L-2016-116, Response to Request for Additional Information Regarding License Amendment Request 236, Revision to TS to Adopt Risk Informed Completion Time TSTF-505, Revision 1,Provide Risk-Informed Extended Completion Times.
| ML16180A178 | |
| Person / Time | |
|---|---|
| Site: | Turkey Point  |
| Issue date: | 06/16/2016 |
| From: | Summers T Florida Power & Light Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| L-2016-116 | |
| Download: ML16180A178 (15) | |
Text
June 16, 2016 L-2016-116 10 CFR 50.90 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555-0001 Re: Turkey Point Nuclear Plant, Units 3 and 4 Docket Nos. 50-250 and 50-251 Response to Request for Additional Information Regarding License Amendment Request 236, Revision to the Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 48"
References:
- 1. Florida Power & Light Company letter L-2014-369, "License Amendment Request No. 236 Revision to the Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 1, 'Provide Risk-Informed Extended Completion Times - RITSTF Initiative 48'," December 23, 2014(ML15029A297)
- 2. NRC E-mail "Request for Additional Information re. Turkey Point 3 & 4 LAR-236 (CACs MF5455 & MF5456)," April 14, 2016(ML16105A459)
- 3. NRC E-mail "Request for Additional Information - Turkey Point 3 & 4 LAR-236 (CACs MF5455 & MF5456)," April 18, 2016(ML16110A004)
- 4. NRC E-mail "Request for Additional Information re. Turkey Point 3 & 4 LAR-236 (CACs MF54555 & MF5456)," June 1, 2016 In Reference 1, Florida Power & Light Company (FPL) submitted license amendment request (LAR) 236 for Turkey Point Units 3 and 4. The proposed amendment would revise the technical specifications (TS) to implement TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times RITSTF [Risk Informed TSTF] Initiative 4b."
In References 2, 3, and 4, the NRC staff requested additional information to complete its review of the LAR. The Enclosure to this letter provides FPL's response to the request for additional information. As discussed with the NRC staff, FPL will provide its response to the four remaining questions (EIC8 RAI 3, EIC8 RAI 5, APLA RAI 8, and S8P8 RAI 1) by August 12, 2016.
This response does not alter the conclusion in Reference 1 that the changes do not involve a significant hazards consideration pursuant to 10 CFR 50.92, and there are no significant environmental impacts associated with the changes.
Florida Power & Light Company 9760 SW 344th Street, Homestead, FL 33035
L-2016-116 Page 2of2 No new or revised commitments are included in this letter.
Should you have any questions regarding this submittal, please contact Mr. Mitch Guth, Licensing Manager, at (305) 246-6698. I declare under penalty of perjury that the foregoing is true and correct.
Executed on June Ib '2016 Sincerely, r=-t~~-
Thomas Summers Site Vice President Turkey Point Nuclear Plant Enclosure cc: NRG Regional Administrator, Region II NRG Senior Resident Inspector NRG Project Manager Ms. Cindy Becker, Florida Department of Health
L-2016-116 Enclosure Page 1 of 13 ENCLOSURE Response to Request for Additional Information Regarding License Amendment Request 236, Revision to the Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 1, "Provide Risk-Informed Extended Completion Times - RITSTF Initiative 48"
L-2016-116 Enclosure Page 2 of 13 EICB RAls TSTF-505 generally allows two types of changes to TSs: (1) using risk-informed completion times (RICTs) for some existing actions, and (2) allowing operation in a condition where two or more redundancies are TS INOPERABLE so long as one or more redundancies is PRA Functional and there is not a total loss of function. The questions below are mainly concerned with the second of these two types of changes.
EICB RAI 1 General
Background:
A nuclear power plant (NPP) control system controls plant operations within parameters required by the safety analysis report (SAR) using both manual and automatic means. When NPP operation exceeds monitored parameters and enters into an unsafe condition as a result of control system failure or through operational error, the NPP protection system is designed to restore the plant to a safe state. Control system failure is mitigated by the prot~ction system, whereas the protection system cannot be tolerated to fail and, therefore, it is designed to meet the single failure criterion, among other criteria. In summary, improper operation or failure mu~t be mitigated by the protection system even when the protection system is degraded by a single failure.
