ML022700603
| ML022700603 | |
| Person / Time | |
|---|---|
| Site: | Boiling Water Reactor Owners Group |
| Issue date: | 09/27/2002 |
| From: | Ruland W NRC/NRR/DLPM/LPD4 |
| To: | Gray J Entergy Nuclear Northeast |
| References | |
| TAC MB1054 NEDC-32988 Rev. 2 | |
| Download: ML022700603 (68) | |
Text
September 27, 2002 Mr. Jack Gray, Chairman BWR Owners Group Entergy Nuclear Northeast 440 Hamilton Avenue P.O. Box 5029 White Plains, NY 10601
SUBJECT:
SAFETY EVALUATION OF TOPICAL REPORT NEDC-32988, REV. 2, "TECHNICAL JUSTIFICATION TO SUPPORT RISK-INFORMED MODIFICATION TO SELECTED REQUIRED ACTION END STATES FOR BWR PLANTS" (TAC NO. MB1054)
Dear Mr. Gray:
On January 5, 2001, the BWR Owners Group (BWROG) submitted Topical Report (TR)
NEDC-32988, Rev. 2, "Technical Justification to Support Risk-Informed Modification to Selected Required Action End States for BWR Plants," for staff review. The BWROG supplemented the topical report by letters dated October 26 and November 6, 2001. TR NEDC-32988, Rev. 2 requests changes in the technical specifications (TSs) end states for numerous limiting condition for operation (LCO) requirements. Most of the requested TS changes would permit an end state of hot shutdown (Mode 3), rather than cold shutdown (Mode 4) as required in the current TSs.
The staff has found that NEDC-32988, Rev. 2 is acceptable for referencing in licensing applications for GE-designed boiling water reactors to the extent specified and under the limitations delineated in the report and in the enclosed NRC safety evaluation (SE).
Licensees requesting a license amendment to revise their end states must include in their amendment requests plant-specific information addressing the stipulations identified in Section 7.0 of the SE.
We do not intend to repeat our review of the matters described in the subject TR and found acceptable, when the report appears as a reference in license applications, except to ensure that the material presented applies to the specific plant involved. Our acceptance applies only to the matters approved in the report.
The NRC requests that the BWROG publish an accepted version, within 3 months of receipt of this letter. The accepted version shall incorporate (1) this letter and the enclosed SE between the title page and the abstract, and (2) a "-A" (designating "accepted") following the report identification symbol.
Should our criteria or regulations change so that our conclusions as to the acceptability of the report are invalidated, the BWROG and/or the applicants referencing the topical report will be expected to revise and resubmit their response documentation, or submit justification for the continued applicability of the topical report without revision of their respective documentation.
Mr. Jack Gray If you have any questions, please contact Alan Wang, Project Manager for GENE topical reports, at (301) 415-1445.
Sincerely,
/RA/
William H. Ruland, Director Project Directorate IV Division of Licensing Project Management Office of Nuclear Reactor Regulation Project No. 691
Enclosure:
Safety Evaluation cc w/encl: See next page
Mr. Jack Gray If you have any questions, please contact Alan Wang, Project Manager for GENE topical reports, at (301) 415-1445.
Sincerely,
/RA/
William H. Ruland, Director Project Directorate IV Division of Licensing Project Management Office of Nuclear Reactor Regulation Project No. 691 DISTRIBUTION:
PUBLIC
Enclosure:
Safety Evaluation PDIV-2 Reading RidsNrrDlpmLpdiv (WRuland) cc w/encl: See next page JTatum JWermiel WDBeckner AWang RDenning NSaltos TRTjader JLazevnick
- For previous concurrences see GThomas attached ORC JTatum RidsNrrLAEPeyton Accession Number: ML022700603 OFFICE SRXB*
SPLB*
RORP*
SPSB*
EEIB*
NAME JWermiel JHannon WBeckner MJohnson JCalvo DATE 9/20/02 9/17/02 9/23/02 5/7/02 5/8/02 OFFICE PDIV-2/PM PDIV-2/LA PDIV-2/SC*
PDIV/D NAME AWang EPeyton SDembek WRuland DATE 9/26/02 9/26/02 9/25/02 9/27/02 OFFICIAL RECORD COPY
BWR Owners Group Project No. 691 cc:
Mr. Kenneth Putnam, Vice Chairman BWR Owners Group Nuclear Management Company Duane Arnold Energy Center 3277 DAEC Rd.
Palo, IA 52324 Mr. James M. Kenny Reactor Response Group Chairman BWR Owners Group PPL Susquehanna, LLC Two North Ninth Street M/C GENA6-1 Allentown, PA 18101-1179 Mr. H. Lewis Sumner Southern Nuclear Company 40 Inverness Center Parkway PO Box 1295 Birmingham, AL 35242 Mr. Carl D. Terry Vice President, Nuclear Engineering Niagara Mohawk Power Corporation Nine Mile Point - Station OPS Bldg/2nd Floor PO Box 63 Lycoming, NY 13093 Mr. Thomas G. Hurst GE Nuclear Energy M/C 782 175 Curtner Avenue San Jose, CA 95125 Mr. Thomas A. Green GE Nuclear Energy M/C 782 175 Curtner Avenue San Jose, CA 95125 Mr. William H. Bolke Exelon 1400 Opus Place, Suite 400 Downers Grove, IL 60515 Mr. William A. Eaton ENTERGY Grand Gulf Nuclear Station P.O. Box 756 Port Gibson, MS 39150 Mr. Mark Bezilla PSEG NUCLEAR Hope Creek Generating Station P.O. Box 236 M/C H07 Hancocks Bridge, NJ 08038 Mr. James F. Klapproth GE Nuclear Energy M/C 706 175 Curtner Avenue San Jose, CA 95125
SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION TOPICAL REPORT NEDC-32988, REV. 2 "TECHNICAL JUSTIFICATION TO SUPPORT RISK-INFORMED MODIFICATION TO SELECTED REQUIRED ACTION END STATES FOR BWR PLANTS" PROJECT NO. 691
1.0 INTRODUCTION
By letter dated January 5, 2001 (Reference 1), the Nuclear Energy Institute (NEI) and the Boiling Water Reactors Owners Group (BWROG) submitted Topical Report NEDC-32988, Rev. 2, "Technical Justification to Support Risk Informed Modification to Selected Required Action End States for BWR Plants," for review by the NRC staff. The BWROG supplemented the topical report by letters dated October 31, 2001 (Reference 2) and November 6, 2001 (Reference 3).
The topical report provides the technical analysis to support the technical specification (TS) changes based on risk information. The change would allow hot shutdown (Mode 3) rather than requiring cold shutdown (Mode 4) for selected TS end states. This topical report is similar to the topical report the staff approved for pressurized water reactors (PWRs) on July 17, 2001.
This topical report provides the basis for changes to the BWR-4 and BWR-6 standard TSs (STS) (References 4 and 5).
Title 10 of the Code of Federal Regulations, (10 CFR), Section 50.36, "Technical Specifications" (Reference 6), states that "when a limiting condition for operation of a nuclear reactor is not met, the licensee shall shutdown the reactor or follow the remedial action permitted by the technical specification until the condition can be met." TSs provide these actions and associated completion time (CT). If the limiting condition for operation (LCO) or the remedial action cannot be met within the CT, the reactor is required to be shut down. When the plant TSs were originally written, the shutdown condition or end state specified was usually cold shutdown.
Each LCO, stated in the TSs, defines the actions to be taken in the event the LCO is not met.
In current TS when an LCO is not met, the TS "actions" call for compensatory measures to be taken within some CT. If such compensatory measures are not taken in time or if directed by the actions, the plant must be placed in a mode or other specified "plant condition" where the LCO does not apply. Unless otherwise specified in the individual TS, LCO 3.0.3 currently requires that a BWR plant be placed in Mode 4 (i.e., cold shutdown). This requirement has established Mode 4 (cold shutdown for BWRs) as the end state for most TS action statements.
However, preliminary risk and operational considerations have indicated that end state modifications could be beneficial. For example, establishing Mode 3 (hot shutdown for BWRs) instead of Mode 4 as the end state for several TS action statements could reduce operational costs without compromising safety and may actually enhance safety.
The BWROG followed up on the above mentioned preliminary risk and operational considerations by performing a detailed risk-informed study. The aim of this study has been to identify and propose changes in end states for all BWR plants. Such a study is documented in report NEDC-32988, Rev. 2, "Technical Justification to Support Risk-Informed Modification to Selected Required Action End States for BWR Plants." Therefore, this report provides the technical basis for changing permitted actions to include an end state of hot shutdown when certain LCOs are not met, rather than the current cold shutdown requirement. The request is limited to: (1) those end states where entry into the shutdown mode is for a short interval, (2) entry is initiated by inoperability of equipment or a restriction on a plant operational parameter, unless otherwise stated in the applicable TS, and (3) the primary purpose is to correct the initiating condition and safely return to power.
The BWROG compared the core damage frequencies during the two modes of operation using the probabilistic risk assessment (PRA) for a typical BWR-4 plant assuming the inoperable conditions specified in TSs.
Important insights from the assessment of the applicability of the representative BWR-4 plant results were applied to other BWR plants through sensitivity studies accounting for design and operational differences and/or direct comparison of features using risk insights for the representative BWR-4 plant. Therefore, the results are applicable to all the BWR models (BWR/2 through 6). In addition to quantitative analysis, the BWROG evaluated the two modes of operation based on defense-in-depth considerations and then proposed a list of end state changes.
2.0 BACKGROUND
The TSs for BWR plants define five operational modes:
Mode 1 - power operation. The reactor mode switch is in run position.
Mode 2 - startup. The reactor mode switch is in the refuel position (with all reactor vessel head closure bolts fully tensioned) or in startup/hot standby position.
Mode 3 - hot shutdown. The reactor coolant system (RCS) temperature is above 200F (TS specific) and the reactor mode switch is in shutdown position (with all reactor vessel head closure bolts fully tensioned).
Mode 4 - cold shutdown. The RCS temperature is equal or less than 200F and the reactor mode switch is in shutdown position (with all reactor vessel head closure bolts fully tensioned).
Mode 5 - refueling. The reactor mode switch is in shutdown or refuel position, and one or more reactor vessel head closure bolts are less than fully tensioned.
Criticality is not allowed in Modes 3 through 5.
The BWROG request would generally allow a Mode 3 end state rather than a Mode 4 end state for selected initiating conditions.
Controlling shutdown risk involves controlling conditions that can cause potential initiating events and responding to initiating events that do occur. Initiating events are a function of equipment malfunctions and human errors. Event response depends on plant sensitivity, ongoing activities, human error, defense-in-depth, and additional equipment malfunctions. In the end state changes considered here, the malfunction of a component or train has generally resulted in a failure to meet a TS and a controlled shutdown has begun because a TS CT has been exceeded.
Most of the current shutdown TSs and design basis analyses were based on the belief that cold shutdown is the safest condition and that the design basis analyses bound credible shutdown accidents. In the late 1980s and early 1990s, the NRC and licensees recognized that this belief was incorrect and took corrective actions to improve shutdown operation. At the same time, standard TSs were developed and many licensees improved their TSs. Since a shutdown rule was expected, almost all TS changes involving power operation, including end state changes, were postponed. However, in the mid 1990s, the Commission decided a shutdown rule was unnecessary in light of industry improvements.
In practice, the realistic needs during shutdown operation are often addressed via voluntary actions and the application of the maintenance rule, 10 CFR 50.65 (Reference 7). In some cases, the most desirable action cannot be achieved because of existing TS limitations.
3.0 ASSESSMENT
APPROACH The staff performed a comparison between the current (Mode 3) and the proposed (Mode 4) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. This comparison was performed to demonstrate that the systems available to safely shut down the plant and maintain it in a safe shutdown condition are comparable in both Modes 3 and 4. The major differences between the systems available in Modes 3 and 4 for core decay heat removal and containment heat removal are given below:
Systems Available for Core Decay Heat Removal System Mode 3 Mode 4 Power conversion system (PCS)
A NA High pressure coolant injection/high A
HPCI (NA), but HPCS (A - BWR 5/6) pressure core spray (HPCI/HPCS)
Reactor core isolation cooling/inventory A
NA control (RCIC/IC)
System Mode 3 Mode 4 Control rod drive (CRD)
A A
Low pressure core spray/containment A*
A spray (LPCS/CS)
Low presure coolant injection/residual A*
A heat removal (LPCI/RHR)
Condensate system A*
A Service water cross-tie A*
A Fire water A*
A A - system available; NA - not available; * - requires reactor pressure vessel (RPV) blowdown Systems Available for Containment Heat Removal System Mode 3 Mode 4 PCS A*
NA RHR A*
A Containment vent A
A
- - requires RPV depressurization with 2-3 safety relief valves (SRVs).
For core decay heat removal, BWR-4 plants have nine systems during Mode 3, but only six systems available during Mode 4. BWR-5/6 plants have nine systems available during Mode 3 and seven systems available during Mode 4.
For containment heat removal, one more system is available in Mode 3 than in Mode 4.
Therefore, in general, more systems for core decay heat and containment heat removal are available during Mode 3 than in Mode 4.
With this perspective, the staff addresses each of the critical safety functions identified in Reference 1 that must be maintained during shutdown operation:
Reactivity control Reactor overpressure control Core decay heat removal and inventory control Containment heat removal Diesel generators Electrical divisions Since the purpose of the requested TS changes is to correct a malfunction and safely and promptly return the reactor to power operation, the staff considered only repairs that (1) maintain the RCS pressure boundary, and (2) maintain containment integrity, heat removal, and electrical capability unless directly involved in the deficiency that is to be corrected.
Reactivity Control This control is not a concern in Modes 3 and 4, since the reactor is already shut down. It is assumed that the plant shutdown was uneventful and all rods are inserted.
Reactor Overpressure Control This control is not a concern in Modes 3 and 4, since the reactor is fully shut down. The pressure is usually lower than the normal operating pressure. Even though this is more of a concern for Mode 3 than for Mode 4, SRVs are available in case of an emergency.
Furthermore, the SRVs are highly reliable. Also, pressure is reduced if RCIC or HPCI is operating during Mode 3.
Core Decay Heat Removal and Inventory Control The following systems can provide the core cooling and inventory control function at high reactor pressure:
PCS - steam through main steam isolation valves (MSIVs) to balance-of-plant (BOP) and condensate HPCI/HPCS systems RCIC system CRD system The following systems can provide core cooling at low pressure:
LPCS/CS LPCI Condensate system SW crosstie system Fire water system In Mode 3, the reactor has to be depressurized before the low-pressure systems can be used.
The plant emergency operating procedures (EOPs) require the operator to depressurize the reactor manually; however, if the operator does not depressurize in time, the automatic depressurization system (ADS) is automatically started.
The following are the major differences between Modes 3 and 4:
The steam-driven systems (HPCI, RCIC and IC) are available in Mode 3 when the reactor is at high pressure, but they are not available in Mode 4 when the reactor is depressurized.
The PCS decay heat removal path through the steam lines to the condenser is available in Mode 3 but not in Mode 4.
The shutdown cooling (SDC) mode of the RHR system may be available during Mode 3 if the reactor pressure is low enough to clear the high pressure interlock of the RHR pump suction valves. The SDC mode is available during Mode 4.
Thus, more systems can provide this function in Mode 3 than in Mode 4.
