ML031400019

Request for Additional Information, Proposed Risk-Informed TS Change Extended Inverter Allowed Outage Time

ML031400019
Person / Time
Site:	North Anna
Issue date:	05/08/2003
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
02-758A, NAPS/JHL
Download: ML031400019 (15)

Text

VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 May 8, 2003 U.S. Nuclear Regulatory Commission Serial No.

02-758A Attention: Document Control Desk NAPS/JHL Washington, D.C. 20555 Docket Nos. 50-338/339 License Nos. NPF-4/7 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY NORTH ANNA POWER STATION UNITS 1 AND 2 REQUEST FOR ADDITIONAL INFORMATION PROPOSED RISK-INFORMED TECHNICAL SPECIFICATIONS CHANGE EXTENDED INVERTER ALLOWED OUTAGE TIME In a December 13, 2002 letter (Serial No.02-758), Virginia Electric and Power Company (Dominion) requested an amendment to Facility Operating License Numbers NPF-4 and NPF-7 in the form of a change to the Technical Specifications for North Anna Power Station Units I and 2. The proposed change revises the Completion Time of Required Action A.1 of Technical Specification 3.8.7, Inverter - Operating, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 14 days for an inoperable inverter. In an April 10, 2003 telephone conference call, additional information was requested by the NRC staff to complete the review of the proposed Technical Specifications change. The requested information is provided in the attachment to this letter.

NRC approval of the proposed Technical Specifications change continues to be requested by December 15, 2003. Once approved the amendment will be implemented within 30 days. Should you have any questions or require additional information, please contact Tom Shaub at (804) 273-2763.

Very truly yours, Leslie N. Hartz Vice President - Nuclear Engineering Commitments made in this letter: None Attachment 74ff4

cc:

U.S. Nuclear Regulatory Commission Region II Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23 T85 Atlanta, Georgia 30303 Mr. M. J. Morgan NRC Senior Resident Inspector North Anna Power Station Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, VA 23218 Stephen Monarque NRC Project Manager Division of Licensing Project Management Washington, D. C. 20555

SN: 02-758A Docket Nos.: 50-338/339

Subject:

Proposed TS Change - Extended Inverter AOT COMMONWEALTH OF VIRGINIA

)

)

COUNTY OF HENRICO

)

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz, who is Vice President - Nuclear Engineering, of Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of her knowledge and belief.

Acknowledged before me this 8th day of May, 2003.

My Commission Expires: March 31, 2004.

Notary Public

- _wa (SEBL)'

Request for Additional Information Inverter Allowed Operation Time Extension North Anna Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

Responses to Request for Additional Information on Vital Bus Inverter Completion Time, North Anna Power Station, Units 1 and 2

1. The Tier 2 evaluation states that there are no single components vith the unit at pover per the TS, when allowed to be out of service concurrent with an inverter would resuilt in a significant change in risk (ie., increase in RAW greater than 10% for components with a RAW of 2).

Confinn that no basic event RAW value previously considered not risk signifi cant (RAW less than 2) increase to 2 or greater with an inverter completion time of 14 days.

Response

A review of the change in risk achievement worth (RAW) for inverter 1-I unavailable for 14 days identified 5 components for which the RAW was below 2 in the base case, but for which the RAW increased to 2 or greater with the increase in RAW greater than 10%. The subject components and their RAW importances were:

' Single AOT calculated from RAW based on cutset truncation of 2 Concurrent AOT duration limited to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> per battery AOT lE-12 The RAWs for the concurrent unavailability of each component and inverter 1-I are very close to a value of 2, which is the accepted cutoff between low safety significant and safety significant for most risk-informed applications. The single AOT risks for the concurrent unavailability of each component and inverter 1-I are near or below the single AOT acceptance criteria for the Tier 1 evaluation.

Furthermore, based on historical experience, it is very unlikely that the concurrent unavailability of these component combinations would occur for an entire 14 day AOT. Therefore, based on the guidance in Regulatory Guide 1.177, Tier 2 compensatory actions are not necessary for these configurations.

