Text

License Amendment Request: Extension of Diesel Generator Required Action Completion Time
	ML031360410
Person / Time
Site:	Calvert Cliffs
Issue date:	05/12/2003
From:	Katz P; Constellation Energy Group
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML031360410 (99)
	v • d • e

Peter E. Katz 1650 Calvert Cliffs Parkway Vice President Lusby, Maryland 20657 Calvert Cliffs Nuclear Power Plant 410 495-4455 Constellation Generation Group, LLC 410 495-3500 Fax Constellation Energy Group May 12, 2003 U. S. Nuclear Regulatory Commission Washington, DC 20555 ATTENTION: Document Control Desk

SUBJECT:

Calvert Cliffs Nuclear Power Plant Unit Nos. 1 & 2; Docket Nos. 50-317 & 50-318 License Amendment Request: Extension of Diesel Generator Required Action Completion Time Pursuant to 10 CFR 50.90, Calvert Cliffs Nuclear Power Plant, Inc. (CCNPP) hereby requests an amendment to Renewed Operating License Nos. DPR-53 and DPR-69 to incorporate the changes described below into the Technical Specifications for Calvert Cliffs Unit Nos. 1 and 2. Specifically, CCNPP proposes to amend Technical Specification 3.8.1, "AC Sources-Operating" to extend several Required Action Completion Times for inoperable diesel generators (DGs). The Bases for Technical Specification 3.8.1 will be modified to address the proposed changes.

BACKGROUND Calvert Cliffs is a two unit site. A total of four DGs, two dedicated to each unit, are provided to supply power to the engineered safety features loads. Three of these DGs are Fairbanks Morse diesels with generators, each with a continuous rating of 3000 kW. The fourth is a Societe Alsacienne De Constructions Mecaniques De Mulhouse (SACM) DG with a continuous rating of 5400 kW. Although the Fairbanks Morse and SACM DGs have different continuous ratings, either of the two DGs dedicated to a unit is capable of supplying all of the engineered safety features loads for the associated bus. In addition, an augmented-quality Station Blackout SACM DG (designated OC DG) with a continuous rating of 5400 kW is installed. This DG can be aligned to any of the four 4160 Volt emergency buses to support station blackout loads or engineered safety features loads, if necessary. The site electrical distribution system has shared functions between the Units. Therefore, the dedicated DGs not only provide support to their specified Unit, but also to the opposite Unit. This dependency is reflected in the Technical Specifications.

DESCRIPTION There are three Conditions that are proposed to have extended Completion Times. Each of the three proposed changes also have associated changes as shown on the Table below. A more complete, in depth explanation of these proposed changes is contained in Attachment (1). Attachment (3) contains the

Document Control Desk May 12,2003 Page 2 marked up Technical Specification pages. Attachment (4) contains the final Technical Specification pages.

Condition Current Current Proposed Required Action and/or Required Completion Completion Times Action Time One LCO 3.8.1.b DG inoperable B.4 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 14 days Associated Changes A.3 6 days 17 days New B.1 N/A Verify opposite unit DGs operable and OC DG available New C.1.1 N/A If new B.1 is not met, meet B.1 or and C.1.2 restore inoperable DG within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months One LCO 3.8.1.c DG inoperable D.4 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 21 days Associated Changes New E. 1 N/A Verify other DGs operable and OC DG available New F.1.1 N/A If new E.1 is not met, meet E.1 or and F.1.2 restore inoperable DG within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Two DGs inoperable G.1 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Associated Changes New 1.1 N/A Verify OC DG available and one other DG operable New J.1.1 N/A If 1.1 is not met, meet 1.1 or restore and J. 1.2 one DG within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Currently, the Required Action Completion Time for a single inoperable DG is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months regardless of the status of the OC DG or the other safety-related DGs. The first proposed change will increase the Required Action Completion Time for a single inoperable safety-related DG to 14 days, provided that the OC DG is available and the other three safety-related DGs are operable.

The second proposed Technical Specification change involves the Required Action Completion Time for declaring the Control Room Emergency Ventilation System (CREVS), Control Room Emergency Temperature System, and H2 Analyzer trains inoperable when the safety-related back-up power supply (DG) is inoperable. The proposed change extends the current 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 21 days when a single DG is inoperable (i.e., OC DG is available and three other safety-related DGs are operable) before the CREVS, Control Room Emergency Temperature System, and H2 Analyzer trains are declared inoperable.

Currently, when both DGs dedicated to redundant safety-related equipment are inoperable, the Required Action Completion Time is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The third proposed change increases this Required Action Completion Time to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months provided the OC DG is available and one other safety-related DG is operable.

In addition to the above changes, an administrative proposed change will also make a correction to the Completion Time for what is currently Required Action D.1 so that it correctly reads "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter" instead of "one per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter." The final Technical Specification 3.8.1 Required Actions and pages will be renumbered to accommodate the proposed changes.

Document Control Desk May 12, 2003 Page 3 These proposed changes are supported by a probabilistic risk evaluation and deterministic discussion meeting the criteria of Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk Inforned Decisions on Plant Specific Changes to the Licensing Basis.

These proposed Technical Specification changes result in a net reduction in risk and fully meet the requirements of Regulatory Guide 1.174. The complete risk evaluation is provided in Attachment (1).

ASSESSMENT We have evaluated the significant hazards considerations associated with this proposed amendment, as required by 10 CFR 50.92, and have determined that there are none (See Attachment 2 for a complete discussion). We have also determined that operation with the proposed amendments will not result in any significant change in the types or significant increases in the amounts of any effluents that may be released offsite, and no significant increases in individual or cumulative occupational radiation exposure.

Therefore, the proposed amendments are eligible for categorical exclusion as set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact assessment is needed in connection with the approval of the proposed amendments.

SAFETY COMMITTEE REVIEW The Plant Operations and Safety Review Committee and the Offsite Safety Review Committee have reviewed these proposed amendments and concur that operation with the proposed amendments will not result in an undue risk to the health and safety of the public.

SCHEDULE During the Unit 1 2004 Refueling Outage, the 5-year overhaul is scheduled for A DG. It is expected that this overhaul will result in A DG being inoperable for greater than 10 days. In accordance with the current Technical Specifications, this will require a shutdown on Unit 2 since CREVS will be declared inoperable with a single DG inoperable for greater than three days. The Unit 1 2004 Refueling Outage is currently scheduled for April 2004. Therefore, we request approval of this proposed amendment as soon as possible or by February 15, 2004 to allow for the necessary outage planning. Please note, additional licensing actions to request a one time extension for the CREVS Required Action Completion Time will be considered if approval of this proposed amendment is not received in time to allow for outage planning.

PRECEDENT

Millstone Nuclear Power Station, Unit No.2 - Amendment No. 261, dated January 4, 2002

Byron Station Unit Nos. 1 and 2- Amendment No. 114, dated September 1. 2000

+ Braidwood Station Unit Nos. 1 and 2 - Amendment No. 108, dated September 1, 2000

Perry Nuclear Plant - Amendment No. 99, dated February 24, 1999

Document Control Desk May 12, 2003 Page 4 Should you have questions regarding this matter, we will be pleased to discuss them with you.

STATE OF MARYLAND :

TO WIT:

COUNTY OF CALVERT :

I, Peter E. Katz, being duly sworn, state that I am Vice President - Calvert Cliffs Nuclear Power Plant, Inc. (CCNPP), and that I am duly authorized to execute and file this License Amendment Request on behalf of CCNPP. To the best of my knowledge and belief, the statements contained in this document are true and correct. To the extent that these statements are not based on my personal knowledge, they are based upon information provided by other CCNPP employees and/or consultants. Such information has been reviewed in accordance with company practice and I believe it reliable.

4, Subscribeo and sworn before me, a Notary Public in and for the State of Maryland and County of Mt, amsy's ,this ,7Z1- dayof a ,2003.

( / k <(O ?X WITNESS my Hand and Notarial Seal: V/ NotaryaPubF frL r- /-

Mcm . r I pr My'c:*rinissrain xpires: yH 6210 7 l Dxate PEK/DJM/bjd Attachments: (1) Diesel Generator Required Action Completion Time Risk Analysis (2) Determination of Significant Hazards (3) Marked Up Technical Specification Pages (4) Final Technical Specification Pages cc: J. Petro, Esquire H. J. Miller, NRC J. E. Silberg, Esquire Resident Inspector, NRC Director, Project Directorate I-1, NRC R. I. McLean, DNR G. S. Vissing, NRC

Document Control Desk May 12, 2003 Page 5 bcc: C. H. Cruse J. B. Hosmer M. A. Geckle P. S. Furio D. L. McCready (AIT No. None)

W. C. Holston R. B. Sydnor G. S. Pavis P. E. Katz J. A. Sickle K. J. Nietmann D. A. Holm J. A. Spina M. G. Korsnick OSSRC Secretary B. Booth E. P. Gwiazdowski A. M. Walters D. J. Mitchell S. J. Loeper T. S. O'Meara File # 09.04 Electronic Docket NRC 03-027 COMMITMENTS IDENTIFIED IN THIS CORRESPONDENCE:

Modify OC Diesel Generator ventilation system to improve its seismic response.

Responsible Person/Organization: RL Szoch Due Date: 2/1/2004 CLB Revision Required? If yes, Type:

Initiation Date:

CT No.:

Posting Requirements for Responses -- NOVIOrder No

ATTACHMENT (1)

DIESEL GENERATOR REQUIRED ACTION COMPLETION TIME RISK ANALYSIS Calvert Cliffs Nuclear Power Plant, Inc.

May 12, 2003

I CAL VERT CLIFFSNUCLEAR POWER PLANT RAN: 02-020 REV: 2 RELIABILITY ENGINEERING REU QUALITY RECORD Diesel Generator Required Action Completion Time Risk Analysis ORIGINATOR: Robert Cavedo 4k i, 1ky *6 /QL?3 I ATE REVIEWER: John Koelbel / -

DATE C 2 g~~~~~

APPROVAL:

4DTE

Calvert Cliffs Nuclear PowerPlant Risk Analysisfor ProposedDGRequiredAction Completion Time License Amendment LIST OF EFFECTIVE PAGES Pages Revision Cover 2 i 2 ii 2 2

iv 2 V 2 vi 2 vii 2 viii 2 1-54 2 RAN 02-020 REV. 2 CCNPP CCNPP RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant Risk A nalysisfor ProposedDG RequiredAction Completion Time License Amendment LIST OF EFFECTIVE SOFTWARE FILES Reliability Software Number: RSN-308 Folder: G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\

File Name Software Description 02-020-Rev2.doc WORD 97 Analysis Folder: G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files DG-Tech-Spec-Chart4.xls EXCEL 97 Tech Spec Basis Document Chart EDG-Q-Changes.xls EXCEL 97 Unavailability Split Fraction changes MFF for All-with-High-EDG Failure EXCEL 97 MFF with the DG Failure Rates Rates.xls Increased Folder: G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files\Unavailability Data from KLG DG Unavail Hrslxls EXCEL 97 Process Unavailable Hours from EDH Folder: G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files\Sensitivity Files Data-EDG-Sen-Cases.xls EXCEL 97 Processed Data for the DG Sensitivity Cases EDG-Cases-2-plus-SR-OOS-mb.csv Comma Delimited Files DG Cases with 2 or more DGs OOS EDG-OOS-AIl-Impacts-mb.csv Comma Delimited Files Evaluator Input Files for DG Cases EDG-OOS-AI]-Impacts-Wind- Comma Delimited Files Evaluator Output Files for DG Cases Removed-mb.csv EDG-Sen-Cases.xls EXCEL 97 DG Sensitivty Case Results EDG-Sen-Cases-mb.csv Comma Delimited Files Evaluator Input Files for DG Sensitivity Cases Part I EDG-Sen-Cases-RB.csv Comma Delimited Files Evaluator Output Files for DG Sensitivity Cases Part I EDG-Sen-Cases-Sorted.xls EXCEL 97 DG Sensitivty Case Results More-EDG-Sen-Cases-mb.csv Comma Delimited Files Evaluator Input Files for DG Sensitivity Cases Part I More-EDG-Sen-Cases-RB.csv Comma Delimited Files Evaluator Output Files for DG Sensitivity Cases Part I New-All-EDG-OOS-Results-DEEP EXCEL 97 Truncation Impact for DG OOS Run.xls Sen-Figures.xls EXCEL 97 Sensitivity Figures iiii RAN 02-020 REV. 2 CCNPP CCNPP RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment LIST OF EFFECTIVE SOFTWARE FILES (Continued)

Directory of G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files\MFF Store\Nornal BINI.MFF Text Seismic Binl RISKMAN MFF Base Case BIN2.MFF Text Seismic Bin2 RISKMAN MFF Base Case BIN3.MFF Text Seismic Bin3 RISKMAN MFF Base Case F_AB_MFF.MFF Text Fire Aux Bldg RISKMAN MFF Base Case F_CR_MFF.MFF Text Fire Cntrl RM and CSR RISKMAN MFF Base Case F_IN_MFF.MFF Text Fire Intake RISKMAN MFF Base Case F_TB_MFF.MFF Text Fire Turbine Bldg RISKMAN MFF Base Case F_YD_MFF.MFF Text Fire Yard RISKMAN MFF Base Case UP3INTA.MFF Text Internal Events and Wind RISKMAN MFF Base Case Directory of G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files\MFF Store\EDG Up Sensitivity BINI.MFF Text Seismic Binl RISKMAN MFF DG Failure Probabilities Increased BIN2.MFF Text Seismic Bin2 RISKMAN MFF DG Failure Probabilities Increased BIN3.MFF Text Seismic Bin3 RISKMAN MFF DG Failure Probabilities Increased F_AB_MFF.MFF Text Fire Aux Bldg RISKMAN MFF DG Failure Probabilities Increased F_CR_MFF.MFF Text Fire Cntrl RM and CSR RISKMAN MFF DG Failure Probabilities Increased F_IN_MFF.MFF Text Fire Intake RISKMAN MFF DG Failure Probabilities Increased F_TB_MFF.MFF Text Fire Turbine Bldg RISKMAN MFF DG Failure Probabilities Increased F_YD_MFF.MFF Text Fire Yard RISKMAN MFF DG Failure Probabilities Increased UP31NTA.MFF Text Internal Events and Wind RISKMAN MFF DG Failure Probabilities Increased iiii RAN 02-020 REV. 2 CCNPP CCNPP RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant RiskAnalysisforProposedDGRequiredAction Completion TimeLicenseAmendment LIST OF EFFECTIVE SOFTWARE FILES (Continued)

Directory of G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files\MFF Store\HA Up Sensitivity BIN I .MFF Text Seismic Binl RISKMAN MFF HA Failure Probabilities Increased BIN2.MFF Text Seismic Bin2 RISKMAN MFF HA Failure Probabilities Increased BIN3.MFF Text Seismic Bin3 RISKMAN MFF HA Failure Probabilities Increased F_AB_MFF.MFF Text Fire Aux Bldg RISKMAN MFF HA Failure Probabilities Increased F_CR_MFF.MFF Text Fire Cntrl RM and CSR RISKMAN MFF HA Failure Probabilities Increased F_IN_MFF.MFF Text Fire Intake RISKMAN MFF HA Failure Probabilities Increased F_TB_MFF.MFF Text Fire Turbine Bldg RISKMAN MFF HA Failure Probabilities Increased F_YD_MFF.MFF Text Fire Yard RISKMAN MFF HA Failure Probabilities Increased UP3INTA.MFF Text Internal Events and Wind RISKMAN MFF HA Failure Probabilities Increased Directory of G:\NED\REU\Controlled Documents\RANS\2002\02-020\REV02\Report Related Files\MFF Store\New EDG Qs Files EDG Qs-Post-AOT-Unit-l.csv Comma Delimited Files Unit I DG Unavailability Changes Post AOT EDG Qs-Post-AOT-Unit-2.csv Comma Delimited Files Unit I DG Unavailability Changes Post AOT EDG-Up.csv Comma Delimited Files AOT Update File iv RAN 02-020 REV. 2 CCNPP CCNPP iv RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant RiskAnalysisfor ProposedDGRequiredAction Completion Time LicenseAmendment REVISION HISTORY Revision Description 0 Initial issue.

1 As the OC DG is not SR, all references to the OC DG being operable are removed.

All Files Unique to the DG Evaluation are explicitly listed in the report.

Clarified the statement in Section 4.1 regarding the focus of maintenance resources.

Clarified the estimated DG OOS times in Sections 4.4, 6.1.1.1 and Table 5.

Clarified the benefit of the OC DG ventilation system being seismically hardened in Section 5.2.

Clarified the description of Assumption 7.

Provided more detail in the sensitivity evaluation regarding the CDF changes associated with Unit I as compared to Unit 2.

Made several editorial changes.

2 Removed sentence regarding cross-unit DG availability in Section 5.1. The cross-unit availability only increases for the IA DG.

Clarified the last paragraph in Section 6.1.1.1 regarding possible changes to the MR performance criteria.

V RAN 02-020 REV. 2 CCNPP v RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysisfor Proposed DGRequiredAction Completion Time LicenseAmendment TABLE OF CONTENTS

1.0 INTRODUCTION

............................................. . 1 1.1 Summary of Proposed Change ............................................. 1 1.1.1 Diesel Generator Required Action Completion Time ............................................ 1 1.2 Analysis Approach. 2

2.0 BACKGROUND

. 2 2.1 Electrical Distribution System. 2 2.2 Safety-Related Diesel Generators (DGs). 3 2.3 Augmented Quality Station Blackout (SBO) Diesel Generator (OC DG) .3 2.4 Current Technical Specification. 4 2.5 Regulatory Guide 1.155 DG Reliability Program5 2.6 Maintenance Rule (MR) (OCFR 50.65) ............................................ 5

3.0 DESCRIPTION

OF PROPOSED TS CHANGES ............................................ 6 4.0 BASIS FOR PROPOSED TS CHANGES ............................................ 6 4.1 Improved Maintenance Effectiveness ............................................ 7 4.2 Reduction of Need to Request Regulatory Relief ............................................ 7 4.3 Improved DG Availability During Shutdown ............................................ 7 4.4 Improved Ability to Support Maintenance Overhaul Durations ............................................ 7 5.0 DETERMINISTIC ASSESSMENT OF THE PROPOSED DG REQUIRED ACTION COMPLETION TIME EXTENSION.. 7 5.1 Defense-in Depth. 8 5.2 Safety Margins. 8 6.0 PROBABILISTIC ASSESSMENT OF THE PROPOSED DG REQUIRED ACTION COMPLETION TIME EXTENSION. . . 9 6.1 Tier 1, Analysis of Risk ................ 9 6.1.1 Diesel Generator Data used in Analysis of Risk ................................. 9 6.1.1.1 Diesel Generator Unavailability Data ................................. 9 6.1.1.2 Diesel Generator Reliability Data ................................. 11 6.1.1.3 Diesel Generator Commnon Cause Data................................. 12 6.1.2 Change in Average Risk ................................. 12 6.1.3 Change in ICCDP and ICLERP ................................. 13 6.1.4 Risk Insights ................................. 16 6.1.5 Scope of PRA ................. 18 6.1.5.1 At-Power Model Structure ................. 18 CCNPP RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysis for ProposedDG RequiredAction Completion Time License Amendment TABLE OF CONTENTS (Continued) 6.1.5.2 Shutdown Risk Assessment ........................................................ 20 6.1.6 PRA Detail Needed for Change ........................................................ 20 6.1.6.1 Key Initiating Events ........................................................ 20 6.1.6.2 Event-Tree Modeling ........................................................ 21 6.1.6.3 Diesel System Models ........................................................ 23 6.1.6.4 Truncation Limits ........................................................ 24 6.1.7 PRA Assumptions ........................................................ 25 6.1.8 Base PRA Results ........................................................ 28 6.1.9 PRA Sensitivity/Uncertainty Analysis ........................................................ 29 6.1.10 Compensatory Measures for Reducing Risk ........................................................ 31 6.1.11 Quality of CCNPP PRA ........................................................ 31 6.1.11.1 CCPRA Revision 0 Peer Review ........................................................ 32 6.1.11.2 Peer Review "B" Level Facts & Observations ........................................................ 34 6.1.11.3 Changes Between the IPE/IPEEE and Revision 0 (Peer Reviewed) ............................... 38 6.1.11.4 Changes Between Revision 0 (Internal Events Peer Reviewed) and Revision 1............... 39 6.1.11.5 CCNPP Unit-2 Revision 1 Model ........................................................ 43 6.1.11.6 Other Relevant CCPRA Open Items ........................................................ 44 6.1.11.7 PRA Software Control ........................................................ 47 6.2 Tier 2, Avoidance of Risk-Significant Plant Conditions .. 48 6.2.1 Station Blackout Diesel (OC DG) .48 6.2.2 Unit-to-Unit Interaction .48 6.2.3 Switchyard Maintenance .48 6.2.4 Grid Availability (High Winds) .49 6.3 Tier 3, Configuration Risk Management ............................ 49 6.3.1 On-line Risk Assessment - PRA Scope and Control ............................................... 50 6.3.1.1 PRA Scope ............................................... 50 6.3.1.2 PRA Configuration Control ............................................... 50 6.3.2 On-line Risk Assessment - Tools ............................................... 50 6.3.2.1 Description of On-line Risk Assessment Tools ............................................... 50 6.3.2.2 Control of On-line Risk Assessment Tools ................................................ 51 6.3.3 On-line Risk Assessment - Process ............................................... 51 6.3.3.1 Qualitative Risk Assessment ............................................... 51 6.3.3.2 Integrated Probabilistic Risk Assessment - Planned LCO Entry .................................... 52 6.3.3.3 Integrated Probabilistic Risk Assessment - Unplanned LCO Entry ................................ 53 6.3.3.4 On-line Risk Assessment - Level 2 ............................................... 53 6.3.3.5 On-line Risk Assessment - Extemal Events ................................................ 54 7.0 PERFORMANCE MONITORING .......................... 54

8.0 CONCLUSION

.......................... 54 CCNPP Y ii RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment TABLES Table I Proposed Required Action Completion Time Durations ................................................. 2 Table 2 CCNPP Diesel Generators ...................................................... 3 Table 3 NUMARC 87-00 DG Target Reliability Levels ...................................................... 5 Table 4 Current Maintenance Rule Performance Criteria ...................................................... 5 Table 5 Best Estimate Diesel Generator Unavailabilities ..................................................... 10 Table 6 Diesel Generator Reliability ..................................................... l1 Table 7 Diesel Generator Common Cause Data ..................................................... 12 Table 8 Summary of Model Changes Considered in Delta Risk Analysis ............................... 13 Table 9 Expected Change in Average Risk ..................................................... 13 Table 10 ICCDP & ILERP for Affected Unit ..................................................... 14 Table 11 Impact of Multiple Diesel Out-of-Service ..................................................... 15 Table 12 Percentage of CDF Change Due to Fire and Seismic .................................................. 17 Table 13 CCPRA Model Structure ..................................................... 19 Table 14 Typical CCPRA Modules within each Model ..................................................... 20 Table 15 OC DG Alignment Preference ..................................................... 22 Table 16 Diesel Generator Human Actions ..................................................... 23 Table 17 OC DG Alignments ..................................................... 26 Table 18 CCPRA Revision I Results ..................................................... 28 Table 19 Peer Review Sub-element Grades ..................................................... 34 Table 20 Facts and Observations Types ..................................................... 34 Table 21 CCPRA Development History ..................................................... 39 Table 22 CCNPP On-line Risk Thresholds ..................................................... 53 FIGURES Figure I Unit One Sensitivity Study Results. .30 Figure 2 Unit Two Sensitivity Study Results viii RAN 02-020 REV. 2 CCNPP CCNPP viii RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment 1.0 Introduction This document is a risk-informed analysis supporting proposed amendments to the technical specifications for the diesel generators.