Containment Heat Removal The following systems provide the containment heat removal capacity in Mode 3: PCS, RHR in the suppression pool cooling (SPC) mode, RHR in the containment spray mode, containment venting and the redundant safe shutdown method using SRVs and the RHR system in the SPC mode.
In Mode 4: RHR in the SPC mode, containment venting and the redundant safe shutdown method using SRVs and the RHR system in the SPC mode.
Thus, one more system (the PCS) can provide the containment heat removal function in Mode 3 than in Mode 4.
AC and DC Electric Power Capability Sufficient AC and DC electrical power capability should be provided to support equipment relied upon for shutdown operation under normal or off-normal conditions. The minimum requirement is normally four sources of AC power (two onsite, two offsite) during Mode 3, the same as for power operation. The usual TS requirement for Mode 4 is one onsite source and one offsite source. For conditions applicable to the CT, the normal power sources should be available unless there are extenuating circumstances such as reduced capability. Elective maintenance should be appropriately curtailed whenever electrical capability is diminished during the CT.
The initiating events that could occur during Modes 3 and 4 are different from those that can occur at full power. The initiating events in Modes 3 and 4 which have the potential to be risk significant are restricted to failure of normally operating systems and their support systems.
Emergent conditions in plant configuration or mode changes, additional structures, systems, and components (SSCs) out-of-service due to failures, or significant changes in external conditions (weather, offsite power availability) may require action prior to conduct of the assessment, or could change the conditions of a previous assessment. In this situation licensees must operate in accordance with the maintenance rule, 10 CFR 50.65. Voluntary licensee initiatives ensure equipment, procedures, and contingency plans sufficient to provide defense-in-depth. Realistic comparisons take all this into account.
The licensee actions associated with safety functions are potentially affected by internal plant conditions as well as by external conditions. An approaching hurricane, an ice storm, or likely thundershower or tornado activity may curtail operator local operation flexibility, disrupt safety functions such as electrical power, or reduce outside power resources available to respond to emergencies. Such conditions are to be considered in planning post-CT operations.
Section 50.65(a)(4) states: "Before performing maintenance activities... the licensee shall assess and manage the increase in risk that may result from the proposed maintenance activities. The scope of the assessment may be limited to structures, systems, and components that a risk-informed evaluation process has shown to be significant to public health and safety." Regulatory Guide (RG) 1.182 (Reference 8) endorses the revised Section 11 of NUMARC 93-01 (Reference 9) which provides guidance on implementing the provisions of 10 CFR 50.65(a)(4). Section 11 states: "The assessment is required for maintenance activities performed during power operations or during shutdown..... Planning and scheduling of maintenance activities during shutdown should consider their impact on performance of key shutdown safety functions." The BWROG confirmed that the proposed change cannot and does not eliminate the need to follow the maintenance rule, 10 CFR 50.65(a)(4), requirements.
The requirement to use the plant configuration risk management plan (CRMP) is still in effect.
This means RG 1.182 and NUMARC 93-01 Section 11 guidance are implemented prior to carrying out maintenance.
4.0 RISK ASSESSMENT 4.1 Objectives and Approach The objective of the BWROGs risk assessment was to show that any risk increases associated with the proposed changes in TS end states are either negligible or negative (i.e., a net decrease in risk).
The BWROG topical report documents a risk-informed analysis of the proposed TS change.
PRA results and insights are used, in combination with results of deterministic assessments, to identify and propose changes in "end states" for all BWR plants. This is in accordance with guidance provided in RGs 1.174 and 1.177. The three-tiered approach documented in RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications," was followed. The first tier of the three-tiered approach includes the assessment of the risk impact of the proposed change for comparison to acceptance guidelines consistent with the Commissions Safety Goal Policy Statement, as documented in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis." In addition, the first tier aims at ensuring that there are no unacceptable temporary risk increases during the implementation of the proposed TS change, such as when equipment is taken out-of-service. The second tier addresses the need to preclude potentially high risk configurations which could result if equipment is taken out-of-service concurrently with the implementation of the proposed TS change. The third tier addresses the application of 10 CFR 50.65(a)(4) of the Maintenance Rule for identifying risk significant configurations resulting from maintenance or other operational activities and taking appropriate compensatory measures to avoid such configurations. The scope of the topical report and this safety evaluation (SE) is limited to identifying excluding changes in end state conditions for Mode 3 rather than Mode 4, regardless of the risk.
The risk assessment approach followed by the BWROG includes the following tasks:
Performance of a generic qualitative risk assessment.
Performance of a quantitative risk assessment for a pilot plant which includes the following:
Comparison of baseline risks between Modes 3 and 4 (i.e., risks when no equipment outages are assumed),
Comparison of configuration-specific risks between Modes 3 and 4 (i.e., risks when certain equipment is assumed to be unavailable),
Performance of sensitivity studies to investigate the robustness of the results to uncertainties in data and modeling assumptions, and Performance of sensitivity studies to ensure that the conclusions of the quantitative assessment for the pilot plant apply also to other BWR plants.
Use of risk insights, derived from the qualitative and quantitative generic risk assessments, in the individual TS assessments supporting each of the proposed end state changes.
The objective of the generic qualitative risk assessment is to show that the proposed TS end-state changes maintain defense-in-depth for expected initiating events. This is achieved by performing qualitative risk comparisons between cold shutdown (Mode 4) and hot shutdown (Mode 3). Such comparisons include risk parameters, such as initiating events and mitigating systems, associated with each critical safety function (e.g., reactivity control and core decay heat removal) at the various BWR plants. The objectives of the quantitative risk assessment are (1) to substantiate the conclusion of the qualitative risk assessment by providing numerical results for a representative plant, (2) to investigate the robustness of the results to uncertainties in data and modeling assumptions through sensitivity analyses, and (3) to assess the applicability of the results to other BWR plants through sensitivity analyses accounting for design and operational differences. In addition, specific risk assessments were also performed for several of the proposed TS end state changes to ensure that the specific condition causing the LCO does not increase the risk when the proposed new end state is implemented. Finally, an integrated discussion of the risk significance and defense-in-depth considerations is provided (using risk insights from both the qualitative and quantitative risk assessments) for each proposed TS end state change. This discussion provides useful information which can be used by individual licensees applying for such TS changes to develop guidance in appropriate plant procedures and/or administrative controls to ensure that risk-significant plant configurations are avoided. The staffs review finds that the BWROGs risk assessment approach is comprehensive and follows staff guidance as documented in RGs 1.174 and 1.177.
4.2 Evaluation of the Quality of the Risk Assessment The risk impact of the proposed end state changes was assessed subject to the following major general assumptions:
The request is to establish Mode 3 (hot shutdown) instead of Mode 4 (cold shutdown) as the end state for all the selected TS action statements.
Entry into the shutdown mode under consideration is for a short interval with the primary intent being to repair a non-functional component and return the plant to power as soon as is practical. The BWRs are most likely to stay in hot shutdown for no more than 2 to 3 days and definitely, not more than a week.
The Mode 4 plant state is defined as the steady state condition with the reactor cooling performed by one RHR loop in the SDC mode and the vessel head tensioned. There is a slight difference between what the TSs define as the beginning of Mode 4 and what is modeled in the risk assessment. The TSs define the beginning of Mode 4 when the reactor coolant temperature decreases below 200F. However, in actual plant operations the RHR system is engaged in the SDC mode before the reactor coolant reaches 200F. The risk assessment for Mode 4 assumes that the RHR is engaged in the SDC mode, even though the temperature may be slightly above 200F.
The assessed risks for both Mode 3 and Mode 4 operation are for steady-states.
The staff finds that these assumptions adequately represent the proposed changes and can be used in PRA models to compare risks between Mode 3 and Mode 4 associated with short duration repairs. This comparison can be made by considering only steady state risks because transition risks, as is discussed later in this SE, are about equal for the two end states or slightly favor Mode 3 as the end state.
The quality of the risk assessment is a very important part of any risk-informed license amendment review. In this case, both the qualitative and quantitative risk assessments must be of adequate quality and completeness to support their intended purposes. Regarding the qualitative risk assessment, the comparisons between current and proposed end states for the various BWR plants must be of adequate quality and completeness to ensure confidence in the robustness of the conclusion that the proposed TS end state changes maintain defense-in-depth for expected initiating events and that all expected initiating events were addressed in the analysis. Regarding the quantitative risk assessment, the various models (including assumptions and data) and sensitivity studies must be of adequate quality and completeness (e.g., with respect to initiating events and failure modes of the various safety systems) to provide confidence in the robustness of the conclusion that the risk will not increase if the proposed new TS end states are approved and implemented. The staffs evaluation of the qualitative and quantitative risk assessments are documented in Sections 4.2.1 and 4.2.2, respectively, of this SE.
4.2.1 Qualitative Risk Assessment The qualitative risk assessment is a comparison between Modes 3 and 4 operation at the various BWR plants. This comparison, which assesses qualitatively the means that exist at each BWR plant to maintain critical safety functions for expected initiating events, contains the following three parts:
Assessment of critical safety functions at shutdown,
Generic comparison of risks at shutdown, and
Comparison of safety and operational features at shutdown among BWR plants.
Several critical safety functions at shutdown (reactor overpressure control, core decay heat removal and containment integrity heat removal) were identified based on insights from previous risk studies. The means utilized at several BWR plants to perform each of the critical functions during Mode 3 (hot shutdown) and Mode 4 (cold shutdown) are discussed and used in the generic (i.e., without reference to a specific plant) comparison of risks.
In the generic comparison of risks at shutdown, Mode 3 and Mode 4 risks are qualitatively compared to each other by discussing the likelihood of the various initiating events and the availability of mitigating systems at each plant operating condition. This generic comparison of risks is complemented by a comparison of safety and operational features among BWR plants.
Such a comparison is needed to ensure that the conclusions of the generic qualitative risk assessment are valid for each specific BWR plant.
The staff finds that the qualitative risk assessment is of adequate quality and completeness to support a conclusion that the proposed TS end state changes maintain defense-in-depth based on examination of the following:
Challenges and mitigating capabilities of BWR plants and comparison between current and proposed end states;
Documentation of the various design and operational features used to mitigate shutdown accidents at BWR plants; and
Proper use of results and insights from previous deterministic and probabilistic studies.
4.2.2 Quantitative Risk Assessment A quantitative risk assessment of current and proposed end states (corresponding to shutdown Modes 4 and 3, respectively) was performed for a representative BWR plant with typical BWR-4 plant features. The scope was to provide a comparison of the risks associated with either staying in Mode 3 or going to Mode 4 to carry out equipment repair. Variability in safety and operational features among BWR plants was addressed by a series of direct comparisons of features as well as by sensitivity studies to ensure that the conclusions of the quantitative assessment for the generic BWR-4 plant apply to all BWR plants.
The staff reviewed the quality of the quantitative risk assessment to ensure that:
Initiating events, accidents sequences, and failures found to be significant contributors to shutdown risk in previous studies have been addressed;
Important assumptions made and data used are reasonable;
Important uncertainties in data and modeling assumptions were identified and appropriate sensitivity studies were performed to provide confidence in the conclusions regarding the proposed TS end states; and
Design and operational differences among the various BWR plants were identified and appropriate sensitivity studies were performed which show that the conclusions of the quantitative risk assessment apply to all BWR plants.
The quantitative risk analysis was performed using PRA models of Modes 3 and 4 for internal initiating events. These models were developed by modifying the full power PRA models of the representative BWR-4 plant. This modification involved developing new accident event trees, including new or modified fault trees, for several initiating events applicable to the shutdown modes of interest. Such initiating events were selected from a broad list of postulated initiating events by screening out those events that either do not apply at shutdown or are not risk significant based on previous PRA insights. The success criteria for the various safety functions were derived from the full power PRA after accounting for the reduced decay heat levels in the shutdown modes. The developed event and fault trees were quantified for the Mode 3 and Mode 4 base cases (i.e, assuming no equipment outages), as well as for several other cases reflecting the LCO conditions for which an end state change is requested. The Mode 3 and 4 core damage frequency (CDF) results were used to identify important risk contributors and investigate the sensitivity of the risk assessment results to important uncertainties in data and modeling assumptions.
The quantitative risk assessment does not include risks from external events (dominated by seismic events, internal fires and internal floods), risks associated with transitions from one mode of operation to another or risks in terms of large early release frequency (LERF). The BWROG used the following qualitative arguments to justify not assessing such risks:
Risks associated with external events are smaller when Mode 3 instead of Mode 4 is selected as the end state for the following reasons:
Seismic events, which are equally likely in either mode, have a larger impact on the plant accident mitigation capability during Mode 4 than during Mode 3. A seismic event is very likely to result in an unrecoverable loss of offsite power event. Also, a seismic event is more likely to disable the condensate and fire water systems than the emergency core cooling system (ECCS). Since the RCIC and HPCI systems, which are designed for seismic loads, are available in Mode 3 and not in Mode 4, the plant ability to prevent core damage is higher in Mode 3 than in Mode 4.
Internal fire and flood events are equally likely to occur during Mode 3 or Mode 4, during either mode the same fire or flood event would impact the same equipment, most likely equipment located in the affected fire or flood zone.
Because there are more systems available for accident mitigation in Mode 3 than in Mode 4, the plants ability to prevent core damage is at least as good in Mode 3 as is in Mode 4.
The only transition risk which needs to be considered in the comparison of risks between the proposed and the current end states is the risk associated with the transition from Mode 3 to Mode 4. This risk is primarily due to the likelihood of a drain-down event while the RHR valves are being aligned for shutdown cooling. This transition risk, believed to be small, is most likely avoided when Mode 3 instead of Mode 4 is selected as the end state for short duration repairs. Therefore, there is no need to assess such a risk because it supports the position that it is safer to stay in Mode 3 rather than go to Mode 4.
During power operation, large early releases are the result of (1) energetic containment failure due to a high pressure core melt, (2) a containment bypass event, and (3) a core damage event occurring in combination with an unisolated containment. Compared to power operation, Mode 3 or Mode 4 operation is associated with lower initial energy level, reduced fission product inventory level and reduced decay heat load. Due to the combined effect of these factors, even though the initial RCS pressure during Mode 3 is higher than during Mode 4, the likelihood of large early release in Modes 3 and 4 is very low. These factors serve to provide time for the operator to respond to serious plant upsets and, consequently, they contribute to delaying the core melt progression and reducing radiation releases. Therefore, any potential increase due to changing the end state is negligible.
The BWROGs and the staffs review identified several areas of uncertainty, in both data and modeling assumptions, associated with the shutdown models of the representative BWR-4 plant which could have an impact on results and conclusions, including the following:
Accident initiating event frequencies used in the risk analysis;
The failure rate of containment vent valve;
Failure rate of operator to vent the containment;
Common cause failure of all emergency diesel generators (EDGs).
The identified areas of uncertainty were evaluated to determine how they impact the results and conclusions of the quantitative risk assessment. Major risk insights from this evaluation, which included whenever necessary the performance of sensitivity studies, are documented in Sections 4.3 and 4.4 of this SE.
The BWROGs and the staffs review identified several important design and operational differences between the various BWR plants and the representative BWR-4 plant used in the quantitative risk assessment. The risk impact of such differences was investigated by a combination of quantitative sensitivity studies and qualitative comparison of features. The purpose of the investigation was to extend the results and conclusions of the quantitative risk assessment to other BWR product lines beyond the representative BWR-4 plant. Some important design and operational differences that were investigated are:
BWR-2 and early BWR-3 product line plants are equipped with ICs instead of RCIC systems.
