Text

Application for Amendment of Facility Operating for Extension of Diesel Generator Completion Time
	ML041540545
Person / Time
Site:	Columbia
Issue date:	05/19/2004
From:	Webring R; Energy Northwest
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	G02-04-099
	Download: ML041540545 (193)
	v • d • e

ENERGY NORTH WEST PO. Box 968

Richland, Washington 99352-0968 May 19, 2004 G02-04-099 United States Nuclear Regulatory Commrission ATTN: Document Control Desk ,-

Washington, D.C. 20555-0001-

SUBJECT:

COLUMBIA GENERATING STATION, DOCKET NO. 50-397 APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME

REFERENCES:

1) Letter G02-03-187 dated December 18, 2003, RL Webring, (Energy Northwest) to USNRC, "Letter of Intent to Participate in Probabilistic Risk Assessment Quality Pilot Application Program"

2) Memorandum dated November 19, 2003, JL Funches, NRR to James E.

Dyer, NRR, "Fee Waiver for Pilot Application of Approach Proposed in DG-1 122, Determining the Technical Adequacy of PRA Results for Risk-Informed Activities, and The Associated Draft Standard Review Plan (SRP) Section"

Dear Sir or Madam:

Pursuant to 10 CFR 50.90, Energy Northwest requests an amendment of the Facility Operating License No. NPF-21 for Columbia Generating Station (Columbia). Specifically, Energy Northwest requests a change for Technical Specification (TS) 3.8.1, "AC Sources-Operating,"

to permit a longer Completion Time (CT) for the Division 1 and Division 2 Diesel Generators (DGs). The proposed changes are a risk-informed TS change that would extend the diesel generator CT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (the current limit) to 14 days.

Detailed and supporting information is provided in the attachments to this letter. A description of the proposed changes and the associated justification are provided in Attachment 1. The information supporting a finding of no significant hazards consideration and environmental assessment are provided in Attachment 2. A marked-up copy of the affected pages from the current TS is provided in Attachment 3, and a marked-up copy of the affected pages from the current TS Bases is provided for information only in Attachment 4. Following approval of this request, Energy Northwest will revise the Columbia TS Bases in accordance with the TS Bases Control Program of TS 5.5.10. A Probabilistic Risk Assessment (PRA) supporting the proposed changes is provided in Attachment 5.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 2 As previously requested (Reference 1), Energy Northwest submits this license amendment request (LAR) for participation in the NRC probabilistic risk assessment pilot program to guide implementation of Regulatory Guide 1.200 For Trial Use, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

and the associated draft standard review plan, Chapter 19.1, "Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities." Attachment 6 contains the information requested in Regulatory Guide 1.200. Additional information is available for the NRC to perform their review of the PRA at Columbia when conducting the site visit as part of the PRA quality evaluation. Attachment 7 contains a summary of commitments.

The NRC has indicated this review of pilot applications is eligible for a waiver of review fees (Reference 2). Energy Northwest, hereby, requests a fee waiver for the full LAR review pursuant to 10 CFR Part 170.11(b)(1).

If you have any questions or desire additional information pertaining to this letter, please call Mr. DW Coleman at (509) 377-4342.

Respectfully, RL Webring Vice President, Nuclear Generation Mail Drop PE04 Attachments:

1) Proposed Technical Specification Change and Supporting Justification

2) No Significant Hazards Consideration and Environmental Assessment

3) Mark-up of the Affected Pages From the TS

4) Mark-up of the Affected Pages From the TS Bases

5) Probabilistic Risk Assessment (PRA) Supporting the TS Change

6) PRA Quality Assessment Consistent with Regulatory Guide (RG) 1.200, Section 4.2

7) Risk Management Action Commitments for the Extended DG CT cc: BS Mallet - NRC RIV WA Macon - NRC NRR NRC Senior Resident Inspector/988C RN Sherman - BPA/1399 TC Poindexter - Winston & Strawn JL Luce - EFSEC

STATE OF WASHINGTON)

Subject:

Application for Amendment for Extension of Diesel COUNTY OF BENTON ) Generator Completion Time I, R.L. Webring, being duly sworn, subscribe to and say that I am the Vice President, Nuclear Generation for ENERGY NORTHWEST, the applicant herein; that I have the full authority to execute this oath; that I have reviewed the foregoing; and that to the best of my knowledge, information, and belief the statements made in it are true.

DATE , 2004 R. L. Webring Vice President, Nuclear Generation On this date personally appeared before me R. L. Webring, to me known to be the individual who executed the foregoing instrument, and acknowledged that he signed the same as his free act and deed for the uses and purposes herein mentioned.

GIVEN under my hand and seal this / _1day of . . .- r-2004.

NotaXPublic in and for the STATE OF WASHINGTON Residing at_

My Commission Expires 3 2: D

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 24 Attachment 1 PROPOSED TECHNICAL SPECIFICATION CHANGE AND SUPPORTING JUSTIFICATION

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 2 of 24 DESCRIPTION AND JUSTIFICATION OF PROPOSED CHANGE

1.0 INTRODUCTION

In accordance with 10 CFR 50.90, Energy Northwest is requesting changes to Appendix A, "Technical Specifications," of the Columbia Generating Station (Columbia) Facility Operating License No. NPF-21. Specifically, the proposed changes will revise Technical Specification (TS) Limiting Condition For Operation (LCO) 3.8.1, "AC Sources-Operating," to extend the allowed completion time (CT), specified for restoration of an inoperable Division 1 Diesel Generator (DG-1) or Division 2 Diesel Generator (DG-2). Although the current CT for restoration of an inoperable diesel generator (DG) is sufficient to support surveillance testing, limited on-line maintenance, and post-maintenance testing activities, the proposed changes will allow greater flexibility and more efficient planning of DG maintenance and testing activities during plant operation. This, in turn, can reduce the number of DG outages while improving overall DG availability and reliability.

2.0

SUMMARY

/OVERVIEW The proposed extension of the DG-1 and DG-2 CT is based on both a deterministic and risk-informed assessment using the Columbia Probabilistic Safety Assessment (PSA) model, also referred to as the Probabilistic Risk Assessment (PRA) model in this document.

Deterministically, the proposed change is supported by the defense-in-depth basis that is incorporated into the plant design, as well as in the approach to maintenance and operation.

This includes consideration of the availability of other power sources (onsite and offsite) to support the essential plant equipment. The capability of the unaffected trains or divisions is sufficient to provide for the minimum safety functions necessary to shut down the unit and maintain it in a safe shutdown condition.

The proposed change is also supported by a plant-specific risk analysis performed in accordance with United States Nuclear Regulatory Commission (NRC) guidance, as identified below for making risk-informed decisions and risk-informed changes to the plant's TS. The results of this risk analysis, as presented and discussed in this Attachment and in Attachment 5, demonstrate that the increase in plant risk associated with extending the CT for DG-1 or DG-2 is acceptably small. An independent peer review of Columbia's PRA to demonstrate its technical adequacy for this application has been performed using the process of Revision A-3 NEI draft "Probabilistic Risk Assessment (PRA) Peer Review Process Guidance," NEI 00-02, dated June 2, 2000. However, the technical adequacy guidance used was the American Society of Mechanical Engineers standard (ASME) RA-S-2003, Addendum A, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," as endorsed by Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities for Trial Use." Summary

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 3 of 24 results of the peer review are presented in Attachment 6. Further, the program and procedures established at Columbia pursuant to the Maintenance Rule (MR), 10 CFR 50.65, "Requirements for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants,"

will ensure that risk is minimized during the performance of DG maintenance and testing.

3.0 BACKGROUND

Columbia TS LCO 3.8.1, "AC Sources - Operating," specifies requirements for the Electrical Power System AC sources. Columbia's Electrical Power System AC sources consist of the offsite power sources and the Class 1E onsite standby power source diesel generators DG-1, DG-2, and Division 3 DG (DG-3) for the High Pressure Core Spray System (HPCS). As required by 10 CFR 50, Appendix A, General Design Criteria (GDC) 17, the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

Figure 1 below is a simplified one-line diagram of Columbia's onsite and offsite distribution systems. The Class 1E AC distribution system supplies electrical power to three divisional load groups, Divisions 1, 2, and 3, with each division powered by an independent Class 1E 4.16 kV ESF bus. The Division 1 and Division 2, 4.16 kV ESF buses have two separate and independent offsite sources of power. The Division 3, 4.16 kV ESF bus has one source of offsite power. Each Class 1E 4.16 kV ESF bus has a dedicated onsite DG. Any two of the three divisions of ESF systems provide the minimum safety functions necessary to achieve and maintain plant shutdown and mitigate the consequences of a design basis accident (DBA).

Columbia's Final Safety Analysis Report (FSAR), Chapter 8 describes the offsite power network supply to the transformer yard from the Bonneville Power Administration (BPA) transmission network. From the transformer yard, two qualified, electrically and physically separated circuits provide AC power to the Division 1 and Division 2, 4.16 kV ESF buses (SM-7 and SM-8). One qualified circuit provides AC power to the Division 3, 4.16 kV ESF bus (SM-4). One qualified circuit is powered from the 230 kV Ashe Substation stepped down through the 230 kV/4.16 kV windings of a 230 kV/6.9 kV/4.16 kV transformer (the startup transformer, TR-S) through connecting switchgear to all 4.16 kV ESF buses. The other qualified circuit (to Division 1 and Division 2, 4.16 kV ESF buses only) is powered from the 115 kV Benton Substation stepped down through a 115 kV/4.16 kV transformer (the backup transformer, TR-B). The offsite AC electrical power sources are designed and located to minimize, to the extent practicable, the likelihood of their simultaneous failure under anticipated operational occurrences and in the event of postulated accidents.

A qualified offsite circuit consists of breakers, transformers, switches, interrupting devices, cabling, and controls required to transmit power from the offsite transmission network to the onsite Class 1E ESF buses. The startup transformer normally provides power to the 4.16 kV ESF buses when the main generator is not connected to the grid. An automatic transfer feature

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 4 of 24 is provided for the ESF divisions. If power is lost to the Division 1 and Division 2 4.16 kV ESF buses (SM-7 and SM-8) due to a loss of the startup transformer supply, the backup transformer supply breaker to the bus will automatically close and provide power. When the main generator is supplying power to the grid, the connection is to the 500 kV grid. In this normal operational line up, power is provided to all the 4.16 kV ESF buses by a 25 kV/4.16 kV normal auxiliary transformer (TR-Nl) fed from the main generator 25 kV isolated phase bus. However, this power source is not credited with meeting the requirements of LCO 3.8.1 .a, because it does not come from an offsite circuit.

Automatic transfer capability is provided so that failure of the TR-N1 supply causes immediate tripping of the normal auxiliary transformer supply breakers and simultaneous closing of the TR-S auxiliary switchgear breakers to supply the balance of plant (BOP) and ESF buses. Each TR-S supply breaker is interlocked to close only if the associated normal auxiliary transformer supply breaker is not locked out, thus preventing closing onto a fault or connecting a credited source to a non-credited source. Manual live transfer capability of power between the normal auxiliary transformer source and the startup and backup (Division 1 and Division 2 only) transformer sources is also provided.

4.0 CURRENT COMPLETION TIME BASIS FOR AN INOPERABLE DIESEL GENERATOR The CTs associated with inoperable AC power sources are intended to minimize the time an operating plant is exposed to a reduction in the number of available AC power sources, and yet permit sufficient time to perform testing or repairs without unnecessarily requiring a plant shutdown. As stated in the TS Bases, the CTs currently specified in LCO 3.8.1 are in accordance with the recommendations of RG 1.93, "Availability of Electric Power Sources,"

(Revision 0). With the number of available AC power sources equal to one less than the number required by LCO 3.8.1.a, the remaining operable DGs and offsite circuits are adequate to supply electric power to the onsite Class 1E distribution system. The current 72-hour CT for an inoperable Division 1, 2, or 3 DG, as specified by Required Action B.4, takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

Additional CTs for other Required Actions under TS 3.8.1 are specified to ensure, for example, timely verification that the offsite circuits are fully available when a DG is declared inoperable (per Required Action B. 1), that required features supported by the inoperable DG are declared inoperable when the redundant required feature(s) are inoperable (per Required Action B.2), or that a determination is made to confirm that DG inoperability is not due to common-cause failure (per Required Action B.3.1 or B.3.2). In particular, a six-day CT is denoted in Required Actions A.2 and B.4.1 to limit the time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the TS LCO.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 5 of 24 Figure 1 TO MAIN GENERATOR <Y I25KV 230KV No XTO ASHE SUBSTATION 1230 MVA TR-Nl TR-S NORMAL AUX POWER START UP POWER 4.16KV 4.16KV 6.9KV (24 MVA) (40 MVA) IT (30 MVA)

NON-SAFETY RELATED L

SAFETY RELATED TR-B

~ BACK-UP POWER COLUMBIA GENERATING STATION 115KV l r TO BENTON SUBSTATION SIMPLIFIED ONE LINE

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 6 of 24 5.0 PROPOSED TECHNICAL SPECIFICATION CHANGES 5.1. Description of Proposed Changes To extend the CT permitted by the TS for DG-1 and DG-2, Energy Northwest proposes to revise the Required Action for B.4 and certain CTs for Required Actions A.3, B.3.2, and B.4 of TS 3.8.1.

The proposed changes to LCO 3.8.1, as reflected in the annotated TS pages provided in Attachment 3, are as follows:

1. Add an optional set of Required Actions to B.4:

"B.4.2.1 Establish risk management action for the alternate AC source to the battery chargers.

AND B.4.2.2 Restore required DG to OPERABLE status."

2. The Completion Time for Required Action B.4.2. 1 is "72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ."

3. The Completion Times for Required Action B.4.2.2 are " 14 days AND 17 days from discovery of failure to meet LCO."

4. Revise the Completion Time for Required Action B.3.2 to add "if not performed within the past 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

5. Renumber current Required Action B.4 to "B.4. 1."

6. Add to the Required Action B.4.1 Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months the phrase "from discovery of an inoperable DG."

7. Revise the Completion Time for Required Action A.3 from: "6 days from discovery of failure to meet LCO" to "6 days from discovery of failure to meet LCO when not associated with Required Action B.4.2.2."

8. Revise the Completion Time for Required Action A.3 to add "17 days from discovery of failure to meet LCO."

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 7 of 24 5.2. Changes 1, 2, and 3 The primary change applies to Required Action B.4, which provides an extension of the CT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days when the DG-1 or DG-2 is inoperable and the risk management action has been established. This is accomplished by a change that adds an optional set of Required Actions with the existing Required Actions. Additional changes are needed to add or revise other CTs specified under Required Actions A.3 and B.4 to address certain scenarios involving combinations or sequences of AC source inoperabilities that could occur. These changes are needed to support or maintain consistency with the proposed extended DG CT and are further explained below.

The 14-day extension of the CT for the DG-1 and DG-2 is conditioned by a Required Action to "Establish risk management action for the alternate AC source to the battery chargers." The risk management action is detailed in the TS Bases. The risk management action is to establish the availability of an alternate AC source to the Division 1 and Division 2 battery chargers (AACSBC). The term "available" is further specified in the TS Bases. This format is similar to other Required Actions in TS (ref LCO 3.4.9, LCO 3.4.10, LCO 3.9.8, and LCO 3.9.9).

5.3. Change 4 Required Action B.3.2 provides one means for addressing the potential for a common-cause failure when a DG is inoperable. The proposed flexibility is to allow performance of SR 3.8.1.2 within the past 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to also satisfy the Surveillance Requirement. This will avoid the potential for having to test the Operable DG during the time the other DG is inoperable.

This will also facilitate verifying the DGs being relied upon by testing the Operable DG immediately prior to the planned maintenance on the other DG. Although not a risk management action or credited in the PRA, this flexibility would provide additional assurance for planned maintenance activities. Additionally, this flexibility allows the normal surveillance testing schedule to be interfaced with planned maintenance schedule without the Action requirement causing the remaining DGs to be unnecessarily exposed to risks during the surveillance testing.