1.1 Summary of Proposed Change The proposed changes address a change to the diesel generator required action completion time (CT).

1.1.1 Diesel Generator Required Action Completion Time The proposed amendments to Facility Operating Licenses DPR-53 for Calvert Cliffs Unit-I and DPR-69 for Calvert Cliffs Unit-2 will revise the Technical Specifications:

Currently, the required action completion time for the DGs is 72 hrs regardless of the status of the OC DG or the other SR DGs. The change increases the required action completion time for a single inoperable DG to 14-days. The 14-day required action completion time is only allowed when the OC DG is available and the other three SR DGs are operable. The 72 hr required action completion time (CT) for all other conditions remains the same.

DGs IA and 2B also act as the emergency power supply for the other Unit's Control Room Emergency Ventilation System (CREVS). The current Technical Specification describes this relationship in LCO 3.8.1.c. Currently, LCO 3.8.1.c (applies toDGs IA and 2B) is effectively 10 days. The effective 10 day required action completion time forDGs IA and 2B as the 3.8.1.c DGs is driven by the CREVS required action completion time (3 days for the DGs and 7 days for CREVS).

This effective 10 day required action completion time applies regardless of the status of the OC DG or the other SR DGs. This change increases the required action completion time for the IA and 2B DGs when acting as the 3.8.l.c DG to effectively 28 days (21 days for the DG and 7 days for CREVS).

The 21-day required action completion time for a DG inoperable to CREVS is only allowed when the OC DG is available and the other three SR DGs are operable. The 72 hr required action completion time for a DG inoperable to CREVS for all other conditions remains the same.

This DG required action completion time extension also impacts the maximum required action completion time for the Control Room Emergency Temperature System (CRETS) and H2 analyzer.

The CREVS required action completion time is considered to bound the impact on the CRETS and the H2 analyzer.

Currently, when both DGs dedicated to redundant SR equipment are inoperable (e.g. IA and IB, 2A and 2B, or IA and 2B), the required action completion time is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The change increases the required action completion time to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12-hour required action completion time is only allowed when the OC DG is available and two other SR DGs are operable.

The proposed changes result in a net reduction in risk and fully meet the requirements of Reg. Guide 1.174.

The benefit of making the OC DG more seismically robust and the improvement in maintenance effectiveness outweighs the adverse impact of the increased required action completion time duration.

Improving OC DG seismically strengthens the overall plant's ability to respond to seismic challenges. The gain in maintenance efficiency will result from the need for fewer required action completion time entries for routine maintenance and therefore less unavailability associated with preparation and return-to-service activities. These two factors counterbalance the increase in unavailability that results from on-line overhauls.

CCNPP Page 1 of 54 RAN02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor Proposed DG RequiredAction Completion Tine License Amendment Table 1 Proposed Required Action Completion Time Durations Diesel Unavailable i E Eabt 1 Required ec Unit-i Action Completion i' Time Unit-2 Required Action Completion Time I f5Diesels Unavailable' (Notes' lad2)

IA 14 days 21 days IB 14 days N/A (Note 3) 2A N/A (Note 3) 14 days 2B J 21 days 14 days Note 1: The case for the OC DG OOS is not presented because the OC DG remains without a required action completion time Note 2: When both IE DGs on the same Unit are inoperable, the OC DG is available, and the other two SR on the other Unit are operable, then the required action completion time increases from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . For all other combinations where two or more of the five site diesel generators are unavailable, the proposed technical specifications are identical to the current technical specifications.

Note 3: The current Unit 2 technical specifications do not restrict the amount of time the I B DG can be inoperable. The current Unit I technical specifications do not restrict the amount of time the 2A DG can be inoperable. This will not change in the proposed technical specifications.

1.2 Analysis Approach The analysis includes an integrated review and assessment of plant operations, deterministic design basis factors, and an evaluation of overall plant risk using probabilistic risk assessment (PRA) techniques.

Deterministically, the proposed change is supported by the defense-in-depth basis that is incorporated into the plant design as well as in the approach to maintenance and operation. With respect to plant risk, the proposed change is supported by a plant-specific risk analysis performed in accordance with NRC guidance for making risk-informed decisions and risk-informed changes to the plant Technical Specifications.

2.0 BACKGROUND

The site has four safety-related diesel generators (DGs) and one Station Blackout (SBO) diesel generator.

Two DGs are dedicated to Unit-I and two are dedicated to Unit-2. The site electrical distribution system has shared functions between the units. Therefore, the dedicated DGs not only provide support to their specified unit, but also to the opposite unit. The SBO diesel generator can support a single 4kV safety-related bus on either unit.

2.1 Electrical Distribution System The CCNPP switchyard is connected to the grid by three physically independent 500kV transmission lines.

Load flow and stability studies indicate that the tripping of one or both fully loaded CCNPP generating units would not impair the ability of the system to supply plant service. These studies were made at the projected peak load conditions and also at minimum load conditions when the two Calvert Cliffs units were supplying the entire Baltimore system (Calvert Cliffs UFSAR, Rev. 31, Section 8.2).

CCNPP Page 2 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for ProposedDG RequiredAction Completion Time LicenseAmendment Two physically independent circuits from the switchyard to the onsite electrical system are also provided from two 500kV/13.8kV plant service transformers that are fed from separate 500kV switchyard busses.

When available, the Southern Maryland Electric Cooperative (SMECO) substation is capable of supplying the power required to maintain both units in a safe shutdown condition (UFSAR, Rev. 31, Section 8.2).

The two plant service transformers feed six 13.8kV/4.16kV service transformers, three of which are capable of supplying the total plant 4.16kV auxiliary load. Four engineered safety features (ESF) busses are supported by these transformers. These busses can be supplied from the DGs or from the SBO diesel generator (UFSAR, Rev, 31, Sections 8.1 and 8.2) 2.2 Safety-Related Diesel Generators (DGs)

Any combination of two of the safety related DGs (one from each unit) is capable of supplying sufficient power for the operation of necessary engineered safety features (ESF) loads during accident conditions on one unit and shutdown loads of the alternate unit concurrent with a loss of offsite power and for the safe and orderly shutdown of both units under loss of offsite power conditions. The diesel generators start automatically following a safety injection actuation signal (SIAS) or an undervoltage condition on the busses that supply vital loads and are ready to accept loads within ten seconds (UFSAR, Rev. 31, Section 8.1). Table 2 summarizes the DG configuration.

The SACM safety-related diesel generator (lA DG) is installed in a separate and independent Category I building. This diesel also includes redundant air receivers, redundant air compressors, and a dedicated fuel oil storage tank within its building (UFSAR, Rev. 31, Section 8.4).

Table 2 CCNPP Diesel Generators

,DG: Make Design Rating Cooli Unit 4.16kV

________________________________ ___ E iiii- E- ) __; i - . _ _iiu__ Bus

-EContinuous IA SACM (Societe Alsacienne De 4.16kV, three-phase, 60 5400 kW outdoor 1 II Constructions Mecaniques De cycle tandem-engine ambient air Mulhouse)

IB FM (Fairbanks Morse) 4.16kV, three phase, 3000 kW SRW 1 14 60 cycle single engine Header 12 2A FM (Fairbanks Morse) 4,16kV, three phase, 3000 kW SRW 2 21 60 cycle single engine Header 21 2B FM (Fairbanks Morse) 4.16kV, three phase, 3000 kW SRW 2 24 60 cycle single engine Header 22 OC SACM (Societe Alsacienne De 4.16kV, three-phase, 60 5400 kW outdoor Either Manually Constructions Mecaniques De cycle tandem-engine ambient air Align Mulhouse) 2.3 Augmented Quality Station Blackout (SBO) Diesel Generator (OC DG)

The SBO diesel generator, designated as OC DG, is designed to provide a power source capable of starting and supplying the essential loads necessary to safely shutdown one unit and maintain it in a safe shutdown condition during a SBO event (UFSAR, Rev. 31, Section 8.4). OC DG is capable of supplying the same emergency plant loads as the DGs. The SBO DG can be aligned to any of the four ESF busses (UFSAR, Rev. 31, Section 8.1).

RAN 02020 REV. 2 Page 3 of 54 CCNPP Page 3 of 54 RAN02-020 REV. 2

Calvert Cliffs NuclearPowerPlant Risk Analysis forProposedDG RequiredAction Completion Time License Amendment The OC DG is similar to the safety-related A DG. The OC DG's supporting systems and associated switchgear are housed in the SBO Diesel Generator Building. The OC DG configuration is summarized in Table 2.

The OC DG is classified as augmented quality. OC DG and IA DG were purchased under one safety-related equipment specification. The non-SACM components (e.g. structures and piping) associated with the OC DG are not qualified or certified to industry and regulatory requirements applicable to a Class IE diesel generator (UFSAR, Rev. 31, Section 8.4).

The SBO Diesel Generator Building is designed to withstand likely weather-related loads as addressed in the local Standard Building Codes. It is not explicitly protected against the effects of tomadoes or hurricanes (UFSAR, Rev. 31, Section 8.4).

OC DG is electrically isolated from the ESF busses by two breakers (one Class 1E and one non-Class IE) and a Class 1E disconnect switch. The design of power connections from the OC DG allow for manual alignment to any one safety-related train in either unit via a Class I E ESF bus. Manual switching capability is provided through Class IE disconnect switches and Class I E breakers (UFSAR, Rev. 31, Section 8.4).

The SBO diesel is started manually. The diesel is loaded onto a 4.16kV bus when it is determined that the DG dedicated to that bus is not available to supply the plant loads. For planned maintenance of a DG, the OC DG is "pre-aligned" by closing the local disconnect switches to the 4.16kV bus affected by the DG maintenance.

2.4 Current Technical Specification Technical Specification 3.8.1 contains the requirements for the safety-related diesel generators (DGs) for Modes I through 4. The TS requires the unit's 2 DGs and the other unit's DG that supplies power to Control Room Emergency Ventilation System (CREVS), Control Room Emergency Temperature System (CRETS) and H2 Analyzer to be operable. Currently, the required action completion time for one of the unit's safety-related DGs is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The current Technical Specification allows the other unit's DG that supplies emergency power to the CREVS, CRETS, and H2 Analyzer to be inoperable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months before these components are to be declared inoperable. An operating Unit currently has a 7-day LCO for an inoperable CREV train. This results in an effective 10 day required action completion time for a DG on the other Unit that supports CREVS (DG IA or DG 2B).

This is illustrated in the following example with Unit-i operating and Unit-2 shut down.

DG 2B is removed from service for maintenance. Since Unit-2 is shutdown, Unit-2 requires only one of its two dedicated DGs (in this case DG 2A). Unit I is operating and requires DGs A and IB and also DG 2B because it is the emergency power supply for one of the sites two common CREV/ CRETs trains. When the 2B DG is taken OOS for maintenance, Unit-l enters a 72-hour LCO because this back-up power source to one of the two required CREV trains is OOS. At the end of the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , with the 2B DG remaining OOS, the affected CREV train is declared inoperable for Unit-I. Unit-I then enters a seven-day CREV LCO because only one of the two required CREV trains is operable. Therefore, in this example with Unit-2 shut down and Unit-l operating, the total effective required action completion time for DG 2B in support of Unit-l is ten days (3 days for the DG plus 7 days for CREVS).

For the CRETS and H2 Analyzer, this results in a total required action completion time of 33 days (3 days for the DG plus 30 days for CRET and H2 Analyzer). If two DGs dedicated to redundant safety-related equipment are inoperable, the required action completion time is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

CCNPP Page 4 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment 2.5 Regulatory Guide 1.155 DG Reliability Program CCNPP maintains a DG reliability program based on Regulatory Guide 1.155, "Station Blackout." The program monitors and evaluates DG performance and reliability consistent with guidance provided in NUMARC 87-00, "Guidelines and Technical Bases for NUMARC Initiatives Addressing Station Blackout at Light Water Reactors." The program requires remedial actions when one or more established reliability "trigger values" are exceeded, requires root-cause evaluation and corrective actions for individual DG failures, and monitors DG unavailability. Table 3 shows the status of the DG Reliability Program as of August 2002.

Table 3 NUMARC 87-00 DG Target Reliability Levels Failurein last Failures lat Failures in lasta Targets for 0.975 DG reliability 20demands 50 de'manids 10 demands J(filures in last 20/50/100ddemnds)

Unit-I 0 1 1 3/ 4 5 Unit-2 0 0 0 3 /4/ 5 SBO* 0 1 1 3/4/5

OC DG is the station blackout diesel generator and is not reportable under the diesel reliability program.

The DG reliability program will not be negatively impacted by the proposed amendment. However, there is a potential that, due to the improved maintenance effectiveness and flexibility that will result from implementation of this amendment, the DG performance may improve.

2.6 Maintenance Rule (MR) (IOCFR 50.65)

CCNPP monitors the reliability and availability of the DGs and the SBO DG as risk significant functions within the scope of the Maintenance Rule. The following Maintenance Rule criteria is currently used:

