Text

License Amendment Request Emergency Diesel Generator Extended Allowed Out-of-Service Time (AOT) - TS 3.8.1, AC Sources--Operating, Ldc 2001-192
	ML020370084
Person / Time
Site:	Grand Gulf
Issue date:	01/31/2002
From:	Eaton W; Entergy Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	-nr, GNRO-2002/00007, RG-1.177
	Download: ML020370084 (69)
	v • d • e

Entergy Operations, Inc.

P 0. Box 756 Port Gibson, MS 39150 SEntergy Tel 601 437 6409 Fax 601 437 2795 William A. Eaton Vice President, Operations Grand Gulf Nuclear Station GNRO-2002/00007 January 31, 2002 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

Grand Gulf Nuclear Station, Unit 1 Docket No. 50-416 License Amendment Request Emergency Diesel Generator Extended Allowed Out-of-Service Time (AOT) - TS 3.8.1, "AC Sources - Operating", LDC 2001-192

REFERENCES:

Letter from Mr. R. K. Edington to USNRC, "License Amendment Request (LAR) 2001-27, Emergency Diesel Generator Extended Allowed Outage Time" dated September 24, 2001.

Dear Sir or Madam:

Pursuant to 10 CFR 50.90, Entergy Operations, Inc. (Entergy) hereby requests the following amendment for Grand Gulf Nuclear Station, Unit 1 (GGNS). Entergy proposes to amend Technical Specifications (TS) 3.8.1, "AC Sources - Operating" to extend the allowed outage time (AOT) for a Division 1 or Division 2 Emergency Diesel Generator (DG) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days. These proposed changes are intended to provide flexibility in scheduling DG maintenance activities, reduce refueling outage duration, and improve DG availability during plant shutdowns.

The proposed change has been evaluated in accordance with 10 CFR 50.91 (a)(1) using criteria in 10 CFR 50.92(c) and it has been determined that this change involves no significant hazards considerations. The bases for these determinations are included in the attached submittal.

Entergy's evaluation includes traditional engineering analyses as well as a risk-informed approach as set forth in RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications."

The proposed change includes new commitments as summarized in Attachment 4. The NRC has approved similar Technical Specification changes for other plants. This request is similar to the Perry Nuclear Power Plant and Clinton Power Station applications. It is also similar to the River Bend application (referenced above) which is currently pending NRC review.

Entergy requests approval of the proposed amendment by September 2002. Once approved, the amendment shall be implemented within 60 days. Although this request is neither exigent nor emergency, your prompt review is requested.

AGO /

January 31, 2002 GNRO-2002/00007 Page 2 of 2 If you have any questions or require additional information, please contact Ron Byrd at 601-368-5792 or Lonnie Daughtery at 601-437-2334.

I declare under penalty of perjury that the foregoing is true and correct. Executed on January 31, 2002.

S in ce re ly , 4 ',;,A .

WAE/RWB/amt attachments:

1. Analysis of Proposed Technical Specification Change

2. Proposed Technical Specification Changes (mark-up)

3. Changes to TS Bases pages (FOR INFORMATION ONLY)

4. List of Regulatory Commitments

5. GGNS PRA Peer Review Certification Information

6. Description of GGNS PSA Model Changes and Updates Risk Information

7. Tier 1: DG PSA Study Results

8. DG AOT LERF Evaluation cc: Mr. Ellis W. Merschoff Regional Administrator U. S. Nuclear Regulatory Commission Region IV 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-8064 Mr. S. P. Sekerak Project Manager Region IV U. S. Nuclear Regulatory Commission NRR/DLPM (w/2)

Mail Stop 07D1 Washington, DC 20555-0001 Mr. T. L. Hoeg, GGNS Senior Resident Mr. D. E. Levanway (Wise Carter)

Mr. L. J. Smith (Wise Carter)

Mr. N. S. Reynolds Mr. H. L. Thomas

Attachment 1 GNRO-2002100007 Analysis of Proposed Technical Specification Change to Letter GNRO-2002/00007 Page 1 of 18

1.0 DESCRIPTION

This letter is a request to amend Operating License NPF-29 for Grand Gulf Nuclear Station, Unit 1 (GGNS).

The proposed change will revise Technical Specification (TS) 3.8.1, "AC Sources - Operating" to extend the length of time that the Division 1 or Division 2 emergency diesel generators (DGs) can be out of service during unit operation. This would allow greater flexibility and more efficient planning of DG maintenance and testing activities during unit operation. The changes would also reduce plant refueling outage duration and improve DG availability during refueling outages. The proposed changes would also minimize the potential for Notice of Enforcement Discretion (NOED) requests due to unforeseen circumstances.

The next Grand Gulf refueling outage is scheduled for the Fall of 2002. Entergy desires this amendment to be issued by September 2002 to support outage work planning.

2.0 PROPOSED CHANGE

Currently, GGNS TS 3.8.1 requires an inoperable DG to be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (REQUIRED ACTION B.4). In addition, REQUIRED ACTIONS A.2 and B.4 establish a 6 day limit on the maximum time allowed for any combination of required AC sources to be inoperable during any single contiguous occurrence of failing to meet LCO 3.8.1.

If either of these conditions cannot be met, the plant must be placed in Hot Shutdown within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and Cold Shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Entergy proposes the following changes to TS 3.8.1:

a. Revise the Completion Times associated with Required Action B.4 From: "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AND 6 days from discovery of failure to meet LCO" To: "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from discovery of an inoperable Division 3 DG, AND 14 days, AND 17 days from discovery of failure to meet the LCO."

b. Revise the Completion Time of Required Action A.2 From: "6 days from discovery of failure to meet LCO" To: "17 days from discovery of failure to meet LCO" (This change is needed to be commensurate with the extended DG AOT)

The extended AOT would typically be used for voluntary planned maintenance or inspections but can also be used for corrective maintenance. Entergy intends to limit use of the extended AOT for voluntary planned maintenance or inspections to once within an operating cycle for each DG (Division 1 and Division 2). Any additional DG unavailability is monitored and evaluated in relationship to Maintenance Rule goals to ensure that DG outage times do not degrade operational safety over time.

In summary, the primary TS change extends the AOT for a Division 1 or Division 2 DG during Modes 1, 2, or 3 from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days. This 11-day extension would also be applied to the maximum time allowed for any combination of required AC sources to be inoperable during any single contiguous occurrence of failing to meet the LCO to be commensurate with the extended DG completion time. The AOT for the Division 3 DG remains at 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months because of the relationship between the Division 3 DG and the High Pressure Core Spray (HPCS) system. The

Attachment I to Letter GNRO-2002/00007 Page 2 of 18 Completion Time for restoring the HPCS system is 14 days. There is no need to extend the Division 3 DG Completion Time since an existing Note in TS 3.8.1 allows the 14 day HPCS AOT (TS 3.5.1) to be applied in the case of an inoperable Division 3 DG. Marked-up pages indicating the proposed changes are provided in Attachment 2.

Respective changes will also be made to the TS Bases in accordance with the Bases Control Program of TS 5.5.11. The Bases will reflect the risk-informed nature of the extended AOT and note that use of the extended AOT for voluntary planned maintenance or inspections should be limited to once within an operating cycle for each DG (Division 1 and Division 2). These changes are provided in Attachment 3 for your information.

3.0 BACKGROUND

The Grand Gulf Class 1 E AC Electrical Power Distribution System AC sources consist of three 1 and three onsite standby offsite power sources (two 500 KV sources and one 115 KV source) power sources (diesel generators). As required by 10 CFR 50, Appendix A, GDC 17, the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems. The Class 1 E AC distribution system supplies electrical power to three divisional load groups, with each division powered by an independent Class 1 E ESF bus. The ESF systems of any two of the three divisions provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition.

Offsite power is supplied to the switchyard from the transmission network. From the switchyard three electrically and physically separated circuits provide AC power to each ESF bus. The offsite AC electrical power sources are designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A detailed description of the offsite power network and circuits to the onsite Class I E ESF buses is found in FSAR, Chapter 8.

The onsite standby power source for each ESF bus is a dedicated DG. The DG starts automatically on loss of coolant accident (LOCA) signal (i.e., low reactor water level signal or high drywell pressure signal) or on an ESF bus degraded voltage or undervoltage signal. In the event of a loss of preferred power, the ESF electrical loads are automatically connected to the DGs in sufficient time to provide for safe reactor shutdown and to mitigate the consequences of a Design Basis Accident (DBA) such as a LOCA.

The current GGNS TS 3.8.1 requires that if a DG is declared inoperable for any reason, the DG must be restored to an operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the plant must be placed in at least hot shutdown within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in cold shutdown within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . An exception is allowed for the Division 3 DG. A note in TS 3.8.1 allows the HPCS system to be declared inoperable either in lieu of declaring the Division 3 DG inoperable or at any time subsequent to entering the ACTIONS for an inoperable Division 3 DG. This exception allows the Division 3 DG to be inoperable for up to an additional 14 days provided that the RCIC system is operable (see TS 3.5.1). Therefore the AOT extensions being requested relate only to the Division 1 and Division 2 DGs.

1 LCO 3.8.1 only requires two of the three offsite power sources to be OPERABLE. Currently, only the two 500 kV sources are credited for meeting the LCO requirements.

Attachment I to Letter GN RO-2002/00007 Page 3 of 18 The requested changes are sought in order to provide needed flexibility in the performance of corrective and preventive maintenance during power operation. In addition, the adoption of the proposed AOT extensions reduces the risk of unscheduled plant shutdowns. In general, risks incurred by unexpected plant shutdowns can be comparable to and even may exceed those associated with continued power operation. GGNS does not currently have a transition risk model to compare these risks quantitatively. However, River Bend Station, Entergy's other BWR6 facility, has evaluated the transition risk in its application (reference section 6.0) which demonstrated that the risk associated with a shutdown transition to repair an DG is comparable to the risk of performing the maintenance on-line.

The NRC has approved similar requests for several other plants. This request is similar to the Perry Nuclear Power Plant and the Clinton Power Station applications. Entergy's River Bend Station also has a similar application pending. Each of these facilities is a BWR6 plant. The Perry Nuclear Power Plant and the River Bend Station also have the capability of using the Division 3 HPCS DG as an alternate AC power source through a cross-tie to the Division 1 or Division 2 ESF buses. References to these applications and amendments are provided in section 6.0

4.0 TECHNICAL ANALYSIS

Entergy has evaluated the proposed changes using traditional engineering analyses as well as a risk-informed approach as set forth in RG 1.177, "An Approach for Plant-Specific, Risk Informed Decisionmaking: Technical Specifications." RG 1.177 prescribes an acceptable approach for requesting TS changes that go beyond current staff positions, especially for those such as relaxations to AOTs or surveillance test intervals. These evaluations and conclusions are also consistent with the guidance of RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis".

4.1 DETERMINISTIC EVALUATION The impact of the proposed change was evaluated and determined to be consistent with defense-in-depth philosophy. The defense-in-depth philosophy requires multiple means or barriers to be in place to accomplish safety functions and prevent the release of radioactive material. The Engineered Safety Feature (ESF) systems required to mitigate the consequences of postulated accidents consist of three independent divisions. The ESF systems of any two of the three divisions provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition. Each of the three independent ESF divisions can be powered from one of the offsite power sources or its associated on-site DG. This design provides adequate defense-in-depth to ensure that the ESF equipment needed to mitigate the consequences of an accident will have diverse power sources available to accomplish the required safety functions. Thus, with one DG out of service, there are sufficient means to accomplish the safety functions and prevent the release of radioactive material in the event of an accident.

In addition, the Division 3 High Pressure Core Spray (HPCS) DG can be cross-connected to either the Division 1 or the Division 2 AC buses to provide an alternate AC power source in the event of a station blackout. Instructions for performing this alignment are contained in current procedures for responding to a loss of AC power event.

to Letter GNRO-2002/00007 Page 4 of 18 Since the proposed AOT change allows some Division 1 or Division 2 DG work to be performed on-line, the availability of the DGs during shutdowns should be increased, thus providing increased defense-in-depth during outages. Some DG maintenance may still be performed during a refueling outage, but to a lessor extent.

The proposed AOT extension does not introduce any new common-cause failure mechanisms and does not compromise protection against common-cause failure modes previously considered.

Defenses against human errors are maintained with the proposed TS changes. Qualified personnel will continue to perform DG maintenance and overhauls whether they are performed on-line or during shutdowns. Operating crews will be briefed on the DG work plan, with consideration given to key procedural actions that would be required in the event of a Loss of Offsite Power (LOOP) or SBO. The procedure for alignment of the Division 3 DG to the Division 1 or 2 bus contains the necessary limitations and details to minimize the potential for human errors and ensure that it will only be used for its intended purpose.

The proposed AOT change does not affect any of the assumptions or inputs to the safety analyses of the FSAR. Assuming there are no additional failures of redundant equipment during the time that the DG is removed from service, the intended safety functions would still be met.

Additionally, the proposed changes do not erode the decrease in severe accident risk achieved with the issuance of the Station Blackout (SBO) Rule. The SBO Rule, promulgated as 10 CFR 50.63 "Loss of All Alternating Current Power," requires that a facility be able to withstand a SBO for a specified duration and recover. GGNS is classified as a four-hour coping plant with 0.95 DG target reliability (see FSAR Appendix 8A). The assumptions used in the SBO analysis regarding reliability of the DGs are unaffected by the proposed TS changes since preventive maintenance and testing will continue to be performed to maintain reliability assumptions. The results of the SBO analysis are not affected by the proposed changes, as the DGs are not assumed to be available during the coping period.