Corrective maintenance is performed when the equipment is failed or is degraded such that action should be taken to ensure future operability. For degraded conditions, this flexibility will allow the verification, through testing, that Common-cause conditions are not present prior to removing the degraded DG from service.

5.4. Change 5 and 6 A change to the CT of Action B.4. 1 is required to avoid an unintentional entry into a condition prohibited by the TS. An addition to the CT is proposed for Action B.4.1 to address the start time for an inoperable DG. This is needed to limit the CT for an inoperable DG without the risk management action for the AACSBC being established and to address a special case for

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 8 of 24 DG-3. The DG-3 is addressed differently than DG-1 and DG-2 due to the connection between the TS requirements for DG-3 and the TS requirements for the HPCS system, which is based on the dedicated relationship between DG-3 and the HPCS system.

Requirements for the HPCS system are specified in LCO 3.5.1, "ECCS - Operating."

Currently under TS 3.8.1, the CT for an inoperable DG-3 is limited to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . If the 72-hour CT is not met, the provision exists for declaring the HPCS system inoperable such that the applicable Condition under LCO 3.5.1 is entered. In accordance with Required Action B.2 under LCO 3.5.1, the CT for restoring the HPCS system (i.e., DG-3) to Operable status is 14 days. Thus, between the 72-hour DG CT under TS 3.8.1 and the 14-day HPCS system CT under LCO 3.5.1, the overall CT for an inoperable DG-3 is 17 days (provided that the inoperable DG-3 is the only reason for declaring the HPCS system inoperable and that the Reactor Core Isolation Cooling system (RCIC) is Operable (per Condition B of LCO 3.5.1).

The additional proposed change to the CT for Action B.4.1 for an inoperable DG is needed to maintain the LCO 3.8.1 72-hour CT for any of the DGs being inoperable until the action associated with B.4.2.1 is completed. The words "from discovery of an inoperable DG" are needed to address, in particular, the situation when inoperability of DG-3 overlaps or occurs contiguously with another DG source being inoperable. This is best explained with an example: assume that DG-1 or DG-2 is declared inoperable and Required Action B.4.2.1 is met (thus extending the CT clock for the inoperable DG to the 14 days), and then the DG-3 is declared inoperable, say, five days later. This would constitute entry into Condition E. Then assume that DG-1 or DG-2, which was previously declared inoperable, is promptly restored to Operable status. This would cause Condition E to be exited. At this point, Condition B would still be in effect due to the inoperable DG-3 even though the CT clock would still be running from the time when Condition B was entered due to the originally inoperable DG-1 or DG-2.

The proposed wording makes it clear that the 72-hour clock for the DG (in this case DG-3) starts at the time when it was discovered to be inoperable, and not when DG-1 or DG-2 was declared inoperable. Without such wording, a condition prohibited by TS would occur in this case because the 72-hour CT would already have been exceeded for the second DG since, as just noted, it would have to be assumed that the CT clock for Condition B started at the time Condition B was entered for the inoperable DG-1 or DG-2.

The additional changes described above are a consequence of the fact that multiple condition entry is not allowed under TS 3.8.1 so that separate CT clocks cannot be run for each inoperable AC source, i.e., for each entry into the Conditions under the TS. Thus, for sequential, overlapping (i.e., "contiguous") inoperabilities under this LCO, the CT clock starts once the LCO is not met. As illustrated by the above example, there is no resetting of the clock when, after an initial Condition entry, a second or subsequent Condition goes into effect and is then cleared while the initial Condition entry is still in effect.

A second CT applies "from discovery of failure to meet LCO" for both B.4.1 and B.4.2.2.

These CTs are specified to limit "daisy chaining" of CTs when, for example, an AC offsite source is declared inoperable, then a DG is declared inoperable (after which the AC source is

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 9 of 24 quickly restored to Operable status). If an AC source is again declared inoperable following the DG inoperability, the CT from failure to meet the LCO could become unreasonably long.

Therefore, the total CT for such contiguous or overlapping inoperable conditions is limited by imposing a CT that begins, not from when the current Condition or equipment inoperability is entered, but from when the discovery of initially failing to meet the LCO is identified. The total CT specified in each of the affected Required Actions is thus being extended to be consistent with the longer CT proposed for an inoperable DG. These additional CTs are consistent with the current structure and philosophy of LCO 3.8.1.

5.5. Changes 7 and 8 The CTs for Required Action A.3 requires modification to avoid conflicts with the extended CT of B.4.2.2. This is accomplished by adding the limitation that the CT for an inoperable offsite circuit that is in a sequential or overlapping (i.e., "contiguous") inoperability with another AC source is 6 days when the failure to meet the LCO is not associated with the extended CT of B.4.2.2. A third CT of 17 days is necessary for when the overlapping inoperability is associated with an extended DG CT of B.4.2.2. Because all the A.3 CTs are connected by the AND connector, the most restrictive will apply.

6.0PROPOSED RISK MANAGEMENT ACTION: ALTERNATE AC SOURCE FOR THE DIVISION 1 AND DIVISION 2 BATTERY CHARGERS The proposed change to the TS includes a Required Action to verify the AACSBC is available.

This Required Action is specifically to minimize the risk associated with the proposed extended CT. This alternate source is a 480-volt diesel generator that will have the capacity to supply 480-volt power at the required voltage and frequency to supply the required DC battery chargers and prevent further discharge of the batteries. The CT for the Required Action to establish the AACSBC is chosen to correspond with the existing 72-hour CT for Required Action B.4. 1. For planned DG maintenance, this feature will be established prior to entry. For emergent conditions requiring DG maintenance, this Required Action must be established prior to exceeding the 72-hour CT of Required Action B.4.2. 1.

No change to Columbia's Station Black Out (SBO) coping time evaluation in FSAR section 8A is proposed and no change in actions will be required to meet the SBO coping time evaluation. Note:

The SBO scenario discussed in this submittal is based on Columbia's PRA model, not on 10 CFR 50.63 requirements. The AACSBC will add additional time to the current credited features and prolong the time that certain features will remain available. Specifically, operation of the Automatic Depressurization System (ADS) can continue to control pressure, reactor and containment instrumentation will remain available for operators use in responding to the effects of the SBO condition, power for breaker control will be extended for AC power restoration and longer operation of RCIC will be possible as long as adequate reactor steam supply pressure remains.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 10 of 24 The proposed design of the AACSBC includes permanent cabling from a non-safety related 480 volt DG to a load center in the area of the battery rooms. Distribution will be from the load center to key lock transfer switches associated with the Division 1 250 volt and 125 volt battery chargers and the Division 2 125 volt battery charger. The key lock transfer switches will allow manual transfer from the normal Class IE bus to the AACSBC. Use of this AACSBC will be administratively controlled. The design of the load center and transfer switches will be in conformance with Columbia's separation criteria which is detailed in FSAR Section 8.3.1.4, "Independence of Redundant Systems."

Procedures for verifying the AACSBC diesel generator is capable of performing its risk management function, including starting and loading, will be performed prior to declaring the AACSBC available.

Until the permanent portions of AACSBC are installed, the use of the extended CT will only be used if the 480 volt DG, temporary cabling, load center, and wiring are pre-staged prior to exceeding the 72-hour CT for establishing the risk management actions. Columbia has developed a temporary installation package for this configuration that was part of a notice of enforcement discretion (NOED) granted in February 2003 for a total 14-day out-of-service time period for DG-1 bearings replacement. This is an additional commitment associated with this proposed change.

In addition, 10 CFR 50.65(a)(4) requires that configuration changes be assessed prior to any planned maintenance that could impact risk. Those configuration risk management actions that are part of Columbia's configuration risk management program will also include the specific configuration controls credited in the PRA evaluation of this change. The specific configuration controls credited in the PRA and additional risk management actions are identified later in this request.

7.0 REASON FOR PROPOSED CHANGES As noted above, the primary change to TS 3.8.1 is the CT extension for an inoperable DG-1 or DG-2; the remaining changes are incidental to this change. Implementation of this proposed Completion Time extension for an inoperable DG-1 or DG-2 will provide the following benefits:

Allows increased flexibility in the scheduling and performance of DG preventive maintenance.

Allows better control and allocation of resources. By allowing on-line preventive maintenance, including scheduled overhauls, the change provides the flexibility to focus more quality resources on any required or elective DG maintenance.

Averts unplanned plant shutdowns and minimizes the potential need for requests for NOEDs.

Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

Improves DG availability during shutdown Modes or Conditions. This should reduce the risk associated with DG maintenance and the synergistic effects on risk due to DG unavailability occurring at the same time as other various activities and equipment outages that occur during a refueling outage.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 11 of 24

Reduces the number of individual entries into Required Action statements by providing sufficient time to perform related maintenance tasks with a single entry.

The proposed extension of the required CT is adequate to perform normal DG inspections and preventive maintenance requiring disassembly of the DG, and to perform post maintenance and operability tests required to return the DG to an operable status. At the same time, the extended DG CT can support required periodic major overhauls of the DGs during plant operation. For such cases, the intent would be that a major overhaul of each DG would be performed at a frequency of no more than once per DG per operating cycle.

In general, plant configuration changes for planned and unplanned maintenance of the DGs, as well as the maintenance of equipment having risk significance, will be managed pursuant to the configuration risk management procedures and program implemented at Columbia for compliance with 10 CFR 50.65. Pertinent details of the plant MR Program are discussed in Attachment 5 of this submittal.

8.0 EVALUATION OF CHANGE The following sections provide an evaluation of the proposed extension of the DG CT with regard to the principles that adequate defense-in-depth is maintained, sufficient safety margins are maintained, and that the proposed increases in core damage frequency and risk are small and are consistent with the guidance of RG 1.177, "An Approach For Plant-Specific, Risk-Informed Decision Making: Technical Specifications," Revision 0. The sections that follow are a discussion regarding compliance with the applicable GDC of 10 CFR 50, Appendix A; a discussion of the engineering considerations, such as defense-in-depth; and other considerations. A summary of the evaluation of the risk impact, including a description of the risk management tools developed for Columbia, is presented in Section VII.

8.1. General Design Criteria and Regulatory Guide Compliance The onsite power system complies with applicable NRC GDC and RGs as described in detail in FSAR Section 1.8, "Conformance to NRC Regulatory Guides," and FSAR Section 8.3.1.2, "Analysis." Safety-related systems and components that require electrical power to perform their safety-related functions are defined as Class 1E loads. The proposed TS changes do not add or reclassify any safety-related systems or equipment; therefore, conformance with RG 1.6, Revision 0, "Independence Between Redundant Standby (Onsite) Power Sources and Between Their Distribution Systems," as discussed in Section 8.3.1.4, "Independence of Redundant Systems," of the FSAR is not affected by this change. These proposed changes do not add any loads to the DGs; therefore, the selection of the capacity of the DGs for standby power systems and conformance to the applicable Sections of RG 1.9, Revision 0 and selected portions of Revision 3, "Selection, Design and Qualification of Diesel-Generator Units Used as Onsite Electric Power Systems at Nuclear Power Plants," are not affected by this change.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 12 of 24 Columbia's design complies with RG 1.32, Revision 0, "Criteria for Safety Related Electric Power Systems for Nuclear Power Plants," and with Revision 2 of this RG, with the exception of those sections of the RG which require compliance with RG 1.93, Revision 0.

Conformance with RG 1.93, "Availability of Electric Power Sources," was not required due to Columbia's construction permit date, however during conversion to the improved technical specification format, conformance with selected portions of RG 1.93 was made as described in the TS Bases Section 3.8.1. Conformance with RG 1.93 is affected by these proposed changes, since the RG prescribes a maximum CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for an inoperable AC power source (consistent with the current TS) and states the 72-hour CT will not be entered for preventive maintenance of the DGs. When the proposed changes are approved, Energy Northwest will continue to conform to RG 1.93 as described in the TS Bases with the exception that the allowed CT for restoration of a DG will be increased from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days and will be used for DG preventive maintenance.

8.2. Engineering Considerations The impact of the proposed TS changes was evaluated and determined to be consistent with the defense-in-depth philosophy. The defense-in-depth philosophy in reactor design and operation requires multiple means or barriers to be in place to accomplish safety functions and prevent release of radioactive material.

Columbia is designed and operated consistent with the defense-in-depth philosophy. Columbia has diverse onsite and offsite power sources available (e.g.3 DGs, TR-S, and TR-B) so that the overall availability of the AC power sources to the ESF buses will not be reduced significantly as a result of increased on-line preventive maintenance activities. Although the proposed changes increase the length of time a DG can be out of service, with one DG out of service during operation, adequate defense-in-depth exists to ensure the availability of AC sources for supplying electric power to the onsite Class 1E distribution system. As described previously (refer to simplified one-line diagram above), the safety-related equipment required to mitigate the consequences of postulated accidents consists of three independent ESF divisions.

Division 1 and Division 2 can be powered using three independent sources of power (either of the two offsite sources or the associated DG). Further, the design assures that loss of an entire division will not prevent safe shutdown of the unit in the event of a DBA. Loss of a single power source by voluntary entry into a TS Action for DG maintenance does not reduce the amount of available equipment to a level below that necessary to mitigate a DBA. The remaining power sources are designed with adequate independence, capacity, and flexibility to ensure that power will be provided to the necessary equipment during postulated accidents.

Thus, with one DG out of service, there are multiple means to accomplish safety functions and prevent release of radioactive material in the event of an accident. The Columbia PRA confirms the results of this deterministic analysis, i.e., the adequacy of defense-in-depth, so that protection of the public health and safety is ensured, as discussed later.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 13 of 24 No new potential common-cause failure modes are introduced by these proposed changes, and protection against common-cause failure modes previously considered is not compromised.

Adequate defenses against human errors are maintained. The proposed changes require one new operator response to credit the AACSBC in the PRA. If an SBO occurred during the extended 14 day CT and restoration of AC power was likely to extend beyond the current battery depletion time, operators would place the AACSBC in service to extend the availability time of the Division 1 and Division 2 batteries.

Qualified personnel will continue to perform DG maintenance whether such maintenance is performed on-line or during plant shutdowns.

Therefore, under controlled conditions it is acceptable to extend the CT and perform on-line maintenance intended to maintain the reliability of the onsite emergency power systems.

8.3. Other Considerations Columbia continues to comply with the conditions of the current operating license. The proposed changes do not conflict with any other commitments, including those associated with SBO capability and the FSAR.

8.4. Station Blackout Capability Columbia is able to withstand and recover from an SBO event of four hours in accordance with 10 CFR 50.63 "Loss of All Alternating Current Power" and the guidelines of Revision 0 of RG 1.155, "Station Blackout." The assumptions used in the SBO analysis regarding the availability and reliability of the DGs are unaffected by these proposed changes since the DGs are not assumed to be available during the SBO coping period. The results of the SBO analysis are also unaffected by the proposed changes. Although the addition of the AACSBC will provide additional battery capability during an SBO and prolong the actual coping time, this additional feature is being applied as a risk management action and not as credited SBO coping equipment for the purpose of complying with 10 CFR 50.63.

8.5. Impact on the FSAR Safety analysis acceptance criteria in the FSAR continue to be met. The proposed changes do not affect any assumptions or inputs to the safety analyses. Unavailability of a single DG due to maintenance does not reduce the number of DGs below the minimum required to mitigate DBAs. In addition, the proposed changes have no impact on the availability of the two offsite sources of power. The effect on FSAR acceptance criteria has been assessed assuming that one DG is out of service and no additional failures occur. The required safety functions continue to be available, and the associated acceptance criteria continue to be met.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 14 of 24 9.0 EVALUATION OF RISK IMPACT An assessment is provided in Attachment 5 that addresses conformance to the defense-in-depth philosophy. That evaluation, which is consistent with the guidance pertaining to risk-informed criteria specified in RG 1.177, essentially assumes the plant is in Condition B of TS 3.8.1 with the associated CT in effect (i.e., a DG is inoperable), with no additional failures. Generally, entry into a TS Condition means that single-failure criteria are not met. The deterministic evaluation showed that sufficient ESF equipment would remain available to achieve safe shutdown of the facility and to mitigate DBAs. The proposed extension of the DG CT will still allow the Emergency Core Cooling Systems (ECCS) to continue to satisfy 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors," as previously analyzed.