Table 4 Current Maintenance Rule Performance Criteria Diesel Generator ' b Availability Reliability eAvailability' Reliability, Criteria ."Performance Criteria Performance

- ~~~~~~~~~or, (ui,, ila i - (.

F.e :.E..... : .: ;0

. > . .:i...-,E (unavailablehours (unavailable hours (FunctionalFailures (Functional Failures) per 2 years) per2 years per 2 years) as of 6/30/2002) as of 6/30/2002)

IA <300 172 <2 IB <200 100 <2 l 2A <200 257 <2 T 2B <200 104 <2 0 OC <800 405 <2 0 RAN 02-020 REV. 2 Page 5 of 54 CCNPP Page 5 of 54 RANo02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment All diesels with the exception of the 2A DG are in the 10 CFR 50.65 a(2) MR category. Maintenance personnel identified degradation of the 2A DG flex gear during a routine surveillance: Repair efforts resulted in the 2A DG exceeding the unavailability performance criteria.

The proposed change to the Maintenance Rule performance indicators is discussed later in this document.

3.0 Description of Proposed TS Changes The following proposed changes apply to CCNPP Unit-I and Unit-2.

Currently, the Required Action Completion Time for the DGs is 72 hrs regardless of the status of the OC DG or the other SR DGs. The change increases the required action completion time for a single inoperable DG to 14-days. The 14-day required action completion time is only allowed when the OC DG is available and the other three SR DGs are operable. The 72 hr required action completion time for all other conditions remains the same.

DGs IA and 2B also act as the emergency power supply for the other Unit's Control Room Emergency Ventilation System (CREVS). The current Technical Specification describes this relationship in LCO 3.8.1.c. Currently, LCO 3.8.1.c (applies toDGs IA and 2B) is effectively 10 days. The effective 10 day required action completion time forDGs A and 2B as the 3.8.1.c DGs is driven by the CREVS required action completion time (3 days for the DGs and 7 days for CREVS).

This effective 10 day required action completion time applies regardless of the status of the OC DG or the other SR DGs. This change increases the required action completion time for the IA and 2B DGs when acting as the 3.8.1.c DG to effectively 28 days (21 days for the DG and 7 days for CREVS).

The 21-day required action completion time for a DG inoperable to CREVS is only allowed when the OC DG is available and the other three SR DGs are operable. The 72 hr required action completion time for a DG inoperable to CREVS for all other conditions remains the same.

This DG required action completion time extension also impacts the maximum required action completion time for the Control Room Emergency Temperature System (CRETS) and H2 analyzer.

The CREVS required action completion time is considered to bound the impact on the CRETS and the H2 analyzer.

Currently, when both DGs dedicated to redundant SR equipment are inoperable (e.g. IA and IB, 2A and 2B, or IA and 2B), the required action completion time is 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The change increases the required action completion time to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12-hour required action completion time is only allowed when the OC DG is available and two other SR DGs are operable.

4.0 Basis for Proposed TS Changes The longer required action completion time will help to avert a potential unplanned shutdown by providing margin for the performance of corrective maintenance that may be needed to resolve DG deficiencies discovered during equipment surveillances or scheduled preventive maintenance activities. In addition, the proposed required action completion time of fourteen days for a single inoperable DG will allow CCNPP to perform preventive maintenance work on-line that currently can only be performed during shutdown.

Plant configuration changes for planned and unplanned maintenance of the DGs, as well as the maintenance of equipment having risk significance, will be managed pursuant to the procedures and programs implemented at CCNPP for compliance with 10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants" (the Maintenance Rule). Pertinent details of the plant Maintenance Rule Program are discussed later in this document.

RAN 02-020 REV. 2 Page 6 of 54 CCNPP Page 6 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment 4.1 Improved Maintenance Effectiveness A significant portion of on-line maintenance activities is associated with preparation and return-to-service activities, such as: tagging, fluid system drain down, fluid system fill and vent, and cylinder block heat-up.

Longer required action completion time durations would allow more maintenance to be accomplished during a given on-line maintenance period and therefore would improve maintenance efficiency.

Also, by allowing on-line preventive maintenance and scheduled overhauls, the change provides the flexibility to focus more quality resources on any required or elected diesel generator maintenance. For example, during plant outages resources are required to support many systems. However, during online maintenance plant resources can be more focused on the diesel generators.

4.2 Reduction of Need to Request Regulatory Relief Planned and corrective maintenance has challenged the site ability to complete diesel generator maintenance within the TS requirements. This proposed amendment averts unplanned plant shutdowns and minimizes the potential need for Notice of Enforcement Discretion (NOED). A NOED was submitted and approved in 2002 for the 2A DG. Several other one-time amendment requests to facilitate maintenance during shutdown conditions have been submitted. Longer required action completion time durations will reduce the regulatory burden associated with effectively maintaining the DGs.

43 Improved DG Availability During Shutdown Performing DG overhauls at-power should reduce the risk associated with DG maintenance and the synergistic effects on risk due to DG unavailability occurring concurrently with other activities and equipment outages during a refueling outage.

4A Improved Ability to Support Maintenance Overhaul Durations The three FM DGs have an estimated workload of 9 days (per 2 years) to complete all maintenance requirements. Each of these diesels has twelve ported cylinders.

The SACM DG has thirty-two valved cylinders resulting in many more parts than the FM DGs. The SACM DG has an estimated workload of 12 days (per 2 years) to complete most maintenance requirements (except the 5-yr and 10-yrPMs). This diesel also has a five-year preventive maintenance requirement that is estimated to take less than two weeks to complete. There is also a ten-year maintenance requirement with a duration that is estimated to be less than 28 days. The proposed twenty-eight-day required action completion time for the outage impact on the opposite unit is being requested to support these longer duration maintenance requirements. Work is underway to reduce the frequency of the five-year and ten-year maintenance requirements. This analysis assumes that the frequencies are not changed.

The proposed required action completion time extension of fourteen days is adequate to support periodic major overhauls of the DGs during at-power operation. For such cases, the intent would be that a major overhaul of each DG would be performed at a frequency of no more than once per DG per operating cycle.

5.0 Deterministic Assessment of the Proposed DG Required Action Completion Time Extension The plant has four safety-related diesel generators and one Station Blackout diesel generator. Any combination of two of the DGs (one from each unit) is capable of supplying sufficient power for the operation of necessary engineered safety features (ESF) loads during accident conditions on one unit and shutdown loads of the alternate unit concurrent with loss of offsite power and for the safe and orderly shutdown of both units under loss of offsite power conditions. The diesel generators start automatically on a safety injection actuation signal (SIAS) or an undervoltage condition on the busses that supply vital loads CCNPP Page 7 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment and are ready to accept loads within ten seconds. A Station Blackout (SBO) diesel generator, OC Diesel Generator, can also be aligned to any of the four ESF busses. When all four SR DGs are operable, the design provides two independently capable and concurrently operating systems for safety injection, containment spray, and miscellaneous 480 volt auxiliary devices for the unit incurring the accident. In addition, the design provides power to operate two sets of equipment for shutting down the accident unit, including for example: two saltwater pumps, two service water pumps, two auxiliary feedwater pumps, containment cooling fans, and emergency turbine auxiliaries.

All necessary ESFs are duplicated and power supplies are arranged so that the failure to energize any one of the applicable busses, or the failure of one diesel generator to start, will not prevent the proper operation of the ESF systems.

The ESF electrical system has been designed to satisfy the single failure criterion as defined in Institute of Electrical and Electronic Engineers (IEEE) 279 (UFSAR Page 8.1-2, Bullet I, Page Revision 26).

5.1 Defense-in Depth The impact of the proposed TS change was evaluated and determined to be consistent with the defense-in-depth philosophy. The defense-in-depth philosophy in reactor design and operation results in multiple means to accomplish safety functions and prevent release of radioactive material.

The CCNPP design is consistent with the defense-in-depth philosophy. The plant has diverse power sources available (that is, DGs and SBO DG) to cope with a loss of the preferred AC source (offsite power). The overall availability of the AC sources to the ESF busses will not be reduced significantly as a result of increased on-line preventive maintenance activities.

While the proposed change does increase the length of time a SACM DG can be out of service during unit operation, it will also increase the availability of the SACM DGs while the unit is shutdown. The increased availability of the SACM DG while shutdown will increase defense-in-depth during outages.

The CCPRA confirms the results of the deterministic analysis - the adequacy of defense-in-depth and protection of the public health and safety are ensured.

No new potential common cause failure modes are introduced by these proposed changes and protection against common cause failure modes previously considered is not compromised.

Adequate defenses against human error are maintained. These proposed changes do not require any new operator response or introduce any new opportunities for human error not previously considered. Qualified personnel will continue to perform DG maintenance and overhauls whether they are performed on-line or during shutdown.

It is therefore acceptable, under controlled conditions, to extend the required action completion time in order to perform on-line maintenance intended to maintain the reliability of the onsite emergency power systems.

5.2 Safety Margins The proposed DG required action completion time license amendment does not change the compliance to any codes or standards that have been previously committed to or the margin to safety analysis acceptance criteria contained within the licensing bases.

RAN 02-020 REV. 2 Page 8 of 54 CCNPP Page 8 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant .

Risk AnalysisforProposed DG RequiredAction Completion TimeLicenseAmendment As part of this amendment, the plant will be enhanced to help maintain the plant safety margin. The OC DG ventilation system is being seismically hardened to support a 0.3g High Confidence of Low Probability of Failure (HCLPF) capacity. This modification provides a small reduction in the baseline core damage frequency and significant reduction in the risk associated with removing a DG from service.

6.0 Probabilistic Assessment of the Proposed DG Required Action Completion Time Extension To further assess the overall impact of the proposed amendment on plant safety a plant specific PRA has been performed to quantify the change in risk. This evaluation included consideration of the Configuration Risk Management Program (CRMP) established at CCNPP pursuant to Maintenance Rule requirements.

The risk evaluation was performed using the three-tiered approach suggested in RG 1.177, as follows:

Tier 1 PRA Capability and Insights Tier 2 Avoidance of Risk-Significant Plant Configurations Tier 3 Risk-Informed Configuration Risk Management Evaluations for each of these tiers are provided below.

6.1 Tier 1, Analysis of Risk Tier I is an evaluation of the impact on plant risk of the proposed TS change as expressed by the change in the following metrics:

CDF core damage frequency ICCDP incremental conditional change in core damage probability LERF large early release frequency ICLERP incremental conditional large early release probability These metrics are evaluated in this section using the diesel generator data discussed below.

6.1.1 Diesel Generator Data used in Analysis of Risk This subsection discusses the diesel generator unavailability, reliability, and common cause data used in the analysis of the proposed required action completion time extension.

6.1.1.1 Diesel Generator Unavailability Data The baseline CDF and LERF terms refer to the average risk measures calculated using historical average equipment unavailability. These values are shown in Table 5 for both the at-power condition and the total unavailability. The at-power availability is used to represent the dedicated DG unavailability to its associated unit (for example, IA and IBDGs unavailability seen by Unit-I). The Total Unavailability (At-power plus Shutdown) represents the unavailability seen by the opposite unit (for example, I A and IB DGs unavailability seen by Unit-2). Only the Total unavailability value is provided for the OC DG since it can be readily aligned to either unit.

RAN 02.020 REV. 2 Page 9 of 54 CCNPP CCNPP Page 9 of 54 RAN02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment For the A DG, the expected change in unavailability is based on shifting from four short at-power scheduled maintenance activities (about thirty hours each) and one shutdown overhaul maintenance activity (about 7 days) during a refueling cycle (i.e. 2 yrs) to two at-power maintenance activities. These activities would be one short planned activity (about 3 days) and one overhaul (about 7 days). For the FM DGs, a similar change would occur. These DGs would shift from two short at-power scheduled maintenance activities (30 hrs each) and one shutdown overhaul (7 days) every cycle (i.e. 2 yrs) to one short maintenance activity (2 days) and one overhaul performed at power (6 days) every cycle. The longer maintenance durations allow less DG tagout duration due to less DG maintenance preparation and return-to-service activities.

Although these changes reduce the overall time the DGs are tagged out, the full benefit of less unavailability is only realized on the IA DG (per Table 5, 180 hr/yr. to 149 hr/yr.). The FM DG unavailabilities increase (per Table 5, 83 hr/yr. to 121 hr/yr.). Often due to shutdown work on the FM DG support systems (e.g. salt water and service water), the FM DG can be maintained while already out-of-service due to support system unavailability. In this case, the FM DG work is shadowed by the support system work. This evaluation does not credit the shadowing effect for at-power operations. For the FM DGs, there is considered to be an additional 60 hrs of at-power work per year per FM DG (per Table 5 Columns I and 3).

The impact of the less frequent IA DG five-year and ten-year maintenance requirements are not considered in the unavailability estimates but are included as part of the sensitivity studies.

Table 5 Best Estimate Diesel Generator Unavailabilities (Does not Include Support System Unavailability)

Unavailability Unavailability At-power fordedicated unit Total (At Power + Shutdown)

Diesel Generator Pre-Cr I Current MR Post-CTy IPost-CT Pre-C Current MR Post-CT Post-CT MR Extension I Performance Extension I MR Extension Performance. Extension i Performance I Criteria (PA (PRA I Performn ce ( R rtra (PRA I Ciei V Values) Criteria Va Values)

Column I Column 2 Column 3 Column 4 Column S Column 6 Column 7 Column 8 IA 89 hours0.00103 days 0.0247 hours 1.471561e-4 weeks 3.38645e-5 months <300 hours 149 hours0.00172 days 0.0414 hours 2.463624e-4 weeks 5.66945e-5 months <400 hours 180 hours0.00208 days 0.05 hours 2.97619e-4 weeks 6.849e-5 months N/A 149 hours0.00172 days 0.0414 hours 2.463624e-4 weeks 5.66945e-5 months <500 hours per year per 2 years per year per 2 years per year per year per 2 years IB, 2A, 2B 61 hours7.060185e-4 days 0.0169 hours 1.008598e-4 weeks 2.32105e-5 months <200 hours 121 hours0.0014 days 0.0336 hours 2.000661e-4 weeks 4.60405e-5 months <300 hours 83 hours9.606481e-4 days 0.0231 hours 1.372354e-4 weeks 3.15815e-5 months N/A 121 hours0.0014 days 0.0336 hours 2.000661e-4 weeks 4.60405e-5 months <400 hours peryear per 2 years peryear per 2 years peryear peryear per2 years OC N/A 194 hours0.00225 days 0.0539 hours 3.207672e-4 weeks 7.3817e-5 months 800 hours0.00926 days 0.222 hours 0.00132 weeks 3.044e-4 months 194 hours0.00225 days 0.0539 hours 3.207672e-4 weeks 7.3817e-5 months <500hours per year I per 2 years peryear per 2 years The post-extension Maintenance Rule Performance criteria will ensure that the risk increase due to this proposed amendment request (excluding the five-year and ten-year SACM required maintenance) will be below IE-6. This was determined by setting all the diesels to their post MR performance criteria and comparing this to the pre-extension average diesel unavailability values. The benefit due to the seismic hardening of the OC DG was not considered in the establishment of these criteria.

RANO2-020 REV. 2 Page 10 of54 CCNPP CCNPP Page 10 of 4 RAN02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for ProposedDGRequired Action Completion Time License Amendment In addition to the above criteria, separate criteria are established for the five-year and ten-year SACM required maintenance. These criteria apply to both the IA DG and the OC DG.

five-year SACM Required Maintenance => fourteen day performance criteria per occurrence ten-year SACM Required Maintenance => thirty day performance criteria per occurrence When the combined impact of the base maintenance activities and the five-year and ten-year maintenance activities are considered, the increase in risk for Unit-I remains below IE-6, while the increase in risk for Unit-2 is slightly higher than IE-6. The larger impact on Unit-2 is due to the cross unit impact that Unit-2 sees from the IA DG five-year and ten-year maintenance activities. Unit-I is assumed to be shutdown during these long-duration IA DG maintenance activities and therefore is only impacted by the OC DG five-year and ten-year maintenance activities. Both IA DG and OC DG long-duration maintenance activities impact unit-2.

The Maintenance Rule (MR) Criteria listed in Table 5 is based on Revision I of the Calvert Cliffs PRA (CCPRA). Revisions to the CCPRA can cause the MR Criteria to change. The CCPRA can change as a result of equipment performance, plant modifications, understanding of plant operations, infrequent maintenance evolutions (e.g. ten-year maintenance), etc. The MR Criteria will be adjusted as required consistent with the CCNPP MR program.

6.1.1.2 Diesel Generator Reliability Data The skid-mounted components for each diesel generator set are modeled as a single component. Three failure modes are modeled as shown in Table 6. Interfacing system and components are modeled separately.

Table 6 Diesel Generator Reliability Diesel Type Failure Mode : Mi alea; Bases F~ailure Riate The prior distributions are based on SACM Failure to Start 2.36E-3 data from the manufacturer (SACM).

per demand This data was collected from 1986 through 1989. These prior distributions were Bayesian updated with plant Failure to Run 1St Hour 2.65E-3 experience from installation of the per hour SACM diesels (August 1995 for DG OC and April 1996 for DG IA) to the present (September 2002).

Based on the SACM "Failure to Run 1" Failure to Run after 1 Hour 5.76E-4 Hour" data times a reduction factor to per hour account for decreased failure rate after one successful hour. Since SACM data was not available, the reduction factor is based on the ratio Failure Rate (FR) after 't Hour to FR 1 'tHour of the original PLG-0500 failure rates.

The prior distributions are based on FM Failure to Start 1.79E-3 PLG-0500 generic failure rates and per demand early plant specific data. The prior distributions were Bayesian updated Failure to Run 1 Hour 6.28E-3 with plant experience for the period of per hour January 1992 through September of 1997.

Failure to Run after 1st Hour 2.5 1E-3 This is a PLG-0500 generic failure rate.

I_n_per hour CCNPP Page 1 1 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Powier Plant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment There is significant experience of running the diesel generators for one hour and therefore its failure is modeled separately from the remaining required hours. The failure rate used for the "after the first hour" is more generic due to limited plant experience.

6.1.1.3 Diesel Generator Common Cause Data The diesel generator common cause factors are taken directly from NUREG/CR-5497, Common Cause Failure Parameter Estimations. These are shown below:

Table 7 Diesel Generator Common Cause Data Group: Ty ail-to-Start Fil-to-Run Two Beta 3.12E-2 4.01E-2 (Used for the two SACM diesels)

Three Beta 3.70E-2 4.99E-2 (Used for the three FM diesels)

Gamma 0.45 0.422 There is also common cause modeled between all five diesels. This common cause considers three contributors: the diesel generators (diesel engine, generator, fuel oil, control circuitry, etc.), the diesel output breakers, and the load shed relays. Due to the diversity of design between the SACM and FM diesels, an estimated likelihood of all five diesels failing included a factor of ten reduction of NUREG/CR-5497 Group of Five values for diesel generators. This estimate was added to the common cause likelihood that the diesel generator feeder breakers fail to close on demand and to the likelihood that three of the largest loads fail to load shed. See the Assumption section for more discussion of the load shed issue.

6.1.2 Change in Average Risk RG 1.174 provides acceptance criteria for the change in CDF (core damage frequency) and LERF (large early release frequency). The guidelines are intended for comparison with a full-scope (including internal events, external events, full power, low power, and shutdown) assessment of the change in risk metric.

The criteria are conditional on the value of the baseline risk metric in that if the CDF is considerably higher than l.OE-4 per reactor year then the focus should be on finding ways to decrease rather than increase it.

CCPRA Revision I has a calculated internal and external event CDF of less than l.OE-4 per reactor year.

The guidance considers increases in CDF and LERF that are less than l.OE-6 and l.OE-7 respectively as very small.

RAN 02-020 REV. 2 Page 12 of 54 CCNPP Page 12 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysis for ProposedDG RequiredAction Completion Time LicenseAmendment The change in average risk was evaluated by comparing the pre-extension model with the post-extension model. Table 8 provides a summary of the model changes made to represent the proposed license amendment. Table 9 summarizes the results.

Table 8 Summary of Model Changes Considered in Delta Risk Analysis Change 'n i-CT Extension Model Pos-CT Extension Model I Diesel Generator Unavailability Uses values from Table 5, Columns I Uses values from Table 5, Columns 3 and 5 and 7 PORV Logic Modification Assumes modification is Assumes modification is implemented on both units implemented on both units OC DG Seismic Modification Does not credit this modification Assumes modification is implemented SACM 5-year and I 0-year required Not included since this maintenance Not included since this low frequency maintenance has not yet been performed. maintenance would be required regardless of the status of the extended required action completion time. Both the 5-year and I 0-year IA DG maintenance activities will likely be performed shutdown.

Table 9 Expected Change in Average Risk (reflecting benefit of OC DG Seismic Modification)

Risk Metric 'Risk'Significancei Risk Metric Results Criterion Unit-1 ]- U l nit-2 Base CDF NA 6.4E-5 6.7E-5 Delta CDF <I.OE-6 -1.9E-6 -2.9E-6 Base LERF NA 5.6E-6 6.1E-6 Delta LERF <I.OE-7 -1.5E-7 -3.2E-7 The benefit of improving the seismic ruggedness of the OC DG outweighs the increased at-power unavailability that results from increasing the DG required action completion time.

6.1.3 Change in ICCDP and ICLERP RG 1.177 provides acceptance criteria for ICCDP and ICLERP. The purpose of the numerical guidelines is to demonstrate that the risk increase is small and to provide a quantitative basis for the risk increase based on the aspects of the Technical Specification change modeled. A small risk increase is defined as ICCDP less than 5.0E-07 and ICLERP less than 5.OE-08.

ICCDP and ICLERP are defined numerically as:

RAN 02420 REV. 2 Page 13 of 54 CCNPP Page 3 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk A nalysisfor ProposedDG RequiredAction Completion Time LicenseAmendment ICCDP = [(conditional CDF with the subject equipment out of service)

- (baseline CDF with nominal expected equipment unavailabilities)]

(duration of single required action completion time under consideration)

ICLERP = [(conditional LERF with the subject equipment out of service)

- (baseline LERF with nominal expected equipment unavailabilities)]

(duration of single required action completion time under consideration)

For this evaluation, the conditional CDF and LERF terms refer to the risk of operating with a DG out of service and the remaining equipment at nominal expected unavailabilities. The post-extension model described in Table 8 was used for this evaluation.

The results of this evaluation are summarized in Table 10.

Table 10 ICCDP & ILERP Unit 1 Unit 2 Diesel Impact Impact OOS 14 days 28 days 14 days 28 days ICCDP I ICLERP ICCDP ICLERP ICCDP ICLERP ICCDP I ICLERP DG OC Available DG1AI; l.l1E-06~ 5.OE-.08: I N/A 1N/A. Jl 0 3.9E 0 1.4E3-06 1 7.7E3-08 DG 1B 1.4E-07 57E-9 -N/A IN/A 3.2E-07 I.2E-08 6.3E-07 2.4E-08 DG 2A 2.1E-07 8.7E-09 4.2E-07 1.7E-08 4.2E-07 2.4E-08 N/A N/A DG 2B 1.2E-07 4.3E-09 2.4E-07 8.6E-09 2.8E-07 9.3E-09 N/A N/A Unit 1 Unit 2 Impact Impact Diesel pIpc OOS 3 days 7 days 3 days 7 days ICCDP I ICLERP ICCDP ICLERP ICCDP ICLERP ICCDP ICLERP DG OC Unavailable DG IA 7.7E-07 2.9E-08 i N/A i N/A 6.0E-07 2.8E-08 1.4E-06 6.6E-08 IDGB 1.5E-07 4.8E-09 N/A N/A .8E-07 7.7E-09 4.2E-07 1.8E-08 DG 2A 1.1E-07 4.3E-09 2.5E-07 I L.OE-08 2.7E-07 I.IE-08 N/A N/A DG 2B 1.1E-07 4.8E-09 2.6E-07 L.1E-08 4.2E-07 1.2E-08 N/A N/A RAN 02-020 REV. 2 Page 14 of 54 CCNPP Page 14 o 4 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor ProposedDG RequiredAction Completion Time LicenseAmendment Table 11 Impact of Multiple Diesels Out-of-Service IA DG i BD `2ADG I 2BDG OCDG I Unitl. I U i (Bus j (Bus ^14)l (Bus 21) (Bus 24) Alignment Days to5E-7 Daysto5E-7 Two DGs Unavailable 1 Unavailable Unavailable ok ok Bus 11 2.6 5.1 2 Unavailable ok Unavailable ok Bus 11 2.9 2.7 3 'Unavailable ok ok Unavailable ' u 11 2.8 2.1 4 Unavailable 0 :' :'