Appropriate restrictions and compensatory measures will be established during the extended DG AOT to mitigate any increase in risk. These include current TS requirements as well as additional administrative controls.

The ACTIONS of TS 3.8.1 for an inoperable DG provide assurance that sufficient power sources remain and that a LOOP would not result in a complete loss of safety function by:

"* verifying offsite power availability within one hour and once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter (ACTION B.1),

"* ensuring that redundant required features that are associated with a division redundant to the inoperable DG are not concurrently inoperable (ACTION B.2), and

"* verifying the operability of the remaining DG by ensuring that a common cause failure does not exist or by increased testing (ACTIONS B.3.1 or B.3.2).

to Letter GN RO-2002/00007 Page 5 of 18 In addition to the above TS conditions, Entergy will implement other restrictions and compensatory measures through administrative procedures to limit the potential risk associated with the extended AOT. These include:

1. Weather conditions will be evaluated prior to entering an extended DG AOT for voluntary planned maintenance. An extended DG AOT will not be entered for voluntary planned maintenance purposes if official weather forecasts are predicting severe conditions (hurricane, tropical storm, tornado, or snow/ice storm) that could significantly threaten grid stability during the planned outage time.

2. The condition of the offsite power supply and switchyard will be evaluated prior to entering the extended maintenance period.

3. No elective maintenance will be scheduled within the switchyard that would challenge offsite power availability during the proposed extended DG AOT.

4. Operating crews will be briefed on the DG work plan whenever the extended AOT period is used, with consideration given to key procedural actions that would be required in the event of a LOOP or SBO.

5. High pressure injection systems (HPCS and RCIC) will not be taken out of service for planned maintenance while DG A (Division 1) or DG B (Division 2) is out of service for extended maintenance.

In addition, GGNS has a Configuration Risk Management Program (CRMP) in place in accordance with GGNS commitments for compliance with 10 CFR 50.65 (monitoring the effectiveness of maintenance). The program provides assurance that risk-significant plant equipment configurations are precluded or minimized when plant equipment is removed from service. It should be noted that DG reliability and availability are monitored and evaluated in relationship to Maintenance Rule goals to ensure that DG outage times do not degrade operational safety over time. Additionally, unavailability is monitored through the performance indicators of the Regulatory Oversight Process.

4.2 EVALUATION OF RISK IMPACT To assess the overall impact on plant safety, a probabilistic safety analysis (PSA) was performed consistent with the guidance pertaining to risk-informed criteria specified in Regulatory Guide 1.177, "An Approach for Plant-Specific Risk-Informed Decisionmaking:

Technical Specifications." The change in average Core Damage Frequency (CDF) and average Large Early Release Frequency (LERF) resulting from the increased Allowed Outage Time (AOT) for the Division 1 and Division 2 emergency diesel generators (DGs) was evaluated. This evaluation included consideration of the Maintenance Rule (a)(4) Program established pursuant to 10 CFR 50.65 to control performance of other potentially high-risk tasks during a DG outage and consideration of specific compensatory measures to minimize risk. All of these elements were included in a risk evaluation performed using the three-tiered approach suggested in RG 1.177, as follows:

Tier 1 - PSA Capability and Insights, Tier 2 - Avoidance of Risk-Significant Plant Configurations, and Tier 3 - Risk-Informed Configuration Risk Management.

Attachment I to Letter GN RO-2002/00007 Page 6 of 18 Evaluations per each of these tiers are provided in this section. Presented first, however, is background information related to the development, certification and application of the PSA model for GGNS.

4.2.1 GGNS PSA Model-Development The PSA model for GGNS was first developed for the Individual Plant Examination (IPE) that was submitted to the NRC by letter GNRO-92/00157 dated December 23, 1992, in response to Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities." The NRC staff issued its Safety Evaluation Report (SER) for the GGNS IPE by letter GNRI-96/00067 dated March 7, 1996, wherein the NRC staff concluded that the GGNS IPE submittal met the intent of Generic Letter 88-20. No major weaknesses were identified.

An independent assessment of the GGNS PSA has been completed to ensure that the GGNS PSA was comparable to other PSA programs in use throughout the industry. This assessment applied the Self-Assessment Process developed as part of the Boiling Water Reactor Owners' Group (BWROG) PSA Peer Review Certification Program. The PSA Certification Team completed an inspection and review of the GGNS PSA in August 1997 and completed a PSA Certification Report in November 1997. The models and methodology used in Revision 1 of the GGNS PSA were included in the PSA Certification review. The quality of the PSA and completeness of the PSA documentation were also assessed. The certification team found that the GGNS PSA is fully capable of addressing issues such as those associated with extending2 the Division 1 and Division 2 DG AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days with a few enhancements.

Attachment 5 provides more details of this assessment, including a summary of the PSA Certification Team members' qualifications and key findings.

At the time of the DG AOT extension evaluation, the GGNS At-Power PSA was undergoing its second major revision. Changes being made include operational and hardware changes as well as some methodology changes that impact the evaluation of offsite AC power recovery. This revision (Revision 2) is still in progress. The DG AOT extension evaluation was performed using an interim model, which captures the important model changes developed through September 2001. A special effort was made to ensure that the aspects of the PSA that are potentially sensitive to the DG maintenance unavailability were adequate to evaluate risk impacts of the increased DG AOT. Attachment 6 provides additional information with regard to the changes incorporated into the PSA.

2 The BWROG PSA Peer Review Certification program does not specifically evaluate the PSA models for a particular application such as a DG AOT extension. However, the grading process for the Certification Program is intended to indicate the types of PSA applications for which the attributes of the PSA are suitable. Those certification elements receiving Grade 3 are deemed to be suitable for types of applications such as single TS actions if supported by deterministic evaluations. Not all areas of the PSA have to be assigned Grade 3 or greater to be suitable for TS changes. An important aspect of the certification process is the development of Facts & Observations (F&Os) that describe the issues relevant to particular sub-elements of the PSA. The impact of these issues on the particular PSA application being developed should be understood and addressed as appropriate.

to Letter GNRO-2002/00007 Page 7 of 18 The GGNS Level 2 model has not been revised since the original IPE submittal. An evaluation of the impact on LERF for the DG AOT extension was performed using the results of Sensitivity Case 1 from the GGNS IPE. This sensitivity more closely represents the current revision of the GGNS Emergency Procedures/Severe Accident Procedures with regard to the venting of the vessel through the MSIVs. Since the prmary impact of the proposed AOT is on the core damage frequency associated with LOSP and SBO, LERF can be estimated based on the fraction of large early releases associated with sequences initiated by a LOSP event. Results are presented in .

GGNS PSA Model Maintenance Updating and maintenance of the PSA is controlled under the following documents:

"* Central Design Engineering Manual procedure CDE-P-05.01-00, "Probabilistic Safety Assessment (PSA) Model Maintenance"

"* Design Engineering Desktop Procedure, EDP-046, "Control and Use of GGNS Probabilistic Safety Assessment" CDE-P-05.01-00 requires a monthly review by the PSA Engineer of procedure changes and calculations revised in the preceding month that could impact the PSA model. As part of the current engineering request process there are review checklists used to identify the need to have particular engineering group's review the design change being developed. Review by the PSA group is required if the change impacts modeled systems in the PSA.

As part of the monthly review required by CDE-P-05.01-00, each change determined to impact the PSA model is graded to determine the appropriate schedule for implementation. If possible, the change is reviewed in a risk analysis that evaluates the risk implications of the change before implementation. If that is not possible, engineering judgement is used.

The PSA model change grading is A, B, C, or D based on the following plant certification comment grades. The scale below summarizes these grades.

GRADE DEFINITION A Extremely important and necessary to address to assure the technical adequacy of the PSA, the quality of the PSA, or the quality of the PSA update process.

B Important and necessary to address but may be deferred until the next PSA update.

C Considered desirable to maintain maximum flexibility in PSA applications and consistency in the industry, but not likely to significantly affect results or conclusions.

D Editorial or minor technical item left to the discretion of the PSA Site Lead, PSA Supervisor, or Site Safety Analysis Manager.

to Letter G NRO-2002/00007 Page 8 of 18 Once per month, the site PSA Engineer provides the PSA Supervisor a report on the status of the PSA model, primarily containing an assessment of the A and B grade model change requests (MCRs) on the PSA model. An interim PSA model update is scheduled as soon as possible after a MCR is graded A. The PSA Supervisor reviews the monthly PSA status report and initiates discussions with the site PSA Engineer and site Safety Analysis Manager to determine the need for an interim update for reasons other than a grade A MCR. An interim PSA model update is scheduled as soon as possible after the decision is made that a model revision is necessary.

Once the determination for a PSA update is made, the appropriate element of the model is modified and its related documentation updated. For example, PSA system notebooks have been developed which contain key model assumptions used in the development of the fault tree models. During a model update these notebooks are reviewed to determine whether the system has changed in a way that requires a system model change. This serves as a second check that relevant design changes are incorporated in the model.

Application of the GGNS PSA A single top model based on Revision I of the GGNS PSA model is used to determine changes in risk from removing equipment from service for maintenance. The risk measure used is Core Damage Frequency. Containment performance is evaluated on a qualitative basis. A description of the risk management control program is included in the Tier 3 section (section 4.2.4).

The PSA model is used by Scheduling and Operations personnel throughout the process of planning and implementing work. This is implemented through the use of a "Plant Safety Index" and color codes described in GGNS administrative procedure 01-S-18-6, "Risk Assessment of Maintenance Activities," and the "GGNS Shutdown Operations Protection Plan." The results obtained from the PSA model are used as part of a blended approach along with other inputs such as TS requirements and operator system knowledge to determine the final work schedule.

The PSA addresses internal events at full power. Other risk sources (external initiating events) are discussed in Attachment 7. A special effort was made to ensure that those aspects of the PSA that are potentially sensitive to changes in DG maintenance unavailability are adequate to evaluate the risk impacts of the increased allowed outage times for the DGs.

For use of the PSA to support changes to the Technical Specifications, the guidance of RG 1.177, "An Approach for Plant -Specific, Risk Informed Decisionmaking: Technical Specifications," is utilized. With regard to the evaluation performed to support the extension of the DG AOT, GGNS is confident that the results of the risk evaluation (described more fully in Attachment 3) are technically sound and consistent with the expectations for PSA quality set forth in RG 1.177. The scope, level of detail, and quality of the PSA is sufficient to support a technically defensible and realistic evaluation of the risk change from this proposed AOT extension.

4.2.2 Tier 1: PSA Capability and Insigqhts As noted previously, risk-informed support for the proposed changes to the DG AOT (for either Division 1 or Division 2) is based on PSA calculations performed to quantify the change in average CDF and average LERF resulting from the increased AOT. To determine the effect of the proposed changes with respect to plant risk, the guidance provided in RG 1.177 was used.

to Letter GN RO-2002/00007 Page 9 of 18 An evaluation was performed based on the assumption that the full, extended AOT (i.e., 14 days) would be applied once per DG per refueling cycle. The cycle time is based on the current 18-month fuel cycle (allowing for planned and unplanned plant outage time) for a net assumed cycle length of 475 operating days. (The next GGNS fuel cycle is planned to be slightly longer.

The shorter time frame used in this analysis is conservative.) It should be noted that DG reliability and availability are monitored and evaluated in relationship to Maintenance Rule goals to ensure that DG outage times do not degrade operational safety over time.

The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) were computed per their definitions in RG 1.177. The results of the risk evaluation, including the computed ICCDP and ICLERP, are presented in Attachment

6. The results of the risk evaluation were compared with risk significance criteria from RG 1.174 for changes in the annual average CDF and LERF and from RG 1.177 for ICCDP and ICLERP.

The ICCDP and ICLERP evaluation was based on the Division I emergency diesel generator (DG A), which provides the limiting values for this risk metric. The values for the ICCDP and the ICLERP demonstrate that the proposed DG AOT change has only a small quantitative impact on plant risk.

The results of the risk evaluation are presented in the table below.

Risk Metric Significance Criterion GGNS Results ACDFAVG <1.OE-06/yr 2.73E-7/yr ICCDP <5.OE-07 2.15E-7 ALERFAvG <1.OE-07/yr 1.04E-08/yr ICLERP <5.OE-08 8.32E-09 4.2.3 Tier 2: Avoidance of Risk-Significant Plant Configurations A Configuration Risk Management Program (CRMP) is in place at GGNS in accordance with GGNS commitments for compliance with 10 CFR 50.65, particularly with respect to paragraph (a)(4). The program provides assurance that risk-significant plant equipment configurations are precluded or minimized when plant equipment is removed from service. For a plant DG removed from service, increases in risk posed by potential combinations of equipment out of service will be managed in accordance with the CRMP program. Additional contingencies, which will be administratively controlled, include:

1. Weather conditions will be evaluated prior to entering an extended DG AOT for voluntary planned maintenance. An extended DG AOT will not be entered for voluntary planned maintenance purposes if official weather forecasts are predicting severe conditions (hurricane, tropical storm, tomado, or snow/ice storm) that could significantly threaten grid stability during the planned outage time.

2. The condition of the offsite power supply and switchyard will be evaluated prior to entering the extended AOT for planned maintenance.

3. No elective maintenance will be scheduled within the switchyard that would challenge offsite power availability during the proposed extended DG AOT.

to Letter GN RO-2002/00007 Page 10 of 18

4. Operating crews will be briefed on the DG work plan, with consideration given to key procedural actions that would be required in the event of a LOOP or SBO.

