ML041210916

Technical Evaluation of Extending Division 1 and 2 Inverter Completion Time (CT)

ML041210916
Person / Time
Site:	Clinton
Issue date:	04/22/2004
From:	Andersen V, Burns E, Hable A, Lee L - No Known Affiliation
To:	AmerGen Energy Co, Office of Nuclear Reactor Regulation
References
C467030704-5827-04/22/04
Download: ML041210916 (131)

Text

TECHNICAL EVA L UA TION OF EXTENDING DIVISION 1 AND 2 IN VER TER COMPLETION TIME (CT)

Prepared for CLINTON POWER STATION AMERGEN FEBRUARY 2004

-. -. f.

SV

.v

v.

~ ~ ~ ~ ~ ~ ~ ~ ~

"~

.r

',1

• :.^

4.

rt-89s-1;

• -. '.c..

.e r.;700

¢ t ~.3..

",r

&_r

.iL tj S:,

.J.

t

-'~"

-;r 'AY1/4'_ -. rk3

r.

-r4

• .a.r.cs _r:

-- *j 2g r

% i r,.~

L 3

I ;..,,

t tiX f

r f t c;.,

.' tr r

.3-..r.;i

.3 q-....

F--r

?,~e~:bj

-l--i i9 IO~~~t3 r~

f

• r*-J.n

... --

• 5¢.:.

w I,r

.4.

I ii C.

3=

> -i

.f:T sj~ >

. ;e.t..t L

w l

I:

1 ~ I 2 § ttj ~

k~t ~;;:s~t2J.

I



2't.

3.

1

§.O::?I

cc 1K 1

37:it:c[ f

.3.-..**

3.* %-.fl-cC

.. *.3 V -

Clinton Inverter CT Extension TABLE OF CONTENTS Section Page ABSTRACT..................................................................................................................... iii

1.0 INTRODUCTION

1-1 1.1 Purpose.1-1 1.2 Background.1-2 1.3 Technical Specifications.1-4 1.4 Scope.1-5 1.5 PRA Quality.1-7 1.6 PRA Definitions.1-7 2.0 APPROACH.2-1 2.1 Plant Configuration.2-1 2.2 Evaluation Approach.2-3 2.3 Regulatory Guides.2-5 2.4 Calculations.2-9 3.0 CLINTON PRA MODEL 3-1 3.1 PRA Development.3-1 3.2 Comparison of Clinton PRA Model with IPE and IPEEE.3-2 3.3 Model Features (2003A)......................................................................... 3-3 3.4 Assumptions.3-6 3.5 PRA Model Quality.3-8 3.6 Uncertainty Evaluation.3-10 4.0 CONFIGURATION RISK MANAGEMENT PROGRAM INSIGHTS..

4-1 4.1 Configuration Risk Management Program (CRMP).4-1 4.2 Safety Benefits.4-2 4.3 Compensatory Measures.4-3 5.0 RESULTS 5-1 5.1 Regulatory Guides.5-1 5.2 Quantitative PRA Results: Regulatory Guideline 1.177.5-1 5.3 Regulatory Guide 1.174.5-2 5.4 Risk Assessments.

5-4 6.0 SENSITIVITIES.6-1 6.1 Identification of Sensitivity Cases to Support Decision Making.6-1 6.2 Process for Sensitivity Evaluation.6-3 6.3 Sensitivity Results.6-3 6.4 RAW Importance Measure.6-6 i

C467030704-5827.04/22/04

Clinton Inverter CT Extension TABLE OF CONTENTS (cont'd)

Section Paqe

7.0 CONCLUSION

S..............................

7-1 7.1 Evaluation of Risk Impact.........................

7-1 7.2 External Events and Shutdown.........................

7-2 7.3 Insights.........................

7-4 7.4 Future Plant Changes.........................

7-6

8.0 REFERENCES

8-1 Appendices Fae APPENDIX A APPENDIX B APPENDIX C APPENDIX D ASSESSMENT OF EXTERNAL EVENTS AND SHUTDOWN IMPACTS...........................................

A-1 CLINTON PRA QUALITY............................................................... B-1 SENSITIVITY CASE

SUMMARY

CALCULATION SHEETS..........

C-1 ASSESSMENT OF EXCESS CONSERVATISM IN SBO LERF ACCIDENT SEQUENCE CONTRIBUTION.......................... D-1 ii C467030704-5827-04,22/04

Clinton Inverter CT Extension ABSTRACT PURPOSE Consistent with the NRC's approach to risk-informed regulation, AmerGen has identified a particular Technical Specification requirement that is restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. The change is being proposed to support on-line maintenance of the NSPS (Nuclear System Protection System) inverters. This Technical Specification is the requirement for each of Division 1 and 2 NSPS Inverter Completion Times to be restricted to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The proposed change is to increase the inverter Completion Time (CT), from the currently specified 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days for Division 1 and Division 2.

The current Completion Time (CT) for restoration of an inoperable NSPS inverter is insufficient to support the required maintenance and post-maintenance testing windows.

The change will provide operational flexibility, allowing more efficient application of plant resources to safety significant activities. The change will allow performance of periodic NSPS inverter maintenance and post-maintenance testing on-line, reducing plant refueling outage duration, and improving NSPS bus inverter availability during shutdown.

The justification for extending the Completion Time for an inoperable NSPS inverter is based upon a risk-informed and a deterministic evaluation consisting of two main elements: 1) the availability of a separate transformer powering each NSPS bus, and 2) the application of the Configuration Risk Management Program (CRMP) while the NSPS inverter is inoperable for planned maintenance.

RISK INFORMED REGULATORY ENVIRONMENT Since the mid-1980s, the NRC has been reviewing and granting improvements to Technical Specifications (TS) that are based, at least in part, on probabilistic risk iii C467030704-5827-04122104

Clinton Inverter CT Extension assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PRA [probabilistic safety assessment] (1) or risk survey and any available literature on risk insights and PRAs.... Similarly, the NRC staff will also employ risk insights and PRAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

REGULATORY GUIDANCE The movement of the NRC to more risk-informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit changes to the plant design basis including Technical Specifications. As examples, Regulatory Guides 1.174 [2] and 1.177 [3] both provide mechanisms to demonstrate valuable PRA input for Technical Specification modification.

The NRC has specified in Regulatory Guides the risk measures that should be calculated to provide input into the decision making process. The risk measures chosen by the NRC in their Regulatory Guides include the following:

Core damage frequency (Regulatory Guide 1.174)

The LERF (Regulatory Guide 1.174)

The Incremental Conditional Core Damage Probability (ICCDP)

(Regulatory Guide 1.177)

The Incremental Conditional Large Early Release Probability (Regulatory Guide 1.177)

These values are all calculated with the latest Clinton PRA full power internal events model (2003A).

(1) The terms PRA and PSA are used interchangeably herein.

iv C467030704-5827-04122/04

Clinton Inverter CT Extension QUANTITATIVE RESULTS The quantitative results of the evaluation are shown in the table below:

RESULTS OF RISK EVALUATION FOR CLINTON INVERTER CT EXTENSION I Risk Significance l

Risk Metric I Risk Metric J

Guideline l

Results l

Guideline Met ACDFAVE

< 1.OE-06/yr 3.OE-08/yr Yes ALERFAVE

< 1.OE-07/yr.

4.OE-09/yr Yes ICCDPDrv1

< 5.OE-07 1.OE-07 Yes ICLERPD[Vl

< 5.OE-08 7.7E-09 Yes CCDPDv2

< 5.OE-07 Yes ICLERPDV 2

< 5.OE-08 Yes The results indicate that the individual inverter ICCDP and ICLERP are within the Regulatory Guide 1.177 guidelines. In addition, Regulatory Guide 1.174 acceptance guidelines (Region III: very small risk changes) are met with approximately an order of magnitude margin. The comparison of the CDF and LERF with the Regulatory Guide 1.174 guidelines is shown in Figures 1 and 2, respectively, for the most limiting of the NSPS inverters, i.e., Division 1.

It is recognized that the Division 1 NSPS inverter has a larger risk associated with its on-line maintenance out of service than the Division 2 NSPS inverter. Nevertheless, the associated risk for each is within the acceptance guidelines specified by the NRC in the applicable Regulatory Guides.

v C467030704-5827-04/22104

Clinton Inverter CT Extension to5 0L 0

10 -5 10 -6 I]

10-4 CDF D = Change in CDF for Extended CTs for inverters Division 1 and 2 Figure 1 Acceptance Guidelines* for Core Damage Frequency (CDF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

vi C467030704-5827-04122104

Clinton Inverter CT Extension U.

-J

• 10-6 10-7 REGION II1.

1 10-7 o

10-6 10-5 LERF--

Cl

= Change in LERF for Extended CTs for inverters Division 1 and 2 Figure 2 Acceptance Guidelines* for Large Early Release Frequency (LERF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

vii' C467030704-5827-04122104

Clinton Inverter CT Extension CONSIDERATIONS OF OTHER HAZARDS The Clinton plant risk due to internal fires was evaluated in 1995 as part of the CPS Individual Plant Examination of External Events (IPEEE) Submittal. [6]

EPRI FIVE Methodology and Fire PRA Implementation Guide screening approaches and data were used to perform the CPS IPEEE fire PRA study. The CDF contribution due to internal fires was calculated at 3.26E-6/yr.

The PSA for internal fires is subject to more modeling uncertainty than the internal events PSA evaluations. While the fire PSA is generally self-consistent within its calculational framework, the fire PSA calculated quantitative risk metric does not compare well with internal events PSAs because of the number of conservatisms that have been included in the fire PSA process. Therefore, the use of the fire PSA figure of merit as a reflection of CDF may be inappropriate. Any use of fire PSA results and insights should properly reflect consideration of the fact that the "state of the technology" in fire PSAs is less evolved than the internal events PSA.

It is calculated that the CPS fire IPEEE CDF would increase by 1-2% due to the inverter CT extension request. The ICCDP for the most limiting of the inverters (i.e., Division 1) is estimated at approximately 1.OE-9. These changes in risk metric would not change the conclusion of the analysis using the internal events PRA.

The Clinton seismic risk analysis was also performed as part of the Individual Plant Examination of External Events (IPEEE). [6]

Clinton performed a seismic margins assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation.

.viii C467030704-5827-04122/04

Clinton Inverter CT Extension The conclusions of the Clinton seismic risk analysis are as follows: [6]

"No improvements to the plant were identified as a result of the Seismic Margins Assessment... the plant was determined to be fully capable of attaining safe shutdown conditions after the Review Level Earthquake (RLE).

Based on a review of the Clinton IPEEE, the conclusions of the SMA are judged to be unaffected by the CT Extension of the NSPS Division 1 and 2 inverters. The inverter CT extension has no impact on the seismic qualifications of the systems, structures and components (SSCs).

(See Section 7 and Appendix A for further discussion of the seismic effects.)

The CPS IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards.

Based upon this review, it was concluded that CPS meets the applicable Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards.

Similar to the conclusions related to the seismic assessment, the inverter CT extension does not impact the conclusions of these external hazards assessment.

COMPETING RISK CONSIDERATIONS Shutdown safety benefits have not been quantified as part of this evaluation. However, to the extent that inverter maintenance performed on-line can reduce the amount of inverter unavailability incurred in a shutdown condition, the shutdown risk is decreased.

In addition, the increased Technical Specification Allowed Outage Time will result in reducing the possibility of incurring a forced shutdown due to an inverter failure at-power.

ix C467030704-5827-04/22/04

Clinton Inverter CT Extension COMPENSATORY MEASURES AND MANAGEMENT OF RISK Finally, a Configuration Risk Management Program (CRMP) will ensure that the plant state is monitored to minimize the risk impact of the change.

As part of the risk management program, certain additional types of items could be included in work planning to minimize any incremental risk.

These additional compensatory measures are identified in the License Amendment Request (LAR).

CONCLUSION The ICCDP and ICLERP for each inverter division are sufficiently below the guidelines of < 5.OE-07 and < 5.OE-08, respectively, to be able to call the risk change small.

Hence, the guidelines of Regulatory Guide 1.177 for the increased inverter CT have been met.

Furthermore, the evaluation of changes in CDF and LERF due to the expected increased inverter unavailability have been shown to meet the risk significance criteria of Regulatory Guide 1.174 with substantial margin. This calculation supports the increase in NSPS inverter CT (Division 1 and 2) from a quantitative risk-informed perspective consistent with the plant operational and maintenance practices.

In addition, the sensitivity evaluations performed to reflect possible variations in key parameters also demonstrate that the acceptance guidelines for RG 1.177 and RG 1.174 are met.

x C467030704-5827-04/22/04

Clinton Inverter CT Extension Section 1 INTRODUCTION 1.1 PURPOSE Consistent with the NRC's approach to risk-informed regulation, AmerGen has identified a particular Technical Specification requirement that is restrictive in its nature and, if relaxed, has a minimal impact on the safety of the plant. This Technical Specification is the requirement for Division 1 and 2 NSPS (Nuclear System Protection System)

Inverter Completion Time to be restricted to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The proposed change is to increase the Completion Time (CT), from the currently specified 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days.

The proposed changes to Technical Specifications will extend the allowable CT for the Required Actions associated with restoration of an inoperable Division 1 or 2 NSPS Inverter. The changes are being proposed to support on-line maintenance activities.

The current CT for restoration of an inoperable inverter (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) is insufficient in some cases to support the required maintenance and post-maintenance testing windows while Clinton is at power.

Implementation of this proposed CT extension to allow on-line maintenance will provide the following benefits:

Allow increased flexibility in the scheduling and performance of preventive maintenance.

Allow better control and allocation of resources.

Allowing on-line preventive maintenance provides the flexibility to focus more quality resources on required or elective inverter maintenance.

Avert unplanned plant shutdowns and minimize the potential need for requests for Notice of Enforcement Discretion (NOED). Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

1-1 C467030704-5827-04122104

Clinton Inverter CT Extension Improve inverter bus availability during shutdown Modes or Conditions.

This will reduce the shutdown risk associated with inverter maintenance and the synergistic effects on risk due to inverter unavailability occurring at the same time as other various activities and equipment outages that occur during a refueling outage.

Permit scheduling of inverter maintenance within the requested 7 day period.(1)

The proposed CT of 7 days is adequate(') to perform inverter maintenance. This time period has also been determined to be sufficient to perform normal preventive inverter inspections and maintenance, and to perform required post-maintenance and operability tests required to return the inverter to operable status.

The justification for extending the Completion Time for an inoperable NSPS inverter is based upon a risk-informed and a deterministic evaluation consisting of two main elements: 1) the availability of a separate safety-related constant voltage transformer (CVT) for each NSPS bus, and 2) the application of the Configuration Risk Management Program (CRMP) while the NSPS inverter is inoperable for planned maintenance.

1.2 BACKGROUND

Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it:

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PRA [probabilistic safety assessmentf) or risk survey and any available literature on risk insights and PRAs.... Similarly, the NRC staff will also employ risk insights and PRAs in evaluating Technical Specifications related submittals. Further, as a part (1) It is noted that it is AmerGen policy to schedule maintenance during on-line operations to be for no more than 50% of a CT. This provides margin to the time at which a window would be exceeded and shutdown would be required.

(2)

PRA and PSA are used interchangeably herein.

1-2 1-2 C467030704-5827-04/22/04

Clinton Inverter CT Extension of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, "Technical Specifications," in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision-making and regulatory efficiency. The PRA policy statement included the following points:

1.

The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

2.

PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

The movement of the NRC to more risk-informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit changes to the plant design basis including Technical Specifications. As examples, Regulatory Guides 1.174 [2] and 1.177 [3] both provide mechanisms to demonstrate valuable PRA input for Technical Specification modification.

Risk informed decision-making provides a process supportive of the efficient allocation of resources which includes effective and judicious maintenance to be performed safely during power operation.

Performance of maintenance on-line is a reflection of this allocation of limited resources and allows the shutdown outages (e.g., refuel or 1-3 C467030704-5827-04122104

Clinton Inverter CT Extension maintenance outages) to be better planned and supported within available resources.

This improves the utilization of resources for those many inspections and repairs that require shutdown conditions. An example of a task that may be removed from the busy outage planning and work load includes individual tasks such as inverter maintenance.

This can be performed in a well planned and executed manner with the full focus of the plant management team during at-power work weeks.

1.3 TECHNICAL SPECIFICATIONS The probabilistic analysis is based on the current Clinton Technical Specifications, which are summarized in Tables 1-1 and 1-2.

The applicable Technical Specifications currently in use for Clinton relative to the subject inverters are 3.8.7 and 3.8.8.

Table 1-1 T.S. 3.8.7 Modes 1. 2, and 3 Condition Required Action Completion Time Division 1 or 2 Restore Division 1 and2 2 Inverter Inoperable inverters to OPERABLE 24 Hours l_

status 1-4 C467030704-5827-04122/04

Clinton Inverter CT Extension Table 1-2 T.S. 3.8.8 Shutdown Modes 4 and 5 Condition l

Required Action Completion Time One or more required&

A.1 Declare affected required Immediately division inverters feature(s) inoperable.

inoperable OR A.2.1 Suspend CORE ALTERATIONS.

Immediately AND A.2.2 Suspend handling of irradiated Immediately fuel assemblies in the primary and secondary containment.

AND A.2.3 Initiate action to suspend Immediately operations with a potential for draining the reactor vessel.

AND A.2.4 Initiate action to restore required Immediately divisional inverters to OPERABLE status.

1.4 SCOPE This analysis is to address the adequacy of the proposed extension of Division 1 and 2 NSPS inverters' CT from the current 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days using the Clinton Probabilistic Risk Assessment (PRA) model.

The following scope of the at-power PRA models is included:

') One Divisional inverter capable of supplying one division of the Division 1 or 2 onsite Class 1E uninterruptible AC bus electrical power distribution subsystem(s) required by LCO 3.8.10, "Distribution Systems - Shutdown".

1-5 C467030704-5827-04122/04

Clinton Inverter CT Extension Internal Events: The 2003A model is enhanced from that used in the IPE. The CT risk impacts are included quantitatively.

Internal Floods: The 2003A model is enhanced from that used in the IPE. The CT risk impacts are included quantitatively.

Seismic Events: The seismic margins assessment is derived from the IPEEE. The safety impacts are assessed qualitatively.

Internal Fires: The internal fires are evaluated conservatively using IPEEE models and assumptions.

The risk due to internal fire contributors is assessed separately and shown to be small.

Other External Event Hazards:

Other External hazards are determined to be non-contributors based on an independent review of IPEEE results.

