ML022330259

Risk Informed Inservice Inspection Program - Response to Request for Additional Information

ML022330259
Person / Time
Site:	Palisades
Issue date:	08/08/2002
From:	Harden P Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TAC MB4420
Download: ML022330259 (25)

Text

NMC-Committed to Nuclear Excellence Palisades Operated by Nuclear Nuclear Management Plant Company, LLC August 8, 2002 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 DOCKET 50-255 - LICENSE DPR PALISADES NUCLEAR PLANT RISK-INFORMED INSERVICE INSPECTION PROGRAM - RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION (TAC NO. MB4420)

By letter dated March 1, 2002, Nuclear Management Company, LLC (NMC) requested approval to implement a risk-informed inservice inspection (ISI) program as an alternative to the American Society of Mechanical Engineers Code,Section XI, ISI requirements for piping at the Palisades Plant. The Nuclear Regulatory Commission (NRC) staff in their review of the subject program has requested additional information by letter dated June 13, 2002. NMC response to the NRC staff's request for additional information is enclosed.

SUMMARY

OF COMMITMENTS This letter contains no new commitments and no revisions to existing commitments.

Paul A. Harden Director, Engineering CC Regional Administrator, USNRC, Region III Project Manager, USNRC, NRR NRC Resident Inspector - Palisades Enclosure 27780 Blue Star Memorial Highway 0 Covert, MI 49043 Telephone: 616.764.2000

ENCLOSURE NUCLEAR MANAGEMENT COMPANY PALISADES NUCLEAR PLANT DOCKET 50-255 August 8, 2002 RISK-INFORMED INSERVICE INSPECTION PROGRAM RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION 23 Pages follow

REQUEST FOR ADDITIONAL INFORMATION RISK-INFORMED INSERVICE INSPECTION (RI-ISI) PROGRAM PALISADES PLANT NRC REQUEST - INTRODUCTION

1. In the enclosure to your letter dated March 1, 2002, Table 3.7-1 and the associatednotes indicate that, on the basis of theirjudgement, the expert panel moved 27 piping segments having risk reduction worth (RRW) values greaterthan 1.005 from being in the category of "high safety significant"(HSS) to "lowsafety significant"(LSS). The NRC staff recognizes that Topical Report WCAP-14572, Revision I-NP-A, allows the expert panel to use deterministicinformation to place segments with RRW values greaterthan 1.005 into the LSS category, but page 143 of the Topical Report states that HSS "segmentsshould not be classifiedlower by the expert panel without sufficientjustification that is documented as part of the [RI-ISI] program. The expert panel should be focused primarily on adding piping to the higherclassification." The expert panel apparently used three factors to move HSS segments to LSS: non-proceduralized operatoractions,proceduralizedoperatoractions, and other considerations. Each of these is addressedbelow:

1.1 OperatorActions The notes in Table 3.7-1 indicate that some of the segments were placed in the LSS category based upon the expert panel's judgment that the "with operatoraction"RRWs are credible and may be used as a basis for the segment classification, while the "withoutoperatoraction"RRWs are inappropriateand discarded.

The 'With" and "without"operatoraction rankings are intended to reduce the impact of the highly uncertainhuman errorevaluation on the categorizationto facilitatepreparationand review of short, template RI-ISI relief requests. Reducing the safety significant categorybased upon the expert panel'sjudgement about the likelihood of successful operatoractions weakens this important element in the approved process.

NRC REQUEST 1.1.1 Non-ProceduralizedOperatorActions The notes in Table 3.7-1 indicate that some of the operatoractions credited by the expert panel to move HSS segments into the LSS category are not proceduralizedactions. Crediting non proceduralizedoperatoractions is generally not acceptable in PRA analyses unless they are simple, skill-of-the-craft actions such as manually startinga standby pump following a failure of auto-start.

When the expert panel moves a HSS segment into LSS based upon an operatoraction, the judgement on the incredibilityof failure of the operatorto perform the requiredaction becomes the dominate contributorto the final disposition of the segment in RI ISI, and thereby of the inspection requirementsin the segment.

The actions requiredto mitigate pipe ruptures must be taken in response to highly unusual and stressful events such as loss of coolantaccidents (LOCAs) outside containment. The selection of the "with human action"RRW as the only credible result assumes that the operatorwill always succeed. This assumption is inconsistentwith acceptableprobabilisticrisk assessment (PRA) methodologies because it assumes the non-proceduralizedaction will always be successfully performed, and inconsistent with the approved RI-ISI methodology where the RRW values with and without operatoraction are used to reduce the sensitivity of the results on the highly uncertain human errorevaluation. The uncertaintiesin the evaluation of these actions are further increaseddue to the non-proceduralizedaction.