BWR-2 plants are equipped with eight CS pumps in two loops with two pumps needed for successful core cooling. The representative BWR-4 plant model includes two CS pumps in two loops and four LPCI pumps with any one pump being sufficient to provide successful core cooling.
BWR-2 plants have no HPCS or HPCI pumps. The representative BWR-4 plant model includes one HPCI pump.
Certain BWR-4 plants are equipped with four CS pumps in two loops with two pumps in a loop needed for successful core cooling. The representative BWR-4 plant model includes two CS pumps in two loops with one pump in a loop needed for successful core cooling.
BWR-5 and BWR-6 plants are equipped with a motor-driven HPCS system which is powered by an independent diesel generator instead of the steam-driven HPCI system used by the representative BWR-4 plant model.
There is variability among BWR plants regarding the number of ADS valves as well as the number of SRVs which can be used to depressurize the reactor manually in case of ADS failure.
There is variability among BWR plants regarding procedures and training for aligning the fire water system for core cooling in Mode 3 (requires successful depressurization with three SRVs) and in Mode 4.
There is variability among BWR plants regarding procedures and training for aligning the CRD system for core cooling in Modes 3 and 4.
There is variability among BWR plants regarding the number of pumps for LPCS/CS and LPCI as well as regarding the availability of service water cross-tie to the LPCI and fire water pumps. The BWR-2 and early BWR-3 plants have fewer low pressure makeup systems.
Some BWR plants do not have the capability to align low pressure ECCS pumps to take suction from the condensate storage tank (CST) as is the case for the representative BWR-4 plant used in the quantitative risk assessment.
There is variability among BWR plants regarding the number and type of feedwater pumps. All plants have at least two feedwater pumps which can be all motor-driven, all steam-driven or a combination of both types.
There is variability among BWR plants regarding support systems. Important differences are in the number of EDGs, electrical divisions and service water loops.
The identified design and operational differences were evaluated to determine how they impact the results and conclusions of the quantitative risk assessment. Major risk insights from this evaluation, which included whenever necessary the performance of sensitivity studies, are documented in Sections 4.3 and 4.4 of this SE.
The staff concludes that the quality of the quantitative risk assessment, including the sensitivity studies performed to address uncertainties and differences among plants, is adequate to show that there are no significant risk increases associated with the proposed TS end state changes for BWR plants.
4.3 Risk Insights from the Qualitative Risk Assessment The BWROG report documents a generic qualitative comparison of shutdown risks in Modes 3 and 4 which aims to show that the proposed TS end state changes do not decrease defense-in-depth. Mode 3 and Mode 4 risks and defense-in-depth are qualitatively compared by discussing the means used to address critical functions and the availability of systems needed to mitigate likely accident initiating events. This generic risk comparison is complemented by a comparison of safety and operational features among BWR plants; a comparison needed to ensure that the conclusions of the generic qualitative risk assessment are valid for each BWR plant. It should be noted that the qualitative comparison of risks is based on a plant configuration which does not include any outages for maintenance. Comparison of risks between Modes 3 and 4 when specific maintenance outages are taking place are part of the quantitative risk assessment discussed in Section 4 of this SE.
Important insights regarding the various means used to accomplish critical functions and mitigate accidents occurring in Modes 3 and 4 are listed below:
The means used to achieve inventory control, reactivity control, reactor overpressure control, containment integrity control, and power availability are approximately equally reliable in Modes 3 and 4.
More means are available to perform the core decay heat removal critical function while the plant is operating in Mode 3 than when it is operating in Mode 4. For initiating events occurring in Mode 3, both the high and the low pressure systems can be used to provide core cooling. Although the high pressure systems can be used directly, the low pressure systems can be used following reactor depressurization which can be achieved reliably.
For initiating events occurring in Mode 4, only the low pressure systems can be used to provide core cooling (HPCS is available for BWR5/6). No credit is taken for using the high pressure systems when the low pressure systems fail during loss of RHR with subsequent re-pressurization of the reactor. The reason is that in Mode 4, the reactor is already depressurized and the steam driven high-pressure systems secured. They are not immediately available for loss of level or loss of cooling transients. Also, they are not required to be available. Following a transient initiator in Mode 4, the operator would use available low pressure water makeup system such as LPCI, LPCS, condensate, fire water system or RHR service water system crosstie. The operator would normally not attempt to use RCIC, for it would take too long to depressurize and initiate. In the highly unlikely scenario that repressurization from Mode 4 is required to either maintain level or cooling or if repressurization occurs because MSIVs fail closed, RCIC initiation would be a high stress human action and would have additional transition risk. Therefore, no credit was taken for HPCI or RCIC in the Mode 4 PRA. For BWR 5 and 6s, the motor driven HPCS pump would be available. However, credit for this was not taken in the generic model. This is primarily because many other low pressure injection and cooling water systems are available.
More means are available to perform the containment heat removal critical function while the plant is operating in Mode 3 than when it is operating in Mode 4. In Mode 4, the RHR system or containment venting can be used to remove heat from the containment. These means can be used also for initiating events occurring in Mode 3 following reactor depressurization, which can be achieved reliably. The difference is that the PCS can provide containment cooling in Mode 3 but not in Mode 4.
In Mode 3 operation, the reactor has to be depressurized before the low pressure systems can be used for core or containment cooling. This action can be achieved reliably because the automatic initiation of the ADS is backed up by manual initiation based on emergency operating procedures.
Potentially significant accident initiating events at shutdown and available mitigating systems were evaluated to establish the acceptability of Mode 3 end state as the default action for most TSs where partial equipment availability is assured and short-term repair is possible. Important insights are:
All potentially risk significant initiating events that can occur while the plant is operating in Mode 3 can be represented (or subsumed) by the following:
- Loss of coolant accidents (LOCAs);
- Loss of offsite power (LOOP);
- Loss of power conversion system; and
- Loss of service water.
All potentially risk significant initiating events that can occur while the plant is operating in Mode 4 can be represented (or subsumed) by the following:
- Loss of coolant inventory;
- LOOP;
- Loss of RHR in the SDC mode; and
- Loss of service water.
The risk impact of LOCAs, as pressure-driven initiating events, are not as significant in Modes 3 and 4 as they are in Mode 1. The major contributor to this initiator is loss of inventory caused by incorrect valve lineups. Since incorrect valve lineups are more likely during Mode 4 operation, the risk associated with LOCAs will be smaller if Mode 3 is adopted as the end state.
LOOP is an important initiating event in both Modes 3 and 4 with approximately the same frequency. Therefore, their risk impact is lower when there is more redundancy and diversity of the mitigating systems, as is the case when the plant is operating in Mode 3. The steam-driven high pressure core cooling systems, available in Mode 3 operation, play a major role in mitigating accidents initiated by LOOP events, including station blackout events.
Loss of the power conversion system in Mode 3 and loss of RHR in the SDC mode in Mode 4 are important initiating events of the same order of magnitude frequency. Since there is much more redundancy and diversity of the mitigating systems when the plant is operating in Mode 3, the risk impact associated with the loss of the PCS initiating event (occurring in Mode 3) is lower than the risk impact associated with the loss of RHR SDC initiating event (occurring in Mode 4).
Loss of service water is an important initiating event in both Modes 3 and 4 with approximately the same frequency. This initiator disables all core and containment cooling systems using the service water system to transfer heat to the ultimate heat sink, such as the RCIC system and the RHR system. In general, accidents initiated by loss of service water in either Mode 3 or Mode 4 are mitigated by using low pressure injection systems and containment venting. Since the SRVs are highly reliable, the risk impact associated with this initiating event is approximately the same for events occurring in Modes 3 and 4.
A comparison of risk important safety and operational features among BWR plants was made to show that the conclusions of the generic qualitative risk assessment are valid for each BWR plant. To facilitate the discussion, the safety features available in each of the BWR product lines are listed by safety function in Table 1. The differences shown in Table 1 do not change the conclusions of the qualitative risk assessment for the following reasons:
Although there are some differences among BWR plants regarding the means used for inventory makeup and heat removal at high pressures, all BWR plants have such features. Therefore, the conclusion that more means are available to perform the core decay and containment heat removal critical functions in Mode 3 than in Mode 4 is valid for any plant.
Table 1 Comparison of Safety Features of BWR Plants.
Safety Features by Safety Function BWR-2 BWR-3 BWR-4 BWR-5 BWR-6 High Pressure Makeup HPCI or HPCS RCIC or IC CRD Pumps None IC 2
Rx Depressurization ADS Valves 5 to 6 3 to 5 4 to 7 7
7 to 8 Low Pressure Makeup CS/LPCS Pumps/Loops LPCI Pumps Condensate Injection Service Water Cross-tie to LPCI Fire Water Pumps 8/2 None Yes None None 2/2 4
Yes None to Yes 2 to 3 2/2 to 4/2 4
Yes None to Yes 1 to 3 1/1 3
Yes None to Yes None 1/1 3
Yes None to Yes None to 3 Heat Removal Motor-Driven (MD) or Steam-Driven (SD)
Feedwater (FW) Pumps RHR Loops Containment Venting 2MD/1SD to 3MD 3
None to Yes 1 MD/2 SD or 3 MD or 2 SD 2
None to Yes 1 MD/2 SD or 3 MD or 2 SD 2
None to Yes Support Systems EDGs Electrical Divisions Service Water Loops 2
2 N/A 2
2 N/A to 2 2 to 4 2 or 4 2
3 3
2 to 3 3
3 2 to 3
Although there are differences in the number of ADS valves among BWR plants, there are enough valves for reliable reactor depressurization at all plants. Therefore, the conclusion that for accidents initiated in Mode 3 the reactor can be depressurized reliably so that the low pressure systems can be used is valid for any plant.
Although there are some differences among BWR plants regarding the means used for inventory makeup and heat removal at low pressures, these differences do not change any conclusions because they impact Mode 3 and Mode 4 risks at a specific plant equally. This is also true for differences among BWR plants regarding support systems.
The above listed insights lead to the conclusion that, in general, plant operation in Mode 3 (hot shutdown) offers at least the same robustness to plant upsets as operation in Mode 4 (cold shutdown). The insights gained from the quantitative risk study (listed below) substantiate this conclusion.
4.4 Risk Insights from the Quantitative Risk Assessment The objectives of the quantitative study were to (1) substantiate the conclusion of the qualitative risk assessment by providing numerical results for a representative plant, (2) investigate the robustness of the results to uncertainties in data and modeling assumptions through sensitivity studies, and (3) assess the applicability of the results to other BWR plants through sensitivity studies accounting for design and operational differences. The quantitative risk assessment was performed for a representative BWR-4 plant. Important safety features of the representative BWR-4 plant which are available in Modes 3 and 4 to mitigate accidents are listed by safety function in Table 2 of this SE.
The scope of the quantitative risk assessment was to compare the core damage risks associated with either staying in Mode 3 or going to Mode 4 to carry out equipment repairs.
This comparison was made for a number of cases based on selected combinations of equipment outages and the results are summarized in Table 3 of this SE. For each of the cases, CDF values were assessed for both the current end state (i.e., Mode 4) and the proposed end state (i.e., Mode 3). In addition to these two CDF values, the change in CDF due to changing the end state from Mode 4 to Mode 3 is also listed in Table 3 for each of the analyzed cases. Such CDF changes, CDF, are reported both in absolute and relative terms.
CDF changes shown in parentheses in Table 3 indicate CDF decreases.
Important results and insights from the quantitative risk assessment, which substantiate the conclusions of the qualitative risk assessment by providing numerical results, are listed below:
The CDF estimates, reported in Table 3, support the requested end state change.
These estimates show that staying in Mode 3, rather than going to Mode 4 to carry out equipment repairs, does not have any adverse effect on plant risk and under some circumstances may actually reduce risk. This conclusion is supported by the following:
When no equipment is taken out (base case), the CDF for Modes 3 and 4 is essentially identical. The Mode 3 CDF is slightly higher than the Mode 4 CDF.
The resulting difference in CDF, CDF, is about 1.0E-8/year which is insignificant.
Table 2 Safety Features of Representative BWR-4 Plant Available in Modes 3 and 4.
1No credit is taken for the high pressure systems following the failure of cooling systems in Mode 4 and subsequent re-pressurization of the reactor.
2Manual depressurization using SRVs is required when in Mode 3.
3Manual depressurization using SRVs is required to use RHR in SDC mode.
Safety Features by Safety Function Representative BWR-4 Plant Available in Mode 3 Available in Mode 4 High Pressure Makeup1 HPCI RCIC 2 CRD Pumps Yes Yes Yes No No Yes Reactor Depressurization 6 ADS Valves Yes Not required Low Pressure Makeup2 2 core spray pumps in 2 loops 4 LPCI pumps Condensate injection Service water cross-tie to LPCI 3 fire water pumps Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Heat Removal3 2 SD FW pumps 2 RHR loops Containment venting Yes Yes Yes No Yes Yes Support Systems 2 EDGs 2 electrical divisions 2 service water loops Yes Yes Yes Yes Yes Yes Table 3 Core Damage Frequency Change due to Changing the End State from Mode 4 to Mode 3 for Selected Combinations of Equipment Outages.
Case Description Mode 4 CDF/yr Mode 3 CDF/yr Absolute CDF/yr Relative CDF/yr (in%)
1 Base Case (no outages) 1.52E-6 1.53E-6 1.0E-8 0.8 2
One LPCS loop out 1.52E-6 1.53E-6 1.0E-8 0.8 3
Both RHR pumps in loop A out 2.26E-5 1.36E-5 (9.0E-6)
(66.3) 4 One SW booster pump out 1.62E-6 1.59E-6 (3.3E-8)
(2.1) 5 One SW booster pump in each loop out 1.67E-6 1.64E-6 (2.8E-8)
(1.7) 6 Two SW booster pumps in one loop out 2.26E-5 1.36E-5 (9.0E-6)
(66.4) 7 One SW pump out 1.56E-6 1.56E-6 (1.0E-9)
(0.1) 8 One SW pump in each subsystem out 1.60E-6 1.60E-6 0.0 0.0 9
One EDG inoperable 7.53E-6 7.54E-6 1.0E-8 0.1 10 Two EDGs inoperable 1.06E-4 1.07E-4 1.0E-7 0.1 11 One EDG & one emergency offsite power out 6.12E-5 6.00E-5 (1.1E-6)
(1.8) 12 Two EDGs & one emergency offsite power out 9.63E-4 9.66E-4 3.1 E-6 0.3 13 4.1kV bus 1F out 1.08E-3 1.94E-4 (8.8E-4)
(457) 14 125V dc bus 1A out 3.54E-5 2.58E-5 (9.5E-6)
(37) 15 HPCI out 1.52E-6 1.55E-6 3.5E-8 2.3 16 HPCI & one LPCI pump out 2.26E-5 1.36E-5 (9.0E-6)
(66) 17 HPCI & one LPCS pump out 1.52E-6 1.55E-6 3.6E-8 2.3 18 RCIC out 1.52E-6 1.57E-6 5.7E-8 3.6
For the majority of analyzed cases with equipment outages, the CDF for Modes 3 and 4 are approximately equal. In all such cases the resulting CDF, either an increase or a decrease, is insignificant.
When one or more redundant trains of pieces of important equipment, such as the RHR system, the service water system and the AC and DC power sources, are taken out-of-service, the Mode 3 CDF is significantly lower than the Mode 4 CDF. This indicates that, for outages involving these important systems, the proposed end state change would lead to significant risk reductions.