ok : ok 044ok iBs 24 Unavailable 2.1 27 5 iok Unavailable Unavailabek b Bus 14 21.5 6.9 6 t$'<l :okk00000:00 tiUnavailable Unavailable ok Bus 21 9.8 7.8 7 ok Unavailable ok Unavailable Bus 24 8.5 7.8 8 ok ok Unavailable Unavailable Bus 24 20.8 4.8 Three Diesels Unavailable (includes OC DG) 9 Unavailable Unavailable Unavailable ok Bus 11 1.3 1.6 10 Unavailable Unavailable ok Unavailable Bus 11 0.8 0.8 11 Unavailable Unavailable ok ok Unavailable 0.8 1.6 12 Unavailable ok Unavailable Unavailable Bus 24 0.9 0.7 13 Unavailable ok Unavailable ok Unavailable 0.6 0.6 14 Unavailable ok ok Unavailable Unavailable 0.9 0.8 15 ok Unavailable Unavailable Unavailable Bus 24 4.8 2.9 16 ok Unavailable Unavailable ok Unavailable 5.9 3.6 17 ok Unavailable ok Unavailable Unavailable 2.2 1.3 18 ok ok Unavailable Unavailable Unavailable 6.9 1.0 The cases shown in Table 11 were performed using solved cutsets using an approach similar to that of the sensitivity studies performed in this report. Cases 3 and 4 and Cases 5 and 6 show how the risk varies based on which bus the OC DG is aligned to. Cases 5, 6, 7 and 8 shows that the impact of two Fairbanks Morse diesels out-of-service is considerably less than that of one SACM diesels and a Fairbanks Morse diesel (Cases 1, 2, 3 and 4). The three Fairbanks Morse case, Case 15, show the impact of three Fairbanks Morse diesels out-of-service is considerably less than other combinations of three diesel.

RAN 02-020 REV. 2 Page 15 of54 CCNPP Page 15 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPowerPlant Risk AnalysisforProposed DGRequired Action Completion Time LicenseAmendment 6.1.4 Risk Insights IA DGlmportance Due to the interconnectivity of the sites electrical distribution system, IA DG is the most important diesel to both Unit-i and Unit-2. This importance is driven by these issues:

Independence of lA DG from other plant systems

Rugged construction of the 1A DG building (wind resistant)

Seismically Rugged (the IA DG meets a Class I seismic design)

Automatic start of the DG, and

the A DG is aligned to an important 4kV bus.

These design features are especially evident in the external events analysis. Large seismic events, beyond design bases, can challenge the Turbine Building Service Water System (TBSRW). Large fires in the Turbine Building can also challenge the TBSRW. Since the Safety-Related Service Water and TBSRW (non-safety-related) are normally connected (TBSRW is isolated on SIAS), the failure of the TBSRW can result in the failure of the safety-related SRW due to a loss of inventory. This can, in turn, result in the failure of the Fairbanks Morse DGs.

OC DG Seismic Modification The OC DG Building was designed and installed to standard building codes. However, the diesel engine and generator are the same as the IA DG. During the IPEEE walkdowns, it was noted that the OC DG is generally rugged with a few exceptions associated with the OC DG building HVAC. A modification was initiated to improve the seismic capacity of the HVAC system in support of this proposed license amendment. Improving the HVAC system to meet a 0.3g HCLPF provides a three percent reduction in total CDF for Unit 1 (4% for Unit 2) and significantly enhances the value of the OC DG. Based on the expected DG unavailability following implementation of the proposed required action completion time extension a net risk reduction is predicted.

4kV Bus lmportance There are two issues that drive the importance of the 4kV busses: location of the motor-driven Auxiliary Feedwater pumps and providing power to charge the four station batteries.

Each unit has two ESF 4kV busses. Unit-I has busses 11 and 14 and Unit-2 has busses 21 and 24. Each unit also has one motor-driven AFW pump and two turbine-driven AFW pumps. 4kV Bus 11 supports the Unit-I motor-driven pump (AFW Pump 13) and 4kV Bus 24 supports the Unit-2 motor-driven pump (AFW Pump 23). These motor-driven pumps can be used to supply the opposite unit. For dual unit events, the CCPRA questions the availability of the turbine-driven pumps for each unit. If these are functioning, then the motor-driven pump is made available to support the opposite unit. It is therefore important to Unit-1 that Bus 24 is available and to Unit-2 that Bus 11 is available.

The second issue is the support to the chargers to maintain the batteries. Each 4kV bus has a separation classification called "facility." The facilities associated with these busses are as follows:

4kV Bus 11 Facility A 4kV Bus 14 Facility B 4kV Bus 21 Facility A 4kV Bus 24 Facility B RAN 02.020 REV. 2 Page 16 of 54 CCNPP Page 16 f 54 RANOt2-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for ProposedDG RequiredAction Completion Time License Amendment The four 125VDC busses are common to both Units. Each 125VDC bus is capable of providing key indications to both Units (e.g. steam generator water level indication). The 125VDC busses are each fed from a Unit-l and Unit-2 480VAC charger (for a total of eight chargers). The facilities of the 125VDC busses and the ultimate 4kV support are:

125VDC Bus 11 Facility A 4kV Busses 11 or 21 125VDC Bus 12 Facility B 4kV Busses 14 or 24 125VDC Bus 21 Facility B 4kV Busses 14 or 24 125VDC Bus 22 Facility A 4kV Busses 11 or21 Therefore, the loss of a single facility (busses 11 and 21 for Facility A or busses 14 and 24 for Facility B) will result in the loss of power to chargers supporting two of the four batteries. Loss of power to two busses of the opposite facilities maintains charging power to all the batteries. Due to the large amount of redundancy, this aspect of cross-unit dependence is not as significant as the motor-driven AFW pump.

Fire, Seismic and High WVind Impacts on RequiredAction Completion Time Extension Seismic, Fire and Wind account for a large percentage of the risk associated with this proposed diesel generator extension. The following table shows the percentage of the risk due to external events associated with taking a diesel out of service.

Table 12 Percentage of CDF Change Due to Fire, Seismic and Wind DG OOS :i Unit I Unit 2 IA 570/o 75%

lB 62% 43%

2A 570/o 77%

2B 36% 45%

OC 64% 57%

If Fire, Seismic and Wind impacts were not used in this analysis the overall risk would drop by approximately 50%.

HurricanesImpact on RequiredAction Completion Time Extension The Wind Analysis includes hurricane and tornado impacts. Hurricanes account for greater than ten percent of the risks noted in this analysis. As noted in Section 6.2.4 a diesel generator will not be taken out of service if a hurricane warning is in effect. Also, an out-of-service diesel will be returned to service as soon as possible if a warning is issued. By procedure, if a hurricane is expected to strike within eight hours the units are placed in Hot Standby (Mode 3).

RAN 02.020 REV. 2 Page 17 of 54 CCNPP CCNPP Page 17 of 54 RAN 02 020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for Proposed DG Required Action Completion Time License Amendment The hurricane analysis is conservatively performed assuming each unit is at power. Given the units will actually be shutdown for a number of hours prior to a hurricane strike the decay heat will be substantially reduced. Given the decreased decay heat and a controlled shutdown, the probability of core damage is significantly less than calculated.

The risk numbers shown in this analysis do not take credit for these compensatory measures.

6.1.5 Scope of PRA The CCPRA is an at-power, internal and external events PRA. Both Level I and Level 2 are addressed.

The external events considered are fire, seismic, and high wind (hurricanes and tornadoes). Both Unit-I and Unit-2 are modeled. The Unit-I models were modified with over two hundred changes to provide a risk assessment model that reflects Unit-2.

6.1.5.1 At-Power Model Structure The accident sequences are developed using logic rules that relate equipment functions and operator actions to initiating events and other equipment functions and operator actions. RISKMAN software uses these rules to develop relationships that are represented by event trees. An event tree is a logical network that begins with an initiating event and progresses through a series of branches that represent the success or failure of the expected system function or operator action. These system functions or operator actions are referred to as top events. Each rule defines the selection criteria for a split fraction (the conditional failure probability of a top event) or a macro (a function that is set to true or false to indicate a plant status based on its associated rule). The split fraction values are contained in a file called a Master Frequency File (MFF). The bases for the MFF values comes from various sources including system analysis (fault-trees) and human action analysis.

Several sets of rules (eight models) using nine MFFs are used to represent the full scope of the CCPRA.

The model definition and associated MFF are summarized below:

RAN 02-020 REV. 2 Page 18 of54 CCNPP Page 18 of 54 RAN02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk AnalysisforProposedDG RequiredAction Completion Time License Amendment Table 13 CCPRA Model Structure InternaExternal Model ' Ma ter Freuencr y File Declptin Intemal General Transient Intemal Base file Intemal LOCA Intemal Base file Intemal Steam Line Break lntemal Base file Intemal Flood Intemal Base file Extemal Fire - Auxiliary Auxiliary Building Human actions are degraded to reflect Building Auxiliary Building fires Intake Structure Human actions are degraded to reflect Intake Structure fires Turbine Building (partial) Human actions are degraded to reflect Turbine Building fires Yard Areas Human actions are degraded to reflect Yard Area fires Extemal Fire - Control Control Room Human actions are degraded to reflect Control Room/Cable Spreading Room fires Room Turbine Building (partial) Human actions are degraded to reflect Turbine Building fires Extemal Seismic Bin I Human actions are degraded to reflect low g levels (low g to 0.28 1gs)

Bin2 Human actions are degraded to reflect mid g levels (0.282g to 0. 6 6 3g)

Bin 3 Human actions are degraded to reflect high g levels (0.664g to high g)

External Wind Wind Base file with Wind Impact Top Events Added Each model is constructed with a similar structure using six event-tree modules and a Plant Damage State (PDS) bin assignment module. These modules are seamlesslyjoined as though they are one event-tree within RISKMAN. The dividing point of each module reflects previous software limitations more than model structure concerns.

CCNPP Page 19 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant, Risk AnalysisforProposedDG RequiredAction Completion Time License Amendment Table 14 Typical CCPRA Modules within each Model GT Modules M idel SUPPORTI Support Systems: Primarily Electrical Busses and DGs SUPPORT2 Support Systems: Primarily Mechanical Support Systems GT I Front-line Systems: Includes reactor and turbine trip functions GT2 Front-line Systems: Includes AFW and HPSI in the injection mode LT Front-line Systems: Long-tern; Includes Containment Spray and systems for re-circulation PDS Plant Damage State: Establishes the plant damage state for the Bin Assignment Rules.

Bin Assignment Uses the PDS macros to assign core damage sequences to a PDS Rules (each PDS has a fixed fraction associated with LERF)

Note that although the structure for each model is the same, the individual module names differ for each model.

6.1.5.2 Shutdown Risk Assessment The changes included in the proposed DG required action completion time license amendment are focused on allowing greater operational flexibility while at-power. The reduction in shutdown risk due to reduced DG shutdown unavailability and the potential avoidance of transition risk are not credited in this analysis.

6.1.6 PRA Detail Needed for Change The CCPRA explicitly models the functions associated with the four DGs and the OC DG in both the Unit-I and Unit-2 PRA models. Key modeling features are discussed below.

6.1.6.1 Key Initiating Events The Loss of Offsite Power (LOOP) is modeled by subdividing this initiator into seven initiating events (IEs). Each IE addresses a different LOOP duration: LOOPOI is less than one hour; LOOP02 is one to two hours; and so forth. The frequency for each IE is based on generic EPRI data and plant specific experience for the likelihood of a LOOP of a specific duration. This approach allows explicit responses to be modeled for the different durations. The grouping of the shorter duration LOOPs is based on plant functionality.

The FM DGs can operate for one hour without ventilation. The DGs can run for over two hours using the fuel oil day tanks. The station battery is assumed to be able to last for about four hours given no SIAS actuation. The remaining times are subdivided based on risk impact. The more subdivisions used, the more accurate (and lower) the calculated CDF.

Loss of Offsite Power InitiatingEvent Frequencies RAN 02.020 REV. 2 Page 20 of 54 CCNPP CCNPP Page 20 of 54 RAN 024020 REV. 2

Calvert Cliffs NuclearPo wer Plant, Risk AnalysisforProposedDG Required Action Completion Time License Amendment Loss of Offsite Power (LOOP) frequencies are parsed into seven time frames based on plant safety functions. The time frames are as follows:

Initiating Event Description LOOPOI Less than I hour LOOP02 From I to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months LOOP04 From 2 to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months LOOP08 From 4 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months LOOPII From 8 to 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months LOOP18 From 11 to 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months LOOP24 From 18 to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months The generic frequencies for these initiators are taken from EPRI TR-1 10398, Losses of Off-Site Power at U.S. NuclearPowerPlants-Through 1997. Each LOOP frequency is extracted from Table 2-1 which is a graph of LOOP events and durations. The generic frequencies have been updated with plant experience.

There has been one loss of offsite power event at CCNPP (in 1987). This LOOP was recovered before four hours had elapsed and is counted as a LOOP04.

Loss of5OOkVor 13kVBusses The DGs could also be required following the loss of a 500kV switchyard bus or a 13kV bus. The CCPRA model contains explicit initiators for both 500kV busses ("red" or "black") and both 13kV busses (11 or 21). In addition, the impact of a LOOP induced by stresses on the grid following a plant trip are included.

To develop a loss of a 500kV bus frequency industry data was reviewed for similar losses. This frequency was Bayesian updated with plant experience which shows that four such events have occurred at Calvert Cliffs: April 11, 1978; November 11, 1979; June 10, 1993; and February 27, 1996.

The loss of 13kV initiating events are based on an evaluation of individual component failure rates that result in the loss of these busses.

6.1.6.2 Event-Tree Modeling Unit-to-UnitInteraction To effectively model the role of the opposite unit DGs, both unit PRAs include all four DGs, the OC DG, and associated electrical and mechanical systems necessary for their operation. The model also includes the consideration that some initiators cause both units to trip (for example, LOOP, hurricane, some fires, loss of 125VDC Bus 11, etc.).

Diesel Unavailability Five top events are used to model the out-of-service unavailability of each diesel generator. Since it is a site practice to remove only one of the five diesels from service at any given time, the separate modeling of the unavailability provides an easy means to account for the mutually exclusive nature of this unavailability. For the three water-cooled Fairbanks Morse diesels the unavailability of service water is also considered in these top events.

Diesel Common Cause The diesel generator common cause is modeled at several different levels:

Between like equipment supporting a single diesel

Between like diesels (between the two SACM diesels and between the three FM DGs)

Between all like and unlike diesels CCNPP Page 21 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for Proposed DG RequiredAction Completion Time License Amendment The common cause between like equipment supporting a single diesel is modeled within the fault-tree for each diesel. The common cause between like diesels is modeled using conditional split fractions within the appropriate diesel generator top events. The common cause between all the diesels (including OC DG) is modeled using a separate top event (Top Event GC) within the event tree. If this top event fails, then all the diesels are set to failure. Top Event GC considers the potential for common cause failure of the 4kV feeder breakers or the common cause failure of multiple load shed relays.

This comprehensive treatment of common cause is not limited to the diesel generators. This approach is used throughout the CCPRA. Other key common cause impacts related to the diesel generators are 125VDC batteries, SRW pumps, SW pumps, ESFAS UV channels, 4kV load breakers, and 120 VAC inverters.

OC DG Substitution During DG maintenance activities the model assumes that OC DG is pre-aligned to the bus associated with the out-of-service DG and cannot be re-aligned to another bus in response to an initiating event. If all DGs are available prior to the trip and only a single DG fails post trip, OC DG is assumed to be preferentially aligned to the 4kV Busses as shown in Table 15.

Table 15 OC DG Alignment Preference l, ,,Order' iUnit-1 Model Unit-2 Model, 1 st 4kV Bus 11 4kV Bus 24 2 nd 4kV Bus 24 4kV Bus 11 3 rd 4kV Bus 14 4kV Bus 21 4 th 4kV Bus 21 4kV Bus 14 4kV Busses 11 and 24 power the motor-driven Auxiliary Feedwater Pumps for their respective units and are therefore the more important 4kV busses. If both DGs on a given unit fail, then OC DG is aligned to the unit in the blackout condition. For example, if DGs A, 2A, and 2B fail in a Unit-l evaluation, then OC DG is considered aligned to 4kV Bus 24 (Unit-2). See the Assumptions Section for addition discussion of this topic.

CCNPP Page 22 of 54 RAN 02.020 REV. 2

Calvert Cliffs NuclearPower Plant Risk AnalysisforProposedDG RequiredAction Completion Time LicenseAmendment OperatorActions Several operator actions that are directly associated with the alignment of the diesel generators are included in the models. These include:

Table 16 Diesel Generator Human Actions Action Top Description Available l-HA Failire Cmmen Event i T =e ;Likelihood BHEC3A GO Align Fuel Oil Makeup to OC 8 hrs 2E4 to 3E-3 Timing is based on time to DG after LOOP deplete the OC DG fuel day tank.

BHEC3B GO Restart OC DG Following Fuel 3.5 hrs 3E-4 This action is questioned if Oil Depletion OC DG shutdowns due to lack of fuel. Action BHEC3A is assumed to fail.

BHEC4A GS . 20 mins 6E-3 Values vary based on:

- number of DGs that failed

- whether the failure is early GK Start, Align and Load OC DG 45 mins 9E4 to 4E-1 or late to a 4kV Bus - available time GL . 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 2E-1 to 3E-I Additional degradation is considered for fire and seismic events.

BHEADU AD Align IA DG to 4kV Bus 24 1 hr 2E-1 Applies to Main Control Room fires only. Value is a conservative estimate.

BHEFVI FV Align IA DG or Off-site I hr IE-1 to 2E-I Applies to Main Control Power on OC DG failure Room fires only. Values are estimated. Values vary dependent on the status of off-site power.

The impact of failing human actions BHEADU and BHEFVI are included as sensitivity studies.

6.1.6.3 Diesel System Models SA CMDiesel Generators (JA DG and OCDG)

The SACM Diesel Generators are modeled using two top events for each diesel generator. For each diesel, one top event addresses planned and unplanned unavailability and a second top event addresses the likelihood that the diesel will start and run for its required mission given it is available. The likelihood that the diesels fail to perform their missions is determined using fault-tree analysis.

CCNPP Page 23 of 54 RAN 02020 REV. 2

Calvert Cliffs Nuclear Power Plant, RiskAnalysisforProposed DG RequiredAction Completion Time License Amendment Both 1A DG and OC DG are relatively independent from the remainder of the plant. They are each housed in their own buildings. Other than the undervoltage signal from ESFAS and control power to close the DG onto the safety-related bus there are no extemal supports required. The following intemal support systems are modeled in detail for each top event:

DG Control Relays

Fuel Oil Makeup

Building Ventilation - Including direct room cooling for the DGs

Electrical Supports - 125VDC, 480VAC, 4kV

DG Fluid Cooling Systems

Air Start System Common cause between like system components is included in the detailed fault-tree models used to represent these models. Common cause between the diesels is discussed above in Event Tree Modeling.

FairbanksMorse Diesel Generators(B, 2A and 2B DGs)

The Fairbanks Morse Diesel Generators are also modeled using two top events for each diesel generator.

For each diesel, one top event addresses planned and unplanned unavailability and a second top event addresses the likelihood that the diesel will start and run for its required mission given it is available. The likelihood that these diesels fail to perform their missions is determined using fault-tree analysis.

The Fairbanks Morse DGs are located in the separate rooms within the Auxiliary Building. They require several plant support systems including 125VDC power, 480VAC power, anundervoltage signal from ESFAS, as well as the plant Service Water System. The following intemal support systems are modeled in detail for each top event:

DG Control Relays

Fuel Oil Makeup

Room Ventilation

SRW Supply CV

Air Start System Common cause between like system components is included in the detailed fault-tree models used to represent these models. Common cause between the diesels is discussed above in Event Tree Modeling.

6.1.6.4 Truncation Limits For each initiating event the CCPRA quantification process post-processes the RISKMAN sequence output to obtain accurate CDFtLERF values with a sufficient number of sequences to ensure resolution while simplifying the sequence results. The CDF and LERF values associated with each initiating event are extrapolated such that the CDFILERF has less than a one-percent change in CDF/LERF for a decade deeper truncation limit.

The truncation limits are set per-initiating event based on the post-processed results. These truncation limits vary from 10.10 to 10' CCNPP Page 24 of 4 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant RiskAnalysisforProposedDG Required Action Completion Time LicenseAmendment 6.1.7 PRA Assumptions Diesel GeneratorRelated Assumptions

1. Diesel unavailability is assumed to be mutually exclusive.

The TS currently have a seventy-two hour limitation for the out-of-service condition of one DG per unit.

Site practice is to remove only a single diesel generator, including the OC DG, from service at any one time.

The impact of this assumption is that when one diesel generator is out of service, the other diesels have a reduced likelihood of failing since they can not be out of service for maintenance.

2. OC DG is assumed pre-aligned to bus of out-of-service DG.

Pre-aligning the OC DG to the out-of-service bus is a practice that is typically used to maximize the reliability of the impacted ESF bus. The OC DG is electrically isolated from the ESF busses by two breakers (one Class IE and one non-Class IE) and a Class IE disconnect switch. To pre-align the OC DG, the local disconnect switch is shut to the effected ESF bus. This removes the need for local action in the applicable switchgear room.

The impact of this assumption is that when one DG is out of service, the OC DG will be dedicated to the impacted bus and only a Main Control Room action is used to start and load the diesel. The CCPRA assumes that once the OC DG is pre-aligned, it will not be re-aligned following the initiation of an accident.

This is conservative since equipment failures including the status of the other DGs may make re-aligning the OC DG a necessity.

3. Post-initiator with all DGs initially available, OC DG will be aligned to the most important bus on the unit with the greatest need.

4kV Bus 11 is the most important bus for Unit-l and 4kV Bus 24 is the most important bus for Unit-2. As long as at least one 4kV bus is available on both Units or there is a blackout condition on both units, the unit with the greatest need is considered the evaluated unit.

CCNPP procedures do not direct OC DG to a particular bus. This approach provides maximum operational flexibility. Since the OC DG is a common diesel to both units, it is evaluated in the PRA for each unit.

This is also true for the DGs except that they are aligned to a dedicated bus. This is appropriate due to the conservative assumption that the OC DG can not be re-aligned once on a bus and the extensive accounting for other cross-system dependencies. For example: AFW Pump 13 can be used by Unit-2 during a LOOP only if a Unit-I turbine-driven AFW pump is available and supports systems including power to the AFW Pump 13 is available.

RAN 02-020 REV. 2 Page 25 of 54 CCNPP Page 25 of 54 RAN 024020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk AnalysisforProposedDGRequiredAction Completion Time LicenseAmendment The table below illustrates the possible alignments and where they are different between the unit models.

Table 17 OC DG Alignments OC DG OC DG 'Alignment iADG iBDG 2A-DG 2BDG U d - U2 Model Different (Bus11)' (us4) (us 21) (Bs24) Alignment ignment Beween Units Unavailable n/a n/a n/a Bus 11 Bus 11 No n/a Unavailable n/a n/a Bus 14 Bus 14 No n/a n/a Unavailable n/a Bus 21 Bus 21 No n/a n/a n/a Unavailable Bus 24 Bus 24 No Fails Works Works Works Bus 11 Bus 11 No Works Fails Works Works Bus 14 Bus 14 No Works Works Fails Works Bus 21 Bus 21 No Works Works Works Fails Bus 24 Bus 24 No Fails Fails Works Works Bus 11 Bus 11 No Fails Works Fails Works Bus 11 Bus 11 No Fails Works Works Fails Bus 11 Bus 24 Yes Works Fails Fails Works Bus 14 Bus 21 Yes Works Fails Works Fails Bus 24 Bus 24 No Works Works Fails Fails Bus 24 Bus 24 No Fails Fails Fails Works Bus 11 Bus 11 No Fails Fails Works Fails Bus 11 Bus 11 No Fails Works Fails Fails Bus 24 Bus 24 No Works Fails Fails Fails Bus 24 Bus 24 No Fails Fails Fails Fails Bus 11 Bus 24 Yes As seen above, our approach to modeling OC DG results in three cases where the alignment of the OC DG is different between the units. None of these cases are associated with the planned unavailability of a DG.

4. Repair of a failed diesel is assumed to be unlikely and therefore not credited.

Recovery of the LOOP is considered within the development of the LOOP initiating events. Each of the seven LOOP initiating events represents a discrete LOOP duration. The diesel mission times are associated with a specific LOOP initiating event. If a DG fails, it can be recovered by the OC DG. However, repairing a DG is not considered due to the added timing complexity. .