The NRC has specified in Regulatory Guides the risk measures that should be calculated to provide input into the decision making process. The risk measures chosen by the NRC in their Regulatory Guides include the following:

Core damage frequency (Regulatory Guide 1.174)

The LERF (Regulatory Guide 1.174)

The Incremental Conditional Core Damage Probability (ICCDP)

(Regulatory Guide 1.177)

The Incremental Conditional Large Early Release Probability (Regulatory Guide 1.177)

These values are all calculated with the latest Clinton PRA model (2003A).

The risk associated with plant shutdown (outages) is expected to decrease as a result of the change in at-power CT for the inverters. This change will allow moving the inverter unavailability time from the outage to an at-power work week. To the extent that inverter maintenance performed on-line can reduce the amount of inverter unavailability incurred in a shutdown condition, the shutdown risk is decreased. This risk reduction is discussed in Section 4.3.

1-6 C467030704-5827-04/22I04

Clinton Inverter CT Extension 1.5 PRA QUALITY The Clinton PRA is a state-of-the-technology tool developed consistent with current PRA methods and approaches.

The Clinton PRA is derived based on realistic assessments of system capability over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the PRA analysis. Therefore, PRA success criteria may be different than the design basis assumptions used for licensing Clinton.

This report examines the risk profile changes from this realistic perspective to identify changes in the risk profile on a best estimate basis that may result from postulated accidents, including severe accidents.

The quality of the CPS PRA models used in performing the risk assessment for the CPS inverter completion time is manifested by the following:

• Sufficient scope and level of detail in the PRA

• Active maintenance of the PRA models and inputs

• Comprehensive Critical Reviews Section 3.5 and Appendix B provide summaries of the attributes of PRA quality that support the use of the PRA for the inverter completion time risk assessment.

1.6 PRA DEFINITIONS The following PRA terms are used in this study:

CDF - Core Damage Frequency (CDF) is a risk measure for calculating the frequency of a severe core damage event at a nuclear facility.

Core damage is the end state of the Level 1 Probabilistic Risk Assessment (PRA). For the purposes of the Level 1 PSA a surrogate has been developed that can be used as a first approximation to define the onset of core damage.

The onset of core damage is defined as the time at which more than two-thirds of the active fuel becomes uncovered, without sufficient injection available to recover the core quickly, i.e., water level below one-third core 1-7 C467030704-5827-04122/04

Clinton Inverter CT Extension height and falling plus calculated peak core temperatures from MAAP greater than 1800OF for more than 10 min.

CDF is calculated in units of events per year.

LERF -

Large Early Release Frequency (LERF) is a risk measure for calculating the frequency of an offsite radionuclide release that is HIGH in fission product magnitude and EARLY in release timing. A HIGH magnitude release is defined as a radionuclide release of sufficient magnitude to have the potential to cause early fatalities (as defined in CPS PRA, such a release is a release of >10% volatile fission products). An EARLY timing release is defined as the timing in which minimal offsite protective measures can be implemented (as defined in CPS PRA, such a release occurs within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after declaration of a General Emergency). LERF is calculated in units of events per year.

Initiating Event - Any event that causes a scram (e.g., Loss of Feedwater) and requires the initiation of mitigation systems to reach a safe and stable state. An initiating event is modeled in the PRA to represent the primary transient event that can lead to a core damage event given failure of adequate mitigation systems (i.e., adequate with respect to the transient in question).

Internal Events - Those initiating events caused by failures internal to the system boundaries.

Examples include Loss of Feedwater, Loss of Instrument Air, Loss of Offsite Power, and internal floods External Events - Those initiating events caused by failures external to the system boundaries. Examples include fires, seismic events, and tornadoes.

HEP - Human Error Probability (HEP) is the probabilistic estimate that the operating crew fails to perform a specific action (either properly or within the necessary time frame) to support accident mitigation.

The HEP is calculated using industry methodologies and considers a number of performance shaping factors such as:

training of the operating crew, availability of adequate procedures, time required to perform action time available to perform action stress level while performing action 1-8 C467030704-5827-04/22/04

Clinton Inverter CT Extension MAAP - The Modular Accident Analysis Package (MAAP) is an industry recognized thermal hydraulic code used to evaluate design basis and beyond design basis accidents. MAAP can be used to evaluate thermal hydraulic profiles within the primary system (e.g., RPV pressure, boildown timing) prior to core damage. MAAP also can be used to evaluate post core damage phenomena such as RPV breach, containment mitigation, and offsite radionuclide release magnitude and timing.

Level 1 PRA - The Level 1 PRA is the evaluation of accident scenarios that begin with an initiating event and progress to core damage. Core damage is the end state for the Level 1 PRA. The Level 1 PRA focuses on the capability of plant systems to mitigate a core damage event.

Level 2 PRA - The Level 2 PRA is a continuation of the Level 1 PRA evaluation. The Level 2 PRA begins with the accident scenarios that have progressed to core damage and evaluates the potential for offsite radionuclide releases. Offsite radionuclide release is the end state for the Level 2 PRA. The Level 2 PRA focuses on the capability of plant systems (including containment structures) to prevent a core damage event from resulting in an offsite release.

RAW - The Risk Achievement Worth (RAW) is the calculated increase in a risk measure (e.g., CDF or LERF) given that a specific system, component, operator action, etc. is assumed to fail (i.e., failure probability of 1.0). RAW is presented as a ratio of the risk measure given the component is failed divided by the risk measure given the component is assigned its base failure probability.

FV - The Fussell-Vesely'(FV) importance is a measure of the contribution of a specific system, component, operator action, etc. to the overall risk. F-V is presented as the percentage of the overall risk to which the component failure contributes.

In other words, the F-V importance represents the overall decrease in risk if the component is guaranteed to successfully operate as designed (i.e., failure probability of 0.0).

Cutset - A cutset is a mathematical combination of initiating events, operator errors, phenomenological effects, equipment unavailabilities, and/or equipment failures required to reach a defined end state or risk measure (e.g., core damage or radionuclide release). A cutset always starts with an initiating event and is combined with subsequent system failures that result in an undesirable end state. A cutset is assigned a calculated frequency based on the value of the initiating event frequency multiplied by the probabilities of the subsequent events. CDF (and LERF) is based on the Boolean sum total of the cutsets.

1 -9 C467030704-5827-04/22/04

, Clinton Inverter CT Extension Section 2 APPROACH The risk impact associated with the extension of the Division 1 and 2 NSPS Inverter Completion Times (CT) has been examined from a number of different view points:

Internal Events External Events Low Power / Shutdown Risk This examination includes qualitative and quantitative analysis as supported by available Clinton specific PRA models. The quantitative evaluation of the risk impact on Clinton associated with inverter maintenance for comparison with NRC acceptance guidelines is calculated using the updated Clinton full power internal events PRA model (Model 2003A).

2.1 PLANT CONFIGURATION 2.1.1 Inverters Inverters are the preferred source of power for the uninterruptible AC buses (1A, 11B, 1C, and 1D) and the Reactor Protection System (RPS) solenoid buses because of the stability and reliability they achieve. There is one inverter per uninterruptible AC bus, making a total of four divisional inverters and one inverter per RPS solenoid bus, making a total of two RPS solenoid bus inverters. The function of the inverter is to provide AC electrical power to these buses.

The divisional inverters contain a solid-state transfer switch to automatically transfer to an alternate source if the inverter detects abnormal conditions, such as an internal inverter component failure or for handling fault clearing or inrush current demands.

2-1 c467030704-5827-04,22/04

Clinton Inverter CT Extension There are four safety related Nuclear System Protection System (NSPS) buses. These buses provide initiation and trip logic signals for the ECCS systems and containment isolation.

The four safety-related 120 volt inverter buses are to support the Nuclear System Protection System instruments. Each has its own inverter supplied from a separate DC bus. There is an alternate supply to each of these NSPS buses from a safety-related AC bus. Each inverter contains a solid-state transfer switch to select the NSPS bus supply. The DC bus through the inverter is the normal supply.

However, if it is unavailable or not within specifications, the solid-state transfer switch will shift to the alternate AC source automatically. In addition, there is a manual bypass switch to the alternate AC source that is used during maintenance alignments or can be used if the solid-state transfer switch fails.

The DC source provides an uninterruptible power source for the instrumentation and controls for the RPS, the Emergency Core Cooling Systems (ECCS) initiation, miscellaneous isolations, and the RPS and main steam isolation valve (MSIV) solenoids.

NSPS Divisions 1C and 1D support HPCS which already have a 14 day CT in the Technical Specifications.

NSPS Divisions 1A and 1 B have a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> CT Technical Specification and they support the ECCS initiation and trip logic on Divisions 1 and 2. These divisional inverters are the subject of this analysis.

2.1.2 Maintenance Rule Interface In accordance with NUMARC 93-01,

'Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants," the inverters are considered risk significant and therefore the reliability and unavailability of the inverters are monitored to demonstrate that their performance is adequate.

2-2 C467030704-5827-04/22/04

Clinton Inverter CT Extension All 4 divisions of NSPS inverters and the parallel transformers are considered risk significant in the CPS Maintenance Rule. (Reference maintenance rule functions IP A, B, C, D and IP-02-A, B, C, D.)

2.2 EVALUATION APPROACH Clinton shall continue to minimize the time periods to complete any unplanned maintenance. Plant configuration changes for planned and unplanned maintenance of the inverters as well as the maintenance of equipment having risk significance is managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident.

The proposed changes are evaluated to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) or large early release frequency (LERF) is small and consistent with the NRC Safety Goal Policy Statement, USNRC, 'Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p.42622, August 16, 1995.

The justification for the use of a Division 1 and 2 inverter extended CT is based upon risk informed and deterministic evaluations consisting of three main elements:

1.

The availability of the alternate power source to the inverter bus

2.

Verification that the opposite division is operable, and

3.

Implementation of the CRMP while an inverter is in an extended CT.

The CRMP is used for all work and helps ensure that there is no significant increase in the risk of a severe accident while any inverter maintenance is performed.

These elements provide adequate justification for approval of the requested Technical Specification change by providing a high degree of assurance that one division of UPS can be provided to the ESF buses during all Design Basis 2-3 C467030704-5827-04/22/04

Clinton Inverter CT Extension Accidents (DBAs) Station Black-out (SBO) and 10 CFR 50 Appendix R fire during the inverter extended CT.

The modeling approach is consistent with the NRC guidance for the calculation of the requested risk measures using the Clinton PRA for internal events and internal floods.

Regulatory Guide 1.177 is followed to calculate the change in risk measures:

ICCDP ICLERP These conditional probabilities are performed to calculate the risk change while in the inverter CT.

These are calculated for each inverter case.

An integrated assessment of the impact of the CT extension is calculated using the PRA and including the inverter unavailability for 7 days per cycle per inverter. This calculation can then be used in comparison with the criteria set in Regulatory Guide 1.174.

Regulatory Guide 1.174 has acceptance guidelines which are described in SECY 99-246 as "trigger point" at which questions are raised as to whether the proposed change provides reasonable assurance of adequate protection.

The effect of risk changes during shutdown are not explicitly included in the quantification.

To the extent that maintenance performed on-line can reduce the amount of maintenance unavailability incurred in a shutdown condition, the shutdown risk is decreased. By not including the risk benefit associated with the outage safety improvement, the risk results reported will be conservative. Section 4.3 provides a discussion of the safety improvements associated with performing the inverter maintenance on-line.

2-4 C467030704-5827-04/22104

Clinton Inverter CT Extension 2.3 REGULATORY GUIDES To determine the effect of the proposed 7 day CT(1) for an inverter, the guidance suggested in Regulatory Guides 1.174 and 1.177 is used. Thus, the following risk metrics are used to evaluate the risk impacts of extending the inverter CT from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days:

a CDFAVE

= change in the annual average CDF due to any increased on-line maintenance unavailability of inverters that could result from the increased CT. This risk metric is used to compare against the criteria of Regulatory Guide 1.174 to determine whether a change in CDF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFBASE.

a LERFAvE = change in the annual average LERF due to any increased on-line maintenance unavailability of inverters that could result from the increased CT.

Regulatory Guide 1.174 criteria were also applied to judge the significance of changes in this risk metric.

ICCDP(lnverter A7 = incremental conditional core damage probability with inverter Y out-of-service for an interval of time equal to the proposed new CT (7 days). This risk metric is used as suggested in Regulatory Guide 1.177 to determine whether a proposed increase in CT has an acceptable risk impact.

ICLERP{Inverter Y)

= incremental conditional large early release probability with inverter Y out-of-service for an interval of time equal to the proposed new CT (7 days).

Regulatory Guide 1.177 criteria were also applied to judge the significance of changes in this risk metric.

() The evaluation of the CT conservatively assumed that each inverter would be unavailable for 7 days per fuel cycle. It is noted that AMERGEN policy is not to voluntarily enter a Completion Time allowed by Technical Specification unless the prescribed maintenance can be performed within % the Completion Time (in this case 3 %/ days).

2-5 C467030704-5827-04122104

Clinton Inverter CT Extension The evaluation of the above risk metrics was performed as follows assuming that Division 1 and 2 NSPS inverters undergo a planned maintenance outage of the full 7 days each fuel cycle. (Clinton is transitioning to a 24 month fuel cycle.)

It is noted that Amergen policy is not to voluntarily enter a Completion Time allowed by Technical Specifications unless the prescribed maintenance can be performed within 1/2 the Completion Time (in this case 3 Y days).

The change in the annual average CDF due to the change in the inverter CT, ACDFAVE, was evaluated by computing:

CDFAVE =7 TCDFi oos +(

TCDFY oos

+ IlTI J CDFb.,~

[Eq. 1]

(

CYCLE)

E.1 where:

CDFBASE = baseline annual average CDF with average unavailability of inverters consistent with the current inverter CT. This is the CDF result of the current baseline PRA.

CDF, oos = CDF evaluated from the PRA model with the NSPS inverter Division 1 out-of-service and compensating measures for inverter Division I implemented.

These compensating measures include prohibiting concurrent maintenance or inoperable status of any of the remaining inverters at the site as well as other compensating measures identified in this evaluation.

CDF2_0os = CDF evaluated for the PRA model with the NSPS inverter Division 2 out-of-service and compensating measures for the Division 2 inverter implemented. These compensating measures include prohibiting concurrent maintenance or inoperable 2-6 C467030704-5827-04122/04

Clinton Inverter CT Extension status of any of the remaining inverters at the site as well as other compensating measures identified in this evaluation.

T, = Total time per fuel cycle (TcYCLE) that NSPS inverter Division 1 is out-of service for the extended CT T2 = Total time per fuel cycle (TcYCLE) that NSPS inverter Division 2 is out of service for the extended CT CDF7da CDF 7days 7 days 699.6 days 699.6days CDF.. x 685.6 days

[Eq.2]

699.6 days ACDFAVE = CDFAM -

CDFBASE

[Eq.3]

where, CDFAVE = Average CDF over a "typical" fuel cycle ACDFAVE = Difference between CDF with current technical specifications on Inverters and the CDF for an average full cycle with the inverter CT extended to 7 days.

A similar approach was used to evaluate the change in the average LERF due to the requested CT, ALERFAVE:

LERFAvE=(TCYC.

LERF,..Q 0 + TCYCLE LERF2- 0,

+(1-T>' 2 JLERFBASE

[Eq.4]

TC. LE 2-7 C467030704-5827-04/22/04

Clinton Inverter CT Extension where:

LERFBASE = baseline annual average LERF with average unavailability of Inverters consistent with the current inverter CT. This is the LERF result of the current baseline PRA. It has been found to include substantial excess conservatism. A correction to remove excess conservatisms as discussed in Appendix D is found to be a factor of 0.44 multiplied by the base LERF. (See discussion under CDFo and above.)

LERF1.oos = LERF evaluated from the PRA model with the NSPS Inverter Division 1 out of service and compensating measures for inverter NSPS Inverter Division 1 implemented.

These compensating measures include prohibiting concurrent maintenance or inoperable status of any of the remaining inverters at the site as well as other compensating measures identified in this evaluation.

LERF2 Oos = LERF evaluated for the PRA model with the NSPS Inverter Division 2 out of service and compensating measures for NSPS Inverter Division 2 implemented.

These compensating measures include prohibiting concurrent maintenance or inoperable status of any of the remaining inverters at the site as well as other compensating measures identified in this evaluation.

ALERFAJvE = (LERFXtE - LERFEAsE)

• 0.44( )

[Eq. 5]

The evaluation was performed based on the assumption that the extended CT would be applied to only one major overhaul per inverter per refueling cycle, hence T1.oos =

T2-0Os = 7 days. The cycle time is based on the current 24 month fuel cycle and an assumed total planned and unplanned outage duration of 30.4 days, which yields TCYCLE

= 699.6 days. Note that the above formula for ACDFAVE conservatively neglects the decrease in CDF contributions from accidents initiated during shutdown that will be This base LERF value is from the 2003A model. It has been found to include substantial excess conservatism. A correction to remove excess conservatisms as discussed in Appendix D is found to be a factor of 0.44 multiplied by the base LERF.

2-8 2C467030704-5827-04/22104

Clinton Inverter CT Extension associated with increased inverter availability of the subject inverters during shutdown periods.

The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using their definitions in Regulatory Guide 1.177. In terms of the above defined parameters, the definition of ICCDP is as follows:

ICCDPDivl (CDF,.oos - CDFBASF)TCT

[Eq. 6]

1CCDPDv,= (CDF,.oos - CDFBASF) * (7 days) * (365 dayslyear)-'

[Eq. 7]

ICCDPD1 vl (CDFoos - CDFBASF)

• 1.92 x 1 0years

[Eq. 8]

Note that in the above formula 365 days/year is merely a conversion factor to provide the CT units consistent with the CDF frequency units.

The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended CT. This should not be confused with the evaluation of ACDFAVE in which the CDF is averaged over a 24 month refueling cycle.

Similarly, ICLERP is defined as follows:

JCLERPDn',l = (LERF,.oos - LERFBAsE)

• 0.44

• 1.92 x 10-2years

[Eq.9]

2.4 CALCULATIONS Table 2.4-1 summarizes input unavailabilities for key components and how they are to be treated for each of the "cases".

Table 2.4-2 summarizes the calculated CDF and LERF values from the Clinton PRA model (2003A).

2-9 C467030704-5827-04122104

Clinton Inverter CT Extension Table 2.4-3 presents the calculations of the change in CDF for use in comparison with the Regulatory Guide 1.174 guidelines or trigger levels.