To further assess the overall impact on plant safety, a risk analysis has been performed for the proposed changes to quantify the change in average core damage frequency (CDF) and average large early release frequency (LERF) produced by the increased CT for the DG-1 and DG-2. This evaluation included consideration of the configuration risk management process established at Columbia pursuant to 10 CFR 50.65 to control performance of other potentially high-risk tasks during a DG outage and consideration of specific compensatory measures to minimize risk. These elements were included in a risk evaluation performed using the three-tiered approach suggested in RG 1.177, as follows:

Tier 1 - PRA Capability and Insights, Tier 2 - Avoidance of Risk-Significant Plant Configurations, and Tier 3 - Risk-Informed Configuration Risk Management.

Evaluations of these tiers are provided below. Presented in Attachment 6, is information related to the development, certification, and application of the PRA model in place for Columbia in accordance with the pilot program for trial use of RG 1.200. A summary is provided below, with specific emphasis on parts of the PRA sensitive to an extended DG CT.

9.1. The Columbia PRA Model-Development The PRA model for Columbia was first developed for the Individual Plant Examination (IPE) that was submitted to the NRC by Letter G02-94-175, dated July 27, 1994, JV Parrish to NRC, "Revision 1 to Response to Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f)." The NRC staff issued its Safety Evaluation (SE) for the Columbia IPE by letter dated April 8, 1997, wherein the NRC staff concluded that the Columbia IPE submittal met the intent of Generic Letter 88-20. In the SE accompanying this letter, the NRC cited certain issues, which were classified as limitations or weaknesses in the PRA. These issues were then evaluated by Energy Northwest staff to determine the impact on the PRA and then prioritized for inclusion in future updates. The major PRA limitations identified in the NRC SE were incorporated into the PRA via three subsequent updates.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 15 of 24 The Peer Review Process developed as part of the Boiling Water Reactor Owners' Group (BWROG) PRA Peer Review Certification Program was first used in 1997 to assure the Columbia PRA was comparable to other PRA programs in use throughout the industry. In February 2004, an independent assessment of the Columbia PRA using the peer review process with more recently developed criteria, was performed to ensure that the Columbia PRA was of sufficient technical adequacy for the DG CT extension application. A PRA Certification Team (Erin Engineering) completed an inspection and review of the Columbia PRA in February 2004 using the criteria of Appendix A of RG 1.200 For Trial Use "An Approach For Determining The Technical Adequacy of Probabilistic Risk Assessment Results For Risk-Informed Activities" (draft) and ASME RA-S-2002, Addendum 2003 "Standard For Probabilistic Risk Assessment For Nuclear Power Plant Applications." Included in this review were the models and methodology used in the Columbia PRA. The quality of the PRA and completeness of the PRA documentation were also assessed. The peer review team found that the Columbia PRA, Revision 5, is capable of addressing issues such as those associated with extending the DG CT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days with a few enhancements. These enhancements were addressed as part of the analysis supporting this submittal.

9.2. Application of the Columbia PRA The PRA model, Revision 5, is used in this evaluation to determine changes in risk from equipment removed from service for maintenance. The risk metrics calculated by the PRA model include core damage frequency and large early release frequency.

Scheduling and operating personnel throughout the process of planning and implementing work use the PRA model. This is implemented through the use of a risk monitor, OREM/Sentinel, described in Columbia Procedure 1.5.14, "Risk Assessment Management for Maintenance/Surveillance Activities." The results obtained from the PRA model are used as guidance along with other inputs such as TS requirements for determining the final work schedule.

The PRA addresses internal events and fires at full power. A special effort was made to ensure that those aspects of the PRA that are potentially sensitive to changes in DG maintenance unavailability are adequate to evaluate the risk impacts of the increased CTs for the DGs.

These elements include a more comprehensive characterization of the initiating event involving a loss of the TR-S and TR-B. Also incorporated were additional plant-specific failure rates and recent design changes. Updating and maintenance of the PRA is controlled under Quality Control Instructions within the PRA program manual.

I APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 16 of 24 For use of the PRA to support changes to the TS, the guidance of RG 1.177 and RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," is utilized.

With regard to the evaluation recently performed to support extension of the DG CT, Energy Northwest is confident that the results of the risk evaluation (described more fully in Attachment 5) are technically sound and consistent with the expectations for PRA quality set forth in RG 1.177 and RG 1.174. The scope, level of detail, and quality of the PRA is sufficient to support a technically defensible and realistic evaluation of the risk change from this proposed CT extension.

9.3. Tier 1: PRA Capability and Insights As noted previously, risk-informed support for the proposed changes to the DG CT (for either Division 1 or Division 2) is based on PRA calculations performed to quantify the change in average CDF and average LERF resulting from the increased CT. To determine the effect of the proposed changes with respect to plant risk, the guidance provided in RG 1.174 and RG 1.177 was used.

An evaluation was performed based on the assumption that the full, extended CT (i.e., 14 days) would be applied once per DG per refueling cycle. The cycle time is based on the current 24-month fuel cycle (allowing for planned and unplanned plant outage time) for a net total cycle length of 670 operating days.

The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) were computed in accordance with RG 1.177. The results of the risk evaluation, including the computed ICCDP and ICLERP, are presented in Attachment 5. The results of the risk evaluation were compared with risk significance criteria from RG 1.174 for changes in the annual average CDF and LERF and from RG 1.177 for ICCDP and ICLERP. The limiting values for the average change in CDF and LERF with risk management actions in place are 3.09E-7/yr and 1.21E-9/yr, respectively. The limiting values for the ICCDP and ICLERP with risk management actions in place are 2.92E-07 for DG-2 and 1.46E-9 for DG-1, respectively. These quantified risk metrics meet their acceptance guidelines and demonstrate that the proposed DG CT change has a very small quantitative impact on plant risk.

In determining the values above, the PRA quantification truncation limit was set to lE-12/yr for sequence quantification. This is more than five orders of magnitude below the total CDF.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 17 of 24 With regard to plant risk during shutdown conditions, no quantitative evaluation of the proposed changes was performed. However, it is reasonable to conclude that performing DG overhauls on-line rather than during outages will increase DG availability during outages. This should reduce shutdown risk by improving the availability of standby AC power sources for shutdown cooling equipment and other equipment needed to mitigate events that may be postulated to occur during shutdown. This increase in safety has not been quantified for Columbia.

9.4. Tier 2: Avoidance of Risk-Significant Plant Configurations As noted previously, a configuration risk management process is in place at Columbia in accordance with Energy Northwest commitments for compliance with 10 CFR 50.65, particularly with respect to paragraph (a)(4) of that regulatory requirement. The program provides assurance that risk-significant plant equipment configurations are precluded or minimized when plant equipment is removed from service. For a plant DG removed from service, increases in risk posed by potential combinations of out-of-service equipment will be managed in accordance with the program as follows:

A. The DG extended CT will not be entered for scheduled maintenance purposes if severe weather conditions are expected.

B. The condition of the offsite power supply and transmission yard, including transmission lines and the stability of the Federal Columbia River Transmission System, will be evaluated through contact with the BPA dispatcher.

C. No elective maintenance will be scheduled within the transmission yard that would challenge the TR-S or TR-B connections or offsite power availability during the proposed extended DG CT.

D. Operating crews will be briefed on the DG work plan, with consideration given to key procedural actions that would be required in the Loss Of Offsite Power (LOOP) or SBO.

E. While in the proposed extended DG CT, the following systems are risk significant during the extended DG CT period and will be protected so that elective maintenance and testing are not performed:

1. Cross train DGs and their respective Service Water Systems

2. TR-S and TR-B and the associated breakers and relay logic (protective and control)

3. HPCS system

4. RCIC system F. While in the proposed extended DG CT, additional elective equipment maintenance or testing that requires any other risk significant equipment to be removed from service will be evaluated and activities that yield unacceptable results will be avoided.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 18 of 24 G. Emergent conditions that result in the protected systems being challenged will be managed to minimize the risk impact.

The above additional risk management actions associated with the configuration risk management program are a new commitment for the extended DG CT. Associated procedures will be revised to implement this commitment.

It should also be noted that TS 3.8.1 requires TR-S and TR-B to be operable during Modes 1, 2 and 3. When a DG becomes inoperable, offsite power operability is ensured by performing Required Action B. 1, which requires a verification of the availability of the required offsite qualified circuits.

9.5. Tier 3: Risk-Informed Configuration Risk Management Program Consistent with 10 CFR 50.65(a)(4), as indicated above, Energy Northwest has developed a program to ensure that risk impacts of out-of-service equipment are appropriately evaluated prior to performing a maintenance activity. The procedure that governs this process is described in Columbia Procedure PPM 1.5.14, "Risk Assessment and Management for Maintenance/Surveillance Activities." This program uses blended (quantitative and qualitative) methods, consistent with the NUMARC 93-01 guidelines, for assessing and managing the increase in risk that may result from maintenance activities.

9.5.1 Key Plant Safety and Transients Functions.

The qualitative assessments evaluate defense-in-depth in key plant safety functions and potential of maintenance activities that may lead to a plant transient or an initiating event. To evaluate the defense-in-depth of the safety systems available in the maintenance configuration, the following safety functions are evaluated:

Reactivity Control RPV Overpressure Control High Pressure Inventory Control RPV Depressurization Low Pressure Inventory Control Reactor/Containment Heat Removal Primary Containment Control Secondary Containment Control 4KV Electrical Power Supply Service Water

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 19 of 24 To evaluate the potential safety impact of an increased transient initiating event frequency and the degree of mitigating capability for the event, the following transient functions are evaluated Plant Trip/Manual Scram Loss of Condenser Loss of Feedwater Loss of Offsite Power Loss of DC Division I Loss of DC Division II Loss of Control and Service Air Anticipated Transient Without Scram Interfacing System Loss of Coolant Accident Stuck Open Relief Valve/Small LOCA

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 20 of 24 9.5.2 Quantitative Assessment of Configuration Risk The Quantitative assessment is based on the PSA Level one internal event model to calculate the core damage risk increase for the maintenance configuration. The Plant Risk Level is determined based on the results of the qualitative and quantitative assessments. The Plant Risk Levels are designated in the colors as defined below:

Plant Risk Levels

a. Maximum defense-in-depth Green b. No evident plant transient

c. Minimal increase in core damage risk, i.e., the configuration-specific core damage frequency (CDF) increases less than two times of the baseline CDF

a. Reduced defense-in-depth,

b. Plant transient is evident but a full complement of mitigation capability is ellavailable, or plant transient mitigating capability is reduced but no related Yelowplant transient is evident

c. Acceptable increase in core damage risk, i.e., the configuration-specific incremental core damage probability (ICDP) is less than 106

a. Marginal defense-in-depth,

b. Plant transient is evident and plant transient mitigating capability is Orange degraded, or plant transient mitigating capability is significantly degraded ge but no related plant transient is evident

c. Significant increase in core damage risk, i.e., the configuration-specific ICDP is between 10.6 and 10

a. No defense-in-depth Red b. Plant transient is evident and plant transient mitigating capability is degraded

c. Unacceptable increase in core damage risk, i.e., the configuration-specific ICDP is greater then 105

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 21 of 24 9.5.3 Risk Management Actions Risk Management Actions are required for each associated Plant Risk Level to control risk of a maintenance activity. The Risk Management Actions are summarized below:

Risk Management Actions Plant Risk Level in Green No additional actions are required beyond normal plant work control.

Plant Risk Level in Yellow Adherence to the schedule is required.

Plant Risk Level in Orange Adherence to the schedule is required. In addition, the following actions should be implemented:

Actions to provide

Conduct pre-job brief with participants performing the tasks and increased risk awareness support personnel directly supporting the performance of the work.

control:

Establish a written contingency plan to restore out of service equipment rapidly.

Use of peer checks is mandatory Actions to reduce

Pre-stage parts and materials.

duration of maintenance

Perform maintenance around the clock.

activity:

Walk-down tag-out and maintenance activity prior to conducting maintenance.

If appropriate, conduct training on mockups to familiarize maintenance personnel with the activity.

Designate test coordinator and management oversight

Management oversight stationed and participate in prejob brief.

System Engineer (or identified alternate) available on site for job coverage Actions to minimize

Minimize other work or plant evolutions that could cause plant magnitude of risk transients, specifically, the following initiators:

increase: - Turbine Trip

- MSIV Isolation

- Loss of Condenser Vacuum

- Loss of Feedwater

Minimize other work in areas that could affect other redundant systems (e.g., ECCS pump rooms), such that there is enhanced likelihood of the availability of the Safety Functions provided by the SSCs in those areas.

Post protected systems, as necessary.

If appropriate, establish alternate success paths for performance of the Safety Function of the out-of-service SSC.

Other actions specified by the PSA engineer.

Plant Risk Level in Red lIA Red Plant Risk Level is not to be intentionally entered.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 22 of 24 10.0 IMPLEMENTATION AND MONITORING PROGRAM To ensure the proposed extension of the DG CT does not degrade operational safety over time, an evaluation is required, as part of the MR should equipment not meet its performance criteria.

10.1. Maintenance Rule Program The reliability and availability of the affected DGs at Columbia are monitored under the MR program as implemented by Columbia Procedure PPM 1.5.11 "Maintenance Rule Program."

If the pre-established reliability or availability performance criteria are exceeded for the DGs, consideration must be given to 10 CFR 50.65(a)(1) actions, including increased management attention and goal setting in order to restore DG performance to an acceptable level. The performance criteria are risk based and are a means to manage the overall risk profile of the plant. An accumulation of small risk evolutions over time resulting in a significance core damage probability is precluded by the performance criteria.

In practice, the actual out-of-service time for the DGs is minimized to ensure that MR reliability and availability performance criteria for these components are not exceeded. The DG availability used in the PRA analysis to calculate the ACDFAvg value for a 14-day CT is conservative compared to the DG system MR goals, actual past performance of the DGs at the plant, and expected availability following implementation of the proposed increased DG CT.

The latter is true because a full 14 days of unavailability per cycle is not anticipated.

The DGs are currently in the 10 CFR 50.65(a)(2) MR category and meet established performance goals. Performance of DG on-line maintenance is not anticipated to result in exceeding the current established MR criteria for DGs. Additionally, the diesel generator's reliability is assessed and monitored to specific reliability goals by PPM 1.5.12, "Diesel Generator Reliability Program." A DG Reliability Committee assures that procedure and policies, oversight and guidance, the actual start, load-run, and failure data is maintained and reviewed for corrective actions and improvements in the DG reliability.

Pursuant to 10 CFR 50.65(a)(3), DG reliability and availability is monitored and periodically evaluated in relationship to the MR goals and SBO target values. To ensure the TS CT does not degrade operational safety over time, the MR Program is used, as discussed above, to identify and correct adverse trends. Compliance with the MR not only optimizes reliability and availability of important equipment, it also results in management of the risk when equipment is taken out of service for testing or maintenance per 10 CFR 50.65(a)(4).

10.2. TS Section 5.5.11, "Safety Function Determination Program (SFDP)"

The SFDP was added to the TS as a result of the conversion to the Improved TS (ITS).

Training on the SFDP was provided to all licensed operations personnel prior to implementation of ITS. This program includes provisions for cross divisional verifications to ensure a loss of the capability to perform a safety function assumed in the accident analysis

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 23 of 24 does not go undetected. TS LCO 3.0.6 establishes requirements regarding supported systems when support systems are found inoperable. Upon entry into TS LCO 3.0.6, an evaluation is required to determine whether there has been a loss of safety function as implemented by Columbia Procedure SWP-OPS-02 "Safety Function Determination Program." Additionally, other limitations, remedial actions, or compensatory actions may be identified as a result of the support system inoperability and corresponding exception to entering supported system Conditions and Required Actions. The SFDP implements the requirements of TS LCO 3.0.6.