Westinghouse-Specific
Background:
NPPs, including Westinghouse plants, may share protection system parameter inputs between both reactor protection and control systems.
Regulatory requirements for sharing equipment and parameter inputs essentially prescribe that additional redundancy or additional design features must be designed into the protection system when there is equipment shared between protection and control systems. In addition, IEEE 279-1971, Clause 4.7.1 requires that shared equipment must be classified as part of the protection system, and Clause 4.7.3 requires that the any failure of shared protection and control equipment must be mitigated by the protection system even when the remaining portions of the protection system are degraded by a single failure (i.e., treating the failure of the shared equipment as the event that must be protected against). Generally, Westinghouse Technical Specifications (TSs) limit the time a plant is allowed to operate with one required instrument
. channel inoperable in either the reactor trip system (RTS) or engineered safety features actuation system (ESFAS) or both. The TS condition remedial action has been determined to be consistent with SAR design criteria and supporting analyses.
The licensee's LAR for adoption of TSTF-505 proposes to allow plant operation in a condjtion where two or more RTS and ESFAS instrumentation channels are inoperable, potentially coupling protection and control systems, and potentially creating the possibility of a new or different kind of accident, anticipated operational occurrence, or condition requiring protective action (i.e., events). The staff needs additional information to understand how: (1) no new events requiring protection exist in the proposed new conditions, (2) all original events are protected against, and (3) PRA modeling adequately addresses protection and control interactions.
A. For the RTS and ESFAS functions addressed by this LAR, please identify all of the instances where equipment or information is shared between protection and control systems.
L-2016-116 Enclosure Page 3of13 B. For each instance, please state whether extra redundancy or a design feature is used to address the "Separation of Protection and Control" criteria.
C. Please describe how each design features eliminates the need for extra redundancy, and how each behaves when there are a reduced number of redundancies:,
FPL Response FPL notes Turkey Point (PTN) currently meets the proposed 1967 General Design Criteria (GDC). GDC 20 is met. FPL further notes that it is the TS Conditions, Required Actions, and their associated Completion Times which specify the limited period of operation where the single failure criterion is not met; the LCO specifies the minimum equipment requirements for unlimited continued operation. Further NEI 06-09 Revision 0-A implemented by TSTF-505 provides a method acceptable to the NRC for determination of this limited time, as an alternative to the fixed times in the Standard TS.
Per PTN LAR L-2014-369, Table 1, FPL limited the scope of their request for RICT for Protection and Control functions to Manual Reactor Trip and Reactor Trip breakers for RTS, and nine auto ESFAS Signals and three manual initiation signals for ESF.
A. Channel independence is carried throughout the system, extending from the sensor to the relay actuating the protective function. The protective and control functions when combined are combined .only at the sensor. The protective and control functions are fully isolated in the remaining part of the channel, control being derived from the primary protection signal path through an isolation device. A failure in the control circuit, therefore, does not affect the protection channel.
B. Isolation of the entire control and protection systems includes all channels except those for steam generator level. The steam generator water level signal is monitored by the control system for sudden changes such that a spurious high water level signal from the protection channel used for control will not close the feedwater control valve; instead, the feedwater controller will reject to MANUAL when the spurious signal is detected. This condition is alarmed such that failure is promptly detected. This level channel is independent of the level channels used for reactor trip on steam/feedwater flow mismatch coincident with low steam generator level.
C. As stated in B, a spurious high water level signal from the protection channel used for control will not close the feedwater control valve; instead, the feedwater controller will
_ reject to MANUAL.
EICBRAI 2 IEEE 279, Clause 3 states:
The design basis shall document as a minimum ... The minimum number and location_of sensors required to monitor adequately, for protective purposes, those variables ... that have spatial dependence.
The Model Application to TSTF-505, Revision 1, Enclosure 1 states:
L-2016-116 Enclosure Page 4of13 The licensee lists each TS Required Action to which the RICT Program may be applied and, for each Required Action, describes the corresponding SSC and associated function modeled in the PRA. This is to include the applicable success criteria used in the PRA model compared to the licensing basis criteria; arid if applicable a disposition of any differences which justifies use of the PRA success criteria when calculating RICTs.