Two accident initiating events are major contributors to risk in both Modes 3 and 4: (1) loss of offsite power, and (2) loss of service water. In addition, the loss of RHR in the SDC mode becomes a significant risk contributor when certain equipment, such as one RHR loop, is out during Mode 4.
Mode 3 and Mode 4 risks are essentially equal when no equipment is taken out even though more systems are available in Mode 3 than in Mode 4 to mitigate accidents.
This is due to the high redundancy and reliability of the low pressure systems which are used to mitigate accidents occurring in Mode 4 and also, following depressurization, in Mode 3.
When certain parts (e.g., components and trains) of low pressure and their support systems are taken out, Mode 4 risks become significantly higher than Mode 3 risks.
This is due to the increased importance of the high pressure systems, which are available only in Mode 3, as the redundancy of low pressure systems decreases.
A common element driving the risk of accidents occurring in both Mode 3 and Mode 4 is containment cooling. All accident sequences initiated in Mode 3 or Mode 4, except for Mode 3 transients with the power conversion system available, require containment heat removal using the RHR pumps (in either the SPC or the SDC mode) or containment venting to avoid core damage. In other words, when an accident is initiated in either Mode 3 or Mode 4, the failure of RHR in both the SPC and SDC modes followed by operator failure to vent the containment leads to core damage, even when all other high and low pressure systems are successful. The contribution of this element to risk depends on the initiating event and the configuration of the plant (i.e., the number and type of unavailable equipment). Some important insights related to this element, which help understand the differences between Mode 3 and Mode 4 risks are:
During a station blackout (SBO) event the RHR pumps are unavailable.
Therefore, containment venting is required to avoid core damage. Successful containment venting requires coolant injection by the fire water pumps. If the plant operates in Mode 3 when the SBO occurs, there is more time available to align and start the fire water pumps than it is in the case of Mode 4 operation.
The reason that more time is available in Mode 3, which increases the probability of success, is due to the fact that in Mode 3 the steam driven RCIC and HPCI pumps are available for initial core cooling.
If core cooling is lost in Mode 3 (i.e., the PCS is lost) while one RHR loop is out, successful operation of the second RHR loop or successful containment venting is required to avoid core damage. However, if core cooling is lost in Mode 4 (i.e.,
the operating RHR SDC loop is lost) while one RHR loop is out, successful containment venting is required to avoid core damage. Thus, when an RHR loop is out, the loss of core cooling initiating event is a larger risk contributor in Mode 4 than in Mode 3.
Based on the results of the quantitative risk assessment for the representative BWR-4 plant, one can conclude that in certain cases it is safer to stay in Mode 3 (hot shutdown) than going to Mode 4 (cold shutdown) to carry out equipment repair. For the remaining cases, staying in Mode 3 has no adverse effect on plant risk. The robustness of such a conclusion has been investigated by performing sensitivity studies to assess the impact of uncertainties in data and modeling assumptions. In addition, through sensitivity studies and/or comparison of the differences among the various BWR product lines (summarized in Table 1 of this SE) with the features of the representative BWR-4 plant (summarized in Table 2 of this SE), this conclusion has been extended to all BWR plants.
Important insights from the investigation of the robustness of the results to uncertainties in data and modeling assumptions through sensitivity studies are listed below.
Based on the review of the risk assessment results, the following three basic events were considered for sensitivity studies: (1) the failure rate of containment vent valves; (2) the operator failure probability to vent the containment; and (3) the common cause failure of all EDGs. The results of such studies are summarized in Table 4. These results indicate that any changes in CDF that could result from changes in data are very small and would not impact the conclusion regarding the proposed TS end state change.
Accident initiating event frequencies were calculated based on a combination of operating experience and data from previous PRA studies. Because some of these frequencies are important contributors to risk, the sensitivity of the risk assessment results to values assumed for these frequencies was investigated. It was found that when the initiating event frequencies are increased, the resulting difference in CDF, CDF, makes the justification of the proposed change even stronger. Reducing the frequencies reduces the CDF values, which are already low, by less than 1 percent.
Therefore, it was concluded that the results and conclusions of the quantitative risk assessment are not sensitive to reasonable changes in the frequencies of the dominant initiating events.
The robustness of the results, as they impact the conclusions of the risk assessment, is reinforced by many conservative assumptions, such as the ones regarding success criteria for CRD pumps and SRVs (the assumption that two CRD pumps are needed for core cooling to mitigate accidents initiated in Modes 3 and 4 is conservative as is the assumption that three SRVs are needed to depressurize the reactor in order to permit low pressure coolant injection for accidents initiated in Mode 3).
These insights indicate that the results of the quantitative risk assessment are robust and that the conclusions of both the qualitative and quantitative risk assessments do not change when uncertainties in data and modeling assumptions are considered.
Table 4 Sensitivity Studies Used to Investigate the Impact of Uncertainties in Data on the Results of the Quantitative Risk Assessment.
Case Mode 4 CDF (per year)
Mode 3 CDF (per year)
CDF (per year)
Base Case (no outages) 1.52E-6 1.53E-6 1.0E-8 The failure rate of containment vent valve increased 10 times 3.0E-6 3.2E-6 2.0E-7 The failure rate of containment vent valve was decreased 10 times 1.4E-6 1.4E-6 1.0E-9 The failure probability of operator to vent the containment was increased 10 times 2.5E-6 2.6E-6 1.0E-7 The failure probability of operator to vent the containment was decreased 10 times 1.4E-6 1.4E-6 1.0E-9 The common cause failure of all EDGs was increased 10 times 2.8E-6 2.8E-6 5.0E-9 The common cause failure of all EDGs was decreased 10 times 1.4E-6 1.4E-6 1.0E-9 Important insights from the assessment of the applicability of the representative BWR-4 plant results to other BWR plants, through sensitivity studies accounting for design and operational differences and/or direct comparison of features using risk insights for the representative BWR-4 plant, are listed below:
BWR-2 and early BWR-3 product line plants are equipped with an IC instead of the RCIC system of the representative BWR-4 plant. The IC and RCIC are both steam driven systems with similar reliability. The only difference, with respect to the function they perform, that could affect CDF is that the RCIC system can be used in Mode 3 to mitigate small LOCAs while the IC cannot be used for that purpose. However, small LOCAs are insignificant contributors to Mode 3 risk. Therefore, the impact that this difference has on the results of the quantitative risk assessment is negligible.
BWR-2 plants are equipped with eight CS pumps in two loops with two pumps needed for successful core cooling. The representative BWR-4 plant model includes two CS pumps in two loops and four LPCI pumps with any one pump being sufficient to provide successful core cooling. Because both BWR-2 and BWR-4 plants have many low pressure cooling systems, the impact that this difference has on the results of the quantitative risk assessment is negligible. The same argument is used for other differences in low pressure systems among BWR plants, such as:
Certain BWR-4 plants are equipped with four CS pumps in two loops with two pumps in a loop needed for successful core cooling while the representative BWR-4 plant model includes two CS pumps in two loops with one pump in a loop needed for successful core cooling; and
There is variability among BWR plants regarding the number of pumps for LPCS and LPCI as well as regarding the availability of service water cross-tie to the LPCI and fire water pumps. Although the BWR-2 and early BWR-3 plants have fewer low pressure makeup systems than the representative BWR-4 plant, this difference has no impact on the results because all BWR plants have many low pressure cooling systems.
BWR-2 plants have no HPCS or HPCI pumps. The representative BWR-4 plant model includes one HPCI pump. Based on insights from the quantitative risk assessment for the representative BWR-4 plant, this difference has no significant impact on risk because of the many high and low pressure systems available to mitigate an accident.
Based on the review of the results, three design and/or operational differences among BWR plants were considered for sensitivity studies. These are:
Variability among BWR plants regarding procedures and training for aligning the fire water system for core cooling in Mode 3 (requires successful depressurization with three SRVs) and in Mode 4;
Some BWR plants do not have the capability to align low pressure ECCS pumps to take suction from the CST as is the case for the representative BWR-4 plant used in the quantitative risk assessment; and
Variability among BWR plants regarding procedures and training for aligning the CRD system for core cooling in Modes 3 and 4.
These results, summarized in Table 5, indicate that any changes in CDF that could result from such design and operational differences are very small and would not impact the conclusion regarding the proposed TS end state change.
Table 5 Impact of Design and Operational Differences on the Results of the Quantitative Risk Assessment for the Representative BWR-4 Plant.
Case Mode 4 CDF (per year)
Mode 3 CDF (per year)
CDF (per year)
Base case (no outages) 1.52E-6 1.53E-6 1.0E-8 No credit for the fire water system 1.58E-6 1.59E-6 1.0E-8 No credit for capability to align the low pressure ECCS pumps to CST 1.5E-6 1.5E-6 1.0E-9 No credit for the CRD system 1.58E-6 1.59E-6 1.0E-8
BWR-5 and BWR-6 plants are equipped with a motor-driven HPCS system which is powered by an independent diesel generator instead of the steam-driven HPCI system used by the representative BWR-4 plant model. Both systems have similar reliability to mitigate accidents occurring in Mode 3 and can function during a station blackout since the HPCI system is steam driven and the HPCS system is powered by an independent power source (diesel generator). Although the HPCS system can be used also in Mode 4 (HPCI is available only in Mode 3), this difference does not have a significant impact on the results because of the many core cooling systems available in Mode 3.
There is variability among BWR plants regarding the number of ADS valves as well as the number of SRVs which can be used to depressurize the reactor manually in case of ADS failure. Reactor depressurization, required to take advantage of the low pressure makeup and heat removal systems for accidents occurring in Mode 3, can be accomplished by either manual opening of selected SRVs or by the ADS. The failure of one or two SRVs or one ADS valve is not a significant contributor to the Mode 3 CDF based on the number of remaining valves available in BWR plants to depressurize the reactor. Therefore, the difference in the number of ADS valves and SRVs among BWR plants does not have a significant impact on the results of the quantitative risk assessment and, thus, does not change the conclusion regarding the proposed TS end state change.
There is variability among BWR plants regarding the number and type of feedwater pumps. All plants have at least two feedwater pumps which can be all motor-driven, all steam-driven or a combination of both types. Since the representative BWR-4 plant assumes a minimum number of feedwater pumps in relation to other plants, the Mode 3 CDF will be even smaller when more pumps are available. Therefore, this difference among plants does not change the conclusion regarding the proposed TS end state change.
There is variability among BWR plants regarding support systems. Important differences are in the number of EDGs, electrical divisions and service water loops.
Since the representative BWR-4 plant assumes minimum support system redundancy in relation to other plants, the Mode 3 CDF will be even smaller when more redundancy in support systems is available. Therefore, this difference among plants does not change the conclusion regarding the proposed TS end state change.
Not all BWR plants have containment venting capability, as is assumed for the representative BWR-4 plant. Since containment venting applies to both Mode 3 and Mode 4 accidents, the relative difference in CDF between Modes 3 and 4 would not change if containment venting is not available. Therefore, this difference among plants does not change the conclusion regarding the proposed TS end state change.
These insights indicate that the results of the quantitative risk assessment are robust and that the conclusions of both the qualitative and quantitative risk assessments do not change when the impact of design and operational differences among BWR plants is considered.
The staff believes that the above listed insights substantiate the generic conclusion that plant operation in Mode 3 (hot shutdown) offers at approximately the same, and in some cases may be higher, robustness to plant upsets as operation in Mode 4 (cold shutdown).
Finally, risk insights from both the qualitative and quantitative risk assessments were used in specific TS assessments. Such assessments are documented in Section 4.5 of the BWROG topical report. They provide an integrated discussion of deterministic and probabilistic issues, focusing on specific technical specifications, which are used to support the proposed TS end state. The staffs review finds that the risk insights support the conclusions of the specific TS assessments.
4.6 Conclusions for Risk Assessment The staffs review finds that the BWROGs risk assessment approach is comprehensive and follows staff guidance as documented in RGs 1.174 and 1.177. In addition, the analyses show that the criteria of the three-tiered approach for allowing TS changes (documented in RG 1.177) are met as explained below:
Risk Impact of the Proposed Change (Tier 1). The risk changes associated with the proposed TS changes, in terms of mean yearly increases in CDF and LERF, are risk neutral or risk beneficial. In addition, there are no significant temporary risk increases, as defined by RG 1.177 criteria, associated with the implementation of the proposed TS end state changes.
Avoidance of Risk-Significant Configurations (Tier 2). The performed risk analyses, which are based on single LCOs, have shown that there are no high risk configurations associated with the proposed TS end state changes. The reliability of redundant trains is normally covered by a single LCO. When multiple LCOs occur, which affect trains in several systems, the plants risk-informed CRMP, implemented in response to the Maintenance Rule [10 CFR 50.65(a)(4)], will ensure that high risk configurations are avoided. As part of the implementation of 10 CFR 50.65 (a)(4) program, licensees are expected to include guidance in appropriate plant procedures and/or administrative controls to preclude high risk plant configurations when the plant is at the proposed end state. The staff finds that such guidance is adequate for preventing risk-significant plant configurations.
Configuration Risk Management (Tier 3). Licensees have programs in place to comply with 10 CFR 50.65(a)(4) to assess and manage the risk from proposed maintenance activities. These programs can support licensee decisionmaking regarding the appropriate actions to control risk whenever a risk-informed TS is entered.
The generic risk impact of the proposed end state mode change was evaluated subject to the following assumptions:
The entry into the proposed end state is initiated by the inoperability of a single train of equipment or a restriction on a plant operational parameter, unless otherwise stated in the applicable technical specification;
The primary purpose of entering the end state is to correct the initiating condition and to return to power as soon as it is practical.
These assumptions are consistent with typical entries into Mode 3 for short duration repairs, which is the intended use of the TS end state changes.
The staff concludes that, in general, going to Mode 3 (hot shutdown) instead of going to Mode 4 (cold shutdown) to carry out equipment repairs does not have any adverse effect on plant risk.
Therefore, the staff finds that the risk information provided by the BWROG supports the requested change.
5.0 RISK AND DEFENSE-IN-DEPTH ARGUMENTS 5.1 General Risk Argument The staff reviewed the risk assessments performed by the BWROG and concluded (Section 4.0 of this SE) that staying in Mode 3 (hot shutdown) instead of going to Mode 4 (cold shutdown) to carry out equipment repairs does not have an adverse effect on plant risk and may actually reduce risk. Indeed, the plant risk is considerably smaller in Mode 3 than it is in Mode 4 for many plant configurations associated with several important equipment outages allowed by TS.
In addition, the proposed change allows repairs to be made in a plant operating mode with lower risks than full power operation and without challenging the normal shutdown systems.
After repairs are made, the plant can be brought to full power operation with the least potential for transients and operator error.
5.2 General Defense-in-Depth Argument The BWROG proposes several system-specific changes to TS end states. Such changes are described in Section 4.5 of the BWROG topical report together with TS change-specific justifications. Risk insights from both the qualitative and quantitative risk assessments were used in these justifications. In addition to the risk arguments, defense-in-depth arguments are used to justify each system-specific TS change, in accordance with the "integrated decision-making" process of RGs 1.174 and 1.177. The staffs assessment of each specific TS change justification is documented in Section 6.0 of this SE.
A comparison between the current (Mode 3) and the proposed (Mode 4) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases, leads to the following three conclusions.