Page 1 of 11 Component RAW (with RAW (with Delta

'Single AOT Risk Inverter 1-I Inverter 1-I RAW if both Component available) unavailable) and Inverter 1-I are unavailable 1-EE-EG-1H, "1H EMERGENCY 1.8 2.23 24%

5.6E-7 DIESEL GENERATOR" 1-EE-EG-11, " 1J EMERGENCY 1.76 2.19 24%

5.4E-7 DIESEL GENERATOR" 1-EE-BKR-15H2, "1H EMER 1.69 2.11 25%

5.OE-7 DIESEL GEN OUTPUT CIRCUIT BKR" 1-EE-BKR-15J2, "1J EMER 1.65 2.07 25%

4.9E-7 DIESEL GEN OUTPUT CIRCUIT BKR" 2

1-BY-B-1-Ill, "STATION 1.61 2.04 27%

2.8E-9 BATTERY 1-III"

2. What are the isk impacts of a loss of offsite power event with or without a vital AC inverter available?

Response

The baseline and conditional cutset equation files used in Table 4-2 of the license amendment request were requantified with all the initiating event frequencies set to zero, except for the loss of offsite power event. The loss of offsite power event core damage frequency (CDF) with inverter 1-I inservice is 1.14E-6 per year. The loss of offsite power event CDF with inverter 1-I unavailable is 1.67E-6 per year. The increase in CDF with an inverter 1-I unavailable is 5.3E-7 per year. The ICCDP is calculated from the inverter 1-I inservice and unavailable cases by taking the difference in CDF and multiplying by the AOT (in units of years). The contribution to the ICCDP (i.e., Single Condition Time Risk) from loss of offsite power events is 2.OE-8, which is the ICCDP reported in the submittal for all initiating events.

Therefore, virtually all of the risk impact due to inverter 1-I unavailability is due to loss of offsite power events.

3. The proposed license amendment discussion on external events is limited to the seismic evaluation of the voltage regulating transformers. Provide additional discussion with respect to seismic, fire, high winds, floods, and other external events and their impact on the proposed inverter times.

Response

The internal events analysis used for the quantification of the risk impact of inverter unavailability includes internal initiating events and internal flooding. Qualitative assessments were performed for the risk impact of inverter unavailability on seismic, fire, floods and other external events evaluated in the Individual Plant Examination of External Events (IPEEE), since these analyses have not been updated since completion of the IPEEE.

The EPRI Seismic Margins Method (SMM) was used at North Anna to evaluate potential severe accident vulnerabilities from seismic events. North Anna was categorized as a focused scope plant per NUREG-1407.

The seismic aspects of the voltage regulating transformer were discussed in Section 2.0 of the license amendment request. A review of the North Anna Seismic IPEEE report indicates that there were no unresolved issues in the IPEEE relating to the seismic adequacy of the inverters, the voltage regulating transformers, or any support systems to these components. The risk significance of an inverter unavailability following a seismic event is not significantly different than a loss of offsite power event. The primary difference is that the duration of the loss of offsite power is potentially longer following a seismic event and the availability of balance of plant systems such as main feedwater and condensate is less certain when offsite power is restored following a seismic event. In addition, the frequency of a seismic event causing a loss of offsite power would be much lower than a non-seismic caused loss of offsite power event at North Anna based on the nearby Surry Power Station seismic PRA.

Nevertheless, the unavailability of an inverter during a seismic induced loss of offsite power has minimal impact on the associated 120 VAC vital bus supply due to the redundancy of the vital buses and low probability of a seismic event during an inverter outage.

If the associated emergency diesel generator fails in the loss of offsite power event, the loss of the 120 VAC vital bus is not significant since there would be no power to accident mitigating system trains that are controlled by the associated vital bus. Therefore, the risk impact of inverter unavailability from a seismic event is less significant than from a loss offsite power event.

Page 2 of 11

The EPRI FIVE method was used at North Anna to evaluate potential severe accident vulnerabilities from internal fire events. This method screened out most areas from quantitative evaluation.

Of the areas not screened out, the resulting core damage frequency from internal fires was calculated at 3.9E-6 per year. The impact of subsequent plant modifications such as the addition of an alternate AC diesel generator and upgrade of all RCP seals to high temperature designs have not been evaluated, but would be expected to significantly lower the core damage risk from fires at North Anna.

