Text

Supplement to License Amendment Request to Adopt TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b
	ML22277A603
Person / Time
Site:	Columbia
Issue date:	10/04/2022
From:	Hauger J; Energy Northwest
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	GO2-22-096
	Download: ML22277A603 (48)
	v • d • e

Jeremy S. Hauger Vice President, Engineering P.O. Box 968, PE30 Richland, WA 99352-0968 509.377.8727 jshauger@energy-northwest.com GO2-22-096 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

Subject:

COLUMBIA GENERATING STATION, DOCKET NO. 50-397 SUPPLEMENT TO LICENSE AMENDMENT REQUEST TO ADOPT TSTF-505, REVISION 2, PROVIDE RISK-INFORMED EXTENDED COMPLETION TIMES - RITSTF INITIATIVE 4b

Reference:

1. Letter from J. K. Dittmer (Energy Northwest) to U.S. Nuclear Regulatory Commission, License Amendment Request to Adopt TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated February 3, 2022 (ADAMS Accession No. ML22034A992)

2. Letter from U.S. Regulatory Commission to Mr. Robert Schuetz (Energy Northwest), Columbia Generating Station - Regulatory Audit Agenda and Questions for License Amendment Request to Revise Technical Specifications to Adopt TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (EPID L-2022-LLA-0023), dated July 6, 2022

Dear Sir or Madam:

In Reference 1, Energy Northwest requested an amendment to the Columbia Generating Station (Columbia) Technical Specifications (TS). The proposed amendment would modify Columbias TS requirements to permit the use of Risk-Informed Completion Times in accordance with TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b.

In Reference 2, the Nuclear Regulatory Commission (NRC) requested a virtual audit to improve the efficiency of staff reviews. As a result of this regulatory audit that was conducted on August 1-5, 2022, Energy Northwest is supplementing the License Amendment Request (LAR) to support the NRC staffs review of the proposed change.

!

October 4, 2022 ENERGY NORTHWEST

GO2-22-096 Page 2 of 2 The attachment to this letter provides information requested by the NRC staff during the regulatory audit to amend Reference 1.

The information contained in the attachment does not affect the Technical Analysis or No Significant Hazards Consideration conclusions contained in the LAR. Additionally, the information provided in this supplement does not affect the bases for concluding that neither an environmental impact statement nor an environmental assessment needs to be prepared in connection with the proposed amendment.

In accordance with 10 CFR 50.91, Energy Northwest is notifying the State of Washington of this amendment supplement by transmitting a copy of this letter and attachment to the designated State Official.

This letter and its attachment contain no new commitments.

If there are any questions or if additional information is needed, please contact Mr. R.M. Garcia, Licensing Supervisor, at 509-377-8463.

I declare under penalty of perjury that the foregoing is true and correct.

Executed this ______ day of ___________ 2022.

Respectfully, Jeremy S. Hauger Vice President, Engineering

Attachment:

Audit Question Responses cc:

NRC RIV Regional Administrator NRC NRR Project Manager NRC Senior Resident Inspector/988C CD Sonoda - BPA/1399 EFSECutc.wa.gov - EFSEC E Fordham - WDOH R Brice - WDOH L Albin - WDOH

!

DocuSigned by:

G::.tt~

GO2-22-096 Attachment Audit Question Responses Page 1 of 46 The following information is being provided to amend Reference 1 as a result of the regulatory audit held on August 1-5, 2022 in response to Reference 2.

Audit Question 3 (APLA/APLC) Part a and b - Impact of Seasonal Variations

Response

a.) The Probabilistic Risk Assessment (PRA) model includes extreme cold weather in the Containment Nitrogen and Service Water System A and Service Water System B logic. A basic event is used for the conditional probability of extreme cold weather. The PARAGON model includes a variable for EXTREMECOLD that sets the conditional probability to TRUE. Otherwise, time-averaged data is used.

Other conditions are evaluated to determine the impact on plant equipment availability. Equipment that is determined to be unavailable is set to TRUE and evaluated in the Configuration Risk Management Program (CRMP). This equipment would also be included as unavailable in the Risk-Informed Completion Time calculation. For example, hot summer weather could challenge temperature limits. If temperature limits were unable to be maintained, then supported systems would be considered unavailable.

Severe weather conditions that do not affect plant equipment availability are evaluated qualitatively as High-Risk Evolutions (HRE). An HRE will elevate the Plant Risk Level (risk color) and require risk management actions.

b.) The PARAGON model includes a variable for EXTREMECOLD that is set to TRUE when the outside temperature is less than 10 degrees Fahrenheit.

The CRMP is controlled per station procedure PPM 1.5.14. Step 5.6.3 directs that Operations control room staff evaluate emergent conditions:

Perform a PARAGON evaluation for emergent work and for questions concerning the current PARAGON evaluation on weekends, backshift, and if the Work Week Manager is not onsite. Notify the Work Week Manager of any plant risk increase to implement the required risk management actions in accordance with Attachment 9.11. Contact the PSA engineer to evaluate elevated risk conditions and develop risk management actions as appropriate.

Emergent conditions are evaluated to determine the impact on plant equipment availability. If it is determined that equipment is unavailable, then the PARAGON schedule is evaluated for risk impact, and risk management actions are implemented as required.

!

GO2-22-096 Attachment Audit Question Responses Page 2 of 46 Audit Question 4 (APLA) Part a and b - Performance Monitoring

Response

a.) The Columbia Generating Station (CGS) Maintenance Rule program incorporates the use of performance criteria to evaluate SSC performance as described in NUMARC 93-01, as endorsed by Regulatory Guide 1.160.

b.) Audit Question APLA-04 requested answering either part a.) or part b.; therefore, part b.) is not applicable.

Audit Question 5 (APLA/APLC) Parts a through e - In-Scope LCOs and Corresponding PRA Modeling

Response

a.) The Reactor Protection System (RPS) model in the CGS PRA is directly taken from NUREG/CR-5500 without any alteration to data. The RPS is divided into mechanical and electrical functions in the PRA model. The mechanical function (Event CM) failures address valves, rod insertion, and accumulator integrity.

NUREG/CR-5500, Volume 3, Table 5 calculates a value of 2.15E-6 per demand for the mechanical failure probabilities (i.e., rod, hydraulic control unit) of the RPS, which is the value used in the PRA model. The electrical portion of the RPS (Event CE) generates the scram signals from the sensors, logical processing of the signal, and the de-energizing of the scram solenoids. NUREG/CR-5500 calculates a value of 3.78E-6 per demand for the electrical failure probabilities (i.e., Channel, Trip System) of the RPS, which is the value used in the PRA model. These values are based on the Fussel-Vesely of the basic event contributions from the cutset solutions. Therefore, the sum of the values of 5.93E-6 is conservative when compared to the total failure probability of 5.8E-6 that is presented in Section 5 of NUREG/CR-5500 for the RPS unavailability.