10.3. Configuration Risk Management Program As stated previously, Energy Northwest has developed a configuration risk management process within the MR program consistent with 10 CFR 50.65(a)(4). The goals of this program are to ensure that risk-significant plant configurations will not be entered for planned maintenance activities, and appropriate actions will be taken should unforeseen events place the plant in a risk-significant configuration during the proposed extended DG CT.

11.0 CONCLUSION

The proposed extension of the DG-1 and DG-2 CT is based upon both a deterministic evaluation and a risk-informed assessment. The deterministic evaluation consisted of the following elements:

availability of offsite power via the TR-S and TR-B; verification that the remaining DGs and offsite power sources are operable; verification that the AACSBC is available; putting in place committed risk management actions including excluding maintenance and testing of protecting systems, avoiding online maintenance in predicted severe weather conditions, and implementation of a configuration risk management process consistent with 10 CFR 50.65(a)(4) while the DG is in an extended CT. This evaluation concluded that an extended allowed CT for DG-1 and DG-2 is consistent with the defense-in-depth philosophy and sufficient safety margins are maintained. The risk-informed assessment concluded that the increase in plant risk is small and consistent with the NRC "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement," Federal Register, Vol.51, p. 30028 (51 FR 30028), August 4, 1986, as further described by NRC RG 1.174 and RG 1.177. Together these analyses provide high assurance of the capability to provide power to the ESF buses during the proposed extension of the DG-1 and DG-2 CTs.

The proposed changes are consistent with NRC policy and will continue to provide adequate protection of public health. The changes advance the objectives of the NRC's PRA Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p. 42622, August 16, 1995 for enhanced decision-making and results in a more efficient use of resources and reduction of unnecessary burden.

Maintenance during power operation should improve overall DG availability and reliability, which in turn, should result in reducing shutdown risk by increasing the availability of emergency power during refueling outages. The proposed changes in DG-1 and DG-2 CTs, in conjunction with the above risk management actions will provide adequate assurance of the capability to provide power to the ESF buses. The added risk management feature of an alternate AC source for the

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 24 of 24 Division 1 and Division 2 battery chargers provide an enhanced ability to respond to an SBO conditions. The equipment required to mitigate design basis events will not be reduced below the required level by performance of DG on-line maintenance.

The proposed changes are consistent with the applicable regulatory requirements, regulatory guidelines, and the NRC Safety Goal Policy Statement. The proposed deviation from RG 1.93 (i.e., extending the allowed outage time to 14 days for either DG-1 or DG-2) has been evaluated to be acceptable. The resultant slight increases in CDF and LERF are below the regulatory guidelines. Finally, the impact of the proposed changes will be monitored in accordance with the MR using performance measures to ensure actual reliability and availability is consistent with the values used in the PRA.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 4 Attachment 2 NO SIGNIFICANT HAZARDS CONSIDERATION AND ENVIRONMENTAL ASSESSMENT

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 2 of 4 NO SIGNIFICANT HAZARDS CONSIDERATION In accordance with 10 CFR 50.92, a proposed change to the operating license involves a no significant hazards consideration if operation of the facility in accordance with the proposed change would not: 1) involve a significant increase in the probability or consequences of any accident previously evaluated; 2) create the possibility of a new or different kind of accident from any accident previously evaluated; or 3) involve a significant reduction in a margin of safety. The proposed changes have been evaluated against each of the three criteria set forth in 10 CFR 50.92 in support of this determination, and are provided below.

The proposed Technical Specification (TS) changes the Limiting Conditions for Operation (LCO) 3.8.1 Required Actions A.3, B.3.2, and B.4 and their respective Completion Times.

The proposed changes, which include Required Actions to Establish the risk management action for the alternate AC source to the Division 1 and Division 2 battery chargers (AACSBC) allows an extension of the current TS Completion Time from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days when the Division 1 Diesel Generator (DG-1) or the Division 2 Diesel Generator (DG-2) is inoperable.

The crediting of performing Surveillance Requirement (SR) 3.8.1.2 to allow meeting the SR if performed within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months enhances the risk management of the required testing.

Does the operation of Columbia Generating Station in accordance with the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed changes do not adversely affect the design of the DGs, the operational characteristics or function of the DGs, the interfaces between the DGs and other plant systems, or the reliability of the DGs. Required Actions and the associated Completion Times are not initiating conditions for any accident previously evaluated, and the DGs are not initiators of any previously evaluated accidents.

The DGs support the mitigation of the consequences of previously evaluated accidents that involve a loss of offsite power. The consequences of a previously analyzed accident will not be significantly affected by the extended DG Completion Time since the remaining DGs will continue to be capable of performing their accident mitigation function as assumed in the accident analysis. Thus, the consequences of accidents previously analyzed are unchanged between the existing TS requirements and the proposed changes. The consequences of an accident are independent of the time the DGs are out of service as long as there are adequate DGs available.

Based on the above, the proposed change to extend the DG allowed Completion Time during plant operation will not involve a significant increase in accident probabilities or consequences.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 3 of 4 Does the operation of Columbia Generating Station in accordance with the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

No new accidents would be created since no changes are being made to the plant that would introduce any new accident causal mechanisms. This amendment request does not impact any plant systems that are accident initiators; neither does it adversely impact any accident mitigating systems. The addition of an independent AACSBC will provide added time for responding to a loss of all AC power assumed in accident analyses. The design of the AACSBC will contain features and administrative controls to maintain the separation and protection of emergency AC distribution systems and does not create the possibility of a new or different kind of accident from any previously evaluated.

Based on the above, implementation of the proposed changes will not create the possibility of a new or different kind of accident from any accident previously evaluated.

Does the operation of Columbia Generating Station in accordance with the proposed amendment involve a significant reduction in the margin of safety?

Response: No.

Margin of safety is related to the confidence in the ability of the fission product barriers to perform their design functions during and following an accident. These barriers include the fuel cladding, the reactor coolant system, and the containment system.

Throughout the period of the current TS Completion Time, when one DG is out-of-service during power operation, the margin of safety is managed by limiting the allowed outage time and other concurrent power source outages within the TS. This time period is a temporary relaxation of the single failure criteria, which, consistent with overall system reliability considerations, provides a limited time to repair the equipment and conduct testing. The extension of the current TS Completion Time to 14 days has been determined not to be a significant reduction in the margin of safety.

The proposed changes will not result in a significant decrease in DG availability so that the assumptions regarding DG availability are not impacted. Probabilistic Risk Assessment (PRA) methods, and a deterministic analysis were utilized to fully evaluate the effect of the proposed DG Completion Time extension. The results of the analysis show no significant increase in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF). Energy Northwest has proposed a number of risk

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 4 of 4 management actions to reduce the possibility of a plant transient; a loss of high-pressure injection and cooling systems, a loss of other on-site power sources, or a loss of offsite power during the period the DG is out-of-service.

Based on the above, the change to the TS Completion Time does not result in a significant further reduction in the margin of safety. This is based on our management of plant risk, the reliability of the other diesel generators, and inclusion of risk management actions.

Therefore, the proposed changes will not significantly increase the probability or consequences of any accident previously evaluated, create the possibility of a new or different kind of accident from any accident previously evaluated, or involve a significant reduction in the margin of safety. Therefore, the proposed assessment meets the requirements of 10 CFR 50.92, in that it involves no significant hazards consideration.

ENVIRONMENTAL ASSESSMENT A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO.

NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 4 Attachment 3 MARK-UP OF THE AFFECTED PAGES FROM THE TECHNICAL SPECIFICATIONS

AC Sources -Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. (continued) A.2 Declare required 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months from feature(s) with no discovery of no offsite power offsite power available inoperable to one division when the redundant concurrent with required feature s) inoperability are inoperable. of redundant required feature(s)

AND A.3 Restore offsite 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months circuit to OPERABLE (17 dkY OoM dlscaveeV

-ys status. AND f $1((0 0f5 0 mr tt ~

6 days from discovery of fail to m wIW{ ;e tRvQA Lf Ad~oA/..2.'n I.

1*

B. One required DG B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. for OPERABLE offsite circuit(s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND (continued)

Columbia Generating Station 3. 8.1-2 Amendment No. *149 169l

AC Sources- Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.2 Declare required 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from feature(s), supported discovery of by the inoperable DG, Condition B inoperable when the concurrent with redundant required inoperability feature(s) are of redundant inoperable. required feature(s)

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OG(s) are not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 iS~ours ji.sot N for OPERABLE OG(s). 'er~oAt1L waUL; htepezsL Z'i houi's AND ANDA r,,J Restore required DG to OPERABLE status.

6 days from discovery of failure to meet LCO (s, P~seur I (contiued)

Columbia Generating Station 3.8.1 -3 Amendment No. 4-49 1691

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Insert 1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued)

OR B.4.2.1 Establish risk 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months management action for the alternate AC source to the battery chargers.

AND B.4.2.2 Restore required DG 14 days to OPERABLE status.

AND 17 days from discovery of failure to meet LCO

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO.

NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 6 Attachment 4 MARK-UP OF THE AFFECTED PAGES FROM THE TS BASES

AC Sources - Operating B 3.8.1 BASES ACTIONS A.2 (continued) offsite power, results in starting the Completion Times for the Required Action. Twenty-four hours is acceptable because it minimizes risk while allowing time for restoration before the unit is subjected to transients associated with shutdown.

The remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

A.3 According to Regulatory Guide 1.93 (Ref. 9), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the The second Completion reliability of the offsite system is degraded, and the

.ti .potential for a loss of offsite power is increased, with Time for Required Action attendant potential for a challenge to the plant safety A.3 establishes a limit on systems. In this Condition, however, the remaining OPERABLE the maximum time allowed offsite circuit and DGs are adequate to supply electrical for any combination of power to the onsite Class 1E distribution system.

required e AC AC power sources The Completion Time takes into account the capacity and to be inoperable during any capability of the remaining AC sources, reasonable time for single contiguous repairs, and the low probability of a DBA occurring dur~ a-_ -- '~?

occurrence of failing to this period. _ i- t oCocFo. witk I meet the LCO when not A e uitm4 Act;orO '4.?.2 associated with Required The gcCompletion Time for Required Action A.3 establis s a limit on the maximum time llowed forLake) combination of required AC power sources to be inoperable reason for this limit and during any single contiguous occurrence of failing to meet third Completion Time the LCO. If Condition A is entered while, for instance, a limit is further explained DG is inoperable and that DG is subsequently returned below. OPERABLE, the LCO may already have been not met for up to (continued)

Columbia Generating Station B 3.8.1-8 Revision 241

AC Sources -Operating B 3.8.1 BASES ACTIONS A.3 (continued) 31 This situati coul lead to a total of ijoysi~ ~ since initial failu e to meet the LCO, to restore e o f te circuit. At this ime, a DG could again become

, the circuit sto d OPERABLE, and an additional

/ (for a total of da ) allowed prior to complete

'<- ---- ? Egi ion of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector t n the Completion Times means that Complet y simultaneously, and the more restrictive must be met.

Similar to Required Action A.2, the Completion Time of Required Action A.3 allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

This exception results in establishing the "time zero" at the time the LCO was initially not met, instead of at the time that Condition A was entered.

B.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining offeite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division systems are not included, although, for this Required Action, Division 3 (HPCS) is considered redundant

_ _(cont i nued)I Columbia Generating Station B 3.8.1-9 Revision 24i

AC Sources -Operating B 3.8.1 BASES ACTIONS B.3.1 and B.3.2 (continued)

Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DGs, the other DGs are declared inoperable upon discovery, and Condition E or G of LCO 3.8.1 is entered, as applicable.

Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed AThJA I 24 AvcrS, u not to exist on the remaining DG(s), performance of

,etfarmed wv- tSR 3.81.2 suffices to provide assurance of continued pedst VIL'oes OPERABILITY of those DG(s).

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.l or B.3.2, the Problem Evaluation Request process will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 10), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the OPERABLE DG(s) are not affected by the same problem as the inoperable DG.

B.4 (to flogulatoly Cuil 1.93 (Ref. 9), opsration mal

r. ~r.

c~ntnuz B eniz D fza V. Vz-io t-- ault niozzl

-- ~e~e In Con on B, the remining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class lE distribution system. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months iXv, Aeqlcsr 2 Ac*se) Completion.Timettakes into account the capacity and j.Y -~- capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required ActionIB.4.l) established a limit on the maximum time allowe for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is (continued)

Columbia Generating Station B 3.8.1-11 Revision 24l

AC Sources -Operating B 3.8.1 BASES ACTIONS B.4 (continued) subsequently restored OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This situation could lead to a total of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCOA. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" k.

connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 6 day Completion Times 'MANGL'e t means that both Completion Times apply simultaneously, and more restrictive Completion Time must be met. 13.s I;

( ~~~~~issrt l.oinpla milar to Required Action B.2, the Completion Time of P a q--,o" -. llowX for an exception to the normal Sf.q2?

citieud t-UFor $nq the allowed outage time "clock."

_This exception results in establishing the "time zero" at the time the LCO was initially not met, instead of the time Condition B was entered.

C.1 and C.2 Required Action C.1 addresses actions to be taken in the event of concurrent failure of redundant required features.

Required Action C.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed with only one division without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 9) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE.

When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related divisions (i.e.,

single division systems are not included in the list, although, for this Required Action, Division 3 (HPCS) is considered redundant to Divisions 1 and 2 ECCS). Redundant (continued)

Columbia Generating Station B 3.8.1-12 Revision 241

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Insert 2 LCO 3.8.1 Action B.4 Bases A second optional set of Actions is provided, that if the risk management action for establishing the alternate AC source to the division 1 and division 2 battery chargers (AACSBC) occurs within the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time limit, an extended Completion Time up to 14 days from the DG's initial inoperability is allowed. To establish the AACSBC, a 480-volt diesel generator is staged and available. The AACSBC is considered available when it can be aligned and supplying the battery chargers within the SBO coping time (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ). Additional risk management actions in accordance with the configuration risk management program required by 10 CFR 50.65a(4) are to be put in place to assure that significant risk configurations are avoided during the extended DG inoperability.

Similar to Action A.3 Completion Time, when the 14-day extended Completion Time is applicable, the 17 day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 52 Attachment 5 PROBABILISTIC RISK ASSESSMENT (PRA)

SUPPORTING THE TS CHANGE

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 2 of 52 Table of Contents Section page 1.0 PURPOSE ........................................................ 3 2.0 INTENDED USE OF EVALUATION ......................................................... 3 3.0 TECHNICAL APPROACH .................... .................................... 3 3.1 Internal Events and Fire ......................................................... 3 3.2 Discussion of Configuration Restrictions .............................................. 22 3.3 Extended CT Risk Management Measures ............................................ 22 4.0 KEY ASSUMPTIONS ......................................................... 24 4.1 Key Assumption Process . ........................................................ 24 4.2 Summary of Key Assumptions ........................................................ 25 4.3 Peer Reviewers' Assessment of Key Assumptions ............. ..................... 26 5.0 PEER REVIEW FACTS AND OBSERVATIONS RELATED TO THE DG CT ...... 26 5.1 Internal Events - F & Os Impacting the TS Application ............ .................. 26 5.2 Fire -Peer Review F & Os Impacting The DG Application .......................... 30 6.0 SENSITIVITY EVALUATION RESULTS FOR KEY ASSUMPTIONS AND F&Os ........................................................ 36 6.1 Unusual Alignments .......................................... 36 6.2 Grid Availability and Stability (SY-A5-1/2) .......................................... 37 6.3 HPCS Sensitivity (12-hour versus 24-hour mission time) ............. ............ 44 6.4 Recirculation Pump Seal Leakage ................ ........................ 46 6.5 Level 2 Human Error Probability (HEP) Sensitivity Results ........... ........... 47 6.6 Ex-Vessel Steam Explosion .......................................... 47 6.7 HEP Sensitivity Results ........................................ 48 6.8 Component Sensitivity Results ............. ........................... 49 7.0

SUMMARY

OF RESULTS ................... 51

8.0 CONCLUSION

S .................. 52

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 3 of 52 1.0 PURPOSE The purpose of this evaluation is to determine the risk impact of extending the emergency diesel generators (DGs) Completion Time (CT) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days. Limiting Condition for Operation (LCO) 3.8.1 Required Action B.4 requires restoration of the required DG to Operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Extending this CT for Division 1 DG (DG-1) and Division 2 DG (DG-2) to 14 days will allow required maintenance activities to be performed while the plant is at power.