Because discardingthe without operatorerrorRRW negates a major element of the approved methodology, and recognizing the greaterthan normal uncertaintyassociatedwith evaluating the likelihood of success of non-proceduralizedactions, the NRC staff believes that sufficientjustification does not exist for moving HSS segments to LSS based on the judgement of the expert panel about the incredibilityof the "without operatoraction"RRW for non proceduralizedoperatoractions. Please identify all piping segments placed in the LSS category basedupon creditingnon proceduralizedactions,place the segments in the category specified in the Topical Report (e.g., HSS if any of the four RRWs is greaterthan 1.005), and modify your inspection location selection accordingly.

NMC RESPONSE 1.1.1 Non-Proceduralized Operator Actions The expert panel proposed moving the following 13 shutdown cooling (SDC) piping segments from a High Safety Significance (HSS) categorization (based on Risk Reduction Worth values) to Low Safety Significance (LSS) based on credit taken for actions not specifically detailed in a procedure:

SDC-002B1 SDC-007A2 SDC-012A1 SDC-002B2 SDC-009 SDC-012A2 SDC-005 SDC-O11A1 SDC-012A3 SDC-006 SDC-011A2 SDC-020 SDC-011A3 NMC used the WCAP-14572 methodology to credit operator actions for all SDC segments. The Westinghouse delta-risk analysis showed a risk reduction in the SDC system going from the current Section XI program to the RI-ISI program even with the above segments not receiving inspections. The additional documentation requested in this RAI will require significant additional time to prepare. In order to expedite the Staffs program review and thereby support the upcoming refueling outage at Palisades, NMC will leave the thirteen SDC segments in the HSS category and adjust the inspection schedule accordingly.

NRC REQUEST 1.1.2 ProceduralizedOperatorActions The notes in Table 3.7-1 indicate that some of the operatoractions credited are proceduralized. Proceduralizedactions must be more than credible before the "withoutoperatoraction"RRWs may be discarded. The failure of proceduralizedoperatoractions are not discarded (i.e., success assumed with a probability of 1.0) in PRA analyses. When the expert panel moves a HSS segment into LSS based upon an operatoraction, the judgement regardingthe likelihood of the action becomes the dominate contributorto the final disposition of the segment in the RI-ISI. Justificationand documentation of each of these actions must be of sufficient quality to support this judgement as the final arbitratorof safety significance. The justification for each action should include:

Identification of the procedurecontaining the required action.

The indicationsavailableto the operatorsto identify the specific action.

The location of the action.

- The time available to perform the action.

The time required to perform the action.

Identification and characterizationof the performance shaping factors that might influence the ability of the operatorsto accomplish the task.

An integrateddiscussion of the above informationjustifying that the failure of the operatorto perform the action is of such a low likelihood that the "withoutoperatoraction" RRW may be discarded.

Pleaseidentify all piping segments placed in the LSS category based upon creditingproceduralizedactions and provide a copy of the justification and documentation developed by the expert panel for each segment. If the originaldocumentation developed by the expert panel does not include the information discussed above, please provide a copy of the originaldocumentation that was developed, and also provide the requestedinformation.

NMC RESPONSE 1.1.2 Proceduralized Operator Actions The expert panel proposed moving the following 5 non-critical service water (NSW) and critical service water (CSW) piping segments, and 4 chemical and volume control (CVC) piping segments from a HSS categorization to LSS based on credit taken for proceduralized operator actions:

NSW-001 CSW-005B CVC-030A NSW-004 CSW-006B CVC-030B NSW-005 CVC-025 CVC-030C Non-Critical and Critical Service Water Segments NMC used the WCAP-14572 methodology to credit operator actions for all NSW and CSW segments. The Westinghouse delta-risk analysis showed a risk reduction in the NSW and CSW systems going from the current Section XI program to the RI-ISI program even with the above segments not receiving inspections.

The additional documentation requested in this RAI will require significant additional time to prepare. In order to expedite the Staff s program review and thereby support the upcoming refueling outage at Palisades, NMC will leave the five NSW and CSW segments in the HSS category and adjust the inspection schedule accordingly.

Chemical and Volume Control Segments Four CVC segments were moved from HSS to LSS based on proceduralized operator actions. The four segments are part of the letdown system and are downstream of the letdown isolation valve but upstream of the letdown orifices. Small break Loss Of Coolant Accident (LOCA) consequences are associated with the segments.

Isolation of letdown mitigates all consequences associated with the segments and all four have low "with operator action" RRW values.