The value 3.78E-6 that is used in Event CE is the RPS failure probability when no credit is given for operator action to manually scram the RPS. When manual scram is credited, NUREG/CR-5500 calculates a value of 5.20E-7. In the CGS PRA, the 3.78E-6 value is used in all accident sequences, except for small break loss of coolant accident (LOCA) and in safety relief valve (SRV) LOCAs. For those initiators, the 5.20E-7 value is used in Event CE2. For the real time risk model (RTR), only the value representing no manual scram credit will conservatively be used explicitly and Event CE (and the logic described herein) will replace Event CE2).

b.) When compared to the NUREG/CR-5500 model, the CGS RPS point estimate events used in the PRA model are the same.

!

GO2-22-096 Attachment Audit Question Responses Page 3 of 46 The NUREG/CR-5500 model uses data from 1984 to 1995, which predates data from NUREG/CR-6928 and its update through 2020. A review of the NUREG/CR-6928 data for RPS systems indicates that the data comes from the RPS System Study from NUREG/CR-5500 for the period of 1986 through 1995. The primary difference is that the NUREG/CR-5500 Volume 3 data is for the boiling water reactor (BWR) RPS systems, while the RPS data reported in NUREG/CR-6928 (2020 update) comes from the combined study of NUREG/CR-5500 Volumes 2, 3, 10, and 11 ( i.e., Westinghouse, General Electric, Babcock & Wilcox) that is not differentiated by reactor brand or type in the combined analysis. Therefore, it is recognized that the BWR RPS Data NUREG/CR-5500 Volume 3 remains the industry state of the art data for RPS data for BWRs. Some data types can be compared to newer data from NUREG/CR-6928 for 2006 through 2020 (taken from the Equipment Performance and Information Exchange System and Reliability and Availability Data System). However, these data types showed a small decrease in probabilities (approximately 30%) over the older data used in NUREG/CR-5500 Volume 3. Therefore, using the older data remains acceptable with only a minor conservatism added to the solution value.

Because the data in NUREG/CR-5500 was specifically taken from RPS systems and has not been updated by a more current study, it remains the industry state of the art study and meets the intent of American Society of Mechanical Engineers (ASME) DA-C1 as a generic data source.

c.) The NUREG/CR-5500 model is a simplified model that addresses two RPS automatic functions for initiating the scram signal, high reactor pressure, and low reactor vessel water level (equivalent to CGS Functions 3 and 4). These two functions are appropriate to represent the full range of plant events, because for identified events, it has been shown that at least two functions are challenged for the design bases accidents in the Final Safety Analysis Report (FSAR). Attachment 6 of Reference 1 identifies at least one diverse trip function for each Technical Specification (TS) function. Therefore, it is conservative to assume that there are only two RPS scram functions challenged for any plant event. It is also appropriate for these two functions to represent the reliability of other functions, as there is little variation between the SSCs of each function from a data standpoint. Therefore, the probability of an RPS scram failure, as calculated by NUREG/CR-5500 is a conservative model for the whole range of functions and their SSCs proposed in the risk-informed completion time (RICT) limiting conditions for operation (LCO).

d.) The Columbia RPS model meets the 2009 ASME/ANS PRA standard CC-II requirements. Requirement SY-A7 CC I-II states:

Develop detailed systems models, unless (a) sufficient system-level data are available to quantify the system failure probability, or (b) system failure is dominated by operator actions, and omitting the model does not mask contributions to the results of support systems or other dependent-failure

!

GO2-22-096 Attachment Audit Question Responses Page 4 of 46 modes. For case (a), USE a single data value only for systems with no equipment or human-action dependencies, and if data exist that sufficiently represent the unreliability or unavailability of the system and account for plant-specific factors that could influence unreliability and unavailability.

Examples of systems that have sometimes not been modeled in detail include the scram system, the power-conversion system, instrument air, and the keep-fill systems. JUSTIFY the use of limited (i.e., reduced, or single data value) modeling.

i.

The use of the NUREG/CR-5500 model as a point estimate meets the ASME standard requirements because the model can be sufficiently addressed by a point estimate, the model is not dependent on human actions, and the data was system-specific and used state of the art approaches still in practice today. These are consistent with Category II and III ASME supporting requirements, and the results of the model remain conservative when compared to newer data. Also, the ASME standard cites RPS models as an example where a point estimate system model is acceptable.

ii.

This question is not applicable because the use of NUREG/CR-5500 was previously justified.

iii.

The NUREG/CR-5500 RPS model is being used as a surrogate. The change proposed in the RICT model is to break the existing electrical RPS point failure estimate event down into its four subsystems arranged in the one-out-of-two taken twice logic, consistent with the NUREG/CR-5500 model, but as subsystem (channel) modules versus individual components. Five events will be used to accurately calculate the current RPS electrical event probability (3.78E-6): the four subsystem events and one common cause event. The NUREG/CR-5500 cutset events were categorized, according to the approach in NUREG/CR-5500, into independent failures and common cause failure. The RPS failure probability from independent and common cause failures was then calculated. Independent failure models for each channel were then calculated by reversing the one-out-of-two taken twice logic. The calculated values used in Reference 1 for the independent subsystem event is 2.0E-4, and for the common cause failure event is 3.7E-

6. For the RICT program, it is proposed to map any RPS structure, system, component (SSC)-related unavailability to the subsystem that it is associated with. This is conservative, as the entire subsystem will be failed in the PRA model, whereas in the plant, all the other functions would remain available in that subsystem (i.e., relays able to open). The manual pushbutton associated with a scram subsystem would also be applied to fail the modeled subsystem, which meets the requirement to address the manual scram aspect of RPS. The CCF probability is not adjusted, as RICTs will not be entered following a failure if the extent of condition determination

!

GO2-22-096 Attachment Audit Question Responses Page 5 of 46 identifies common cause contributors for the failed SSC. The approach was compared to results from removing a channel from service in the NUREG/CR-5500 model by failing all K relays associated with each subsystem as shown in Table APLA-Q5.1 below.