5. High pressure injection systems (HPCS and RCIC) will not be taken out of service for planned maintenance while DG A (Division 1) or DG B (Division 2) is out of service for extended maintenance.

Note that GGNS already has the capability and procedures for cross-connecting the HPCS DG to either the Division 1 or 2 ESF bus. This capability is included in the PSA models used for the risk assessment.

While in the proposed extended DG AOT, additional elective equipment maintenance or testing that requires the equipment to be removed from service will be evaluated and activities that yield unacceptable results will be avoided. Cutsets were generated for DG A and B out of service individually. These cutsets were reviewed for insights as to which systems or actions are most critical to reducing plant risk while a DG is out of service for extended maintenance. provides the initiating event frequency distribution and top eight cutsets with DG A or DG B out of service. The cutsets were also reviewed to identify a list of in-service equipment that would be more important as a result of DG A or B being out of service.

For DG A, the primary systems included:

Offsite Power Supply Division 1 DC power supply Division 2 DC power supply Reactor Core Isolation Cooling (RCIC)

DG B (Division 2)

DG C (Division 3)

High Pressure Core Spray (HPCS)

Division 3 SSW Division 2 SSW For DG B, the primary systems included:

Offsite Power Supply Division 1 DC power supply Division 2 DC power supply Reactor Core Isolation Cooling (RCIC)

DG A (Division 1)

DG C (Division 3)

High Pressure Core Spray HPCS Division 3 SSW Division 1 SSW Procedural and Technical Specification controls are already in place which will ensure that these systems are not removed from service while an DG is out of service for extended maintenance. Most of these systems would result in an EOOS color code of "Red." This level of risk would not be entered voluntarily. Note that a "Red" risk condition typically overlaps conditions prohibited by Technical Specifications or conditions requiring entry into a Technical Specification Action. General Manager / Designee notification is required upon entering a "Red" to Letter GNRO-2002/00007 Page 11 of 18 condition from emergent activities. If an entry into a "Red" condition occurs (e.g., due to equipment failures), then steps would be taken to restore any equipment out for testing or maintenance that could improve the plant safety index (PSI). Timely actions would be taken to reduce plant risk by either restoring inoperable or unavailable equipment or to put the plant in a safer condition (e.g., reduce power or shutdown), taking into account any risk associated with the transient required to achieve the safer state.

4.2.4 Tier 3: Risk-Informed Configuration Risk Management Program Consistent with 10 CFR 50.65(a)(4), and as indicated above, GGNS has developed a program that ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing a maintenance activity. The procedures that govern this process are GGNS administrative procedure 01-S-18-6, "Risk Assessment of Maintenance Activities," and the "GGNS Shutdown Operations Protection Plan." Procedure 01-S-18-6 ensures that risk from planned maintenance is evaluated and that maintenance activities are scheduled appropriately.

This program requires an integrated review (i.e., both probabilistic and deterministic) to identify risk-significant plant equipment outage configurations. This review is required both during the work management process and for emergent conditions during normal plant operation.

Appropriate consideration is given to equipment unavailability, operational activities like testing or load dispatching, and weather conditions. This program includes provisions for performing a configuration-dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. Risk is re-assessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed.

For planned maintenance activities, an assessment of the risk of the activities on plant safety is performed prior to the scheduled work. The assessment includes the following considerations:

"* Maintenance activities that affect redundant and diverse structures, systems, and components (SSCs) that provide backup for the same function are minimized.

"* The potential for planned activities to cause a plant transient are reviewed and work on SSCs that would be required to mitigate the transient are avoided.

" Work is not scheduled that is likely to exceed a TS or Technical Requirements Manual (i.e., a licensee controlled document containing requirements removed from the TS as part of conversion to the Improved Standard TS) completion time requiring a plant shutdown.

"* For Maintenance Rule Program High Risk Significant SSCs, the impact of the planned activity on the unavailability performance criteria is evaluated.

" As a final check, a quantitative risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the Level 1 PSA model. The results of the risk assessment are classified by a color code based on the increased risk of the activity. These color code classifications are described in the following table.

to Letter GN RO-2002/00007 Page 12 of 18 Risk Color Code Classification Color Level of Break Points Plant Impact and Required Action Risk Green Minimal Lower limit Normal work controls are sufficient.

Risk corresponds to two times zero maintenance CDF.

Yellow Acceptable Lower limit Measures should be taken to ensure that Risk corresponds to one subsequent maintenance activities do not train of standby increase risk to a higher risk level color service water out of (orange or red condition).

service (Train C).

Orange Higher Risk Lower limit Duty Plant Manager approval for voluntary corresponds to NEI entry, or notification upon emergent entry is 93-01 limit 3 . required. It is anticipated that entry into an "Orange" region will be relatively infrequent.

While infrequent entry into an "Orange" condition is acceptable, the following actions should be considered:

"* Written guidance/contingency plans should be developed if this condition will be entered voluntarily.

" Maintenance causing an "Orange" condition should be considered for continuous coverage.

" If this condition is a result of emergent work, steps should be taken to restore any equipment out for testing that could improve the plant risk index.

(Continued on next page) 3 NEI 93-01 Section 11.3.7.2 explains that the EPRI PSA Applications Guide (EPRI TR-105396), section 4.2.3, includes guidance for evaluation of temporary risk increases. The guidance is as follows: the configuration-specific CDF should be considered in evaluating the risk impact of the planned 3maintenance configuration. Maintenance configurations with a configuration-specific CDF in excess of 1-0 /year should be carefully considered before voluntarily entering such conditions. If such conditions are entered, it should be for very short periods of time and only with a clear detailed understanding of which events cause the risk level.

to Letter G NRO-2002/00007 Page 13 of 18 Continued- Risk Color Code Classification Color Level of Risk Break Points Plant Impact and Required Action Red Unacceptable Risk greater than This level of risk should not be entered Risk NEI 93-01 limit, voluntarily. Duty Plant Manager Designee notification is required upon entering a "Red" condition from emergent activities. Note that a "Red" risk condition typically overlaps conditions prohibited by Technical Specifications or conditions requiring entry into a Technical Specification Action. The following actions should be considered:

"* Steps should be taken to restore any equipment out for testing that could improve the plant risk impact.

"* Timely actions should be taken to reduce plant risk by either restoring inoperable or unavailable equipment or to put the plant in a safer condition (e.g., reduce power or shutdown), taking into account any risk associated with the transient required to achieve the safer state.

Emergent work is reviewed by Planning and Scheduling and Operations to ensure that it does not invalidate the assumptions made during the schedule development process. Prior to starting any work, the work scope and schedule are critically reviewed to assure that nuclear safety and plant operations are consistent with the expectations of management.

The probability of plant fire events is not assessed for distinct plant activities such as DG maintenance. However, the GGNS Fire Protection Program significantly minimizes fire risk through various design features and administrative controls that address fire prevention as well as mitigation. A description of the GGNS Fire Protection Program is provided in Appendix 9B of the GGNS USFAR. GGNS Administrative Procedure 01-S-10-1, "Fire Protection Plan,"

prescribes the fire prevention and fire protection policies necessary to implement the approved Fire Protection Program. The program assures that an adequate balance in the defense-in depth concept is maintained to minimize both the probability and consequences of damage due to fire throughout the GGNS site.

The Fire Protection Program uses a three tiered approach:

1. The application of administrative controls to prevent fires from starting.

2. The use of active engineered design features to detect and suppress fires, limiting damage consequences of fires that do start.

3. The use of passive barriers in combination with the design of plant safety systems such that fires will not prevent essential plant safety functions from achieving and maintaining safe shutdown.

to Letter GN RO-2002/00007 Page 14 of 18 Fire prevention is primarily accomplished through the following procedures:

10-S-03-4, Fire Protection: Control of Combustible Material, establishes requirements for the safe storage, transport and use of combustibles in safety related areas and non safety related areas of the plant.

10-S-03-3, Fire Prevention: Control of Ignition Sources, establishes controls for hot work and any other potential ignition sources within the plant.

10-S-03-8, Fire Watch Program, describes the responsibilities and duties of persons associated with assigning, documenting, and performing fire watch duties.

There are additional procedures that address other aspects of the program, which are not listed here. As with current maintenance practices, these fire protection procedures would be used, as applicable, during the extended DG maintenance to minimize the risk from fire.

4.2.5 Implementation and Monitoring Program To ensure the proposed extension of the DG AOT does not degrade operational safety over time, should equipment not meet its performance criteria, an evaluation is required as part of the Maintenance Rule (MR) (i.e., 10 CFR 50.65).

The reliability and availability of the affected DGs at GGNS are monitored under the Maintenance Rule Program as implemented by Administrative Procedure 01-S-17-22, "Maintenance Rule Program." If the pre-established reliability or availability performance criteria are exceeded for the DGs, consideration must be given to 10 CFR 50.65 (a)(1) actions, including increased management attention and goal setting in order to restore DG performance (i.e., reliability and availability) to an acceptable level. The performance criteria are risk informed and, therefore, are a means to manage the overall risk profile of the plant. An accumulation of large core damage probabilities over time is precluded by the performance criteria.

In practice, the actual out-of-service time for the DGs is minimized to ensure that MR reliability and availability performance criteria for these components are not exceeded. It should be noted that the DG availability used in the PSA analysis to calculate the ECDFavg value for a 14-day AOT is conservative compared to the DG system MR goals, actual past performance of the DGs at the plant, and expected availability following implementation of the proposed increased DG AOT. The latter is true because a full 14 days of unavailability per cycle is not anticipated.

The DGs are all currently in the 10 CFR 50.65 (a)(2) MR category (i.e., the DGs are meeting established performance goals). Performance of the DG on-line maintenance is not anticipated to result in exceeding the current established MR criteria for DGs.

Pursuant to 10 CFR 50.65 (a)(3), DG reliability and availability is monitored and periodically evaluated in relationship to the MR goals. The GGNS DG availability goal is 97.5% (no more than 2.5% unavailability). The unavailability for the Division 1 DG was 0.89% for the year 2000 and 1.37% for 2001. The unavailability for the Division 2 DG was 0.66% for the year 2000 and 0.67% for 2001. The MR performance goal for reliability is no more than one maintenance preventable functional failure (MPFF) per division in an 18-month period. There were no MPFF for either division in 2000 but there have been two MPFFs for the Division I DG and one MPFF to Letter GNRO-2002/00007 Page 15 of 18 for the Division 2 DG in 2001. The Division 1 DG was in the (a)(1) MR category from March 19, 2001 to September 12, 2001 because of the two MPFFs that occurred in 2001.

The MR Program provides a process to identify and correct adverse trends to ensure the TS Allowed Outage Time does not degrade operational safety over time. Compliance with the MR not only optimizes reliability and availability of important equipment, it also results in management of the risk when equipment is taken out of service for testing or maintenance per 10 CFR 50.65 (a)(4).

4.2.6 Conclusion The proposed extension of the Division I and Division 2 DG AOT is acceptable based upon a risk-informed assessment. This risk-informed assessment concludes that the increase in plant risk is small and consistent with the USNRC "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement," Federal Register, Vol. 51, p. 30028 (51 FR 30028), August 4, 1986, as further described by NRC Regulatory Guide 1.177.

The proposed changes are consistent with NRC policy and will continue to provide adequate protection of public health. The changes advance the objectives of the NRC's Probabilistic Risk Assessment (PRA) Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p. 42622, August 16, 1995, for enhanced decision-making and results in a more efficient use of resources and reduction of unnecessary burden.

Maintenance during power operation can improve overall DG availability and should result in reducing shutdown risk by increasing the availability of emergency power during refueling outages.

5.0 REGULATORY ANALYSIS

5.1 Applicable Regulatory Requirements/Criteria The proposed changes have been evaluated to determine whether applicable regulations and requirements continue to be met. The conformance discussion for General Design Criteria (GDC) is provided in Chapter 8 as well as in Section 3.1 of the GGNS FSAR. The conformance discussion for the Branch Technical Positions (BTPs) applicable to electrical power systems is referenced in FSAR Table 8.1-1. Entergy has determined that the changes do not require any exemptions or relief from regulatory requirements, other than the TS, and do not affect conformance with any GDC differently than described in the FSAR.

10 CFR 50.36 requires a licensee's TS to establish limiting conditions for operations, which include allowed outage times for equipment required for safe operation of the facility.

Regulatory Guide (RG) 1.93, "Availability of Electric Power Sources" prescribes a maximum TS AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for an inoperable AC power source (consistent with the current TS). The RG also states that the time limits are explicitly for corrective maintenance activities and do not include preventive maintenance activities which require the incapacitation of any required electric power source. If the proposed changes are approved, GGNS will continue to conform to RG 1.93 with the exception that the TS AOT for an inoperable DG may be increased from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days and may be used for DG preventive maintenance activities rather than for to Letter GNRO-2002/00007 Page 16 of 18 corrective maintenance activities only. This deviation is justified based on the technical analysis provided in Section 3.2.

5.2 No Significant Hazards Consideration Entergy Operations, Inc. is proposing that the Grand Gulf Nuclear Station Operating License be amended to extend of the Technical Specification Completion Time for the Division 1 and Division 2 Emergency Diesel Generators (DGs) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days to allow on-line maintenance to be performed. Entergy Operations, Inc. has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed Technical Specification (TS) changes do not affect the design, operational characteristics, function, or reliability of the DGs. The DGs are not the initiators of previously evaluated accidents. The DGs are designed to mitigate the consequences of previously evaluated accidents including a loss of offsite power. Extending the allowed outage time (AOT) for a single DG would not significantly affect the previously evaluated accidents since the remaining DGs supporting the redundant ESF systems would continue to perform the accident mitigating functions as designed.