Expert panel representatives discussed that isolating Primary Coolant System (PCS) leaks, especially the procedurally driven action to isolate letdown very early in the event, are actions trained on frequently by operations personnel. The panel also had confidence in quick control room recognition and response to pipe failures in containment. The combination of the panel's high confidence in the listed actions and the segments low RRW values "with operator action" were the primary basis for the judgment to move the above four CVC segments to LSS.

..and provide a copy of the justification and documentation developed by the expert panel for each segment."

Expert panel meeting documentation includes meeting minutes recorded during each panel meeting and the "Risk Informed Inspection Expert Panel Evaluation Segment Ranking Worksheets". There was a ranking worksheet reviewed by the panel for each piping segment. The sheets included detailed information about each segment. Included in the sheets were the RRW values for CDF and LERF both with and without operator action, as well as a detailed list of all the consequences associated with the segment. Operator actions associated with segments were also listed on the worksheet. Expert panel members were aware during the discussion that the actions listed on the sheet were ones with both diagnosis and action performed from the control room.

The following information was included on the worksheets for the four CVC segments:

Failure Effects on system (same for all four segments)

Without operator action: Small break LOCA initiating event and loss of letdown With operator action: Operator could close CV-2001 to isolate letdown and stop leak Refer to Table 1.1.1-1 below for the RRW values that were presented to the expert panel.

Table 1.1.1-1 RRW Values DFCDF LERF LR Segment CDF CFLERF w/Operator w/Operator action action CVC-025 1.0087 1.0001 1.0102 1.0000 CVC-030A 1.0083 1.0001 1.0086 1.0000 CVC-030B 1.0087 1.0001 1.0097 1.0000 CVC-030C 1.0083 1.0000 1.0099 1.0000 The following is an excerpt from the expert panel meeting minutes 10/11/2000:

Segments CVC-025, 030A, 030B, and 030C were all initially categorized as high safety significant. All of them were in the low safety significant category when credit was taken for the operator action. Operator actions listed for CVC to isolate Letdown in the event of a pipe failure are credible actions.

"Identificationof the procedure containing the requiredaction."

Off Normal Procedure (ONP) 23.1 "PCS Leak" Step 4.7.d "IF the leak is not isolated, then close CV 2001, Letdown Stop Valve" Emergency Operating Procedure (EOP) 1.0 "Standard Post Trip Actions" Instruction step 5 "Determine that PCS Inventory Control acceptance criteria are met" Contingency step 5.1.b "Manually operate charging and letdown" EOP 4.0 "Loss of Coolant Accident Recovery" Instruction step 9.b "Ensure closed Letdown Stop Valves CV-2001 and CV-2009" "T he indicationsavailableto the operatorsto identify the specific action."

A pipe failure in these segments (a PCS leak in containment) would have the following symptoms:

"* Volume Control Tank level lowering with lcw level alarm at 62.5%

"* Charging - Letdown mismatch greater than normal

"* Increased charging flow

"* Variable speed charging pump (P-55A) speed rises automatically

"* Automatic start of backup charging pump

"* Containment sump level rising

"* Radiation rise in containment atmosphere

"* Rising containmsnt humidity

"* Pressurizer level decreasing In crediting postulated operator actions to isolate a CVC piping failure, Palisades followed the Westinghouse methodology. The Palisades expert panel determined that a PCS leak would lead the operators to isolate letdown. It is the opinion of current and past licensed operators on the expert panel that the slow progression of the small break LOCA event, the early steps in both Off-Normal and EOP procedures, and frequent operator training on the event makes it extremely likely that operators would quickly isolate letdown during any loss of PCS inventory or LOCA. All the requested information in the RAI (time available, time required, performance shaping factors, etc) has not been developed in detail for the segments in question since the Westinghouse methodology does not require this level of information. However, the staff at Palisades believes the expert panel's judgment is realistic and that the classification of the four CVC segments as LSS is considered reasonable.

It is important to note that the RI-ISI process is a risk-informed process and not a risk-based process. There are other important considerations beyond the risk importance measures that are produced as part of the process. NMC agrees that the expert panel should be focused primarily on adding piping segments to the high safety significant (HSS) category; however, per WCAP 14572, piping segments that have been determined by quantitative methods to be HSS can be categorized low safety significant (LSS) with sufficient justification.

Additionally, categorization of segments as LSS by the expert panel is not the final determination of which segments are not included in the RI-ISI inspection program. Systems must meet the criteria identified in the WCAP-14572. The criteria states that the total change in piping risk should be risk neutral or a risk reduction in moving from the current ASME Section XI to RI-ISI program. If a system is not at least risk neutral following expert panel classification, additional segments are identified for inspection.