A. Please identify all RTS & ESFAS variables (associated with this LAR) that have spatial dependence.
- 8. Please explain how special [sic - spatial] dependency is accounted for in the determination of probabilistic risk assessment (PRA) Functional or "loss of function" of the associated sensors.
Note: Section 3.2.3 of NRG-approved Topical Report (TR) NEI 06-09, "Risk Informed .
Technical Specifications Initiative 4b: Risk Managed Technical Specification (RMTS),"
Revision 0-A (ADAMS Accession No. ML12286A322) states:
If a degraded or nonconforming condition existing on a component can be explicitly modeled by the station's PRA, then a situation specific RICT can be calculated. In these cases the PRA analysis supporting the RICT calculation must be documented, retrievable, and able to be referenced using normal operator documentation mechanisms (e.g., Control Room Logs or other equivalent methods). In the RICT calculation, equipment PRA functionality may be considered. The evaluation for the applicability of crediting "PRA functionality" shall be conducted in accordance with the guidance provided in Item 11 of Section 2.3.1. This guidance is intended to address separate operability and PRA functionality assessments which would allow a component to be considered both inoperable and PRA functional based on an evaluation of the same degraded condition.
If the condition causing a component to be inoperable is not modeled in the PRA, and the condition has been evaluated and documented in the RMTS program as having no risk impact, then the RICT may be calculated assuming availability of the inoperable component and its associated system, subsystem or train. If there is no documented basis for exclusion, or if the condition was screened as low probability, then the
- inoperable component must be considered not functional.
FPL Response FPL notes PTN currently meets the proposed 1967 General Design Criteria (GDC). GDC 20 is met. FPL further notes that it is the TS Conditions, Required Actions, and their associated Completion Times which specify the limited period of operation where the single failure criterion is not met; the LCO specifies the minimum equipment requirements for unlimited continued operation. Further, NEI 06-09 Revision 0-A implemented by TSTF-505 provides a method acceptable to the NRG for determination of this limited time, as an alternative to the. fixed times in the Standard TS.
L-2016-116 Enclosure Page 5 of 13 Per PTN LAR L-2014-369, Table 1, FPL limited the scope of their request for RICT for Protection and Control functions to Manual Reactor Trip and Reactor Trip breakers for RTS, and nine auto ESFAS Signals and three manual initiation signals for ESF.
A. PTN does not note any RTS/ESFAS variables associated with this LAR that have spatial dependence.
B. N/A.
EICB RAI 4 NEI 06-09 Rev. 0-A states that a RICT cannot be used in a condition where there is a total loss of TS specified safety function; however, the LAR does not describe how it will be determined if there is a total loss of safety function.
For each l&C function where there is a proposed ACTION for the condition where there are two or more INOPERABLE redundancies, please describe the process of how it will be determined if there is a total loss of TS specified safety function.
FPL Response Loss of a TS specified safety function will not result if a sufficient number.-of channels remain operable or PRA functional to initiate a reactor trip or engineered safety features actuation signal when plant parameters exceed the actuation setpoint. For manual actuations with two redundant channels, at least one channel must be operable or PRA functional to provide manual actuation capability. For automatic actuations involving a 2-of-3 or 2-of-4 actuation logic, at least two channels must remain operable or PRA functional to initiate automatic actuation. A functional channel may include an inoperable channel that is in the tripped condition.
EICB RAI 6 For each FUNCTIONAL UNIT in TS Tables 3.3-1 & 3.3-2 (addressed by this LAR), please identify the minimum number of channels that must be OPERABLE or PRA Functional for there not to be a total loss of TS specified safety function.
FPL Response As discussed in the response to EICB RAI 4, for manual actuations with two redundant channels, at least one channel must be operable or PRA functional to provide manual actuation capability. For automatic actuations involving a 2-of-3 or 2-of-4 actuation logic, at least two channels must remain operable or PRA functional to initiate automatic actuation. The table .
below identifies the minimum number of channels that must be operable or PRA functional to avoid a total loss of TS specified safety function (for the instrumentation functions to which TSTF-505 is being applied).