The Unit 2 Appendix R distribution panel is powered from vital bus inverter 1-I in order to mitigate a fire in Unit 2 which disables its vital bus. The panel supplies backup power to a Unit 2 excore neutron flux monitor and normal power for the Unit 2 instrumentation on the auxiliary monitoring panel. A similar arrangement exists for the Unit 1 Appendix R distribution panel and the Unit 2 inverter. For a fire in the main control room which will prevent monitoring vital reactor instrumentation, vital bus power is supplied to the auxiliary monitoring panel (which has

-the minimum essential instrumentation for monitoring both reactors) and excore neutron flux monitors from both unit's Appendix R distribution panel. The inverters and voltage regulating transformers are all located in the ESGR rooms. The impact of an inverter unavailability during a fire in this area would be of minimal consequence since the components are located in the same fire area. The consequences of a fire in any other area are bounded by the internal events loss of offsite power analysis. A review of the fire analysis in the North Anna IPEEE report did not identify any issues associated with the inverters or the vital bus power supply.

High winds and external floods were screened out of the IPEEE analysis because the design of the North Anna meets the 1975 version of the Standard Review Plan. Nearby facility accidents were screen out of the IPEEE analysis based on a review of changes since the UFASR was issued. All transportation accidents, excluding military aircraft accidents, were also screened out of the IPEEE analysis.

A bounding analysis in the IPEEE was performed to show the contribution to core damage from military aircraft accidents was below the screening value. A survey of engineering and operations personnel was used to determine that North Anna is not subject to any other unique external events. A review of the high winds, external floods, and nearby facility accidents analyses in the North Anna IPEEE report did not identify any issues associated with the inverters or the vital bus power supply. The overall consequence of an inverter unavailability in any of these external initiating events is adequately addressed by the internal events loss of offsite power analysis.

4. For the base case risk analysis the inverter maintenance failures were set to "zero." Did the analysis assume recovery of the inverter? Describe how common cause factors were accounted for in the inverter risk analysis for inverter failure probabilities when set to tnie orfalse.

Response

The PRA model used for all the analyses was based on the average test and maintenance model, which uses 3-year average test and maintenance unavailabilities for all test and maintenance basic events. The "zero maintenance" PRA model was not used for any calculations in the analysis since it was concluded that the potential existed for other maintenance to occur concurrent with an inverter unavailability, wherever permitted by the technical specifications.

In the base case risk analysis, the inverter 1-I test and maintenance basic event was set to zero and all other test and maintenance basic events (including the other inverters) were unchanged.

Page 3 of 11

No recovery was assumed for either a failed inverter or an inverter in test and maintenance. A review of plant specific data and generic data sources for inverter common cause failures did not identify any common cause failures of inverters. Therefore, the PRA model used for the analysis did not include any common cause failure potential between inverters. However, a sensitivity analysis described in Section 4.1.4.4 of the license amendment request was performed to determine if conservative assumptions regarding the potential for common cause failures would change the results. The conclusion of the sensitivity analysis was that conservative assumptions about the potential for common cause failure of the inverters produced risk results which still met the Regulatory Guide 1.174 and 1.177 acceptance criteria.

5. Are the replacements U-2 regulating voltage transfonners seismically qualified? Willfiture replacement transformers be seismically qualified?

Will future replacement inverters inclutde an atomatic transfer feature to the voltage regulating transformers upon loss of pover?

Response

The Unit 2 replacement transformers are seismically qualified.

Specifically, the procurement specification for recently installed vital bus inverters 1-I, 1-11, 2-I, and 2-II requires each inverter, voltage regulating transformer, and static transfer switch to be constructed as Class E and seismically qualified. If any additional vital bus inverters are purchased in the future, they would be procured using the same requirements. Any future replacement inverters would also include an automatic transfer feature to the voltage regulating transformers upon loss of power.

6. List plant tools, techniques and procedures used in evaluating the configuration isk (Tier 3) per 10 CFR50.65(a)(4).

Response

Dominion's 10 CFR 50.65(a)(4) compliance fully satisfies the recommendations of Regulatory Guide 1.177 Tier 3. The Dominion (a)(4) program performs full PRA analyses of all planned maintenance configurations at power in advance using the SCIENTECH Safety Monitor. The PRA model in the SCIENTECH Safety Monitor is a comprehensive, component level, core damage and large early release model. The North Anna Regulatory Guide 1.177 Tier 3 program has been previously evaluated by the NRC in its review and approval of a 14 day allowed outage time for the emergency diesel generators (Amendment Nos. 214 and 195). Configurations that approach or exceed the NUMARC 93-01 risk limits (1.OE-6 for CDP) are avoided or addressed by compensatory measures. Historically, both Surry and North Anna rarely approach this limit.