Table 2.4-4 presents the calculations of the change in LERF for use in comparison with the Regulatory Guide 1.174 guidelines or trigger levels.

Table 2.4-5 presents the calculations for ICCDP for each of the inverter CTs for use in comparison with the Regulatory Guide 1.177 guidelines or trigger levels.

Figure 2.4-1 provides representative risk profiles before and after the proposed inverter technical specification change.

2-10 C467030704-5827-04122104

Clinton Inverter CT Extension Table 2.4-1 NSPS INVERTER MAINTENANCE UNAVAILABILITIES FOR CALCULATIONS Planned Maintenance Unavailabilities to be Imposed Case Inverter Div 1 Unavailable Inverter Div 2 Unavailable II CDF,.oos (3)

I.OE-2(')

0 CDF20cos )

0 1.0E-2(')

CDFBASE 2)

Random(2)

Random(2)

(1) 7 days 23 months

=7 das 699.6 days

=

1.0E-2 (2)

Inverter Planned Extended Maintenance Unavailability Set to Zero. This case is considered representative of current plant operation. All other maintenance events set at these annualized values.

I (3) The quantitative evaluation performed here uses the Clinton model with the historical maintenance unavailability terms included in the model. This results in a higher calculated configuration specific CDF and LERF for the evaluated cases with the inverters unavailable.

This results in slightly conservative calculated risk metrics.

This assumption is acceptable because of the demonstrated margin to the acceptance guidelines.

2-11 C467030704-5827-04122/04

Clinton Inverter CT Extension Table 2.4-2 PRA MODEL RESULTS FOR THE RISK METRIC CALCULATIONS Frequency Frequency CDF (Per Rx Yr)(')

LERF (Per Rx Yr)(2)

CDFI oos1.52E-5(3)

LERF1.00s 5.02E-7(2)

CDF2.oos 9.97E-6(3) (4)

LERF2.00 5 9.86E-8(2)

CDFBASE 9.97E-6(3)

LERFBASE 9.86E-8 2 )

(1) All CDF estimates based on Single Top model at a truncation of 3E-1 1/yr.

) All LERF estimates based on Single Top model at a truncation of 5E-1 1/yr. As modified by Appendix D to remove excess conservatisms.

(3) The asymmetry between CDF,.00 s and CDF2.00s is due to a plant design asymmetry. The Division 1 inverter supports RCIC. RCIC tends to be a mitigation system in SBO related events such that the impact of the Division 1 inverter is greater than Division 2.

(4) CDF2.00s is reported as the same value as CDFBase.

Model quantification shows the difference between CDF2.00 s and CDFBase to be less than 3.1E-1 0/yr.

2-12 C467030704-5827-04122104

Clinton Inverter CT Extension Table 2.4-3 CDF CALCULATIONS FOR CLINTON Average CDF after CT Extension Included

[Use Eq. 2]

CDFAVE = 1.52E-5/yr

• 1.0E-2 + 9.97E-6/yr

• 1.0E-2

+ 9.97E-6/yr

• 0.98 CDFAVE = 1.52E-7/yr + 9.97E-8/yr + 9.77E-6/yr CDFAVE = 1.OOE-5/yr Change in CDF

[Use Eq. 3]

ACDFAVE = CDFAVE CDFBASE ACDFAVE = 1.OOE-5/yr -- 9.97E-6/yr' ACDFAvE = 3.OE-8/yr 2-13 C467030704-5827-04/22104

Clinton Inverter CT Extension Table 2.4-4 LERF CALCULATIONS FOR CLINTON Average LERF(1 ) after CT Extension Included

[Use Eq. 4]

LERFAvE(1) = 5.02E-7/yr

• 1.OE-2 + 9.86E-8/yr

• 1.0E-2

+ 9.86E-8/yr

• 0.98 LERFAvE = 5.02E-9/yr + 9.86E-10/yr + 9.86E-8/yr LERFAvE(1) = 1.025E-7/yr Change in LERF

[Use Eq. 5]

ALERFAVE = 1.025E-7/yr - 9.86E-8/yr ALERFAvE = 4.OE-9/yr

') For these calculations the LERF inputs have included the 0.44 factor to remove some of the excess conservatisms in the 2003A LERF model as described in Appendix D.

2-14 C467030704-5827-04122/04

Clinton Inverter CT Extension Table 2.4-5 ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP Division 2: ICCDP

=

(CDF1.Oos - CDFBASE)

• 1.92E-2yr

=

(1.52E-5/yr - 9.97E-6/yr)

• 1.92E-2yr

=

1.OE-7

=

(CDF2.oos - CDFBASE)

• 1.92E-2yr

=

E ICLERP CALCULATION

[Eq. 9]

Division 1: ICLERP(1) = (LERFi.oos - LERFBase) I 1.92E-2yr

= (5.02E-7/yr-9.86E-8/yr). 1.92E-2yr

= 7. 7E-9 Division 2: ICLERP(1) = (LERF2 -oos - LERFBase)

• 1.92E-2yr

=

1) For these calculations the LERF inputs have included the 0.44 factor to remove some of the excess conservatisms in the 2003A LERF model as described in Appendix D.

2-15 C467030704-5827-04/22104

Clinton Inverter CT Extension BEFORE INVERTER COMPLETION TIME CHANGE AL C

F CDFBASE I -

J. -

T Refuel AFTER INVERTER COMPLETION TIME CHANGE CDF1.oos CDF 2oos C

D F

T T

Refuel Figure 2.4-1 Typical Fuel Cycle Evaluation Used for Regulatory Guide 1.174 Evaluation 2-16 C467030704-5827-04/22/04

Clinton Inverter CT Extension Section 3 CLINTON PRA MODEL 3.1 PRA DEVELOPMENT Maintenance of Model, Inputs, Documentation The Clinton Power Station (CPS) PRA model and documentation has been maintained living and is routinely updated to reflect the current plant configuration following refueling outages and to reflect the accumulation of additional plant operating history and component failure data.

The Level 1 and Level 2 CPS PRA analyses were originally developed and submitted to the NRC in September 1992 as the Clinton Power Station Individual Plant Examination (IPE) Submittal. The CPS PRA has been updated many times since the original IPE. A summary of the CPS PRA history is as follows:

• CPS IPE (September 1992)

• Revision 1 (April 1994)

• Revision 2 (January 1995)

• Revision 3 (June 2000)

• Revision 3a (December 2000)

• Revision 2003A (August 2003)

The latest PRA update (2003A) includes the incorporation of all the "A" PRA Peer Review Fact and Observations (F&Os) and the risk significant "B" F&Os. The PRA Peer Review is discussed in Appendix B. The latest PRA update also includes the effects of the Extended Power Uprate of 20%.

In addition to incorporating recent advances in PRA technology across all elements of the PRA, a-special effort was made to ensure that those aspects of the PRA that are potentially sensitive to changes in inverter maintenance unavailability are adequate to evaluate the risk impacts of the increased completion times (CTs) for the inverters.

3-1 C467030704-5827-04122/04

Clinton Inverter CT Extension These elements include the proper characterization of initiating events involving loss of offsite power, treatment of time dependent offsite power recovery, treatment of operator actions to implement emergency operating procedures, and data analysis of key parameters such as diesel generator failure rates, maintenance unavailabilities, and common cause failure probabilities.

The external event contributions to the PRA model reassessment are described in Appendix A and include the following external event challenges:

Seismic Fire Others -- screened out The internal flood evaluation has been quantitatively included in the PRA.

For the Level 2 analysis (i.e., the containment analysis), LERF was calculated using an approach based on a detailed containment event tree.

This approach to LERF evaluation supports a realistic quantification of contributions to containment failure and radionuclide release.

3.2 COMPARISON OF CLINTON PRA MODEL WITH IPE AND IPEEE The following subsections discuss some of the key considerations in the IPE model in comparison with the current Clinton PRA model.

3.2.1 IPE Model Update The Clinton IPE internal events model has been substantially enhanced to more accurately reflect the plant dependencies, operator actions, procedures, and the latest thermal hydraulic analysis.

See Section 3.3 regarding the principal model feature changes.

3-2 C467030704-5827-04/22104

Clinton Inverter CT Extension 3.2.2 External Events Refer to Appendix A for further details on the IPEEE seismic and internal fire analysis.

3.2.2.3 Other External Events Extreme winds, external floods, and other external events (e.g., aircraft impact, transportation accidents, etc.) were also assessed in the IPEEE study and included in the Clinton IPEEE Submittal. These hazards were determined to be not significant contributors to total plant risk and no potential vulnerabilities were identified. Therefore, the requested inverter CT extension has a negligible effect on the risk profile at Clinton from these other external events. Quantification of such accident sequences is not explicitly included in the accident sequence quantification of this assessment. (See Appendix A) 3.2.4 Shutdown There have not been any requirements to develop a shutdown PRA quantitative model as there has been for full power operation. Nevertheless, Clinton has a CRMP program and qualitative model to assess the safety functions for shutdown to assure adequate defense-in-depth during operations at shutdown. In any event, if inverter overhauls are moved to at-power plant configurations, this would result in safety improvements during shutdown. These improvements are not quantified in the enclosed assessment.

3.3 MODEL FEATURES (2003A) 3.3.1 Base Model The CPS 2003A PRA model, which is used to evaluated the inverter Completion Time (CT) extension, has been updated in a number of important areas, for example:

3-3 C467030704-5827-04/22/04

Clinton Inverter CT Extension Extended Power Uprate The success criteria and HRA timing and resulting HEP values have been updated to be consistent with operation at the 20% uprated power level.

Data Extensive plant specific data has been added to the model to increase the fidelity of the operating plant with the model.

Modeling The model has been converted to CAFTA-based software for model quantification.

• Critical Reviews The risk significant findings from the PRA Peer Review using NEI 00-02 have been incorporated.

3.3.2 CT Model Modifications The impacts associated with the inverter on-line maintenance configuration show up in multiple contributors to the risk spectrum.

These risk contributors are assessed quantitatively to determine their impact relative to NRC criteria.

The model effects include the following:

• Spurious Scram (Turbine Trip): There is a potential to increase the spurious turbine trip initiating event frequency due to the reduced redundancy in the scram logic power supply. Specifically, a failure of the AC supply to the NSPS bus when an inverter is OOS will result in introducing a half scram.

If a latent scram signal from the other division exists, then a spurious scram transient will be introduced.

Therefore, the probability of this spurious turbine trip initiator is modeled as a potential increase in scram challenges when the inverter is OOS.

• Spurious Scram (MSIV Closure): The failure of one NSPS bus results in de-energization of the associated divisional leak detection 3-4 C467030704-5827-04/22104

Clinton Inverter CT Extension (temperature sensors) logic powered from the associated division.

This satisfies part of the logic for an MSIV closure signal.

MSIV closure can be induced by the high temperature logic if an NSPS Division (1 or 2) is lost and a latent high temperature trip occurs due to a failure or set point drift. Therefore, the probability of this spurious MSIV closure initiator is modeled as a potential increase in reactor isolation scram challenges when the inverter is OOS.

Equipment Failure:

With the inverter OOS, the reliance on the AC power source for the NSPS divisional bus means that failures that defeat AC power will result in failures of the systems dependent on the bus. This is important for RCIC that is modeled as dependent on Division 1 NSPS, but does not otherwise have an immediate dependency on Division 1 AC. Therefore, the loss of NSPS 1A results in RCIC unavailability. This condition applies to both spurious initiators with the alternate supply failed (AC) and SBO events where AC fails due to source failures. Other divisional core cooling systems have a direct and immediate dependency on AC power and would fail during SBO scenarios regardless of the status of the NSPS inverters and therefore have less impact on the results of this study.

Partial effects on failure to scram sequences result if AC power or transformer 1A (1 B) becomes unavailable:

SDV high water level Div 1 (Div 2) float switch disabled Div I (Div 2) end of cycle (EOC) RPT trip logic power loss disables CB 3A (3B) breaker. The EOC RPT results in recirc run back and is not the ATWS RPT that is used to ensure reactivity control under failure to scram conditions.

Backup scram valve 'A" ("B") fails closed Scram reset push-button (cannot be reset)

These impacts are treated in surrogate fashion through revisions to the failure to scram conditional failure probabilities given NSPS failure.

Partial effects on other equipment also result if AC power or transformer 1A (1 B) becomes unavailable:

Auto start of DG 1 (2) on LOCA signal disabled For Div 1: LPCI "A" and LPCS LOCA initiation logic fails in non-tripped condition For Div 2:

RHR "B" and UC" LOCA initiation logic fails in non-tripped condition 3-5 C467030704-5827-04/22/04

Clinton Inverter CT Extension This means that the auto initiation logic is unavailable for the ECCS if the AC power source or transformer fails. This manual backup is modeled as ineffective.

• Main Condenser: Both condenser mechanical vacuum pumps will trip if Div 1 NSPS is de-energized.

However, the SJAE provides condenser vacuum under power operation and unavailability of the mechanical vacuum pumps has little impact on the severe accident sequences.

Automatic Div 1 (2) ADS logic initiation signals are dependent on NSPS 1A and 1B, respectively. The CPS PRA models the manual initiation of SRVs using SRV hand switches with their appropriate dependency on the Div 1 and 2 125 VDC buses. Automatic ADS logic is inhibited as part of the EOPs.

Therefore, the ADS logic signal dependence on NSPS does not play a role in the PRA evaluation.

3.4 ASSUMPTIONS The assumptions used in the Clinton PRA evaluation include the following:

The PRA models used in this evaluation assume a particular plant configuration with respect to the normally running or standby status in the base model and for the CT models. It is not expected that the conclusions of this evaluation would be affected by alternate configurations of these normally running systems. In practice, it is expected that the application of the Configuration Risk Management Program will ensure that any unfavorable combinations of alignments and out of service conditions do not have significant risk impacts.

Major overhauls of the inverter on line within the extended CT will only occur at most once per inverter per fuel cycle and will be completed within the requested 7 days. Compensatory measures are included in the proposed plans. These compensatory measures include the fact that other risk significant systems will not be OOS when the CT is entered nor will they voluntarily be removed from service during the CT. These compensatory measures have conservatively not been included in the risk metric calculations. This modeling assumption results in higher ACDF, ALERF, ICCDP, and ICLERP.

3-6 C4670307D4-5827-04/22/04

Clinton Inverter CT Extension Corporate direction is to schedule an on-line maintenance at less than 1/2 the CT, i.e., 3 % days. This is not explicitly incorporated in the model except in Section 6 as a sensitivity case.

During the 24 month refueling cycle, the plant is estimated to be in operation all but 30.4 days (- 1 month). This means that the plant is in operation a total of 699.6 days out of the 730 day refueling cycle or an availability of 0.96. This assumption does not influence the ICCDP or ICLERP calculations. The influence of lower availability factors is investigated in a sensitivity case reported in Section 6.

The conditional CDF and LERF values defined above that simulate the risk states when an inverter is taken out of service under the extended CT (e.g., CDF1.oos and LERFI-oos) were determined for each inverter by setting its unavailability to 1.0 in the PRA models.

The maintenance unavailabilities for the remaining inverters and other equipment are not changed for this PRA calculation. For the case when NSPS inverter Division 1 is removed from service, the base PRA model does not permit concurrent removal from service for NSPS inverter Division 2.

Other combinations of maintenance unavailabilities with the Division 1 and 2 inverters are conservatively accounted for in the model.

Additional model changes for the CT model calculation reflect the plant configuration changes discussed in Section 3.3.2:

Turbine Trip initiators and MSIV closure initiators are increased via incorporation of events in the initiator calculation that depend on the transformer failure during the inverter OOS period ANDed with the probability of a latent failure on the other division (estimated probability of 1.4E-2).

Scram system unavailability effect is modeled conservatively by setting the incremental mechanical scram failure probability 5% higher when the complications associated with a transformer failure and inverter OOS are encountered.

Auto initiation ECCS logic signal for the associated division fails if the transformer fails when the inverter is OOS.

No manual backup is credited.

Recovery of the inverter from the out of service condition due to maintenance is not credited in the PRA evaluation.

3-7 C467030704-5827-04/22104

Clinton Inverter CT Extension 3.5 PRA MODEL QUALITY The Clinton PRA is a state-of-the-technology tool developed consistent with current PRA methods and approaches.

The Clinton PRA is derived based on realistic assessments of system capability over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the PRA analysis. Therefore, PRA success criteria may be different than the design basis assumptions used for licensing Clinton.

This report examines the risk profile changes from this realistic perspective to identify changes in the risk profile on a best estimate basis that may result from postulated accidents, including severe accidents.

The quality of the CPS PRA models used in performing the risk assessment for the CPS Inverter CT extension is manifested by the following:

• Sufficient scope and level of detail in PRA

• Active maintenance of the PRA models and inputs

• Comprehensive Critical Reviews Scope and Level of Detail The CPS PRA is of sufficient quality and scope for this application. The CPS PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.

Maintenance of Model. Inputs. Documentation The CPS PRA model and documentation have been maintained living and are routinely updated to reflect the current plant configuration following refueling outages and to reflect the accumulation of additional plant operating history and component failure 3-8 C467030704-5827-04122104

Clinton Inverter CT Extension data.

The Level 1 and Level 2 CPS PRA analyses were originally developed and submitted to the NRC in September, 1992 as the Clinton Power Station Individual Plant Examination (IPE) Submittal.

The CPS PRA has been updated many times since the original IPE. A summary of the CPS PRA history is as follows:

• CPS IPE (September 1992)

• Revision 1 (April 1994)

Revision 2 (January 1995)

• Revision 3 (June 2000)

Revision 3a (December 2000)

Revision 2003A (August 2003)

The latest revision (2003A) includes the incorporation of all the "A" PRA Peer Review Facts and Observations and the risk significant "B" F&Os. The latest PRA update (2003A) also includes the effects of the Extended Power Uprate of 20%.

LERF The calculated LERF value of the model (dated 8/28/03) is 2.24E-7/yrP1 ) compared to a CDF value of 9.97E-6/yr. This corresponds to a LERF contribution of about 2%(1) of the CDF. The LERF determination is based on a detailed containment event tree structure that includes multiple release categories, and is not based on a simplified LERF-only logic in the style of NUREG/CR-6595.

(1) However, it was subsequently recognized that the 2003A model LERF is conservative and could bias the results of risk informed applications. Appendix D discusses the treatment of these conservatisms in the NSPS inverter CT application.