L-2016-116 Enclosure Page 6of13 No. of Channels Total No. to Meet Safety Functional Unit of Function Channels {No. of channels to trip)
.:,_:.::: :* ;, .: ::~".: .** ' "*::. ; > *: ' ' 'i' :* ' ,,*:** .'* *: * ".' :* .. ::* ,': . ' .. :*'"* *. ,,,;;' ':**: '::* : * "'"" :* ::. : : *: ' : *, *:* .. *; :, :. *'.- ' *,'
.T~xkeY)~qii:~!* tJt1i!~:*~ :~:4:*~*.T;~ ;!~?!:~: 3:?-S 1~~.~~:oCf:.~ir p?stE:}'!1 ln~tr~m*ert~:tip,~:~ : . . . ~* . , : . s..,** * :
- 1. Manual Reactor Trip 2 1
- 19. Reactor Trip Beakers 2 1 No. of Channels Total No. to Meet Safety Functional Unit of Function Channels {No. of channels to trip)
- ,.:*:.,::"" ** :.... *.... :: .. ::., <<: ... :.:* :*~*.: . : . * .... ,* .. : * . .:,,*':<::-'.*c' * .:*..*/.*'"'/*)::.. **; . . . *: *.: .""* . . *':.:**.. ".... :*: .. y: * ** .i4 Ju_tkey.Pbii'Jt.Units*:3r&4.*-:tJ$ T~ble*:3.G'~9; E;Qgil'H;iere~d ;S~f~ty.P~.citµres ActLiatib'r:t syst~rti; ** *
.*.rt, :r. ,'. '..... :':' , *:*. _';. .:. . *. :.: ' ,. . *.. :. :* .
T~~trurpe~taU?h': ..:*; ,:* :* ;: :~* ~:; >*.. " ,/'. ,:
1.a. Safety Injection Manual Initiation 2 1 1.c. Safety Injection Containment Pressure-High 3 2 1.d. Safety Injection Pressurizer Pressure Low 3 2 1.e. Safety Injection High Differential Pressure Between 3 per 2 per steam line in Steam Line Header and any Steam Line steam line any steam line 1 per steam line in 2 per 1.f. Safety Injection Steam Line Flow - High any two steam steam line lines 1 per 1 per steam 1.f. Safety Injection Steam Line Flow - High Coincident with steam generator in any Steam Generator Pressure - Low generator two steam lines 1.f. Safety Injection Steam Line Flow - High Coincident with 1 per loop 1 per loop in any Tavg - Low two loops 2.b. Containment Spray Containment Pressure - High High 3 2 2.b. Containment Spray Containment Pressure - High High 3 2 Coincident with Containment Pressure - High 3.a.1 Containment Isolation Phase A Manual Initiation 2 1 3.b.1 Containment Isolation Phase B Manual Initiation 2 2 3 per 2 per steam 6.b. Auxiliary Feedwater Steam Generator Water Level -
steam generator in any Low- Low generator steam generator 7.a. Loss of Power 4.16 kV Buses A and B (Loss of Voltage) 2 per bus* 2 per bus 7.b. Loss of Power 480 V Load Centers 3A, 3B, 3C, 30 and 2 per load 2 on any load 4A, 4B, 4C, 40 Undervoltage center center 7.c. Loss of Power 480 V Load Centers 3A, 3B, 3C, 30 and 2 per load 2 on any load 4A, 4B, 4C, 40 Dearaded Voltage center center
L-2016-116 Enclosure Page 7of13 APLA RAls APLA RAI 1 - Internal events PRA The internal events peer review results from the 2002 Peer-Review in Table 1 of the LAR includes facts and observations (F&Os) labeled AS-1, AS-2, AS-3, and AS-9 (Table 1 does not include the corresponding Supporting Requirements (SR) for the F&Os) that identify a number of success criteria that were either not properly modelled in the PRA or were not properly developed. The disposition of these F&Os all indicate that additional evaluation was performed and the PRA was sometimes changed. The status of all the F&Os is assigned "closed." The NRG staff notes that the only currently accepted F&O closure path is the use of the Peer Review process (i.e., subsequent peer review on the same SR as covered in the F&O). It is important to have accurate success criteria when calculating RICTs and when using "PRA Functional."