Emergent configurations are identified and analyzed by the on-shift staff for prompt determination of whether risk management actions are needed. The configuration analysis and risk management processes are fully proceduralized in compliance with the requirements of (a)(4).

North Anna's 10 CFR 50.65(a)(4) compliance program requires analysis and management of all configuration risks. Inverters are explicitly included in the (a)(4) scope and their removal from service is monitored, analyzed and managed using the Safety Monitor tool. In addition, possible loss of offsite power hazards (grid loading/stability, switchyard or other electrical maintenance, external events such as severe weather) are all modeled and explicitly accounted for in the (a)(4) program.

When a configuration approaches the (a)(4) risk limits, plant procedures direct the Page 4 of 11

implementation of risk management actions in compliance with the regulations. If the configuration is planned, these steps must be taken in advance.

Individually, a single inverter outage does not approach the required risk management thresholds of the (a)(4) regulation.

While combinations of unavailable equipment and/or evolutions, including an inverter outage may approach the limits and even require risk management actions, the risks arising from these configurations will be dominated by factors other than the inverter.

As a result, the risk significance of an inverter outage does not warrant limitations upon other equipment.

7. With a new equipment installation is the assumption of only one 14 day outage per refueling cycle adequate? If 14 days is usedfor the installation what is the probability that additional time for maintenance will be required due to new inverter perfomiance, surveillance, or operability concerns.

Response

In clarification of the outage time assumed in this question, the license amendment request analysis assumes an average of one 14 day outage every year per inverter as the basis for the risk analysis.

This assumption conservatively bounds all future preventive and corrective maintenance that might occur.

Furthermore, not all inverters and associated regulating transformers will require replacement, although planning and preparation has occurred to support this activity. Should the station decide to replace the remaining inverters and regulating transformers, the assumed 14 day outage every year per inverter should bound the replacement and testing activities. Occurrence of other preventive and corrective maintenance activities is not assumed to require an entire 14 day period based on prior experience.

In accordance with monitoring program guidance in Regulatory Guide 1.174, when the PRA model is periodically updated, the actual unavailability of the inverters will be input into the PRA model and the risk impact will be compared against the acceptance criteria to ensure that these conclusions remain valid.

8.

No discussion of cumulative rtisk was presented in the submittal. Are there other recent or pending applications that would affect the results shown for a 14 day inverter CT? Does the PRA analysis included in the submittal reflect these changes?

Response

The only prior risk-informed technical specification granted at North Anna was a 14 day emergency diesel generator (EDG) allowed outage time in August 1998. There are no pending risk-informed applications for changes to the North Anna Technical Specifications. The test and maintenance unavailability data used in the PRA model for this license amendment request was based on actual plant component (including the EDGs) unavailabilities for the period January 1, 1997 to December 31, 1999. The average core damage and large, early release frequencies calculated for the inverter analysis reflect the cumulative impact of the EDG allowed outage time and the inverter changes.

Page 5 of 11

9. Provide a discussion on the applicability of the Unit 1 analysis to Unit 2.

Response

The designs of North Anna Units 1 and 2 are maintained virtually identical. Therefore, only a single PRA model was developed for North Anna. The are no major design differences between Units 1 and 2 relating to the vital buses. None of the design differences impact the modeling of accident mitigating systems in the PRA.

The shared unit components (e.g., Alternate AC diesel generator) and unit cross-ties (e.g.,

charging and component cooling water) are all equally capable of supporting each unit for the accident mitigating functions modeled in the PRA.

10. Discuss how the values for baseline ICCDP, delta CDF, delta LERF and ICLERP stated in the submittal are consistent vith the methodology given in RG 1.174 and RG 1.177 in that the baseline CDF states the nominal expected equipment unavailabilities are used.

Response

The PRA model for the inverter analysis used 3-year average test and maintenance equipment unavailabilities. RG 1.177 references NUREG/CR-6141, "Handbook of Methods for Risk-Based Analyses of Technical Specifications," as the basis for the methods to calculate the risk impact of technical specification changes. A review of NUREG/CR-6141 did not identify any guidance stating that nominal expected equipment unavailabilities should be used in the calculations.