3-9 C467030704-5827-04122104

Clinton Inverter CT Extension Critical Reviews The CPS PRA model has benefited from the following comprehensive technical reviews:

• CPS PRA Self-Assessment

• NEI PRA Peer Review Process A comprehensive self-assessment of the CPS at-power Level 1 and Level 2 PRA models was performed in July 2000. CPS identified both the strengths of the PRA model, and areas where potential enhancements to the PRA model could improve the traceability of the PRA documentation and improve its use for risk informed applications.

The Clinton internal events PRA received a formal industry PRA Peer Review in October 2000. The comments from the PRA Peer Review were prioritized into four categories A-D based upon importance to the completeness of the model.

All comments in Categories A and B (recommended actions and items for consideration) were identified to CPS as priority items. The comments in Categories C and D (minor comments, good practices, and editorial) are potential enhancements and remain for consideration in future updates of the Level 1 and 2 PRA models.

Refer to Appendix B for further details regarding the quality of the CPS PRA.

3.6 UNCERTAINTY EVALUATION A set of practical sensitivity evaluations have been performed to demonstrate the influence of some of the key assumptions in the assessment. These sensitivities are discussed in Section 6.

3-10 C467030704-5827-04/22/04

Clinton Inverter CT Extension Section 4 CONFIGURATION RISK MANAGEMENT PROGRAM INSIGHTS 4.1 CONFIGURATION RISK MANAGEMENT PROGRAM (CRMP)

The Maintenance Rule implementation at Clinton ensures that before performing elective on-line maintenance that the risk is assessed and effectively managed to balance the improved reliability of the inverter with the on-line unavailability to be incurred.

Clinton has developed a program ("On-Line Maintenance") that ensures that the risk impact of equipment out of service is appropriately evaluated prior to performing any maintenance activity. This program requires an integrated review (i.e., both probabilistic and deterministic) to uncover risk-significant plant equipment outage configurations in a timely manner both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities like testing or load dispatching, and weather conditions.

Clinton currently has the capability to perform a configuration dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. Risk is re-assessed if equipment failure/malfunction or emergent conditions produce a plant configuration that has not been previously assessed. It is noted that Amergen policy is not to voluntarily enter a Completion Time allowed by Technical Specifications unless the prescribed maintenance can be performed within 1/2 the Completion Time (in this case 3 1/2 days).

The CRMP includes the following considerations:

4-1

-1C467030704-5827-04122/04

Clinton Inverter CT Extension Maintenance activities that affect redundant and diverse SSCs that provide backup for the same function are minimized.

The potential for planned activities to cause a plant transient are reviewed and work on SSCs that would be required to mitigate the transient are avoided.

Work is not scheduled that is highly likely to exceed a TS or Technical Requirements Manual CT requiring a plant shutdown. Planning for on-line equipment outages typically provides for a 100% contingency time within the Technical Specifications completion time.

4.2 SAFETY BENEFITS There are a number of safety benefits to be obtained from the extended inverter CT that have not been quantitatively assessed. These important benefits are identified here qualitatively for consideration in the assessment and sufficient decisions regarding any perceived risk profile changes.

(1)

There would be a reduction in entry into Technical Specification 3.0.1 which would require a forced shutdown of the plant and its attendant risks. 'Transition risk" associated with unneeded reactor shutdown for inverter maintenance is avoided.

Specifically, the increased Technical Specification Allowed Outage Time will result in reducing the possibility of incurring a forced shutdown due to an inverter failure at-power.

(2)

One of the principal safety benefits is associated with the ability to remove the inverter maintenance and overhauls from the refuel outages and to perform them during power operation. This safety benefit can be quite significant especially given the improved performance of AmerGen in completing refuel outages in relatively short times. As an example, the Clinton refuel outage in April 2002 was 35 days compared with previous outages of 50 or more days.

With the reduced outage durations, the inverter maintenance and overhaul could be forced to be performed within the constraints of the Technical Specifications but at times of increased shutdown risk. It is judged that the risk decrease associated with removing the inverter maintenance from a compressed refuel schedule of 23 days or less results in a safety benefit that is comparable to the risk increase of performing the maintenance at-power.

This assessment is highly dependent on the specific refueling, the schedule of the coincident outage work, and the controls in place.

4-2 c467030704-5827-04n22lO4

Clinton Inverter CT Extension For example, SDC isolation can be caused by failure of either NSPS inverter (see LER 1998-03) if the alternate AC supply via a step down transformer is also unavailable.

The increased CT would allow for the inverter maintenance on-line and could therefore reduce the need for maintenance during shutdown. This could result in a risk reduction for the shutdown plant operating states and can be considered to provide compensatory benefit for performing the maintenance on-line.

However, as part of this submittal, no quantitative benefit is included in any of the calculations associated with the risk reduction during refuel outages.

(3)

Performing inverter overhauls with the reactor at power results in beneficial conditions such that with the inverter work on-going, the maintenance planning, work, and inspection efforts can be focused on this task.

Planning the performance of inverter overhauls at power is judged to result in an improved inverter maintenance and attendant reliability compared with attempting the inverter outage during a refuel outage with its many competing demands for resources.

4.3 COMPENSATORY MEASURES As part of the risk management program, certain additional types of items could be included in work planning to minimize any incremental risk.

These additional compensatory measures are identified in the License Amendment Request (LAR).

4-3 C467030704-5827-04/22/04

Clinton Inverter CT Extension Section 5 RESULTS As discussed in Section 2, there are a number of quantitative risk measures that are used in the regulatory decision making process to assess the efficacy of a plant change.

This section summarizes the Regulatory Guides' risk metrics requested and provides the calculated results from the Clinton PRA model.

5.1 REGULATORY GUIDES As described earlier, the probabilistic risk assessment input to the decision making process has been defined in detail by the NRC in two Regulatory Guides, Regulatory Guide 1.174 and 1.177.

The guidelines given in Regulatory Guide 1.177 include:

The licensee has demonstrated that the TS CT change has only a small quantitative impact on plant risk.

An ICCDP of less than 5.0E-7 is considered small for a single TS CT change. An ICLERP of 5.OE-8 or less is also considered small.

The guidelines from Regulatory Guide 1.174 are provided to assure that the CDF and LERF changes when the extended CT is implemented remain acceptable.

These guidelines specify acceptably small changes as a function of the absolute values of the CDF and LERF.

5.2 QUANTITATIVE PRA RESULTS: REGULATORY GUIDE 1.177 This subsection includes the quantitative PRA results using the Clinton PRA model.

5-1 C467030704-5827-04/22/04

Clinton Inverter CT Extension The results of the risk evaluation are compared in Table 5.2-1 with risk significance guidelines from Regulatory Guide 1.177 for ICCDP and ICLERP.(1 ) The ICCDP and ICLERP for both the Division 1 and the Division 2 inverters are below the risk significant guideline established in Regulatory Guide 1.177.

The ICCDP and ICLERP guideline values demonstrate that the proposed inverter CT change has only a small quantitative impact on plant risk. This table demonstrates the following:

For the NSPS Division 2 inverter, the Regulatory Guide 1.177 guidelines for ICCDP and ICLERP are both met with substantial margin.

For the NSPS Division 1 inverter, the calculated ICCDP and ICLERP are well below the acceptance guideline. Therefore, consistent with Regulatory Guide 1.177, the quantitative impact on plant risk is usmall".

5.3 REGULATORY GUIDE 1.174 5.3.1 Core Damage Frequencv (CDF)

Figure 5.3-1 shows the acceptance guideline for CDF from Regulatory Guide 1.174.

The Division 1 inverter CT changes have been included in the Clinton PRA calculation.

The base CDF is 9.97E-6/yr while the calculated increase in CDF associated with the CT extension is 3.0E-8Iyr. This combination of results places the proposed plant Tech Spec change in Region IlIl of the Regulatory Guide which is described as:

Very small changes in the CDF risk metric More flexibility with respect to the Baseline CDF The conclusion is that the Regulatory Guide 1.174 guidance for CDF is met with substantial margin.

(1) The Regulatory Guide 1.174 acceptance guidelines and calculated values for the CPS inverter CT changes are also included in Table 5.2-1.

5-2 C467030704-5827-04122/04

Clinton Inverter CT Extension Table 5.2-1 RESULTS OF RISK EVALUATION FOR CLINTON INVERTER CT EXTENSION l

Risk Significance l Risk Metric l

Risk Metric Guideline Results Guideline Met ACDFAvEl

< 1.OE-06Iyr(l) 3.OE-8/yr Yes ALERFAVE

< 1.OE-07/yr(')

4.OE-9/yr Yes ICCDPDri

< 5.OE-07(2) 1.0E-7 Yes ICLERPDIV

< 5.OE-08(2) 7.7E-9 Yes ICCDPDIv2

< 5.OE-o7(2)

Yes ICLERPv 2

< 5.OE-08 2 Yes (1)

Regulatory Guide 1.174.

(2)

Regulatory Guide 1.177.

5-3 C467030704-5827-04122/04

Clinton Inverter CT Extension 5.3.2 Large Early Release Frequency (LERF)

Figure 5.3-2 shows the acceptance guideline for LERF from Regulatory Guide 1.174.

The inverter for Division 1 CT changes have been included in the Clinton PRA calculations. Specifically, the base LERF is 9.86E-8/yr(') while the calculated increase in LERF associated with the CT extension is 4.OE-9/yr.

This combination of results places the proposed plant Completion Time change in Region IlIl which the Regulatory Guide describes as:

Very small changes in the LERF risk metric More flexibility with respect to the Baseline LERF The conclusion is that the Regulatory Guide 1.174 guidance on LERF is met with substantial margin.

5.4 RISK ASSESSMENTS The results indicate that the individual inverter ICCDP and ICLERP are within the Regulatory Guide 1.177 guidelines. In addition, Regulatory Guide 1.174 acceptance guidelines (Region IlIl: very small risk changes) are met with approximately an order of magnitude margin for the most limiting of the NSPS inverters, i.e., Division 1.

The source of the small incremental at-power risk is associated with Loss of Offsite power initiating events occurring during the inverter out of service time. In addition to the LOOP initiator, it is also necessary for RCIC to be demanded. This primarily relates to complete SBO sequences where RCIC would be depended upon to extend the time available before core damage to allow recovery of offsite or on-site AC power.

(1) Appendix D shows the LERF estimate derivation when the excess conservatisms are removed.

5-4 C467030704-5827-04/22104

Clinton Inverter CT Extension It is recognized that the Division 1 NSPS inverter has a larger risk associated with its on-line maintenance out of service than the Division 2 NSPS inverter. Nevertheless, the associated risk for each is within the acceptance guidelines specified by the NRC in the applicable Regulatory Guides.

5-5 C467030704-5827-04/22104

Clinton Inverter CT Extension 0

C-)

10 -5t~ ~~RGO 1 11 i2l1l 10 -6 REGION II Id ii 10-5 CDF 0

= Change in CDF for Extended CTs for inverters Division I and 2 Figure 5.3-1 Acceptance Guidelines* for Core Damage Frequency (CDF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

546 c467030704-5827-04/22104

Clinton Inverter CT Extension w

10-6 10-7 10-6 10-5 LERF 0

= Change in LERF for Extended CTs for inverters Division 1 and 2 Figure 5.3-2 Acceptance Guidelines* for Large Early Release Frequency (LERF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

5-7 C467030704-5827-04122/04

Clinton Inverter CT Extension Section 6 SENSITIVITIES In addition, to the point estimate calculations of the risk metrics provided in Section 5, understanding the potential uncertainty associated with these risk metrics can also prove valuable in the decision-making process.

One of the methods that provides valuable input into the decision-making process is to provide sensitivity calculations for situations with different assumed conditions. This section describes:

The sensitivity cases that have been identified The process used for the sensitivity evaluation The results of the sensitivity evaluations 6.1 IDENTIFICATION OF SENSITIVITY CASES TO SUPPORT DECISION MAKING The identification of useful sensitivities involves identifying potential issues that have large uncertainty or may change based on future plant operation and should be considered by the decision makers. These sensitivities fall into the following general areas:

A.

Model or data assumptions B. Specific equipment performance issues C. Operating philosophy changes: None Identified D. Plant Modifications: None Identified The following are the items identified for each general area.

6-1 C467030704-5827-04122104

Clinton Inverter CT Extension A.

Model or Data Assumptions The following model or data assumptions could be important in the decision making process and are identified as candidates for a sensitivity evaluation:

A-1: Transformer Failure Probability Increase by factor of 10 Decrease by a factor of 10 A-2: Loss of Offsite Power Frequency Increase by a factor of 3 A-3: Diesel Generator Fail to Start Probability (and its common cause groups)

Increase by a factor of 3 A-4: Impact on electrical common cause failure to scram is increased from 5% (i.e., Inverter Cases assessed in Section 5) to 20%

A-5: Plant availability is varied from the base case assumed 96%

availability to 85%. The 96% plant availability is considered a best estimate projection. The 85% availability is considered a reasonable lower bound.

B. Operating Philosophy Changes Operating philosophy, procedures, and training can substantially change the risk profile.

The following specific items are identified that may influence the decision making process.

B-1: Inverter planned maintenance at 3 Y2 days/cycle above base case, instead of the full 7 day CT. This sensitivity case reflects the fact that on-line equipment outages are typically completed well within the required CT.

6-2 C467030704-5827-04/22/04

Clinton Inverter CT Extension 6.2 PROCESS FOR SENSITIVITY EVALUATION Inverters 1A and 1B have relatively small calculated ICCDP and ICLERP values.

Therefore, while there is substantial margin associated with these criteria, these are the more limiting criteria and are the ones used for the sensitivity evaluation.

It is noted that the A LERF and A CDF risk metrics of Regulatory Guide 1.174 have even more substantial margin to the Region IlIl acceptance guidelines and those margins are not presented for the sensitivity cases. Only the more limiting margins of ICCDP and ICLERP are presented.

The parameters chosen to provide the comparison among the sensitivity cases and with the base case are the following:

CDF LERF ICCDP (Incremental Conditional Core Damage Probability)

ICLERP (Incremental Conditional Large Early Release Probability)

As shown by the base calculations in Section 5, the ICCDP and ICLERP are not limiting in the assessment of the 1 B inverter CT. Therefore, their calculation as parameters in the sensitivity study is not required for effective input to the decision making process.

Only the impact associated with inverter 1A CT is required to be evaluated.

The single top model at a truncation of 3E-1 1/yr is used for the sensitivity calculations for CDF and a truncation limit of 5E-1 1/yr for LERF.

6.3 SENSITIVITY RESULTS Table 6.3-1 summarizes the results from the sensitivity cases. Most of the sensitivities indicate relatively small or negligible impacts on the ICCDP and ICLERP.

6-3 C467030704-5827-04122/04

Clinton Inverter CT Extension The effects of increasing the failure rate of the alternate power source (the transformer) in Sensitivity Case A-1 results in a negligible change in the risk metrics.

This demonstrates the robust nature of the calculated risk metrics in the base model.

Specifically, it demonstrates that the transformer failure rate is not a critical parameter in the assessment of the risk impact. In other words, the transformer failure rate is low, and large changes in its failure rate alone do not result in significant degradation in plant mitigating system capability.

The dominant sequences affecting the increase in CDF associated with the Division 1 inverter OOS are those with LOOP initiators leading to SBO events.

The total configuration specific CDF increases by a factor of 1.52.(Y)

This is simply the ratio of CDF with Div 1 NSPS inverter OOS to the base CDF.

The sensitivity Cases A-2 and A-3 demonstrate the reasons that the inverter availability introduces small changes to the risk profile. Cases A-2 and A-3 address sequences where the mitigating system redundancy is reduced by the unavailability of AC power.

Station Blackout (SBO) accident sequences contribute approximately 32% to the CDF risk metric in the base model. The model with the configuration including the Division 1 inverter OOS results in a configuration specific increase in the SBO contribution from this 32% to 55% of the CDF. This is because, with the normal Division 1 NSPS bus power supply unavailable, any failure of the alternative supply, such as failure of the 1A EDG to start during a LOOP, results in RCIC failure.

RCIC is important in SBO sequences to provide additional time for AC power recovery.

(1) Note, however, that this configuration specific risk is less than a factor of two over the base CDF, and, therefore, is GREEN for on-line risk assessments using the AmerGen guidance under the Maintenance Rule.

6-4 C467030704-5827-04/22104

Clinton Inverter CT Extension It is noted in Sensitivity Case A-2 that substantial changes in the LOOP frequency that affect SBO accident sequence frequencies result in increasing the ICCDP and ICLERP risk metrics. However, even using a LOOP frequency increased by a factor of 3, which would be approximately the 90% upper bound of LOOP data, the ICCDP and ICLERP would both remain below the R.G. 1.177 guideline used to ascribe small risk impacts despite this large change in the LOOP frequency.

In addition, the increase in diesel generator failure probability ("fails to start") and the associated common cause terms for the Division 1 Diesel (DIG A)(') by a factor of three (3), as in Sensitivity Case A-3, (which would be above the 90% upper bound) also demonstrates that the calculated risk metrics of ICCDP and ICLERP remain below acceptance guidelines in RG 1.177 used to ascribe small risk impacts.

Both of these sensitivities (Cases A-2 and A-3) are judged to provide valuable inputs to the decision makers to demonstrate the significance of protecting the offsite power sources and the diesels during inverter maintenance.

Sensitivity Case A-4 demonstrates that the changes in the scram failure probability modeled in this sensitivity result in a negligible change in the risk metrics of ICCDP and ICLERP for the limiting case of the Division I inverter OOS.

Sensitivity Case A-5 shows that changes in the plant availability factor of approximately 11% have a small influence on the assessed risk metrics.

Both risk metrics of A CDF and A LERF are well within the RG 1.174 acceptance guidelines for very small risk changes indicating an insensitivity to the plant availability assumption.

(1) The common cause failure probabilities were not also increased. The single random failure to start and failure to run probabilities were increased for DIG A.

6-5 C467030704-5827.04122/04

Clinton Inverter CT Extension In addition, ACDF and ALERF are not limiting risk metrics in the assessment of the Completion Time (CT) extension.

It is also noted that the intent of the AmerGen approach to on-line maintenance is to perform the on-line maintenance well within the Technical Specification Completion Time (CT). Sensitivity Case B-1 shows that the ICCDP and ICLERP risk metrics have substantially increased margins if the actual time used for maintenance and test is 3 1/2 days (i.e., approximately 50% of the CT) instead of the maximum allowable 7 days.

Finally, if there is only a single divisional inverter on-line outage of 7 days per refuel cycle, this would reduce the A CDF and A LERF calculated in these hypothetical cases by approximately a factor of two.