The first two conclusions are applicable to all proposed specific TS changes. The third conclusion applies only to those TS changes which are related to systems whose function is to mitigate radiation releases associated with design basis accidents (e.g., the MSIV LCS).
Because of the commonality of these conclusions, they are listed here to avoid repetition throughout Section 6.0.
More means are available when the plant is operating in Mode 3 than when it is operating in Mode 4 to perform critical functions, such as core heat removal, containment heat removal and water makeup, whose success is needed to prevent core damage and containment failure. For accidents initiated in Mode 3, both the high (e.g.,
HPCI/HPCS and RCIC) and the low pressure systems can be used to provide core cooling. Also, the PCS can provide containment cooling in Mode 3, but not in Mode 4.
In addition, the availability of the steam-driven high pressure core cooling systems in Mode 3 provide a much better defense-in-depth in mitigating accidents initiated by loss of offsite power, including station blackout events. Although the high pressure systems can be used directly, the low pressure systems can be used following reactor depressurization which can be achieved reliably because the automatic initiation of the ADS is backed-up by manual initiation based on emergency procedures.
The same means are available when the plant is operating in Mode 3 as when it is operating in Mode 4 for mitigating large early releases. Compared to power operation, Mode 3 or Mode 4 operation is associated with lower initial energy level, reduced fission product inventory level and reduced decay heat load. Due to the combined effect of these factors, the likelihood of large early release in Modes 3 and 4 is very low (as can be determined by a direct comparison to the LERF at power operation). Therefore, any potential increase in LERF that would result from the higher values of these factors in Mode 3, as compared to Mode 4, is negligible. Furthermore, when the improved defense-in-depth with respect to core damage and containment failure prevention in Mode 3 are taken into consideration, a net reduction in LERF during Mode 3 operation is likely.
The same means are available when the plant is operating in Mode 3 as when it is operating in Mode 4 for mitigating any radiation releases above TS limits, such as those from leaking MSIVs. Compared to power operation, Mode 3 or Mode 4 operation is associated with lower initial energy level, reduced fission product inventory level and reduced decay heat load. Due to the combined effect of these factors, any radiation releases in either Mode 3 or Mode 4 would be considerably smaller than they are when the accident occurs at power operation. For all practical purposes, the magnitude of such releases can be considered comparable. Furthermore, an examination of the likely accident initiating events that could occur in Modes 3 and 4 shows that the major contributor to a LOCA, which has the potential to create the highest pressure in the containment and the largest leak rate through leaking valves, is loss of inventory caused by incorrect valve lineups. Since incorrect valve lineups are more likely during Mode 4 operation, the magnitude of any radiation releases through leaking valves could be larger in Mode 4 than in Mode 3. Therefore, when the improved defense-in-depth with respect to core damage and containment failure prevention in Mode 3 are also taken into consideration, one can conclude that the frequency of comparable radiation releases through leaking valves, will not be higher for Mode 3 operation than it is for Mode 4 operation.
The staffs review is limited to the concept of allowing the plant to be in Mode 3 rather than Mode 4. The industry TSTF will provide the marked-up changes to the STS. The staff will review the marked-up changes when they are submitted.
In general, the BWROG followed the improved standard technical specifications (ISTS) CT in establishing required mode entry times.
6.0 ASSESSMENT
OF PROPOSED TS CHANGES The staffs review is limited to the concept of allowing the plant to be in Mode 3 rather than Mode 4 for the following TS. The industry TS task force (TSTF) will provide the marked-up changes to the STS. The staff will review the marked-up changes when they are submitted.
1.
TS 4.5.1.2 and LCO 3.4.3 (BWR-4); TS 4.5.2.2 and LCO 3.4.4 (BWR-6) - Safety/Relief Valves (SRVs)
The function of the SRVs is to protect the plant against severe overpressurization events.
These TSs provide the operability requirements for the SRVs as described below. The TS change allows the plant to remain in Mode 3 until the repairs are completed.
Plant applicability: BWR-4/6 LCO: The safety function of 11 SRVs must be operable (BWR-4 plants). The safety function of seven SRVs must be operable and the relief function of seven additional SRVs must be operable (BWR-6 plants).
Condition requiring entry into end state: If the LCO cannot be met with one or two SRVs inoperable, the inoperable valves must be returned to operability within 14 days. If the SRVs cannot be returned to operable status within that time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Proposed modification for end state required actions: If the LCO cannot be met with one or two SRVs inoperable, the inoperable valves must be returned to operability within 14 days. If the one or two inoperable SRVs cannot be returned to operable status within 14 days, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. If three or more SRVs become inoperable, the plant must be placed in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Assessment: The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and in the proposed Mode 3 end state. The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4. Going to Mode 4 for one inoperable SRV would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system. In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the necessary overpressure protection function and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state. The proposed change would allow the inoperable SRV to be repaired in a plant operating mode with lower risks. After repairs are made, the plant can be brought to full-power operation with less potential for transients and errors. The plant is taken into cold shutdown only when three or more SRVs are inoperable.
Finding: The requested change to allow operation in Mode 3 with a minimum number of SRVs inoperable is acceptable after a plant-specific evaluation. Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
2.
TS 4.5.1.3 and LCO 3.5.1 (BWR-4); TS 4.5.2.3 and LCO 3.5.1 (BWR-6) - ECCS (Operating)
The ECCS provides cooling water to the core in the event of a LOCA. This set of ECCS TSs provide the operability requirements for the various ECCS subsystems as described below. This TS change would delete the secondary actions. The plant can remain in Mode 3 until the required repair actions are completed. The reactor is not depressurized.
Plant applicability: BWR-4/6 LCO: Each ECCS injection/spray subsystem and the ADS function of seven (BWR-4) and eight (BWR-6) SRVs must be operable.
Conditions requiring entry into end state: If the LCO cannot be met, the following actions must be taken for the listed conditions:
(a)
If one low-pressure ECCS injection/spray subsystem is inoperable, the subsystem must be restored to operable status in 7 days.
(b)
If the inoperable ECCS injection/core spray cannot be restored to operable status, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (BWR-4 plants only).
(c)
If two ECCS injection subsystems are inoperable or one ECCS injection subsystem and one ECCS spray system are inoperable, one ECCS injection/spray subsystem must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. If this required action cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (BWR-6 plants only).
(d)
If the HPCI/HPCS system is inoperable, the RCIC system must be verified to be operable by administrative means within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and the HPCI/HPCS system restored to operable status within 14 days.
(e)
If one ADS valve is inoperable, it must be restored to operable status within 14 days.
(f)
If one ADS valve is inoperable and one low-pressure ECCS injection/spray subsystem is inoperable, the ADS valve must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or the low-pressure ECCS injection/spray subsystem must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
(g)
If two or more ADS valves become inoperable or the required actions described in items (e) and/or (f) cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and the reactor steam dome pressure reduced to less than 150 psig within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Proposed modification for end state required actions:
(a)
No change.
(b)
If the inoperable ECCS injection or spray system is inoperable, the plant must be restored to operable status within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The plant is not taken into Mode 4 (cold shutdown).
(c)
If two ECCS injection subsystems are inoperable or one ECCS injection subsystem and one ECCS spray system are inoperable, one ECCS injection/spray subsystem must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. If this required action cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The plant is not taken into Mode 4 (BWR-6 plants only).
(d)
No change.
(e)
No change.
(f)
No change.
(g)
If two or more ADS valves become inoperable or the required actions described in items (e) and/or (f) cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The reactor is not depressurized.
Assessment: The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and the proposed Mode 3 end state. The evaluation indicates that the core damage risks are lower in Mode 3 than in the current end state (Mode 4). Going to Mode 4 for one ECCS subsystem or one ADS valve would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system. In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the reactor coolant inventory and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
3.
TS 4.5.1.4 and LCO 3.5.3 (BWR-4 only) - RCIC System The function of the RCIC system is to provide reactor coolant makeup during loss of feedwater and other transient events. This TS provides the operability requirements for the RCIC system as described below. The TS change allows the plant to remain in Mode 3 until the repairs are completed.
Plant applicability: BWR-4 LCO: The RCIC system must be operable during Modes 1, 2 and 3 when the reactor steam dome pressure is greater than 150 psig.
Condition requiring entry into end state: If the LCO cannot be met, the following actions must be taken: (a) verify by administrative means within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> that the HPCI system is operable, and (b) restore the RCIC system to operable status within 14 days. If either or both actions cannot be completed within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and the reactor steam dome pressure reduced to less than 150 psig within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Proposed modification for end state required actions: This TS change keeps the plant in Mode 3 (hot shutdown) until the required repairs are completed. The reactor steam dome pressure is not reduced to less than 150 psig.
Assessment: This change would allow the inoperable RCIC system to be repaired in a plant operating mode with lower risk and without challenging the normal shutdown systems. The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and in the proposed Mode 3 end state. The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4. Going to Mode 4 for inoperability of RCIC would also cause loss of the high-pressure steam-driven injection system HPCI and loss of the power conversion system (condenser/feedwater), and would require activating the RHR system. The EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the necessary overpressure protection function and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
4.
TS 4.5.1.6 and LCO 3.6.1.6 (BWR-4); TS 5.5.2.5 and LCO 3.6.1.6 (BWR-6) - Low-Low Set (LLS) Logic Valves The function of LLS logic is to prevent excessive short-duration SRV cycling during an overpressure event. This TS provides operability requirements for the four LLS SRVs as described below. The TS change allows the plant to remain in Mode 3 until the repairs are completed.
Plant applicability: BWR-4/6 Conditions requiring entry into end state: If one LLS valve is inoperable, it must be returned to operability within 14 days. If the LLS valve cannot be returned to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Proposed modification for end state required actions: The TS change would keep the plant in Mode 3 until the required repair actions are completed. The plant would not be taken into Mode 4 (cold shutdown).
Assessment: The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and the proposed Mode 3 end state. The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4, the current end state. Going to Mode 4 for one LLS inoperable SRV would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and would require activating the RHR system. With one LLS valve inoperable, the remaining valves are adequate to perform the required function. The EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the necessary overpressure protection function during the infrequent and limited time in Mode 3 and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state. The proposed change allows repairs of the inoperable SRV to be performed in a plant operating mode with lower risks.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
5.
TS 4.5.1.1, TS 4.5.2.1 and LCO 3.3.8.2 - Reactor Protection System (RPS) Electric Power Monitoring RPS electric power monitoring system is provided to isolate the RPS bus from the motor generator (MG) set or an alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the load connected to the RPS bus against unacceptable voltage and frequency conditions and forms an important part of the primary success path of the essential safety circuits. Some of the essential equipment powered from the RPS buses includes the RPS logic, scram solenoids, and various valve isolation logic. The TS change allows the plant to remain in Mode 3 until the repairs are completed.
Plant applicability: BWR-4/6 LCO: For Modes 1, 2, 3 and Modes 4 and 5 (with any control rod withdrawn from a core cell containing one or more fuel assemblies) two RPS electric power monitoring assemblies shall be operable for each in-service RPS motor generator set or alternate power supply.
Condition requiring entry into end state: If the LCO cannot be met, the associated in-service power supply(s) must be removed from service within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for one electric power assembly (EPM) inoperable or one hour for both EPM assemblies inoperable. If the in-service power supply cannot be removed from service within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Proposed modification for end state required actions: The proposed change is to keep the plant in Mode 3 until the repair actions are completed. Delete required action in C.2 which required the plant to be in Mode 4.
Assessment: To reach Mode 3 in accordance with the TS, there must be a functioning power supply with degraded protective circuitry in operation. However, the overvoltage, undervoltage, or underfrequency condition must exist for an extended time period to cause damage. This is a low probability of this occurring in the short period of time that the plant remains in Mode 3 without this protection.
The specific failure condition of interest is not risk significant for BWR PRAs. If the required restoration actions cannot be completed within the specified time, going into Mode 4 would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system.
In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the RPS power monitoring system during the infrequent and limited time in Mode 3 and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state.
Finding : Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
6.
TS 4.5.1.19 and LCO 3.8.1 (BWR-4); TS 4.5.2.17 and LCO 3.8.1 (BWR-6) - AC Sources (Operating)
The purpose of the AC electrical system is to provide the power required during all situations to put the plant in a safe condition and prevent the release of radioactive material to the environment.
The Class 1E electrical power distribution system AC sources consist of the offsite power source (preferred power sources, normal and alternate(s)), and the onsite standby power sources (emergency diesel generators). In addition, many sites provide a crosstie capability between units.
As required by General Design Criterion (GDC) 17 of 10 CFR Part 50, Appendix A, the design of the AC electrical system provides independence and redundancy. The onsite Class 1E AC distribution system is divided into redundant divisions so that the loss of any one division does not prevent the minimum safety functions from being performed. Each division has connections to two preferred offsite power sources and a single diesel generator.
Offsite power is supplied to the unit switchyard(s) from the transmission network by two transmission lines. From the switchyard(s), two electrically and physically separated circuits provide AC power through a step down transformer(s) to the 4.16 KV emergency buses.
In the event of a loss of off-site power, the emergency electrical loads are automatically connected to the EDGs in sufficient time to provide for a safe reactor shutdown and to mitigate the consequences of a design basis accident (DBA) such as a LOCA.
Plant applicability: BWR-4/6 LCO: The following AC electrical power sources shall be operable in Modes 1, 2, and 3:
(a)
Two qualified circuits between the offsite transmission network and the onsite Class 1E AC electric power distribution system, (b)
Three diesel generators, and (c)
Automatic Sequencers.
Condition requiring entry into end state: Plant operators must bring the plant to Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following the sustained inoperability of one required automatic load sequencer either or both required offsite circuits, either one, two or three or required diesel generators, or one required offsite circuit and one, two or three required diesel generators.
Proposed modification for end state required actions: Delete required action G.2 to go to Mode 4 (cold shutdown). The plant will remain in Mode 3 (hot shutdown).
Assessment: Entry into any of the conditions for the AC power sources implies that the AC power sources have been degraded and the single failure protection for the safe shutdown equipment may be ineffective. Consequently, as specified by TS 3.8.1, at present the plant operators must bring the plant to Mode 4 when the required action is not completed by the specified time for the associated action.
The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and in the proposed Mode 3 end state. Events initiated by the loss of offsite power are dominant contributors to core damage frequency in most BWR PRAs, and the steam driven core cooling systems IC, RCIC and HPCI play a major role in mitigating these events.
The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4 for one inoperable AC power source. Going to Mode 4 for one inoperable AC power source would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system.
In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the AC power and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are lower than going to the Mode 4 end state.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
7.
4.5.1.20 TS LCO 3.8.4 (BWR-4), 4.5.2.18 TS LCO 3.8.4 - DC Sources (Operating)
The purpose of the DC power system is to provide a reliable source of DC power for both normal and abnormal conditions. It must supply power in an emergency for an adequate length of time until normal supplies can be restored.
The DC electrical system:
(a)
Provides AC emergency power system with control power, (b)
Provides motive and control power to selected safety related equipment, and (c)
Provides power to preferred AC vital buses (via inverters).
Plant applicability: BWR 4/6 LCO: For Modes 1, 2 and 3, the following DC sources are required to be operable:
BWR-4: The (Division 1 and Division 2 station service, and DG 1B, 2A, and 2C) DC electrical power systems shall be operable.
BWR-6: The (Divisions 1, 2, and 3) DC electrical power subsystems shall be operable.