The duration of a TS AOT is determined considering that there is a minimal possibility that an accident will occur while a component is removed from service. A risk-informed assessment was performed which concluded that the increase in plant risk is small and consistent with the USNRC "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement," Federal Register, Vol.5 1, p. 30028 (51 FR 30028), August 4, 1986, as further described by NRC Regulatory Guide 1.177.

The current TS requirements establish controls to ensure that redundant systems relying on the remaining DGs are Operable. In addition to these requirements, administrative controls will be established to provide assurance that the AOT extension is not applied during adverse weather conditions that could potentially affect offsite power availability.

Administrative controls are also implemented to avoid or minimize risk-significant plant configurations during the time when a DG is removed from service.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

to Letter GNRO-2002/00007 Page 17 of 18

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed TS changes do not involve a change in the design, configuration, or method of operation of the plant that could create the possibility of a new or different kind of accident. The proposed change extends the AOT currently allowed by the TS.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The Engineered Safety Feature (ESF) systems required to mitigate the consequences of postulated accidents consist of three independent divisions. The ESF systems of any two of the three divisions provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition. Each of the three independent ESF divisions can be powered from one of the offsite power sources or its associated on-site DG. This design provides adequate defense-in-depth to ensure that the ESF equipment needed to mitigate the consequences of an accident will have diverse power sources available to accomplish the required safety functions. Thus, with one DG out of service, there are sufficient means to accomplish the safety functions and prevent the release of radioactive material in the event of an accident.

The proposed AOT change does not affect any of the assumptions or inputs to the safety analyses of the FSAR and does not erode the decrease in severe accident risk achieved with the issuance of the Station Blackout (SBO) Rule, 10 CFR 50.63 "Loss of All Alternating Current Power".

The proposed extended AOT deviates from the recommended 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT of Regulatory Guide (RG) 1.93. However, an extension of the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT to 14 days has been demonstrated to be acceptable based on deterministic and risk-informed analyses.

The proposed changes are not in conflict with any other approved codes or standards applicable to the onsite AC power sources.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Entergy concludes that the proposed amendment(s) present no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

5.3 Environmental Considerations The proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation to Letter G NRO-2002/00007 Page 18 of 18 exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 PRECEDENCE The NRC has approved similar requests for several other plants. The GGNS requested TS changes are identical to the changes approved for the Perry Nuclear Power Plant (Amendment No. 99 to NPF-58 dated February 24, 1999 TAC NO. MA3537) and the Clinton Power Station (Amendment No. 141 to NPF-62 dated November 8, 2001, TAC NO. MB0861). Entergy's River Bend Station (RBS) also has a similar application pending (TAC NO. MB3041). Each of these facilities is a BWR6 plant. The Perry, River Bend, and Grand Gulf facilities have the capability of using the Division 3 HPCS DG as an alternate AC power source through a cross-tie to the Division 1 or Division 2 ESF buses.

Attachment 2 GNRO-2002/00007 Proposed Technical Specification Changes (mark-up) to GNRO-2002/00007 Page 1 of 4 AC Sourcos-Operating 3,6,1 3.8 ELECTRICAL POWER SYSTEMS 3,8.1 AC Sources-OpeWatiflg LCO 3.8.1 The following AC electrical power sturces shall be OPERABLE:

a, Two qualified circuits between the offsite transmlssion network and the onsite Class IE AC Electric Power Dlstribution System;

b. Three diesel generators (DGs); and

c. ODivison t and Division 2 automatic load sequencers.

APPLICABILITY: MODES 1, 2, and 3.

Division 3 AC electrical power sources are not required to be OPERABLE when Hiih Pressure Core Spray System is iroperable.

ACT IONS _ ..... .. .. __I__

CONDITION REQUIRED ACTION CONPIETION TIME A. One required offsite A.1 Perform SR 3.8.1.I 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months circuit Inoperable for for OPERABLE required reasons other than offslte circuit.

Condition F. Oce per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter (continued)

GRMO GULF 3.8,,1 Amendment No. 120 to GNRO-2002/00007 Page 2 of 4 At Sources -Operati ng 3.8.1 ACT IONS __ _ _ _.... .... ........... . ..

CONDITION REQtUIRED ACTION COMPLETION [LtME A. (continued) A.2 Restore required 7Z hours offsite circuit to OPERASLE status. AW 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from discovery of two divi sions with no offsite power AND S¢-rdays from di scovery of failure to meet LCO B. One required OG 6.1 Perform SR 3.8,1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable for reasons for OPERABLE required other than offsite circuit(s). .

Condition F, Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND_

8.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s), supported discovery of by the inopera1le DG, Condition B inoperable when the concurrent with redundant required inoperability of feature(s) are redundant noperableS. required feature(s)

ANoi (continued)

GRAND GULF 3 .8-2 Amendment No. 120 to GNRO-2002/00007 Page 3 of 4 AC Souces -Operat3.8.1 i ng ft rfiiC A*ti Au", . .. .

CONDITION RiEQUIREO ACTION tOMPTLETIO*M limt

__________ ________________________________________ I B. (continued) Determite OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months D*(s) are riot inoperable due to common cause failure.

-OR 0.3.2 Perform SR 3.8.1.2 for OPERABLE DG(s).

AND Be4 Restore required DG to OPERABLE status-C.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from C. Two required offsite discovery of circuits inoperable. feature(s) inoperable when the redundant Condition C required feature(s) concurrent with are itnoperab!e. inoperability of redundant required feature(s)

Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months C.2 offsite circuit to OPERABLE status.

_________________________________________________ .1 (continued)

(continued)

GRANO GULF Amendment No. 120 to GNRO-2002/00007 Page 4 of 4 INSERT A 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months from discovery of an inoperable Division 3 DG AND 14 days AND 17 days from discovery of failure to meet LCO

Attachment 3 GNRO-2002/00007 Changes to Technical Specification Bases Pages FOR INFORMATION ONLY to GNRO-2002/00007 Page 1 of 5 AC Sources--Ope rat ing 8 3.8.1 BASES ACTIONS AZ (continued) the ECO. If Condition A is entered while, for instance, a DG is inoperable and that OS is subsequently returned P RABLE, the LCO may already have been not met for up to This situation could lead to a total of since initial failure to meet the LCO, to restore Sthe o site circuit. At this time, a 06 could again become the circuit lenoabje,

/9oet.(yti~for a total o ao to lete rer f fthe LMEOa ftlhTFT providesC~!

ohfmYTiT a limit on the time allowed aa specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B 4re enter concurrently. The "AND" connector between

>J:rt ay Completion 7fiour*1-iTle apply CYletion Times means that both simultaneously, and. the more restrictive most be met, The Completion Time allows for an exception to the normal "time zero" for beginning the allowed outage time "clock.'

This exception results in establishing the "time zero* at the time the LCO was initially not met, instead of at the time that Condition A was enterod.

To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offslte circuit on a more frequent basis. Since the Required Action only specifies "perform, ' a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being Pot met. However, if a circuit fails to pass SR 3.8.1-1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

Required Action 8.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single (conntinupdl GRAND GULF B 3,8-6 Revision ho. $

to GNRO-2002/00007 Page 2 of 5 AC Sources--Operat ng 8 3.8.1 BASES ACTIONS B.Z (continued) division systemps are not included, although, for this Required Action, Division 3 is considered redundant to Division I and 2 Emergency Core Cooling System (ECCS).

Redtmdant roquired features failures consist of inoperable features associated with a division redundant to the division that has an ivoperable OG.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "tine zero" for beginning the allowed outage time "clock."

In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DOexists; and

b. A required feature on another division is inoperable.

If, at any time during the existence of this Condition (ore DG inoperable), a required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one required DS inoperable coincident with one or, more required support or sopported features, or both, that are associated with the OPERASLE 0G(s), results in starting the Completion Time for the Required Action. Four hours from the discovery of these events existing concurrently is acceptable because it minimizes risk while allowing time for restoration before subjecting the unit to transients associated with shutdown.

The remaining OPERLE 06s and offslte circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost, however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the compontent, OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a DBA occurring during this period.

jcontinuedl GRA R GUL8 8 3.8-7 Revision No, 0 to GNRO-2002/00007 Page 3 of 5 AC Sources -Operating B 3.8.1 BASES ACTIONS i4 4 L B', 2 (continued)

Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DO does not exist on the OPERASLE DOG, SR 3,8.1.2 does not have to be performed. If the cause of inoperability exists on other 00(s), the other DG(s) are declared Inoperable upon discovery, and Condition E and potentially Condition H of LCO 3.8.1 is entered. Once the failure is repaired, and the common cause failure no longer exists, Requir#d Action 8.3.1 Is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),

performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those Do(s).

In the event the inoperable DG is restored to OPERABLE status prior to completing either 8.3.1 or 8.3.2, the Corrective Action Program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable time to confirm that the OPERABLE 06(s) are not affected by the sam problem as the inoperable DG.

SAccording to Regulatory Guide 1.93 (Ref. 6), operation a

""capability o the remaining AC sources, reasonable time for repairs, anr$ low

__'4__

b ty of a OBA occurring Le4Ds durAng a this SThe *tlV~tion established a limit on Time for Required the maximum time Action allowe8.4 for any combination of required AC power sources to be i moperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an I. .ontinuedl.

GRAIIND GULF B 3.9-8 Revision No. 0 to GNRO-2002/00007 Page 4 of 5 AC Sources--Operatlng B 3.8.1 BASES ACTIONS 8.4 (continued) offsite circuit is inoperable and that circuit is subsequently restored OPERABLE, the LCO may already have c_ - been not met fr up oj2 hours. This situation could lead YVA ... to ai totaol( 0 since initial failure to meet the LCO, to restore *tk- At this time, an offsite circuit could again become inoperable, the D reGtoed OP" an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total o a s allo2weld_,

to complete restoration of the LCO. The34 y&C0let1on Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which

* ... Conditions Atw~

~~conn~torb

ar and Bth__.1V. oted

ýe comlep The n "AND' ncurrtly. ie means Thaoplet~ eioiles apply simultaneously, and thet ct*nctlve Completion Time must be met.

As in Re64i Action 8.2, the Completion Time allows for an exception to the normal *time zeros for beginning the allowed outage time *clock." This exception results in establishing the "time zero" at the time the LCO was initially no-t mt, instead of the time Condition B was entered.

C_ and C,2 Required Act-ion C.1 addresses actions to be taken in the event of concurrent failure of redundant required features.

Required Action C.1 reduces the vulnerability to a loss of function. The rationale for the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption Is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related divisions (i.e.,

single division systems are not included in the list, although, for this Required Action, Division 3 is considered redundant to Division I and 2 EUCS). Redundant required features failures consist of any of these features that are inoperable, because any inoperability is on a division redundant to a division with inoperable offsite circuits.

S.J.ontied GRAND GULF 8 3.8-4 Revision No. 0 to GNRO-2002/00007 Page 5 of 5 INSERT B Although Condition B applies to a single inoperable DG, several Completion Times are specified for this Condition.

The first Completion Time applies to an inoperable Division 3 DG.

INSERT C This Completion Time begins only "upon discovery of an inoperable Division 3 DG" and, as such, provides an exception to the normal "time zero" for beginning the allowed outage time "clock" (i.e., for beginning the clock for an inoperable Division 3 DG when Condition B may have already been entered for another equipment inoperability and is still in effect).

The second Completion Time (14 days) applies to an inoperable Division 1 or Division 2 DG and is a risk-informed allowed out-of-service time (AOT) based on a plant specific risk analysis. The extended AOT would typically be used for voluntary planned maintenance or inspections but can also be used for corrective maintenance. However, use of the extended AOT for voluntary planned maintenance should be limited to once within an operating cycle (18 months) for each DG (Division I and Division 2). Additional contingencies are to be in place for any extended AOT duration (greater than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and up to 14 days) as follows:

1. Weather conditions will be evaluated prior to entering an extended EDG AOT for voluntary planned maintenance. An extended DG AOT will not be entered for voluntary planned maintenance purposes if official weather forecasts are predicting severe conditions (hurricane, tropical storm, tornado, or snow/ice storm) that could significantly threaten grid stability during the planned outage time.

2. The condition of the offsite power supply and switchyard will be evaluated.

3. No elective maintenance will be scheduled within the switchyard that would challenge offsite power availability during the proposed extended DG AOT.

4. Operating crews will be briefed on the DG work plan whenever the extended AOT period is used, with consideration given to key procedural actions that would be required in the event of a LOOP or SBO.

5. High pressure injection systems (HPCS and RCIC) will not be taken OOS for planned maintenance while DG Division 1 or 2 is out of service for extended maintenance.

Attachment 4 GNRO-2002/00007 List of Regulatory Commitments to GNRO-2002/00007 Page 1 of I List of Regulatory Commitments The following table identifies those actions committed to by Entergy in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE (Check one) SCHEDULED ONE- CONTINUING COMPLETION COMMITMENT TIME COMPLIANCE DATE ACTION (If Required)

1. Weather conditions will be evaluated prior to X entering an extended DG AOT for voluntary planned maintenance. An extended DG AOT will not be entered for voluntary planned maintenance purposes if official weather forecasts are predicting severe conditions (hurricane, tropical storm, tornado, or snow/ice storm) that could significantly threaten grid stability during the planned outage time.

2. The condition of the offsite power supply and X switchyard will be evaluated prior to entering the extended maintenance period.

3. No elective maintenance will be scheduled X within the switchyard that would challenge offsite power availability during the proposed extended DG AOT.