This evaluation will demonstrate that the guidelines of Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis," November 2002, and RG 1.177, "An Approach for Plant Specific, Risk-Informed Decision Making: Technical Specifications," August 1998, have been met.

2.0 INTENDED USE OF THE EVALUATION This evaluation is used to provide the risk impact that demonstrates necessary elements for approval of a license amendment request (LAR) to change the plant technical specifications (TS).

3.0 TECHNICAL APPROACH 3.1. Internal Events and Fire The proposed TS changes to extend the Completion Time for DG-1 and DG-2 are based on probabilistic risk assessment (PRA) calculations performed to quantify the changes in core damage frequency (CDF) and large early release frequency (LERF) resulting from the increased CTs. Additionally, the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) were calculated. In computing these risk metrics, certain normal risk management actions were included. Additionally, this computation was performed including the alternate AC source to the Division 1 and Division 2 battery chargers (AACSBC). This AACSBC provides a longer time for maintaining important mitigating systems and features, which results in higher probabilities for recovery of offsite or onsite power sources. Both risk metric computations are detailed below and the results are provided to demonstrate the effectiveness as requested in RG 1.177.

To determine the effect of the longer CT for restoration of an inoperable DG-1 or DG-2, the guidance of RG 1.174 and RG 1.177 was used. The following risk metrics were used to evaluate the internal event risk impacts of extending the DG CT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 4 of 52 3.1.1. Risk Metric Definitions ACDFAvG is the change in annual average core damage frequency due to any increased on-line maintenance unavailability of the DGs that could result from the increased CT.

This risk metric is used to determine whether a change in CDF is regarded as risk significant compared with the guidelines of RG 1.174. These guidelines are a function of the baseline annual average core damage frequency, CDFBASE. In this evaluation, it is assumed that one 14-day diesel generator outage occurs per operating cycle (2 years) per division.

ALERFAvG is the change in the annual average large early release frequency due to any increased on-line maintenance unavailability of DGs that could result from the increased CT. RG 1.174 guidelines were also applied to judge the significance of changes in this risk metric.

ICCDP(Yoos) is the incremental conditional core damage probability with DG (Y) out-of-service (OOS) for the proposed new CT (i.e., 14 days) with normal risk management actions included as defined in RG 1.177. This risk metric is used as recommended in RG 1.177 to determine whether a proposed increase in the CT risk impact is acceptably small.

ICCDP(YR) is the incremental conditional core damage probability with DG (Y) out-of-service for the proposed new CT (i.e., 14 days) with both the normal risk management actions included and the Required Action for the AACSBC is met as defined in RG 1.177. This risk metric is used as recommended in RG 1.177 to determine whether a proposed increase in the CT risk impact is acceptably small.

ICLERP(Yoos) is the incremental conditional large early release probability with DG (Y) out-of-service for the proposed new CT (i.e., 14 days) with normal risk management actions included as defined in RG 1.177. RG 1.177 guidelines were also applied to judge the significance of changes in this risk metric.

ICLERP(nm) is the incremental conditional large early release probability with DG (Y) out-of-service for the proposed new CT (i.e., 14 days) with normal risk management actions included and the Required Action for the AACSBC met as defined in RG 1.177.

RG 1.177 guidelines were also applied to judge the significance of changes in this risk metric.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 5 of 52 The evaluation of the above risk metrics was performed as follows.

The change in the annual average CDF because of the change in the DG CT, ICDFAvG, with normal risk management measures was evaluated by computing:

ACDFAvG = [Ti1TcycE]CDFioos + [T2/TcYcuE] CDF200s +[1- (Ti + T2)/TcYcLE]CDFB4sE - CDFBAsE The change in the annual average CDF because of the change in the DG CT with normal risk management measures and AACSBC was evaluated by computing:

ACDFAVGRA = [Td/TcycE]CDFiR + [T2/TcYcL]CDFzu +[1- (Ti + T2)/TcYcE]CDFBAsE - CDFAS.sE Where the following definitions were applied:

CDFwoos is the CDF evaluated from the PRA model with DG-1 out of service and normal risk management measures for DG-1 implemented. These risk management measures include prohibiting concurrent maintenance or inoperable status of other risk significant equipment as detailed below.

CDFiRp is CDFiooswith the AACSBC available.

CDF200s is the CDF evaluated from the PRA model with Division 2 DG out-of-service and risk management measure for DG-2 implemented. These risk management measures include prohibiting concurrent maintenance or inoperable status of other risk significant equipment as detailed below.

CDF2RA is CDF200swith the AACSBC available.

Ti is the total time per fuel cycle (TcYcLE) that DG 1 is OOS for the extended CT.

T2 is the total time per fuel cycle (TcycLE) that DG 2 is OOS for the extended CT.

CDFBASE is the baseline annual average CDF with average unavailability of the DGs consistent with the current DG CT. This is the CDF result from the current baseline internal events PRA.

A similar approach was used to evaluate the change in the average LERF because of the requested CT extension with normal risk management measures, LLERFAvG:

ALERFAvG=jTITcYcLE]LERFioos + [T21TcYcLE]LERF2oos +[1- (Ti + T2)ITcYcE]LERFBAsE - LERFBAsE A.LERFAvGRA=[TI1TcYcL~]LERFiRA + [T21Tcyc]LERF2RA +[1- (Ti + T2)1TctcL]LERFBAsE - LERFBAsE

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 6 of 52 Where the following definitions were applied:

LERFioos is the LERF evaluated from the PRA model with DG-1 out of service and normal risk management measures for DG-1 implemented. These risk management measures include prohibiting concurrent maintenance or inoperable status of other risk significant equipment as detailed below.

LERFiR is LERFioos with the AACSBC available.

LERF200s is the LERF evaluated from the PRA model with DG-2 out-of-service and normal risk management measures for DG-2 implemented. These risk management measures include prohibiting concurrent maintenance or inoperable status of other risk significant equipment as detailed below.

LERF2RA is LERF200s with the AACSBC available.

LERFBAsE is the baseline annual average LERF with average unavailability of the DGs consistent with the current DG CT. This is the LERF result from the current baseline internal events Level 2 PRA.

The evaluation was performed based on the assumption that the full, extended CT would be applied once per DG per refueling cycle, hence Ti = T2 = 14 days. The cycle time is based on the current 24-month fuel cycle (allowing for planned and unplanned plant outage time, which yields TCYCLE = 670 days). The above formula for LICDFAVG conservatively neglects the decrease in CDF contributed from those events initiated during shutdown that would be associated with the increased DG availability during shutdown periods.

3.1.2. ICCDP and ICLERP The ICCDP and ICLERP are computed using their definitions in RG 1.177. In terms of the above defined parameters, the ICCDP is computed for normal risk management actions and normal risk management measures with inclusion of the AACSBC availability. These are computed to gain insight into the effectiveness of the additional Required Action (i.e. AACSBC) in combination with the normal risk management configuration limitations impose by TS and 10 CFR 50.65(a)(4). The formulas are as follows:

ICCDP(foos) = (CDFyoos - CDFuAsE)*AT and ICCDP('YRA) = (CDFrAi - CDFBAsE)*AT

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 7 of 52 Where AT is the CT converted to units consistent with the CDF frequency units (14 days*lyr/365 days=3.84E-2yr).

Similarly, ICLERP is computed as follows:

ICLERPa'oos) = (LERFroos - LERFBAsE)*3.84E-2 and ICLERP(IRA) = (LERFvRi - LERF4sE)*3.84E-2 These cases are computed and compared below as requested in RG 1.177.

3.1.3. The Internal Events and Fire Risk Analysis Results The internal events and fire risk analysis results are presented in tabular form below.

The internal events results are presented in graduated sets showing corresponding effectiveness of the risk management actions. The normal protection of the cross-train DGs, their support service water systems, not allowing maintenance that would impact the offsite power sources or the high pressure injection systems, High Pressure Core Spray (HPCS) and Reactor Core Isolation Cooling (RCIC), yields adequate results for DG-1. For DG-2, a result only slightly higher than the risk metric guidelines of RG 1.177 occurs. The inclusion of the AACSBC brings the results of the risk metrics evaluation for internal events well within the guidelines and provides sufficient margin for risks due to fire and external events.

Table 5-1 shows the results for each DG's dependent calculation of the risk metrics.

The bolded cases are those used in the calculation for the requested TS change. Figure 5-1 through Figure 5-4 present these results graphically and their relationship with the guidelines of RG 1.174 and RG1.177. The small asymmetry in the ICCDP and ICLERP is due to divisional load differences (RCIC, LPCS, LPCI A on Division 1; LPCI B/C, SW crosstie to RHR and an additional steam tunnel cooler on Division 1) and the effect of risk management actions on their importance. Also, presented for information only is DG-3's impact on the risk metric guidelines for a 17-day on-line unavailability. The current TS condition that allows this DG-3 unavailability is discussed later. The results are presented to demonstrate that no change to the TS for DG-3 is required.

The internal event CDF results in Figure 5-1 show that for the cases of DG-1 and DG-2 OOS for 14 days with only normal risk management actions and the AACSBC not available, fall within Region III of RG 1.174 acceptance guidelines and would normally be considered without additional conditions (dCDFAvG). Also shown are the results with the AACSBC available (4CDFAVGRA). These results fall well within the acceptance

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 8 of 52 guidelines for Region III of RG 1.174. The internal event LERF evaluation results shown in Figure 5-2 demonstrate that all cases for DG-1 and DG-2 OOS for 14 days fall well within the Region III guidelines when either the normal risk management actions are included (ALERFAvG) or when the AACSBC is available (/LERFAvGRA.). The results are calculated using the formulas of Section 3.1.1 as follows.

ACDFAVGRA = (141670)*(1.451E-5) +(14/670)*(1.492E-5) + (670-28)/670

7.33E-6 -

7.33E-6

= 3.09E-7/yr ALERFAVGM = (14/670)*(7.24E-7) +(14/670)*(7.06E-7) + (670-28)/670

6.86E 6.86E-7

= 1.21E-9/yr The risk metric values are:

ACDFBAsE = 7.33E-6/yr ACDFAVG = 5.43E-7/yr ACDFAvGRA = 3.09E-7/yr ALERFAssE = 6.86E-7/yr ALERFAvG = 2.28E-9/yr ALERFAVGo = 1.21E-9/yr The RG 1.177 results for the internal events ICCDP and ICLERP from Table 5-1, shown in Figure 5-3 and Figure 5-4, depict that significant margin is available from the acceptance guidelines of < 5E-7 for ICCDP and < 5E-8 for ICLERP.

Table 5-2 and Table 5-3b show the results for the change in risk from fire events. Only computations using normal risk management actions are presented.

The Fire PRA analysis results are presented in Table 5-2 with only the normal and high-pressure systems protected for the risk management controls. Although the AACSBC would have an effect in reducing the fire risk, this reduction is not reflected in the calculation. For scenarios involving a loss of offsite power (LOOP), rather than using the LOOP event trees, the fire PRA uses the loss of feedwater event tree. The LOOP and station blackout (SBO) event trees are not used in the fire PRA because most of the special features of the these two event trees have to do with timing of injection failure and the potential for recovery of offsite power or onsite DG recovery.

For the fire PRA, it was conservatively assumed that if offsite power or onsite DG power failed, it could not be restored within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. Therefore, it is more appropriate to use the loss of feedwater event tree, with TR-S and TR-B unavailable to represent LOOP. In this way, offsite power would not be modeled as recovered. In addition, the fault tree dependencies on the DGs were explicitly included in the quantification. DG-2 is the Appendix R protected train for safe shutdown. As expected, the condition of DG-2 being in the extended CT is the more risk sensitive case than DG-1. These results are within the risk metric acceptance guidelines.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 9 of 52 Table 5-1 Tnternnl Events Risk Metric Rmisilts for DG-1. DG-2. and DG-3 Case# Model System Risk Management Total ICDF* TCCDP Total ALERF ICLERP 00S (System in Zero- CDF (Yr') (14 days) LERF (Yrl) (Y') (14 days) maintenance) (Yr')

Al.l Baseline - None 7.33E-6 6.86E-7 A1.2 AACSBC - None 6.70E-6 6.78E-7 -

1.3 AACSBC DG-1 DG-2 & 3, SW-2 & 3, 1.45E-5 7.18E-06 2.76E-7 7.24E-7 3.80E-08 1.46E-9 TR-B, TR-S, HPCS, RCIC 1.3.1 Baseline DG-1 DG-2 & 3, SW-2 & 3, TR- 1.99E-5 1.26E-05 4.82E-7 7.44E-7 5.80E-08 2.22E-9 B, TR-S, HPCS, RCIC 2.3 AACSBC DG-2 DG-1 & 3, SW-1 & 3, 1.49E-5 7.59E-06 2.92E-7 7.06E-7 2.OOE-08 7.67E-10 TR-B, TR-S, HPCS, RCIC 2.3.1 Baseline DG-2 DG-1 & 3, SW-I & 3, TR- 2.07E-5 1.34E-05 5.14E-7 7.37E-7 5.1OE-08 1.96E-9 B, TR-S, HPCS, RCIC 3.3 AACSBC DG-3** DG-1 & 2, SW-1 & 2, TR- 1.40E-5 6.67E-06 3.11E-7 9.77E-7 2.91E-07 1.36E-8 B, TR-S, HPCS*, RCIC 3.3.1 Baseline DG-3** DG-1 &2, SW-1 &2, TR- 1.53E-5 8.00E-06 3.73E-7 1.03E-6 3.46E-07 1.62E-8 B, TR-S, HPCS*, RCIC

This term is the configuration specific CDF (Total CDF) minus the baseline CDF and is provided for completeness.

- Based on a 17 day DG-3 OOS condition with HPCS available only when 230 kV offsite source is available Table 5-2 DG CT Fire Results I _

Cases #

1_Model

_ _ Il System OOS I System in Zero-maintenance Total CDF W l(r')

Delta CDF (Y r")

l CCDP IC D Base Baseline - None 1.40E-5 F-1.3 DG-1 DG-2 & 3, SW-2 & 3, TR-B, TR-S, HPCS, RCIC 1.41E-5 9.2E-8 3.45E-9 F-2.3 DG-2 DG-1 & 3, SW-1 & 3, TR-B, TR-S, HPCS, RCIC 1.85E-5 4.42E-6 1.7E-7

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 10 of 52 Figure 5-1 RG 1.174 CDF for DG CT=14 Days Risk Region Evaluation 1.OOE-04 -r 1.00E-05 -I-t-

aU 1.OOE-06 4-1.OOE.07 !-

1.00E-06 1.OOE-05 1.00E-04 1.OOE-03 1.OOE-02 CDF

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 11 of 52 Figure 5-2 RG 1.174 DG CT=14 Days LERF Region Evaluation 1.00E-05 1.OOE-06 us 1.00E -j 1.00E-08 I:

1.002-09 1.OOE-07 1.00E-06 1.OOE-05 1.00E-04 1.00E-03 LERF

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment S Page 12 of 52

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 13 of 52 Figure 5-4 RG 1.177 ICLERP Comparisons Between DGs 1, 2 & 3 (Internal Events) 5.

4

... . .... .,.,~

I L,, Series-2 I .62 M ilSeries2 IIX DG-1 OOS DG-2 OOS DG-3 OOS SERIES 1: w/ AACSBC + RM Actions*

SERIES 2: w/o AACSBC + RM Actions*

(*no elective maintenance on cross-train DGs, cross-train SWs, TR-B/S, HPCS, RCIC)

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 14 of 52 Fire LERF Development and Methodology The Fire LERF was estimated by grouping the accident sequence damage states into fire core damage bins. The process was achieved using the Internal Events Level 2 PRA and resultant damage state frequencies from the fire CDF analysis as shown in Table 5-3a. Quantifying the Level 2 model using fire damage state frequencies yielded the Fire LERF of 3.36E-07/yr.