Condition requiring entry into end state: The plant operators must bring the plant to Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following the sustained inoperability of one DC electrical power subsystem for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
Proposed modification for end state required actions: The proposed TS change is to remove the requirement to place the plant in Mode 4. The required action in D.2 (BWR-4) and E.2 (BWR-6) are deleted.
Assessment: If one of the DC electrical power subsystems is inoperable, the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and in the proposed Mode 3 end state. Events initiated by the loss of offsite power are dominant contributors to core damage frequency in most BWR PRAs, and the steam driven core cooling systems IC, RCIC and HPCI play a major role in mitigating these events. The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4. Going to Mode 4 for one inoperable DC power source would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system. In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the DC power and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
8.
TS 4.5.1.21 and LCO 3.8.7 (BWR-4); TS 4.5.2.19 and 3.8.7 (BWR-6) - Inverters (Operating)
In Modes 1, 2, and 3, the inverters provide the preferred source of power for the 120 V AC vital buses which power the RPS and the ECCS initiation. The inverter can be powered from an internal AC source/rectifier or from the station battery.
Plant applicability: BWR-4/6 LCO: For Modes 1, 2, and 3 the following inverters shall be operable:
BWR-4: The Division 1 and Division 2 shall be operable.
BWR-6: The Divisions 1, 2, and 3 shall be operable.
Condition requiring entry into end state: The plant operators must bring the plant to Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following the sustained inoperability of the required inverter for a period of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
Proposed modification for end state required actions: The proposed TS change is to remove the requirement to place the plant in Mode 4. The Required action in B.2 (BWR-4) and C.2 (BWR-6) are deleted.
Assessment: If one of the inverters is inoperable, the remaining inverters have the capacity to support a safe shutdown and to mitigate an accident condition. The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and in the proposed Mode 3 end state. Events initiated by the loss of offsite power are dominant contributors to core damage frequency in most BWR PRAs, and the steam driven core cooling systems IC, RCIC and HPCI play a major role in mitigating these events. The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4. Going to Mode 4 for one inoperable inverter power source would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system. In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the inverters during the infrequent and limited time in Mode 3 and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
9.
TS 4.5.1.22 and LCO 3.8.9 (BWR-4); TS 4.5.2.20 and LCO 3.8.9 (BWR-6) - Distribution Systems (Operating)
The onsite Class 1E AC and DC electrical power distribution system is divided into redundant and independent AC, DC, and AC vital bus electrical power distribution systems. The primary AC electrical power distribution subsystem for each division consists of a 4.16 KV engineered safety feature (ESF) bus having an offsite source of power as well as a dedicated onsite diesel generator (DG) source.
The secondary plant distribution subsystems include 600 VAC emergency buses and associated load centers, motor control centers, distribution panels and transformers.
The 120 VAC vital buses are arranged in four load groups and are normally powered from the DC electrical power system.
There are two independent 125/250 VDC station service electrical power distribution systems and three independent 125 VDC DG electrical power distribution subsystems that support the necessary power for ESF functions. Each subsystem consists of a 125V and 250 V bus and associated distribution panels.
Plant applicability: BWR-4/6 LCO: For Modes 1, 2, and 3 the following electrical power distribution subsystems shall be operable:
BWR-4: The (Division 1 and Division 2) AC, DC, and AC vital buses shall be operable.
BWR-6: The (Divisions 1, 2, and 3) AC, DC, and AC vital buses shall be operable.
Condition requiring entry into end state: The plant operators must bring the plant to Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> following the sustained inoperability of one AC or one DC or one AC vital bus electrical power subsystem for a period of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> respectively (16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> from the discovery of the failure to meet the LCO).
Proposed modification for end state required actions: The proposed TS change is to remove the requirement to place the plant in Mode 4. The required action in D.2 (BWR-4) and D.2 (BWR-6) are deleted.
Assessment: If one of the AC/DC/AC vital subsystems is inoperable, the remaining AC/DC/AC vital subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. The BWROG did a comparative PRA evaluation of the core damage risks of operation in the current end state and in the proposed Mode 3 end state. Events initiated by the loss of offsite power are dominant contributors to core damage frequency in most BWR PRAs, and the steam driven core cooling systems IC, RCIC and HPCI play a major role in mitigating these events. The evaluation indicates that the core damage risks are lower in Mode 3 than in Mode 4. Going to Mode 4 for one inoperable AC/DC vital power source would cause loss of the high-pressure steam-driven injection system (RCIC and HPCI), and loss of the power conversion system (condenser/feedwater), and require activating the RHR system. In addition, the EOPs direct the operator to take control of the depressurization function if low pressure injection/spray systems are needed for RPV water makeup and cooling. Based on the low probability of loss of the AC/DC/AC vital electrical subsystems during the infrequent and limited time in Mode 3 and the number of systems available in Mode 3, the staff concludes that the risks of staying in Mode 3 are approximately the same as and in some cases lower than the risks of going to the Mode 4 end state.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
10.
TS 4.5.1.5 and LCO 3.6.1.1 - Primary Containment The function of the primary containment is to isolate and contain fission products released from the reactor primary system following a design basis LOCA and to confine the postulated release of radioactive material. The primary containment consists of a steel lined, reinforced concrete vessel, which surrounds the reactor primary system and provides an essentially leak tight barrier against an uncontrolled release of radioactive material to the environment. Additionally, this structure provides shielding from the fission products that may be present in the primary containment atmosphere following accident conditions.
Plant Applicability: BWR-4/6 LCO: The primary containment shall be operable.
Condition requiring entry into end state: If the LCO cannot be met, the primary containment must be returned to operability within one hour (Required Action A.1). If the primary containment cannot be returned to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2).
Proposed modification for end state required actions: Delete Required Action B.2.
Assessment: The primary containment is one of the three primary boundaries preventing the release of radioactive material. (The other two are the fuel cladding and the RCS pressure boundary.) Compliance with this LCO ensures that a primary containment configuration exists, including equipment hatches and penetrations, that is structurally sound and will limit leakage to those leakage rates assumed in the safety analyses. This LCO entry condition does not include leakage through an unisolated release path or containment rupture. The BWROG has determined that previous generic PRA work related to 10 CFR Part 50, Appendix J requirements has shown that containment leakage is not risk significant. Should a fission product release from the primary containment occur, the secondary containment and related functions would remain operable to contain the release, and the standby gas treatment system would remain available to filter fission products from being released to the environment. By remaining in Mode 3, HPCI, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal. Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is maintained with respect to water makeup and decay heat removal by remaining in Mode 3.
Finding: The requested change is acceptable. Note that the staffs approval relies upon the secondary containment and the standby gas treatment system for maintaining defense-in-depth while in this reduced end state.
11.
TS 4.5.1.7 and LCO 3.6.1.7 - Reactor Building-to-Suppression Chamber Vacuum Breakers (BWR-4 only)
The reactor building-to-suppression chamber vacuum breakers relieve vacuum when the primary containment depressurizes below the pressure of the reactor building, thereby serving to preserve the integrity of the primary containment.
Plant applicability: BWR-4 LCO: Each reactor building-to-suppression chamber vacuum breaker shall be operable.
Condition requiring entry into end state: If one line has one or more reactor building-to-suppression chamber vacuum breakers inoperable for opening, the breaker(s) must be returned to operability within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (Required Action C.1). If the vacuum breaker(s) cannot be returned to operability within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action E.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action E.2).
Proposed modification for end state required actions: Modify Condition E to relate only to Condition C and delete Required Action E.2. Add Condition F, with Required Actions F.1 and F.2, to address the required actions related to Conditions A, B, and D.
Assessment: The BWROG has determined that the specific failure condition of interest is not risk significant in BWR PRAs. The reduced end state would only be applicable to the situation where the vacuum breaker(s) in one line are inoperable for opening, with the remaining operable vacuum breakers capable of providing the necessary vacuum relief function. By remaining in Mode 3, HPCI, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal. Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is maintained with respect to water makeup and decay heat removal by remaining in Mode 3. The existing end state remains unchanged for conditions involving more than one line or vacuum breakers that are stuck in the open position, as established by new Condition F.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
12.
TS 4.5.1.8 and LCO 3.6.1.8 - Suppression Chamber-to-Drywell Vacuum Breakers (BWR-4 only)
The function of the suppression chamber-to-drywell vacuum breakers is to relieve vacuum in the drywell, thereby preventing an excessive negative differential pressure across the wetwell/drywell boundary.
Plant applicability: BWR-4 LCO: Nine suppression chamber-to-drywell vacuum breakers shall be operable for opening.
Condition requiring entry into end state: If one suppression chamber-to-drywell vacuum breaker is inoperable for opening, the breaker must be returned to operability within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (Required Action A.1). If the vacuum breaker cannot be returned to operability within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action C.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action C.2).
Proposed modification for end state required actions: Modify Condition C to relate only to Condition A, and delete Required Action C.2. Add Condition D with Required Actions D.1 and D.2 to maintain the existing requirements for Condition B.
Assessment: The BWROG has determined that the specific failure of interest is not risk significant in BWR PRAs. The reduced end state would only be applicable to the situation where one suppression chamber-to-drywell vacuum breaker is inoperable for opening, with the remaining operable vacuum breakers capable of providing the necessary vacuum relief function. By remaining in Mode 3, HPCI, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal.
Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is maintained with respect to water makeup and decay heat removal by remaining in Mode 3. The existing end state remains unchanged for conditions involving any suppression chamber-to-drywell vacuum breakers that are stuck open, as established by new Condition D.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
13.
TS 4.5.1.9, TS 4.5.2.8, and LCO 3.6.1.9 - Main Steam Isolation Valve (MSIV) Leakage Control System (LCS)
The MSIV LCS supplements the isolation function of the MSIVs by processing the fission products that could leak through the closed MSIVs after core damage, assuming leakage rate limits which are based on a large LOCA.
Plant applicability: BWR-4/6 LCO: Two MSIV LCS subsystems shall be operable.
Condition requiring entry into end state: If one MSIV LCS subsystem is inoperable, it must be restored to operable status within 30 days (Required Action A.1). If both MSIV LCS subsystems are inoperable, one of the MSIV LCS subsystems must be restored to operable status within seven days (Required Action B.1). If the MSIV LCS subsystems cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action C.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action C.2).
Proposed modification for end state required actions: Delete Required Action C.2.
Assessment: The BWROG has determined that this system is not significant in BWR PRAs and, based on a BWROG program, many plants have eliminated the system altogether. The unavailability of one or both MSIV LCS subsystems has no impact on CDF or LERF, independently of the mode of operation at the time of the accident. Furthermore, the challenge frequency of the MSIV LCS system (i.e., the frequency with which the system is expected to be challenged to mitigate offsite radiation releases resulting from MSIV leaks above TS limits) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than probabilities considered negligible in RG 1.177 for much higher consequence risks, such as a large early release.
Section 5.1 summarizes the staffs risk argument for approval of TSs 4.5.1.9, 4.5.2.8, and LCO 3.6.1.9, "Main Steam Isolation Valve (MSIV) Leakage Control System (LCS)." The argument for staying in Mode 3 instead of going to Mode 4 to repair the MSIV LCS system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 3) and the proposed (Mode 4) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable MSIV LCS system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
14.
TS 4.5.1.11 and LCO 3.6.2.4 - Residual Heat Removal (RHR) Suppression Pool Spray (BWR-4 only)
Following a DBA, the RHR suppression pool spray system removes heat from the suppression chamber airspace. A minimum of one RHR suppression pool spray subsystem is required to mitigate potential bypass leakage paths from the drywell and maintain the primary containment peak pressure below the design limits.
Plant applicability: BWR-4 LCO: Two RHR suppression pool spray subsystems shall be operable.
Condition requiring entry into end state: If one RHR suppression pool spray subsystem is inoperable, it must be restored to operable status within seven days (Required Action A.1). If both RHR suppression pool spray subsystems are inoperable, one of them must be restored to operable status within eight hours (Required Action B.1). If the RHR suppression pool spray subsystem cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action C.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action C.2).
Proposed modification for end state required actions: Delete Required Action C.2.
Assessment: The main function of the RHR suppression spray system is to remove heat from the suppression chamber so that the pressure and temperature inside primary containment remain within analyzed design limits. The RHR suppression spray system was designed to mitigate potential effects of a postulated DBA, that is a large LOCA which is assumed to occur concurrently with the most limiting single failure and conservative inputs, such as for initial suppression pool water volume and temperature. Under the conditions assumed in the DBA, steam blown down from the break could bypass the suppression pool and end up in the suppression chamber air space and the RHR suppression spray system could be needed to condense such steam so that the pressure and temperature inside primary containment remain within analyzed design basis limits. However, the frequency of a DBA is very small and the containment has considerable margin to failure above the design limits. For this reason, the unavailability of one or both RHR suppression spray subsystems has no significant impact on CDF or LERF, even for accidents initiated during operation at power. Therefore, it is very unlikely that the RHR suppression spray system will be challenged to mitigate an accident occurring during power operation. This probability becomes extremely unlikely for accidents that would occur during a small fraction of the year (less than three days) during which the plant would be in Mode 3 (associated with lower initial energy level and reduced decay heat load as compared to power operation) to repair the failed RHR suppression spray system.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.1.11 and LCO 3.6.2.4, "Residual Heat Removal (RHR) Suppression Pool Spray." The argument for staying in Mode 3 instead of going to Mode 4 to repair the RHR suppression pool spray system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases.
In addition, the probability of a DBA (large break) is much smaller during shutdown as compared to power operation. A DBA in Mode 3 would be considerably less severe than a DBA occurring during power operation since Mode 3 is associated with lower initial energy level and reduced decay heat load. Under these extremely unlikely conditions, an alternate method that can be used to remove heat from the primary containment (in order to keep the pressure and temperature within the analyzed design basis limits) is containment venting. For more realistic accidents that could occur in Mode 3, several alternate means are available to remove heat from the primary containment, such as the RHR system in the suppression pool cooling mode and the containment spray mode.
The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable RHR suppression spray system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
15.
TS 4.5.1.12, TS 4.5.2.10, and LCO 3.6.4.1 - Secondary Containment Following a DBA, the function of the secondary containment is to contain, dilute, and holdup fission products that may leak from primary containment. Its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis and that fission products entrapped within the secondary containment structure will be treated by the standby gas treatment system prior to discharge to the environment.
Plant applicability: BWR-4/6 LCO: The secondary containment shall be operable.
Condition requiring entry into end state: If the secondary containment is inoperable, it must be restored to operable status within four hours (Required Action A.1). If it cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1), and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2).
Proposed modification for end state required actions: Delete Required Action B.2.
Assessment: This LCO entry condition does not include gross leakage through an unisolable release path or secondary containment rupture. The BWROG has determined that previous generic PRA work related to 10 CFR Part 50, Appendix J requirements has shown that containment leakage is not risk significant. The primary containment, and all other primary and secondary containment-related functions would still be operable, including the standby gas treatment system, thereby minimizing the likelihood of an unacceptable release. By remaining in Mode 3, HPCI, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal. Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is improved with respect to water makeup and decay heat removal by remaining in Mode 3.
Finding: The requested change is acceptable. Note that the staffs approval relies upon the primary containment, and all other primary and secondary containment-related functions to still be operable, including the standby gas treatment system, for maintaining defense-in-depth while in this reduced end state.
16.
TS 4.5.1.13, TS 4.5.2.11, and LCO 3.6.4.3 - Standby Gas Treatment (SGT) System The function of the SGT system is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a DBA are filtered and adsorbed prior to exhausting to the environment.