- A. Summarize how the post 2002 Peer-Review success criteria evaluations were performed and documented against the ASME/ANS RA-Sa-2009 PRA Standard.
B. Clarify how the review conducted on the new success criteria evaluations is consistent with current peer review guidance.
FPL Response A. The success criteria (SC) for the Turkey Point PRA model are documented in PTN-BFJR-09-014, Turkey Point PSA Success Criteria for Extended Power Uprate, Revision 1, 6/7/14. SC listed in this calculation were mostly taken from the results of available computer simulations using the Modular Accident Analysis Program (MAAP) program with Turkey Point plant-specific files. For events, systems, or components which were not simulated using MAAP, Turkey Point plant-approved references were used to establish the applicable SC.
In the document PTN-BFJR-09-014, the calculation and documentation of the SC calculations were evaluated against the SC SRs of the ASME/ANS RA-Sa-2009 PRA Standard. All of the SRs met the requirements of Capability Category II or higher.
B. As mentioned above, in the document PTN-BFJR-09-014, the calculation and documentation of the SC calculations were evaluated against the SC SRs of the ASME/ANS RA-Sa-2009 PRA Standard. The grading of the NEI 00-02 SC requirements as well as the related F&Os were fully considered in this assessment.
All of the SRs met the requirements of Capability Category II or higher. Additional validation of proper resolution of the F&Os will be performed via ari independent review of the closure.
L-2016-116 Enclosure Page 8of13 APLA RAI 2 - Fire PRA The results of the fire PRA peer review given in Table 2 of the LAR are the same as given in Table V-3 of the NFPA 805 transition LAR. The NRG staff review of the NFPA 805 LAR resulted in a number of RAls on the disposition of the fire PRA F&Os for the NFPA 805 application. At the conclusion of the NFPA 805 fire PRA review, the response to NFPA PRA RAI 29 under letters dated April 4, 2014 (ADAMS Accession' No. ML14113A176), and July 18, 2014 (ADAMS Accession No. ML14213A078), summarized a variety of method and model changes that were required to use only acceptable methods in the final NFPA 805 fire PRA. Is the fire PRA that will be used to support the RICT calculations the same fire PRA that was determined to be acceptable for the NFPA 805 transition and future self-approval? How does the licensee's maintenance and change process ensure that the latest model of record used in the RICT program reflects the as-built, as-operated plant?
- FPL Response Yes, the fire PRA that will be used to support the RICT calculations will be the same fire PRA that was determined to be acceptable for the NFPA 805 transition and future self-approval.
Per PRA Group procedure EN-AA-105-1000, PRA Configuration Control and Model Maintenance, plant design modifications are reviewed for their potential effect ori the PRA model. If a modification is judged to affect the PRA model, an entry is made into the Turkey Point PRA model change database, and an estimate is made of the risk impact. If it is minor, the change is made at the next scheduled model update. If it is major, a model change is conducted promptly. ,
APLA RAI 3-TS Limiting Conditions of Operation (LCOs) 3.6.1.7, 3.6.1.3, and 3.6.4 The disposition for PRA Success Criteria associated with TS LCO *3.6.1. 7 presented in the LAR, , Table E1-1, states: "The PRA Model includes an event which involves a large, pre-existing containment leak; this would be bounding for the risk associated with an inoperable air lock door closed, and can be used as a bounding surrogate." The disposition for PRA functionality associated with TS LCO 3.6.4 (Containment Isolation Valves) and TS LCO 3.6.1.3 (Containment Air Locks) also refers to use of this leak event in the PRA as a surrogate. Explain why the leakage for a "large pre-existing containment leak" is a "bounding surrogate" for the leak events above.
FPL Response It is a "bounding surrogate" because the existence of a "large pre-existing containment leak" coincident with a core damage sequence is sufficient to cause a large early release in the PRA model.