4. High pressure injection systems (HPCS and X RCIC) will not be taken out of service for planned maintenance while DG A (Division 1) or DG B (Division 2) is out of service for extended maintenance.

5. Operating crews will be briefed on the DG X work plan whenever the extended AOT period is used, with consideration given to key procedural actions that would be required in the event of a LOOP or SBO.

6. Entergy intends to limit use of the extended X AOT for voluntary planned maintenance or inspections to once within an operating cycle for each DG (Division 1 and Division 2).

Attachment 5 GNRO-2002100007 GGNS PSA Peer Review Certification Information to GNRO-2002/00007 Page 1 of 13 ATTACHMENT 5 GGNS PSA Peer Review Certification Information An independent assessment of the GGNS Revision 1 PSA, using the Self-Assessment Process developed as part of the Boiling Water Reactor Owners' Group (BWROG) PSA Peer Review Certification Program, was completed to ensure that the GGNS PSA was comparable to other PSA programs in use throughout the industry. To this end, a PSA Certification Team completed an inspection and review of the GGNS PSA in August 1997 and issued a PSA Certification Report in November 1997. Table 5-1 provides a summary of the PSA Certification Team members' qualifications. Included in the PSA Certification review were the models and methodology used in the GGNS PSA. The quality of the PSA and completeness of the PSA documentation were also assessed. The certification team found that the GGNS PSA is fully capable of addressing issues such as those associated with extending the Division 1 and Division 2 DG AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days with a few enhancements.4 Issues that are pertinent to the risk study in support of the DG AOT extension are discussed below.

Overall, the peer review resulted in the conclusion that most of the elements of the GGNS PSA were Grade 3 or suitable for supporting risk-informed applications such as changes to the TS.

The review team identified 7 facts and observations (F&Os) with the significance level of "A" and 83 F&Os with the significance level of "B". The significance levels have the following definitions.

A - Extremely important and necessary to address for ensuring the technical adequacy of the PSA, the quality of the PSA, or the quality of the PSA update process.

B - Important and necessary to address, but may be deferred until the next PSA update.

The following discussion lists all the level "A" F&Os with resolutions. All level "B" F&Os that are related to a sub-element receiving a grade less than "3" are shown in Table 5-2 with a status. A discussion of impact on the DG AOT risk evaluation is also provided. The majority of the items identified in Table 5-2 would have minimal impact on the risk study because they do not impact Loss of Offsite Power (LOOP) events or systems used to mitigate LOOPs (i.e., a number deal with Anticipated Transient Without Scram (ATWS) or Interfacing System Loss of Coolant Accident (ISLOCA) events).

4 The BWROG PSA Peer Review Certification program does not specifically evaluate the PSA models for a particular application such as an EDG AOT extension. However, the grading process for the Certification Program is intended to indicate the types of PSA applications for which the attributes of the PSA are suitable. Those certification elements receiving Grade 3 are deemed to be suitable for types of applications such as single TS actions if supported by deterministic evaluations. Not all areas of the PSA have to be assigned Grade 3 or greater to be suitable for TS changes. An important aspect of the certification process is the development of Facts & Observations (F&Os) that describe the issues relevant to particular sub-elements of the PSA. The impact of these issues on the particular PSA application being developed should be understood and addressed as appropriate.

to G NRO-2002/00007 Page 2 of 13 Level A F&Os

1. Accident Sequence Evaluation: Safety Functions Critical safety functions such as "CM" and the decay heat removal function 'W/ are not explicitly considered in some of the event trees. The consideration of, for example, decay heat removal is needed to fully assess the system interactions and dependencies on the containment parameters during specific sequences. Failure to include would lead to incorrect importance rankings when performing applications.

GGNS Resolution:

The draft ASME PRA Standard, Rev. 12 does not require that each critical safety function be explicitly represented in the event tree headers. Rather, it only requires that each critical safety function be included in the quantitative model (AS-A8), which has been done in the current GGNS event trees. Explicit consideration of the critical safety functions in event tree headers is a matter of individual preference. The GGNS event trees were modified to ensure that the impact of containment failure on the continued operation of ECCS is properly incorporated. Previous revisions of the GGNS PRA assumed that the containment would fail high in the enclosure building and would not impact equipment in the auxiliary building. Review of that assumption and related reports and calculations has lead to the determination that there is a reasonable probability that containment could fail at lower elevations and that the subsequent steam flooding could impact the continued operation of ECCS equipment.

2. Accident Sequence Evaluation: Basis for Credit For Enhanced Control Rod Drive (CRD)

Table 6.3 of the initiating event notebook does not identify enhanced CRD as an effective means of providing makeup to the RPV for T3C events. However, cutsets in Sequence T 33 appear to credit enhanced CRD as a recovery for T3C events.

GGNS Resolution:

The success criteria for CRD was reviewed and subsequently revised so that it is not credited as a high pressure core cooling success path in the short term. CRD is credited for long-term core cooling except for those initiating events involving loss of reactor inventory (i.e., LOCAs and Stuck Open Relief Valves).

3. Data Analysis: RCIC Failure Rate Data Plant specific data was collected on the RCIC pump. One failure was observed on 72 demands and 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months of operation. In GGNS-91/0043, the failure was classified as a failure to run. This failure was used to develop a plant specific failure to run rate and generic data was used for the failure to start where no failures were observed. Based on a review of the source record (IR 90-1-12), it seems that this event could be classified as a failure to start due to the fact it appears to be due to a condition which was present during standby (steam leak causing water accumulation). If reclassified as a failure to start, generic data would likely be used for failure to run and a plant specific value would be used for failure to start. This could have a noticeable impact on RCIC unavailability and total CDF.

to GNRO-2002/00007 Page 3 of 13 GGNS Resolution:

Plant specific data is being updated as part of the current GGNS PSA (Revision 2) update.

The DG AOT risk analysis incorporated updated plant specific data for RCIC and other important components.

4. Credit for Enhanced CRD Flow The plant procedure for enhanced CRD flow to the reactor vessel may not provide the amount of flow credited. The procedure does not require placing redundant suction and drive filters in service nor does it require closing the pump minimum flow valve to the CST.

This is judged to have two effects. The first is that the increased flow will result in an increased pressure drop across the pump suction filters which may very likely result in a pump trip on low suction pressure. The second effect is that approximately 20 gpm per pump will be diverted to the CST and not flow to the reactor vessel. The CRD system configuration during the preoperational test of two pump enhanced flow to the vessel was considerably different than that currently used in procedure 04-1-01-Cl 1-1. The startup test procedure was performed with the minimum flow valves closed, recirculation pump seal purge at 20 gpm total, RPS scrammed, the standby suction filter in service, the filter bypass line open, the standby drive filter in service, pressure control valve F003 open, pressure control valve F004 open, flow controller in manual and demanding 100%, and the backup flow control valve in service and adjusted to full open. The summary of the Grand Gulf Enhanced CRD Injection Calculation in the Misc. PSA information notebook indicates that the CRD pumps will trip on loss of NPSH following emergency depressurization when being used to feed the reactor vessel in enhanced flow mode.

GGNS Resolution:

See response to number 2 above.

5. Dependency Analysis: Containment Isolation Causing Loss of PCS In reviewing small LOCA sequence (S2L-39) it was identified that the logic model failed to identify the dependency between the containment isolation signal and the PCS. It appears that in cutting circular logic ties in the model, the dependencies between instrument air and the BOP systems were not fully retained.

GGNS Resolution:

The statement is basically correct about the model. A containment isolation signal causes an isolation of Plant Service Water (PSW) to the Turbine Building, but this does not necessarily cause a loss of all of the Power Conversion Systems (PCS). There would be a potential loss of Turbine Building Cooling Water (TBCW) because of the loss of PSW and loss of Instrument Air (IA) due to the isolation. However, IA would not necessarily fail because Standby Service Water (SSW) B can provide an alternate source of cooling if there is no LOCA. Therefore, IA to the Turbine Building and other plant areas would still be available. It is also possible to bypass the IA and PSW isolation under most circumstances and there is a Human Failure Event in the model to address this action. The IA model has been revised for the Revision 2 update to ensure that it accurately reflects the availability of to GNRO-2002/00007 Page 4 of 13 IA to different buildings given containment isolation. The incorporation of this change in updated model also ensures that a containment isolation signal has the correct impact on the PCS. The DG AOT risk analysis utilized a model that incorporated these changes.

6. Quantification: Containment Isolation Causing Loss of PCS In reviewing small LOCA sequence (S2L-39) it was identified that the logic model failed to identify the dependency between the containment isolation signal and the PCS. It appears that in cutting circular logic ties in the model, the dependencies between instrument air and the BOP systems were not fully retained.

GGNS Resolution:

This item is identical to number 5 above.

7. Level 2: The Level 2 has not been updated to develop a LERF for the latest PSA update.

GGNS Resolution:

The development of a LERF model is planned as part of the current PSA update. However, it is not scheduled for completion until later this year. The results of the IPE Level 2 analyses were utilized to address LERF for the DG AOT extension risk analysis. See Attachment 8 for additional details.

These enhancements did not receive a formal industry peer review such as from the BWROG PSA Peer Review process. However, the resolutions were reviewed by GGNS and by other EOI PSA personnel.

to GNRO-2002/00007 Page 5 of 13 Table 5-1 PSA PEER REVIEW CERTIFICATION TEAM EXPERIENCE EXPERIENCE

SUMMARY

TEAM Years Years of PSA MEMBER Degree Experience Experience Selected PSA Projects E. T. Bums BS - Engineering 26 21

Technical reviewer of Level Science - RPI 1 IPEs for fifteen BWR MS - Nuclear plants Engineering - RPI 0 Manager, technical advisor, Ph.D., Nuclear or lead engineer on many Engineering, RPI IPEs/PRAs for BWR plants 0 Lead engineer on several containment safety studies K. Canavan B.S. Chemical 13 11 0 Oyster Creek PSA team, Engineer, BChE leader for Levels 1, 2, and Manhattan IPEEE College a Davis-Besse Nuclear Power Station PSA team

PSA Applications

BWROG IRBR Vice Chairman R.A. Hill MS Industrial 27 19

Reviewer of Reactor Safety Engineering Study BA Biochemistry 0 Developed human reliability simulator data collection program

Project Manager for BWROG projects relative to PRA.

to GNRO-2002/00007 Page 6 of 13 Table 5-1 PSA PEER REVIEW CERTIFICATION TEAM EXPERIENCE EXPERIENCE

SUMMARY

TEAM Years Years of PSA MEMBER Degree Experience Experience Selected PSA Projects M.A. Phillips BS Nuclear 17 4

Supervisor of PSA Group Engineering - RPI responsible for all PSA MS - Nuclear activities and applications Engineering - RPI at Hope Creek and Salem nuclear plants Operations review of Hope Creek IPE

Senior Reactor Operator license - Hope Creek

Millstone I ATWS response support

B&W 205 AFW system reliability analyses

Managed update of Salem 1 & 2 Level 1 and Level 2 PSA models D.E. True BS - Chemical 17 16 0 Chief PSA analyst for Engineering - Trojan University of 0 Co-author of the PSA Peer California at Review Certification Berkeley Guidelines 0 Developer of ORAM/

SENTINEL concept R.M. BS - Nuclear 11 11 0 Analyst for Palisades PSA Wachowiak Engineering - 0 Project Lead for Duane Purdue University Arnold IPE MS - Nuclear

Supervisor of PSA Group Engineering - at Cooper, GINNA and Purdue University Trillo Level 1/Level 2 Interfaces

DOE Technical Reviewer for Westinghouse AP600 PSA

CE System 80+ Cont.

GE ABWR and SBWR to GNRO-2002/00007 Page 7 of 13 Table 5-2 below provides all open level "B" F&Os that are related to a sub-element receiving a grade less than "3" and summarizes the impact the F&O would have on the DG AOT risk study.

Table 5-2 Significant PSA Certification Facts and Observations PSA Certification F&O Resolution or DG AOT Risk Impact Initiating Events (IE)

The GGNS PSA has developed a thorough list of initiating No impact. This is a documentation/enhancement issue. This item events. It is desirable to document the process used to should be reclassified as a Level C item.

develop this list and to ensure that support system initiators are adequately covered.

GGNS has done an excellent job of considering plant Two of the other issues are discussed below. The third and final issue specific features and plant specific data where available, is listed in the next item.

There are however a few selected issues that could benefit from additional investigation for possible influences. Loss of offsite power recovery data The loss of offsite power (LOOP) recovery data was based on NUREG/CR-4550 information while the LOOP frequency was developed from data in NSAC 194. The initiating event frequency and recovery should be consistent. Revision 2 of the GGNS model is incorporating the most recent LOOP data and is performing a plant specific LOOP recovery analysis. The model used for the DG AOT risk evaluation used this new information.

