection programs For mechanisms with slow growth rates where operating i experience has shown that there is no need for augmented inspections, the Section XI inspection interval has been used successfully in the past and will still be used to manage these mechanisms.

a i Finally, the Service History and Susceptibility Review and ongoing industry events reviews assure i that the industry trends are being monitored to assure that if an unexpected or new mechanism is i identified, or a new component is identified as susceptible to an existing degradation mechanism, i the ISI program will be updated to reflect that change. The program update will incorporate any

, additional inspections mandated by the NRC, as well as those inspections deemed appropriate by the industry owners groups addressing the specific issues.

1 4

1 4

Attachment to

2CAN109801 j Page 95 of102 j NRC Question No. 34.0 The licensee has pesformed a Service History and Suceptibility Review, as detailed in Section 6.0 l of each system risk evaluation for ANO-2. The results are listed in tabular form as Table (s) 6.

l These tables show the databases searched and list a designation for the results, if any instances are found for a particular degradation mechanism. It is unclear how this plant-specific review is factored into the overall risk evaluation. Is the review intended to supplant the industry review j performed by EPRI to enable assigning a degradation category, as described in TR-106706, l Section 4.07 Please clarify how this ANO-2 specific review is used to modify the methodology for categorizing segments according to degradation potential.

Entergy Operations Response The Service History and Susceptibility Review was conducted for each ANO-2 system not to j supplant, but to supplement the EPRI industry review. Plant-specific data were collected to identify potential damage mechanisms associated with particular plant configurations and service conditions that may not have been identified in the EPRI industry review. The site-specific review included identification of any mechanisms or events potentially resulting in piping degradation, as i well as through wall leaks or mptures. Plant-specific service history is considered a key element l in confirming degradation mechanism susceptibility. This information was also utilized in the element selection process Collection of this data allowed fine tuning of the element selection process where applicable and provided additional confirmation of tl e appropriate assignment of damage mechanisms to systems or portions thereof.

l 4

Attachment to 2CAN109801 Page % of102 NRC Question No. 35.0 The EPRI methodology described in TR-106706, Section 4.0, as used by the licensee for categorizing degradation mechanisms into failure potential requires clarification in the following areas:

a. The large pipe break potentials listed are "High", for a >50gpm leak, " Medium", for a 1-10 gpm leak, and " Low", where no leakage is expected. These translate into degradation categories of"Large break", "Small leak", and "None", respectively. There appears to be an area of potential leakage not covered by this categorization; specifically, leaks between 10 and 50 gpm. Please describe how postulated leakage rates in the 10-50 gpm range will be addressed.

b. The EPRI report cites the basis for degradation mechanism categories as a review of industry service data that includes approximately 1,000 crack and/or leak events, and 100 rupture events, although no degradation mechanism was identified in 48% of these events.

Further, no leakage rate information was available, but the report states that it is believed these events produced leakages much less than 50 gpm. The data reviewed is very limited and does not appear to support this assumption.

In addition, approximately 30% of the rupture events have been attributed to flow-accelerated corrosion (FAC). The source material is from previous EPRI work (referenced in the report).

The report's final assessment is that FAC is the only mechanism likely to be detected by periodic inspections that has a large break potential (>50 gpm); all other mechanisms will only result in small leaks (<10 gpm). No justification is given for this contention.

Provide the technical bases for these assumptions. Also, it is unclear whether the source material is up-to-date and comprehensive; is the source considered to be a global consensus or industry standard for describing potential degradation mechanisms in light water commercial nuclear facilities?