RAN 02.020 REV. 2 Page 26 of 54 CCNPP Page 26 of 54 RAN 024020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk A nalysis for Proposed DG RequiredAction Completion Time License Amendment

5. During ESF UV sequencer operation, it is assumed that three of the largest loads must fail to load shed before the DG is assumed to fail.

When the undervoltage devices sense a low bus voltage condition, actuation logic will load shed selected loads and start the associated DG. Failure to load shed one or more loads could degrade the diesel or the associated bus resulting in a low voltage or low frequency condition. Design calculations show that the load shed margin is low in that one or two loads failing to load shed would result in the minimum voltage being exceeded. However, a failure that occurred at CCNPP during an integrated ESF test resulted in a FM DG picking up significant load. The bus impact was minimal. A three-load failure criteria is a compromise in that it is a slightly higher number of load failures than the design calculation showed as acceptable but a much lower than the number of failures seen during an actual plant event in which the diesel performed acceptably.

6. Diesel failure rate and common cause likelihood are assumed to remain the same.

The changes to the TS directly impact the DG unavailability assumed in the PRA. However, no changes were made to the diesel failure rates to start and to run or to the common cause likelihood. With the increase in operational flexibility, there is a potential that these failure rates may improve. Therefore, this assumption is considered conservative.

7. Shutdown risk and transition risk are assumed to further justify the requested change.

It is anticipated that the lA DG unavailability will decrease as a result of this proposed amendment (Table 5, Column Post-CT Extension Values). In addition, transitions to lower modes of operation may be avoided. The risk reduction associated with these improvements is not explicitly calculated in the analysis supporting this change.

8. The Diesel Generators will continue to be worked around the clock while out of service for maintenance.

The DGs will continue to receive high priority from Operations and Maintenance personnel. This will ensure that the DGs are returned to service in the minimal amount of time. This assumption is necessary to support the expected reduction in total unavailable hours incurred as a result of the required action completion time extension.

Other Assumptions that Could Impact this ProposedSubmittal

9. Various values are assumed for the likelihood that the steam generators underfill or overfill on loss of Auxiliary Feedwater (AFV) flow control.

The CCNPP AFW system uses air-operated flow control values to modulate the feedwater flow. These valves fail open on loss of power and on loss of instrument air. The operator action to properly control AFW flow is modeled in Top Event HX. On failure to control flow, the model estimates the likelihood that the failure will result in an underfill or over feed condition. These values are estimated for the three conditions described below:

1. Flow Control supports and Steam Generator Level indication available.

In this case it is assumed slightly more likely that an overfill condition will exist. As AFW Flow control setpoints are sufficient to remove all decay heat, if the operator does nothing, as decay heat decreases the Steam Generator Levels will increase. Thus, it is expected to have a 20/80 split between underfill and overfill.

RAN 02420 REV. 2 Page 27 of 54 CCNPP CCNPP Page 27 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear PowerPlant RiskAnalysisforProposedDGRequiredAction Completion Time LicenseAmendment

2. Flow Control supports fail and Steam Generator Level indication available.

Given that the Flow Control Valves fail open on loss of power or air it is even more likely that a failure to control level will lead to an overfill condition. (Underfill is fifty percent less likely than when flow control power is available.) The value used (0.10) remains significant due to the potential for improper local control or the potential for operators to trip the AFW pumps if level starts approaching overfill.

3. Flow Control supports fail and no Steam Generator Level indication is available.

Given that the FCVs fail open and operators have no indication of a high level, it is very likely that an overfill condition will result from a failure to control flow. Operators are unlikely to trip the AFW Pumps if S/G level indication is not available. This value is estimated at 0.02 (one fifth of value with S/G indication available).

The availability of the DGs directly impacts the availability of the AFW flow control support systems and Main Control Room indication. Varying these values is included as a sensitivity analysis.

6.1.8 Base PRA Results The base PRA used for this proposed amendment contains both internal and external events for Unit-l and Unit-2. Table 18 shows the results of the Unit-I and Unit-2 CCPRA Revision I model.

Table 18 CCPRA Revision 1 Results iCDF LERF Hazard

_______________ Unit-I ~ Unit-2 -Unit-I; Unit-2 Internal Events 3.34E-5 3.40E-5 1.86E-6 1.89E-6 General Transients 2.64E-5 2.69E-5 1.35E-6 1.37E-6 Flood 1.87E-6 1.93E-6 7.26E-8 7.64E-8 LOCA 4.61 E-6 4.63E-6 4.11 E-7 4.15E-7 SLB 5.34E-7 5.33E-7 2.64E-8 2.64E-8 External Events 3.05E-5 3.26E-5 3.78E-6 4.18E-6 High Winds 5.14E-7 6.24E-7 1.87E-8 2.24E-8 Fire 2.01E-5 1.99E-5 2.03E-6 2.05E-6 Seismic 9.89E-6 1.21E-5 1.73E-6 2.11E-6 Aircraft <1.OE-6* <I.OE-6* NA NA Turbine Missile <.OE-7* <I.OE-7* NA NA Total 6.39E-5 6.66E-5 5.64E-6 6.07E-6

The change in risk due to these hazards was not addressed in this analysis and is not included in the totals.

CCNPP Page 28 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysis forProposedDGRequiredAction Completion Time License Amendment 6.1.9 PRA Sensitivity/Uncertainty Analysis To evaluate the sensitivity of the DG required action completion time to variations of key contributing parameters, a series of 78 sets of sensitivity cases were evaluated. Each set evaluates with the estimated DG unavailabilities pre-extension versus post-extension for the varied parameters.

The results of the sensitivity study indicate that there is a high degree of confidence that the DG required action completion time extension, coupled with the OC DG modification, results in a net risk reduction.

The OC DG modification causes an annual reduction in the Unit I CDF of 1.90E-06 and an annual reduction in the Unit 2 CDF of 2.9E-06.

The Unit 1 sensitivity cases results appear in Figure 1.0. The Unit 2 sensitivity results appear in Figure 2.0.

None of the cases evaluated show a net risk increase.

The sensitivity evaluation is based on varying these key parameters:

The frequency of a hurricane (Base, Half, Double)

The frequency of a loss of off-site power (Base, Half, Double)

Whether the RCP motor failure causes a RCP trip without operator action (Yes, No)

The failure likelihood of the RCP seals (Base, Half, Double)

The failure likelihood of the operators controlling AFW Flow (Base, Half, Double)

The failure likelihood of the operators to recover from a SG overfill (Base, Half, Double)

The failure likelihood of the operators to align the opposite Unit AFW pump (e.g. AFW Pump 23 aligned to Unit 1) (Base, Half, Double)

The failure likelihood of the operators to align the 120 VAC inverters to the back-up bus (Base, Half, Double)

These parameters are considered key based on cutset examination. These parameters dominate the cutsets that contain DGs OOS. The six RCP seal cases (the two RCP motor trip cases times the three RCP seal failure likelihood cases) are used as the base framework of the sensitivity study. Each of the remaining 6 parameters are varied individually (2 cases each [half and double]). This results in a total of 78 (78=2*3+6*2*6) cases for each Unit. Each of these cases is evaluated with the estimated DG unavailabilities pre-extension versus post-extension. This results in 78 sets of delta core damages for each Unit.

Of the parameters evaluated, AFW Flow control is the most important. When the human action failure rate is doubled the delta CDF increases by about 70% for both Unit 1and Unit 2. This is by far the most important parameter. AFW flow control during normal loss of decay heat removal scenarios is extremely reliable. Loss of indication or loss of remote flow control capability complicates AFW flow control. Some of the most significant contributors to AFW flow control losses given a DG is unavailable are extemal events.

For example, during an extremely large earthquake, the Fairbanks Morse DGs may fail due to loss of service water. Without the IA DG and OC DG, the 125 VDC battery will eventually deplete. Without 125 VDC power, operations would soon be trying to control the turbine driven AFW pumps locally with local indication only. Other extemal events cause similar problems. High wind scenarios can cause the failure of the OC DG since it is not designed to withstand severe winds. Two other DGs failures on the same facility can cause a spurious safety system actuation. This complicates AFW flow control through a loss of compressed air. Within internal events, the dominant scenarios are a spurious ESFAS actuation and losses of the 500kV busses.

For Unit 2, the operator action to mitigate steam generator overfill is quite significant. When this human action doubles, the delta CDF increases by about 40%. The importance of this human action is driven by losses of flow control. If flow control is lost the steam generators can be underfed (i.e. direct core damage),

RAN 02-020 REV. 2 Page 29 of 54 CCNPP CCNPP Page 29 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for ProposedDG Required Action Completion Time License Amendment or overfed. An overfeed fails the operating turbine driven AFW pump, and requires operations to clear the lines of water and start the stand-by AFW pump. The Fairbanks Morse DGs are more dependent than the SACM DGs (e.g. SRW, electrical bus work, etc.). As Unit 2 has no dedicated SACM DGs, the key AFW related control systems like electrical power and air are more vulnerable on Unit 2. The AFW flow control valves fail open on loss of air or electrical support. It is more likely that an overfill will occur on a loss of air or electrical support. This causes a higher fraction of AFW flow control losses to be overfills on Unit 2.

This in turn increases the importance of this action to Unit 2.

The remaining parameters cause a 10% to 20% increase in the delta CDF for a doubling of the parameter in question.

Based on the results of the sensitivity study, there is a high degree of confidence that the DG required action completion time extension coupled with the OC DG being more seismically rugged results in a risk reduction.

Unit One Sensitivity Study Results Figure 1 4.5E-07 4.OE-07 3.5E-07 3.OE-07 U-2.5E-07 . ..

- 2.OE-07 1.5E-07 5.OE-07 O.OE;ON-0 M8 0% 20% 40% 60% 80% 100%

CCNPP Page 30 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPowerPlant Risk Analysisfor ProposedDGRequiredAction Completion Time License Amendment Unit Two Sensitivity Study Results Figure 2 4.5E-09 4.OE 3.5E-09 3.OE-09 U-c 2.5E-09 Z 2.OE 1.5E-09 1.OE-09 5.OE-1 0 O.OE+00 0% 20% 40% 60% 80% 100%

Using the Post-CT unavailability data (from Table 5) causes a much smaller CDF increase on Unit 2 than the Unit 1. This is largely due to the IA DG. For Unit , the at-power IA DG unavailability increases from 89 hrs to 149 hrs (per Table 5). For Unit 2, the at-power DG unavailability decreases from 180 hrs to 149 hrs (per Table 5). The 1A DG is the most important site DG. This is especially true for external events scenarios that can disable all SRW and cause off-site power to be lost. The lost of SRW fails the FM DGs.

The reduction in at-power IA DG unavailability from the Unit 2 perspective negates much of the risk increase associated with increasing the at-power FM DG unavailability.

6.1.10 Compensatory Mleasures for Reducing Risk When a DGs are removed from service, the other in-service DGs and 4kV will be flagged off to prevent inadvertent degradation.

6.1.11 Quality of CCNPP PRA CCNPP utility personnel have constructed the CCPRA with a strong commitment toward developing a complete and accurate PRA. This commitment can be seen through the following elements:

Formal qualification program for the PRA staff

Use of procedures to control PRA processes

Independent reviews (checks) of PRA documents

Comprehensive PRA Configuration Control Program

- Plant change monitoring program

- Process to control PRA quantification software

- Active open items list

- Interface with the site corrective action program

- Process to maintain configuration of previous risk-informed decisions CCNPP Page 31 of 54 RAN 02420 REV. 2

- Calvert Cliffs NuclearPowerPlant .

RiskAnalysisforProposedDGRequiredActionCompletion TimeLicenseAmendment

Peer reviews

Participation in the CEOG cross comparison process

Incorporation, where applicable, of CEOG PRA Technical Positions

Commitment of continuous quality improvement The CCPRA Revision 0 was peer reviewed in November 2001. The CCPRA Revision I Model contains several refinements, but uses techniques and practices similar to the peer reviewed revision.

Considering the scope (internal and external events), level of detail, processes, and excellent peer review results, the CCPRA is sufficient to support a technically defensible and realistic evaluation of the risk associated with this amendment request.

The following sub-sections provide a summary of the CCPRA Revision 0 peer review, the changes made between Revision I (used for this amendment) and Revision 0, and a brief history of the CCPRA since the IPE submittal.

6.1.11.1 CCPRA Revision 0 Peer Review The CCPRA Revision 0 internal events model has been reviewed as part of the Combustion Engineering Owners Group (CEOG) Peer Review Process in November 2001. The peer review team consisted of five full-time members. Four members were utility personnel and the remaining member was the team leader/facilitator from Westinghouse. Two of the reviewers had participated in previous CEOG peer reviews. The reviewers had a combined PRA experience of approximately seventy-five years. It should also be noted that CCNPP PRA personnel have participated in every CEOG sponsored peer review and through this process have gained considerable insight and experience as to the technical requirements for developing an effective PRA.

Note that the risk assessment for this proposed amendment is based on CCPRA Revision 1. The changes between the Revision 0 and Revision I are discussed below.

The peer review addressed eleven technical elements. The team uses a checklist for each technical element as a framework to evaluate the scope, comprehensiveness, completeness and fidelity of the PRA being reviewed. Each item on the checklist is evaluated with a grade:

Exceeds Meets Marginal Inadequate Items evaluated other than meets are documented with Facts and Observations (F&Os). Each F&O is provided with a level of significance (A: Extremely Important, B: Important, C: Desirable, D: Minor, 0:

Observation, S: Superior).

At our request, the team also evaluated the CCPRA against the draft ASME PRA Standard, Revision 14A.

This was accomplished by using the ASME Standard supporting requirements as sub-tier criteria. The team was provided with a self-assessment of the CCPRA to the draft ASME PRA requirements. The team used this self-assessment to aid in gauging the technical adequacy of the CCPRA.

All eleven technical elements were found to "Meet" requirements.

RAN 02-020 REV. 2 Page 32 of 54 CCNPP Page 32 of 54 RAN02-020 REV. 2

Calvert Cliffs Nuclear Powver Plant Risk Analysis for Proposed DG RequiredAction Completion Time LicenseAmendment The review team found several strengths. Below is an excerpt from the peer review report.

"The reviewfound several strengths. The Calvert Cliffs PRA staff is knowledgeable and is committed to improving the Calvert Cliffs PRA. Calvert Cliff's management is also committed to improving the quality of the PRA, as witnessed by the resourcesdedicated to the maintenanceand applicationoftthe PRA. Throughout thepeer review, the Calvert Cliffs PRA staff was cooperative andhelpful. The documentation supportingthe PRA is the most extensive and thorough of allPRAs reviewed to date andwas readily availableto the review team, which greatlyfacilitatedthe review.

Priorto the arrivalof the peer review team, the Calvert Cliffs PRA staffperformeda self-assessment against the NEI criteriausing the peer review checklists anda self-assessment against the requirementspresented in draft 14A of the ASME PRA standard. The results of these self-assessments were documented with an annotated checklist that cross-correlatedboth sets of requirements. This self-assessment appears to have been thorough and objective.

The Calvert cliffs peer review also included a review oftthe Calvert Cliffs PRA againstthe ASME High Level Requirements (HLRs) for 9 of 10 key PRA areas. InternalFlooding is consideredas not being assessed sincefive of the seven InternalFloodingHLRs were not reviewed in sufficient depth to evaluate the compliance. Although the LERF element was reviewed, the documentation HLRfor LERF was not assesseddue to a delay in locatingthe MAAP analyses.

Overall, the CalvertCliffs PRA met with the requirementsof 45 of46 assessedASME PRA StandardHLRs for a Category IIPRA. (Note: Compliance with an HLR does not imply 100%

compliance with all Supporting Requirements (SRs) for that HLR) One HLR was not met due to the lack of uncertaintyanalyses.

Thus, it is concluded that the Calvert Cliffs PRA is sufficient to support CategoryII risk-informed applicationswith supportfrom deterministic analyses to addressany individual weaknesses that may impact the specific analyses."

A total of forty-three F&Os were identified. No "A" level significant issues were identified. The issues that were identified are focused on localized areas of the PRA.

An estimated core damage frequency reduction of five to ten percent is expected as a result of incorporating the significant issues identified by this review. These issues are discussed below.

Of the 213 sub-elements reviewed, eighty-seven percent were evaluated as meeting or exceeding the requirements.

Three sub-elements were graded as "Inadequate." All three are associated with the lack of an uncertainty analysis. The need to perform this analysis has been previously identified. The uncertainty analysis for this proposed required action completion time extension is addressed by a series of sensitivity analyses.

A grade of "Exceeds" was assigned to four sub-elements.

IE-16 Traceable initiating event documentation DA-15 Documentation of failure probabilities that do not fit into the basic event database ST-4 Reactor pressure vessel failure modeled appropriately L2-14 Containment capability is analyzed under severe accident conditions RAN 02.020 REV. 2 Page 33 of 54 CCNPP Page 33 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPowerPlant Risk Analjysis forProposedDGRequiredAction Completion Time LicenseAmendment The below table summarizes the results:

Table 19 Peer Review Sub-element Grades Grade - umbrof Sub-elements Percnt a Exceeds 4 2%

Meets 181 85%

Marginal 25 12%

Inadequate 3 1%

A total of forty-three Facts and Observations (F&Os) were written.

Table 20 Facts and Observations Types Type . Description . Number A Extremely Important 0 B Important 11 C Desirable 18 D Minor 1 0 Observation 13 S Superior Total 43 6.1.11.2 Peer Review "B" Level Facts & Observations A summary of the eleven "B" level F&Os is provided below:

IE-01 The CCPRA uses a SGTR initiating event frequency based on NUREG/CR-5750 which covers industry experience up to 1995. A CE Owners Group (CEOG) document issued in June 2000 has a new SGTR frequency that is about twenty percent lower.

CCNPP Response: The newer data will be incorporated in a future PRA update. It is expected that this will result in less than a one percent reduction in calculated internal event CDF. This has CCNPP Page 34 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk A nalysisfor Proposed DG RequiredAction Completion Time License Amendment been added as an open item (CRMP 428) in the CCPRA PRA configuration control program.

Consistent with our configuration control process (EN-1 -330) no Issue Report has been initiated since this is an update to more recent data with a minimal change in calculated CDF.

Required Action Completion Time Extension Impact: The DGs play only a small role in the mitigation of a SGTR. Incorporation of this F&O will not negatively impact this submittal.

IE-02 The CCPRA does not explicitly model the spurious RCP seal failure and spurious primary safety relief valve opening as initiating events.

CCNPP Response: This is a non-conservative error. A new open item (CRMP 420) has been added to the CCPRA configuration control program to address this issue. A preliminary review of the industry data associated with these initiators shows no events that would be applicable to CCNPP. It therefore appears that the addition of these initiating events will have minimal to no impact. IR3-070-503 has been initiated to capture this issue.

Required Action Completion Time Extension Impact: The inclusion of the above events is expected to result in no impact on this submittal.

IE-05 The CCPRA uses a draft reference for the bases of its interfacing LOCA initiating events. A CCPRA open item (CRMP 199) had been previously issued in June 2000 to require an update of this analysis. The frequencies used for these initiators are consistent with typical industry values so this should not have a significant impact.

CCNPP Response: As stated by the reviewers, this issue is not expected to cause any significant impact. The completion of the documentation for the interfacing LOCA has been prioritized after the other more significant issues. The issue had been previously captured in our configuration control program as open item (CRMP 199). It is currently planned for completion by the end of 2003. Consistent with our configuration control process (EN-1-330), no Issue Report has been initiated since this issue is associated with ongoing documentation of the PRA and has minimal risk impact.

Required Action Completion Time Extension Impact: The interfacing LOCA initiating events are sent directly to core damage. The issue has no impact on the risk analysis used to evaluate the change in the DG availability.

IE-07 The failure mode associated with the spurious actuation of the over-current or 86-lockout device is not considered as a potential initiating event. This failure is also not considered in the accident mitigation portion of the model.

CCNPP Response: This is a non-conservative error. This issue is a potential addition to our initiating events and/or an increase in the initiating event frequency associated with the failure of the safety-related 4kV busses. A new open item (CRMP 419) has been added to the CCPRA configuration control program to address this issue. The addition of this issue is expected to result in a one to four percent increase in the calculated CDF. IR3-070-504 has been initiated to capture this issue.

Required Action Completion Time Extension Impact: The spurious actuation of the lock-out relay or over-current protection causes the failure of the 4kV bus in question regardless of the status of the DG dedicated to the bus. For this to impact the importance of the DGs, off-site power feeds to the other SR busses must be lost concurrent with this event. As there is no common mode failure, the likelihood of this set of circumstances is so small that there is essentially no impact on the required action completion time extension risk analysis.

CCNPP Page 35 of 4 RAN 02.020 REV. 2

Calvert Cliffs Nuclear Power Plant RiskAnalysisforProposed DG RequiredAction Completion Time LicenseAmendment AS-01 The CCPRA models single and multi-tube SGTRs. For multi-tube SGTRs, no recovery is currently credited. Crediting recovery could reduce the calculated CDF by fifteen percent.

CCNPP Response: This is the most significant finding of this peer review. The CCPRA models both single tube and multi-tube SGTRs. For multi-tube ruptures, we have taken a conservative approach pending time to more thoroughly address this issue. The issue was captured as an open item (CRMP 285 and 336). However, the perspective of the reviewers helped clarify the appropriate approach for modeling this issue. The improved modeling was incorporated into the CCPRA Revision I model.

Required Action Completion Time Extension Impact: The risk analysis for this required action completion time extension includes the resolution of this issue.

AS-04 This finding recommends the incorporation of the new RCP seal LOCA model. This model is currently under review by the NRC. Implementation guidance is also under development by the CEOG.

CCNPP Response: We have been working to incorporate the new RCP Seal LOCA model. An open item (CRMP 138) in the CCPRA configuration program had already captured this issue. The new RCP Seal model will be included into a future PRA update. Consistent with our configuration control process (EN-1-330) no IR has been initiated since this is an update to more recent model. In addition, the new CEOG RCP model is not fully developed.

Required Action Completion Time Extension Impact: A sensitivity analysis is included to understand how this issue impacts the DG required action completion time extension.

SY-02 The failure of the time delay relay associated with the steam admission valves to the TD AFW pump turbines is not included in the CCPRA. The relay failure could result in the overspeed failure of the TD AFW pump.

CCNPP Response: This is a non-conservative fault-tree error. Its incorporation is expected to result in a small increase in the auto-start turbine-driven AFW pump failure likelihood. This increase will result in a very small increase, approximately a 0.25 percent change, in the calculated CDF. Issue Report IR3-070-507 has been initiated to capture this issue.

Required Action Completion Time Extension Impact: The small impact of this error is not expected to change the conclusion of this required action completion time extension submittal.

SY-08 On loss of component cooling, the CCPRA credits the possibility of failure of the RCP motor before RCP seal failure in order to prevent a seal failure. If the motor is stopped by failure, the likelihood of seal failure is significantly reduced.

CCNPP Response: The appropriateness of crediting the failure of the RCP motor was previously identified as an open item (CRMP 138). Crediting the failure of the RCP motor was instituted after talking with a PRA practitioner from another plant many years ago. This position was also supported by a system engineer (this has been bases captured). However, it appears that this practice is now an outlier. This will be re-assessed when the new RCP model is implemented during the next update. Due to EOP improvements, elimination of the credit for the failure of the RCP motor is believed to have a minimal impact on the calculated CDF.

Required Action Completion Time Extension Impact: A sensitivity analysis is included to understand how this issue impacts the DG required action completion time extension.