This in fact was the case for five segments that were added to the inspection program for change in risk considerations. The Westinghouse delta-risk analysis for the CVC system showed that there is a risk reduction in going from the current program to the RI ISI program even with four HSS segments (moved from HSS to LSS by the expert panel) not receiving an inspection.

NRC REQUEST 1.2 Other Considerations The notes in Table 3.7-1 indicate that a number of piping segments were moved from the HSS category to the LSS category by the expert panel based upon considerationsother than the potential for operatoractions. The justification should include:

The specific weakness in the quantitative evaluation that causes the segment to be inappropriatelyplaced in HSS.

A discussion of the more appropriateassumption that corrects the weakness.

A discussion of the magnitude of the impact of the more appropriateassumption that supports moving the HSS segment into LSS.

For example, Note 7 states that there are 'no active failure mechanism' in several pressurizer(PRZ) segments and that they "would be subjected to the lowest temperature of all PCS [primary coolant system]/PRZ segments". If the environment in these segments is so benign, why were they HSS accordingto the RRW values? What is the inappropriateassumption that lead to the HSS categorization? What is the more appropriateassumption and how much does it influence the consequence and/orthe frequency of the segments? failure? Please identify each of these segments and provide a copy of the justification developed and documented by the expert panel to move the segment from the HSS to the LSS category. If the originaldocumentation developed by the expert panel does not include the information discussed above, please provide the originaldocumentation that was developed, and also provide the requested information.

NMC RESPONSE 1.2 Other Considerations Based on considerations other than crediting operator actions, the Palisades Expert panel has proposed moving the following concentrated boric acid (CBA), CSW, main steam system (MSS),

fire protection system (FPS), and pressurizer (PZR) segments from HSS to LSS:

CBA-012 MSS-041 PZR-016 CSW-027 FPS-014 PZR-017 NMC moved the above segments from HSS to LSS based on expert panel judgment and other considerations (e.g. conservative PSA modeling assumptions, nonrealistic Win-SRRA inputs, results from past ISI inspections, etc.) other than operator actions.

Additionally, the Westinghouse delta-risk analysis showed a risk reduction in the all the above systems going from the current Section XI program to the RI-ISI program even with the above segments not receiving inspections. The additional documentation requested in this RAI will require significant additional time to prepare. In order to expedite the Staff's program review and thereby support the upcoming refueling outage at Palisades, NMC will leave the five CBA, MSS, FPS, and PZR segments in the HSS category and adjust the inspection schedule accordingly.

The analysis of Critical Service Water (CSW) segment CSW-027 as described in the March 1, 2002, RI-ISI submittal conservatively assumed that a failure would cause loss of backup Auxiliary Feedwater (AFW) suction for two AFW pumps. A more realistic consequence is the loss of backup suction to just one AFW pump.

The segment in question is only associated with one AFW pump and the initial choice of PSA surrogates for quantification was overly conservative. CDF and LERF values for the segment were evaluated with a loss of backup suction to one electric motor driven AFW pump, and one steam turbine driven AFW pump. A more realistic choice of surrogates would have failed suction to only an electric motor driven AFW pump. With the more realistic surrogate, the CDF would increase by less than 1% above the baseline value.

Therefore the expert panel categorization of the segment as LSS is considered acceptable.

NRC REQUEST

2. In the NRC Staff Evaluation Report (SER) on the PalisadesIndividual PlantExamination (IPE), dated February7, 1996, the NRC staff concluded that there were limitationsin the Human ReliabilityAssessment (HRA) approach used by the licensee that could limit the PalisadesIPE in future regulatoryuses. These limitations include:

Treatment of pre-initiatorand post-initiatorerrorsusing the Technique for Human ErrorRate Prediction which limits the degree of insights about plant-specific factors influencing human performance.

Use of screening values that are significantlylower than values typically used for post-initiatoractions and not including dependencies in the initialquantification.

Treatment of diagnosis for post-initiatoractions, which is not consistent with most nuclearpower plant HRAs.

In one of the two post-initiatoractions that was quantified using the Accident Sequence Evaluation Program(ASEP) model, the calculatedhuman errorprobability (HEP)was the lowest value of all post-initiatorHEPs.

Please explain how these limitationsin the HRA have been addressed during the evaluationsperformed in support of this relief request.

NMC RESPONSE "Treatmentof pre-initiatorand post-initiatorerrorsusing the Technique for Human ErrorRate Predictionwhich limits the degree of insights about plant-specific factors influencing human performance. "

The THERP methodology was employed for selected mis-calibration and "after maintenance" mis-positioned valve failure modes in the IPE submittal. These modeled malfunctions are referred to as pre-initiator failures. Some seventy pre-initiator errors are still included in the updated model that was used for the RI-ISI analysis. The same failure rate is used for "like" failure modes. For example, instrument mis-calibration errors (high) are assigned the same likelihood regardless of the device.