Table 5-3a Fire CDF Grouped by A11ident Sequence Damage State Core Damage Bin Description Frequency 2D Loss of containment decay heat removal; containment failed; 3.50E-06/yr high RCS pressure; LP injection failed; Decay heat removal failed.

IBO Loss of reactor decay heat removal; containment intact; high 2.70E-06/yr RCS pressure; LP injection available; Decay heat removal failed.

IG Loss of reactor decay heat removal; containment intact; low 4.76E-06/yr RCS pressure; LP injection failed; Decay heat removal available.

1A2 Loss of reactor decay heat removal; containment intact; high 3.08E-06/yr RCS pressure; LP injection available after vessel breach; Decay heat removal available.

The following bases were used to adjust the internal events Level 2 model to calculate a reasonable but conservative LERF due to fire:

a. The events representing the non-recovery of AC power before containment failure and non-recovery of AC power before vessel failure were changed since the fire PRA assumes that loss of offsite power will not be recovered for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This conservatism assumes that credit is not taken for recovering AC power before containment failure or before vessel failure.

b. The internal events LERF model assumes that mechanical failures of HPCS cannot be recovered within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , but that electrical failures can be recovered if AC power is recovered. For the fire PRA, it is assumed that HPCS failure due to fire cannot be recovered. Therefore, HPCS failure due to electrical or mechanical faults has been changed so that HPCS is not recovered when AC power is recovered.

c. The internal events containment isolation valve failure probability is not impacted by a fire-induced failure of containment isolation valves (CIV) to close because most containment penetrations are protected by dual isolation valves that are powered by opposite trains and physically separated to minimize common-cause failure by fire. Other penetrations have sufficient check valves or fail-safe design

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 15 of 52 features that provide low probability of not closing. Operator action is also available for manual closing for the outboard CIV. The likelihood of containment isolation failure by fire is less likely than the common-cause failure of the MSIVs.

d. The probability of a hot-short causing a reopening of the penetration's flow path is also less than the MSIV's failure probability due to the three phase design of the motor operators, the separate divisional routing for penetrations with two CIVs, and manual action to close the outboard CIV.

Based on the above discussions, the internal events containment isolation failure probability of 7.88E-04 from the internal events LERF model is used for the fire LERF estimate.

Although a Peer Review has not been conducted for the Fire LERF model, the presented LERF results are judged adequate to estimate the LERF risk due to fire initiators. The estimated Fire LERF results based on the internal events Level 2 model is presented in Table 5-3b. The results show that the risk decision for the DG extended CT would not be limited by the risk metric guideline associated with a fire induced LERF.

Table 5-3b DG CT Fire LERF (Surrogate) Results Cases System System in Zero- Total LERF Delta Case l S maintenance (Yrt L) etra ICLERP Base Baseline - None 3.36E-7 F-1.3 . DG-1 DG-2 & 3, SW-2 & 3, 3.44E-7 8.20E-9 3.15E-10 TR-B, TR-S, HPCS, RCIC F-2.3 DG-2 DG-1 & 3, SW-1 & 3, 4.22E-7 8.61E-8 3.30E-9 TR-B, TR-S, HPCS, RCIC 3.1.4. Evaluation of External Events The impact of this change to our Individual Plant Examination for External Events (IPEEE) was also assessed.

The seismic qualification of all Class 1E electrical equipment and safety-related mechanical equipment at CGS was evaluated to the requirements of RG 1.100, RG 1.92, NUREG-0800, and Institute of Electrical and Electronics Engineers (IEEE)-

344-1975 as part of the initial licensing of the plant. FSAR Section 3.10 provides the results of that evaluation and Section 3.10.4.3 provides the Seismic Qualification Review Team conclusion of acceptability.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 16 of 52 A seismic PRA (SPRA) for CGS was performed in support of the IPEEE program.

The SPRA included a site-specific hazard curve and site-specific fragility calculations for numerous components and structures. The seismic PRA is consistent with the PRA methodology described in NUREG-1407. Components were screened at the 0.5g review level earthquake (RLE). Walkdowns of the plant were conducted to support the analysis. The mean seismic CDF was estimated to be 2. 1E-05/yr. An update of the IPEEE SPRA is currently in-progress and is not yet available for use. However, based on the IPEEE analysis, the seismic risk is dominated by seismic-induced DG failure, which are correlated failures and would not be impacted by the DG CT extension. DG-1 and DG-2 and associated control panels are located in the same building (Diesel Generator Bldg.), on the same floor (El. 441'), and are sensitive to the same spectral frequency range, therefore, consistent with standard industry techniques and guidance (e.g., Table 3.1 of NUREG/CR-4840, "Procedures for the External Event CDF Analysis for NUREG-1150"), seismic-induced failure of DG-1 and DG-2 is appropriately modeled with a 1.0 correlation factor (i.e., seismic-induced failure of one DG means both are failed).

Ceramic insulators for offsite power transformers tend to be the most vulnerable components in the offsite power system during a seismic event. NUREG/CR-4550, Vol.4, Rev 1 Part 3, "Analysis of Core Damage Frequency, Peach Bottom Unit 2 External Events," estimates the median peak ground acceleration at which these ceramic insulators are lost to be approximately 0.25 g. The SSE for CGS is 0.25g and the annual estimated probability of exceedance is 1.1E-4 (FSAR Section 2.5.2.6.2).

Using the NUREG/CR-4550 estimation, the conclusion can be reached that the seismic LOOP initiator is over an order of magnitude less than the grid and weather related LOOP initiating event frequency for CGS.

Industry experience also supports this conclusion. The recent history of seismic events appears to be a relatively minor contributor to the industry LOOP frequency. Evidence of this is provided in EPRI Report TR-110398, "Losses of Offsite Power at U.S.

Nuclear Plants - Through 1997." This report records no LOOP events caused by seismic events, even though the database includes over a thousand years of unit operating experience and includes a period of time that had noteworthy earthquakes.

Evaluation of high winds, external floods, and other external events in the IPEEE per GL 88-20 were submitted to and reviewed by the NRC. The Staff Evaluation Report concluded that CGS IPEEE was capable of identifying the most likely severe accidents and severe accident vulnerabilities and the IPEEE met the intent of Supplement 4 to GL 88-20. The IPEEE determined that the recurrence frequency for the maximum tornado wind speed is approximately IE-07/yr and, as such, maximum wind speed was eliminated as a plant hazard per the Standard Review Plan. Other external events (e.g.,

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 17 of 52 external fire, external floods, high winds, etc.) were considered to be insignificant contributors to severe accidents. The proposed changes should have a negligible effect on the risk profiles from other external events.

3.1.5. Evaluation of Significant Contributors and Components (Internal Events PRA)

An evaluation of the significant basic events, significant cutsets relative to sequences and CDF, significant accident sequences and progression sequences, significant contributors, and significant containment challenges as defined in RG 1.200 was performed to gain insight into those risk management actions that would be most effective in reducing the risk associated with the proposed change to the TS. This assessment was performed on the baseline model with no equipment OOS. The results are presented in Table 5-4. For some categories of risk, only a few of the highest contributors were presented, such as the basic events ranked by Fussell-Vesely (FV) importance of > 0.005, only the top 5 out of 89 events are listed.

From a contribution value assessment, the protection of the power sources, both offsite and onsite, is important because a large portion of the core damage risk is associated with the SBO event. The importance to recover an AC source is readily seen from these indicators. The importance of HPCS and RCIC can be readily seen as a significant element of several categories.

The set of systems and trains selected for prohibiting planned testing or maintenance during the extended DG maintenance period was based on the risk evaluations, assessment of significant PRA elements and the sensitivity evaluations. These will be implemented as part of the configuration risk management process associated with the Maintenance Rule (MR).

The selected systems are:

1) The cross-train DGs and the associated service water systems

2) TR-S and TR-B and the associated breakers and relay logic (protective and control)

3) RCIC, and

4) HPCS

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 18 of 52

[_Significance l Definition Term Significant basic Definition Those basic events (i.e., equipment lPRA element Table 5-4 Evaluation The top 5 basic events (from FV) are:

l Contribution Value Pt. Estimate FV event: unavailability and human failure 1. LOOP Initiating frequency 1. 3.61E-2 3.54E-1 events) that have a Fussell-Vesely 2. On-site power non-recovery in 6 hrs 2. 5.90E-1 1.74E-1 A

3. IIPCS test and maintenance 3. 2.47E-2 1.62E-1 importance greater than .05. 4. Failure of RCIC pump to run for 24 hrs 4. 1.19E1 1.30E-1

5. Human error in performing non-ATWS emergency 5. 2.00E-4 1.16E3-1 OR depressurization a risk achievement worth (RAW) The top 5 basic events (from RAW) are: Pt. Estimate RAW greater than 2.* 1. RPV rupture initiating frequency 1. 3.00E-7 136500

2. Common-cause failure of SW Train-A and -13 suction strainers 2. 5.72E-6 12848

3. Failure to scram due to mechanical problem

4. Common-cause failure of SW discharge valves (2A, 2B, 29A) 3. 2.15E-6 11860

5. Flooding initiating frequency (Rx Bldg case 6) 4. 7.OOE-7 11692 l 5. 9.60E-6 5957 Significant cutset Those cutsets, when rank ordered by The cutsets contribute to the highest accident sequence CDF [SBOS28] are: Total frequency for SBOS28 (relative to decreasing frequency, comprise 95% is 8.3 1E-7/yr with the sequence): of the sequence CDF OR that following cutsets contribute individually contribute more than 1% 1. SO with RCIC in test/maintenance, DG-3 fall to start, and AC >1%

to the sequence CDF.* recovery unsuccessful in 30 min 1. 1.981-7/yr SO with RCIC fail to start, DG-3 fail to start, and AC sO.

recovery unsuccessful in 30 min 2. 1.52E-7/yr

3. SBO with RCIC fail to run for 6 hrs, DG-3 fail to start, and AC recovery unsuccessful (in avg 4 hrs) 3. 4.24E8/yr

4. SBO with RCIC-V-13 fail-to-open, DG-3 fail-to-start, and AC recovery unsuccessful in 30 min 4. 3.95E-8/yr

5. S1O with RCIC-PCV-15 fail-to-close, DG-3 fail-to-start, and AC recovery unsuccessful In 30 min5. 1.10E-8/yr Significant cutset Those cutsets, when rank ordered by The top 3 cutsets to the CDF are:

(relative to CDF): decreasing frequency, comprise 95% 1. RPV rupture combined with all the mitigating systems failed 1. 3.00E-7/yr of the CDF OR that individually 2. Internal flooding (case 6) occurred when HPCS is in 2. 2.37E-7/yr contribute more than I % to CDF.* maintenance

3. During S1O, RCIC is in maintenance, DG-3 is failed from DG 3. 1.97&-7/yr common-cause with DG-1 and -2, and AC power Is not recovered in 30 min

Only top signincant contributors presented.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 19 of 52 Table 5-4 (Continued)

Significance Evaluation Definition Term l Definition I PRA element [ Contribution Value Significant accident A significant sequence is one of the set of sequences, The top 3 accident sequences to the CDF are:

sequence: defined at the functional or systemic level that when 1. SBO with IPCS and RCIC failure and failure to recover AC 1. 8.31E-7/yr rank ordered by decreasing frequency, comprise 95% power in 30 min of the core damage frequency (CDF), OR that 2. SBO with RCIC and IIPCS initially available, orlsite power 2. 5.91E-7/yr individually contribute more than - 1% to the CDF.* recovery not successful in 12 hrs, and on-site power recovery not successful in 6 hrs

3. Flooding Case-8 combined with RIIR-A failure 3. 4.02E-7/yr The top 3 accident sequences to the LERF are:

Significant accident One of set of containment event tree sequence that 1. Internal flooding caused core damage and RPV failure, and 1. 1.87E7/yr progression when rank ordered by decreasing frequency, subsequently resulted in a "large" containment failure sequence: comprise 95% of the LERF, OR that a single 2. Large loss of coolant accident (LOCA) outside of containment 2. 1.57E-7/yr definition of individually contribute more than gl % 3. ATWS caused core damage, RPV rupture (@high pressure) 1.23E-7/yr the to LERF.* and subsequently resulted in a large containment failure Significant (a) In the context of an accident sequence, a The top 3 basic events contributing to the SBO accident sequence are:

contributor: significant basic event or an initiating event that 1. LOOP initiating event frequency 1. 3.61E-2/yr contributes to a significant sequence; (b) in the 2. DG-1 being taken out-of-service 2. 1.001yr context of an accident progression sequence, a 3. AC power not recovered in 30 min 3. 5.82E-1/yr contributor which is an essential characteristic (i.e., The top 3 basic events contributing to the IGS02 accident progression containment failure mode, physical phenomena) of a sequence are significant accident progression sequence, and if not 1. Total CDF for Plant Damage State IG 1. 1.38E6/yr modeled would lead to the omission of the sequence; 2. Containment isolation success probability for general transient 2. 9.99E-1/yr for example, not modeling hydrogen detonation in an 3. Containment failure size small 3. 9.90E..1 /yr ice condenser plant would result in a significant LERF sequence not being modeled.

Significant Those containment challenges that contribute to the The top 3 accident sequences to likely challenge the containment are:

containment set of significant accident progression sequences. 1. Transients (such as Turbine Trip) with no makeup injection 1. 1.36E-6 /yr challenges (core is depressurized, containment isolated) leading to large late containment failure

2. Transients with loss of decay heat removal (injection available) 2. 1.10E-6 /yr leading to large late containment failure

3. Transients with loss of decay heat removal with failure of 3. 3.13E-7 /yr IIPCS leading to large late containment failure

Only top significant contributors presented

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 20 of 52 3.1.6. Existing LCO 3.8.1 Required Actions Effect on Common-Cause Failure (CCF)

The treatment of common-cause failure modeling in the PRA presumes that, given a failure of individual components, the potential exists that the same failure mechanism could exist on like components in the plant due to similar circumstances such as design, maintenance, or operating practices. Given an absence of knowledge about the particular failure mechanism involved, when one failure occurs, a higher likelihood of failure should be assigned to the like components.

The LCO 3.8.1 provides Required Actions that directly address this condition to minimize the probability of a common-cause failure occurrence. LCO 3.8.1 requires that if a failure of a DG does occur, an investigation is required per LCO 3.8.1, Required Action B.3.1 to determine that the other Operable DGs are not inoperable due to common-cause failure. Alternatively, in accordance with Required Action B.3.2, the remaining DG can be tested through a surveillance run to demonstrate that it remains operable. After these particular activities, the state of knowledge about the failure mechanism has been improved to the point that it can be determined, with confidence, that the particular failure mechanism is not a common-cause that would cause the remaining DGs to be unable to perform their design functions. If the remaining DGs are found to be inoperable, the extended CT will not be allowed in accordance with LCO 3.8.1, Required Action E.1. Required Action E.1 requires restoration of DG-1 or DG-2 to operable status in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if they were the cause of the Condition or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months if a DG-3 is inoperable. Failure to restore one of the DGs to operable status in the required CT requires that the plant be in Mode 3 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and Mode 4 in 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

Presuming that this determination of common-cause failure condition was correctly made, the best estimate of the remaining potential for common-cause failures would be represented by the common-cause failures and values in the base PRA model. In the case of planned or preventative maintenance, performing the verification that a common-cause failure condition does not exist per LCO 3.8.1, Action B.3.1 or B.3.2 prior to commencing the maintenance provides the appropriate bases for the treatment of common-cause failure in the PRA assumptions. Therefore, once the common-cause implications have been investigated and discounted, the risk increase due to corrective maintenance activities on a diesel is estimated to be approximately that of preventive maintenance activities. Therefore, we believe the risk evaluation to be valid regardless of whether the unavailability is incurred due to an emergent corrective or planned maintenance condition.