RAN 02.020 REV. 2 Page 36 of 54 CCNPP Page 36 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment DA-01 NUREG/CR-5497 provides the latest industry data source for common cause failure events. The CCPRA has adopted this data for a very limited scope of components (MSSVs and the PORVs).

CCNPP Response: The use of NUREG/CR-5497 data will be increased in future updates of the PRA.

This is captured by a new open item (CRMP 426). Consistent with our configuration control process (EN-1-330) no Issue Report has been initiated since this is an update to more recent data.

Required Action Completion Time Extension Impact:

The following common cause factors from NUREG/CR-5497 have been incorporated into the CCPRA:

DGs - Fail to Start, Fail to Run

PORVs - Fail to Open, Fail to Close, and Fail to Remain Close

Main Steam Safety Valves - Fail to Open, Fail to Close

Low and High Pressure Safety Injection MOVs - Fail to Open A complete comparison of the remaining common cause factors was performed. The following significant deltas were found:

1. Battery Failure Rates The CCNPP Beta Factors were more conservative than the NUREG. However, the Gamma and Delta Factors were non-conservative compared with the NUREG.

2. 4kV Breakers CCPRA Common Cause Factors for "Fail-to-Close" are non-conservative when compared with the NUREG.

3. Reactor Trip Breakers CCPRA Common Cause Factors for fail-to-open are non-conservative when compared with the NUREG.

4. Emergency Service Water Pumps (Service Water, Component Cooling Water, Saltwater)

CCPRA "Fail-to-Run" Beta factors are significantly more conservative than the NUREG.

5. AFW and HPSI Check Valves CCPRA Beta Factors for fail-to-open are less conservative than the NUREG.

6. PORV Block Valves CCPRA has much more conservative values for the PORV Block valves than the NUREG.

The cases where the CCPRA was non-conservative were checked for impact on the DG Required Action Completion Time Extension. It was found that the Battery, Reactor Trip Breakers, and Check Valves noted do not significantly impact the DG Required Action Completion Time Extension risk. The 4kV Breaker fail-to-close mode has the potential for an impact. A sensitivity study was performed that found this impact to be small.

CCNPP Page 37 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant, Risk Analysis for Proposed DG Required Action Completion Tine License Amendment HR-01 The CCPRA quantified the pre-initiator human actions using a failure rate based on NUREG/CR-1278. The values were treated as mean values. However, the values in NUREG/CR-1278 are median values.

CCNPP Response: This is a non-conservative error. Its impact is very small. Issue Report IR3-070-508 was initiated to capture this issue.

Required Action Completion Time Extension Impact: The impact of this issue is very small and does not change the conclusions of the required action completion time extension submittal.

HR-03 There are several human actions that use Unit-2 to help mitigate Unit-I. No example of an analysis could be found that considered the impact of the operating status (operation, outage, and startup) on the human actions.

CCNPP Response: A review of impact of the opposite unit operating status on the human actions has not been performed. This is captured by a new open item (CRMP 429). Issue Report IR3-070-509 has been initiated to capture this issue.

Required Action Completion Time Extension Impact: A review of all the human actions was performed for this submittal to determine if changes are necessary to address this issue. No changes were identified.

6.1.11.3 Changes Between the IPE/IPEEE and Revision 0 (Peer Reviewed)

Many changes have been made to the CCPRA since the IPE and IPEEE submittals. The CCPRA Revision 0 model was peer reviewed in November 2001. The Revision 0 model was approximately the fourth update of the Calvert Cliffs PRA since the IPE Summary Report and is the first model to be controlled by a formal configuration control program. See the below table for a summary of the CCPRA development history.

RAN 02420 REV. 2 Page 38 of 54 CCNPP CCNPP Page 38 of 54 RAN02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for ProposedDG RequiredAction Completion Time LicenseAmendment Table 21 CCPRA Development History Model Unit-l e cripti : Unit-2 Description Da te "

Revision 1 Internal and External Events Internal and External Events - 10/2002 development based on over 200 identified changes between Unit-I and

2. Unit-2 cable routed generally assumed to be the same as Unit-I for fire impact.

Revision 0 Internal and External Events Unique aspects of External Events on 5/2002 Unit-2 were deferred to Revision 1.

Revision 0 Internal Events - This updated model Internal Events only - development 10/2001 was used for the implementation of based on modeling major changes the revised Maintenance Rule (a)4 between the Units.

requirements. This is the first model to be controlled by a formal configuration control program.

Revision A Interim Update Not Assessed. 3/99 IPEEE + First Internal and Extemal Models Differences were assessed and 2/98 Update 2 qualitatively addressed.

IPEEE Fire, Seismic and High Wind PRA Differences were assessed and 8/97 qualitatively addressed.

Update 2 Updated internal events model for Not Assessed. 8/97 IPEEE Update 1 First Update Not Assessed. 5/94 IPE Internal Events and Level 2 Differences were assessed and 12/93 qualitatively addressed.

6.1.11.4 Changes Between Revision 0 (Internal Events Peer Reviewed) and Revision I There are a number of changes between the Revision 0 model and the Revision I model. The majority of the substantive internal events changes are directly a result of the internal events peer review. The internal Revision 0 CDF is 4.0E-5. The internal events Revision I CDF is 3.4E-5. The change in the modeling of a multiple tube steam generator tube rupture accounts for the majority of this decrease. (In Revision 0 the multiple-tube steam generator tube rupture has a contribution of approximately 5.0E-6). The remaining internal events changes are focused on the modeling of the DGs. These changes focused on ensuring the accuracy of the DG modeling. Improvements included using the most recent common cause factors, the most recent failure data, and fully crediting the OC DG. These changes caused both increases and decreases in the risk of removing a DG from service. Here are some of the more substantial changes between the Revision 0 and the Revision 1 model:

CCNPP Page 39 of 54 RAN02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for ProposedDG RequiredAction Completion Time License Amendment Improved Human Action Methodolog The current CCPRA human action methodology was refined to address several identified issues. The base methodology remains the same. These issues included:

I Better Treatmentof Peer Checking The Revision 0 model did not explicitly address peer checking. The new methodology adds additional performance shaping factors to account for the benefit of effective peer checking. This is especially important for actions that have a large amount of implementation time and have many opportunities to recover.

v' Better Treatment ofDegradationdue to entry into the FunctionalRecovery EOP andforfire conditions The Revision 0 model used a fixed degradation value for entry into the more complicated functional recovery EOP. Revision 0 also used a set of standard degradations for fire related actions. The new approach explicitly determines the degradation through operator interviews.

Each performance-shaping factor is interviewed for the base value and for various degradation values. This approach more appropriately determines the degree of degradation and ensures that the various degradation values are consistent.

V ClarifiedPerformanceShaping Factors The performance shaping questions were clarified to ensure more consistent understanding and results. An operation crew as opposed to individual focus is now emphasized.

The above changes were applied to about a dozen base human actions with associated Auxiliary Feedwater Control, OC DG alignment, OC DG fuel oil make-up, and long-term inventory control in the CCPRA Revision I model. This represents about ten percent of the actions included in the CCPRA.

Other actions will be updated to the newer methodology in future updates.

Added Undervoltage (UV) Actuation Top Events The undervoltage function was previously included in the DG top events to account for the impact of the failure to load shed. However, when the OC DG is aligned to a 4kV ESF bus, the UV signal for that bus is manually actuated in order to shed and reload the bus. Therefore, the load-shed function not only impacts the dedicated DG, but also the success likelihood of the OC DG. Making the UV function into separate functions (Top Events UA, UB, UC, and UD) allows the model to better account for this dependency.

Increased Credit for OC DG The CCPRA Revision 0 model used OC DG for providing power to the battery chargers and powering the motor-driven AFW pumps. The OC DG must be aligned within forty-five minutes to support AFW (Top Event GK) and within two hours to support the battery chargers (considered within Top Event GJ in Revision 0).

The CCPRA Revision 1model adds a twenty-minute (Top Event GS) and forty-five minute recovery (Top Event GK) to support once-through-core-cooling and Auxiliary Feedwater respectively.

CCPRA Revision I also credits late OC DG alignment for late failures of the Service Water-cooled Fairbanks Morse DGs. This change enables the OC DG to support the motor-driven AFW pump and battery chargers when the FM DGs fail due to Service Water failures.

CCNPP Page 40 of 54 RAN 02.020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment CCPRA Revision I also includes an improved analysis of the OC DG fuel oil day tank (FODT) which has an eight-hour capacity. This facilitated lowering the OC DG failure rate as the makeup component failure probabilities could be removed for LOOP events that are eight hours or less.

No credit was included in the CCPRA Revision 0 model for using the OC DG to recover 4kV Bus 11 on the spurious ESFAS actuation as an initiating event (Initiating Event IESF). Initiating Event IESF is modeled as causing a spurious and temporary actuation of ESFAS Channel A. One of the impacts of this actuation is to load shed 4kV Bus 11. In Revision 0, DG IA was the only DG credited. In Revision 1, both DG IA and DG OC are credited for recovery of 4kV Bus 11 following IESF.

Improved Diesel Generator Modeling The CCPRA Revision I model has DG maintenance alignments addressed by separate top events (Top Events G1, G2, G3, G4 and G5). Previously, the maintenance alignments were included within the diesel generator top events. This old approach made it difficult to account for the mutual exclusivity of the maintenance and the operational practice of pre-aligning the OC DG during DG maintenance. This change is based on the assumption that no more than one DG will be OOS at the same time for diesel maintenance or due to Salt Water Header unavailability (except for A DG, which does not require SW cooling supports). See Assumptions Section for a discussion on this issue.

The CCPRA Revision I also added a common cause linkage (Top Event GC) between the SACM and Fairbanks Morse diesel generators. Since these diesel generators are quite diverse, this new common cause relationship represents a weak link between these diverse diesels. Included in the common cause considerations are the 4kV feeder breakers and the relays associated with the ESFAS undervoltage actuation signals. See the Assumption Section for the approach to modeling the failure of load-shed relays. Although very unlikely, this change explicitly accounts for common cause across the highly diverse SACM and Fairbanks Morse diesel generators.

Incorporated PORV Logic Modification This modification prevents the failure of two 120VAC vital busses from causing a spurious opening of the PORVs and removes the 125VDC dependency to open the PORV for once-through-core-cooling (OTCC). The modification also added a key-locked switch to the control panel to enable the initiating of OTCC. Top Event PO was added as a plant-condition flag to represent the installation status of this modification. The modification is installed in Unit-I (2002 Refueling Outage) and Unit-2 (2003 Refueling Outage). A second PORV top event (Top Event PP) was also added to better address the status of whether both PORVs are open to support pressure relief or decay heat removal.

Improved Multiple SGTR Modeline Improved multiple SGTR modeling per the recommendation of the Peer Review team. As long as the steam generators are isolable (Top Event SQ), multiple tube ruptures (Top Event WS) are considered recoverable. This improvement addresses the peer review F&O "AS-O1." See Section 6.1.11.2 Peer Review "B" Level Fact and Observations for a discussion and resolution of this issue.

Improved Containment Modeling Restructured top events and initiating events such that containment breaches greater than two inches are considered "large." This change impacts penetrations less than two inches (Top Event SH), greater than two inches (Top Event SI), the Hydrogen Purge line (Top Event SG) and the containment sump line (Top Event SR). The definition of LOCA initiating events less than two inches (IVVI) and greater than two inches (IVV2) also changed. These changes make the CCPRA LERF modeling more consistent with industry practice.

CCNPP Page 41 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant.

Risk AnalysisforProposedDGRequiredAction Completion Time LicenseAmendment

Improved AFW Flow Control and Make-up Modeling The CCPRA Revision 0 model addressed all AFW flow control conditions using a half dozen split fractions. The human actions used to represent these conditions addressed both early and late flow control conditions, local and remote control and the status of indication. The approach to modeling the AFW flow control was revised to better address the impact of these various conditions. This approach allowed for the better matching of the interviewed action with the accident scenario. The new human action methodology was used for these actions.

The CCPRA Revision I model also improves the link between steam generator overfill recovery actions and the AFW flow path top event (Top Event Fl). If the operator fails to align AFW Pump 23 to Unit-l (Top Event OB) or to start AFW Pump 13 (Top Event FH) then it is unlikely that he will be able to perform the complicated actions involved with recovering from a steam generator overfill.

Improved Long-Term Condensate Functionalitv The human actions associated with long-term condensate inventory (Top Event F3) were re-interviewed and restructured. The interview process discovered a built-in peer checking process for dual unit trips, like LOOPs, in that both units monitor the shared condensate storage tank. Other insights were also gained during the interview process. This resulted in a general improvement in the modeling of the maintenance of long-term availability.

Improved ESFAS Actuation Modeling ESFAS actuation channel 15V/28V power supply tops (Top Events JI and J2) were added. These power supplies were previously modeled within each ESFAS model top event. The new top events allow the model to effectively account for the potential of a common mode failure of all ESFAS top events.

Improved HPSI Pump Modeling Top Events HD, HE & HJ now represent the Human Action to throttle HPSI flow (for 11, 12 and 13 HPSI pumps). Failure to throttle results in HPSI Pump failure after the start of recirculation. In Revision 0, the failure of these human actions was considered a short-term failure of the HPSI pumps. In Revision 1, this is considered to fail the HPSI pumps only after the start of re-circulation, which occurs later in the accident.

This is primarily a Level 2 impact.

Improved Modeling of the 4kV Bus Alternate Feed Modeline The CCPRA Revision 0 model contains an operator action to align the alternate feeder breakers from the other 13kV bus, if available. The Revision 0 model conservatively failed this action for both units if the Unit-l 4kV transformers failed. Revision I represents these functions using two separate top events, one for Unit-I (Top Event H5) and one for Unit-2 (Top Event H6). As both the Unit I and Unit 2 Plant Models are impacted by the status of its own and the opposite unit 4kV busses, Top Events H5 and H6 are modeled in the Unit I Plant Model and the Unit 2 Plant Model.

Updated High Wind Model On April 28th, 2002 a significant tornado struck Southern Maryland. Weather experts determined that the tornado briefly reached F4 in La Plata, Maryland. The tornado continued across Charles and Calvert Counties passing north of CCNPP. The high wind analysis did not consider the probability of F4 or F5 tornadoes. The High Wind initiating frequencies were updated to reflect the recent tornado experience. In addition, the model structure was changed to reflect the impact associated with a larger footprint tornado.

CCNPP Page 42 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysis forProposedDGRequiredAction Completion Time LicenseAmendment

Updated Fire Model Unit-I Fire Model, Revision I is an update and refinement of the IPEEE Fire Model. Fire Model Revision 1, like the IPEEE, assesses the risk contribution and significance of fire initiated events to the total plant risk. The split fraction values used in the Fire model are based on five Master Frequency Files (MFFs) each adjusted/specific to areas impacted by fire.

Improvements to the Revision I Fire Model include:

Incorporation of the internal events Plant Model Revision I changes.

Incorporation of an improved human action methodology for many important human actions. The new Revision 1 human action methodology is an improvement over Revision 0 in that smoke impacts are directly assessed during the operator interview process.

Improved modeling for AOP-09A, Control Room Evacuation and Safe Shutdown due to a Severe Control Room Fire. A detailed review of the Control Room abandonment procedure was performed that resulted in many structural improvements in the model. The scope of AFW flow actions (Top Event FW) and electrical alignments (Top Event VB) changed as a result. The human actions to trip with a "non-trip" fire (Top Event FU) and aligning DG 1A or offsite power when DG OC is unavailable (Top Event FV) were added to the fire model.

Updated the fire ignition frequency impacts for the Control Room, Cable Spreading Rooms, Switchgear Rooms, Turbine Building, and Yard.

Improved the modeling of turbine building fires. This included the refinement of fire impacts, the consideration of the newly install Condenser Pit Fire Sprinkler System and the consideration of the modified Control Room ventilation system that is now in a permanent re-circulation mode.

6.1.11.5 CCNPP Unit-2 Revision I Model

Background

Construction began on CCNPP, Units 1 and 2 in July 1969. The Nuclear Steam Supply Systems (NSSS) for both units are supplied by Combustion Engineering. The NSSS encompasses the Reactor Vessel, Steam Generators, Reactor Coolant Pumps, Pressurizer and Emergency Core Cooling Systems. Bechtel Corporation designed the balance-of-plant systems and was responsible for overall construction. Unit-I began commercial operation in May 1975 and Unit-2 on April 1977.

The Main Turbine Generator and the Steam Generator Feed Pumps for each unit are supplied by different vendors, General Electric Company for Unit-I and Westinghouse Electric Corporation for Unit-2.

Although these components are different, they have almost exactly the same technical parameters and accomplish the same function.

A key difference between the units occurred with the addition of two new diesel generators. The 1A DG and OC DG, added in the late 1990's, are both air-cooled diesel generators.. The three other site diesels are Service Water (SRW) cooled. DG IA supports a Unit-I bus while DG OC is a station blackout (SBO) diesel that can be aligned to any Unit-I or Unit-2 4kV ESF bus. This configuration resulted in Unit-I having one SRW cooled DG and one air-cooled DG. Unit-2 has two SRW cooled DGs.

PRA Model The CCNPP Unit-2 Revision I model is the first Unit-2 model that quantifies both internal and external events. Note that the difference in the DG configuration, including the addition of the OC DG, occurred after the IPE Submittal.

RAN 02-020 REV. 2 Page 43 of 54 CCNPP CCNPP Page 43 f 4 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor ProposedDG RequiredAction Completion Time LicenseAmendment The Unit-2 model starts with the Unit-I model. Differences between the units were then identified and incorporated as changes to the Unit-I event-tree rules to create the Unit-2 event-tree rules. Over two hundred differences are modeled between the Unit-I and Unit-2 models. A simplified approach was used in the development of the Unit-2 fire model in that cable routing between the units was generally considered the same.

Two significant differences between the units are described below:

Diesel Generator Configuration Although the Unit-i and Unit-2 models contain the functions of all four DGs and the OC DG, the alignment of these diesels from the individual unit perspective is different. Therefore, the Unit-2 model reflects that the dedicated DGs are service-water dependent. The Unit- model has one air-cooled DG (IA DG) and one SRW dependent DG.

Turbine Building Service Water Configuration Both units have an interface between the safety-related SRW headers located in the Auxiliary Building and the non-safety-related SRW sub-system located in the Turbine Building (Turbine Building SRW).

In both units, the Auxiliary Building headers supply cooling to the Turbine Building loads. Two redundant sets of isolation valves are able to isolate the Turbine Building loads from the safety-related SRW headers on a SIAS condition.

In Unit-i, the two SRW Headers remain separate after entering the Turbine Building until just prior to returning to the Auxiliary Building. The instrument air compressors are the critical components cooled by SRW Header I1. SRW Header 12 provides cooling to the steam generator feeder pump and condensate booster pump lube oil coolers. Therefore, the loss of SRW Header 11 will result in the loss of the instrument air compressors.

The Unit-2 SRW Headers combine into a common header immediately after entering the Turbine Building. A loss of a single SRW header does not result in the loss of the instrument air compressors.

6.1.11.6 Other Relevant CCPRA Open Items The CCPRA configuration is procedurally controlled by EN-1-330, Probabilistic Risk Assessment Configuration Control Procedure. Plant changes are monitored for impact on the PRA. Areas for modeling improvement are also captured. Issues requiring action are entered into the CCPRA Configuration Risk Management Program (CRMP) database as a CRMP Issue. Issues are prioritized as to their potential impact on the calculated risk as follows:

A Potential changes of five percent or more to CDF or LERF B Potential changes of one percent or more to CDF or LERF C Potential changes that enhance or have limited sequence impact D Documentation issues CCNPP Page 44 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor Proposed DG Required Action Completion Time License Amendment The open CRMP Issues were reviewed to identify those that could have a potential impact on the proposed change to the diesel required action completion time extension. These issues are discussed below.

"A " CRMP Issues CRMP 138 Re-evaluate the treatment of RCP Seal LOCA - Incorporate new CEOG Seal LOCA Model when developed.

Required Action Completion Time Extension Impact: As noted in the discussion on F&O AS-04 from the Peer Review, a sensitivity analysis is included to understand how this issue impacts the DG required action completion time extension.

CRMP 139 Develop an improved methodology for fire human actions.

This issue addresses the concern that the increases in human action failure rates are not consistent or intuitive as they could be. Generally the easier actions with low failure rates are being increased more dramatically than harder actions with high failure rates.

Required Action Completion Time Extension Impact: A new human action methodology was developed to address this concern. The key diesel alignment split fractions were quantified with this new methodology. All AFW flow control human actions, which are very significant in core damage sequences, are also quantified with this improved methodology.

CRMP 210 Add an unavailability alignment for an ESFAS Cabinet being de-energized.

If an ESFAS Sensor Cabinet is de-energized all ESFAS Channels go to a I of 3 condition.

Any spurious actuation in any one of the remaining three channels will cause a spurious ESFAS actuation. Failure of any power supports for the remaining channels will cause all ESFAS functions to spuriously actuate, including UV actuation.

Required Action Completion Time Extension Impact: The ESFAS channels are powered from 120VAC Panels which are in-turn powered by 125 VDC Busses. The interface between this issue and the DGs is that during a LOOP the DGs provide long-term power to the 125 VDC busses. For a spurious ESFAS actuation to occur power would need to be lost to one of the remaining sensors. This would take the failure of 3 DGs. For example, the IA DG, the 2A DG, and the OC DG being lost would cause the 'A' facility sensors to trip once the 125VDC batteries deplete. For this issue to cause a problem, these events must occur:

off-site power must be lost to the same facility on both Unit I and Unit 2 for a duration longer than the battery life on the remaining ESFAS sensors,

three DGs must fail or be out-of-service,

a ESFAS channel must be OOS, and

the ESFAS channel is not restored prior to battery depletion.

Given the likelihood of these events and the rarity of an ESFAS sensor channel OOS, this issue is not considered to affect the DG required action completion time conclusions.

"B" CRMP Issues CRMP 14 Implement improvements in the CCPRA human action methodology.

The following issues were identified associated with CCPRA human action methodology:

1. There is a large difference between operator estimate and calculated human action values.

CCNPP Page 45 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant RiskAnalysisforProposedDG RequiredAction Completion TimeLicenseAmendment

2. The methodology does not clearly identify the entire Control Room team as being considered for each action.

Required Action Completion Time Extension Impact: As noted for CRMP 139 above, actions associated with aligning DG OC to a safety related bus have been re-interviewed as well as those associated with controlling AFW flow.

CRMP 17 Re-assess the value for PORV failure to CLOSE to ensure testing limitation are accounted for in the failure rate.

This issue addresses the concern that the tests used as plant experience in the Bayesian Update may not adequately test the actual function of the PORV.

Required Action Completion Time Extension Impact: A sensitivity study was performed that tripled PORV fail-to-close failure rate. The result did not significantly change the CDF impact of the proposed DG required action completion time changes.

CRMP 18 Re-assess the value for PORV failure to OPEN due to concern on the Bayesian update on the generic failure rate.