Although this could limit some insight with respect to pre-initiator plant specific processes, there is no effect on the RI-ISI analysis, as post initiator operator errors were not modeled as separate events but as consequential hardware failures.

Moreover, the Palisades PSA model conservatively over predicts the impact of pre-initiator calibration errors as these same stressors are included in many of the modeled common cause functional groups.

Additionally as part of the Palisades PSA maintenance model process, the post-initiator IPE HEPs (i.e., the "non" above referenced consequential failures) used to support this request were updated using NUREG/CR-4772, "Accident Sequence Evaluation Program (ASEP)

Human Reliability Analysis Procedure." The ASEP methodology provided guidance on how to evaluate pre and post-diagnoses tasks.

"Use of screening values that are significantly lower than values typically used for post-initiatoractions and not including dependencies in the initial quantification."

The IPE submittal originally employed HEP screening values of 1 E-02 and 1E-03. The subsequent maintenance update employing the NUREG/CR-4772 methodology used a value of 0.1 for the HEP's in which a specific human error rate was not developed. The setting of four HEP's to a screening value of 0.1 was included in the PSA RI-ISI model.

"Treatmentof diagnosis for post-initiatoractions, which is not consistent with most nuclearpower plant HRAs."

Since the IPE submittal the Palisades post-initiator operator actions have been updated using the ASEP Methodology. The ASEP approach has two phases, the diagnosis tasks and the post-diagnosis tasks. The diagnosis responsibilities consists of determining what to do when an abnormal event has been recognized and the post-diagnosis task consists of those actions that are logically taken following the correct diagnosis of an abnormal event. Diagnosis requires evaluating the operator's knowledge based behavior and post-diagnosis evaluates the operator's skill and rule based behaviors. In conclusion the Palisades PSA model HEP revision has addressed the above SER issue. This HEP revision was included in the PSA model used to evaluated RI-ISI program.

"In one of the two post-initiatoractions that was quantified using the Accident Sequence Evaluation Program(ASEP) model, the calculated human errorprobability (HEP)was the lowest value of allpost-initiator HEPs."

In this instance, the NRC Staff Evaluation Report (SER) is referring to the IPE developed HEP for once-through cooling (OTC). The operator action

(- 8E-05) was re-analyzed again using the ASEP methodology. Both pre and post diagnosis elements were evaluated resulting in a new HEP value of 2.9E-03. This updated value was used in the RI-ISI PSA model.

NRC REQUEST

3. In the enclosure to your letterdated March 1, 2002, Section 1.2, "PSA Quality," states that the Combustion Engineering Owners Group (CEOG) peer review performed in May 2000 found a weakness in performing a thorough dependency analysis for the operatoractions modeled in the PSA. You state that the "weakness related to the appropriatenessof the magnitude of human errorprobabilitiesused in the model given the possibilitythat dependent operatoractions may not have been adequately considered." In general, omitting the dependencies between multiple operatoractions yields lower human errorrates for a sequence of actions.

Your reportedinvestigation that observed a slight increase in risk after including the dependencies in a number of multiple actionsis consistent with this generalobservation. However, on page 2, you continued that you chose not to "remove further some of the conservatismby assessing more human errorcombinations...[because]...additionalevaluation is not considerednecessary due to the alreadysmall increase in [core damage frequency] CDF."

Including dependencies between human actions does not "remove conservatism"- it removes non-conservatism. The small increasein CDF observed from the completed evaluation does not alone support the conclusion that furtherevaluation would not yield largerincreases.

Please explain how the incomplete review of dependencies could affect the evaluationsperformed in support of this reliefrequest.

NMC RESPONSE "Includingdependencies between human actions does not "remove conservatism"- it removes non-conservatism. The small increasein CDF observed from the completed evaluation does not alone support the conclusion that further evaluation would not yield largerincreases. "

NMC used the following process to evaluate human action dependencies should resolve this question. Cutsets that were not specifically evaluated for human action dependencies were assumed to have complete dependence, which is conservative. Evaluation of additional combinations can only serve to remove some of that conservatism.

"Pleaseexplain how the incomplete review of dependencies could affect the evaluations performed in support of this relief request."

The following describes the process employed by Palisades to address the CEOG peer review concern regarding human action dependencies.

In May 2000, a CEOG sponsored PSA peer review team reviewed the Palisades PSA. In their evaluation, the team commented that the number of combinations that were considered in the qualitative human error dependency evaluation may not have been sufficient to assure that all risk significant combinations were identified. To alleviate this concern, Palisades performed a thorough investigation on the impact of human error dependency on the baseline CDF.