The ICCDP and ICLERP because of the fixed assumptions used in their derivation would not change regardless of the frequency with which the extended CT is exercised.

The derivation of the ICCDP and ICLERP purports to measure the risk impact of a single outage regardless of the frequency.

6.4 RAW IMPORTANCE MEASURE When the plant configuration changes, the importance measures for the configuration also change. For the short time when the inverter is out of service (OOS) (choose inverter 1A), the RAW values for most components actually decrease. For those RAW values that increase, many change by very small amounts (i.e., less than 50% changes in RAW). The configuration change with NSPS Inverter 1A OOS results in substantial changes in the RAW for the basic events identified in Tables 6.4-1 and 6.4-2. The RAW changes are calculated by taking the difference between the RAW with NSPS 1A OOS and the RAW for the basic event with the baseline model configuration assumed.

"Substantial change" is defined as a RAW > 2 and a change in the RAW > 50%.

6-6 C467030704.5827-04/22104

Clinton Inverter CT Extension There is also a list of RAW values that would increase to above 2 based on the new configuration, i.e., the RAW > 2 only applies with the 1A inverter OOS. Table 6.4-2 provides the Summary of the Basic Events which increase their RAW above 2.0 for the plant configuration with inverter 1A OOS.

6-7 C467030704-5827-04122/04

Clinton Inverter CT Extension Table 6.3-1 SENSITIVITY CASE RESULTS1 ' (3)

CDF Base LERF Sensitivity (Inverter LERF(3)

(Inverter Case Description Change in Model Base CDF 00S)

ICCDP (xYr)

(rx)(

3)

ICLERP 0

Base Case 9.97E-06 1.52E-05 1.OE-07 9.86E-08 5.02E-07 7.7E-09 A-1 Transformer Failure Probability (a) Increase Increase NSPS transformer failure I.OOE-05 1.52E-05 1.OE-07 9.86E-08 5.02E-07 7.7E-09 probabilities by a factor of 10 (b) Decrease Decrease NSPS probabilities byfa 9.97E-06 1.52E-05 1.0E-07 9.86E-08 5.02E-07 7.7E-09 factor of 10 A-2 Loss of Offsite Power Increase LOOP IE Frequency frequency by a factor of 1.66E-05 3.15E-05 2.9E-07 2.48E-07 1.50E-06 2.4E-08 3

A-3 Diesel Generator DGA Fail Increase the DGA FTS to Start Probability (and its and all CCF events 1.16E-05 1.88E-05 1.38E-07 1.45E-07 7.65E-07 1.2E-08 common cause groups) including DGA FTS by a factor of 3.

A-4 Impact on Electrical Increased from 5% to common cause failure to 20%.

9.97E-06 1.52E-05 1.OE-07 9.86E-08 5.02E-07 7.7E-09 scram 6-8 6-8 C467030704.5827-04/22/04

Clinton Inverter CT Extension Table 6.3-1 SENSITIVITY CASE RESULTS(' (3)

CDF Base LERF (Inverter LERF 3)

(Inverter Case Description Change in Model Base CDF

)

CCDP RxYr)

OS) 3 ICLERP A-5 Plant Availability Factor Change the times for the changed to 85%

various plant 9.97E-06 1.52E-05(2) 1.0E-07 9.86E-08 5.02E-07 7JE-09 configurations performed outside the model.

B-1 Inverter maintenance is Change the times for the performed in nominally 3 Y% various plant 9.97E-06 1.52E-05 5.OE-08 9.86E-08 5.02E-07 3.9E-09 days instead of the Tech configurations performed Spec Limit of 7 days.

outside the model.

(1) Sensitivity Case results are developed for the more limiting inverter OOS, i.e., NSPS Inverter 1A (Division 1).

(2)

The change in risk metrics occurs due to changes in the relative times of exposure of the base CDF (LERF) and inverter OOS CDF (LERF).

The results are the following for the R.G. 1.174 risk metrics:

ACDF = 1.18E-7/yr ALERF = 2.07E-8/yr

3)

The sensitivity cases have all been performed with the LERF model re-evaluated to remove excess conservatisms. See Appendix D.

Specifically, the conservatisms that were reduced but not eliminated include:

Failure to credit manual action to isolate containment in an SBO Failure to properly account for containment venting through the unisolated line to preclude overpressure failure of containment.

6-9 6-9 C467030704-5827-04/22104 I

Clinton Inverter CT Extension Table 6.4-1

SUMMARY

OF THE BASIC EVENTS WITH RELATIVELY LARGE CHANGES IN RAW VALUES FOR CDF WHEN INVERTER 1A IS OOS RAW Base Change in Event Name IAnrOS RAW (IA-Base)

Description IEYLOOPXXI 81.10 49.43 31.67 LOSS OF OFF-SITE POWER INITIATOR CC FAILURE OF ADS AIR BOTTLE BACKUP RUPTURE GDISKCCPIL 36.96 22.43 14.53 DISKS COMMON CAUSE RHR A B&CILPCS INJ MOV FAIL TO RABCLCCMVO 40.34 27.58 12.76 OPEN FANS VD01CA AND C FAIL TO START - COMMON AVDACCCFNS 20.96 9.69 11.27 CAUSE FANS VD01 CA AND B FAIL TO START - COMMON AVDABCCFNS 22.89 11.75 11.14 CAUSE COMMON CAUSE FAIL FOR DG HX DISCHARGE XDGABCCMVO 23.49 12.53 10.96 VALVES A&B AVDABCCFNR 21.54 10.86 10.68 FANS VD01 CA AND B FAIL TO RUN - COMMON CAUSE FANS VD01CA AND C FAIL TO RUN - COMMON AVDACCCFNR 17.91 7.67 10.24 CAUSE COMMON CAUSE FAIL FOR DG HX DISCHARGE XDGACCCMVO 22.57 12.48 10.09 VALVES A&C DAMPERS VD01YA AND C FAIL TO OPEN - COMMON AVDACCCDMO 22.95 12.96 9.99 CAUSE FAILURE OF DAMPERS VD01YA AND B TO OPEN -

AVDABCCDMO 23.90 13.98 9.92 COMMON CAUSE OP FAILS TO MANUALLY INITIATE RAPID DEPRESS.

GADSSORSYH 10.79 1.14 9.65 (IORV/SORV)

FAILURE OF CB A AND C TO CLOSE - COMMON ADGACCCCBC 23.76 15.06 8.70 CAUSE FANS VD01CB AND C FAIL TO START - COMMON AVDBCCCFNS 17.33 8.69 8.64 CAUSE FAILURE OF CB A AND B TO CLOSE - COMMON ADGABCCCBC 24.25 15.67 8.58 CAUSE FANS VD01CB AND C FAIL TO RUN - COMMON AVDBCCCFNR 15.67 7.20 8.47 CAUSE DAMPERS VD01YB AND C FAIL TO OPEN - COMMON AVDBCCCDMO 18.77 10.64 8.13 CAUSE COMMON CAUSE CIRCUIT BREAKER 221A1 AND A221XCCCBO 24.35 16.30 8.05 221 B1 FAIL TO OPEN COMMON CAUSE FAIL FOR DG HX DISCHARGE XDGBCCCMVO 18.54 10.65 7.89 VALVES B&C FAILURE OF CB B AND C TO CLOSE - COMMON ADGBCCCCBC 19.55 12.11 7.44 CAUSE 6-10 6-10 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table 6.4-2

SUMMARY

OF THE BASIC EVENTS WHICH INCREASE THEIR RAW ABOVE 2.0 WHEN INVERTER 1A IS OOS RW Base Change in Inverter Model RAW Event Name 1A OOS RAW (1A-Base)

Description ADG01KCDGH 2.90 1.76 1.14 FAILURE TO RESTORE DG01KC AFTER MAINT AVD01YCDMO 2.76 1.62 1.14 FAILURE OF DAMPER VD01YC TO OPEN FAILURE OF CIRCUIT BREAKER 221CI TO OPEN AP221C1CBO 2.97 1.86 1.11 (ERAT)

AVD01CCFNS 2.43 1.42 1.01 FAILURE OF FAN VD01CC TO START AVD01CCFNR 2.20 1.28 0.92 FAILURE OF FAN VD01CC TO RUN AVD01YADMO 2.21 1.44 0.77 FAILURE OF DAMPER VD01YA TO OPEN XDG11AAHXP 2.10 1.33 0.77 DIV I DG HX lDG11AA PLUGGED OR FOULED XDG12AAHXP 2.10 1.33 0.77 DIV 1 DG HX lDG12M PLUGGED OR FOULED XSX063AMVO 2.37 1.61 0.76 DISCHARGE VALVE 1SX063A FAILS TO OPEN ADG01 KADGH 2.37 1.62 0.75 FAILURE TO RESTORE DG01 KA AFTER MAINT FAILURE OF CIRCUIT BREAKER 221A1 TO OPEN AP22IAlCBO 2.47 1.73 0.74 (ERAT)

XDG11ABHXP 1.98 1.32 0.66 DIV2 DG HX IDG11AB PLUGGED OR FOULED DG01 KC OUT OF SERVICE - PREVENTIVE ADG01KCDGM 2.27 1.62 0.65 MAINTENANCE AVD01YBDMO 2.04 1.41 0.63 FAILURE OF DAMPER VD01YB TO OPEN ADG01 KBDGH 2.14 1.54 0.60 FAILURE TO RESTORE DG01 KB AFTER MAINT XSX063BMVO 2.14 1.54 0.60 DISCHARGE VALVE 1SX063B FAILS TO OPEN FAILURE OF CIRCUIT BREAKER 221B1 TO OPEN AP221BICBO 2.21 1.62 0.59 (ERAT) 6-11 C467030704-5827-04/22/04

Clinton Inverter CT Extension Section 7 CONCLUSIONS This section provides the conclusions and insights from the risk assessment of extending the divisional Nuclear System Protection System (NSPS) inverter Completion Time (CT) from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days.

7.1 EVALUATION OF RISK IMPACT Risk informed input for this change* is based on the latest Clinton probabilistic risk assessment update (2003A) for full power internal events. The PRA is used to quantify the change in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) produced by the increased CT for the Inverters. Other deterministic techniques are being implemented to minimize any risk impact. These deterministic techniques include: (1) implementation of a CRMP to control performance of other high risk tasks during the inverter outage; and, (2) consideration of specific compensatory measures to minimize risk.

The risk impact of the proposed NSPS divisional inverter CT changes has been evaluated and found to be acceptable. The calculated risk increases are very small as characterized by Regulatory Guide 1.174.

The effect on risk of the requested increase in CT for restoration of an inoperable inverter has been evaluated using NRC's three-tier approach suggested in Regulatory Guide 1.177, "An Approach for Plant-Specific Risk-informed Decisionmaking: Technical Specifications," dated August, 1998:

Tier 1: PRA Capability and Insights Tier 2: Avoidance of Risk-Significant Plant Configurations Tier 3: Risk-Informed Configuration Risk Management 7-1 C467030704-5827-04122104

.et

. Clinton Inverter CT Extension The evaluation of changes in CDF and LERF due to the expected increased inverter unavailability have been shown to meet the risk significance criteria of Regulatory Guide 1.174 with substantial margin. The changes in CDF and LERF are found to represent very small changes in risk. This calculation supports the increase in inverter CT from a quantitative risk-informed perspective.

Furthermore, as indicated in Section 5, the Incremental Conditional Core Damage Probability (ICCDP) and the Incremental Conditional Large Early Release Probability (ICLERP) for each inverter for the increased CT are sufficiently below the guidelines of

< 5.0E-07 and < 5.OE-08, respectively, to be able to call the risk change small. Hence, the conclusion that the risk change is small is consistent with Regulatory Guide 1.177.

In addition, the sensitivity evaluations performed to reflect possible variations in key parameters also demonstrate that the acceptance guidelines for RG 1.177 and RG 1.174 are met.

One key assumption in this evaluation is that increased inverter maintenance unavailability will occur no more than that bounded by one 7 day inverter outage per inverter train per 24 month refueling cycle.

7.2 EXTERNAL EVENTS AND SHUTDOWN The Clinton plant risk due to internal fires was evaluated in 1995 as part of the CPS Individual Plant Examination of External Events (IPEEE) Submittal. [6]

EPRI FIVE Methodology and Fire PRA Implementation Guide screening approaches and data were used to perform the CPS IPEEE fire PRA study. The CDF contribution due to internal fires was calculated at 3.26E-6/yr.

7-2 C467030704-5827-04/22/04

Clinton Inverter CT Extension The PSA for internal fires is subject to more modeling uncertainty than the internal events PSA evaluations.

While the fire PSA is generally self-consistent within its calculational framework, the fire PSA calculated quantitative risk metric does not compare well with internal events PSAs because of the number of conservatisms that have been included in the fire PSA process. Therefore, the use of the fire PSA figure of merit as a reflection of CDF may be inappropriate. Any use of fire PSA results and insights should properly reflect consideration of the fact that the "state of the technology" in fire PSAs is less evolved than the internal events PSA.

It is calculated that the CPS fire IPEEE CDF would increase by 1-2% due to the inverter CT extension request. The ICCDP for the most limiting of the inverters (i.e., Division 1) is estimated at approximately 1.OE-9. These changes in risk metric would not change the conclusion of the analysis using the internal events PRA.

The Clinton seismic risk analysis was also performed as part of the Individual Plant Examination of External Events (IPEEE). [6]

Clinton performed a seismic margins assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation.

The conclusions of the Clinton seismic risk analysis are as follows: [6]

"No improvements to the plant were identified as a result of the Seismic Margins Assessment... the plant was determined to be fully capable of attaining safe shutdown conditions after the Review Level Earthquake (RLE). "

Based on a review of the Clinton IPEEE, the conclusions of the SMA are judged to be unaffected by the CT Extension of the NSPS Division 1 and 2 inverters. The NSPS inverters are only one source of power available to the NSPS buses and the initiation logic supported by NSPS. The inverter is backed up by the regulating transformer 7-3 7-3 C467030704-5827-04/22/04

Clinton Inverter CT Extension source to the NSPS bus. The seismically qualified diesel generators are in turn a power supply for the regulating transformer source to the NSPS bus.

The inverter CT extension has no impact on the seismic qualifications of the systems, structures and components (SSCs).

The CPS IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards.

Based upon this review, it was concluded that CPS meets the applicable Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards.

Similar to the conclusions related to the seismic assessment, the inverter CT extension does not impact the conclusions of these external hazards assessment.

7.3 INSIGHTS 7.3.1 Postulated Dominant Risk Scenario The development of the Clinton PRA update to support the risk assessment of extending the inverter CT has resulted in several risk insights that may be useful to consider:

The Div. 1 diesel generator availability during inverter 1A on-line maintenance is critical to minimizing the configuration specific risk The offsite power availability including the ERAT are critical to minimizing the configuration specific risk 7.3.2 Positive Safety Benefits There are a number of safety benefits to be obtained from the extended inverter CT that have not been quantitatively assessed. These important benefits are identified here 7-4 C467030704-5827-04/22104

Clinton Inverter CT Extension qualitatively for consideration in the assessment and sufficient decisions regarding any perceived risk profile changes.

(1)

There would be a reduction in entry into Technical Specification 3.0.1 which would require a forced shutdown of the plant and its attendant risks. "Transition risk" associated with unneeded reactor shutdown for inverter maintenance is avoided.

Specifically, the increased Technical Specification Allowed Outage Time will result in reducing the possibility of incurring a forced shutdown due to an inverter failure at-power.

(2)

One of the principal safety benefits is associated with the ability to remove the inverter maintenance and overhauls from the refuel outages and to perform them during power operation. This safety benefit can be quite significant especially given the improved performance of AmerGen in completing refuel outages in relatively short times. As an example, the Clinton refuel outage in April 2002 was 35 days compared with previous outages of 50 or more days.

With the reduced outage durations, the inverter maintenance and overhaul could be forced to be performed within the constraints of the Technical Specifications but at times of increased shutdown risk. It is judged that the risk decrease associated with removing the inverter maintenance from a compressed refuel schedule of 23 days or less results in a safety benefit that is comparable to the risk increase of performing the maintenance at-power.

This assessment is highly dependent on the specific refueling, the schedule of the coincident outage work, and the controls in place.

For example, SDC isolation can be caused by failure of the either NSPS inverter (see LER 1998-03) if the alternate AC supply via a step down transformer is also unavailable.

The increased CT would allow for the inverter maintenance on-line and could therefore reduce the need for maintenance during shutdown. This could result in a risk reduction for the shutdown plant operating states and can be considered to provide compensatory benefit for performing the maintenance on-line.

However, as part of this submittal, no quantitative benefit is included in any of the calculations associated with the risk reduction during refuel outages.

(3)

Performing inverter overhauls with the reactor at power results in beneficial conditions such that with the inverter work on-going, the maintenance planning, work, and inspection efforts can be focused on this task. Planning the performance of inverter overhauls at power is judged to result in an improved inverter maintenance and attendant reliability compared with attempting the inverter outage 7-5 C467030704-5827-04122104

Clinton Inverter CT Extension during a refuel outage with its many competing demands for resources.

7.4 FUTURE PLANT CHANGES The PRA models used to perform this risk evaluation provide the best available state of knowledge of the potential risk impacts of the requested increased inverter CT.

No future plant changes are anticipated that would influence the assessed risk of the inverter CT extension.

7-6 C467030704-5827-04122/04

Clinton Inverter CT Extension Section 8 REFERENCES

1. Samanta, P.K. et al, Handbook of Methods for Risk-Based Analyses of Technical Specifications, NUREG/CR-6141, U.S. Nuclear Regulatory Commission, Washington (DC), dated 1994.

2.

An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Regulatory Guide 1.174, Revision 1, November 2002.

3.

Regulatory Guide 1.177: An Approach for Plant-Specific, Risk-Informed Decision-Making: Technical Specifications, USNRC, August 1998.

4. Amendment No. 99 to facility operating License No. NPF-58. Perry Nuclear Power Plant, Unit 1 (TAC No. MA3537), Letter from D.V. Picket (NRC) to L.W. Myers (First Energy), dated February 24, 1999.

5. South Texas Project (STP) Staff Evaluation Report (SER) on inverter CT Extension.

6.

Illinois Power, Clinton Power Station Individual Plant Examination For External Events (IPEEE), Final Report, September 1995.

7. Payne, A.C., et al, Analysis of the Clinton Unit 2 Nuclear Power Plant: Risk Methods Integration and Evaluation Program (IPE), NUREG/CR-4832, USNRC, March 1992.

8.