Table APLA-Q5.1. Comparison of RPS Model Results Out of Service Case Proposed RICT Model Result NUREG/CR-5500 Model Result Assessment No Maintenance 3.78E-6 3.77E-6 RICT surrogate model equivalent All A Channel K Relays (Div 1 impact) 2.04E-4 5.07E-6 RICT surrogate model bounding All A and B Channel K Relays (Div 1 and Div 2 impact) 4.04E-4 6.37E-6 RICT surrogate model bounding All A and C Channel K Relays (Div 1 unavailable) 1 9.97E-1 RICT surrogate model equivalent As demonstrated, the proposed RPS model generates results that are bounding for RICT entry and meets the 2009 ASME/ANS PRA standard CC-II requirements.

This approach is an extension of existing approaches and will be implemented as a matter of model maintenance. This approach does not represent a new approach or model upgrade, as the underlying data is the same as what was previously peer reviewed.

iv.

This question is not applicable because the proposed surrogate was previously justified as bounding for RICT entry.

e.) The RPS data used for Event CE in the internal events model and used for the seismic model are the same. Seismic impacts on RPS logic would result in relay chatter, which would open RPS channel circuits and scram the reactor; therefore, seismic events do not degrade reliability of the RPS to scram the reactor. Seismic impacts on the scram function are modeled for control rods, hydraulic control units, and the alternate rod insertion system.

!

GO2-22-096 Attachment Audit Question Responses Page 6 of 46 Audit Question 6 (APLA) Parts a through k - Missing Information in Table E1-1

Response

The following cells shaded in grey show updates to Table E1-1, In-Scope TS/LCO Conditions to Corresponding PRA Functions in response to Audit Question 6 (APLA).

a.) TS 3.3.4.1, LCO a.2, Turbine Governor Valve (TGV) Fast Closure, Trip Oil Pressure - Low CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.4.1.A EndofCycle

Recirculation

PumpTrip(EOC RPT)

Instrumentation

Oneormore

required

channels

inoperable.

Functiona.1Turbine

ThrottleValve(TTV)-

Closure

(Fourchannels)

Functiona.2.Turbine

GovernorValve(TGV)-

FastClosure,TripOil

PressureLow(Four

channels)

No

TripBoth

Recirculation

Pumps

TwoTurbineTripValve

Closurechannelsin

eithertripsystem

OR

TwoTurbineGovernor

ValveFastClosureTrip

OilPressureLow

channelsineithertrip

system

None

SeeNote3

!

I

GO2-22-096 Attachment Audit Question Responses Page 7 of 46 b.) TS 3.3.4.2, LCO b, Reactor Vessel Steam Dome Pressure - High CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.4.2.A Anticipated

TransientWithout

SCRAMRecirculation

PumpTrip(ATWS RPT)

Instrumentation

oneormore

channelsinoperable

Functiona.RVWL-Low

LowLevel2

(Fourchannels)

(SeeNote4)

Functionb.Reactor

VesselSteamDome

(RVSD)Pressure-High

(Fourchannels)

(SeeNote4)

Yes

TripsRecirculation

Pumpassociated

withthetripsystem

TwoRVWL-Low,Low,

Level2channelsinone

oftwotripsystems

OR

TwoRVSDPressure-

Highchannelsinoneof

twotripsystems

SameasDesign

Success

Criteria

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

!

I

GO2-22-096 Attachment Audit Question Responses Page 8 of 46 c.) TS 3.3.5.1, Function 1.b, Drywell Pressure - High CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.5.1.B ECCS

Instrumentation-

Asrequiredby

RequiredAction

A.1and

referencedin

Table3.3.5.11.

1.ECCSActuationInstrumentationforLowPressureCoolantInjectionA(LPCI)andLowPressureCoreSpray(LPCS)

Subsystems

1.a.RVWL-LowLow

Low,Level1

(Twochannels)

Yes

ActuatebothLPCI

AandLPCS

OneRVWLLevel1

channel

OR

OneDrywellPressure

HighchannelfromTwo

Subsystems

Sameas

Design

Success

Criteria.

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

1.b.DrywellPressure-

High

(Twochannels)

Yes

ActuatebothLPCI

AandLPCS

2.ECCSActuationInstrumentationforLPCIBandLPCICSubsystems

2.a.RVWL-LowLow

Low,Level1

(Twochannels)

Yes

ActuatebothLPCI

BandLPCIC

OneRVWL-Level1

channel

OR

OneDrywellPressure

HighchannelfromTwo

Subsystems

Sameas

Design

Success

Criteria

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

2.b.DrywellPressure-

High

(Twochannels)

Yes

ActuatebothLPCI

BandLPCIC

3.ECCSActuationInstrumentationHighPressureCoreSpray(HPCS)System

3.a.ReactorVessel

WaterLevel-LowLow,

Level2

(RVWL2)

(Fourchannels)

Yes

ActuateHPCS

TwoRVWLLevel2

differentialpressure

switches

Sameas

Design

Success

Criteria

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

3.b.DrywellPressure-

High

(Fourchannels)

Yes

ActuateHPCS

TwoDrywellPressure

Highpressureswitches

Sameas

Design

Success

Criteria

!

I I

GO2-22-096 Attachment Audit Question Responses Page 9 of 46 d.) TS 3.3.5.1, Function 3.e, Suppression Pool Water Level - High CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.5.1.D ECCS

Instrumentation

Asrequiredby

RequiredActionA.1

andreferencedin

Table3.3.5.11.

3.ECCSActuationInstrumentationHPCSSystem

3.d.Condensate

StorageTank(CST)

LevelLow

(Twochannels)

3.e.SuppressionPool

WaterLevel(SPWL)

High

(Twochannels)

Yes

ChangeHPCS

suctionfromCST

toSuppression

Poolforcontinued

HPCSoperation

Oneoftwochannels

ofCSTLevel-Low

OR

OnechannelofSPWL

High

Oneoffour

channelsof

CSTLevelLow

OR

Onechannel

ofSPWLHigh

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

TwoadditionalnonTS

CSTLevel-Lowchannels

aremodeledexplicitly

withthesamedetailas

TSchannels.

!

I I

GO2-22-096 Attachment Audit Question Responses Page 10 of 46 e.) TS 3.3.5.1, Function 5.3, Accumulator Backup Compressed Gas System Pressure - Low CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.5.1.F

ECCS

Instrumentation

Asrequiredby

RequiredAction

A.1andreferenced

inTable3.3.5.11.

ADSinitiationlogicandinstrumentationfunctions

4.a.RVWL-LowLow

Low,Level1

(Twochannels)

No

InitiateADSTrainA TwoReactorVessel

WaterLevel

-LowLowLevel1

channelsineitherof

twoADSactuation

systems

None

ADSInhibit

assumed.