L-2016-116 Enclosure Page 9of13 APLA RAI 4 - TS LCO 3.6.2.1 In LAR, Tab~e E1-1, in the rows "3.6.2.1 Containment Spray (CS) System" and "3.6.2.1 Emergency Containment Cooling System," the "Disposition" column states, "Failure of the Emergency Containment Cooling function does not directly impact either core damage or large early release mitigation, but is modeled for level two PRA." TSTF-505, Revision 1, June 14, 2011, states "[t]he traveler will not modify Required Actions for systems that do not affect Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) or for which a Risk Informed Completion Time cannot be quantitatively determined." Clarify why Required Actions associated with these systems can be modified with respect to the TSTF guidance, and explain how a RICT based on CDF and .LERF can be quantitatively determined.
FPL Response Containment spray and emergency containment cooling do not directly impact CDF or LERF.
They are modeled in the Turkey Point PRA since their failure impacts other equipment that does impact CDF and late containment failure. Therefore, their impact on risk can be quantified for use in a RICT calculation using the PRA model.
APLA RAI .5 - Applicability of Guidance Table E9-1, "Disposition of Key Assumptions ... ," of the LAR includes a row starting with "GENERIC Impact of failure of RCS pressure relief." The "Discussion" column states, "[g]eneric success criteria based on GEOG guidance for pressure relief are used." Summarize the evaluation and results that lead to accepting the GEOG guidance as applicable to the 3-loop Westinghouse Turkey Point Units 3 and 4, FPL Response This was a mistake. Failure of RCS pressure relief in the Turkey Point PRA model is not based on GEOG guidance. It is based on a Turkey-Point-specific analysis, CN-TA-09-9, Turkey Point Units 3 and 4 A TWS Analysis for the Extended Power Uprate Program, Westinghouse Electric Company, Rev. 0, 06/09/2009. ,.....,
APLA RAI 6 - Minimum Joint HEPs Guidance in NUREG-1792, "Good Practices for Implementing Human Reliability Analysis (HRA)," (Table 2-1) recommends joint human error probability (HEP,) values should not be below 1E-05. Table 4-3 of EPRI 1021081, "Establishing Minimum Acceptable Values for Probabilities of Human Failure Events," provides a lower limiting value of 1E-06 for sequences with a very low level of dependence. F&O 4-24 from the FPRA peer review listed in LAR, , Table 2, states, " ... the reasonableness of risk-significant, post initiator HEPs relative to each other was not yet reviewed in the scenario context, plant history, procedures, operational practices, and experience." The peer review team noted that this F&O originated from SR HR-G6. Based on the disposition to this F&O, it appears that minimum joint HEPs were not applied in the internal events PRA and that no update was made to the PRA as a result of
L-2016-116 Enclosure Page 10of13*
this F&O. The NRG staff notes that underestimation of minimum joint probabilities could result in nonconservative RIGTs of varying degrees for different inoperable SSGs.
Furthermore, the staff has considered the license amendments adopting NFPA 805 (May 28, 2015, ADAMS Accession No. ML15061A237), which states regarding the clarification of the disposition of PRA RAI 29.c.i, "the licensee provided a sensitivity study applying a floor value of 1.0E-05 to all HEP combinations in the FPRA model," and "the licensee stated it applies a joint HEP floor value of 1.0E-05 in the updated PRA." The NRG concluded that the fire PRA values include an acceptable minimum joint HEP value, but these changes were not reviewed for internal events.
Given that it is not clear from the F&O disposition whether or to what extent a dependency analysis was performed as part of the HRA, and whether minimum joint probabilities were applied to combinations of HEPs appea~ing in the same cutset, provide the following:
A. Describe the HRA dependency analysis performed in response to this F&O used in the PRA and whether it is consistent with NRG accepted guidance. In the response, specifically address how each of the issues identified by the peer review was dispositioned. If the approach to performing HRA dependency analysis is not consistent with NRG guidance, then justify this departure ..
B. Also, confirm that each joint HEP value used in the internal events PRA below 1.0E-06 and each joint HEP used in the fire PRA below 1E-.05 includes. its own separate justification that demonstrates the inapplicability of the NUREG-1792 lower guideline values. Provide an estimate of the number of joint HEPs below the guideline values, discuss 'the range of values, and provide at least two different examples where justification has been developed.