Issuance of Amendment No. 179 to Facility Operating License No. DPR-35, Pilgrim Nuclear Power Station (TAC No. M95277), Letter from A.B. Wang (NRC) to T.A.

Sullivan (Boston Edison Co.), dated December 11, 1998.

9.

SECY-99-095 from L. Joseph Callan (EDO) to Commissioners, Probabilistic Risk Assessment Implementation Plan Pilot Application for Risk Informed Technical Specifications, dated April 30, 1997.

8-1 C467030704-5827-04/22/04

Appendix A ASSESSMENT OF EXTERNAL EVENTS AND SHUTDOWN IMPACTS

Clinton Inverter CT Extension Appendix A ASSESSMENT OF EXTERNAL EVENTS AND SHUTDOWN IMPACTS A.1 INTRODUCTION Appendix subsections A.2, A.3, and A.4 discuss the external events assessments of risk in support of the Clinton inverter CT extension submittal. It includes:

• An examination of past Clinton external event analysis.

• A reevaluation of that analysis to ensure it reflects the plant and plant procedures.

• Incorporation of the analysis into a quantitative PRA model where appropriate because it may influence the CT probabilistic analysis; or Alternatively, a qualitative assessment to indicate the impact on the Completion Time assessment.

Appendix A.5 discusses the shutdown risk implications.

A.2 INTERNAL FIRES INDUCED RISK The Clinton plant risk due to internal fires was evaluated in 1995 as part of the CPS Individual Plant Examination of External Events (IPEEE) Submittal. [A-1] EPRI FIVE Methodology and Fire PRA Implementation Guide screening approaches and data were used to perform the CPS IPEEE fire PRA study. The CDF contribution due to internal fires was calculated at 3.26E-6/yr.

The fire PSA is subject to more modeling uncertainty than the internal events PSA evaluations.

While the fire PSA is generally self-consistent within its calculational framework, the fire PSA calculated quantitative risk metric does not compare well with internal events PSAs because of the number of conservatisms that have been included in the fire PSA process. Therefore, the use of the fire PSA figure of merit as a reflection A-1 C467030704-5827-04/22104

Clinton Inverter CT Extension of CDF may be inappropriate. Any use of fire PSA results and insights should properly reflect consideration of the fact that the "state of the technology" in fire PSAs is less evolved than the internal events PSA.

Relative modeling uncertainty is expected to narrow substantially in the future as more experience is gained in the development and implementation of methods and techniques for modeling fire accident progression and the underlying data.

A qualitative impact on the Clinton fire risk profile due to the inverter completion time extension is estimated here based on review of the Clinton IPEEE fire PSA results. As the CPS internal fire PRA models are currently archived, the IPEEE documentation for the fire induced core damage scenarios and the associated frequency results were reviewed in support of this assessment. This estimate is performed as follows:

The dominant fire scenarios from the CPS IPEEE fire analysis are used to represent the CPS fire risk profile. These scenarios are those summarized in Figure 4.24, "Fire Zone Contribution to Core Damage Frequency", of the 1995 Clinton IPEEE Final Report.

Based on the internal events risk impact results of this risk assessment, it is determined that the inverter CT extension only impacts SBO scenarios, all other accident types are negligibly impacted. As such, based on CPS response to the first and second rounds of RAI's on the EDG CT extension submittal, the CPS fire IPEEE quantitative results are reviewed to determine the breakdown of the fire CDF into SBO and non-SBO accidents.

The results of the inverter CT base case quantification (in terms of CDF increase as a function of SBO vs. non-SBO accidents) are applied to the CPS fire scenarios. The CPS CT base quantification cutsets were compared with'the CPS base PRA cutsets to make this determination. The sum of SBO cutsets increased by approximately a factor of 1.6 for the CT case over the base case; and, the sum of the non-SBO cutsets increased insignificantly (i.e., < 1%).

The fire impact calculation estimate is summarized here in Table A-1. As can be seen from Table A-1, it is estimated here that the CPS fire IPEEE CDF would increase by 1-A-2 C467030704-5827-04122104

Clinton Inverter CT Extension 2% due to the inverter CT extension request. The ICCDP is estimated at approximately 1.OE-9.

A.3 SEISMIC RISK The Clinton seismic risk analysis was performed as part of the Individual Plant Examination of External Events (IPEEE). [A-1]

Clinton performed a seismic margins assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequency sequences were quantified as part of the seismic risk evaluation.

The conclusions of the Clinton seismic risk analysis are as follows: [A-1]

"No improvements to the plant were identified. as a result of the Seismic Margins Assessment... the plant was determined to be fully capable of attaining safe shutdown conditions after the Review Level Earthquake (RLE).

Based on a review of the Clinton IPEEE and the key general conclusions identified earlier in this assessment, the conclusions of the SMA are judged to be unaffected by the CT Extension of the NSPS Division 1 and 2 inverters. The NSPS inverters are only one source of power available to the NSPS buses and the initiation logic supported by NSPS. The inverter is backed up by the regulating transformer source to the NSPS bus. The seismically qualified diesel generators are in turn a power supply for the regulating transformer source to the NSPS bus. The inverter CT extension has no impact on the seismic qualifications of the systems, structures and components (SSCs).

A.4 OTHER EXTERNAL EVENTS RISK In addition to internal fires and seismic events, the CPS IPEEE Submittal analyzed a variety of other external hazards:

• High Winds/Tornadoes A-3 C467030704-5827-04/22104

Clinton Inverter CT Extension Table A-1 ESTIMATE OF IMPACT ON FIRE CDF DUE TO INVERTER CT REQUEST ESTIMATE OF IMPACT ON FIRE CDF DUE TO INVERTER CT REQUEST

-V. Andersen (09112103)

Dominant Fire Scenarios Per CPS IPEEE:

A-lb A-1 b A-2k A-2n A-3d A-3f CB-1 C8-1 C8-1 C8-1 C82z C834 Fire Area I

Fire Area Description A1udliary Bldg - EL 707W Hallway Audliary Bldg - EL 7r General Access Auntiary Bldg. Dlv. I Non-Safely SWGR IAunllary Bldg. Dv. I Safety SVOGR Atxiary Bldg. - Dv. 11 Non-Safety SvVGR AIuwlsry Bldg. D*v. 11 Safety SW5R I c Contrln Bldg. EL 70z 1 d Control Bldg. Cremistry Lb Areas Iea Control Bldg - Eh. 73r 757 Gen.Access A Lob HVAC if Contrl Bl. CCW Equipment Area Contol Bldg. Div. 1I Cable Spreaddg Area la Control Bldg

• CAPS Area I

Control Bldg - Div. I Cable Spreading Area Sa Contral Blog

• Div. SI SWOR 6 tControl Bldg - Main Control Room id Control Bldg - Ops iheaRestroomsSiornge Fwel Bldg - El. 71 zGeneral Access Fuel Bldg EL. 3r General Access Fuel Bldg

- Els. 755s& 781-Screenbouse

- Elh. e7t` & sw Radraste - El. 78t General Access TOTALS:

I I

IFraction ol Fire Scenarios with Flre4ndue Indcd LO 0 Fire Area Fire-Fire-induced LOOP Scenari Scenaro That I CDF of Fire SB Induced CDF LOOP CDF SBO Scenarios 3.25E-10

'None>

0.00 0.00 0.00 1.79E-10

'None' 0.00 0.00 0.00 2.95E-07 All (assumed) 2.95E-07 0 01 2.95E409 7.t1E407

-None>

0.00 0.00 0.00 127E-07 All (assumed) 1.27E-07 0.01 1.27E-09 2.00E407 Ail (assumed) 2.OOE407 0.10 2.OOE-08 2.04E-08

'None' 0.00 0.00 0.00 5.36E-l0

'None>

0.00 0.00 0.00 1.14E-09

'None' 0.00 0.00 0.00 6.85E-08 All (assumed) 6.85E-08 0.01 6.85E-10 3.97E-09 All (assumed) 3.97E-09 0.10 3.97E-10 1.05E-07 Scenario#6 7.81E-09 1.00 7.81E-09 Scenario #8 8.46E-10 1.00 8.46E-10 Scenario #9 8.70E-10 1.00 8.70E-10 Scenafto tPLUtJA 1.16E-09 negligible negligible 1.39E09 All (assumed) 1.39E-09 0.10 1.39E-10 1.36E407

'None>

0.00 0.00 0.00 120E406 Scenarlo SH13-P570 7.73E-09 negligible negligible 3.72E408

-None>

0.00 0.00 0.00 4.26E-10

<None, 0.00 0.00 0.00 1.11E4-8 None>

0.00 0.00 0.00 1.13E-09

'None' 0.00 0.00 0.00 3.38E407

-None>

0.00 0.00 0.00 4 75FwYt Scenario #2 3.50E409 negligible

_gega2Lib_

3.26E-06 3.50E-08 CB-8 CB-8 C8-4 C84 F-1a F-In F-1p M-2c R-1t ywbbk.. an CPSA

.COfto.0.

&w.wcTnV*.ne (1.1%)

lrh~ftb-..

wr~I n aelW.

CPS en Sao a.s co r. We. Wo..

CT.A~tkob Estimation of Chanae In CPS Fire Risk Due to Inverter CT Renuest:

Delta Fire CDFO [( 99% x 3.26e-x (1 + 0.01)) + ( 1% x 3.26e4 x (1.6)) - 3.26e-1 Iyr 5.22E4U81yr Delta Fire CDF I%)

• 1.6%

ICCDP (fire)

• 1.OE-09 Where: - The 99% term represents the fraction of the internal fires CDF due to non-SBO scenarios.

- The 0.01 term represents the <1% Increase manifested in the Internal events non-SBO COF due to the Inverter CT request.

- The 1% term represents the fraction of the internal fires COF due to 580 accidents.

- The factor of 1.6 term represents the approximate increase manifested in the internal events 500 CDF due to the Inverter CT request

- The ICCDP is calcuialed as: (Delta Fire COF x 7 daysl365 days 3

- For lire areas A-2k, A-3d. A-3t. CO-1I. CB-2 and C8-4, the fraction of tire scenario CDF that results in $00 CDF is based on information presented by CPS In responses to the rotund of RAls on the CPS EDG CT Extension reauesL For eal otier fieareas. the estimates are based A-4 A-4 G467030704-5827-04/22/04

Clinton Inverter CT Extension

• External Flooding

• Transportation and Nearby Facility Accidents

• Other External Hazards The CPS IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, nearby facility accidents, and other external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards.

Based upon this review, it was concluded that CPS meets the applicable Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards.

Similar to the conclusions related to the seismic assessment, the inverter CT extension does not impact the conclusions of these external hazards assessment.

A.5 SHUTDOWN RISK The areas of review appropriate to shutdown risk are the following:

• Initiating Events

• Success Criteria

• Human Reliability Analysis The following qualitative discussion applies to the shutdown conditions of Hot Shutdown (Mode 3), Cold Shutdown (Mode 4), and Refueling (Mode 5). The risk impacts during the transitional periods such as at-power (Mode 1) to Hot Shutdown and Startup (Mode

2) to at-power are judged to be subsumed by the at-power Level 1 PRA.

This is consistent with the U.S. PRA industry, and with NRC Regulatory Guide 1.174 which states that not all aspects of risk need to be addressed for every application. While higher conditional risk states may be postulated during these transition periods, the short time frames involved produce a insignificant impact on the long-term annualized plant risk profile.

A-5 C467030704-5827-04122104

Clinton Inverter CT Extension A.5.1 Shutdown Initiating Events Shutdown initiating events include the following major categories:

• Inadvertent Draindown

• LOCAs

• Loss of Decay Heat Removal (includes LOOP)

No new initiating events or increased potential for initiating events during shutdown (e.g., loss of DHR train) can be postulated due to the removal of the inverter work window from shutdown.

SDC isolation can be caused by failure of the Div 2 NSPS inverter (see LER 1998-03) if the alternate AC supply via a step down transformer is also unavailable.

The increased CT would allow for the inverter maintenance on-line and would therefore eliminate the need for maintenance during shutdown.

This would result in a risk reduction for the shutdown plant operating states and can be considered to provide substantial compensatory benefit for performing the maintenance on-line.

A.5.2 Shutdown Success Criteria There is no change in shutdown success criteria.

A.5.3 Shutdown HRA Impact There is no change in HRA impact under shutdown configurations except that less dependence on crew actions may be postulated because of a reduction in inverter unavailability during shutdown operations.

At6 C467030704-5827-04122/04

Clinton Inverter CT Extension A.5.4 Shutdown Risk Summary SDC isolation can be caused by failure of the Div 2 NSPS inverter (see LER 1998-03) if the alternate AC supply via a step down transformer is also unavailable.

The increased CT would allow for the inverter maintenance on-line and would therefore reduce the need for maintenance during shutdown. This would result in a risk reduction for the shutdown plant operating states and can be considered to provide substantial compensatory benefit for performing the maintenance on-line.

Based on a review of the potential impacts on initiating events, success criteria, and HRA, the change in on-line NSPS Division 1 and 2 inverter CT is assessed to result in an increase in safety (i.e., risk reduction) for shutdown risk.

A.6 REFERENCES

[A-1] Illinois Power, Clinton Power Station Individual Plant Examination For External Events (IPEEE), Final Report, September 1995.

A-7 C467030704-5827-04122104

Appendix B CLINTON PRA QUALITY

Clinton Inverter CT Extension Appendix B CLINTON PRA QUALITY The quality of the Clinton PRA models used in performing the risk assessment for the Clinton Inverter Completion Time extension is manifested by the following:

• Level of detail in PRA

• Maintenance of the PRA

• Comprehensive Critical Reviews B.1 LEVEL OF DETAIL The Clinton PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.

The PRA model quantification process used for the Clinton PRA is based on the linked fault tree methodology, which is a well-known methodology in the industry.

The model quantification is performed using the EPRI R&R Workstation software.

B.1.1 Initiating Events The Clinton at-power PRA explicitly models a large number of internal initiating events:

• General transients

• LOCAs

• Support system failures

• Internal Flooding events The initiating events explicitly modeled in the Clinton at-power PRA are summarized in Table B-1.

The number of internal initiating events modeled in the Clinton at-power PRA is similar to the majority of U.S. BWR PRAs currently in use.

B3-1 C467030704-5827-04122104

Clinton Inverter CT Extension Table B-1 CPS INITIATING EVENTS -

TYPE OF EVENT INITIATING EVENT CATEGORY DESIGNATOR TREE Loss of Off-Site Power IEYLOOPXXI Loss of Off-Site Power (with Recovery)

IEYLOOPRCI Loss of Reserve Auxiliary IEYLOSRATI TRANSIENT Transient without Isolation IETRANSYI Transient with Isolation IEYTRANISI Inadvertent Open Relief Valve IEYIORVXXI Loss of Feedwater IEYLOSSFWI Manual Shutdown IEYMANSHXI Small LOCA IEYSBLOCAI Medium LOCA IEYMEDLOCI Large LOCA IEYLLOCAXI Interfacing System LOCA LPCS Injection IEYISLOCDI RHR LPCI Train A IEYISLOCEI RHR LPCI Train B IEYISLOCII LOCA RHR LPCI Train C IEYISLOCJI RHR SDC Suction IEYISLOCFI RHR SDC Return Train A IEYISLOCGI RHR SDC Return Train B IEYISLOCHI Break Outside Containment Main Steam IEYBOCMSXI FW Injection IEYBOCFWXI HPCS Injection IEYBOCHPCI RCIC Steam Line IEYBOCRCII RWCU Suction IEYBOCRWCI B-2 B-2 C467030704-5827-04/22104

Clinton Inverter CT Extension Table B-I CPS INITIATING EVENTS TYPE OF EVENT INITIATING EVENT CATEGORY DESIGNATOR TREE Loss of TBCCW IEYLOSSTBI Loss of Plant Service Water IEYLOSSSWI Loss of Instrument Air IEYLOSSIAI SPECIAL Loss of 6.9 KV Bus 1AP04E IEYLOSAC41 INITIATOR Loss of 6.9 KV Bus 1AP05E IEYLOSAC51 Loss of 4 KV Bus 1AP06E IEYLOSAC61 Loss of 4 KV Bus 1AP08E IEYLOSAC81 Loss of non-safety DC Bus 1 E IEYLOSDCEI Loss of non-safety DC Bus 1 F IEYLOSDCFI Internal Flooding (multiple)

B-3 C467030704-5827-04122104

Clinton Inverter CT Extension B.1.2 System Models The Clinton at-power PRA explicitly models a large number of frontline and support systems that are credited in the accident sequence analyses. The Clinton systems explicitly modeled in the Clinton at-power PRA are summarized in Table B-2. The number and level of detail of plant systems modeled in the Clinton at-power PRA is equal to or greater than the majority of U.S. BWR PRAs currently in use. Where other PRAs may not develop logic for such systems as instrument air, ECCS instrumentation, main steam and condenser, and fire protection, the Clinton PRA specifically models these with fault tree logic.

B.1.3 Operator Actions The Clinton at-power PRA explicitly models a large number of operator actions:

• Pre-initiator actions

• Post-Initiator actions

• Recovery Actions

• Dependent Human Actions Approximately one hundred and sixty (160) operator actions (about 90 pre-initiators, about 65 post-initiators, about 5 recovery actions) are explicitly modeled. Given the large number of actions modeled in the Clinton at-power internal events PRA, a summary table of the individual actions modeled is not provided here.

The human error probabilities for the actions are modeled with accepted industry HRA techniques and include input based on discussion with plant operators, trainers, and other cognizant personnel.

B-4 C467030704-5827-04I22/04

Clinton Inverter CT Extension Table B-2 SYSTEMS MODELED IN CLINTON AT-POWER PRA System System System Fault Tree Narrative

(*.CAF File)

(*.DOC File)

Auxiliary Power AUXPWR AP Hydrogen Ignitors HG CGCS DC & Inverters DCNSPS DCNSPS Fire Protection (for RPV injection)

FP FP Feedwater delivery FW FW ADS ADS ADS HPCS HP HPCS Service Air/ Instrument Air IA IAS Containment Isolation Cl Cl LPCS LPCS LPCS Main Steam and Condenser MS MS Control Rod Drive (for RPV CRD CRDS injection)

Initiation Logic (e.g., for ECCS)

IN INIT Containment Venting CNMTVENT ECVS RHR RHR RHR Standby Liquid Control SLC SLC Offsite Power OSP cSP RCIC RCIC RCIC Miscellaneous Support MISCSUPP MSS Shutdown Service Water SX SSWS B-5 C467030704-5827-04122104

Clinton Inverter CT Extension With regard to dependent actions, the human reliability analysis facet of the Clinton PRA explicitly considers the dependent effects of individual modeled actions (considering such issues as relevant timing among actions, similar cues) and develops dependent operator actions that replace various combinations of the independent human actions appearing in the quantification results.