Instead, NUREGICR-6141 indicates in Section 3.2.6 that if maintenance may be carried out on other down components, then their outcomes also can be modeled in the Ro and RI calculations.

By including the average test and maintenance equipment unavailabilities for all other components in the PRA model (as permitted by the technical specifications) the potential for concurrent maintenance of an inverter and other plant equipment is considered, as directed by NUREG/CR-6141.

In addition, use of average test and maintenance equipment unavailabilities in the PRA model, versus nominal expected equipment unavailabilities, results in a larger risk impact in the baseline ICCDP, delta CDF, delta LERF and ICLERP calculations since additional cutsets result from the test and maintenance basic events.

Therefore, it was considered appropriate to use the average test and maintenance equipment unavailabilities in the inverter analysis.

11. What is the Base CDF (nominal equipment out of service) for North Anna? The IPE data base indicates an estimated core damage frequency of 7.1E-5/r-y from internally initiated events. Provide background on the IPE results with respect to the baseline result estimated at 1.083E-SIr-y shown in the submittal.

Response

The North Anna PRA model has undergone numerous major updates since it was developed for the Individual Plant Examination (IPE). All the updates were documented in calculation files.

The major model improvements included addition of the alternate AC diesel generator, additional credit for unit cross-connects, update of the reactor coolant pump (RCP) seal LOCA model to reflect enhanced high temperature seals, and incorporation of updated plant specific initiating event, failure rate and unavailability data.

Page 6 of 11

The current North Anna PRA model NOAA core damage frequency with nominal equipment out of service (i.e., all test and maintenance unavailability basic events set to zero) is 9.55E-6/yr (with the default sequence truncation limit of lE-10). The current North Anna PRA model NOAA core damage frequency using average test and maintenance basic event unavailabilities is 1.06E-5/yr (with the default sequence truncation limit of lE-10).

This model includes contributions from internal flooding initiating events.

The following is a summary of the significant model changes made to the N7B model that are reflected in the NOAA model.

Reliability Data - The reliability basic events were Bayesian updated to include recent failure data from the years 1997 to 1999.

The common cause failure (CCF) basic events in the model were updated due to the update in the reliability basic events.

Select human error probability (HEP) and recovery basic events in the model were updated.

The small break LOCA (S2) initiating event was updated to include additional small LOCA categories.

The following new event trees were added to quantify flooding risk:

FAB2, FAB3, FAB4 - Aux building flood FAC1 - Emergency Switchgear room chiller flood FTB1, FTB2 - Turbine building flood The SG1 and SG3 steam generator tube rupture fault trees were revised to improve the modeling of the check valves in the steam generator lines to the decay heat release valve.

The EHI, EHA, EJ1 and EJA fault trees were revised to improve the modeling of the vital bus inverter.

Common cause failure (CCF) basic events were added to the component cooling water CCI and CCA fault trees for the component cooling pumps.

The component cooling CC1 and CCA fault trees were also revised to add logic for recovery of component cooling to the RCP thermal barriers as part of the T4 initiating event.

• In response to changes in surveillance frequencies due to the implementation of improved technical specifications (ITS), all Type 2 basic events were reviewed and their frequencies revised in the fault trees. The majority of the changes were minor (e.g. changed 2160 hours0.025 days <br />0.6 hours <br />0.00357 weeks <br />8.2188e-4 months <br /> to 2208 hours0.0256 days <br />0.613 hours <br />0.00365 weeks <br />8.40144e-4 months <br /> for quarterly testing to be consistent with the ITS).

The 1997 North Anna PRA Model N7B calculated a core damage frequency of 3.5E-5/yr using average test and maintenance basic event unavailabilities.

Internal flooding initiating events were not included in this model. The following is a summary of the significant model changes made to the 1996 February NAPS PRA model that are reflected in the N7B model.

The T6 (loss of service water) event tree was revised to incorporate the unavailability of the service water (SW) during the loss of SW accident sequences.

The event tree functions were revised to quantify the respective fault trees with SW unavailable.

The T7 (steam generator tube rupture) event tree was modified to take into account the potential for the ruptured steam generator power operated relief valve (PORV) or a safety relief valve to reclose following success of cooldown function.