To address the human action dependency issue with respect to CDF, Palisades developed a systematic approach that investigated a sufficient number of human actions to merit confidence that the impact of these dependencies have been thoroughly assessed and adequately represented in the PSA models. The approach was iterative and methodical. Subsequent prioritization of the impact of potential dependencies on the overall CDF was performed. The analysis began with conservative assumptions regarding conditional probabilities of multiple human errors found in the Palisades cutsets and gradually removed the conservatisms from the combinations of HEPs that were determined to influence the CDF. The iteration terminated when the change in CDF became negligible.

The operator actions of concern are those performed in response to an initiating event, or post initiating event actions. As noted above, the objective was to assess the potential dependency between post-initiating human actions modeled in the Palisades PSA and evaluate their impact on CDF in a thorough manner.

The method consisted of the steps outlined below. The ASEP [1] and THERP [2] (THERP was used to identify the conditional dependencies in this evaluation, only) human error methodologies to assess and quantify dependent human error probabilities (DHEP) between the errors as shown in Figures Ia and lb were employed. The human error dependency analysis consisted of the following steps.

1. Identify the post-initiator operator error events modeled in the PSA to be included in the dependency review.

2. Regenerate CDF sequences with human error events set to unity (1.0) to obtain a relatively complete input for the dependency evaluation.

3. Identify all post-initiating event operator error event combinations in the same CDF cutset in the baseline CDF equation.

4. Identify the combinations that are considered independent using the decision trees presented in Figures Ia and lb.

5. For all other human error combinations, credit only one human error event in the combination. Set the remaining human error events in the combination to 'True' (i.e.,

assuming they all are completely dependent upon the credited human error event).

6. Select several human error combinations that are not independent in accordance with Figures Ia and lb and derive conditional values based on Figures 2a and 2b.

7. Separate the CDF cutsets into modules containing the identified combinations of human actions. Determine a ACDF between the baseline value for these modules and the value obtained by assuming the human actions are dependent for all the modules.

8. Identify dominant modules containing multiple human error events with respect to the change in CDF and identify the additional dependent actions that contribute to this change.

Derive conditional failure probabilities for these newly identified combinations of human actions.

9. Repeat steps 7 and 8 until ACDF due to human error dependency becomes negligible.

The relatively small increase in the overall CDF contributed by the dependency analysis of human actions (ACDF increase < 40%) is an indication that dependency between human actions within important accident sequences are low and that the PSA already accounted for any significant dependency among critical actions in the modeling development process. Moreover, the ACDF could be further reduced by explicitly modeling additional human error combination dependencies.

However, additional evaluation is not considered necessary due to the already small increase in CDF. In summary the Palisades PSA model is considered to satisfactorily address human error dependencies and that it is adequate to evaluate the RRW values of the analyzed segments in support of the RI-ISI relief request.

Figure la- Diagnosis Dependency Decision Tree Figure Ib: Post-Diagnosis Dependency Decision Tree Any Previous Failed Operator Same Time Actions Failure of the Frame As With Same Immediately the Similar Operator Proceeding Preceding Goals or As Failed Op Action Op Action Actions OA? Workload Dependency Level

____ _________ £ ________

Actions L _______ .1.

OA? Dependency Level Heavy Moderate to Complete PModerate Moderate to High Light Low to Moderate Heavy Mode rate to High.

Moderate Low to Moderate Light Zero to Low Heavy iZero to Moderate Moderate -Zero to Low Zero to Low I

Light A

Yes Heavy Low to Mo~derate No Zero to Moderate Zero to Low Zero Zero

.Zero

- 16 -

Fi6ure 2a: Dependency Model - 2 Human Error Events

~HE #1 HE #2 End States Failure Success D1 Al< D2 SA2 Diagnosis HE #1 dl, dl' Diagnosis HE #2 d2 d2' Post-diagnosis HE#1 al al

'Post-diagnosis HE#2 a2 a2' ET Sequences cdl a2Ia1*(1-d2Jd1)*a1 cd2 d2/dl*al*(1-dl) cd3 a2*(l-d2I/di)*dl cd4 d2Idl*dl TOTAL HEP cd* cd2+cd3+cd4 dl Figure 2b: Dependency Model - 3 Human Error Events

• End I ..