Entergy Operations Response a) The use of pipe break potential (i.e., "High" for large break (50 gpm), " Medium" for small break (1 - 10 gpm) and " Low" for no leakage) is quite arbitrary and is only illustrative of the type of leakage that would be expected from specific damage mechanisms. As indicated in the EPRI TR-106706, the only damage mechanism associated with large leaks is FAC. Water hammer is considered to elevate the pipe break potential if present in conjunction with another damage mechanism. These mechanisms have the potential to result in large flaw opening areas producing relatively large leaks. All other mechanisms, such as fatigue, stress corrosion, and MIC/ pitting either result in very tight cracks or very small localized nonplanar flaws such that leakage from these mechanisms is relatively small in most cases For all practical purposes, the quantification of the leakage in "gpm" could have been omitted, but was provided only to illustrate the type ofleakage that would be s _

l l

Attachment to

, 2CAN109801 Page 97 of102 expected from these mechanisms. The High, Medium, and Low failure potential

)

categories refer to the potential for pipe ruptures of sufficient magnitude to create the consequences that are assessed in the consequence evaluation part of the procedure.

b) The EPRI approach for assessing pipe rupture potential is based on insights from service experience that were briefly summanzed in TR-106706. The original technical basis documents for this work were referenced in TR-l%706. These research efforts collected and analyzed service experience of piping systems that covered the first 2,100 plant years of U.S. commercial light water reactor operating life.

Since publication of TR-106706, EPRI has continued its research to support the technical basis for implementation of RI-ISI. The events in the database listed as " unknown" are ,

associated with event reports in which the degradation mechanism was not reported.

Follow-up investigations were subsequently made to investigate the unknown cause issue l further. These follow-up investigations included re-reviewing all the event reports for the

events originally listed as ruptures and contacting utility personnel to verify the final determination of failure mechanism. A complete evaluation of the data has been performed and shown in Table 35-1. As can be seen from this table, the " unknown"

mechanism failure has reduced to 139 out of a total of 1145 leaks and ruptures. Table

, 35-1 was developed after a very thorough and exhaustive review of all the data. As indicated in the response to question 35(a), the quantification of the leakage is only

! indicative of the type of leakage that would be expected from the degradation j mechanisms.

I ,j l '

1 l

I

l l

Attachment to 2CAN109801 ,

I Page 98 of102 l l

Table 351 Service Experience with Leaks and Ruptures Frsm Different Damage Mechanisms

! Degradation Failure Mechanism Type of Failure Type I.D. Description All Leak Rupture SC Stress Corrosion Cracking 151 151 0 TF Thermal Fatigue 38 37 1 Degradation E-C Erosion Cavitation 12 12 0 Mechanism CF Corrosion Fatigue 11 11 0 E/C Erosion Corrosion or Flow 201 183 18 i Accelerated Corrosion COR Corrosion Attack 65 64 1 VF Vibration Fatigue 312 298 14 D&C Design & Construction 166 152 14 Defects Severe WH Water Hammer 27 18 9 Loading HE Human Error 14 13 1 OVP Overpressure 6 3 3 4 FP Frozen Pipes 3 1 2  ;

Others OTH Others N/A N/A N/A UNK Unreported Cause 139 133 6 All All Failure Mechanisms 1145 1076 69

[1] Jamali, K., Pipinn Failures in U.S. Commercial Nuclear Power Plants, EPRI Interim Report TR-100380, July 1992.

[2] Jamali, K., Piping Failures in U.S. Commercial Nuclear Power Plants. EPRI Report TR-102266, April 1993.

[3] Bush, S.H., et al., " Piping Failures in the United States Nuclear Power Plants: 1 % 1-1995,"

SKI Report 96:20, January 1996.

[4] Fleming, Karl, Craig Sellers, and Doug True, " Independent Review EPRI Risk Informed In- 1 Service Inspection Procedure," prepared by ERIN Engineering and Research, Inc. for EPRI, July 12,1996.

[5] Gosselin, Stephen R. and Karl N. Fleming, " Evaluation of Pipe Failure Potential Via Degradation Mechanism Assessment," Proceedings ofICONE 5, 5* International Conference on Nuclear Engineering, May 26-30,1997, Nice France.

4

[6] Stone and Webster Engineering Corp, " Water Hammer Prevention, Mitigation, and Accommodation," EPRI Report NP-6766, Final Report July 1992.

[7] Fleming, K.N., T.J. Mikschi and J.W. Read. " Piping System Reliability Models and Database for Use in Risk Informed In-service Inspection Applications," EPRI No. I10161, prepared by ERIN Engineering and Research, Inc. (Draft) June 1998.