Interfacing System LOCA initiatingfrequency The issue concems the failure probability utilized for the ISLOCA events. The probability used (1E-3) is usually conservative but may be an oversimplification. There is no impact to DG AOT Risk evaluation since ISLOCA is a negligible contributor to the overall CDF and the onsite power systems (DGs) are not important in ISLOCA sequences.

to G NRO-2002/00007 Page 8 of 13 Table 5-2 Significant PSA Certification Facts and Observations PSA Certification F&O Resolution or DG AOT Risk Impact The calculation of plant specific special initiators has some No impact. While this issue is being addressed for the Revision 2 significant problems that may lead to a factor of up to 5 GGNS PSA update, it has not been incorporated into the model used increase in these event frequencies. Here are some for the DG AOT risk evaluation. This issue addresses the initiating examples from the CCW initiator, but the concepts are event frequency for special initiators, which are associated with the valid for the rest. loss of certain support systems. None of the support systems (e.g.,

a) Common cause failure of 3 of 3 pumps is not the only Turbine Building Cooling Water, Instrument Air or Plant Service dominant contributor. If one considers common cause Water) provide support to the DGs. Onsite power is also not failure of 2 of 3 pumps (-6E-6) along with the considered to be a major contributor for sequences initiated by special unavailability due to T&M for the third (-.06 = 2% per initiators.

pump), this leads to a term almost as large as the CCF term in the model: thus a factor of 2.

b) The unavailability of heat exchangers in combination with the failure of the others needs to consider all combinations that will occur over the target year. In other words, the HX gate needs to be multiplied by a factor of 3 to consider all of the exposure to this condition.

c) The unavailability factor for a heat exchanger seems way too low... < 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months per year. This needs to be verified and/or updated.

d) For initiators, failures of passive equipment for common suction/discharge headers need to be considered. This can be as high as 1 E-6 per hour, or a factor of 2 increase. When these estimates are considered in the P42-110 quantification, the initiator frequency goes up to -2E-2, depending on the common suction piping failure frequency.

to GN RO-2002/00007 Page 9 of 13 Table 5-2 Significant PSA Certification Facts and Observations PSA Certification F&O Resolution or DG AOT Risk Impact Accident Sequences (AS)

ATWS--It is not clear how the nodes W1, W3, and Y can No impact. ATWS is a negligible contributor to the overall CDF. The be deleted from the ATWS event tree. The containment containment heat removal function is being added to the Revision 2 heat removal function is one that is considered necessary GGNS PRA updated model to address this issue but these changes for reaching a safe stable state. In addition, external water are not included in the model utilized for the DG AOT analysis.

injection such as SSW cannot be successful in preventing However, the change is not expected to significantly impact the overall core damage if containment heat removal is unavailable, contribution of ATWS to CDF when combined with other changes Excluding this safety function (containment heat removal) (probability of failure of RPS) to the ATWS model.

from the ATWS evaluation seems not to be technically justified.

There are a large number of ATWS accident sequences No impact - ATWS is a negligible contributor to the overall CDF. This with and without PCS available that are assigned to "stable will be addressed in the Revision 2 GGNS PSA Update.

reactor' end states. It is assumed that they are not counted as core damage. The assignment of sequences to non-core damage when there is no reactivity control material inserted during the event and containment is pressurized beyond failure appears to be a non conservative assumption that differs from most BWR PSAs. Examples TC-48, TC-49, TC-51, TC-52.

ATWS followed by an SORV is not included. This has No impact - ATWS is a negligible contributor to the overall CDF. This been identified in a number of PSAs and simulator will be addressed in the Revision 2 GGNS PSA Update.

observations at other BWRs as a potential issue because of the possibility that inadvertent depressurization may occur resulting in a situation where condensate may inject and wash boron out of the core before actions can be taken by the operating crew to prevent causing recriticality due to loss of boron.

to GNRO-2002/00007 Page 10 of 13 Table 5-2 Significant PSA Certification Facts and Observations PSA Certification F&O Resolution or DG AOT Risk Impact System Analysis (SY)

Common mode failure of the SLC relief valves is not No impact. ATWS is a negligible contributor to the overall CDF. This modeled. Due to the nature of the operation of positive will be addressed in the Revision 2 GGNS PSA Update.

displacement pumps, relief valves used in this application often have higher failure rates and an increased potential for common mode failure.

Common Cause Failure of SSW Supply & Discharge No impact. These valves do not impact service water to the DGs and Valves To RHR HX The system notebook for Standby the inclusion of common cause events for them would not impact SBO Service Water indicates that the standby service water sequences and would only have minor impact on long term LOOP supply (FO14A-A, F014B-B) and discharge valves (F068A- events.

A, F068B-B) for the RHR heat exchanger are modeled as common cause events. A review of the system model and master logic model failed to identify these events.

DataAnalysis (DA)

Plant specific failure data was analyzed only for HPCS, The data analysis is being updated for the Revision 2 GGNS PSA RCIC, and DGs. All other systems used generic failure Update and is incorporating plant specific information for additional data. systems. The model utilized for the DG AOT risk evaluation has incorporated updated plant specific data for additional systems as well as updated maintenance unavailability data for risk significant maintenance rule systems.

Human Reliability Analysis (HR)

The probability value for the failure of the diagnosis of early Minimal impact. The HRA analysis (GGNS-91-0044, RO) notes that in injection is 2.66E-4. The probability of failure of early slower moving scenarios, the diagnosis failure probability is negligible.

injection with two sources available is 2.7E-5 (NRS-FO- Typically, the multiple failure to start events occur in the longer term INJ2SYST) and with three sources is 1 E-5 (NRS-FO- cutsets. The combined F-V value of the multiple start events is -4E-4.

INJ3SYST). It seems that these total failure probabilities should not be lower than the failure probability of the to GNRO-2002/00007 Page I Iof 13 Table 5-2 Significant PSA Certification Facts and Observations PSA Certification F&O Resolution or DG AOT Risk Impact diagnosis.

It is not clear if operations input is sought in the No impact - Administrative recommendation to have Operations development and quantification of the human error review HRA. One of the inputs to the HRA is operator interviews.

probabilities or their determining parameters (e.g., time required). This is an important facet of the development of the human reliability analysis and ensures that operations insights are reflected in the HRA values.

INHIBIT ADS: The assessment of the ADS inhibit under No impact - ATWS is a negligible contributor to the overall CDF.

failure to scram conditions is considered in the GGNS PSA Also, ADS is not credited for SBO sequences because the low to:

pressure ECCS pumps would not automatically start. The ADS logic

"* Be independent of the accident sequence requires a low pressure ECCS pump to start and run for initiation.

"* Be of very low failure probability (1E-5) Given the current operator training on the importance of inhibiting ADS for ATWS events and the fact that it is one of the first actions Each of these two characteristics is considered to be performed for ATWS events, it is doubtful that the failure to inhibit different than other BWR PSAs and may be deserving of ADS probability would increase significantly.

reconsideration. The HEP for ADS Inhibit is set at 1E-5.

This is substantial credit for an operator action that must occur within a short time period (-110 seconds) when there may be a large number of alarms and lack of clear indication regarding the course of events. It is judged that most HRA methods would classify ADS inhibit as requiring the event to be diagnosed and the procedure be entered that specifies ADS. The diagnosis and entering the procedure is considered a strong function of time.

Therefore, the entry conditions can influence this time. For example, a loss of feedwater or MSIV closure event should result in ADS challenge very quickly whereas turbine trip events or PCS available events may not challenge the ADS inhibit until after a successful entry into the procedure to GNRO-2002/00007 Page 12 of 13 Table 5-2 Significant PSA Certification Facts and Observations PSA Certification F&O Resolution or DG AOT Risk Impact to terminate feedwater (i.e., one successful action occurs).

The alignment of fire water for RPV injection uses a failure Minimal impact. The HRA analysis is being updated for the Revision probability of 0.013 for all accident sequences. It is judged 2 GGNS PRA Update. In the interim, it is judged that the HEP for that there may be a spectrum of values for fire protection firewater addition is acceptable for this application. Firewater is not water injection success depending upon the type of credited unless RCIC or some other system has operated for accident sequence. The types of variations may include:- approximately six hours or more. The situations proposed would add

"* SBO where the LPCI injection valve to the RPV needs refinement to the PSA but would not significantly alter the results.

to be opened manually by local action within a short time when RCIC is unavailable.

"* SBO with an SORV

"* TQUV.

"* ATWS where stress is high

"* Level 2 a

Quantification(QU)

ATWS: The evaluation of MSIV closure following a No impact. ATWS is a negligible contributor to the overall CDF. The Turbine Trip ATWS does not appear to be quantified revised EP/SAPs address this issue in that direction to open or recognizing the actions that the operator will be taking as maintain the MSIVs open is given earlier in the procedures than the directed by the EOPs. When evaluating the ability to previous EP's. This will be addressed in the Revision 2 GGNS PSA maintain the MSIVs open, the procedural direction and Update.

training guidance provided to the staff should be considered. Specifically, the operating staff is directed to lower RPV water level to reduce power given a failure to scram and in parallel attempt to bypass the low-level Level 1 interlock. The operating staff is not directed to stop and bypass the low level (Level 1 interlock on MSIV closure).

to GNRO-2002/00007 Page 13 of 13 Table 5-2 Significant PSA Certification Facts and Observations DCA C,4iFi-+unn FR.fl Resolution or UUi AU I K*ISK Impact

.Jnluo I or DU -A KIS Impact i

ATWS: For Accident Sequence TC-6, the feedwater No impact. ATWS is a negligible contributor to the overall CDF.

injection control system continues to try to seek normal water level. The timing of SLC initiation is considered to be adversely impacted iffeedwater flow is not terminated or reduced. This does not appear to be included in the quantification of the HRA for SLC initiation. It is noted that only a short time is allowed for SLC initiation in the HRA evaluation. The short time would be consistent with the high feedwater level; however, the HEP assessed is judged not consistent with the short time allowed. -4 I -- i,*l9( I 9)

+

I~ m Iz,=t ") 11 LERF-The definition of LERF has not been formalized but No impact. This is administrative observation with regard to the the release categories for Level 2 are capable of definition of LERF.

supporting the definition given the following: - Early is currently listed are within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of declaration of a General Emergency. (P. 18 GGNS 92-0048). It is judged prudent to ensure that protective actions can be taken in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and be effective. Other BWRs have used times of 4 to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for the definition of Early. It would be useful for future PSA applications to clearly describe potential radionuclide release scenarios in terms of release magnitude and timing consistent with the PSA Applications Guide.

Attachment 6 GNRO-2002/00007 Description of GGNS PSA Model Changes And Updated Risk Information to GNRO-2002/00007 Page 1 of 7 ATTACHMENT 6 Description of GGNS PSA Model Changes And Updated Risk Information PSA Model Revision 1 Major Model Changes The original GGNS IPE model was representative of the plant design through September 1989.

Revision 1 of the GGNS PSA model included plant changes and operating performance data through June 1995. Changes to the model and data inputs for Rev. 1 include the following:

"* Incorporation of updated plant specific data for system maintenance and testing unavailability.

"* Incorporation of updated plant specific data for initiating event frequencies.

"* Incorporation of updated plant specific data for certain important components (i.e., diesel generators, HPCS and RCIC pumps).

"* Various modeling changes to system models to correct minor modeling errors and incorporate plant modifications since the original IPE.

In addition, Emergency Operation Procedures and Off-Normal Event Procedures were reviewed to determine if any revisions had been made since the original IPE that would require changes to the IPE model or assumptions. No changes were required as a result of this procedure review.

DG AOT PSA Model Changes Revision 1 of the GGNS PSA Model is currently undergoing a major update and was therefore not available for this evaluation. An interim model that captures the important model changes developed through September 2001 was used for the DG AOT extension evaluation. Changes to the Revision 1 model and data inputs for the DG AOT Model include the following:

"* Plant changes through RFO1 1 (the most recent refueling outage) were reviewed and system models revised if required.

"* Incorporation of updated plant specific data for system maintenance and testing unavailability.

"* Incorporation of updated plant specific data for certain components. In addition to updated plant specific data for the diesel generators, HPCS pump and RCIC pump, plant specific data was incorporated for the low pressure ECCS pumps, air compressors, service water pumps and selected HVAC equipment.

"* Incorporation of updated plant specific data for initiating event frequencies.

"* Incorporation of updated loss of offsite power initiator frequency and a revised recovery model for loss of offsite power initiators utilizing convolution.

"* Incorporation of additional detail in the switchyard, plant service water, and standby service water models.

"= Incorporation of changes to the model to address various Facts and Observations from the PSA Certification review. This included such items as revised CRD success criteria, revised modeling to incorporate the impact of containment failure on continued ECCS operation, the addition of common cause failure event for all three DGs, and the correction of minor quantification flag settings.

A summary of the quantification results from this updated model is provided in the following pages of this attachment.

to GNRO-2002/00007 Page 2 of 7 Summary of Updated Risk Information Baseline DG AOT PSA Model

1. Summary of Risk Analyses CDF = 1.40E-5/year LERF= 1.17E-7/yr

2. Initiators - At Power Internal Events InitiatorID InitiatorDescription Percent of Internal Events CDF

%T1 5 Loss of Offsite Power 25.7%

%T3A Transient with PCS (normal service water) Available 19.0%

%T2 Transient with Loss of PCS 18.2%

%T3B Loss of Feedwater Transient 12.2%

%TAC1 Loss of Div 1 AC Bus 8.2%

%TDC1 Loss of Div 1 DC Bus 7.1%

%TDC2 Loss of Div 2 AC Bus 2.7%

%TAC2 Loss of Div 2 DC Bus 2.5%

Misc. Others 4.3%

5 The Loss of Offsite Power initiating event frequency is 0.035/year per NSAC-166.

to GNRO-2002/00007 Page 3 of 7

3. Dominant Sequences - At Power Internal Events Sequence Description CDF (/year)

Sequence T-36-This sequence involves a transient event followed by 3.478E-6 successful retention of offsite or onsite (Division 1 and 2) power. The PCS system fails as well as HPCS, RCIC and reactor vessel depressurization.

Sequence T1 B-35-A LOOP occurs and is followed by a loss of all 3 1.82E-6 divisions of on-site power. HPCS is not available because of the failure of the Division 3 DG. SRVs open and close to relieve pressure surge caused by the scram. RCIC is demanded but fails.