Onlymanual

depressuri zation

credited

FailureofTrainAADS

SOVstoopenisusedasan

equivalentsurrogatefor

RICTcalculation[6]

5.a.RVWL-LowLow

Low,Level1

(Twochannels)

No

InitiateADSTrainB

FailureofTrainBADS

SOVstoopenisusedasan

equivalentsurrogatefor

RICTcalculation[6]

4.c.RVWL-LowLevel

3(Permissive)

(Onechannel)

No

ADSPermissive

TrainA

OneRVWL-LowLevel

3channelineitherof

twoADSactuation

systems

None

ADSInhibit

assumed.

Onlymanual

depressuri zation

credited

FailureofTrainAADS

SOVstoopenisusedasan

equivalentsurrogatefor

RICTcalculation[6]

5.c.RVWL-LowLevel

3(Permissive)

(Onechannel)

No

ADSPermissive

TrainB

FailureofTrainBADS

SOVstoopenisusedasan

equivalentsurrogatefor

RICTcalculation[6]

4.f.Accumulator

BackupCompressed

GasSystemPressure-

Low

(Threechannels)

No

Alignbackup

nitrogenonlow

headergas

pressure

Twooutofthree

compressedgasheader

systempressure-Low

ineitheroftwoADS

actuationsystems

Oneoftwo

nitrogen

bottleracks

supplyingthe

ADSsafety

gasheader.

Aconservativesurrogate

ofunavailabilityofthe

TrainAnitrogensupply

headerwillbeused.

5.e.Accumulator

BackupCompressed

GasSystemPressure-

Low

(Threechannels)

No

Aconservativesurrogate

ofunavailabilityofthe

TrainBnitrogensupply

headerwillbeused.

!

GO2-22-096 Attachment Audit Question Responses Page 11 of 46 f.) TS 3.3.6.1, Function 5.a, Residual Heat Removal (RHR) Shutdown Cooling (SDC) System Isolation, Pump Room Area Temperature - High g.) TS 3.3.6.1, Function 5.b, RHR SDC System Isolation, Pump Room Area Ventilation Differential Temperature - High h.) TS 3.3.6.1, Function 5.c, RHR SDC System Isolation, Heat Exchanger Area Temperature - High (Room 505, 507, 605, and 606 Area) i.) TS 3.3.6.1, Function 5.d, RHR SDC System Isolation, Reactor Vessel Water Level - Low, Level 3 CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.6.1.A Primary

Containment

Isolation

Instrumentation

oneormore

channels

inoperable

5.ResidualHeatRemoval(RHR)ShutdownCooling(SDC)SystemIsolation(Functione.andf.)

Functions5.athrough5.dareforoperationalmode3onlyandareoutsidethescopeoftheRICTprogram.

5.e.ReactorVessel

Pressure-High

(Twochannels)

No

AutomaticIsolation

ofRHRSDCvalves

OneRVP-Highchannel

oneitherisolation

system

None

SeeNote7.c

5.f.ManualInitiation

(Fourchannels,twoper

switch/PBpair)

No

Manualisolationof

RHRSDCvalves

Oneswitch/PBpairon

eitherisolationsystem

None

SeeNote7.c

!

GO2-22-096 Attachment Audit Question Responses Page 12 of 46 j.) TS 3.3.8.1, Function 1.b, Divisions 1 and 2 - 4.16 kV Emergency Bus Undervoltage, TR-S Loss of Voltage - Time Delay CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.8.1.B LossofPower(LOP)

instrumentation

Asrequiredby

RequiredActionA.1

andreferencedin

Table3.3.8.11.

1.Divisions1and24.16kVEmergencyBusUndervoltage

1.a.TRSLossofVoltage

(LOV)-4.16kVBasis

(Fourchannels,twoper

bus

No

LOVsensingcap abilityandtime

delaytoinitiatetrip

ofoffsitepower

circuit,startthe

associated

emergencydiesel

generator(DG)and

initiatesource

transfertoconnect

tothenext

availablepower

sourceonDivision

1or24.16kVbus.

OneLOVchannelper

bus

None

Function1.awillbe

conservativelymappedto

modeledrelaysthatfailDG

LOVstartsignalandTRB

transfer,whichare

affectedcircuitsoftheLOV

channels.OperableLOV

channelwillconservatively

notbecreditedforRICT.

1.b.LossofVoltage

TimeDelay(Four

channels,twoperbus)

Yes

TwoTimeDelay

channelsperbus

Sameas

Design

Success

Criteria

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

!

GO2-22-096 Attachment Audit Question Responses Page 13 of 46 k.) TS 3.3.8.1, Function 1.e, Divisions 1 and 2 - 4.16 kV Emergency Bus Undervoltage, Degraded Voltage - 4.16 kV Basis CGSTS

CGSTSDescription

SSCsCoveredbyTS

LCOCondition

Modeledin

PRA

FunctionCovered

byTSLCO

Condition

DesignSuccessCriteria

PRASuccess

Criteria

Comments

3.3.8.1.C LossofPower

(LOP)

instrumentation

Asrequiredby

Required

ActionA.1and

referencedin

Table3.3.8.11.

1.Divisions1and24.16kVEmergencyBusUndervoltage(SeeNote8)

1.c.TRBLossof

Voltage4.16kVBasis

(Twochannels,one

perbus)

Yes

SenseLOVon

BackupTrans formerandTransfer

BustoDG

OneLOVchannelper

Bus

Sameas

Design

Success

Criteria.

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

1.d.TRBLossof

VoltageTimeDelay

(Sixchannels,three

perbus)

Yes

TimeDelayfor

powerrecovery

ThreeTDchannelper

bus

Sameas

Design

Success

Criteria.

1.e.DegradedVoltage

(DV)4.16kVBasis

(Sixchannels,threeper

bus)

Yes

SenseEssential

BusDVand

TransferBustoDG

TwoDVchannelsper

bus

Sameas

Design

Success

Criteria.

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

1.f.DegradedVoltage

PrimaryTimeDelay(Six

channels,threeper

bus)

Yes

TimeDelayfor

powerrecovery

TwoDVPrimaryTD

Channelsperbus

Sameas

Design

Success

Criteria.

1.g.DegradedVoltage

SecondaryTime

Delay

(Sixchannels,three

perbus)

Yes

TimeDelayfor

powerrecovery

ThreeDVSecondary

TDChannelperbus

Sameas

Design

Success

Criteria.

2.Division3-4.16kVEmergencyBusUndervoltage

2c.DegradedVoltage

4.16kVBasis(Three

channels)

Yes

SenseHPCSBus

DVandTransfer

toDG

TwoDVChannels

Sameas

Design

Success

Criteria.