The operator post-initiator operator actions have been completely reevaluated for the 2003A model to incorporate the latest CPS procedures and the latest crew training.

These were incorporated after operator crew interviews, reassessment of the EOPs/SAMGs, requantification of the HEPs, and an investigation into the dependent HEP impact on the model.

The number of operator actions modeled in the Clinton at-power PRA, and the level of detail of the HRA, is equal to or greater than many U.S. BWR PRAs currently in use.

B.1.4 Data The data (component reliability data and initiating event data) have been Bayesian updated to incorporate the most recent Clinton operating experience for the 2003A model.

B.1.5 Common Cause Events The Clinton at-power PRA explicitly models a large number of common cause component failures. The components explicitly modeled in the Clinton at-power PRA with common cause component failures are summarized in Table B-3.

Over four hundred common cause terms are explicitly included in the Clinton PRA. Given the large number of CCF terms modeled in the Clinton at-power internal events PRA, a summary table of them is not provided here. The number and level of detail of common cause component failures modeled in the Clinton at-power PRA is equal to or greater B-6 C467030704-5827-04122/04

Clinton Inverter CT Extension than the majority of U.S. BWR PRAs currently in use. The latest NRC data provided in NUREG/CR-5497 and 5485 are used in the 2003A update.

B.2 MAINTENANCE OF PRA B.2.1 History of Clinton PRA Models Maintenance The Clinton PRA model and documentation has been maintained living and is routinely updated to reflect the current plant configuration following refueling outages and to reflect the accumulation of additional plant operating history and component failure data. The Level 1 and Level 2 Clinton PRA analyses were originally developed and submitted to the NRC in September, 1992 as the Clinton Power Station Individual Plant Examination (IPE) Submittal. The Clinton PRA has been updated many times since the original IPE. A summary of the Clinton PRA history is as follows:

• Clinton IPE (September 1992)

• Revision 1 (April 1994)

• Revision 2 (January 1995)

• Revision 3 (June 2000)

• Revision 3a (December 2000)

• Revision 2003A (August 2003)

The Clinton IPE model of 1992 was updated in 1994 and 1995 to reflect the changes made to the plant since the development of the submittal. Clinton recognized in 1996 that the PRA should be updated again. Plant specific-equipment failure data could be updated with the available operating history. In addition, the offsite power model, while adequate for IPE purposes, was inadequate for evaluating risk for potential plant configurations and PRA applications.

B-7 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table B-3 COMPONENTS RECEIVING COMMON CAUSE TREATMENT IN CLINTON PRA Diesel generators (fail to start and run)

Pumps (failure to start and run)

Motor operated valves (failure to open or close on demand)

Circuit breakers (failure to open or close on demand)

Batteries Battery chargers Air operated valves (failure to open or close on demand)

Safety/relief valves (failure to open or close on demand)

Check valves (failure to open on demand, failure to remain closed)

Instrument and control components (failure to send signal or actuate equipment)

Explosive valves (failure to open)

Solenoid valves (failure to operate)

Fans (failure to start and run)

Compressors (failure to start and run)

Chillers (failure to start and run)

Transformers Inverters Static transfer switches (failure to transfer)

Strainers/filters B3-8 c467030704-5827-04122104

Clinton Inverter CT Extension Revision 3 to the Clinton PRA incorporated many modifications, including the following major changes:

Level 1 PRA

• Included Loss of Reserve Auxiliary Transformer initiating event.

This initiator contributed to approximately 30% of the Revision 3 CDF.

• Updated breaker failure to open and failure to close on demand probabilities based on plant specific data.

• Included common cause ERAT and RAT breaker failure to open event.

• Updated plant specific battery charger failure rates based on plant specific data.

• Developed detailed offsite AC power model.

Level 2 PRA

• Explicitly included containment phenomenology in Level 2 quantification.

For the original IPE and previous updates, containment phenomenology (e.g., direct containment heating, core concrete interactions) were treated with position papers to explain why (in most cases) the phenomenon would be unlikely at Clinton.

Consideration of these phenomena was included in the sequence quantification.

• Eliminated time limit for containment failure. A general assumption for previous PRA models was that if containment failure did not occur within three days, then containment failure was averted.

For the Revision 3 update, no time limit for containment failure was assumed.

During use of the Revision 3 PRA model, Clinton determined that a number of conservative assumptions existed in the model that tended to produce overly conservative results for certain PRA applications. The majority of the conservative assumptions had a minor impact on the base model.

Clinton decided to perform another update to the PRA model (i.e., Revision 3a) in order to provide proper risk informed guidance for the PRA applications.

B-9 c467030704-5827-04/22/04

Clinton Inverter CT Extension The Revision 3a model changes included the following:

• Decreased RCIC run time from 24 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for SBO sequences.

Incorporated best estimate surveillance test intervals for certain valve plugging events (i.e., for HPCS and RCIC valves).

• Credited manual initiation of RCIC as a backup to automatic initiation logic failure (i.e., failure of RCIC Level channel failures).

Note:

manual initiation and control of RCIC is not credited given loss of power to NSPS 120 VAC Bus A due to the complexity of manual RCIC control.

Credited manual initiation of diesel generators given failure to start due to under voltage relay failure.

• Revised recovery file to credit diesel generator recovery for certain non-SBO sequences.

• Included recovery for long term loss of decay heat removal sequences.

The time for containment pressurization such that SRVs will eventually reclose is much greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The recovery term represents failure of plant personnel to implement or repair a long term decay heat removal mechanism.

Revised Loss of Offsite Power initiating event frequency to credit that Clinton has offsite power supplies from two independent sources (i.e.,

RAT and ERAT).

• Removed potentially non-conservative credit for diesel generator recovery for cutsets with DG maintenance events.

The Clinton 2003A PRA model quantifies the core damage frequency (CDF) and Large Early Release Frequency (LERF).

The 2003A model upgrade was performed to include the modifications summarized below:

• Extended Power Uprate (EPU) 20%

• Revised human reliability analysis (HRA) based on recent operator interviews

• Maintenance unavailability data based on the most recent plant operating experience B-10 c467030704-5827-04122104

Clinton Inverter CT Extension

• Bayesian updated initiating event frequencies utilizing Clinton most recent operating experience

• Individual component random failure probabilities Bayesian updated (as applicable) based upon the most recent plant specific data and the most current generic sources

• Detailed Interfacing System (LOCA) ISLOCA) initiating event frequency evaluation per NSAC-154

• Updated ATWS event tree sequence structure

• Common cause failure (CCF) calculations revised to incorporate the updated individual random basic event probabilities and the most up to date Multiple Greek Letter (MGL) parameters from NUREG/CR-5497 and NUREG/CR-5485 for component groups where plant specific data were available Revised LOOP/DLOOP analysis for initiating event frequencies and non-recovery probabilities based upon a Midwest regional data 'filtering approach Revised mechanical and electrical ATWS probabilities, based on information in NUREG/CR-5500

• Incorporation of internal flood sequences This Quantification Notebook also dispositions a large number of items that were reviewed during the 2003A update process and identified for inclusion in the 2003A model. These include the following:

Clinton BWROG Peer Review comments

• Exelon Update Requirements Evaluation (URE) Database(')

The Clinton 2003A update was performed to ensure that the risk significant PRA Peer Review comments and those identified internally through the URE process were incorporated explicitly into the quantified PRA model.

(1) Clinton has an active process that provides a running list of PRA changes to be made at the PRA update, i.e., UREs. This running list of changes includes PRA modifications that are identified during internal reviews and PRA applications.

B-1 I B-Il C467030704-5827-04122/04

Clinton Inverter CT Extension No PRA Peer Review items were identified by the BWROG relative to the inverter models and their impacts, except a potentially conservative assumption regarding room cooling requirements.

This conservatism regarding the inverter room cooling requirement is retained in the current update, but it has an insignificant effect on the calculated risk metrics.

The CPS 2003A PRA update resolves each of the five (5) Level "A" comments identified during the CPS BWROG PRA Peer Review performed in October 2000. [C-3]

In addition, the CPS 2003A update resolves 32 of the 48 Level "B" Peer Review comments as identified in the CPS PRA Update Program Plan. The 32 Level 'B" comments resolved for the update address the risk significant Level "B" comments. The remaining 16 Level "B" comments were reviewed and judged to be appropriate to defer until a future update.

The PRA models are continually implemented and studied by plant PRA personnel in the performance of their duties.

Potential model modifications/enhancements are itemized and maintained for further investigation and subsequent implementation, if necessary.

Each supporting element of the Clinton PRA is documnented, typically in a stand-alone report.

Each analysis element is reviewed by cognizant personnel and comments reconciled before final approval. The analysis element reviews are guided by checklists that cover both technical and document format/content issues.

Formal comprehensive model reviews are discussed in Section B.3.

B.3 COMPREHENSIVE CRITICAL REVIEWS The Clinton PRA model has benefited from the following comprehensive technical reviews:

B-12 c467030704-5827-04122104

Clinton Inverter CT Extension

• Clinton PRA Self-Assessment

• NEI PRA Peer Review Process B.3.1 Clinton PRA Self-Assessment A comprehensive self-assessment of the Clinton at-power Level 1 and Level 2 PRA models was performed in July 2000. [B-1]

The scope of the self-assessment review included the following key aspects:

1.

Identify and address areas where the Clinton PRA may require additional or alternative documentation, technical upgrades, or process improvements. The self-assessment was performed prior to the Clinton PRA Certification Review. (See Section B.3.2.)

2.

Review the PRA documentation to ensure that as complete a set of documentation as feasible was available to the peer reviewers.

3.

Identify areas where the baseline PRA should be improved to support its use in risk-informed applications.

The methodology of the self-assessment review included the following key aspects:

1.

Perform self-assessment using the NEI checklists of the eleven (11) technical elements that were also used during the peer review certification. [B-2]

2.

Document the results of the review for each technical element using the PRA Peer Review forms or separate observation forms, per the NEI guidance, as necessary.

Based on the findings for each of the eleven technical elements, Clinton summarized the strengths of the PRA model.

In addition, Clinton summarized the areas where potential enhancements to the PRA model could improve the traceability of the PRA documentation and improve its use for risk informed applications.

B-1 3 C467030704-5827-04r22104

Clinton Inverter CT Extension B.3.2 NEI PRA Peer Review Subsequent to the self-review, the Clinton internal events PRA received a formal industry PRA Peer Review in October 2000. [B-3] The purpose of the PRA Peer Review process is to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The PRA Peer Review process uses a team composed of PRA and system analysts, each with significant expertise in both PRA development and PRA applications. This team provides both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements. The team uses a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA products available.

The Clinton review team used the Revision A-3 NEI draft "Probabilistic Risk Assessment (PRA) Peer Review Process Guidance" dated June 2, 2000 as the basis for the review. [B-2]

The general scope of the implementation of the PRA Peer Review includes review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events, internal flooding, and containment performance, with focus on large early release frequency (LERF). The eleven technical elements are shown in Tables B4 through B-6.

The intensive peer reviews involved approximately two person-months of engineering effort by the review team and provided a comprehensive assessment of the strengths and limitations of each element of the PRA. All of the findings and observations from these assessments that the review team indicated were important and those that involved risk elements needed to evaluate the proposed Completion Time extension were dispositioned. This resulted in a number of enhancements to the PRA models prior to their use to support the proposed change.

B-14 C467030704-5827-04/22104

Clinton Inverter CT Extension B.4 PRA QUALITY

SUMMARY

The quality of modeling and documentation of the Clinton PRA models has been demonstrated by the foregoing discussions on the following aspects:

• Level of detail in PRA

• Maintenance of the PRA

• Comprehensive Critical Reviews Results of previous internal and external reviews have identified various items that could be modified in the models. These items will not discernibly affect the change in CDF or LERF associated with the inverter completion time extension change. The Clinton Level 1 and Level 2 PRAs provide the necessary and sufficient scope and level of detail to allow the calculation of CDF and LERF changes and the ICCDP and ICLERP for the inverter CT extension risk-informed application.

B-1 5 C467030704.5827-04/22/04

Clinton Inverter CT Extension Table B4 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Initiating Events Guidance Documents for Initiating Event Analysis Groupings Transient LOCA Support System/Special ISLOCA Break Outside Containment Internal Floods Subsumed Events Data Documentation Accident Sequence Evaluation (Event Trees)

Guidance on Development of Event Trees Event Trees (Accident Scenario Evaluation)

Transients SBO LOCA ATWS Special ISLOCA/BOC Internal Floods Success Criteria and Bases Interface with EOPs/AOPs

• Accident Sequence Plant Damage States Documentation B-16 c467030704-5827-04122104

Clinton Inverter CT Extension Table B4 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Thermal Hydraulic Guidance Document Analysis Best Estimate Calculations (e.g., MAAP)

• Generic Assessments FSAR - Chapter 15

• Room Heat Up Calculations

• *Documentation System Analysis System Analysis Guidance Document(s)

(Fault Trees)

System Models Structure of models Level of Detail Success Criteria Nomenclature Data (see Data Input)

Dependencies (see Dependency Element)

Assumptions Documentation of System Notebooks B-17 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table B4 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Data Analysis Guidance Component Failure Probabilities System/Train Maintenance Unavailabilities Common Cause Failure Probabilities Unique Unavailabilities or Modeling Items AC Recovery Scram System EDG Mission Time Repair and Recovery Model SORV LOOP Given Transient BOP Unavailability Pipe Rupture Failure Probability Documentation Human Reliability Analysis Guidance Pre-Initiator Human Actions Identification Analysis Quantification Post-Initiator Human Actions and Recovery Identification Analysis Quantification Dependence among Actions Documentation B-1 8 c467030704-5827-04/22104

Clinton Inverter CT Extension Table B4 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 1 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Dependencies Guidance Document on Dependency Treatment Intersystem Dependencies Treatment of Human Interactions (see also HRA)

Treatment of Common Cause Treatment of Spatial Dependencies Walkdown Results Documentation Structural Capability Guidance RPV Capability (pressure and temperature)

ATWS Transient Containment (pressure and temperature)

Reactor Building Pipe Overpressurization for ISLOCA Documentation Quantification/Results Guidance Interpretation Computer Code Simplified Model (e.g., cutset model usage)

Dominant Sequences/Cutsets Non-Dominant Sequences/Cutsets Recovery Analysis Truncation Uncertainty Results Summary B-1 9 c467030704-5827-04/22/04

Clinton Inverter CT Extension Table B-5 PRA CERTIFICATION TECHNICAL ELEMENTS FOR LEVEL 2 PRA ELEMENT CERTIFICATION SUB-ELEMENTS Containment Performance Analysis

• Guidance Document

• Success Criteria L1/L2 Interface

• Phenomena Considered

• Important HEPs

• Containment Capability Assessment

• End state Definition LERF Definition CETs

• Documentation B-20 C467030704-5827-04/22104

Clinton Inverter CT Extension Table B-6 PRA CERTIFICATION TECHNICAL ELEMENTS FOR MAINTENANCE AND UPDATE PROCESS PRA ELEMENT CERTIFICATION SUB-ELEMENTS Maintenance and Update Process

• Guidance Document

• Input - Monitoring and Collecting New Information Model Control PRA Maintenance and Update Process Evaluation of Results Re-evaluation of Past PRA Applications Documentation B-21 C467030704-5827-04/22/04

Clinton Inverter CT Extension REFERENCES

[B-1] Clinton PRA Self-Assessment Report, Document Y-109241, August 10, 2000.

[B-2] Probabilistic Risk Assessment (PRA) Peer Review Process Guidance", Rev. A-3 (Draft), NEI, June 2, 2000.

[B-3] Clinton PRA Peer Review Certification Report, GE Document BWROG/PRA-2000-03, October 2000.

B-22 C467030704-5827-04122/04

Appendix C SENSITIVITY CASE

SUMMARY

CALCULATION SHEETS

Clinton Inverter CT Extension Appendix C SENSITIVITY CASE

SUMMARY

CALCULATION SHEETS This appendix provides selected sensitivity calculations which are used to demonstrate the possible range of risk metrics when potentially important variables are varied significantly from those used in the Base Model calculations.

The results of these sensitivity cases are summarized in Section 6.

The following is a list of the sensitivity cases quantified in this appendix:

Sensitivity Case Description I

Change in Mode l

A-1 a Transformer Failure Probability Increase NSPS transformer failure l_

probabilities by a factor of 10 A-2 Loss of Offsite Power Frequency Increase LOOP IE frequency by a factor of 3 A-3 Diesel Generator DGA Fail to Start Increase the DGA FTS and all Probability (and its common cause CCF events including DGA FTS l

groups) by a factor of 3.

A-4 Impact on electrical common cause Increased from 5% to 20%.

failure to scram A-5 Plant Availability Factor changed to Change the times for the various 85%

plant configurations performed outside the model.

B-1 Inverter maintenance is performed Change the times for the various in nominally 3 1/2 days instead of the plant configurations performed Tech Spec Limit of 7 days.

outside the model.

The sensitivity cases have all been performed with the LERF model re-evaluated to remove excess conservatisms. See Appendix D. Specifically, the conservatisms that were reduced but not eliminated include:

• Failure to credit manual action to isolate containment in an SBO Failure to properly account for containment venting through the unisolated line to preclude overpressure failure of containment.