Required Action Completion Time Extension Impact: The PORV fail-to-open top events are also not significant contributors with regards to the CDF impact of the DG required action completion time changes.

CRMP 78 Update the Level 2 analysis.

There is potential for improvements in the existing Level 2 analysis as this is still based on the IPE analysis.

Required Action Completion Time Extension Impact: Revisions to the Level 2 analysis are not expected to significantly change the fraction of LERF sequences when compared to CDF sequences. Most improvements will likely result in the refinement of some of the bounding analysis that is currently used. Some improvements have been made to the Revision I CCPRA model to improve the LERF binning.

CRMP 126 Based on new SWGR Heat-up Calculation consider Temperature Acceleration on the SWGR Room Components Required Action Completion Time Extension Impact: SWGR HVAC is required when both 4kV busses (one SR and one NSR) are energized in the same room. During a LOOP, the NSR busses de-energize and SWGR ventilation is not required. As a result, the temperature acceleration caused by a loss of SWGR ventilation is not very important to the DG required action completion time extension calculations.

CRMP 182 EOP Revisions need to be incorporated into Plant Model Required Action Completion Time Extension Impact: All human actions relevant to OC DG have been re-interviewed as well as all AFW Flow Control actions.

CRMP 279 Improve the modeling of the failure of SRW during a LOOP to allow a late SSSA due to the loss of SRW induced DG Failure.

The potential for Service Water or Saltwater failures to cause a Spurious Safety System Actuation, by failing the Fairbanks Morse DGs, is not considered in the plant model.

RAN 02-020 REV. 2 Page 46 of 54 CCNPP Page 46 f 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment Required Action Completion Time Extension Impact A sensitivity was performed to determine the impact on the DG required action completion time revision. Saltwater and Service Water failure rates were added to the DGs and there was no significant change to the overall risk due to the expected DG unavailabilities.

CRMP 286 Investigate improving the HPSI injection header MOV throttling success criteria.

Currently it is assumed that failing to throttle the HPSI Loop MOVs will cause failure of the pumps on RAS actuation. This may be overly conservative.

Required Action Completion Time Extension Impact: A review of sequences shows that assuming that the HPSI Pumps would not fail, if the LOOP MOVs were not throttled on RAS, would not be a significant change in the calculated impacts of this required action completion time extension. Unavailability of the DGs is not significant in HPSI failure sequences.

CRMP 342 Steam Generator Blowdown is not accounted for in the timing bases for operator actions used to recover decay-heat removal system failures.

The timing of loss of feedwater recovery actions may be impacted by this change.

Required Action Completion Time Extension Impact: The timing of DG OC alignment actions could be impacted here. Top event GK models the alignment of 0C DG in time to recover a loss of all feedwater with AFW within 45 minutes. To model the impact of less time to align DG 0C, all GK split fractions were doubled. This did not significantly impact the risk due to the expected changed in DG unavailability.

CRMP 438 Evaluate the need for increasing the LOCA Sump Failure Likelihood due to insulation induced blockage.

Required Action Completion Time Extension Impact: Injection sequences with a DG unavailable are not significant. Increasing the Sump blockage probability is not expected to cause a significant increase in risks associated with the DG required action completion time.

CRMP 530 Formalize the Basis for the Fraction of AFW Underfill given a Loss of AFW Flow Control Required Action Completion Time Extension Impact: The probability that operations will underfill the Steam Generators, given flow control is failed and all supports are available, is 20%. Doubling all UQ values will only cause an increase in the overall risk impact of the DG required action completion time extension by 2E-08 per year.

6.1.11.7 PRA Software Control The primary event-tree quantification computer program, RISKMAN Version 2.0 for Windows, used to support the CCPRA is classified as safety-related. RISKMAN Version 5.0 for Windows, also classified as safety-related, was used for some fault-tree re-quantification.

Other post-processing software programs are classified as safety-related. Two in-house programs are used:

the Minimizer and the QSS Evaluator.

RAN 02-020 REV. 2 Page 47 of 54 CCNPP Page 47 of 54 RAN 02-020 REV. 2

Calvert Cliffs NuclearPower Plant Risk Analysis for ProposedDG RequiredAction Completion Time License Amendment Minimizer Version Z The MINIMIZER removes guaranteed failed top events and the success top events from the sequences and Boolean reduces the number of sequences. This minimization has the advantage of reducing the total number of sequences, reducing their complexity and improving the amount of risk contribution captured for a given truncation level. The results resemble cutsets in that each accident sequence contains only the initiating event and the split fractions that independently failed. The output of the Minimizer is a set of core damage cutsets and a set of LERF cutsets. These files are the input to the QSS Evaluator.

The MINIMIZER also automates many of the steps used in determining the proper truncation limit.

This software is classified safety-related. Formal verification and validation of the changes made to enable this analysis, the ability to handle multiple models (internal events, fire, siesmic, etc.) was in progress at the time of this submittal.

QSS Evaluator Version P The QSS Evaluator is a software tool that quantifies the CCPRA model using a set of minimized sequences. Its primary function is for the calculation of Maintenance Rule (a)4 risk assessment. The QSS Evaluator was used for the risk assessment of this proposed amendment to determine the change in the risk metrics resulting from implementation of the proposed DG required action completion time extension and for the included sesnitivity studies.

This software is classified as safety-related. Formal verification and validation has been completed and documented consistent with the site processes and procedures.

6.2 Tier 2, Avoidance of Risk-Significant Plant Conditions Tier 2 is an identification of potentially high-risk configurations that could exist if equipment in addition to that associated with the TS change is taken out of service concurrently, or other risk significant operational factors such as concurrent system or equipment testing are involved. The objective of Tier 2 is to ensure that appropriate restrictions are placed on dominant risk significant configurations that would be relevant to the proposed TS change.

6.2.1 Station Blackout Diesel (C DG)

If the Station Blackout Diesel (OC DG) is out of service at the same time a DG is out of service, the DG required action completion time will remain seventy-two hours.

6.2.2 Unit-to-Unit Interaction Only one DG between the two units can be taken out-of-service for planned entry into the extended required action completion time. If multiple DGs are out-of-service, one on each unit, then the seventy-two hour required action completion time applies. IfmultipleDGs are out-of-service on a single unit then TS 3.0.3 applies.

6.23 Switchyard Maintenance Existing operator instructions (OI) specify the following precautions prior to taking out of service a safety-related DG:

Determine whether other maintenance is in progress or planned that will reduce the reliability of off-site power supplies.

The Shift Manager determines how to minimize both the time that the DG is out of service and the time that off-site power supplies are at reduced reliability.

CCNPP Page 48 of 4 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysis for Proposed DG RequiredAction Completion Time License Amendment In addition, the existing on-line risk assessment process (refer to Tier 3, Configuration Risk Management, below), would measure the overall plant risk of diesel unavailability concurrently with maintenance activities in the switchyard. This risk is managed in accordance with paragraph (a)(4) of 10 CFR 50.65.

6.2.4 Grid Availability (High Winds)

High winds (hurricanes and tornadoes) could cause damage to the grid and could result in a plant trip in conjunction with a loss of offsite power. The CCNPP Emergency Response Plan specifies actions to take in severe weather conditions. If a tornado watch, tornado warning, hurricane watch, or hurricane warning are predicted or exists for CCNPP or any of the 500KV line right-of-ways, then the following Tier 2 restrictions are implemented:

Ensure that the diesel generators are available for service.

If a diesel generator is not available, expedite maintenance to ensure that the equipment becomes available.

In addition, the existing on-line risk assessment qualitatively assesses the impact of predicted severe weather against planned plant maintenance configurations. This risk is managed in accordance with paragraph (a)(4) of 10 CFR 50.65.

6.3 Tier 3, Configuration Risk Management Tier 3 is the development of a proceduralized program, which ensures the risk impact of out-of-service equipment is appropriately evaluated prior to performing a maintenance activity. The program applies to technical specification structures, systems or components for which a risk-informed required action completion time has been granted. A viable program would be one that is able to uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation and is described in RG 1.77 as the Configuration Risk Management Program (CRMP). The need for this third tier stems from the difficulty of identifying all possible risk-significant configurations under Tier 2 that will be encountered over extended periods of plant operation.

Integrated on-line risk assessment has been in use at CCNPP since mid 1990s. Due to a revision to the Maintenance Rule, 10 CFR 50.65 (a)4, the process was updated in November 2000 to reflect the guidance in NUMARC 93-01 Revision 3.

The CCNPP on-line risk assessment process helps to ensure that the decrease in plant safety for voluntary entry into a limiting condition for operation action statement is small and is acceptable for the period of the maintenance or testing activity. It also helps to ensure that the removal from service of safety systems and important non-safety equipment and the general impact of maintenance and testing is minimized. This assurance is applicable for all plant configurations and is specifically applicable to the entry into the proposed extended DG required action completion time.

Consistent with RG 1.177, the following program elements are described below:

6.3.1 On-line Risk Assessment - PRA Scope and Control 6.3.2 On-line Risk Assessment - Tools 6.3.3 On-line Risk Assessment - Process 63.4 On-line Risk Assessment - Level 2 6.3.5 On-line Risk Assessment - External Events The elements of the current process are described below. Details of this process may change over time.

However, the fundamentals of performing of an integrated risk assessment using probabilistic risk techniques that meets the Maintenance Rule (a)4 requirements will not.

RAN 02-020 REV. 2 Page 49 of 54 CCNPP CCNPP Page 49 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Pover Plant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment 6.3.1 On-line Risk Assessment - PRA Scope and Control This sub-section addresses the scope and control of the PRA used to support on-line risk assessment.

6.3.1.1 PRA Scope The CCPRA used for on-line risk assessment is a Level 1 and 2, at-power, internal events PRA. The on-line risk assessment model is derived from the current revision of the PRA. The model is modified to remove the impact of planned maintenance on initiating events and mitigating events. In addition, the impact of the plant availability factor is removed, that is, initiating event frequencies are increased since the plant operating mode (at-power) is known. The PRA is used to assess risk in Modes 1, 2, and 3.

Lower modes of operation (Modes 4, 5, and 6) are assessed consistent with the INPO 89-017 Revision 1, Guidelines for Management of Planned Outages at Nuclear Power stations and NUMARC 91-06, Guidelines for Industry Actions to Assess Shutdown Management.

Although an external events PRA that addresses fire, seismic and high winds was used for the risk assessment supporting this proposed license amendment, the on-line risk assessment of external events is qualitatively assessed.

6.3.1.2 PRA Configuration Control The CCPRA configuration is procedurally controlled by EN-1-330, Probabilistic Risk Assessment Configuration Control Procedure. This procedure provides the control and processes for maintaining the CCPRA consistent with the as-operated, as-built plant.

Plant changes are monitored for impact on the PRA. Issues requiring action are entered into the CCPRA Configuration Risk Management Program (CRMP) database as a CRMP Issue. These issues are prioritized in accordance with their significance for implementation into future PRA updates. Significant CRMP Issues that are the result of errors are entered into the site corrective action program.

Routine training ensures that current users of the PRA, including the on-line risk assessment analysts are aware of all significant open issues.

Issues that potentially impact the on-line assessment tools are procedurally identified and addressed.

6.3.2 On-line Risk Assessment - Tools This sub-section describes the on-line risk assessment tools and their controls.

6.3.2.1 Description of On-line Risk Assessment Tools The Calvert Cliffs Quarterly System Schedule (QSS) on-line risk assessment process uses a suite of in-house developed software to determine the risk configuration of the plant. These software tools are:

QSS Communicator This software application imports data (maintenance activities for a given week) from the maintenance scheduling software and facilitates the processing of this information by the Work Week Coordinator with regard to scope and equipment impact. A companion software application called the Outage Communicator aids in capturing the outage activities that could impact the opposite unit.

QSS Converter This software application uses the output from the Communicator and aids in associating the impacted plant function to the appropriate PRA impact (if previously developed) or supports the development of a new impact. Qualified PRA analysts perform this activity.

RAN 02.020 REV. 2 Page 50 of 54 CCNPP Page 50 of 54 RAN02-020 REV. 2

Calvert Cliffs Nuclear Power Plant RiskAnalysisforProposedDGRequiredAction Completion TimeLicenseAntendment QSS Evaluator This software application uses the output of the Converter and the output from the CCPRA (solved accident cutsets) to determine the integrated risk impact.

Note: Although the CCPRA is based on RISKMAN software that produces accident sequences, these sequences are post-processed to have characteristics like cutsets.

6.3.2.2 Control of On-line Risk Assessment Tools PRA Model Input The on-line risk assessment model used, as input into the QSS Evaluator is a zero maintenance unavailability version of the base PRA model. Open items against the base PRA model are assessed for impact of the on-line risk assessment process. The PRA analyst addresses any applicable identified items during the on-line risk assessment evaluation process. This process isproceduralized in EN-1-334, Probabilistic Risk Assessment of Maintenance Activities.

Tool Software Control The software suite used for the on-line risk assessment process has been developed using verification and validation techniques to ensure high confidence in its capability and results.

6.3.3 On-line Risk Assessment - Process The on-line risk assessment process is controlled by a site procedure, NO-I-I 17, Integrated Risk Management, and a unit level procedure, EN-1-334, Probabilistic Risk Assessment of Maintenance Activities. The site procedure establishes the overall administrative controls, responsibilities and duties for the direction, control and oversight of risk significant activities at CCNPP. The unit level procedure identifies the controls and processes used by the PRA analysts to support the integrated risk assessment process.

The integrated risk management process uses both deterministic and probabilistic tools to identify and control risk.

6.3.3.1 Qualitative Risk Assessment Plant personnel assess the following risks during the planning process for each planned maintenance activity:

Nuclear Safety

Industrial Safety

Environmental Safety

Corporate Safety Note: Radiological Safety is assessed through a separate process.

This risk assessment is performed using a series of checklist. Each risk area is evaluated as HIGH, MEDIUM or LOW. Nuclear Safety HIGH and MEDIUM activities are included in the integrated probabilistic risk assessment. By including these activities, the process has an effective means of capturing potentially risk significant activities, especially trip sensitive activities that may not have been directly in the scope of the PRA.

RAN 02.020 REV. 2 Page 51 of 54 CCNPP Page 1 of 54 RAN 02-020 EV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor Proposed DG RequiredAction Completion Time License Amendment 6.3.3.2 Integrated Probabilistic Risk Assessment - Planned LCO Entry An integrated risk assessment is performed two weeks prior to execution of the maintenance activity.

Consistent with RG 1.160, Revision 2, the scope of the CCNPP on-line risk assessment process includes all structures, systems and components (SSCs) modeled in the plant PRA. No additional at-power high safety significant SSCs were identified. The process considers the following activities as part of the scope:

All PRA Scope Functions A Maintenance Rule Risk Assessment Guideline is maintained to aid in the determination of the scope of the Calvert Cliffs risk assessment process. This guideline is controlled by the NO-1-1 17, Integrated Risk Assessment Procedure. The guideline lists the plant functional equipment group (FEG) identifiers that are within scope of the PRA. FEGs identify groups of equipment that perform like functions to help optimize the scheduling process. FEGs are similar to top events. Several maintenance activities are often performed on different components (for example, a pump and its associated breaker) related to the FEG that is taken out of service. Work activities are coded with the FEG identifier in the planning process and are electronically transferred into the QSS Communicator as part of the risk assessment scope.

The tying of the FEG to PRA scope allows for a transparent interaction between the work scheduled and the work assessed.

Nuclear Safety HIGH and MEDIUM Individual maintenance activities that have been assessed as Nuclear Safety HIGH or MEDIUM (deterministic risk assessment) are included in the scope of the integrated risk assessment. These activities are coded in the planning process and electronically transferred into the QSS Communicator as part of the risk assessment scope.

Testing Activities associated with surveillance and other periodic testing are electronically transferred into the QSS Communicator.

Other Doors, risk significant locations, and other activities are also included in the evaluation process.

The Work Week Coordinator processes this information using the QSS Communicator by reviewing the maintenance activities, determining the FEG state (whether the FEG is available, not available, valve locked open, etc.) and screening non-intrusive maintenance. Once completed, he transfers this information to the qualified PRA analyst. The PRA analyst uses the QSS Converter to facilitate the determination of the impact of each maintenance activity on the CCPRA. The analyst develops impact macros that convert the activity to the appropriate impact on initiating events and split fractions. If the impact had been previously determined, the QSS Converter will automatically assign the appropriate impact.

All activities are either assigned a macro or screened. Cross unit impacts are also determined during this process, including the risk impact of outage maintenance activities on the opposite, on-line unit. Once all activities are dispositioned, the PRA analyst evaluates the integrated impact using the QSS Evaluator. The Evaluator addresses the impacts on Unit-l and Unit-2 as determined by the PRA analyst. The evaluation typically considers a preventive or corrective maintenance activity to last twenty- four hours in order to allow scheduling flexibility within any given day. Tests are typically assessed on a 12-hour shift basis.

Some risk activities may be assessed and managed on shorter time increments.

RAN 02.020 REV. 2 Page 52 of 54 CCNPP CCNPP Page 52 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor ProposedDGRequiredAction Completion Time License Amendment The following risk metrics and action thresholds are used in this process:

Table 22 CCNPP On-line Risk Thresholds Threshold':

0 et c 10l on 0t-i-MetrP 0 , ;Medium Hi Low D escripti

t; pt' t -

Daily CDF Risk >=8 >=4 times base <4 The maximum daily configuration specific times times CDF normalized to the base CDF (i.e. no base base equipment out-of-service).

Daily LERF Risk >=8 >=4 times base <4 The maximum daily configuration specific times times LERF normalized to the base LERF (i.e. no base base equipment out-of-service).

Weekly ICCDP >lE-5 IE-5 to 1E-6 <1E-6 The sum of the products of the incremental CDFs and the durations of the various maintenance activities during a single week.

Weekly ICLERP >1E-6 1E-6 t IE-7 <1E-7 The sum of the products of the incremental LERFs and the durations of the various maintenance activities during a single week For conditions evaluated as a MEDIUM and HIGH risk configuration, actions are taken to re-schedule activities or lower risk. If it is not possible to prevent a MEDIUM or HIGH risk configuration, then the appropriate risk management actions are established in accordance with NO-1-1 17, Integrated Risk Management.

6.3.3.3 Integrated Probabilistic Risk Assessment - Unplanned LCO Entry Emergent conditions may result in the need for action prior to conduct of the assessment, or could change the conditions of a previously performed assessment. Emergent work as defined in NO-1-1 17 is "an activity added to a work week after the T-2 Scheduled Risk Assessment Meeting." "T-2" refers to two weeks prior to work execution.

Guidance is provided in the CCNPP risk assessment process to perform a risk assessment on a reasonable schedule commensurate with the safety significance of the condition. Guidance on the performance (or re-evaluation) of the assessment is designed such that it will not interfere with, or delay, the operator and/or maintenance crew from taking timely actions to restore the equipment to service or take compensatory actions.

To minimize the evaluation response time, a qualified PRA analyst is on twenty-four hour call.

6.3.3.4 On-line Risk Assessment - Level 2 The CCNPP on-line risk assessment process directly assesses Level 2 risk by using the LERF metric. See Table 22 above.

RAN 02-020 REV. 2 Page 53 of 54 CCNPP Page 3 of 54 RAN 02-020 REV. 2

Calvert Cliffs Nuclear Power Plant Risk Analysisfor ProposedDG RequiredAction Completion Time License Amendment 6.3.3.5 On-line Risk Assessment - External Events External Events are qualitatively evaluated by a PRA analyst assessing the event and then adjusting the internal events PRA model.

7.0 Performance Monitoring The reliability and availability of the DGs are monitored under the Maintenance Rule Program. If the pre-established reliability or availability performance criteria are exceeded for the DGs, they are considered for 10 CFR 50.65 (a)(1) actions, requiring increased management attention and goal setting in order to restore their performance (reliability and availability) to an acceptable level. The performance criteria are risk-informed and, therefore are a means to aid in managing the overall risk profile of the plant. The actual out-of-service time for the DGs will be minimized to ensure the reliability and availability performance criteria for these ESF busses are not exceeded.

In practice, the actual out-of-service time for the DGs and the SBO DG is minimized to ensure that the Maintenance Rule reliability and availability performance criteria for these components are not exceeded.

It should be noted that a full fourteen days of unavailability per DG per cycle is not anticipated.

To ensure that the operational safety associated with the extended TS required action completion time does not degrade over time, the Maintenance Rule Program is used as discussed above, to identify and correct adverse trends. Compliance with Maintenance Rule not only optimizes reliability and availability of important equipment, it also results in management of the risk when equipment is taken out-of-service for testing or maintenance.

8.0 Conclusion We propose extending the required action completion time for a single DG out of service from seventy-two hours to fourteen days. The risk contributions associated with this extension have been quantitatively evaluated using the current plant-specific probabilistic risk assessments for Calvert Cliffs Units I and 2.

The changes for a single DG OOS, when considering the seismic improvements of the OC DG and anticipated unavailabilities, result in a risk reduction. There is also additional risk reduction that was not quantified associated with averting unnecessary plant transients and with reduced risk during shutdown operations. The latter reduction comes as a result of scheduling less DG unavailability while the unit is shutdown.

The second Technical Specification affected involves the required action completion time for declaring the Control Room Emergency Ventilation System (CREVS) inoperable when the Safety-Related back-up power supply (DG) is inoperable. The proposed change extends the current seventy-two hours to twenty-one days when a single DG is inoperable (i.e. OC is available and three other SR DGs are operable) before the CREVS train is declared inoperable. The risk associated with this required action completion time extension was evaluated in conjunction with the above change to fourteen days. The net risk reduction mentioned above includes this CREVS Technical Specification Required Action Completion Time extension. The DG extension also impacts the H2 analyzer and CRETs Required Action Completion Time.

Currently, the CREVS Required Action Completion Time is 7 days and the CRETs and H2 analyzer required action completion time is 30 days. Therefore, the DG OOS time is limited by the CREVS Required Action Completion Time.

The third Technical Specification effected involves the required action completion time when the two DGs on a Unit are both inoperable. The proposed change extends the current two hours to twelve hours when the OC DG is available and the other two SR DGs are operable. The risk associated with this required action completion time extension was evaluated in conjunction with the other changes. The proposed change is considered acceptable.