The total common-cause failure probability for a component in a given failure mode is the product of the random independent failure probability (RIP) for the failure mode and the appropriate CCF factors (beta, gamma, delta). Because the mission time for the RIP event is used for the CCF event, the process conservatively assumes non-

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 21 of 52 staggered testing. Common-cause values for the PRA model were developed using the Multiple Greek Letter (MGL) approach for common-cause modeling. The MGL factors were derived from data and software provided in INEL-94/0064. The following Beta and Gamma factors were applied to the single DG failure events to calculate the above CCF values.

For fail-to-start events:

Beta = 3.83E-2 Gamma = 5.91E-1 Single Diesel = 1.19E-2 For fail-to-run events:

Beta = 5.32E-2 Gamma = 4.44E-1 Single Diesel = 1.59E-2 The single DG failure probabilities were derived using a Bayesian update of generic DG failure rates and plant specific DG experience.

DG failure to start and run common-cause events have been modeled with the following failure probabilities:

Table 5-5 DG Common-Cause Probabilities Failure Probability*

Common-Cause Event 2 Component group 3 Component group CCF of all three DGs fail-to-start __2.70E-4 CCF of DG-1 and DG-2 fail-to-start 4.57E-4 9.35E-5 CCF of DG-2 and DG-3 fail-to-start 4.57E-4 9.35E-5 CCF of DG-1 and DG-3 fail-to-start 4.57E-4 9.35E-5 CCF of all three DGs fail-to-run . - 3.76E-4 CCF of DG-1 and DG-2 fail-to-run 8.46E-4 2.35E-4 CCF of DG-2 and DG-3 fail-to-run 8.46E-4 2.35E-4 CCF of DG-1 and DG-3 fail-to-run 8.46E-4 2.35E-4

Bases NUREG/CR-4780 & CGS Bayesian update data The PRA has taken special efforts to ensure that common cause of the diesel generators is treated in a manner that maximizes the calculated risk differential associated with the extended DG CT.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 22 of 52 Common cause analyses of the plant configurations have been designed to maximize the calculated difference between the cases:

With all DG available (Group of 3) - Base Model

With one divisional D/G out for planned maintenance (Group of 2) - DG CT For the DG CT probabilistic risk assessment evaluation, these treatments correspond to the base model and the extended DG CT configuration. They use separate common cause analyses specifically derived from NRC common cause data analyses assuming a group of 3 in the base case and a group of 2 in the other. This approach yields the most conservative (largest) change in failure probability for the diesels with available data and models.

3.2 Discussion of Configuration Restrictions Configuration risk management restrictions may be proposed as prerequisite measures to use of extended CT to assure significant margin. The proposed TS Required Action of pre-staging of a portable generator to be available to supply the Division 1 battery chargers (E-C1-1 and E-C2-1) and the Division 2 Battery charger (E-C1-2) in the event of a loss of all AC power (i.e., SBO) is a significant risk mitigating feature to be added to the plant. The following discusses the bases for the configuration risk management restrictions imbedded in the process based on restrictions within our current TS and the additional risk management actions and their treatment within the analysis.

3.3 Extended CT Risk Management Measures Providing the Division 1 and Division 2 125-volt and Division 1 250-volt batteries with extended capacity due to an SBO event results in a significant benefit to reducing the risks during an extended DG CT. The primary benefit during the extended CT is a higher recovery factor for restoring an offsite or onsite power source. Verification of the availability of the AACSBC is a requirement for using the extended CT.

The AACSBC will be pre-staged with required cabling and distribution boards in place for rapid connection. The connection to the 480-V AC diesel generator will be designed to quickly establish a supply to the Division 1 125-V and 250-V, and Division 2 125-V battery chargers. The alternate AC source's capacity will be sufficient to supply each of these battery chargers simultaneously. With the pre-staging, the estimated evolution time to connecting the alternate battery charger supply to the batteries will be well within the Division 1 and Division 2 battery depletion times (- 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ) during SBO conditions. This provides significant additional time to operate RCIC and the ADS valves for reactor pressure control.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 23 of 52 In addition to maintaining the ability to run RCIC and control reactor pressure with the ADS valves, extending the Division 1 and Division 2 125-V DC batteries maintains the operator's ability to restore 115 kV offsite power breaker alignments to critical switchgear from the control room.

This restriction appears as a proposed Required Action in the LCO for use of the extended CT. For emergent corrective maintenance associated with a DG, this TS Required Action will be required to be completed within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and prior to use of the extended CT.

By implementing the risk management measure restrictions and the AACSBC, as presented above, sufficient margin exists to meet the acceptance guidelines for ICCDP and ICLERP.

This additional margin provides assurance that the results bound assumptions, uncertainties and sensitivity factors associated with this change for use in planned and corrective maintenance conditions for the DGs.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 24 of 52 4.0 KEY ASSUMPTIONS Consistent with the ASME PRA Standard, RG 1.200, and RG 1.174, key assumptions are identified in this evaluation to ensure they are treated in the decision-making process.

Attachment 6 provides details of the identification method.

4.1 Key Assumption Process A list of the key assumptions and approximations relevant to the results used in the DG CT application decision-making process provides information to support the assessment of whether the use of these assumptions and approximations is either appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate. Attachment 6 presents the detailed development of the key assumptions in accordance with RG 1.200. An overview of the process used for identification of the key assumptions (i.e. key uncertainties) is shown in the flowchart below:

Identify List of Potential Uncertainties Is Potential Area of Yes Screen out Uncertainty a Negligible l of further consideration Impact on Application as a key uncertainty t No Is Potential Area of Uncertainty Based on a Yes Screen out Consensus Model or lo of further consideration Approach as a key uncertainty

' No Identify as a Key Source of Uncertainty and Perform Necessary Sensitivities

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 25 of 52 4.2 Key Assumptions List A summary of the key assumptions derived from this process is shown in Table 5-6.

Column 1 of Table 5-6 provides the key source of uncertainty. Most of the key assumptions listed below were also identified by a Peer Review Team Fact and Observation (F&O). The PRA Peer Review Team Fact and Observations related to the key uncertainty are identified in Column 1 in parenthesis.

Column 2 of Table 5-6 provides the key assumption used in treating the key source of uncertainty to provide confidence in the PRA results.

Table 5-6 l_ Key Assumption List Key Source of Uncertainty "Key Assumption" Unusual Alignments The Columbia Generating Station (CGS) configuration control management program (imposed by on-line evaluates the on-line plant configuration to ensure that no undue risk is introduced. The maintenance, testing, or PRA relies on this process to ensure that a configuration is not entered that would emergent work.) compromise the validity of the PRA results.

(SY-A5-1/2) See Section 6.1 Grid Stability The grid stability to CGS is high and the grid unavailability remains low. Agreements (AS-A2-1) with Bonneville Power Administration (BPA) provide periodic confirmation that these See Section 6.2 remain as evaluated. Energy Northwest has determined the generic values of conditional LOOP given a transient or LOCA do not apply to CGS. The conditional loss of offsite AC power given a LOCA or transient is explicitly modeled using fault tree techniques.

Recirc Pump Seal Leakage The CGS PRA does not currently include the recirculation pump seal leakage in the base model calculations (probabilistic or deterministic).

(AS-A5-2) The recirculation pump seal leakage during an SBO has been modeled in MAAP See Section 6.4 sensitivity cases for a variety of assumed leak rates and it has been determined to have no impact on the accident sequence progression as modeled in the CGS PRA.

All Containment Alignments During the process of a core melt progression the containment parameters may significantly change in terms of water inventory and oxygen concentration. (No F&Os; Peer Review Team considered model acceptable as is.) The initial control of water inventory, oxygen concentrations, plus Emergency Operating Procedure (EOP) directions during accidents are sufficient to minimize the change in the containment parameters during a process of core melt such that their impact on the failure location or failure size remains as modeled in the PRA.

Ex-Vessel Steam Explosion The PRA model uses a potentially conservative estimate of the probability of containment failure due to ex-vessel steam explosion and shell-debris interaction failures.

(LE-DI-1, LE-B2-1) This results in a conservative estimate of the LERF risk metric. For specific See Section 6.6 applications, the change in LERF or ICLERP may be suppressed because of the conservative assumption regarding the early containment failure mechanisms. A sensitivity case to demonstrate the ICLERP for smaller values of the probability of ex-vessel steam explosion and shell-debris interaction failures is one way to demonstrate the impact of this key source of uncertainty.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 26 of 52 4.3 Peer Reviewers' Assessment of Key Assumptions The Peer Review Team reviewed the base PRA (Rev 5). The Peer Review Team found the modeling assumptions were generally well defined and captured within the base model PRA documentation. The PRA Peer Review Team did not explicitly review a "key assumptions list"; however, the Team's comments clearly indicate their review of the assumptions used in the model and documented within the PRA Notebooks. The "key assumption list" was developed subsequent to the peer review in accordance with the latest RG 1.200 guidelines. Most of the key assumptions listed above were also identified by the Peer Review Team Fact and Observations (F & 0). Where this occurred, the F & 0 is identified in Section 6.

5.0 PEER REVIEW TEAM F & Os POTENTIALLY IMPACTING THE TS APPLICATION 5.1 Internal Events - F & Os Impacting the TS Application The following Tables provide the summary results of the F & Os classified as an importance level A or B by the Peer Review Team for the CGS PRA, Revision 5, specifically associated with the condition of DG-1 or DG-2 being OOS for 14 days. Those that may have a more than a negligible impact on the results are identified for further evaluation.

By definition, Importance Levels A or B F&Os are:

"Importance Level A - Extremely important and necessary to address to assure the technical adequacy of the PSA or the quality of the PSA or the quality of the PSA updateprocess. "

"Importance Level B - Important and necessary to address, but may be deferreduntil the next PSA update. Consider necessary to meet Capability Category II. "

A complete summary of the A and B level F & Os for the full PRA are presented in Attachment 6. The F & Os presented below along with the above key assumptions comprise the areas of focus for PRA quality investigation for the extension in the DG CT application.

Each of the F & Os that may have more than negligible impact is evaluated primarily by performing a sensitivity evaluation. The F & 0 number and summary of the sensitivity results and conclusions are presented below. The description of the F & 0 has been condensed. The full description is available from the PRA Peer Review Report.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 27 of 52 Table 5-7 2004 PEER REVIEW APPLICATION PRA

SUMMARY

Level I or 2 PRA Met, N/A Not I II III Total F&Os-A&B2 Element Met Potential to be more than negligible in Bold Initiating Event (IE) 23 1 2 2 2 - 30 IE-C3-1, IE-C7-1, IE-C9-1 Accident Sequence 17 1 - 1 1 1 21 AS-A4-1, AS-A4-2, AS-A4-4, AS-A5-3,AS-A5-4, (AS) AS-A5-6, AS-B2-2, AS-B2-3, AS-B3-1, AS-B3-2, AS-A2-1, AS-A2-2 Success Criteria (SC) 8 1 6 - 15 SC-A6-2, SC-A6-3, SC-B1-2, SC-B1-4, SC-B1-5,

. . SC-B3-1, SC-B5-1, SC-Cl-i System Analysis (SY) 36 1 3 - - 1 41 SY-A8-1, SY-A17-2, SY-A19-1, SY-B5-1 Human Reliability 18 - 9 4 2 1 34 HR-El-1, HR-E1-2, HR-E1-3, HR-E3-1, (HR) HR-F2-1, HR-F2-2, HR-F2-3, HR-G3-1, HR-G4-1, HR-G5-1, HR-G5-2, HR-G8-1, HR-H2-1 Data Analysis (DA) 17 1 4 3 3 1 29 DA-B1-1, DA-DI-1 Internal Flood (IF) 24 1 1 - - 2 28 IF-E5-1, IF-E7-1 Quantification (QU) 23 1 4 - 1 2 31 QU-C2-1, QU-D2-1, QU-D4-1 LERF Analyses (LE) 14 2 7 8 6 - 37 LE-A4-1(LE-E2), LE-A4-2, LE-B2-1, LE-C2-1, LE-C3-2, LE-C4/C5-1, LE-C4-2, LE-C4/C5-1, LE-C7-2, LE-D1-1, LE-E3-1, LE-Fl-l, LE-F2-1, LE-

. _ _ G5-1 Total 180 9 36 18 15 8 266 -

1 It is noted that for many of the ASME PRA Standard Supporting Requirements the same requirement is applicable to all Capability Categories. In this compilation, the fact that a Supporting Requirement is determined to be met means that it meets at least Capability Category 11.

2 There were no internal event PRA F & Os rated as an "A" concern by the Peer Review Team.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 28 of 52 TABLE 5-8 2004 PEER REVIEW

SUMMARY

F & OS RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS LEVEL 1 PRA

[ BF&O* [ Issue I Resolution Method AS-A2-1, A conditional probability of a LOOP induced by a transient or LOCA is explicitly quantified, Unique CGS grid stability supports the current model.

AS-A2-2 but at a very low conditional failure probability. A qualitative assessment of the BPA grid Grid Stability evaluation performed. See Section 6.2 reliability indicates that this is a negligible impact on the DG CT application. l AS-A5-3 Conservative treatment of HPCS operation may reduce the impact of DG CT application. Conservatism may lead to an overestimate of risk Conservatism may lead to an overestimate of risk increase. increase. Sensitivity performed to demonstrate impact.

See Section 6.3.

AS-B2-2, Vent impacts associated with non-SBO and non-LOOP sequences. This does not Performed HRA evaluation. Determined that crew AS-B2-3 influence the DG CT application. Vent Impact on operating systems verified during interpretations of procedures were appropriate and interviews that vent would be tightly controlled. No impact due to proper control. consistent with PRA modeling. See Section 6.7 SY-A17-2 RCIC back pressure assumption affects non LOOP and non-SBO sequences. MAAP See RCIC Sensitivity. See Section 6.4 evaluations performed to demonstrate deterministic effects.

SY-B5-1 The chargers appear to receive credit for a specific AC bus transfer that may depend solely on The dependency was verified to be presented. See DC availability. Gate GXDC2012 of the DC System Notebook.

HR-E1-3 HEP justification needed. Interviews conducted subsequent to PRA Peer Review. See HEP Sensitivity. See Section 6.7 HR-E3-1 HEP justification needed. Interviews conducted subsequent to PRA Peer Review. See HEP Sensitivity. See Section 6.7 .

HR-G3-1 HEPs significantly affecting the DG CT extension were re-evaluated with the Cause Based See HEP Sensitivity. See Section 6.7 HRA Method subsequent to the PRA Peer Review and this F&O.

HR-G5-1 Gathering basis for required action times occurred after the PRA Peer Review. See HEP Sensitivity. See Section 6.7 lHR-G5-2 Gathering basis for required action times occurred after the PRA Peer Review. See HEP Sensitivity. See Section 6.7 HR-G8-1 Establish a minimum HEP that should be applied to combinations of HEPs. See HEP Sensitivity. See Section 6.7 DA-B1-1 Recalculate the combining of plant specific data failure rates for components, which are See Component Sensitivity. See Section 6.8 inappropriately grouped. l QU-C2-1 Evaluation of HEP dependencies among actions within a cutset. Sensitivities performed as part of HR-El-3, HR-E3-1, HR-G8-1. See Section 6.7 QU-D2-1 There is a conservative assessment of HPCS viability applied in the model. This may See HPCS Sensitivity. See Section 6.3 introduce a conservative bias in the DG CT application risk metric calculations.

All F&Os associated with the internal events level 1 and 2 were importance level B or less.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 29 of 52 TABLE 5-9 2004 PEER REVIEW

SUMMARY

F & OS RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS LEVEL 2 PRA A or B F&O Issue I Resolution Method LE-B2-1 The ex-vessel steam explosion may be conservatively treated This may conservatively bias the LERF risk metric in the DG CT application.

in the Level 2 model. See ex-vessel steam explosion sensitivity evaluation. See Section 6.6 LE-C2-1 The HRA implementation in the Level 2 is thought to be See Level 2 HEP Sensitivity. See Section 6.5 generally conservative. However, dependencies are treated in an approximate manner. There would be some small l_ impact on the DG CT application.