4 Attachrwt ta 2CAN109801 Page 99 of102 NRC Question No. 36.0 Several issues pertaining to the manner in which the licensee has performed the degradation mechanisms evaluation in all system risk evaluations need to be clarified:

, a. For example, in Section 5.0 of the Containment Spray System evaluation, the licensee states, "The results (of the evaluation) indicate that no degradation mechanisms are

. potentiallypresent." Does the licensee intend to state that no mechanisms are currently active? Or that the evaluation concludes that no mechanisms are potentially applicable?

, Please clarify what is meant by the preceding statement in this as well as other system i

evaluations.

i b. For the system example cited above, the licensee has qualitatively determined that the potential for microbiologically influenced corrosion (MIC) and pitting attack (PIT) is l

considered low. However, even a small potential implies that some probability exists that the degradation may be manifested during the serv;ce life of the component. This  !

determination carries forward to the segment risk rankings (Tables 7 in each system l evaluation) where a degradation mechanism classified as "None" relates to no potential for small leak or large break, and ultimately lowers the overall risk ranking for that line

segment. It appears that the licensee is approaching this ranking in a non-conservative manner. For all system risk evaluations, the licensee should justify why, when my notential exists for a particular degradation mechanism to occur, a failure potential of "None" is assigned to the applicable line segments.

c. The attributes to be considered for degradation mechanisms, as listed by the licensee in Table 5 of each system evaluation, do not coincide with those in the referenced basis methodology documents (Code Case N-578 and EPRI TR-106706). It appears the licensee has developed several more attributes for consideration when determining if a particular degradation mechanism could be present. For the Containment Spray System example cited above, the licensee has considered ambient temperature (less than 200*F) as i the basis for excluding intergranular stress corrosion cracking (IGSCC) from occurring.

However, the references do not list temperature as a criteria for consideration, only sensitized material, stagnant flow, and oxygenated water. By using temperature as a basis, the licensee is able to eliminate IGSCC from consideration for this system. This is not consistent with the referenced documents. The licensee should show cause for not using

. the same criteria as that listed in the references.

. Entergy Operations Response j As explained in the response to question 4.0, the list of degradation mechanisms and associated attributes described in SIA Report SIR-96-097 was utilized in the ANO-2 pilot application. The damage mechanism criteria employed for ANO-2 is very similar to that contained in EPRI TR-106706. The use of the damage mechanism table in SIR-96-097 provided various i

Attachment to 2CAN109801 Page 100 of102 enhancements as a result of application experience gained from the early stages of the ANO-2 pilot project.

a) The method provided in EPRI TR-106706 for evaluating the applicability of the listed mechanisms is binary in nature. That is, a degradation mechanism is considered operative or not; no " shades of gray" are permitted. A strict interpretation of this binary approach would have resulted in listing mechanisms in systems with an extremely low probability of occurrence, a probability not borne out by operating experience. Hence, the philosophy which was adopted in assigning the mechanisms is that if a mechanism has an extremely low probability of occurrence (of the order of 3-sigma) based on the criteria specified in l the TR it is considered not applicable.

The process, however, goes beyond this binary approach in the element selection process in that a more " continuous" type process is used to select the most susceptible locations for inspection after the initial degradation mechanism and consequence evaluation. This approach therefore uses the attributes in the degradation assessment table plus industry experience to perform the damage mechanism assessment on the " front end" of the evaluation for systems or subsystems. This eliminates mechanisms which will eventually be found to be inconsequential to failure after the initial evaluation. However, the process allows the inspection to be focussed at areas of the system that are considered the most susceptible to any identified or "potentially present" damage mechanism during the element selection process.

The process furthermore looks at the system operating experience in the " Service History and Susceptibility Review" sections to assure that the damage mechanisme evaluation is I consistent with operating experience.