G. If the assessment described in item b) has not been performed or if minimum joint probability "floor was not applied or the value of the "floor cannot be justified, then explain how underestimating joint human error probabilities impacts the RIGT estimates.
FPL Response
. A. The current Turkey Point Fire PRA model uses a joint HEP floor of 1E-05 in the dependency analysis, with no exceptions.
B. The current internal events model does not have a joint HEP floor. In the next internal events model update, however, a joint HEP floor of 1E-06 will be applied. If a joint HEP is assigned a probability lower than 1E-06, it will only be after a detailed review of the sequence to confirm that the timing, cues, manpower, and stress levels of the constituent HFEs justifies it. This model update will be completed and implemented before 4b implementation.
G. As mentioned above, the fire PRA model uses a joint HEP floor of 1E-05, and the current internal events PRA model does not h_ave a joint HEP floor. A sensitivity study showed that the effect on the.internal events GDF of a joint HEP floor of 1E-06 is minimal, less than a 5% increase. Therefore, the impact on the estimated RIGTs in the LAR is expected to be minimal. Regardless, a joint HEP floor will be implemented in the internal events model before 4b implementation.
L-2016-116 Enclosure Page 11 of 13 APLA RAI 7 - Translation to Configuration Risk Management Program {CRMP) Model Enclosure 8, Section 2.0, of the LAR describes the process that will be used to translate the baseline PRA models for use in the CRMP model to be used in the RICT Program. The description implies that the CRMP model has not yet been developed and, furthermore, the translation process itself does not appear to be fully developed. Specifically, some expected.
adjustments or changes to the baseline model are not identified, such as use of a plant availability factor for determining the average annual risk that would not be applicable to configuration-specific risk.
A. Summarize the translation process.
B. Provide a comprehensive discussion of the changes made to the baseline PRA model to produce the CRMP model and how it is assured that these changes are appropriate and comprehensive.
FPL Response A. The baselin.e PRA model is modified by removing mutually exclusive maintenance events logic excluding configurations prohibited by plant procedures or guidelines, and altering the flag file and alignment events to allow those using the risk .
monitoring software for a configuration-specific risk analysis to designate the alignments and configuration in effect at the time.
B. After the changes described above have been made to the baseline model to create the model to be used in the CRMP model, the CRMP model is exercised in the risk monitor and the results verified by comparing them to results obtained by quantifying the baseline model with the mutually exclusive event logic, alignments, and flags set appropriately.
\ APLA RAI 9- NFPA 805 Modification Implementation The NRC Safety Evaluation (SE) for NEI 06-09 (ADAMS Accession No. ML071200238) approved and provided limitations and conditions for use of the TR Section 4.0, Item 6, of the SE requires that the licensee provide the plant-specific total CDF and LERF to confirm that these are less than 1E-4/year and 1E-5/year, respectively. This is consistent with the risk acceptance guidelines in Regulatory Guide 1.174 (ADAMS Accession No. ML100910006).
~
In Table 5-1, Enclosure 5 of the application, the licensee provided baseline fire risks of 8.66E-05/year and 5.35E-06/year for CDF and LERF, respectively, for Unit 3, and 7.69E-05/year and 4.85E-06/year for CDF and LERF, respectively, for Unit 4.
\
The licensee also provided baseline fire risks in LAR Attachment W, Letter to U.S. Nuclear Regulatory Commission, "Turkey Point Nuclear Generating Station Units 3 and 4, Docket Nos.
50-250 and 50-251, Response to Request for Additional Information Regarding LAR No. 216, Transition to 10 CFR 50.48(c) - NFPA 805 Performance-Based Standard for Fire Protection,"
(ADAMS Accession No. ML14279A093). These post-NFPA-805-modification fire risk values are
L-2016-116 Enclosure Page 12of13 8.86E-05/year and 5.45E-06/year for GDF and LERF, respectively, for Unit 3, and 8.10E- -
05/year and 4.98E-06/year for GDF and LERF, respectively, for Unit 4.