HE #1 HE #2 HE #3 bD1" Al D2 A2 D3~ A3 States Failure Success Diagnosis HE #1 d1 d1' Diagnosis HE #2 d2 d2'

-Diagnosis HE #3 d3 d3' I Post-diagnosis HE#1 - al al' Post-diagnosis HE#21 a2 a2' al Post-diagnosis a3. a3 HE#3

• ET Sequences edl a31a2a1 *(1 -d3/d1'd2')*a2/a1 *(1 -d2/dl' Yal *(1-dl) cd2 d3/dld2*a2/a1*(l(12/dlý*a1*(1ldl) cd3 a3a1 *(1 -d3/d2d )*d2.d.Val .. *(1 -dl) cd4 d3Pd2d l 1 (1 -d c*d2dl'd*a *)

cd5 a3Ia2*(l -d3Id1 d2')*a2*(1 -d2Id1)*d1 cd6 d3/d1dld2'a 2* (1-d2Id1) *dl cd7 a3 *(1-d 3/dl1d2) *d2Id 1*d 1 dl cd8 dl~d2/dl*d3/dld2 TOTAL HEP cdI + cd2 +cd3 +cd4 +cd5 +cd6 +

d2/d 1 a3 cd7+cd8 -

d3/dld2 NRC REQUEST

4. On page 3 of the enclosure to your letter dated March 1, 2002, in the section on "Deviations"you state that four piping segments in the safety injection/refuelingwater tank and containmentsump (SSS) system are in a category of thin-walledpiping and have attributes of low pressure, low temperature,low design stress, and low fatigue stress, that are not appropriatefor use with the Westinghouse statistical(Perdue)model.

These attributesdo not appearto be outside the bounds of applicabilityof the Perdue model listed on page 178 of WCAP-14572. You furtherstate that a 7.5% sample was selected from each of the segments as an alternative to running the Perduemodel. Pleaseexplain why the Perdue model is not applicable to these four piping segments.

NMC RESPONSE Four segments, SSS-001, SSS-002, SSS-002C, and SSS-007 were considered outside of the applicability of the Perdue model. The safety significance of these 4 segments, as determined by the quantitative criteria, is low safety significance since the associated RRW values are less than 1.001. The expert panel categorized these 4 segments as high safety significant based on deterministic reasons. The failure of these segments can lead to loss of the Safety Injection and Refueling Water Tank (SIRWT) and are unisolable from the SIRWT.

Segment failure probabilities are calculated using the SRRA program.

The failure probability value associated with large leak and no ISI and no leak detection for each segment is tabulated. If the failure probability is greater than 1E-4, the segment is placed in a high failure importance (HFI) category. If the failure probability is less than 1 E-4, the segment is placed in the low failure importance (LFI) category. All 4 segments were initially placed in the LFI category.

The Perdue model uses results from the SRRA evaluation to determine if there is a 95% confidence that the probability of the leak rate per year per lot is less than the target leak rate per year per lot. When the probability of a flaw (10% through-wall crack) at the present age of the plant is close to 1.0, and the failure probabilities are of sufficient magnitude, the confidence does not meet the 95% acceptance criteria. The probability of a flaw at the plant's present age has a value close to 1.0 for these thin walled (schedule 10) piping segments. One of these piping segments did not receive a construction radiograph. This causes the high probability of a flaw in the Perdue model process. Therefore, a very small conditional probability of a leak/year/weld is required to obtain an acceptable (>95%)

confidence that the calculated leak rate will be less than the target leak rate.

Application of the overall process (i.e., risk evaluation, SRRA, and Perdue model) indicates that 100% of the welds in the segments of interest need to be examined in the proposed risk-informed ISI program. This result is judged to be inappropriate by the engineering team for these segments for the following reasons:

"* The piping segments operate at low temperatures (<1 500 F) and low pressures (<100 psi) in this thin-wall piping

"* The piping is constructed of 304SS, which is a ductile material with high fracture toughness values

"* Leaks have not occurred and unacceptable flaw indications, per the ASME Section Xl code, have not been discovered from volumetric and surface examination of these piping segments in more than 29 years of operation

"* There are no known active degradation mechanisms existing within these segments To this end, the engineering team, including Westinghouse, reviewed the Perdue model applicability for segments SSS-001, SSS-002, SSS-002C, and SSS-007. Based on this review, it has been determined that the Perdue model should not be used to establish a statistically relevant inspection sample size to verify the condition of the piping. The following summarizes this rationale:

" Given that pre-service examination using volumetric examination methods was not performed during original construction for segment SSS-007, the probability of having a flaw is more than ten times higher than for a segment that received a pre-service exam.

" Per page 171 of WCAP-14572, Revision 1-NP-A, the Perdue model is based on the probability of a flaw existing (at the current age of the plant) that exceeds an unacceptable flaw defined by ASME Section XI Code. The unacceptable flaw has been defined as a/t>0.10, based on general acceptance standards that are appropriate for reactor piping operating at higher temperatures, pressures, and expected operating and design basis loadings.