Sequence T-34-A transient event occurs and is followed by successful 1.74E-6 retention of offsite or onsite (Division 1 and 2) power. PCS, HPCS and RCIC fail but depressurization is successful. Low pressure injection systems successfully operate; however, containment heat removal and venting is unsuccessful which leads to containment failure in the long term and subsequent failure of the low pressure systems.

Sequence T-23-A transient event occurs and is followed by successful 1.65E-6 retention of offsite or onsite (Division 1 and 2) power. The PCS and HPCS fail but RCIC provides core cooling until containment cooling (by SPC and CS) and manual depressurization fail. CRD is initially successful but eventually fails when containment venting fails and leads to containment failure in the long term.

Sequence T-1 3-A transient event occurs and is followed by successful 1.38E-6 retention of offsite or onsite (Division 1 and 2) power. The PCS HPCS fail but RCIC provides core cooling until containment cooling (by SPC) fails. Manual depressurization succeeds but containment cooling by SDC and CS also fail. CRD is initially successful but eventually fails when containment venting fails and leads to containment failure in the long term.

to GNRO-2002/00007 Page 4 of 7 Summary of Updated Risk Information (continued)

DG A (Division I) Out of Service

1. Summary of Risk Analyses CDF = 1.96E-5/yr LERF = 3.34E-07/yr

2. Initiators - At Power Internal Events InitiatorID InitiatorDescription Percent of Internal Events CDF

%T1 Loss of Offsite Power 52.6%

%T3A Transient with PCS Available 13.1%

%T2 Transient with Loss of PCS 10.6%

%T3B Loss of Feedwater Transient 7.2%

%TAC1 Loss of Div 1 AC Bus 4.9%

%TDC1 Loss of Div 1 DC Bus 4.3%

%TDC2 Loss of Div 2 AC Bus 2.0%

%TAC2 Loss of Div 2 DC Bus 1.9%

Misc. Others 2.8%

to GNRO-2002/00007 Page 5 of 7

3. Dominant Sequences - At Power Internal Events Sequence Description CDF (/year)

Sequence T1B-35-A LOOP occurs and is followed by a loss of all 3 3.96E-6 divisions of on-site power. HPCS is not available because of the failure of the Division 3 DG. SRVs open and close to relieve pressure surge caused by the scram. RCIC is demanded but fails.

Sequence T1 B-32-A LOOP occurs and is followed by a loss of all 3 3.63E-6 divisions of on-site power. HPCS is not available because of the failure of the Division 3 DG. SRVs open and close to relieve pressure surge caused by the scram. RCIC is initially successful. With no containment heat removal, the reactor is depressurized because of the SP heat capacity temperature limit and RCIC eventually is lost due to high SP temperature or battery depletion. Firewater is successfully connected but batteries eventually deplete resulting in closure of the SRVs and the operators fail to open the RCIC steam line to maintain the vessel at low pressure. This results in loss of firewater injection.

Sequence T-36-This sequence involves a transient event followed by 2.85E-6 successful retention of offsite or onsite (Division 1 and 2) power. The PCS system fails as well as HPCS, RCIC and reactor vessel depressurization.

Sequence T-34-A transient event occurs and is followed by successful 1.74E-6 retention of offsite or onsite (Division 1 and 2) power. PCS, HPCS and RCIC fail but depressurization is successful. Low pressure injection systems successfully operate; however, containment heat removal and venting is unsuccessful which leads to containment failure in the long term and subsequent failure of the low pressure systems.

Sequence T-23-A transient event occurs and is followed by successful 1.23E-6 retention of offsite or onsite (Division 1 and 2) power. The PCS and HPCS fail but RCIC provides core cooling until containment cooling (by SPC and CS) and manual depressurization fail. CRD is initially successful but eventually fails when containment venting fails and leads to containment failure in the long term.

to GNRO-2002/00007 Page 6 of 7 Summary of Updated Risk Information (continued)

DG B (Division 2) Out of Service

1. Summary of Risk Analyses CDF = 1.68E-5/yr LERF = 2.56E-7/yr

2. Initiators - At Power Internal Events InitiatorID InitiatorDescription Percent of Internal Events CDF

%T1 Loss of Offsite Power 46.9%

%T3A Transient with PCS Available 14.2%

%T2 Transient with Loss of PCS 12.4%

%T3B Loss of Feedwater Transient 8.3%

%TAC1 Loss of Div I AC Bus 5.8%

%TDC1 Loss of Div 1 DC Bus 5.0%

%TDC2 Loss of Div 2 AC Bus 1.9%

%TAC2 Loss of Div 2 DC Bus 1.8%

Misc. Others 3.2%

to GNRO-2002/00007 Page 7 of 7

3. Dominant Sequences - At Power InternalEvents Sequence Description CDF (/year)

Sequence T1B-35-A LOOP occurs and is followed by a loss of all 3 3.59E-6 divisions of on-site power. HPCS is not available because of the failure of the Division 3 DG. SRVs open and close to relieve pressure surge caused by the scram. RCIC is demanded but fails.

Sequence T1B-32-A LOOP occurs and is followed by a loss of all 3 2.78E-6 divisions of on-site power. HPCS is not available because of the failure of the Division 3 DG. SRVs open and close to relieve pressure surge caused by the scram. RCIC is initially successful. With no containment heat removal, the reactor is depressurized because of the SP heat capacity temperature limit and RCIC eventually is lost due to high SP temperature or battery depletion. Firewater is successfully connected but batteries eventually deplete resulting in closure of the SRVs and the operators fail to open the RCIC steam line to maintain the vessel at low pressure. This results in loss of firewater injection.

Sequence T-36-This sequence involves a transient event followed by 2.79E-6 successful retention of offsite or onsite (Division 1 and 2) power. The PCS system fails as well as HPCS, RCIC and reactor vessel depressurization.

Sequence T-34-A transient event occurs and is followed by successful 1.82E-6 retention of offsite or onsite (Division 1 and 2) power. PCS, HPCS and RCIC fail but depressurization is successful. Low pressure injection systems successfully operate; however, containment heat removal and venting is unsuccessful which leads to containment failure in the long term and subsequent failure of the low pressure systems.

Sequence T-23-A transient event occurs and is followed by successful 1.34E-6 retention of offsite or onsite (Division 1 and 2) power. The PCS and HPCS fail but RCIC provides core cooling until containment cooling (by SPC and CS) and manual depressurization fail. CRD is initially successful but eventually fails when containment venting fails and leads to containment failure in the long term.

Attachment 7 GNRO-2002100007 Tier 1: Diesel Generator PSA Study Results to GNRO-2002/00007 Page 1 of 8 ATTACHMENT 7 Tier 1: Diesel Generator PSA Study Results INTERNAL EVENTS ANALYSIS Risk-informed support for the proposed TS changes to extend the allowed outage time (AOT) for either the Division 1 or Division 2 DG is based upon PSA calculations performed to quantify the change in average CDF and average LERF resulting from the increased AOT.

To determine the effect of the longer AOT for restoration of an inoperable Division 1 or Division 2 DG, the guidance suggested in RG 1.177 was used. Thus, the following risk metrics were used to evaluate the risk impacts of extending the DG AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days.

ACDFAvG is the change in the annual average CDF due to any increased on-line maintenance unavailability of DGs that could result from the increased AOT. This risk metric is used to determine whether a change in CDF is regarded as risk significant compared against the criteria of RG 1.174. These criteria are a function of the baseline annual average core damage frequency, CDFBASE. In this study, it is assumed that one extended diesel generator outage occurs per cycle per division.

ALERFAVG is the change in the annual average LERF due to any increased on-line maintenance unavailability of DGs that could result from the increased AOT. RG 1.174 criteria were also applied to judge the significance of changes in this risk metric.

ICCDPy is the incremental conditional core damage probability with DG Y (Div 1 or Div

2) out of service for the proposed AOT of 14 days. This risk metric is used as suggested in RG 1.177 to determine whether a proposed increase in AOT duration has an acceptable risk impact.

ICLERPy is the incremental conditional large early release probability with DG Y (Div 1 or Div 2) out of service for the proposed AOT of 14 days. RG 1.177 criteria were also applied to judge the significance of changes in this risk metric.

Attachment 6 provides the values for the Baseline DG AOT model at-power base CDF as well as the CDF for DG A (Division 1) being out of service (OOS) and DG B (Division 2) OOS. This information is summarized in the table below.

Table 7-1 Metric CDF Baseline 1.40E-5/yr DG A OOS 1.96E-5/yr DG B OOS 1.68E-5/yr The average at-power CDF with the change in the DG AOT was computed by adding the CDF for the period during which the DG is out of service (OOS) in the AOT with the CDF for the remainder of the cycle.

to GNRO-2002/00007 Page 2 of 8 ACDFAT-POWER = (TA/TCYCLE)CDFAOOS + (TB/TCYCLE)CDFBOOS + (1 - (TA + TB)/TCYCLE)CDFBASE CDFBASE where CDFAOOS is the CDF evaluated from the PSA model with the Division 1 DG (DG A) out of service and compensating measures for DG A implemented. These compensating measures include prohibiting maintenance or inoperable status of any of the remaining two DGs at the site as well as other compensating measures identified in this evaluation.

CDFBOOS is the CDF evaluated from the PSA model with the Division 2 DG (DG B) out of service and compensating measures for DG B implemented. These compensating measures include prohibiting maintenance or inoperable status of any of the remaining two DGs at the site as well as other compensating measures identified in this evaluation.

TA is the total time per fuel cycle (TCYCLE) that DG A is out of service for the extended AOT.

TB is the total time per fuel cycle (TCYCLE) that DG B is out of service for the extended AOT.

CDFBASE is the baseline annual average CDF with average unavailability of DGs consistent with the current DG on-line testing and maintenance.

The evaluation was performed based on the assumption that the full AOT would be applied once per DG per refueling cycle, hence TA = TB = 14 days. The cycle time is based on the current 18 month fuel cycle (allowing for planned and unplanned outage time), which yields TCYCLE = 475 days. In determining the values below, the PSA quantification truncation limit was set to 5E-10/yr for sequence quantification, more than 4 orders of magnitude below the total CDF. CDFAoos and CDFBOos were determined with the maintenance frequency for certain support systems set to zero. Specifically, the maintenance frequency for the remaining DGs, HPCS, RCIC and the alternate trains of SSW were set to zero. These systems would not be taken out of service for planned maintenance during extended planned maintenance on the Divisions 1 or 2 DGs.

ACDFAT-POWER = (TA/TCYCLE)CDFAoos + (TB/TCYCLE)CDFBOOs + [1 - (TA + TB)/TCYCLE]CDFBASE CDFBASE

= (14 days/475 days)

1.96E-5/yr + (14 days/475 days)

1.68E-5/yr

+ [1 - (14 + 14 days)/475 days]

1.4E-5/yr- 1.4E-5/yr

= 5.78E-7/yr + 4.95E-7/yr + 1.32E-5/yr - 1.4E-5/yr

= 2.73E-7/yr to GNRO-2002/00007 Page 3 of 8 An approach similar to that used for the at-power CDF was used to determine the average at power LERF.

As determined in Attachment 8, the baseline GGNS LERF is estimated to be 1.17E-7/yr. The LERF with DG A out of service and DG B out of service was estimated to be 3.34E-7/yr and 2.55E-7/yr respectively. Therefore, ALERFAvG can be calculated in a manner similar to ACDFAT.

POWER.

ALERFAVG = (TA/TcYCLE)LERFAOOS + (TB/TCYCLE)LERFBoos + (1 - (TA + TB)/TCYCLE)LERFBASE LERF1BASE where LERFAoOs is the LERF evaluated from the PSA model with the Division 1 DG (DG A) out of service and compensating measures for DG A implemented. These compensating measures include prohibiting maintenance or inoperable status of any of the remaining two DGs at the site as well as other compensating measures identified in this evaluation.

LERFBoos is the LERF evaluated from the PSA model with the Division 2 DG (DG B) out of service and compensating measures for DG B implemented. These compensating measures include prohibiting maintenance or inoperable status of any of the remaining two DGs at the site as well as other compensating measures identified in this evaluation.

TA is the total time per fuel cycle (TCYCLE) that DG A is out of service for the extended AOT.

TB is the total time per fuel cycle (TCYCLE) that DG B is out of service for the extended AOT.

LERFBASE is the baseline annual average LERF with average unavailability of DGs consistent with the current DG on-line testing and maintenance.

The evaluation was performed based on the assumption that the full AOT would be applied once per DG per refueling cycle, hence TA = TB = 14 days. The cycle time is based on the current 18 month fuel cycle (allowing for planned and unplanned outage time), which yields TCYCLE = 475 days. The change in the annual average CDF because of the change in the DG AOT was evaluated by computing the change in the at-power CDF and the change in the shutdown CDF.

ALERFAvG = (TA/TCYCLE)LERFAOOS + (TB/TCYCLE)LERFBOOS + (1 - (TA + TB)/TCYCLE)LERFBASE LERFBASE

= (14 d/475 d)3.34E-7/yr + (14 d/475 d)2.55E-7/yr + (1- (2 *14 d)/475 d)

1.17E-7/yr

- 1.17E-7/yr

= 9.84E-9/yr + 7.55E-9/yr + 1.1 OE-7/yr - 1. 17E-7/yr

= 1.04E-8/yr to G NRO-2002/00007 Page 4 of 8 The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using their definitions in RG 1.177. In terms of the above defined parameters, the definition of ICCDP is as follows:

ICCDPy = (CDFyoos - CDFBAsE)

TAOT For this evaluation, the CDF for DG A was used since this value bounds the CDF with DG B out of service.