C-1 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table C-1a CDF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-1a (Transformer Probability Increased x10)

Average CDF after CT Extension Included

[Use Eq. 2]

CDFAVE = 1.52E-5/yr

• 1.0E-2 + 9.97E-6/yr a 1.0E-2

+ 9.97E-6/yr E 0.98 CDFAVE = 1.52E-7/yr + 9.97E-8/yr + 9.77E-6/yr CDFAVE = 1.OOE-5/yr Chanae in CDF

[Use Eq. 3]

ACDFAvE = CDFAVE -

CDFBASE ACDFAVE = 1.OOE-5/yr - 9.97E-6/yr ACDFAvE = 3.OE-8/yr C-2 C467030704-5827-04122/04

Clinton Inverter CT Extension Table C-1b LERF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-1a (Transformer Probability Increased x10)

Average LERF after CT Extension Included

[Use Eq. 4]

LERFAVE(1 )

= (5.02E-7/yr

• 1.OE-2 + 9.86E-8/yr

• 1.OE-2

+9.86E-8/yr

• 0.98)

LERFAvE = (5.02E-9/yr + 9.86E-1 0/yr + 9.66E-8Iyr)

LERFAVE = 1.026E-07/y$1 )

Chance in LERF

[Use Eq. 5]

ALERFAvE") = (1.026E-7/yr - 9.86E-8yr)

ALERFAvE = 4.OE-9/yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-3 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table C-1c ICCDP AND ICLERP CALCULATIONS FOR CLINTON SENSITIVITY CASE A-1 a (Transformer Probability Increased x10)

ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP

=

(CDF1.00s - CDFBASE)* 1.92E-2yr

=

(1.52E-5/yr - 9.97E-6/yr)

• 1.92E-2yr

=

1.OE-7 Division 2: ICCDP

=

(CDF2-oos - CDFBAsE) 1.92E-2yr

=

ICLERP CALCULATION

[Eq. 9]

Division 1: ICLERPr 1 ) = (LERF1.oos - LERFBase)

• 1.92E-2yr

= (5.02E-7/yr-9.86E-8/yr). 1.92E-2yr

= 7.7E-9 Division 2: ICLERP = (LERF2.oos - LERFgase) e 1.92E-2yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-4 C-4

~C467030704

-5827-0 4 22104

Clinton Inverter CT Extension Table C-2a CDF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-2 (LOOP Frequency Increased x3)

Average CDF after CT Extension Included

[Use Eq. 2]

CDFAVE = 3.15E-5/yr

• 1.OE-2 + 1.66E-5/yr

• 1.OE-2

+ 1.66E-5/yr

• 0.98 CDFAVE = 3.15E-7/yr + 1.66E-7/yr + 1.63E-5/yr CDFAVE = 1.68E-5/yr Chanae in CDF

[Use Eq. 3]

ACDFAvE = CDFAVE CDFBASE 4CDFAVE = 1.68E-5fyr - 1.66E-5/yr 4CDFAvE = 2.OE-7/yr C-5 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table C-2b LERF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-2 (LOOP Frequency Increased x3)

Average LERF after CT Extension Included

[Use Eq. 4]

LERFAVE(1 ) = (1.50E-6/yr

• 1.OE-2 + 2.49E-7/yr. 1.0E-2

+2.49E-7Iyr e 0.98)

LERFAvE = (1.50E-8/yr + 2.49E-9/yr + 2.44E-7/yr)

LERFAVE = 2.61E-07/yr Change in LERF

[Use Eq. 5]

ALERFAvE(1 ) = (2.61E-7/yr - 2.48E-7/yr)

LILERFAvE = 1.30E-8/y')

(1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-6 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table C-2c ICCDP AND ICLERP CALCULATIONS FOR CLINTON SENSITIVITY CASE A-2 (LOOP Frequency Increased x3)

ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP

=

(CDF1.oos - CDFBASE) 1.92E-2yr

=

(3.15E-5/yr - 1.66E-6/yr) e 1.92E-2yr

=

2.86E-7 Division 2: ICCDP

=

(CDF2.oos - CDFBASE)* 1.92E-2yr

=

ICLERP CALCULATION

[Eq. 9]

Division 1: ICLERP{ 1) = (LERF1.oos - LERFgase)

• 1.92E-2yr

= (1.5E-6/yr-2.48E-7Iyr)

• 1.92E-2yr

= 2.4E-8 Division 2: ICLERP = (LERF2.oos - LERFgase)

• 1.92E-2yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because.one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-7 C467030704-5827-04/22/04

Clinton Inverter CT Extension Table C-3a CDF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-3 (D/G A Fail to Start Increased x3)

Average CDF after CT Extension Included

[Use Eq. 2]

CDFAVE = 1.88E-5/yr

• 1.0E-2 + 1.16E-5/yr e 1.0E-2

+ 1.16E-5Iyr

• 0.98 CDFAVE = 1.88E-7/yr + 1.16E-7/yr + 1.13E-5/yr CDFAVE = 1.17E-5/yr Chanae in CDF

[Use Eq. 3]

ACDFAvE = CDFAVE - CDFBASE ACDFAvE = 1.17E-5/yr - 1.16E-5/yr ACDFAvE = 1.OE-7/yr C-8 C467030704-5827-04/22104

Clinton Inverter CT Extension Table C-3b LERF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-3 (DIG A Fail to Start Increased x3)

Average LERF after CT Extension Included

[Use Eq. 4]

LERFAVE(')

= (7.66E-7/yr

• 1.0E-2 +

+ 1.45E-7/yr v 0.98) 1.45E-7/yr e 1.0E-2 LERFAvE = (7.66E-9/yr + 1.45E-9/yr+ 1.42E-7/yr)

LERFAvE = 1.51E-7/yr Change in LERF

[Use Eq. 5]

ALERFAvE(') = (1.51E-7/yr - 1.45E-7Iyr)

ALERFAvE = 6.0E-9/yr~')

(1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-9 c467030704-5827-04/22104

Clinton Inverter CT Extension Table C-3c ICCDP AND ICLERP CALCULATIONS FOR CLINTON SENSITIVITY CASE A-3 (D/G A Fail to Start Increased x3)

ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP

=

(CDFI-oos - CDFBAsE)

• 1.92E-2yr

=

(1.88E-5/yr - 1.16E-6/yr) e 1.92E-2yr

=

1.38E-7 Division 2: ICCDP

=

(CDF2 -oos - CDFBASE) 1.92E-2yr ICLERP CALCULATION

[Eq. 9 ]

Division 1: ICLERP(")

= (LERF1.oos - LERFgase)

• 1.92E-2yr

= (7.65E-7/yr-1.45E-7Iyr) a 1.92E-2yr

= 1.2E-8 Division 2: ICLERP = (LERF2 oos -LERFgase)

• 1.92E-2yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-10 C467030704-5827-04122/04

Clinton Inverter CT Extension Table C-4a CDF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-4 Average CDF after CT Extension Included

[Use Eq. 2]

CDFAVE = 1.52E-5/yr

• 1.0E-2 + 9.97E-6/yr

• 1.OE-2

+ 9.97E-6/yr

• 0.98 CDFAVE = 1.52E-7/yr + 9.97E-8/yr + 9.77E-6/yr CDFAVE = 1.OOE-5/yr Chanae in CDF

[Use Eq. 3]

ACDFAvE = CDFAVE - CDFBASE ACDFAVE = 1.OOE-5/yr - 9.97E-6/yr ACDFAvE = 3.OE-8/yr C-1 1 C467030704-5827-04122104

Clinton Inverter CT Extension Table C-4b LERF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-4 Average LERF after CT Extension Included

[Use Eq. 4]

LERFAvE( ) = (5.02E-7/yr a 1.OE-2 + 9.86E-8/yr *

+ 9.86E-8/yr a 0.98) 1.OE-2 LERFAVE = (5.02E-9/yr + 9.86E-10/yr + 9.66E-8/yr)

LERFAvE = 1.026E-7/yr Change in LERF

[Use Eq. 5]

ALERFAvE('1

= (1.026E-7/yr - 9.86E-8/yr)

ALERFAVE = 4.0E-9/y$1v (1) it is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-12 C4670307o4-5827-04122/04

Clinton Inverter CT Extension Table C-4c ICCDP AND ICLERP CALCULATIONS FOR CLINTON SENSITIVITY CASE A-4 ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP

=

(CDF1.oos - CDFBASE)

• 1.92E-2yr

=

(1.52E-5/yr - 9.97E-6/yr) e*1.92E-2yr 1.OE-7 Division 2: ICCDP

=

(CDF2.oos - CDFBASE)

• 1.92E-2yr

=

ICLERP CALCULATION

[Eq. 9]

Division 1: ICLERP(l) = (LERF 1.oos - LERFBase). 1.92E-2yr

= (5.02E-7Iyr-9.86E-8Iyr)

• 1.92E-2yr

= 7.7E-9 Division 2: ICLERP = (LERF2 00s - LERFgase)

• 1.92E-2yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-1 3 C467030704-5827-04122104

Clinton Inverter CT Extension Table C-5a CDF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-5 (Reduced Plant Availability)

Avera-ge CDF after CT Extension Included

[Use Eq. 2]

CDFAVE = 1.52E-5/yr. 1.13E-2 +

+9.97E-6/yr

• 0.977 9.97E-6/yr. 1.13E-2 CDFAVE = 1.72E-7/yr + 1.13E-7/yr + 9.74E-6/yr CDFAVE = 1.OOE-5/yr Chance in CDF

[Use Eq. 3]

ACDFAvE = CDFAVE -

CDFBASE ACDFAvE = 1.00E-5/yr - 9.97E-6Iyr ACDFAvE = 3.OE-8/yr C-14 C467030704-5827-04/22104

Clinton Inverter CT Extension Table C-5b LERF CALCULATIONS FOR CLINTON SENSITIVITY CASE A-5 (Reduced Plant Availability)

Average LERF after CT Extension Included

[Use Eq. 4]

LERFAVE(1 ) = (5.02E-7/yr

• 1.13E-2 + 9.86E-8/yr

• 1.13E-2

+ 9.86E-8/yr

• 0.977)

LERFAvE = (5.67E-9/yr + 1.11E-9/yr+ 9.13E-8/yr)

LERFAvE = 1.02E-7/yr Change in LERF

[Use Eq. 5]

ALERFAvE(1) = (1.03E-7Iyr - 9.86E-8/yr)

ALERFAvE = 4.5E-9/yrt1 (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-15 C467030704-5827-04/22104

Clinton Inverter CT Extension Table C-5c ICCDP AND ICLERP CALCULATIONS FOR CLINTON SENSITIVITY CASE A-5 (Reduced Plant Availability)

ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP

=

(CDF1.Oos - CDFBASE)e 1.92E-2yr

=

(1.52E-5/yr - 9.97E-61yr). 1.92E-2yr

=

1.OE-7 Division 2: ICCDP

=

(CDF2-oos - CDFBASE)* 1.92E-2yr

=

ICLERP CALCULATION

[Eq. 9 ]

Division 1: ICLERP(r)

= (LERF 1.oos - LERFBase)

• 1.92E-2yr

= (5.02E-7/yr-9.86E-8/yr)

• 1.92E-2yr

= 7.7E-9 Division 2: ICLERP = (LERF2.oos - LERFsase)

• 1.92E-2yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-16 C467030704-5827-04/22104

Clinton Inverter CT Extension Table C-6a CDF CALCULATIONS FOR CLINTON SENSITIVITY CASE B-1 (Reduced CT)

Average CDF after CT Extension Included

[Use Eq. 2 modified for 3 2 day CT]

CDFAVE = 1.52E-5/yr

• 5.OE-3 + 9.97E-6/yr

• 5.OE-3

+9.97E-6/yr

• 0.99 CDFAVE = 7.60E-8/yr + 4.98E-8/yr + 9.87E-6/yr CDFAvE = 1.00E-5/yr Change in CDF

[Use Eq. 3]

ACDFAvE = CDFAVE -

CDFBASE LICDFAvE = 1.00E-5/yr - 9.97E-6/yr ACDFAvE = 3.OE-8/yr C-17 C467030704-5827-04122/04

Clinton Inverter CT Extension Table C-6b LERF CALCULATIONS FOR CLINTON SENSITIVITY CASE B-1 (Reduced CT)

Average LERF after CT Extension Included

[Use Eq. 4]

LERFAVE(1 ) = (5.02E-7/yr

• 5.OE-3 + 9.86E-8/yr

• 5.OE-3

+ 9.86E-8/yr # 0.99)

LERFAVE = (2.51E-9/yr +4.93E-10/yr+9.76E-8/yr)

LERFAvE = 1.01E-7/yr Change in LERF

[Use Eq. 5]

LILERFAVE( 1V = (1.01E-7/yr - 9.86E-8/yr)

ALERFAVE = 2.4E-9/yr>v (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-18 c467030704-5827-04n22104

Clinton Inverter CT Extension Table C-6c ICCDP AND ICLERP CALCULATIONS FOR CLINTON SENSITIVITY CASE B-1 (Reduced CT)

ICCDP CALCULATION

[Eq. 6]

Division 1: ICCDP

=

(CDF1.oos - CDFBASE) e 9.6E-3yr

=

(1.52E-5/yr - 9.97E-6/yr) e 9.6E-3yr

=

5.OE-8 Division 2: ICCDP

=

(CDF2.oos - CDFBASE) e 9.6E-3yr

=

ICLERP CALCULATION

[Eq. 9]

Division 1: ICLERFPS1 ) = (LERF1.. oos - LERFBase). 9.6E-3yr

= (5.02E-7/yr-9.86E-8/yr)

• 9.6E-3yr

= 3.9E-9 Division 2: ICLERP = (LERF2 oos - LERFBase) e 9.6E-3yr (1) It is noted that the LERF evaluation includes some potential conservatism in the evaluation of SBO accident sequences. Because one containment penetration line may not isolate automatically given a loss of all AC power, the current PRA model includes these SBO cases as LERF contributors.

Inclusion of a local operator action to manually isolate this line is consistent with Clinton procedures and is considered appropriate. Therefore, the change in LERF caused by SBO sequences is reduced by a factor of 0.44 based on the analysis in Appendix D.

C-19 C467030704-5827-04/22/04

Appendix D ASSESSMENT OF EXCESS CONSERVATISM IN SBO LERF ACCIDENT SEQUENCE CONTRIBUTION

Clinton Inverter CT Extension Appendix D ASSESSMENT OF EXCESS CONSERVATISM IN SBO LERF ACCIDENT SEQUENCE CONTRIBUTION The 2003A CPS LERF model is judged to have a significant number of conservatisms incorporated into the LERF calculation. The principal one affecting the inverter CT application is that related to the treatment of SBO events that result in core damage.

For these scenarios, the timing inferred from the model is that core damage occurs: (a) relatively early (- 30 min. to 1 hr.); or, (b) relatively late > 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. However, in both cases the following assumption is made:

It is noted that the Clinton containment is operated with the containment normally unisolated.

Accident signals will lead to the isolation of containment. However, one pair of the isolation valves that are normally open require AC power to close. Therefore, under some postulated SBO accident sequences the isolation valves will require local manual action to close. This local manual action is directed by procedure 4200-01. Previous PRA analysis in 2000 provided the following inputs:

A review of the containment penetrations which would be expected to be open during normal operation identified one penetration that could lead to a failure to isolate containment during a station blackout (reference the CIS fault tree). This is the fuel pool cooling and cleanup return from the upper pools. This line contains normally open motor operated valves which would remain open on loss of all AC power. This line also contains manually operated valves which would be accessible and could be shut.

The probability of failure of containment isolation during station blackout then depends on the human error probability to isolate this line.

The failure probability is derived from the flow charts used to develop HEP screening values. The task is a manual alignment of a system, performed outside the control room, directed by procedure 4200.1, performed in the fuel building, simple, and at least 1.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> is available for the action, yielding a human error probability of.4. Radiation fields in this area could be high, but there are conservative assumptions in that analysis that would not necessarily apply to station blackout conditions in which no pumps are running to circulate high activity liquids.

Therefore, it is assumed that access would be sufficient to allow local manual closure of one of the valves.

D-1 C467030704-5827-04/22/04

Clinton Inverter CT Extension The HEP associated with this action has previously been assessed using the Clinton PRA HRA methodology and the results are as follows:

Previous Clinton HEP used Time Available Before HRA in this Initial Radionuclide Estimates Analysis Accident Type Release from the Fuel HEP HEP SBO with Immediate Loss 40 min.

0.48 0.48 of Injection SBO with Battery Depletion 4 Hrs 0.03 0.40 at 4 Hrs However, the previous HEP calculated recoveries were not used in the development of the single top PRA model nor in the 2003A model. The current PRA assumption is that no isolation occurs (HEP = 1.0). This results in an initial release starting within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> (the definition of early) of either a "short term" SBO or "long term" SBO with core damage. In addition, the assumption results in.a LERF if the containment ultimately fails due to overpressure in the wetwell water space.

The contributing SBO sequences to LERF in the 2003A model involve the following assumed conditions:

• The SBO occurs leading to core damage

• The single open pathway to outside containment is not closed by the crew prior to core damage (Assumed = 1.0)

• A radionuclide release is initiated at core damage due to the unisolated line After initiation of the release (early),(1 ) the containment line is subsequently isolated (success probability = 1.0)

• The containment continues to pressurize and eventually fails due to overpressure in the wetwell water space leading to a large early release (unscrubbed)

() This may occur at 30 min. or 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> both satisfy the definition of "earlyb in LERF.

D-2 C467030704-5827-04122/04

Clinton Inverter CT Extension This satisfies the CPS definition of LERF (initiated early) and eventually is a "large release".

The lack of credit for the procedurally directed and expected early isolation then biases the SBO results such that they appear as the dominant LERF contributors.

This appendix provides an estimate of the recovery actions that are credited to reduce some of the conservatisms associated with the LERF evaluation for SBO events:

Containment Isolation to Prevent an "Early" Release For short term SBO events, credit is given for the local manual action to isolate the line before a release occurs under SBO conditions (probability = 0.48 based on the HRA for CPS).

For long term SBO events, with more than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> available for the crew action to locally isolate the single penetration that is failed to isolate, an HEP of 0.4 is used.

Summary The following summarizes the impact of removing some of the excess conservatisms in the LERF model.

LERF (Short Term SBO) 38%

• 2.24E-7

• 0.48 LERF (Long Term SBO) 33%

• 2.24E-7

• 0.4

where, 38% = The fraction of core damage sequences that also lead to LERF 2) resulting from short term SBO accident sequences 33% = The fraction of core damage sequences that also lead to LERF 2) resulting from long term SBO accident sequences (2)

Derived from examining the conditional LERF assessed from the 2003A model. See Table 6-2 of CPS LERF Quantification Notebook (CPS PSA-015) dated December 2003.

D-3 C467030704-5827-04122/04

Clinton Inverter CT Extension All of the A LERF and ICLERP associated with the inverter CT extension is attributed to these SBO sequences. Therefore, more realistic (yet still conservative) estimates of the A LERF and ICLERP can be made by removing some of the excess conservatism by using the weighted average of the above recovery actions that the crew will be pursuing, but which have not yet been incorporated into the 2003A base model.

Effective Non-Recovery Probability = (

04 1 224E

0)

=0.44 0.71

• 2.24E - 7 Therefore, the effective non-recovery probability that can be applied to the change in LERF associated with the inverter CT extension is:

Effective Non-Recovery Probability = 0.44 D4 C467030704-5827-04/22104