The reported fire risk values in the different documents are similar but not the same. If the licensee receives the RICT amendment approval before the NFPA-modifications are completed and wants to implement the RICT program before the modifications are completed, then:
A. Provide an estimate of the total GDF and LERF for the as-built, as-operated plant at the time the RICT program will be implemented to ensure that it satisfies the limitations and conditions in Section 4.0, Item 6, of the NEI 06-09 SE.
B. Confirm that modifications that are not yet installed are not credited in the GDF and
-LERF calculation for each RICT calculation.
An alternative option to providing the information in parts A and B would be for the licensee to propose a license condition that delays implementation of the RICT program until the NFPA modifications are complete.
FPL Response A. The GDF and LERF for the as-built as-operated plant at the time of implementation of the RICT program cannot be determined at this time since several NFPA 805 modifications are being implemented. At the time of implementation of the RICT program, GDF, and LERF will be estimated based on modifications completed for
, NFPA 805 as well as other changes in the model. The RICT program will only be implemented if it satisfies the limitations and conditions in Section 4, item 6 of the NEI 06-09 SE.
B. At the time of implementation of RICT, any modifications that are not installed will not be credited in the estimation of GDF or LERF.
APLA RAI 10 - Human Action Surrogate Events The RICT program is equipment-oriented (e.g., SSCs may be out of service), but allows a proper surrogate to be used for the equipment not modelled in the PRA. In some instances
- Operator actions are used "as a surrogate to conservatively bound the risk increase associated with [certain] functions." For example, Table E1-1 of the LAR, under 3.3.2 for "Function 1a -
Safety Injection (SI) - Manual Initiation" states in the "Disposition" column that, "[t]he operator action for failure to actuate a manual SI will be used as a surrogate to conservatively bound the risk increase associated with this function." For each such surrogate in your PRA models, explain how the action fully models each different failure mode, and partial failure modes, of the equipment being represented by the action.
FPL Response There are two functions in Table E1-1 that are modeled using operator action surrogates: 3.3.1 Reactor Trip System Instrumentation Function 1 - Manual Reactor Trip, and 3.3.2 Engineered Safety Features Actuation System, (ESFAS) Instrumentation Function 1a - Safety Injection (SI)
L-2016-116 Enclosure Page 13of13
- Manual Initiation. The first is modeled using the surrogate operator action of failing to actuate a manual reactor trip. If this action is set to True in the PRA model, the failure of the manual reactor trip function in its entirety is set to True in the PRA model. Likewise, the second is modeled using the surrogate operator action of failing to manually actuate SI.* If this action is set to True in the PRA model, the failure of the manual SI actuation function in its entirety is set to True in the PRA model. In both cases, partial, different, and all-encompassing failure modes are bounded by the surrogate events.
APLA RAI 11 - Instrumentation Models Instrumentation is often not modelled in detail in PRAs and in.some cases is only modelled as a single, generic basic event generally representing all trains.
A Clarify how individual instrument unavailability can be accounted for in the RICT calculations that use a single basic event (e.g., TS 3.3.5 8.1).
- 8. Alternatively describe how instrumentation is modelled in sufficient detail in the PRA to appropriately model the different effects of different numbers of trains (e.g., one, two, three and four) unavailable in order to estimate a RICT.
FPL Response A If an individual instrument channel is inoperable, and the PRA does not include sufficiently detailed modeling of the instrument channel, then a RICT is conservatively calculated by assuming a bounding failure of other equipment or failure of an operator action as stated in Table E1-1. For example, TS 3.3.2, Function 7 (standard TS 3.3.5 8.1, 8.1 addressed in LAR TS action 18A) requires two channels (per bus/load center); this equipment is not modeled individually in the PRA. If one channel is inoperable, the remaining operable channel will not meet the 2/2 criteria. A bounding RICT is calculated in the PRA Model failing the basic event of the associated ESF function, which is a more limiting situation than one channel out of two being inoperable since the remaining operable channel is also not being credited.
B. Similar bounding calculations for the RICT Program are identified in Table E.1-1. The proposed TS changes for the RICT Program do not otherwise include individual instrument channels which are not modeled in the PRA.