As an illustration of the binary process and the Service History and Susceptibility Review approach for the case of MIC in the containment spray system, the system selected in question 36, the presence of microbes cannot be precluded as a result of the normal operating temperature (less than 150'F) and water purity considerations (since the RWT is not treated with biocides). However, a detailed Service Histoiy and Susceptibility Review for this system indicates that no evidence has ever been observed to suggest that MIC has been active or is a potential problem for the CSS at ANO-2. This is consistent with industry operating experience and the fact that the RWT contains treated water consistent with primary water chemistry controls. For this illustration, MIC is potentially active, however, its presence has never been observed at ANO-2 or at any other operating plant for this system. Consequently, this mechanism is not considered active at the plant for CSS, even though it was identified as "potentially present."

b) The point made by the NRC as related to the apparent lack of conservatism in the evaluation of MIC and pitting for the CSS when examining only TR-106706 is well taken.

Since these mechanisms have been identified as potentially active, as noted in the response to question 36a above, the appropriate action would seem to have been to consider these

Attachment to 2CAN109801 Page 101 of102

]

i mechanisms as "small leak" mechanisms in accordance with TR-106706. However, as

, explained in response to question 36a, given the water purity controls in place, this mechanism is not considered active for the CSS. In addition, in the ANO-2 evaluation, a Service History and Susceptibility Review, Section 6.0 of the CSS submittal, was

performed which substantiated the industry experience that MIC is not an active

! mechanism for the CSS. It is this augmented assessment which is used to identify the mechanisms as " inactive" at this plant. These data illuetrating that no evidence of these

! mechanisms has ever been observed results from an exhaustive service history review of l the performance history of the plant from prior to commercial operation to the present.

This evidence, augmenting the degradation mechanism assessment, provides the assurance i that MIC and pitting are inactive in the CSS at ANO-2.

l c) The list of attributes in Table 5 of the submittal for each system, though different in arrangement from that presented in EPRI TR-106706, is not really different in content i than the original list of mechanisms presented in Table 4-1 of TR-106706. The only new i mechanism that appears in this new table is pitting which for most practical purposes was i already addressed by MIC. All other mechanisms presented in the new table were also i covered in Table 4-1 of TR-106706, albeit under a different general heading. This rearrangement was a result of recommendations provided by a design review team which reviewed the mechanisms and attributes for completeness and accuracy after publication of TR-106706.

l The attributes listed for IGSCC remain similar to those identified in the EPRI report.

j Additional clarification is provided to differentiate between oxidizing conditions and initiating contaminants which tend to exacerbate the corrosion prienomenon and i potentially produce corrosive effects outside the range of parameters generally accepted 1 for oxidizing conditions alone. Thus, the addition of the 200' F threshold condition for I

oxidizing environments alone is consistent with industry standards (e.g., Generic Letter 88-01 for IGSCC in BWRs) and lower temperature effects are accounted for by invoking the presence ofinitiating contaminating species such as chlorides or fluorides. The intent of Table 5 in the ANO-2 submittals is to provide further clarification of the mechanisms and their operating ranges.

Attachment to 2CAN109801 Page 102 of 102 l

NRC Question No. 37.0 i l

1 In the licensee's submittal references are made to a software tool that was used to support the RI ISI evaluations. What are the capabilities of this software tool? Which steps in each of the evaluations were automated by this software?

Entergy Operations Response The software tool used in the ANO-2 RI-ISI evaluation is ISIS (Inservice Inspection Software),

the first alpha version. In this version, ISIS is a Microsoft Access Database which contains '

information necessary to perform a RI-ISI evaluation:

• Data on the Systems and Scope of Analysis: line and weld numbers, descriptions, class, type, and material.

• Data from the FMECA Degradation Mechanism analysis: degradation mechanism identified for each location.

. Data from Consequence Analysis: consequence description, spatial effects, isolability and recovery, lost trains, available trains, and consequence rank. l The only automated part in the application of this alpha version of the software is the automated segment grouping and risk ranking, based on the assigned degradation mechanisms and l consequence ranks. l The ISIS database is used as the main documentation source for the RI-ISI analysis. The examples of the information contained in the database, are given in the ANO-2 submittal reports:  ;

FMECA - Consequence Information Report FMECA- Degradation Mechanisms i FMECA- Segment Risk Ranking Repon l l

l