SSCsaremodeled

consistentwiththeTS

scopeandcanbedirectly

includedintheCRMtool

fortheRICTprogram.

!

GO2-22-096 Attachment Audit Question Responses Page 14 of 46 Notes for Table E1-1 are listed below for reference. Edits to the Notes section for Table E1-1, In-scope TS/LCO Conditions to Corresponding PRA Functions, are shown in italicized text.

1. Individual RPS instrumentation inputs to the RPS logic system are not modeled in the PRA. The RPS failure probability is based on the NUREG/CR-5500 Volume 3 model (Reference 6). The PRA model uses a single point estimate event to represent RPS failure due to electrical SSC failures. For the RICT calculation, the Reference 6 model cutsets were reviewed and a probability of failure of each of the four sub-systems (channels) was developed. A new simplified RPS model using the four sub-system failure events was developed based on the one-out-of-two taken twice logic. This new RPS model generates the exact base probability of the NUREG/CR-5500 model. For any subsystem with a function considered inoperable or bypassed, the associated subsystem event was failed in this new RPS model to calculate the RICT. This new simplified RPS model was validated to provide more conservative results than the NUREG/CR-5500 model when a function channel is inoperable or bypassed. This new simplified RPS model is used to calculate the values in Table E1-2 with two subsystems out of service (one bypassed and another inoperable), which is allowed for some functions. This RPS model addresses both Condition A and Condition B of TS 3.3.1.1.

The CGS PRA CRM program model will be updated to use this new simplified RPS electrical failure logic model prior to RICT program implementation. This is not a model upgrade, but only a model maintenance item and does not introduce any new PRA methods.

2. There are three reactor feedwater system channels of Reactor Vessel Water Level (RVWL) - High used to trip the reactor feed pumps (RFPs) and the main turbine. Failure of the RFP and the main turbine high water level trip functions are not modeled. Failure or unavailability of these trip functions could result in damage to the RCIC turbine, RFP turbines, and main turbine, of which RCIC and the RFPs provide PRA functions. A similar impact from the HPCS discharge valve isolation signal on RVWL high is expected. As a conservative surrogate for the maintenance of any TS 3.3.2.2.A high water level channel or TS 3.3.5.1.C function 3.c. high water level channel, RCIC and the RFPs will be failed. This is conservative because the RCIC and RFPs are assumed failed regardless of a failure of reactor vessel level control and failure of all channels of the trip function.

3. The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to the core thermal MCPR Safety Limit. This is not a PRA modeled function. However, EOC-RPT provides another backup to the ATWS-RPT for load reject transients and can be conservatively assessed using a surrogate. Failure of recirculation pump breakers to trip will be used as a conservative surrogate for the RICT calculation. The surrogate is conservative as the breakers are tripped by the EOC-RPT logic. Thus, the RICT calculated for this surrogate is bounding for each channel because one channel out of service does not prevent the trip of the RPT breakers.

!

GO2-22-096 Attachment Audit Question Responses Page 15 of 46

4. ATWS-RPT system instrumentation is part of the redundant reactivity control system and has 2 independent trip systems each composed of two channels of each functional input. Each trip system uses a 2-out-of-2 logic for each function. Thus, either two Reactor Water Level - Low Low, Level 2 or two Reactor Vessel Steam Dome Pressure

- High signals are needed to trip a trip system. One trip system trips one recirculation pump and the other system trips the other recirculation pump.

5. Instrumentation to open minimum flow valves is not modeled explicitly but is modeled as within the valve component boundary. Therefore, the minimum flow valve events are used as instrumentation surrogates.

6. The Fire PRA models individual SOVs and dependencies for each SRV (ADS and non-ADS). For the RICT evaluation in Table E1-2, the Fire PRA logic was also added to the Internal events, Internal flood, and Seismic hazards models for the quantification.

Additionally, ADS SRVs are only modeled by common cause failures or their supporting SOVs and supports. For the RICT calculation, individual ADS SRV valve body independent failure to open events were added. This logic will be included in the CRM program models for all hazards prior to RICT program implementation. This is not a model upgrade, but only a model maintenance item and does not introduce new PRA methods.

7. One isolation system is associated with the inner primary containment isolation valves and the other isolation system is associated with the outer primary containment isolation valves with the success criteria being closure of one of the two isolation valves. Where SSCs are modeled consistent with the TS scope, SSC will be directly used for unavailability in the CRM tool for the RICT program. Otherwise, the use of surrogates will be as follows:

a) For functions 1.e, MS isolation on MS tunnel temperature - high, and 1.f, MS isolation on MS tunnel differential temperature - high, will use the leak detection (LD) monitors for each inoperable channel as a conservative surrogate. The LD monitors are modeled in the PRA, but the individual temperature elements are not modeled in the PRA. Two LD monitors each receive inputs from two MS tunnel temperature channels (one element per channel) and two MS tunnel differential temperature channels (two elements per channel). With one or more elements inoperable, the associated TD monitor(s) will be failed in the PRA. This is conservative because diversity for functions 1.e and 1.f will not be credited.

b) For RWCU isolation function 4.f, Pump Room Temperature - high channels will use the LD monitors for each inoperable channel as a conservative surrogate. The LD monitors are modeled in the PRA, but the individual temperature elements are not modeled in the PRA. Two LD monitors each receive inputs from two temperature elements channels each. With one or more element inoperable, the associated TD monitor(s) will be failed in the PRA. This is conservative because redundancy of two channels per monitor is not credited for function 4.f. For other unmodeled Function 4 subsets, the RWCU isolation valve will be failed open as a conservative surrogate

!

GO2-22-096 Attachment Audit Question Responses Page 16 of 46 for the associated instrumentation subsystem, unless the valve is isolated and de-energized. This is conservative because one channel inoperable will not render the associated isolation valve not closable.

c) For functions 5.e. and 5.f, a RHR shutdown cooling suction line isolation MOV will be failed open as a conservative surrogate for the associated instrumentation subsystem, unless the MOV is isolated and de-energized. This is conservative because one channel inoperable will not render the associated isolation valve not closable.

d) For other unmodeled functions (2.a, 2.d, 3 and 6) a large pre-existing containment isolation failure will be used as a conservative surrogate for the LCO condition. See Notes 9 and 10 for the background of the large pre-existing containment failure event and how it will be applied. This approach is conservative because unmodeled functions have been determined not to contribute to LERF.