ICCDPy = (CDFyoos - CDFBASE) * (14 days)/(365 days/year)

Note that in the above formula, 365 days/year is merely a conversion factor to get the Allowed Outage Time units consistent with the CDF frequency units. The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time to the extended allowed outage time. This should not be confused with the evaluation of ACDFAVG.

ICCDPy = (CDFyoos - CDFBASE) * (14 days)/(365 days/year)

= (1.96E-5/year- 1.4E-5/year) * (14 days)/(365 days/year)

= 2.15E-7 Similarly, ICLERP is defined as follows.

ICLERPy = (LERFyoos - LERFBASE)

TAOT

= (3.34E-7/year - 1 .17E-7/year) * (14 days)/(365 days/year)

= 8.32E-9 The results of the risk evaluation are presented in the table below.

Table 7-2 Risk Metric Significance Criterion5 GGNS Results ACDFAVG <1.OE-06/yr 2.73E-7/yr ICCDP <5.OE-07 2.15E-7 ALERFAVG <1.OE-07/yr 1.04E-8/yr ICLERP <5.0E-08 8.32E-9 Note that these estimates are obtained using the GGNS Level 1 Internal Events PSA model that does not include contributions from internal fires, seismic events and other external events.

However, due to the relatively low frequency of these events as compared to that expected from internal initiators and the significant capability of the plant to cope with these events (e.g., SSE 6 Reference RG 1.174 & RG 1.177 to GNRO-2002/00007 Page 5 of 8 design criterion and substantial separation used in the design of the plant), inclusion of fires and external events would not impact the conclusions of this evaluation.

EXTERNAL INITIATING EVENTS Fire As stated in NUREG-1407, the IPEEE was meant to be a vulnerability screening analysis rather than a full scope probabilistic risk assessment. While PSA techniques were used to develop core damage frequencies associated with internal fires, the results from the IPEEE are still screening analyses and therefore are not directly comparable to the CDF results from the IPE.

The CDF values generated for the IPEEE are intended to show that the CDF is low enough that a vulnerability does not exist. The evaluation of external events and internal fires contains some very large uncertainties. In many cases, these uncertainties led to the application of conservative assumptions to bound the accident and prove that no vulnerabilities exist.

By letter dated November 15, 1995, Entergy Operations, Inc. (EOI), submitted the Individual Plant Examination for External Events (IPEEE) for GGNS. EOI received the NRC Staff Evaluation Report by letter dated March 16, 2001, in which the staff concluded that the aspects of seismic events, fires, and high winds, floods, and other (HFO) events were adequately addressed.

GGNS developed a Fire PSA to address the fire portion of the IPEEE. The basic approach used was to find a target set of equipment associated with a particular fire scenario. These are components that may be directly impacted by the fire scenario or may be impacted by fires affecting cables that power or control the components. Based upon the fire scenario, existing initiators from the plant full power internal events PSA were selected to represent the type of plant shutdown that could occur. The list of initiating events and basic events representing the components lost were input as failures into the full power PSA model to derive conditional core damage probabilities (CCDPs) given a fire. This CCDP was typically multiplied by the fire ignition frequency to derive an estimated core damage frequency for a particular fire scenario.

The following table provides the fire areas identified as important.

to GNRO-2002/00007 Page 6 of 8 Table 7-3 Important Fire Areas Fire Area Description of Area Core Damage Frequency CC502 Main Control Room 3.85E-06 CC202 Division I Switchgear Room 9.37E-07 CA301 Auxiliary Building Corridors, 139' Elevation 6.70E-7 CA201 Auxiliary Building Corridors, 119' Elevation 6.38E-07 CC210 Division 3 Switchgear Room 6.08E-07 CA101 Auxiliary Building Corridors, 93' Elevation 5.74E-07 CC215 Division 2 Switchgear Room 4.06E-07 CT100 Turbine Building, 93' Elevation 3.24E-07 CC402 Lower Cable Room-Control Building (148' Elevation) 2.82E-07 CC104 Hot Machine Shop-Control Building (93' Elevation) 2.42E-7 CC302 HVAC Equipment Room-Control Building (133' 2.10E-07 Elevation)

CD306 Division 3 Diesel Generator Building 1.72E-07 CT200 Turbine Building, 113' Elevation 7.1OE-09 Total Fire CDF 8.92E-06 Because the diesel generators are only required to mitigate loss of offsite power events in the PSA analysis, the only fire scenarios that could increase in risk due to the DG AOT extension are those that would lead to a LOOP. Random occurrences of LOOPs concurrent with internal fire events are considered probabilistically insignificant. The individual fire areas identified as important were reviewed for sequences contributing to the CDF to identify those that involve the fire induced LOOP initiator. Six fire areas have 13 scenarios that would result in the loss of offsite power. These scenarios account for 14.55% of the total Fire PSA core damage frequency. In order to address the impact of a DG being out of service, these scenarios were reviewed to assess the impact to CDF of either DG A or DG B being out of service when a fire resulting in a LOOP occurs. There were four different possibilities:

CASE 1: DG A and B are not failed by the fire (either directly or through required support systems),

CASE 2: Both DG A and B are failed by the fire, CASE 3: DG A is failed by the fire and DG B is not, and CASE 4: DG A is not failed by fire and DG B is failed by fire.

to GNRO-2002/00007 Page 7 of 8 Therefore, depending on which DG was assumed to be out of service, the CDF of each scenario was adjusted as follows in order to allow an estimation of the CDF with either DG out of service.

Table 7-4 CASE DG A Out of Service DG B Out of Service 1 CDF X 10 CDF X 10 2 No Change No Change 3 No Change CDF X 10 4 CDF X 10 No Change A factor of 10 increase is utilized based on the assumption of a RAW value of 10 for either DG train. With the above modifications, the CDF with DG A out of service is 1.22E-5/yr and the CDF with DG B out of service is 1.09E-5/yr. Using the same methods as previously discussed, ACDFFIRE is determined to be 1.51 E-7/yr and the ICCDP is determined to be 1.26E-7 (based on DG A out of service). Both of these estimates are within the significance criteria of RG 1.177 and 1.174.

Seismic Per the GGNS IPEEE, "GGNS is classified in NUREG-1407 as a reduced scope plant of low seismicity; therefore, emphasis was placed on conducting detailed seismic walkdowns." Since GGNS did not perform a seismic PSA analysis for the IPEEE, the seismic LOOP initiator frequency was not previously determined. The likelihood of a seismic event at GGNS is on the order of 5E-5/yr (Ref. NUREG-1488). Maximum ground acceleration for the safe shutdown earthquake (SSE) is 0.15 g (GGNS FSAR Section 3.7.1.1). Ceramic insulators for offsite power transformers tend to be the most vulnerable components in the offsite power system during a seismic event. NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, "Analysis of Core Damage Frequency, Peach Bottom Unit 2 External Events," estimates the median peak ground acceleration at which these ceramic insulators are lost to be approximately 0.25 g. Using this value, the conclusion can be reached that the seismic LOOP initiator is over an order of magnitude less than the LOOP initiating event frequency times the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months non-recovery probability for AC power used in the base PSA model.

Industry experience also supports this conclusion. At least in recent history, seismic events appear to be a relatively minor contributor to the industry LOOP frequency. Evidence of this is provided in EPRI Report TR-1 10398, "Losses of Offsite Power at U.S. Nuclear Plants - Through 1997." This report records no LOOP events caused by seismic events, even though the database includes over a thousand years of unit operating experience and includes a period of time that had noteworthy earthquakes.

to GNRO-2002/00007 Page 8 of 8 SENSITIVITY ANALYSIS A simple sensitivity analysis was performed to determine the impact of varying the failure probabilities of the DGs on the CDF. This analysis was performed by multiplying the DG failure to run and failure to start basic event probabilities by factors of 0.2, 0.5, 2, and 5 in the cutset results. These factors were applied to both DG A and DG B and the HPCS DG since the primary initiator of concern is a loss of offsite power. The results are plotted in the following figure and indicate no undue sensitivity to the DG failure probabilities.

Figure 7-1. DG Sensitivity

Attachment 8 GNRO-2002100007 DG AOT LERF Evaluation to GNRO-2002/00007 Page 1 of 3 ATTACHMENT 8 DG AOT LERF Evaluation The GGNS Level 2 model has not been revised since the original IPE submittal. Therefore, the results of the GGNS IPE Level 2 analysis have been used to estimate the impact of the DG AOT extension on LERF. The GGNS IPE Level 2 results (see Table 8-3) are presented as the likelihood of 10 different release categories. These release categories are defined based on the Cesium and Tellurium Release fractions and the timing of the containment event tree end-state.

Release categories 3, 4 and 5 (Early Medium, Early Medium-High and Early High) were determined to be most representative of LERF. Since the DG AOT extension primarily impacts sequences initiated with a LOOP event, LERF is estimated by determining the fraction of release frequency for release categories 3, 4 and 5 for those plant damage states (PDS) involving a LOOP.

The GGNS Emergency Procedures (EP/SAPs) have been revised to incorporate the BWROG EP/SAP Guidelines, Revision 1, July 1997 since the IPE submittal. This revision incorporates severe accident management strategies and provides better guidance with regard to the venting and flooding of the containment. The previous revision of the EP's was more likely to result in the early venting of the reactor through the MSIVs. With the new revisions, venting the reactor through the MSIVs is only called for after containment water level has been raised to a level where RPV back flooding would be effective and is much less likely to occur early. Therefore, IPE Sensitivity Case 1, which does not utilize MSIV venting, is the best representation of GGNS for the DG AOT extension evaluation. The GGNS IPE Sensitivity Case 1 results are presented on Table 8-3.

LERF is estimated as follows:

Table 8-1 3(e-M) 4(e-mH) 5(e-H) Total of Categories 3,4&5 PDS 1 ST-SBO 0.001987 0.004984 0.044197 0.051168 PDS 2 ST-SBO 0 4.50E-06 3.90E-07 0.00000489 PDS 3 LT-SBO 3.70E-06 0.000082 0 0.0000857 PDS 4 ST-LOSP 0 0.00007 0 0.00007 PDS 5 ST-LOSPO0 0 0 0 Total LERF Frequency X 10000 0.05132859 LERF Fraction = Total LERF Frequency/Total CDF (IPE)

= 5.133E-7/1.586E-5

= 3.24%

to GNRO-2002/00007 Page 2 of 3 The LERF for each of the DG AOT extension analyses is obtained by multiplying the above fraction by the fraction of the CDF associated with the loss of offsite power initiator. The following table summarizes the results.

Table 8-2 CDF T1 T1 CDF LERF Contribution Frequency Baseline 1.40E-05 25.7% 3.60E-06 1.17E-07 DG A OOS 1.96E-05 52.6% 1.03E-05 3.34E-07 DG B OOS 1.68E-05 46.9% 7.88E-06 2.55E-07 to GNRO-2002/00007 Page 3 of 3 Table 8-3 GGNS IPE Level 2 Sensitivity Casel Results PDS Weighted Weighed Probability X 10000 Desc Prob 1 (e-L) 2(e-mL) 3(e-M) 4(e-mH) 5(e-H) 6(I-mL) 7(1-ml) 8(1-M) 9(I-mH) 10(I-H) SUM X 10000 PDS 1 ST-SBO 0.464586 0.146579 0.013091 0.001987 0.004984 0.044197 0.206887 0.001496 0.008447 0.00472 0.032198 0.464586 PDS 2 ST-SBO 0.010526 0.00129 0.000096 0 4.50E-06 3.90E-07 0.008765 0.000043 0.000021 0.000195 0.000111 0.010526 PDS 3 LT-SBO 0.216569 0.018132 0.001652 3.70E-06 0.000082 0 0.132796 0.000744 0.023079 0 0.040082 0.216571 PDS 4 ST- 0.154157 0.024613 0.004283 0 0.00007 0 0.125163 0 0.000029 0 0 0.154158 LOSP PDS 5 ST- 0.034751 0.000188 0.000013 0 0 0 0.034539 7.20E-07 0.00001 0 00.034751 LOSP II PDS 6 LOCA 0.031149 0 0 0 0 0 0.029523 0.000024 0.00084 00.000762 0.031149 PDS 7 ST- 0.232267 0.015971 0.000022 0.000044 0 0 0.21615 3.80E-06 0.000077 0 0 0.232268 TRAN PDS 8 LT-TRAN0.324564 0 0 0 0 0 0.081555 0 0.081401 0 0.161607 0.324563 PDS 9 ST- 0.1177 0.000746 0 8.40E-06 0 00.113862 00.003061 0 0.000023 0.1177 TRAN SUM 1.586269 0.207519 0.019157 0.002043 0.005141 0.044197 0.94924 0.002312 0.116965 0.004915 0.234783 1.586272

GNRO-2002/00007, License Amendment Request Emergency Diesel Generator Extended Allowed Out-of-Service Time (AOT) - TS 3.8.1, AC Sources--Operating, Ldc 2001-192

Contents

Text

SUBJECT:

REFERENCES:

Dear Sir or Madam:

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

SUMMARY

SUMMARY

Navigation menu

GNRO-2002/00007, License Amendment Request Emergency Diesel Generator Extended Allowed Out-of-Service Time (AOT) - TS 3.8.1, AC Sources--Operating, Ldc 2001-192

Text

SUBJECT:

REFERENCES:

Dear Sir or Madam:

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

SUMMARY

SUMMARY

Navigation menu

Search