The HV (heating, ventilation, and air conditioning) fault tree was revised by removing the gate representing the HV initiating event. Since the T8 event tree was modified by modeling the loss of Unit 2 emergency switchgear room (ESGR) cooling explicitly in the event tree, the gate Page 7 of 11

combining the loss of Unit 1 and 2 ESGR cooling was removed. The function corresponding to the T8 initiating event was modeled in the IE-EQN tree similar to the IPE model.

The fault trees (FB4, HH1, and HR1) were revised to include the configuration where charging pump 1-CH-P-1C can be energized by either H or J buses. This configuration allows the 1C pump to start manually on the H bus when the 1A pump is unavailable, or on the J bus when the lB pump is unavailable.

The service water (SW) fault trees (1SW and 2SW) were revised to incorporate the assumption that the Unit 1 pumps are running and the Unit 2 pumps are in standby. The 1996 Feb model assumed the "A" SW train pumps to be running and the "B" SW train pumps to be in standby.

A new circulating water (CW) system fault tree is developed to model the condenser dependency on the CW pumps. CW system is needed to maintain condenser capacity to remove 40% of reactor rated power (about 1157 IW) when steam dump is needed.

The main steam fault tree (MS) was revised to include the steam valve failure due to the C9 interlock failure Since the internals of the service air system (SA) PCV valves 101 and 102 were removed to prevent valves from failing closed, these two basic events, 1SAPCV-FC-PCV101 and 2SAPCV-FC-PCV201, were deleted from the SA fault trees 1SA and 2SA.

Revised the reactor trip function in the RP100 fault tree to indicate that both MG set supply breakers have to be open to de-energize the control rods.

The dependency of the reactor coolant pumps on the component cooling was added to the model.

The dependency of the component cooling heat exchangers on the service water was added to the model.

The dependency of bearing cooling (BC) on the condensate pump oil cooler was included in the model.

The cross-tie between the Unit 1 and Unit 2 BC systems was failed, since this cross-tie is never expected to be used.

The valves supplying service water to instrument air compressors heat exchangers were added to the model.

Service water cooling to the Unit 2 charging pumps dependency was added to the model.

The cross-tie between the Unit 1 and Unit 2 charging pumps was added.

The model was revised to include only the Unit 2 charging pumps suction from the refueling water storage tank. The suction from the volume control tank was deleted.

The model was revised to include the ventilation dependency on the charging pump cubicles.

The 1996 February NAPS PRA model core damage frequency was 5.32E-5/yr using average test and maintenance basic event unavailabilities.

Internal flooding initiating events were not included in this model. The following is a summary of the significant model changes made to the 1995 June NAPS PRA model that are reflected in the 1996 February model.

Removed HEPs for 002, 003, 004, 006, 007, 0201, 0202, 0203 from fault tree lFT. These HEP basic events have been moved to the appropriate fault trees as discussed in the CH analysis file.

Removed HEPs for 002, 003, 004, 006, 007, 0201, 0202, 0203 from fault tree FF1. These HEP basic events have been moved to the appropriate fault trees as discussed in the CH analysis file.

Page 8 of 11

Stopped using functions Y01 and 001 since these functions had a value of 1.0. The event trees were revised to delete the sequence which have always been in the complement branch of these functions. The FF1 fault tree was revised to delete the unnecessary gates and the DATA.BED file revised to delete the basic events.

Function 003, D3-MLOCA, 1SI-2A, Q08 and VI01 are no longer utilized in the event trees.

These functions are no longer quantified.

Truncation limits for several functions were adjusted to minimize the model quantification time.

Renamed basic event F-EP-1OHR-V to 1RC-R-1-LOOP to replace the four electrical basic events previously used F-EP-lOHR-V Deleted electrical functions basic events (e.g., F-EP-1OHR-C, F-EP-10HR-V, etc) which are no longer necessary. Also deleted the corresponding gates from the FFT' fault tree and the basic events from the BED file.

The 1995 June NAPS PRA model calculated a core damage frequency of 4.08E-5/yr using average test and maintenance basic event unavailabilities.

Internal flooding initiating events were not included in this model.

The following is a summary of the significant model changes made to the 1994 January NAPS IPEEE PRA model that are reflected in the 1995 June model.

The EDG unavailability data was updated.