8. Each 4.16 kV emergency bus has its own independent LOP instrumentation and associated trip logic. The voltage for the Division 1, 2, and 3 buses is monitored at two levels, which can be considered as two different undervoltage functions: loss of voltage and degraded voltage. For Division 1 and 2, the loss of voltage function is monitored by two instruments per bus and the degraded voltage is monitored by three instruments per bus. The degraded voltage signal is generated when a degraded voltage occurs for a specified time interval and also provides a backup for the undervoltage functions.

9. The containment air locks are not explicitly modeled in the CGS PRA. Since the containment airlocks are not modeled, there are no explicit PRA Success Criteria.

However, the LCO condition will be modeled using the pre-existing large containment isolation failure as a conservative surrogate in the PRA. The pre-existing large containment failure event probability was derived by the Pacific Northwest Laboratory (PNL) for the NRC (see EPRI Risk Impact Assessment of Extended Integrate Leak Rate Test Intervals, TR-101824) plus the use of NUREG-1493. Columbia is not an outlier in the use of this generic industry accepted data that addresses the operating experience-based probability of containment release pathways being larger than small. Because the containment hatch doors have no dependencies, for the LCO condition, it is appropriate to increase the failure probability of the surrogate event in the CRM program (versus setting to logical True) for the RICT calculation. This added probability represents the likelihood of failure of the redundant operable door. A bounding probability was derived from the square root of the pre-existing large isolation failure probability. The RICT in Table E1-2 was calculated using this approach.

10. Where PCIV SSCs are modeled consistent with the TS scope, unavailability can be directly included in the CRM tool for the RICT program. Unmodeled PCIVs were screened in the PRA due to from LERF consideration based on PCIVs being smaller than 2 inches or if the PCIV isolates a closed system inside containment. However, a conservative assessment using a surrogate pre-existing large containment isolation failure will be used to address individual unmodeled PCIV unavailability (See basis for

!

GO2-22-096 Attachment Audit Question Responses Page 17 of 46 event in Note 9). Although very conservative, screened penetrations shall be assessed with this surrogate. Where the redundant unisolated operable isolation valve(s) is(are) fail safe, the respective failure probability(ies) shall be added to the surrogate event in the CRM program. If any remaining unmodeled unisolated operable isolation valve is not fail safe, the surrogate shall be set to failed (logical True) for the LCO condition. The RICT values in Table E1-2 were calculated assuming the redundant valve is not fail-safe, and the surrogate event was set to logical True. This approach is conservative because unmodeled PCIV SSCs have been determined not to contribute to LERF.

11. Failure of the drywell spray is used as a conservative surrogate for reactor building to suppression chamber vacuum breakers. For sequences requiring drywell spray, success of vacuum breakers was assumed in the PRA, and the possibility of failure was screened as insignificant. Failure of sprays is modeled to cause containment failure. For the LCO condition, failure of the drywell spray function is a conservative surrogate. This approach is conservative because a single vacuum breaker unavailability will not result in failure of the spray function or containment failure for the accidents for which spray is modeled.

12. If sufficient suppression pool to drywell vacuum breakers fail to open under certain accident sequences, failure of the drywell floor may occur and a loss of LOCA vapor suppression will occur. The drywell floor seal failure event is a conservative surrogate to model vapor suppression bypass. For the LCO condition, the event probability will be increased to that of a bounding common cause factor given a single vacuum breaker is failed. This approach is conservative because a single vacuum breaker unavailability will result in an insignificant increase in the vacuum breaker function unreliability, and the common cause factor is orders of magnitude higher than the calculated risk. Further, if common cause is determined, then the extent of condition determination will result in multiple vacuum breakers inoperable, and a RICT will not be entered.

13. The RHR system contains three separate pump trains, two of which contain heat exchangers for heat removal. The third pump train is for LPCI functions only.

14. Each Division 1 and 2 125 VDC subsystem has an installed redundant standby charger that is normally isolated and can be manually aligned to meet the LCO requirements.

The installed redundant spare battery charger is a design feature of the 125 VDC distribution system and is therefore, modeled in the PRA as a recovery action option.

15. 120/240V 1 Phase power panels PP-7A-F, PP-8A-G, and PP-4A, and 120/208V 3 phase power panels PP-7A-A-A and PP-8-A-A-A are not modeled in the PRA and will use the source motor control center or power panel as a conservative surrogate. This is conservative because additional PRA loads will be impacted by the surrogate being inoperable.

16. 125 VDC distribution panels DP-S1-1E and MC-S1-2D are not modeled in the PRA and will use the source motor control system or power panel as a conservative surrogate.

!

GO2-22-096 Attachment Audit Question Responses Page 18 of 46

17. A qualified offsite circuit meets GDC-17 requirements and consists of all breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit AC power from the offsite transmission network to the onsite Class-1E 4.16kV ESF switchgear buses.

18. Energization transients of any DC loads that are beyond the capability of the battery charger and normally require the assistance of the battery will not be able to be brought online. To maintain the function of the valves supplied by the 250 VDC system, diverse AC-powered isolation valves are required to be available to maintain the function. This is consistent with TS 3.8.4 Bases.

19. Energization transients of any 250 DVC loads that are beyond the capability of the charger may fail the charger. To bound this condition with the 250 VDC battery unavailable, the Basic Event E-C2-1 UNABLE TO MAINTAIN DC LOADS will be set to TRUE.

20. Loss of any DC electrical power subsystem does not prevent minimum safety function from being performed. No situation exists where single DC bus failure would prevent plant personnel from achieving a reactor cold shutdown condition.

Audit Question 12 (APLA/APLC) Parts 1 through 4 - PRA Modeling and Uncertainty of FLEX Equipment and Actions

Response

1) The selected Human Failure Events (HFEs) are those credited in the PRA for initiating the credited Diverse and Flexible Coping Strategies (FLEX) strategies. For the sensitivity study, the HFEs and FLEX equipment were failed (TRUE) so that no credit was given to FLEX for the sensitivity. This is bounding as FLEX is completely removed from credit in the PRA. This is true for all hazards.

2) Sensitivities were selected based on a review of accident sequences and LCOs that would be impacted by FLEX credit. Combinations of LCOs were also selected from these sensitivities that were perceived as sensitive to FLEX credit.

3) Table APLA-Q12.1 below summarizes the impact of FLEX equipment on RICT durations for the chosen sensitivities.

!

GO2-22-096 Attachment Audit Question Responses Page 19 of 46 Table APLA-Q12.1. FLEX Sensitivity Results RICT Configurations Base RICT (days)

FLEX Not Credited RICT (days)

Change RICT Difference (hours)

RCIC 30.00 30.00 0.0%

0 RHR-A 30.00 30.00 0.0%

0 RHR-B 30.00 30.00 0.0%

0 HPCS 18.87 18.67

-1.1%

-4.8 4 kV LOV Div B & DG3 5.94 5.80

-2.4%

-3.4 SW-B & DG3 4.43 4.38

-1.0%

-1.1 No configurations were identified that had a significant change in RICT. A 5% or larger change would be considered for significance review.