CCNPP Page 54 of 54 RAN 02-020 REV. 2

ATTACHMENT (2)

DETERMINATION OF SIGNIFICANT HAZARDS Calvert Cliffs Nuclear Power Plant, Inc.

May 12, 2003

ATTACHMENT (2)

DETERMINATION OF SIGNIFICANT HAZARDS The proposed amendment revises Technical Specification 3.8.1, AC Sources - Operating to extend to Required Action Completion Time for inoperable diesel generators (DGs). There are three changes proposed to implement this requested extension. The first proposed change will increase the Required Action Completion Time for a single inoperable safety-related DG to 14 days, provided that the 0C DG is available and the other three safety-related DGs are operable.

The second Technical Specification change involves the Required Action Completion Time for declaring the Control Room Emergency Ventilation System, 'Control Room Emergency Temperature System, and H2 Analyzer inoperable when the safety-related back-up power supply (DG) is inoperable. The proposed change extends the current 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 21 days when a single DG is inoperable (i.e., OC DG is available and three other DGs are operable) before the Control Room Emergency Ventilation System, Control Room Emergency Temperature System, and H2 Analyzer trains are declared inoperable.

Currently, when both DGs dedicated to redundant safety-related equipment are inoperable, the Required Action Completion Time is tvo hours. The third proposed change increases this Required Action Completion Time to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12-hour Required Action Completion Time is only allowed when the OC DG is available and one other safety-related DG is operable.

Each of the proposed changes have associated changes needed to realign the Required Actions with the proposed changes. An additional proposed change will also make a correction to the Completion Time for what is currently Required Action D.1 so that it correctly reads "once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter" instead of "one per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter."

These proposed changes have been evaluated against the standards in 10 CFR 50.92 and have been determined to not involve a significant hazards consideration, in that operation of the facility in accordance with the proposed amendments:

1. WYould not involve a signficant increase in the probabilityor consequences of an accidentpreviotusly evaluated.

The proposed Technical Specification changes do not affect the design, operational characteristics, function or reliability of the DGs. The DGs are not accident initiators, and extending the DG Required Action Completion Times will not impact the frequency of any previously evaluated accidents. The design basis accidents will remain the same postulated events described in the Updated Final Safety Analysis Report. In addition, extending the DG Required Action Completion Times will not impact the consequences of an accident previously evaluated. The consequences of previously evaluated accidents will remain the same during the proposed extended Required Action Completion Times as during the current Required Action Completion Times. The ability of the remaining DGs to mitigate the consequences of an accident will not be affected since no additional failures are postulated while equipment is inoperable within the Technical Specification Required Action Completion Times. Therefore, the proposed changes will not increase the probability or consequences of an accident previously evaluated.

The duration of a Technical Specification Required Action Completion Time is determined considering that there is a minimal possibility that an accident will occur while a component is removed from service. A risk informed assessment was performed that concluded that the plant risk is acceptable and consistent with the guidance contained in Regulatory Guide 1.177.

The additional proposed changes to renumber action requirements and the correction of a misspelled word will not result in any technical changes to the current requirements. Therefore, these additional proposed changes will not increase the probability or consequences of an accident previously evaluated.

1

ATTACHMENT (2)

DETERMINATION OF SIGNIFICANT HAZARDS

2. Would not create the possibility of a new or different type of accidentfrom any accidentpreviously evaluated The proposed changes to the Technical Specifications do not impact any system or component in a manner that could cause an accident. The proposed changes will not alter the plant configuration or require any unusual operator actions. The proposed changes will not alter the way any structure, system, or component functions, and will not significantly alter the manner in which the plant is operated. There will be no adverse effect on plant operation or accident mitigation equipment. The response of the plant and the operator following an accident will not be significantly different. In addition, the proposed changes do not introduce any new failure modes. Therefore, the proposed changes will not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. WVould not involve a significantreduction in a margin of safety.

The margin of safety provided by the DGs is to provide emergency back-up power supply to systems required to mitigate the consequences of postulated accidents. The engineered safety features systems on either of the two trains for each unit provide for the minimum safety functions necessary to shutdown the units and maintain it in a safe shutdown condition. Each of the two trains can be powered from one of the offsite power sources or its associated DG. In addition, the OC DG (Station Blackout DG) is available to provide power to any of the trains. This design provides adequate defense in-depth to ensure that diverse power sources are available to accomplish the required safety functions. Thus, with a safety-related DG out-of-service, there is sufficient means to accomplish the safety functions and prevent the release of radioactive material in the event of an accident.

The proposed change does not affect any of the assumptions or inputs to the Updated Final Safety Analysis Report and does not reduce the decrease in severe accident risk achieved with the issuance of the Station Blackout Rule, 10 CFR 50.63, "Loss of All Altemating Current Power."

Therefore, the proposed change does not involve a significant reduction in the margin of safety.

2

ATTACHMENT (3)

MARKED UP TECHNICAL SPECIFICATION PAGES 3.8.1-2 3.8.1-3 3.8.1-4 3.8.1-5 3.8.1-6 3.8.1-7 3.8.1-8 Calvert Cliffs Nuclear Power Plant, Inc.

May 12, 2003

AC Sources-Operating 3.8.1 ACTIONS CONDITION I REQUIRED ACTION I COMPLETION TIME A. One required A.1 Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months LCO 3.8.1.a offsite SR 3.8.1.2 for circuit inoperable. required OPERABLE AND offsite circuits.

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no discovery of no offsite power offsite power to available inoperable one train when its redundant concurrent with required feature(s) inoperability of is inoperable. redundant required feature(s)

AND A.3 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. AND from discovery of failure to meet LCO 3.8.1.a or LCO 3.8.1.b CALVERT CLIFFS - UNIT 1 3.8.1-2 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION R REQUIRED ACTION COMPLETION TIME B. One LCO 3.8.1.b DG Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. SR 3.8.1.2 for the OPERABLE required AND offsite circuit(s).

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s) supported discovery of by the inoperable DG Condition B inoperable when its concurrent with redundant required inoperability of feature(s) is redundant inoperable. required feature(s)

AND Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG(s) is not inoperable due to common cause failure.

OR Perform SR 3.8.1.3 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG(s).

AND

__________________________________ J I CALVERT CLIFFS - UNIT 1 3.8.1-3 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 ACTIONS (continued)

T CONDITION IUIRED ACTION COMPLETION TIME B. (continued) Restore DG to {)Z leu , / 6114 sB OPERABLE status.

AND w s from discovery of failure to meet LCO 3.8.1.a or LCO 3.8.1.b

_~~

LCO 3.8.1.c offsite ----------- NOTE------------

circuit inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating," when Conditio is entered with imXC power source to a train.

Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months SR 3.8.1.2 for required OPERABLE AND offsite circuit(s).

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND CALVERT CLIFFS - UNIT 1 3.8.1-4 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION R REQUIRED ACTION COMPLETION TIME (continued) a2 Declare, CREVS, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from CRETS, or H Analyzer discovery of no with no offsite power offsite power to available inoperable one train when the redundant concurrent with CREYS. CRETS, or H2 inoperability of Analyzer is redundant inoperable. required feature(s)

AND 7d3 Declare CREVS, CRETS, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and H2 Analyzer supported by the inoperable offsite circuit inoperable.

+

LCO 3.8.1.c DG ----------- NOTE-inoperable. . - Enter-applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating," when Conditio r s'-entered with no AC power source to a train.

6- (

Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months SR 3.8.1.2 for the OPERABLE required AND offsite circuit(s). ,4e)

-O 'per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months AND hereafter

________________________________ I. I CALVERT CLIFFS - UNIT 1 3.8.1-5 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION I REQUIRED ACTION ICOMPLETION TIME (continued) Declare CREVS, CRETS, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from

,. or H2 Analyzer discovery O-S) 6 supported by the Condition6a C_3 inoperable DG concurrent wi th inoperable when the inoperability of redundant CREVS, redundant CRETS, or H2 Analyzer required is inoperable. feature(s)

AND 1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG(s) is not inoperable due to common cause failures.

OR AND2 Perform SR 3.8.1.3 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG(s).

AND I 'E.5 Declare CREVS, CRETS, and Hz Analyzer supported by the inoperable DG inoperable.

CALVERT CLIFFS - UNIT 1 3.8.1-6 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION I REQUIRED ACTION I COMPLETION TIME

"-cm Two required LCO 3.8.1.a offsite 1 Declare required feature(s) inoperable 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from discovery circuits inoperable. when its redundant Condition required feature(s) concurrent with OR is inoperable. inoperability of redundant One required required LCO 3.8.1.a offsite feature(s) circuit that provides power to the CREVS, AND CRETS, and H2 Analyzer inoperable 2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and the required offsite circuit to LCO 3.8.1.c offsite OPERABLE status.

circuit inoperable.

+

One required ----------- NOTE------------

LCO 3.8.1.a offsite Enter applicable Conditions circuit inoperable. and Required Actions of LCO 3.8.9, when Conditio I-I)

AND is entered with no AC pow;5 source to any train.

One LCO 3.8.1.b DG inoperable.

1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuit to OPERABLE status.

OR 2 Restore DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status.

CALVERT CLIFFS - UNIT 1 3.8.1-7 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 Two LCO 3.8.1.b DGs iours inoperable. G status.

OR LCO 3.8.1.b DG that provides power to the CREVS, CRETS, and H2 Analyzer inoperable and LCO 3.8.1.c DG inoperable.

Required Action and Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, B,XA E. F w=i-lIQt Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Three or more Enter LCO 3.0.3. Immediately required LCO 3.8.1.a and LCO 3.8.1.b AC sources inoperable.

CALVERT CLIFFS - UNIT 1 3.8.1-8 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

INSERT 1 CON D1ll(UN EQ URED ACTl(I)N COMPZLL'rltN 'I'lM E B.1 Verify both DGs on the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months other unit OPERABLE and OC DG available. AND Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter AND INSERT 2 CONDIIION REQUIRED ACTlON COMPLE'tION 'I'ME C. Required Action and C.1.1 Restore both DGs on 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months associated Completion the other unit to Time of Required Action OPERABLE status and B.1 not met. OC DG to available status.

OR C. 1.2 Restore DG to OPERABLE status.

INSERT 3 CONDl'I'ION REQUIRED AC'IION COMPLEIION 'I'ME E.1 Verify both LCO 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 3.8.1.b DGs OPERABLE, the other AND unit's DG OPERABLE and the OC DG Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter available.

AND

INSERT 4 CONDIIION REQUIRED ACTION COMPLE'O'N)TME F. Required Action and F.l.1 Restore both LCO 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months associated Completion 3.8.l.b DGs and other Time of Required Action unit's DG to E.1 not met. OPERABLE status and OC DG to available status.

OR F.1.2 Restore DG to OPERABLE status.

INSERT 5 CONDIION REQUlKED ACTION COMPLEION 'l'ME I.1 Verify OC DG 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months available and one other DG OPERABLE.

AND INSERT 6 CONDITION REQUIRED ACTION COMPLEION IME J. Required Action and J.1.1 Restore OC DG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion available status and one Time of Required Action other DG to I. 1 not met. OPERABLE status.

OR J.1.2 Restore one DG to OPERABLE status.

ATTACHMENT (4)

FINAL TECHNICAL SPECIFICATION PAGES Section 3.8.1 Calvert Cliffs Nuclear Power Plant, Inc.

May 12,2003

AC Sources-Operating 3.8.1 3.8 ELECTRICAL POWER SYSTEMS 3.8.1 AC Sources-Operating LCO 3.8.1 The following AC electrical sources shall be OPERABLE:

a. Two qualified circuits between the offsite transmission network and the onsite Class E AC Electrical Power Distribution System;

b. Two diesel generators (DGs) each capable of supplying one train of the onsite Class 1E AC Electrical Power Distribution System; and

c. One qualified circuit between the offsite transmission network and the other unit's onsite Class 1E AC electrical power distribution subsystems needed to supply power to the Control Room Emergency Ventilation System (CREVS), Control Room Emergency Temperature System (CRETS), and H2 Analyzer and one DG from the other unit capable of supplying power to the CREVS, CRETS, and H2 Analyzer.

APPLICABILITY: MODES 1, 2, 3, and 4.

CALVERT CLIFFS - UNIT 1 3.8.1-1 Amendment No. 227 CALVERT CLIFFS - UNIT 2 Amendment No. 201

AC Sources-Operating 3.8.1 ACTIONS CONDITION I REQUIRED ACTION I COMPLETION TIME A. One required A.1 Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months LCO 3.8.1.a offsite SR 3.8.1.2 for circuit inoperable. required OPERABLE AND offsite circuits.

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no discovery of no offsite power offsite power to available inoperable one train when its redundant concurrent with required feature(s) inoperability of is inoperable. redundant required feature(s)

AND A.3 Restore required 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months offsite circuit to OPERABLE status. AND 17 days from discovery of failure to meet LCO 3.8.1.a or LCO 3.8.1.b I

CALVERT CLIFFS - UNIT 1 3.8.1-2 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION I REQUIRED ACTION l COMPLETION TIME B. One LCO 3.8.1.b DG B.1 Verify both DGs on 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. the other unit OPERABLE and OC DG AND available.

Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter AND B.2 Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months SR 3.8.1.2 for the OPERABLE required AND offsite circuit(s).

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.3 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from I feature(s) supported discovery of by the inoperable DG Condition B inoperable when its concurrent with redundant required inoperability of feature(s) is redundant inoperable. required feature(s)

AND B.4.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months I DG(s) is not inoperable due to common cause failure.

OR CALVERT CLIFFS - UNIT 1 3.8.1-3 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4.2 Perform SR 3.8.1.3 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months I for OPERABLE DG(s).

AND B.5 Restore DG to 14 days OPERABLE status.

AND 17 days from I discovery of failure to meet LCO 3.8.1.a or LCO 3.8.1.b C. Required Action and C.1.1 Restore both DGs on 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months associated Completion the other unit to Time of Required OPERABLE status and Action B.1 not met. OC DG to available status.

OR C.1.2 Restore DG to OPERABLE status.

CALVERT CLIFFS - UNIT 1 3.8.1-4 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION I REQUIRED ACTIO COMPLETION TIME D. LCO 3.8.1.c offsite ----------- NOTE----------- I circuit inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating," when Condition D is entered with no AC power source to a train.

D.1 Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months I SR 3.8.1.2 for required OPERABLE AND offsite circuit(s).

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND D.2 Declare, CREVS, 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from I CRETS, or H2 Analyzer discovery of no with no offsite power offsite power to available inoperable one train when the redundant concurrent with CREVS, CRETS, or H2 inoperability of Analyzer is redundant inoperable. required feature(s)

AND D.3 Declare CREVS, CRETS, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and H2 Analyzer supported by the inoperable offsite circuit inoperable.

CALVERT CLIFFS - UNIT 1 3.8.1-5 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION R REQUIRED ACTION COMPLETION TIME E. LCO 3.8.1.c DG ----------- NOTE----------- I inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.9, "Distribution Systems-Operating," when Condition E is entered with I no AC power source to a train.

E.1 Verify both LCO 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 3.8.1.b DGs OPERABLE, the other unit's DG IAND OPERABLE and the OC DG available. Once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter AND E.2 Perform SR 3.8.1.1 or 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months SR 3.8.1.2 for the OPERABLE required AND offsite circuit(s).

Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND E.3 Declare CREVS, CRETS, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from or 2 Analyzer discovery of supported by the Condition E inoperable DG concurrent with inoperable when the inoperability of redundant CREVS, redundant CRETS, or H2 Analyzer required is inoperable. feature(s)

AND

_____________________________________ .1. J CALVERT CLIFFS - UNIT 1 3.8.1-6 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME E. (continued) E.4.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months DG(s) is not inoperable due to common cause failures.

OR E.4.2 Perform SR 3.8.1.3 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for OPERABLE DG(s).

AND E.5 Declare CREVS, CRETS, 21 days and H2 Analyzer supported by the inoperable DG inoperable.

F. Required Action and F.1.1 Restore both LCO 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months associated Completion 3.8.1.b DGs and other Time of Required unit's DG to OPERABLE Action E.1 not met. status and OC DG to available status.

OR F.1.2 Restore DG to OPERABLE status.

CALVERT CLIFFS - UNIT 1 3.8.1-7 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME G. Two required G.1 Declare required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from I LCO 3.8.1.a offsite feature(s) inoperable discovery of circuits inoperable. when its redundant Condition G required feature(s) concurrent with OR is inoperable. inoperability of redundant One required required LCO 3.8.1.a offsite feature(s) circuit that provides power to the CREVS, AND CRETS, and H2 Analyzer inoperable G.2 Restore one required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and the required offsite circuit to LCO 3.8.1.c offsite OPERABLE status.

circuit inoperable.

H. One required ----------- NOTE-----------

LCO 3.8.1.a offsite Enter applicable Conditions circuit inoperable. and Required Actions of LCO 3.8.9, when Condition H AND is entered with no AC power source to any train.

One LCO 3.8.1.b DG _- -- - - -

inoperable.

H.1 Restore required 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months offsite circuit to OPERABLE status.

OR H.2 Restore DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months I OPERABLE status.

CALVERT CLIFFS - UNIT 1 3.8.1-8 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME I. Two LCO 3.8.1.b DGs I.1 Verify OC DG 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. available and one other DG OPERABLE.

OR AND LCO 3.8.1.b DG that provides power to the I.2 Restore one DG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months CREVS, CRETS, and H OPERABLE status.

Analyzer inoperable and LCO 3.8.1.c DG inoperable.

J. Required Action and J.1.1 Restore OC DG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months associated Completion available status and Time of Required one other DG to Action .1 not met. OPERABLE status.

OR J.1.2 Restore one DG to OPERABLE status.

K. Required Action and K.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A, AND B, C, E,-F, G, H, I, or J not met. K.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months L. Three or more L.1 Enter LCO 3.0.3. Immediately I required LCO 3.8.1.a and LCO 3.8.1.b AC sources inoperable.

CALVERT CLIFFS - UNIT 1 3.8.1-9 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS

NOTE-------------------------------------

SR 3.8.1.1 through SR 3.8.1.15 are only applicable to LCO 3.8.1.a and LCO 3.8.1.b AC sources. SR 3.8.1.16 is only applicable to LCO 3.8.1.c AC sources.

SURVEILLANCE FREQUENCY SR 3.8.1.1 -------------------NOTE-------------_

Only required to be performed when SMECO is being credited for an offsite source.

Verify correct breaker alignment and Once within indicated power availability for the 69 kV 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after SMECO offsite circuit. substitution for a 500 kV offsite circuit AND 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter SR 3.8.1.2 Verify correct breaker alignment and 7 days indicated power availability for each required 500 kV offsite circuit.

CALVERT CLIFFS - UNIT 1 3.8.1-10 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.3 ------------------ NOTES ------------------

1. Performance of SR 3.8.1.9 satisfies this Surveillance Requirement.

2. All DG starts may be preceded by an engine prelube period and followed by a warmup period prior to loading.

3. A modified DG start involving idling and gradual acceleration to synchronous speed may be used for this Surveillance Requirement as recommended by the manufacturer. When modified start procedures are not used, the voltage and frequency tolerances of SR 3.8.1.9 must be met.

Verify each DG starts and achieves steady 31 days state voltage 4060 V and < 4400 V, and frequency 58.8 Hz and 61.2 Hz.

CALVERT CLIFFS - UNIT 1 3.8. 1-11 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.4 ----- NOTES ------------------

1. DG loadings may include gradual loading as recommended by the manufacturer.

2. Momentary transients below the load limit do not invalidate this test.

3. This Surveillance shall be conducted on only one DG at a time.

4. This Surveillance Requirement shall be preceded by and immediately follow without shutdown a successful performance of SR 3.8.1.3 or SR 3.8.1.9.

Verify each DG is synchronized and loaded, 31 days and operates for 2 60 minutes at a load 2 4000 kW for DG 1A and 2700 kW for DGs B, 2A, and 2B.

SR 3.8.1.5 Verify each day tank contains 325 gallons 31 days of fuel oil for DG 1A and 275 gallons of fuel oil for DGs 1B, 2A, and 2B.

SR 3.8.1.6 Check for and remove accumulated water from 31 days each day tank.

SR 3.8.1.7 Verify the fuel oil transfer system operates 31 days to automatically transfer fuel oil from storage tank[s] to the day tank.

CALVERT CLIFFS - UNIT 1 3.8.1-12 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

-SURVEILLANCE FREQUENCY SR 3.8.1.8 Verify interval between each sequenced load 31 days block is within + 10% of design interval for the load sequencer.

SR 3.8.1.9 ------------------- NOTE-------------------

All DG starts may be preceded by an engine prelube period.

Verify each DG starts from standby condition 184 days and achieves, in 10 seconds, voltage

> 4060 V and frequency > 58.8 Hz, and after steady state conditions are reached, maintains voltage 4060 V and 4400 V and frequency of > 58.8 Hz and < 61.2 Hz.

SR 3.8.1.10 Verify manual transfer of AC power sources 24 months from the normal offsite circuit to the alternate offsite circuit.

SR 3.8.1.11 -------------------NOTE-------------------

Momentary transients outside the load and power factor limits do not invalidate this test.

Verify each DG, operating at a power factor 24 months of < 0.85, operates for 60 minutes while loaded to 4000 kW for DG 1A and 3000 kW for DGs IB, 2A, and 2B.

SR 3.8.1.12 Verify each DG rejects a load 500 hp 24 months without tripping.

CALVERT CLIFFS - UNIT 1 3.8.1-13 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.13 Verify that automatically bypassed DG trips 24 months are automatically bypassed on an actual or simulated required actuation signal.

SR 3.8.1.14 Verify each DG: 24 months

a. Synchronizes with offsite power source while loaded upon a simulated restoration of offsite power;

b. Manually transfers loads to offsite power source; and

c. Returns to ready-to-load operation.

CALVERT CLIFFS - UNIT 1 3.8.1-14 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.15 -------------------NOTE------------_

All DG starts may be preceded by an engine prelube period.

Verify on an actual or simulated loss of 24 months offsite power signal in conjunction with an actual or simulated Engineered Safety Feature actuation signal:

a. De-energization of emergency buses;

b. Load shedding from emergency buses;

c. DG auto-starts from standby condition and:

1. energizes permanently connected loads in < 10 seconds,

2. energizes auto-connected emergency loads through load sequencer,

3. maintains steady state voltage 2 4060 V and 4400 V,

4. maintains steady state frequency of 58.8 Hz and < 61.2 Hz, and

5. supplies permanently connected and auto-connected emergency loads for 2 5 minutes.

CALVERT CLIFFS - UNIT 1 3.8.1-15 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

AC Sources-Operating 3.8.1 SURVEILLANCE REQUIREMENTS (continued)

SURVEILLANCE FREQUENCY SR 3.8.1.16 For the LCO 3.8.1.c AC electrical sources, In accordance SR 3.8.1.1, SR 3.8.1.2, SR 3.8.1.3, with applicable SR 3.8.1.5, SR 3.8.1.6, and SR 3.8.1.7 are Surveillance required to be performed. Requirements CALVERT CLIFFS - UNIT 1 3.8.1-16 Amendment No.

CALVERT CLIFFS - UNIT 2 Amendment No.

ML031360410

Contents

Text

SUBJECT:

1.0 INTRODUCTION

2.0 BACKGROUND

3.0 DESCRIPTION

8.0 CONCLUSION

2.0 BACKGROUND

Background

Navigation menu

ML031360410

Text

SUBJECT:

1.0 INTRODUCTION

2.0 BACKGROUND

3.0 DESCRIPTION

8.0 CONCLUSION

2.0 BACKGROUND

Background

Navigation menu

Search