Plant applicability: BWR-4/6 LCO: Two SGT subsystems shall be operable.
Condition requiring entry into end state: If one SGT subsystem is inoperable, it must be restored to operable status within seven days (Required Action A.1). If the SGT subsystem cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2). In addition, if two SGT subsystems are inoperable in Modes 1, 2, or 3, LCO 3.0.3 must be entered immediately (Required Action D.1).
Proposed modification for end state required actions: Delete Required Action B.2. Change Required Action D.1 to "Be in Mode 3" with a Completion Time of "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />."
Assessment: The unavailability of one or both SGT subsystems has no impact on CDF or LERF, independent of the mode of operation at the time of the accident. Furthermore, the challenge frequency of the SGT system (i.e., the frequency with which the system is expected to be challenged to mitigate offsite radiation releases resulting from materials that leak from the primary to the secondary containment above TS limits) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as large early release.
Section 5.1 summarizes the staffs risk argument for approval of TSs 4.5.1.13, 4.5.2.11, and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System." The argument for staying in Mode 3 instead of going to Mode 4 to repair the SGT system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode
- 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable SGT system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
17.
TS 4.5.1.14 and LCO 3.7.1 - Residual Heat Removal Service Water (RHRSW) System (BWR-4 only)
The RHRSW system is designed to provide cooling water for the RHR system heat exchangers, which are required for safe shutdown following a normal shutdown or DBA or transient.
Plant applicability: BWR-4 LCO: Two RHRSW subsystems shall be operable.
Condition requiring entry into end state: If the LCO cannot be met, the following actions must be taken for the listed conditions:
(a)
If one RHRSW pump is inoperable, it must be restored to operable status within 30 days (Required Action A.1).
(b)
If one RHRSW pump in each subsystem is inoperable, one RHRSW pump must be restored to operable status within seven days (Required Action B.1).
(c)
If one RHRSW subsystem is inoperable for reasons other than Condition A, the RHRSW subsystem must be restored to operable status within seven days (Required Action C.1).
(d)
If the required action and associated completion time cannot be met within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action E.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action E.2).
Proposed modification for end state required actions: Renumber Conditions D (and Required Action D.1) and E (and Required Actions E.1 and E.2) to Conditions E (and Required Action E.1) and F (and Required Actions F.1 and F.2), respectively. Modify new Condition F to address new Condition E, which maintains the existing requirements with respect to both RHR subsystems being inoperable for reasons other than Condition B. Add a new Condition D, which establishes requirements for existing Conditions A, B, and C, that are similar to existing Condition E but without Required Action E.2.
Assessment: The BWROG performed a comparative PRA evaluation of the core damage risks when operating in the current end state versus the proposed Mode 3 end state. The results indicated that the core damage risks while operating in Mode 3 (assuming the individual failure conditions) are lower or comparable to the current end state. By remaining in Mode 3, HPCI, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal. Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is improved with respect to water makeup and decay heat removal by remaining in Mode 3, and the required safety function can still be performed with the RHRSW subsystem components that are still operable.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
18.
TS 4.5.1.15 and LCO 3.7.2 - Plant Service Water (PSW) System and Ultimate Heat Sink (UHS) (BWR-4 only)
The PSW system (in conjunction with the UHS) is designed to provide cooling water for the removal of heat from certain safe shutdown-related equipment heat exchangers following a DBA or transient.
Plant applicability: BWR-4 LCO: Two PSW subsystems and the UHS shall be operable.
Condition requiring entry into end state: If the LCO cannot be met, the following actions must be taken for the listed conditions:
(a)
If one PSW pump is inoperable, it must be restored to operable status within 30 days (Required Action A.1).
(b)
If one PSW pump in each subsystem is inoperable, one PSW pump must be restored to operable status within seven days (Required Action B.1).
(c)
If the required action and associated completion time cannot be met within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action E.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action E.2).
Proposed modification for end state required actions: Delete Required Action E.2 and add Condition F with Required Actions F.1 and F.2 to maintain the other requirements unchanged that are referred to in existing Condition E.
Assessment: The BWROG performed a comparative PRA evaluation of the core damage risks associated with operating in the current end state versus the proposed Mode 3 end state. The results indicated that the core damage risks while operating in Mode 3 (assuming the individual failure conditions) are lower or comparable to the current end state. With one pump inoperable in one or more subsystems, the remaining pumps are adequate to perform the PSW heat removal function. By remaining in Mode 3, HPCI, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal.
Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is improved with respect to water makeup and decay heat removal by remaining in Mode 3.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
19.
TS 4.5.1.16 and LCO 3.7.4 - Main Control Room Environmental Control (MCREC)
System (BWR-4 only)
The MCREC system provides a radiologically controlled environment from which the plant can be safely operated following a DBA.
Plant applicability: BWR-4 LCO: Two MCREC subsystems shall be operable.
Condition requiring entry into end state: If one MCREC subsystem is inoperable, it must be restored to operable status within seven days (Required Action A.1). If the MCREC subsystem cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2). If two MCREC subsystems are inoperable in Modes 1, 2, or 3, LCO 3.0.3 must be entered immediately (Required Action D.1).
Proposed modification for end state required actions: Delete Required Action B.2, and change Required Action D.1 to "Be in Mode 3" with a Completion Time of "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />."
Assessment: The unavailability of one or both MCREC subsystems has no significant impact on CDF or LERF, independently of the mode of operation at the time of the accident.
Furthermore, the challenge frequency of the MCREC system (i.e., the frequency with which the system is expected to be challenged to provide a radiologically controlled environment in the main control room following a DBA which leads to core damage and leaks of radiation from the containment that can reach the control room) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as a large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.1.16 and LCO 3.7.4, "Main Control Room Environmental Control (MCREC) System." The argument for staying in Mode 3 instead of going to Mode 4 to repair the MCREC system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 3) and the proposed (Mode 4) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable MCREC system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
20.
TS 4.5.1.17 and LCO 3.7.5 - Control Room Air Conditioning (CRAC) System (BWR-4 only)
The CRAC system provides temperature control for the control room following control room isolation during accident conditions.
Plant applicability: BWR-4 LCO: Two CRAC subsystems shall be operable.
Condition requiring entry into end state: If one CRAC subsystem is inoperable, the subsystem must be restored to operable status within 30 days (Required Action A.1). If the required actions and associated completion times cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2). If two CRAC subsystems are inoperable, LCO 3.0.3 must be entered immediately (Required Action D.1)
Proposed modification for end state required actions: Delete Required Action B.2 and change Required Action D.1 to "Be in Mode 3" with a Completion Time of "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />."
Assessment: The unavailability of one or both air conditioning subsystems has no significant impact on CDF or LERF, independently of the mode of operation at the time of the accident.
Furthermore, the challenge frequency of the air conditioning system (i.e., the frequency with which the system is expected to be challenged to provide temperature control for the control room following control room isolation following a DBA) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as a large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.1.17, and LCO 3.7.5, "Control Room Air Conditioning (AC) System." The argument for staying in Mode 3 instead of going to Mode 4 to repair the air conditioning system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode
- 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable air conditioning system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
21.
TS 4.5.1.18 and LCO 3.7.6 - Main Condenser Off Gas (BWR-4 only)
The off gas from the main condenser normally includes radioactive gases. The gross gamma activity rate is controlled to ensure that accident analysis assumptions are satisfied and that offsite dose limits will not be exceeded during postulated accidents. The main condenser off gas (MCOG) gross gamma activity rate is an initial condition of a DBA which assumes a gross failure of the MCOG system pressure boundary.
Plant applicability: BWR-4 LCO: The gross gamma activity rate of the noble gases measured at the main condenser evacuation system pretreatment monitor station shall be 240 mCi/second after decay of 30 minutes.
Condition requiring entry into end state: If the gross gamma activity rate of the gases in the MCOG system is not within limits, the gross gamma activity rate of the noble gases in the MCOG must be restored to within limits within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (Required Action A.1). If the required action and associated completion time cannot be met, one of the following must occur:
(a)
All steam lines must be isolated within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1).
(b)
The steam jet air ejector (SJAE) must be isolated within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.2).
(c)
The plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.3.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.3.2).
Proposed modification for end state required actions: Delete Required Action B.3.2.
Assessment: The failure to maintain the gross gamma activity rate of the noble gases in the MCOG within limits has no significant impact on CDF or LERF, independent of the mode of operation at the time of the accident. Furthermore, the challenge frequency of the MCOG system (i.e., the frequency with which the system is expected to be challenged to mitigate offsite radiation releases following a DBA) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.1.18 and LCO 3.7.6, "Main Condenser Off Gas." The argument for staying in Mode 3 instead of going to Mode 4 to repair the MCOG system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable MCOG system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
22.
TS 4.5.2.6 and LCO 3.6.1.7 - Residual Heat Removal (RHR) Containment Spray System (BWR-6 only)
The primary containment must be able to withstand a postulated bypass leakage pathway that allows the passage of steam from the drywell directly into the primary containment airspace, bypassing the suppression pool. The primary containment also must be able to withstand a low energy steam release into the primary containment airspace. The RHR containment spray system is designed to mitigate the effects of bypass leakage and low energy line breaks.
Plant applicability: BWR-6 LCO: Two RHR containment spray subsystems shall be operable.
Condition requiring entry into end state: If one RHR containment spray subsystem is inoperable, it must be restored to operable status within seven days (Required Action A.1). If two RHR containment spray subsystems are inoperable, one of them must be restored to operable status within eight hours (Required Action B.1). If the RHR containment spray system cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action C.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action C.2)
Proposed modification for end state required actions: Delete Required Action C.2.
Assessment: The primary containment is designed with a suppression pool so that, in the event of a LOCA, steam released from the primary system is channeled through the suppression pool water and condensed without producing significant pressurization of the primary containment. The primary containment is designed so that with the pool initially at the minimum water level and the worst single failure of the primary containment heat removal systems, suppression pool energy absorption combined with subsequent operator controlled pool cooling will prevent the primary containment pressure from exceeding its design value.
However, the primary containment must also withstand a postulated bypass leakage pathway that allows the passage of steam from the drywell directly into the primary containment airspace, bypassing the suppression pool. The primary containment also must withstand a postulated low energy steam release into the primary containment airspace. The main function of the RHR containment spray system is to suppress steam, which is postulated to be released into the primary containment airspace through a bypass leakage pathway and a low energy line break under DBA conditions, without producing significant pressurization of the primary containment (i.e., ensure that the pressure inside primary containment remains within analyzed design limits).
Under the conditions assumed in the DBA, steam blown down from the break could find its way into the primary containment through a bypass leakage pathway. In addition to the DBA, a postulated low energy pipe break could add more steam into the primary containment airspace.
Under such an extremely unlikely scenario (very small frequency of a DBA combined with the likelihood of a bypass pathway and a concurrent low energy pipe brake inside the primary containment), the RHR containment spray system could be needed to condense steam so that the pressure inside the primary containment remains within the analyzed design limits.
Furthermore, containments have considerable margin to failure above the design limit (it is very likely that the containment will be able to withstand pressures as much as three times the design limit). For these reasons, the unavailability of one or both RHR containment spray subsystems has no significant impact on CDF or LERF, even for accidents initiated during operation at power. Therefore, it is very unlikely that the RHR containment spray system will be challenged to mitigate an accident occurring during power operation. This probability becomes extremely unlikely for accidents that would occur during a small fraction of the year (less than three days) during which the plant would be in Mode 3 (associated with lower initial energy level and reduced decay heat load as compared to power operation) to repair the failed RHR containment spray system.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.2.6 and LCO 3.6.1.7, "Residual Heat Removal (RHR) Containment Spray System." The argument for staying in Mode 3 instead of going to Mode 4 to repair the RHR containment spray system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable RHR containment spray system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
23.
TS 4.5.2.7 and LCO 3.6.1.8 - Penetration Valve Leakage Control System (PVLCS)
(BWR-6 only)
The PVLCS supplements the isolation function of primary containment isolation valves (PCIVs) in process lines that also penetrate the secondary containment. These penetrations are sealed by air from the PVLCS to prevent fission products leaking past the isolation valves and bypassing the secondary containment after a design basis LOCA.
Plant applicability: BWR-6 LCO: Two PVLCS subsystems shall be operable.
Condition requiring entry into end state: If one PVLCS subsystem is inoperable, it must be restored to operable status within 30 days (Required Action A.1). If two PVLCS subsystems are inoperable, one of the PVLCS subsystems must be restored to operable status within seven days (Required Action B.1). If the PVLCS subsystem cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action C.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action C.2).
Proposed modication for end state required actions: Delete Required Action C.2.
Assessment: The BWROG has determined that this system is not significant in BWR PRAs.
The unavailability of one or both PVLCS subsystems has no impact on CDF or LERF, independently of the mode of operation at the time of the accident. Furthermore, the challenge frequency of the PVLCS system (i.e., the frequency with which the system is expected to be challenged to prevent fission products leaking past the isolation valves and bypassing the secondary containment) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8.
This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.2.7 and LCO 3.6.1.8, "Penetration Valve Leakage Control System (PVLCS)." The argument for staying in Mode 3 instead of going to Mode 4 to repair the PVLCS system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode
- 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable PVLCS system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
24.
TS 4.5.1.10, TS 4.5.2.9 and LCO 3.6.2.3 - Residual Heat Removal (RHR) Suppression Pool Cooling Some means must be provided to remove heat from the suppression pool so that the temperature inside the primary containment remains within design limits. This function is provided by two redundant RHR suppression pool cooling subsystems.
Plant applicability: BWR-4/6 LCO: Two RHR suppression pool cooling subsystems shall be operable.
Condition requiring entry into end state: If one RHR suppression pool cooling subsystem is inoperable, it must be restored to operable status within seven days (Required Action A.1). If the RHR suppression pool spray subsystem cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2).
Proposed modification for end state required actions: Delete Required Action B.2 and add Condition C, with Required Actions C.1 and C.2, to maintain existing requirements unchanged for two RHR suppression pool subsystems inoperable.
Assessment: The BWROG has completed a comparative PRA evaluation of the core damage risks of operation in the current end state versus operation in the proposed Mode 3 end state.
The results indicated that the core damage risks while operating in Mode 3 (assuming the individual failure conditions) are lower or comparable to the current end state. One loop of the RHR suppression pool cooling system is sufficient to accomplish the required safety function.
By remaining in Mode 3, HPCS, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal.
Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is improved with respect to water makeup and decay heat removal by remaining in Mode 3.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
25.
TS 4.5.2.12 and LCO 3.6.5.6 - Drywell Vacuum Relief System (BWR-6 only)
The Mark III pressure suppression containment is designed to condense, in the suppression pool, the steam released into the drywell in the event of a LOCA. The steam discharging to the pool carries the non-condensibles from the drywell. Therefore, the drywell atmosphere changes from low humidity air to nearly 100 percent steam (no air) as the event progresses.
When the drywell subsequently cools and depressurizes, non-condensibles in the drywell must be replaced to avoid excessive weir wall overflow into the drywell. Rapid weir wall overflow must be controlled in a large break LOCA, so that essential equipment and systems located above the weir wall in the drywell are not subjected to excessive drag and impact loads. The drywell post-LOCA and the drywell purge vacuum relief subsystems are the means by which non-condensibles are transferred from the primary containment back to the drywell.