4) Neither the FLEX human error probabilities nor FLEX equipment failure probabilities are key sources of uncertainty based on the results of the sensitivities.

Audit Question 13 (APLA) Part e - TS 5.5.16, Proposed Administrative Controls for the RICT Program

Response

Energy Northwest agrees that the phrasing contained in Attachment 1 of Reference 1 (page 6 of 15), specifically, methods approved for use with this program in Amendment No. [###] provides more clarity than the phrasing in the administrative controls for the RICT program in TS 5.5.16 paragraph e (see Insert 2 of Attachment 2 of Reference 1).

Therefore, Energy Northwest proposes to replace paragraph e with the following:

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2.

Methods to assess the risk from extending the Completion Times must be PRA methods approved for use with this program in Amendment No. [###], or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

!

GO2-22-096 Attachment Audit Question Responses Page 20 of 46 Audit Question 02 (APLB) Parts ii through iv - Deviations from NRC Endorsed Guidance as Source of Modeling Uncertainty

Response

ii.) The CGS Fire PRA includes treatment of sensitive electronics as targets consistent with the guidance in NUREG/CR-6850 and NRC Frequently Asked Question (FAQ) 13-0004. Based on the ignition source walkdowns performed during the development of the Fire PRA, the physical analysis units (PAU) listed below are those in which sensitive electronics are assumed to be present. These PAUs include those housing the main set of control and relay panels supporting the plant. In order to account for sensitive electronics, the scenario development strategy consisted of failing the ignition source and any adjacent panel at the time of ignition or within the zone of influence very early in the event.

x The main control room (Fire Area RC-10): The main control board and all electrical cabinets (including those containing sensitive electronics) within the zone of influence of a source are failed at ignition (at t = 0, no credit for detection or suppression). This PAU was evaluated for hot gas layer conditions in support of main control room abandonment. The fire modeling results suggest that only large fires in the main control board generate hot gas layers descending under the cabinets within 5 to 10 minutes after fire starts. These are conditions that would generate temperatures inside closed cabinets affecting the sensitive electronics.

At these times, control room abandonment has been triggered due to smoke descending at operators height (e.g., visibility conditions, etc.). Therefore, the impact of failure of sensitive electronics is captured in the analysis as control room abandonment due to habitability will force shutdown from outside the main control room without relying on shutdown capabilities within the main control room.

x The High Pressure Core Spray (HPCS) diesel generator room (Fire Area DG-1):

This PAU is modeled as a full compartment burn (i.e., all Fire PRA targets failed at time of ignition) with the exception of selected cables that were subjected to detailed fire modeling analysis.

x The diesel rooms (Fire Areas DG-2 and DG-3): These PAUs are modeled as full compartment burn. Therefore, all Fire PRA targets are failed at time of ignition.

x General equipment areas in the reactor buildings R-1-E471 and R-1-E522: These are large areas of the reactor building where detailed fire scenarios have been defined. All electrical cabinets (including those containing sensitive electronics) within the zone of influence of a source are failed at ignition (at t = 0, no credit for detection or suppression). In addition, all equipment targets (i.e., targets other than cables in conduits or cable trays) credited in the Fire PRA are failed in the first two damage states within four minutes from ignition and before a damaging hot gas layer is generated at the height of the ignition sources. Therefore, fire

!

GO2-22-096 Attachment Audit Question Responses Page 21 of 46 modeling treatment of sensitive electronics in this compartment is conservative relative to the damage criteria in FAQ 13-0004.

x PAUs in the Vital Island, including:

o Switchgear room #1 (Fire Area RC-14) o Division 1 electrical equipment room (Fire Area RC-4) o Division 2 electrical equipment room (Fire Area RC-7) o Switchgear room #2 (Fire Area RC-8)

All electrical cabinets in these four PAUs (including those containing sensitive electronics) within the zone of influence of a source are failed at ignition (at t = 0, no credit for detection or suppression). In addition, all equipment (i.e., targets other than cables in conduits or cable trays) targets credited in the Fire PRA are failed in the first two damage states within four minutes from ignition and before a damaging hot gas layer is generated at the height of the ignition sources. At four minutes, the hot gas layer temperature as predicted by the CFAST software (with no credit for Heat Soak model) is less than 65o C. Therefore, sensitive electronics outside the zone of influence are failed within four minutes from ignition and before hot gas layer reaches 65o C. This is conservative relative to the damage criteria in FAQ 13-0004.

The treatment for sensitive electronics described above for each of the PAUs in which sensitive electronics are assumed to be present does not rely on caveats about configurations that can invalidate the technical approach. Specifically: 1.) no credit is taken for thermoset damage criteria for calculating a time to damage for sensitive electronics (i.e., cabinets with PRA targets are assumed damage at ignition), 2.) sensitive electronics are failed at the time of ignition for the cabinets of fire origin, 3.) for PAUs modeled as full compartment burn, sensitive electronics are failed at time zero (i.e., no credit for time to damage), 4.) walkdowns of these fire compartments confirmed that doors to the electrical cabinets in these compartments are closed. Further, the contents of the cabinets in these compartments are not mounted to the door but are instead recessed into the cabinet itself.

iii.) The treatment for sensitive electronics is consistent with FAQ 13-0004.

iv.) The treatment for sensitive electronics is consistent with FAQ 13-0004. No implementation item to replace the current approach with an acceptable approach prior to the implementation of the RICT program is necessary.

!

GO2-22-096 Attachment Audit Question Responses Page 22 of 46 Audit Question 1 (EICB) Parts a and b - Manual Scrams and Manual Trips

Response

a.) The following Manual Scrams are not modeled in the PRA:

x Function 1b, Intermediate Range Monitors - Inop [Inoperable]

x Function 2c, Average Power Range Monitors - Neutron Flux - High x Function 2d, Average Power Range Monitor - Inop x Function 2e, Average Power Range Monitors out-of-4 Voter x Function 5, Main Steam Isolation Valve Closure, Final Safety Analysis Report (FSAR) Section 15.6.4, Steam System Piping Break Outside Containment (Reference 31)

The following Manual Scram is implicitly modeled for a limited set of accident sequences using Event CE2, ELECTRICAL FAILURE OF SCRAM + MANUAL SCRAM, NUREG/CR-5500. Credit for manual scram is given for small LOCA and Stuck Open Relief Valve sequences only. All other accident sequences do not credit manual scram and use the Event CE, ELECTRICAL FAILURE OF SCRAM SYSTEM NUREG/CR-5500, which does not credit manual scram. For more details regarding the modeling of the RPS functions, see the response to Audit Question APLB-05.

x Function 10, Reactor Mode Switch - Shutdown Position Below is a discussion on Columbia operations procedures and times associated with the actions evaluated as adequate.