The EDG common cause modeling was simplified.

The alternate AC diesel generator was credited and included in the model.

The 1994 January NAPS Individual Plant Examination of External Events (IPEEE) model was created from the NAPS Individual Plant Examination (IPE). The updated internal events core damage frequency was not reported.

The following is a summary of the significant model changes made to the 1992 December NAPS IPE model that are reflected in the 1994 January NAPS IPEEE model.

The loss of service water initiating event frequency was reduced from 1.4E-4/yr to 2.3E-5/yr Thirteen human action recovery events were added to the model.

The 1992 December NAPS Individual Plant Examination (IPE) reported a core damage frequency of 7.1E-5/yr using average test and maintenance basic event unavailabilities, of which 6.8E-5/yr was due to internal initiating events (other than internal flooding), and 3.6E-6/yr was due to internal flooding initiating events.

12. Provide expanded discussion of the scope, level of detail of the North Anna PRA including the applicability of the North Anna PRA in assessing the proposed inverterAOTs. Provide a discussion on the programs to update and maintain the North Anna PRA to reflect current plant as-built conditions. With respect to peer review, provide additional details on the guidelines tsed and organizations employed.

Response

The North Anna PRA model NOAA used for the inverter analysis reflects the as-built, as-operated condition of the units. The inverters, voltage regulating transformers, and 120 VAC vital buses are all modeled at the component level in the NOAA model. All the dependencies affecting the 120 VAC vital buses and the systems dependent on the 120 VAC vital bus supplies, Page 9 of 11

which impact accident mitigating functions are explicitly included in the NOAA model. The NOAA model is a detailed, component level, internal initiating events Level 1 and large, early release PRA model. The NOAA model was updated in May 2002, and reflects plant specific unavailability data and failure rate data from the period January 1, 1997 through December 31, 1999. The NOAA model also includes an updated internal events flooding model, which had not been previously updated since the IPE.

A set of procedures was developed during the 1997 to 2000 time period to provide guidance for the maintenance and update of the PRA models (Dominion Nuclear Safety Analysis Manual -

Part IV, Chapter G, "PRA Model Update Tracking", Chapter J, "PRA Model Update Process" and Chapter K, "PRA Model Upgrade Process"). These procedures establish a model update frequency of every 36 months. The procedures also set time limits for the incorporation of updated PRA information into existing and prior risk-informed applications, such as prior risk-informed technical specification changes, MOV ranking, risk-informed ISI (for Surry), operator training, Maintenance Rule, and severe accident management guidelines (SAMGs). An update tracking item database was also implemented, which stores each of the open items that will require a PRA change and their ultimate resolution. A rigorous system for PRA software and model control also exists. Updates to the IPE Level 1 internal events models were subsequently made in 1995 (to support the 14 day EDG Allowed Outage Time change submittal), 1996, 1997, and 2002, respectively. The Level 2 model was updated, for both North Anna and Surry as a common analysis, in late 2000. All of the PRA model updates were documented per Appendix B QA requirements. The PRA documentation consists primarily as a library of calculation files.

For a given system model, there will be the original IPE calculation file, supplemented with a series of revisions and addenda that describe various changes that have been made to the model, assumptions, data, and results.

A peer review of the North Anna PRA was conducted in July 2001 by seven qualified Westinghouse and utility participants using the peer review process developed by the Westinghouse Owners Group (WOG), which was consistent with the industry guidance in NEI-00-02, "Industry PRA Peer Review Process." The "A" and "B" level findings and observations from that peer review were all summarized in the license amendment request.

13. Was generic data or plant specific data (inverters, transformers) used in the evaluation of the risk impact of the proposed CT?

Response

Generic data was used in the PRA model for the inverters and transformers since these components are not risk-significant in the PRA model and are not included in the scope of Maintenance Rule data gathering.

14. Is there a cross-tie capabilityfrom the otherNorth Anna unitfor the 120v vitalAC bus?

Response

No.

Page 10 of 11

15. Were the risk impacts of diesel generators including diesel generator maintenance evaluated vith respect to the proposed completion times? DG completion times, for example?

Response

The risk impacts of emergency diesel generators (EDG) including diesel generator maintenance were evaluated in the inverter analysis as indicated in the responses to Questions #1 and #10 above.

Page 11 of 11