Plant applicability: BWR-6 LCO: Two drywell post-LOCA and two drywell purge vacuum relief subsystems shall be operable.
Condition requiring entry into end state: If one or two drywell post-LOCA vacuum relief subsystems are inoperable or if one drywell purge vacuum relief subsystem is inoperable for reasons other than being not closed, the subsystem(s) must be restored to operable status within 30 days (Required Actions B.1 and C.1, respectively). If the required actions cannot be completed within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
Proposed modification for end state required actions: Renumber Condition F (and Required Action F.1, but deleting Required Action F.2) to Condition G (and Required Action G.1) and apply the condition to Conditions B and C. Renumber existing Condition G (and Required Actions G.1 and G.2) to be Condition H (and Required Actions H.1 and H.2). Add a new Condition F (with Required Actions F.1 and F.2) to maintain the existing requirements for Conditions A, D, and E.
Assessment: The BWROG has determined that the specific failure conditions of interest are not risk significant in BWR PRAs. With one or two drywell post-LOCA vacuum relief subsystems inoperable or one drywell purge vacuum relief subsystem inoperable, for reasons other than not being closed, the remaining operable vacuum relief subsystems are adequate to perform the depressurization mitigation function. By remaining in Mode 3, HPCS, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal. Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is improved with respect to water makeup and decay heat removal by remaining in Mode 3.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
26.
TS 4.5.2.13 and LCO 3.7.1 - Standby Service Water (SSW) System and Ultimate Heat Sink (UHS) (BWR-6 only)
The SSW system (in conjunction with the UHS) is designed to provide cooling water for the removal of heat from certain safe shutdown-related equipment heat exchangers following a DBA or transient.
Plant applicability: BWR-6 LCO: Division 1 and 2 SSW subsystems and UHS shall be operable.
Condition requiring entry into end state: If one or more cooling towers with one cooling tower fan is inoperable, the cooling tower fan(s) must be restored to operable status within seven days (Required Action A.1). If one SSW subsystem is inoperable for reasons other than Condition A, the SSW subsystem must be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (Required Action B.1). If the required action(s) and associated completion time(s) cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action C.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action C.2).
Proposed modification for end state required actions: Maintain the existing second and third conditions of Condition C unchanged by transferring them to a new Condition D (with Required Actions D.1 and D.2) and delete Required Action C.2.
Assessment: The BWROG determined that the specific failure condition of interest is not risk significant in BWR PRAs. With the specified inoperable components/subsystems, a sufficient number of operable components/subsystems are still available to perform the heat removal function. By remaining in Mode 3, HPCS, RCIC, and the power conversion system (condensate/feedwater) remain available for water makeup and decay heat removal.
Additionally, the EOPs direct the operators to take control of the depressurization function if low pressure injection/spray are needed for RCS makeup and cooling. Therefore, defense-in-depth is improved with respect to water makeup and decay heat removal by remaining in Mode 3.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
27.
TS 4.5.2.14 and LCO 3.7.3 - Control Room Fresh Air (CRFA) System (BWR-6 only)
The CRFA system provides a radiologically controlled environment from which the unit can be safely operated following a DBA. The CRFA system consists of two independent and redundant high efficiency air filtration subsystems for treatment of recirculated air or outside supply air. Each subsystem consists of a demister, an electric heater, a prefilter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section, a second HEPA filter, a fan, and the associated ductwork and dampers. Demisters remove water droplets from the airstream. Prefilters and HEPA filters remove particulate matter that may be radioactive.
The charcoal adsorbers provide a holdup period for gaseous iodine, allowing time for decay.
Plant applicability: BWR-6 LCO: Two CRFA subsystems shall be operable.
Condition requiring entry into end state: If one CRFA subsystem is inoperable, it must be restored to operable status within seven days (Required Action A.1). If the CRFA subsystem cannot be restored to operable status within the allotted time, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2). If two CRFA subsystems are inoperable in Modes 1, 2, or 3, LCO 3.0.3 must be entered immediately (Condition D).
Proposed modification for end state required actions: Delete Required Action B.2 and change Required Action D.1 to "Be in Mode 3" with a Completion Time of "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />."
Assessment: The unavailability of one or both CRFA subsystems has no significant impact on CDF or LERF, independent of the mode of operation at the time of the accident. Furthermore, the challenge frequency of the CRFA system (i.e., the frequency with which the system is expected to be challenged to provide a radiologically controlled environment in the main control room following a DBA which leads to core damage and leaks of radiation from the containment that can reach the control room) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as a large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.2.14 and LCO 3.7.3, "Control Room Fresh Air (CRFA) System." The argument for staying in Mode 3 instead of going to Mode 4 to repair the CRFA system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable CRFA system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
28.
TS 4.5.2.15 and LCO 3.7.4 - Control Room Air Conditioning (CRAC) System (BWR-6 only)
The CRAC system provides temperature control for the control room following control room isolation. The CRAC system consists of two independent, redundant subsystems that provide cooling and heating of recirculated control room air. Each subsystem consists of heating coils, cooling coils, fans, chillers, compressors, ductwork, dampers, and instrumentation and controls to provide for control room temperature control. The CRAC system is designed to provide a controlled environment under both normal and accident conditions. A single subsystem provides the required temperature control to maintain a suitable control room environment for a sustained occupancy of 12 persons.
Plant applicability: BWR-6 LCO: Two CRAC subsystems shall be operable.
Condition requiring entry into end state: If one CRAC subsystem is inoperable, it must be restored to operable status within 30 days (Required Action A.1). If the required actions and associated completion times cannot be met, the plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.2). If two CRAC subsystems are inoperable, LCO 3.0.3 must be entered immediately (Condition D).
Proposed modification for end state required actions: Delete Required Action B.2 and change Required Action D.1 to "Be in Mode 3" with a Completion Time of "12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />."
Assessment: The unavailability of one or both air conditioning subsystems has no significant impact on CDF or LERF, independent of the mode of operation at the time of the accident.
Furthermore, the challenge frequency of the air conditioning system (i.e., the frequency with which the system is expected to be challenged to provide temperature control for the control room following control room isolation following a DBA which leads to core damage) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e.,
Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as a large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.2.15 and LCO 3.7.4, "Control Room Air Conditioning (CRAC) System." The argument for staying in Mode 3 instead of going to Mode 4 to repair the CRAC system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode
- 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable CRAC system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
29.
TS 4.5.2.16 and LCO 3.7.5 - Main Condenser Off Gas (BWR-6 only)
The off gas from the main condenser normally includes radioactive gases. The gross gamma activity rate is controlled to ensure that accident analysis assumptions are satisfied and that offsite dose limits will not be exceeded during postulated accidents.
Plant applicability: BWR-6 LCO: The gross gamma activity rate of the noble gases measured at the off gas recombiner effluent shall be 380 mCi/second after decay of 30 minutes.
Condition requiring entry into end state: If the gross gamma activity rate of the noble gases in the MCOG is not within limits, the gross gamma activity rate of the noble gases in the MCOG must be restored to within limits within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (Required Action A.1). If the required action and associated completion time cannot be met, one of the following must occur:
(a)
All steam lines must be isolated within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.1).
(b)
The SJAE must be isolated within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.2).
(c)
The plant must be placed in Mode 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (Required Action B.3.1) and in Mode 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Action B.3.2).
Proposed modification for end state required actions: Delete Required Action B.3.2.
Assessment: The failure to maintain the gross gamma activity rate of the noble gases in the MCOG within limits has no significant impact on CDF or LERF, independent of the mode of operation at the time of the accident. Furthermore, the challenge frequency of the MCOG system (i.e., the frequency with which the system is expected to be challenged to mitigate offsite radiation releases following a DBA) is less than 1.0E-6/yr. Consequently, the conditional probability that this system will be challenged during the repair time interval while the plant is at either the current or the proposed end state (i.e., Mode 4 or Mode 3, respectively) is less than 1.0E-8. This probability is considerably smaller than the probabilities considered "negligible" in RG 1.177 for much higher consequence risks, such as large early release.
Section 5.1 summarizes the staffs risk argument for approval of TS 4.5.2.16 and LCO 3.7.5, "Main Condenser Off Gas." The argument for staying in Mode 3 instead of going to Mode 4 to repair the MCOG system (one or both trains) is also supported by defense-in-depth considerations. Section 5.2 makes a comparison between the current (Mode 4) and the proposed (Mode 3) end state, with respect to the means available to perform critical functions (i.e., functions contributing to the defense-in-depth philosophy) whose success is needed to prevent core damage and containment failure and mitigate radiation releases. The risk and defense-in-depth arguments, used according to the "integrated decision-making" process of RGs 1.174 and 1.177, support the conclusion that Mode 3 is as safe as Mode 4 (if not safer) for repairing an inoperable MCOG system.
Finding: Since the time spent in Mode 3 to perform the repair is infrequent and limited, and in light of defense-in-depth considerations, the proposed change is acceptable.
7.0 COMMITMENTS NEEDED TO IMPLEMENT THE TSs RELATED TO TOPICAL REPORT NEDC-32988 Any licensee requesting the TS changes to operate a plant in accordance with this BWROG topical report, must commit to implement the following stipulations in the TS or its associated Bases. The following stipulations assure that the implementation of this topical report will be consistent with staffs safety evaluation:
- 1.
Entry into the shutdown modes approved in this SE shall be for the primary purpose of accomplishing short-duration repairs which necessitated exiting the original operating mode. In response to the staff's questions, the BWROG stated that "The BWRs are most likely to stay in hot shutdown for no more than 2 to 3 days and definitely, not more than a week." The staff expects that the licensees will follow this guidance.
- 2.
Appropriate plant procedures and administrative controls will be used when the plant is operated in the proposed end states.
- 3.
Entry into and use of the proposed end states shall be in accordance with the requirements of 10 CFR 50.65(b)(4). The licensee should do a risk assessment with respect to performance of the key shutdown safety functions, as described in Section 4 of this SE.
- 4.
The purpose of the BWROG request is to allow corrective maintenance in a safe operating mode after an CT has been exceeded and minimize the corrective action time so that the plant can be restored to power operation. Ordinarily the failures result in a degraded plant condition. Consequently, with respect to additional licensee outage activities that could affect the safe conduct of operations and that are not directly required for correction of the failure or failures that caused the CT to be exceeded, a licensee must make two commitments:
- a.
The licensee will perform a safety assessment in accordance with the maintenance rule prior to undertaking such additional activities.
- b.
If conditions change so that the safety assessment is no longer valid, the licensee will suspend all such additional activities via a process consistent with safety until the assessment has been revalidated. The staff expects the licensee to make a contingency plan to address this situation. The contingency plan may require such actions as (1) suspending the activity until conditions are again appropriate, (2) terminating the activity and starting over when conditions are again appropriate, and (3) continuing the activity if safety is best ensured by completing the activity. The staff recognizes that such decisions may have to be made on the basis of engineering judgement should an unforseen situation arise.
- 5.
The requested end state changes do not prohibit licensees from entering cold shutdown if they wish to do so for operational reasons or maintenance requirements. In such cases, the specific requirements associated with the requested end state changes do not apply.
8.0 CONCLUSION
The staffs evaluation approves only operation as described and acceptably justified in References 1 and 2. The staff finds that the topical report used realistic assumptions regarding plant conditions and the availability of the various mitigative systems (including during transitions requiring operator actions) in analyzing the risks and considering the defense-in-depth and safety margins. Thus, the staff concludes that the topical report uses realistic assumptions to justify the change in end state.
Because BWRs are likely to stay in hot shutdown for no more than 2 to 3 days, the probability of transients and accidents is low.
9.0 REFERENCES
1.
Anthony R. Pietrangelo (NEI) to William D. Beckner (NRC), "Technical Justification to Support Risk-Informed Modification to Selected Required Action End States for BWR Plants, BWR Owners Group Risk Informed Technical Specification Committee, NEDC-32988, Rev. 2, December 2000," dated January 5, 2001.
2.
Anthony R. Pietrangelo (NEI) to William D. Beckner (NRC), enclosing a letter dated October 26, 2001, from J. M. Kenny (BWR Owners Group) to Biff Bradley (NEI),
"BWROG Response to NRC Request for RAN On NEDC-32988-NRC Project 291,"
dated October 31, 2001.
3.
Biff Bradley (NEI) ro J. M. Kenny (BWR Owners Group), "BWROG Response to NRC Draft Request for Additional Information (RAI) on Risk-Informed Technical Specification Initiative 3 - NRC Project Number 291," dated November 6, 2001.
4.
NUREG-1433, Standard Technical Specification, General Electric Plants, BWR/4, Rev.
2, April 2001.
5.
NUREG-1434, Standard Technical Specification, General Electric Plants, BWR/6, Rev.
2, April 2001.
6.
Federal Register, Vol. 58, No. 139, Pages 39132-39139, "Final Policy Statement on TS Improvements for Nuclear Power Plants," July 22, 1993.
7.
Code of Federal Regulations Title 10, Section 50.36, "Technical Specifications," Section 50.65, "Requirements for monitoring the effectiveness of maintenance of nuclear power plants."
8.
Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants," May 2000.
9.
Industry Guideline for Monitoring the Effectiveness of Maintenance Activities at Nuclear Power Plants. Nuclear Energy Institute, NUMARC 93-01, Revision 2, April 1996.
Attachment:
List of Acronyms Principal Contributors: G. Thomas N. Saltos J. Tatum J. Lazevnick Date: September 27, 2002
LIST OF ACRONYMS AC Alternating current ADS Automatic depressurization system ASME American Society of Mechanical Engineers ATWS Anticipated transients without scram BOP Balance of plant BWR Boiling water reactor BWROG Boiling Water Reactor Owners Group CDF Core damage frequency CE Combustion Engineering CEOG Combustion Engineering Owners Group CRAC Control room air conditioning CRD Control rod drive CRFA Control room fresh air CRMP Configuration risk management plan CS Containment spray CST Condensate storage tank CT Completion time DBA Design basis accident DC Direct current DG Diesel generator DW Drywell ECCS Emergency core cooling system EDG Emergency diesel generator EOP Emergency operating procedure EPG Emergency procedure guidelines EPM Electric power monitoring ESF Engineered safety feature GDC General Design Criteria GE General Electric HEPA High efficiency particulate air HPCI High pressure coolant injection HPCS High pressure core spray IC Isolation condenser IPE Individual plant examination LCO Limiting condition for operation LCS Leakage control system LERF Large early release frequency LLS Low-low set LOCA Loss-of-coolant accident LOOP Loss of offsite power LPCI Low pressure coolant injection LPCS Low pressure core spray Attachment MCOG Main condenser off gas MCREC Main control room environmental control MD Motor-driven MG Motor generator MSIV Main steam isolation valve NEI Nuclear Energy Institute NRC Nuclear Regulatory Commission PCS Power conversion system PRA Probabilistic risk assessment PSW Plant service water PVLCS Penetration valve leakage control system PWR Pressurized water reactor RCIC Reactor core isolation cooling RCPB Reactor coolant pressure boundary RCS Reactor cooling system RHR Residual heat removal RHRSW Residual heat removal service water RPS Reactor protection system RPV Reactor pressure vessel SBO Station blackout SD Steam-driven SDC Shut-down cooling SE Safety evaluation SGT Standby gas treatment SJAE Steam jet air ejector SPC Suppression pool cooling SRV Safety relief valve SSC Structures, systems and components SSW Standby service water STS Standard Technical Specifications SW Service water UHS Ultimate heat Sink