1) Function 1b, Intermediate Range Monitors - Inop [Inoperable] is not credited in any FSAR transient/accident. Therefore, there is no FSAR required time. IRMs are bypassed at significant power [when the mode switch is turned to run (Mode 1)]. In Mode 2, the Average Power Range Monitor Neutron Flux - High (Setdown) provides automatic protection. Plant procedure PPM 1.3.1, Step 4.8.3.d fourth bullet includes the direction for operators to scram prior to exceeding an RPS setpoint. Operators are trained on scram setpoints regularly and the annunciator response procedures include setpoints. Plant procedure PPM 3.3.1 immediate actions describe inserting a manual scram by placing the mode switch in shutdown and depressing the manual scram pushbuttons.

2) Function 2c, Average Power Range Monitors - Neutron Flux - High. FSAR Section 15.1.6 Inadvertent Residual Heat Removal Shutdown Cooling Operation credits operator action to limit power rise after 10 minutes. The operating crews are trained on reactivity control regularly and prior to planned startups and shutdowns. The operating crews use the station developed control rod pull sheets in conjunction with the startup (PPM 3.1.2) and

!

GO2-22-096 Attachment Audit Question Responses Page 23 of 46 shutdown (PPM 3.2.1) procedures. Slow positive reactivity additions can be compensated for by inserting control rods either during a startup or shutdown.

Additionally, PPM 1.3.1, Step 4.8.3.d fourth bullet includes the direction for operators to scram prior to exceeding an RPS setpoint. Operators are trained on scram setpoints regularly and the annunciator response procedures include setpoints. PPM 3.3.1 immediate actions describe inserting a manual scram by placing the mode switch in shutdown and depressing the manual scram pushbuttons. Additionally, Function 2b, Simulated Thermal Power - High is a diverse instrumentation to Function 2c, Average Power Range Monitors -

Neutron Flux - High for the FSAR transient accident Inadvertent Residual Heat Removal Shutdown Cooling Operation in FSAR Section 15.1.6. Therefore, Manual Scram or Manual Trip is not solely relied upon as a diverse means for Function 2c, Average Power Range Monitors - Neutron Flux - High.

3) Function 2d, Average Power Range Monitor - Inop is not credited in any FSAR transient/accident. Therefore, there is no FSAR required time. Plant procedure PPM 1.3.1, Step 4.8.3.d fourth bullet includes the direction for operators to scram prior to exceeding an RPS setpoint. Operators are trained on scram setpoints regularly and the annunciator response procedures include setpoints.

Plant procedure PPM 3.3.1 immediate actions describe inserting a manual scram by placing the mode switch in shutdown and depressing the manual scram pushbuttons.

4) Function 2e, Average Power Range Monitors Out-of-4 Voter is implicitly assumed in the accident and transient analyses. Failure of this function would fail the following functions:

x 2a, Neutron Flux - High (Setdown) x 2b, Simulated Thermal Power - High x 2c, Neutron Flux - High x 2d, Inop x 2f, OPRM Upscale Functions 2a, Neutron Flux - High (Setdown), 2b, Simulated Thermal Power -

High, 2d, Inop, and 2f, OPRM upscale are not credited in any FSAR transient/accidents.

Function 2c, Neutron Flux-High is credited in FSAR Section 15.1.6 Inadvertent Residual Heat Removal Shutdown Cooling Operation, 15.4.9 Control Rod Drop Accident, and 15.2.1 Pressure Regulator Failure - Close. Failure of Function 2e, Average Power Range Monitors Out-of-4 Voter does not impact the diverse Instrumentation listed in Attachment 6 for Function 2c, Neutron Flux-High except for the Inadvertent Residual Heat Removal Shutdown Cooling Operation, which is discussed above.

!

GO2-22-096 Attachment Audit Question Responses Page 24 of 46 Furthermore, procedure PPM 1.3.1, Step 4.8.3.d fourth bullet includes the direction for operators to scram prior to exceeding an RPS setpoint. Operators are trained on scram setpoints regularly and the annunciator response procedures include setpoints. PPM 3.3.1 immediate actions describe inserting a manual scram by placing the mode switch in shutdown and depressing the manual scram pushbuttons.

5) Function 5, Main Steam Isolation Valve - Closure. After further review Function 4, Reactor Vessel Water Level - Low, Level 3 is a diverse Instrumentation to Function 5 for FSAR Section 15.6.4 Steam System Piping Break Outside Containment. Therefore, Manual Scram or Manual Trip is not solely relied upon as a diverse means for Function 5, Main Steam Isolation Valve - Closure.

Furthermore, procedure PPM 1.3.1, Step 4.8.3.d fourth bullet includes the direction for operators to scram prior to exceeding an RPS setpoint. Operators are trained on scram setpoints regularly and the annunciator response procedures include setpoints. PPM 3.3.1 immediate actions describe inserting a manual scram by placing the mode switch in shutdown and depressing the manual scram pushbuttons.

6) Function 10, Reactor Mode Switch - Shutdown Position is not credited in the FSAR transient accident. Therefore, there is no FSAR required time. Procedure PPM 1.3.1, Step 4.8.3.d fourth bullet includes the direction for operators to scram prior to exceeding an RPS setpoint. Operators are trained on scram setpoints regularly and the annunciator response procedures include setpoints.

PPM 3.3.1 immediate actions describe inserting a manual scram by placing the mode switch in shutdown and depressing the manual scram pushbuttons.

b.) Function 3c, Reactor Vessel Water Level - High, Level 8 is listed to maintain continuity of functions to match the TS table.

Audit Questions 1.a through 10.b.2 (EEEB) - Electrical Engineering Branch (EEEB)

Audit Questions

Response

Revisions to Table E1-1, In-Scope TS/LCO Conditions to Corresponding PRA Functions, are shown following the responses to the follow-on questions submitted by the NRC staff.

1.a)

Remove the information on diesel generators; keep note but move to notes section with a footer to reference the note. Keep the information on the offsite circuit.

1.b)

Function should not be called out in Column 3, only in Column 5.

1.c)

Yes.

!

GO2-22-096 Attachment Audit Question Responses Page 25 of 46 2.a)

Reference note has been removed.

2.b)