" When the large flaw size distribution is combined with the above Perdue model assumption (particularly since thin-wall piping is being evaluated), an unreasonable 100% sample size result is determined.

" The a/t>0.10 Perdue model assumption is inappropriate for the piping segments of interest. The operating temperatures and pressures for these thin-walled piping segments are <150OF and <100 psi, respectively. Given these conditions, along with the fact that the piping is constructed of stainless steel material that is ductile and has an inherently high fracture toughness, piping fracture evaluation experience to date indicates that the unacceptable flaw size would at least have an a/t>0.50 using fracture evaluation methods defined in ASME Section XI.

"* Ifthe Perdue model could account for this value, the probability of having a flaw exceeding this value at the current age of the plant would be significantly reduced. A highly reliable piping system would be demonstrated that would reflect a conclusion consistent with the engineering judgment discussed above.

Thus, the statement on page 184 of WCAP-14572, Revision 1-NP-A "Other situations may exist that warrant considerations beyond the above guidance" - is exercised in the selection of actual inspection locations.

The inspection sample selected for the four segments will be kept at the existing Section XI guideline of 7.5%. This 7.5% sample inspection provides adequate assurance to identify random or unknown conditions in these highly reliable segments.

NRC REQUEST

5. In Section 3.1 on page 4 of the enclosure to your letter dated March 1, 2002, you state that the Reactor Cavity Flood System was excluded from system scope considerationin the RI-ISI program. What is the basis stated in the documentation maintainedat the site for excluding this system?

NMC RESPONSE The report "Consumers Energy Palisades Scope of Risk-Informed Inservice Inspection Program" Revision 1, was generated during initial program scoping. Justification for Reactor Cavity Flood system exclusion from the program is listed on page 9 of the report in the Comment column of Table 1 "Palisades RI-ISI Scope Definition". The comment states that the system is excluded primarily because it is entirely made up of floor drain piping in containment. Discussion during the scoping process included several other facts to support the system's exclusion:

• Since the piping is embedded in concrete, a weld failure will not disable the system. If a pipe failure occurs the concrete around the pipe will channel the water to the intended location.

"* The system is open to containment atmosphere under normal conditions and has no process fluid (unless containment sprays actuate). Therefore it has no active degradation mechanism to cause a weld failure.

"* The system is categorized as Low Safety Significant for Maintenance Rule.

NRC REQUEST

6. Table 5-1 of the enclosure to your letter dated March 1, 2002, shows that, for the primary coolant system, there are 5 volumetric examinationsin the 29 HSS piping segments. Pleaseexplain why only 5 volumetric examinationsare performed.

NMC RESPONSE Of the 29 HSS segments in the PCS system, only 5 of them contain butt welds. There are a total of 20 butt welds associated with the 5 segments.

The number of weld inspections per segment to be inspected was determined using the Westinghouse statistical (Perdue) model as described in section 3.7 of WCAP-14572, Revision 1-NP-A. The remaining 24 segments contain only socket welds. In accordance with section 3.8 of the submittal, the socket welds in these segments cannot be individually examined by any currently available NDE techniques that are appropriate for the degradation mechanism. Therefore, for these segments, a visual (VT-2) examination will be performed during the system pressure test each refueling outage NRC REQUEST

7. Will the RI-ISI program be updated every 10 years and submitted to the NRC consistent with the currentASME XI requirements?

NMC RESPONSE The RI-ISI program will be a living program that will be updated as required to reflect ISI needs, PSA model changes, and any required WCAP provisions. Following program approval only the inspection plan would be submitted to the NRC in accordance with current ASME Section XI requirements.

NRC REQUEST

8. Under what conditions would the RI-/SI program be resubmitted to the NRC before the end of any 10-year interval?

NMC RESPONSE The RI-ISI program would be resubmitted to the NRC before the end of any 10-year interval if there is an impact to the basis for NRC approval in the plant specific Safety Evaluation.

NRC REQUEST

9. Since 66% of the scheduled examinations under the RI-ISI program are being examined by the end of the thirdinspection interval, how will the welds be selected in terms of risk category?

NMC RESPONSE In selecting examinations, primary consideration will be given to elements that are in Region 1A of the Structural Element Selection Matrix since these elements are high safety significant and have a high failure importance. For elements in Region 1 B and 2, there is no active degradation mechanism; therefore a combination of considerations will be used to determine which elements to examine. These considerations include:

• Dominant contributors to risk

• Selecting elements from various systems and postulated degradation mechanisms

• Radiation exposure

• Accessibility