LE-Dl-l The ex-vessel steam explosion may be conservatively treated This may conservatively bias the LERF and ICLERP risk metric in the DG CT in the Level 2 model. application. Assessed as meeting at least Capability Category 11. However, the ICLERP and delta LERF risk metrics should be evaluated in a sensitivity case with the ex-vessel steam explosion probability reduced. See ex-vessel steam l_ explosion sensitivity evaluation. See Section 6.6 LE-E3-1 Level 2 (ATWS related sequences) has not been updated to The calculations have been performed to update the Level I and subsequently Revision 5 Level 1. Level 2. The total LERF reduced from 6.986E-7 per year to 6.858E-7 per l_ year. The revised SBO contribution to the LERF is less than 10 percent.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 30 of 52 5.2 Fire -Peer Review F & Os Impacting The DG Application Tables 5-10 and 5-11 provide the applicable summary results of the F & Os classified as A or B level by the Peer Review Team for the CGS Fire PRA, Revision 1. Those that may have more than a negligible impact on the results are identified for further evaluation.

Two of the F & Os were rated as level A. These were resolved by modifying the Fire PRA to incorporate changes to the model. Level B F & Os were evaluated and where necessary sensitivity evaluations preformed. The following tables provide the details of the resolutions. The description of the F & 0 has been condensed. The full description is available from the Peer Review Report.

Table 5-10 2004 PEER REVIEW APPLICATION FPRA

SUMMARY

Level 1 FPRA Element Fire Areas and Fire I

Met I

N/A 2 1 I

Not Met Imore I

I*

I II*

2 III*

JPotential Total 5

F & Os- A & B none to be than negligiblinBd Compartments (FC)

Cable and Equipment Location 4 - 1 3 8 CE-B1-2, CE-B2-3, Data (CE) CE-B3-4 Development of Fire Ignition 4 - - 1 5 none Frequencies (FR)

FPRA Model Development - 7 3 - 1 - - 11 FM-C4-1, FMI-D1-1 Plant Response (FM) _

Fire Scenario Development 4 - 3 1 2 3 13 FS-CI/C2-1, FS-(FS) C4-2, FS-C5-1 FPRA Model Quantification 2 - - 3 1 - 6 none (M Q )_ _ _ _ _ _ _ __ __ _ _ _ _ _ _

Total 23 4 3 5 6 7 48 See above

Note: Fire PRA capability rating criteria developed by consultants because a consensus standard did not exist at this time.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 31 of 52 TABLE 5-11 2004 PEER REVIEW

SUMMARY

FIRE F & OS RELATED TO DG CT APPLICATION F&O Issue I Resolution Method CE-B2-3 1 The Fire PRA analysis includes treatment of the offsite power supply connection via startup The PRA Fire Model was revised to include transformer TR-S. A review of the plant three line diagram found that the transformer is these cables.

provided with differential relay protection. The current transformer (CT) circuits which provide input to this protective relay include ASH5-65, ASM1-14, ASM3-15, BSH6-65, and BSM2-95.

A fire induced failure of any these cables could appear to the differential relay as a short circuit on the transformer secondary circuit. In response to such a spurious signal, the differential relay is expected to generate a switchyard breaker trip signal to open the transformer primary breakers.

These cables have been screened from the Fire PRA. As such, it appears that an important fire induced circuit failure has been inadvertently excluded from the analysis. Given the proposed EDGCTCT application, this specific failure mode is critical to the analysis.

CE-B3-4 The analysis process incorporates the complete scope of CARPS data. A review of the analysis The PRA Fire Model was revised. The database found numerous instances where cables identified as being applicable to the analysis - database analysis was updated to disposition not screened - are not associated with a model basic event. As such, it would appear that these cables.

potential fire induced cable failures that affected credited systems or functions may not have been treated in the analysis. Can this be annotated with a resolution statement?

FM-C4-I The Fire PRA includes explicit treatment of fire induced spurious equipment actuation. This The PRA Fire model was revised to use EPRI treatment uses a generic value of 0.10 as the conditional probability given fire damage. This recommended value.

value is indirectly discussed and not adequately justified in the analysis documentation. In addition, the 0.10 value is lower than the EPRI recommended value by a factor of 3. The EPRI value was developed based on generic testing combined with an Expert Elicitation that reviewed the testing results. Given the current industry focus on fire induced spurious actuation - both single and multiple, this treatment is expected to be questioned.

1 This F & 0 was an importance level A

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 32 of 52 TABLE 5-11 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F & OS RELATED TO DG CT APPLICATION F&O Issue Resolution Method FS-Cl/ The scenarios involve relatively small fire events. The maximum heat release rate considered is The cabinets of interest are relatively closed C2-1 limited to less than 600 KW. This compares to an EPRI/NRC recommended value of 800 KW and have IEEE-383 qualified cables, the heat of open electrical cabinets with non-IEEE 383 qualified cables. Postulated combustible fluid release rates recommended by EPRI were based fires often have values of several megawatts. The analysis methodology as implemented used. Switchgear cubicles with incoming requires the treatment of any fire that exceeds the fire modeling input parameters to be treated as power, such as, the yard transformer feeder causing zone wide failure. However, in cases where the zone boundaries are also based on a cubicles and DG cubicles, were assumed to

'limited' fire scenario, it is unclear how the resulting scenario can be justified. have higher heat release rates. Large The consequence of the fire modeling treatment and application may include instances where the quantities of transient combustibles cannot be quantification is overly conservative or other instances where it may be non-conservative. stored in the safety-related areas. Small I quantities must be stored in spill proof containers. However, in many compartments it was conservatively assumed that the transient fires spread throughout the compartment. Fire propagation was based on EPRI FEDB. Modeling treatment is sufficiently conservative. No impact anticipated to DG CT.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 33 of 52 TABLE 5-11 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F & OS RELATED TO DG CT APPLICATION F&O [ Issue I Resolution Method FS-C4-2' The treatment of the postulated fire in the main control room includes the application of multiple

Although the HEP treatment is judged factors, which includes: an HEP for fire suppression, an HEP for shutdown from outside the adequate, the Fire PRA was modified to a main control room, and the treatment of the availability of plant systems following control room higher HEP of 1E-2. A sensitivity was abandonment. The basis for the selection of several key input parameters is not adequately performed by increasing to IE-1. The justified. resulted CDF is 2.1E-5/yr and DG2 ICCDP is 4.7E-8.

The analysis describes the use of a screening HEP of 3.0E-03 for errors associated with the

In the procedure, HPCS is tripped to execution of the ABN-CR-EVAC. The procedure flow chart shows parallel actions required prevent overfill. In the fire PRA, credit is by five operators to implement the single train shutdown strategy. Given the 10 minutes given to using unprotected A train and demanded, the number and apparent complexity of those actions, the use of an HEP of 3.0E- HPCS, if they are not damaged by the fire, 03 would require more rigorous HRA treatment to justify. and if the B train and RCIC are not

The event tree treatment includes a node for the conditional probability that HPCS is available available.

following control room abandonment. However, ABN-CR-EVAC directs the operators to

The use of the 3.0E-4 HEP was not for use ensure that HPCS is tripped within 10 minutes of abandonment.

of A train equipment outside of the control

The treatment of the control room abandonment includes credit for the conditional availability room. This HEP was used when the control of Train A from outside the main control room for selected fire sequences. This treatment room fire was successfully extinguished, and includes the use of a reduced HEP of 3.0E-04. The steps to implement a potential Train A the control room did not need to be appear late in ABN-CR-EVAC making it unclear whether the HEP is appropriate or whether evacuated, but B train cabinets were this actually represents a success path.

involved in the fire. A train equipment and

The plant damage state (PDS) assigned for the scenario that involves control room HPCS are not affected by the fire, and, if abandonment and successful implementation of the procedure is TFN. This is the same as they do not start automatically, can be that used for the non-abandonment case. Given the limited controls and systems that can be operated and controlled normally from the confirmed to be available given abandonment, the basis for this treatment should be control room.

documented in greater detail. A cursory review of the event tree for TFN indicates that it

Because of the various scenarios in the may be applicable only for the non-abandonment case. As a consequence, the control room control room fire analysis, the event trees abandonment case may credit mitigation beyond that which is available. This treatment is used transfers to group the sequences for equally applicable for many other sequences. In general, the basis for the PDS assignments further level 1 analysis. The TFN transfer should be documented and justified in greater detail. category contributes less than 5E-09/yr to CDF, and is not important to LERF.

This F&O was an importance level A

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 34 of 52 TABLE 5-11 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F & OS RELATED TO DG CT APPLICATION F&O I Issue I Resolution Method FS-C5-1 The event trees presented in the Screening Fire Event Trees Report (FPSA-2-ET-0001) include The screening analysis is judged adequate for instances where automatic fire suppression is credited. The treatment in the event trees is such the following reasons:

that successful suppression is assumed to result in only loss of the single 'worst case'

First, the "worst case" single failure in the component. This treatment is applied without any supporting fire modeling analyses or entire compartment was always assumed to discussion. The application of this approach may result in non-conservative treatment. The fail, which is very conservative.

scenario of interest is a case where a fire involving a fixed fire ignition source occurs and is not self-extinguished. The treatment assumes that the environment in the fire zone is such that

Second, based on EPRI FEDB analysis, it conditions necessary to actuate the automatic fire suppression system occur. However, without was assumed that a fixed ignition source analysis or some other assessment of the fire zone it is unclear how it can be concluded that an fire (other than yard transformers) would be intervening target is precluded from being disabled. In addition, treatment of the suppression limited to the initial ignition source if system actuation time versus the target damage time does not appear to have been considered. automatic suppression is successful. A The quantification using the TFS designator indicates that only the single worst case component fault tree was developed to model failure of is assumed to be failed. If the scenario actually results in fire damage to an intervening cable the automatic fire suppression systems.

tray, then additional failures would have been inappropriately excluded.

Third, since the automatic fire suppression systems at CGS actuate at relatively low temperatures (generally 165F) and cable has a damage threshold of about 700F, the assumption was made that the fire suppression system would actuate before target cables were damaged.

Documentation will be enhanced.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Attachment 5 Page 35 of 52 TABLE 5-11 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F & OS RELATED TO DG CT APPLICATION F&O Issue I Resolution Method FM-DI-l The Fire PRA analysis methodology describes a post-processing of outside control room There is an extensive document on operator operator actions. This is described in Appendix J. However, the post-processing described in actions in the Post Fire Safe Shutdown Appendix J was not performed. The concern is that the quantification results include the analyses. This was used to verify that there inappropriate crediting of an operator recovery action that is actually precluded by the postulated were no actions incorporated into the fire PRA fire event. that would require an operator to pass through or take actions in the area of a fire. The only exception was for the main control room fire, where the operators must trip the plant and close the MSIVs before evacuation of the main control room. Based on the PFSS analyses, no ex-control room operator actions were removed from the analysis. However, credit could not be taken for some equipment (and associated operator actions) after certain fires in the main control room, since the control and actuation cables could be damaged.

Documentation will be revised to describe the process used. Negligible Impact.

L _____

___ ____ ___ ___ ___ ___ ____ ___ ___ ___ ___ __I

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 36 of 52 6.0 SENSITIVITY EVALUATION RESULTS FOR KEY ASSUMPTIONS AND F & Os A summary of the key assumptions and sensitivity analyses performed to address those peer review team F & Os, which may have more than a negligible impact on the risk results for the extended DG CT, are presented below. The results of these evaluations do not significantly change the risk evaluation conclusions with respect to the risk metric guidelines.

6.1. Unusual Alignments (SY-A5-1/2)

The potential for water hammer in the Residual Heat Removal (RHR) system (initially operating in the Suppression Pool Cooling (SPC) mode) during a LOOP and coincident with a postulated Design Basis LOCA or LOCA signal has previously been recognized (NUREG-927, 3/84; NEDC-32513, 12/95). The concern was due to the potentially long run-time of the RHR system aligned in the SPC mode due to heating of the suppression pool from leaking safety/relief valves (SRVs). CGS has previously investigated this issue and implemented a run-time limit of 780 hours0.00903 days 0.217 hours 0.00129 weeks 2.9679e-4 months per year with a guideline of less than 15 hrs per week while in Modes 1, 2 or 3. This limit is slightly below 10% of annual plant operation time.

The CGS plant data of an RHR system operating in the SPC mode during last six years has been collected and listed below:

CGS RHR System in SPC Hours of Operation During Modes 1, 2, and 3 Year (counted from 7/1 to 6/30) Total Time (hours) 1999 129.90 2000 217.00 2001 222.53 2002 113.80 2003 265.19 2004 (7/1/03 to 4/15/04) 74.40 Annual Average - 175/yr The plant data indicates the annual SPC run-time has been significantly less than 10% (876 hrs/yr) of the total time in a year. Therefore, it is determined this unusual alignment (RHR operated in the SPC mode during Modes 1, 2 and 3) would not significantly impact the plant risk due to water hammer concerns.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 37 of 52 6.2. Grid Availability and Stability (AS-A2-1)

The FSAR Section 8.2.2 provides the analysis of grid availability and grid stability for the interface of the BPA Federal Columbia River Transmission System (FCRTS) and its supply to CGS.

Grid Unavailability:

The BPA 230-kV and 115-kV transmission lines outage historical data for CGS was initially evaluated over the period from 1985 to 1991. Planned outages, unplanned outages (loss of source), and under voltage durations during CGS operation were used to calculate a total unavailability of 4.8E-2 per year for the 230-kV line into CGS. For the 115-kV line into CGS, planned outages and unplanned outages during CGS operation were used to calculate a total unavailability of 1.2E-3 per year.

A recent BPA analysis provides an evaluation of the grid unavailability similar to the above (1985-1991) analysis. This recent 6-year analysis period (includes the years 1998 through 2003) provides the results in total time for planned and unplanned outages and under voltage conditions and covers the period from the start of deregulation. Although not predictive of future long-range conditions, this information does confirm the stability of the offsite power sources.

The planned and unplanned (loss of power source) grid outage data for the 230 kV and 115 kV covers a period of 1998 through 2003 (six years). The under voltage data for the 115 kV Benton line covered this same period. The 230 kV under voltage supply from the ASHE 230 supply covers the period from 2001 through 2003. This corresponds to the time following the addition of a shunt capacitor bank at the ASHE substation and better represents the current voltage control performance for the 230 kV supply. This data collection period is sufficiently long enough to judge if a change in the total unavailability was occurring, but not long enough to base a revision to the initiation frequency of a LOOP.

The update analysis was performed by BPA as part of the agreement with BPA for offsite power control. Using the above methodology, the unavailabilities for planned outages, unplanned loss of source and the under voltage condition for the 230 kV and 115 kV supply lines to CGS were 7.37E-3 and 5.25E-3, respectively. The unavailabilities of 230 kV and 115 kV supply lines to CGS while online were 6.41E4 and 7.61E-5, respectively. Table 5-12 provides details of each type of unavailability.

Table 5-12 contains information provided by BPA on planned, unplanned, and under voltage conditions on an annual basis. The actual loss of power for a source lasted a longer period due to completion of internal processes and verification that no internal problems were caused by the loss of power. The time values listed in Table 5-14 reflect this longer period, however, Table 5-12 durations reflect the time that BPA recorded the power was unavailable or under voltage from

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 38 of 52 the BPA grid to CGS. CGS experienced loss of an offsite source from plant centered, grid related and weather related events over this six-year period. See Table 5-14 for details.

The LOOP initiation frequency derived from history (plant centered/grid/weather) = (19.33 events/yr

7.61E-05) + (.33 events/yr

6.41E-4) = 1.68E-3/yr Table 5-12 fGrid Unavailability Analysis Summary Condition # of Minutes Unavailable Unavailable Events per Yr4 Probability Probability During per Yr CGS Online 230 kV planned outage' 1 3539 6.73E-3 230 kV unplanned loss of power 0.33 2422 4.60E-4 4.59E-4 230 kV under voltage (total number 193 95 1.811E-4 1.81E14 of 5 minute intervals source is under voltage)

Total Average Annual Unavailability 230 kV 7.37E-3 6.41E-4 115 kV planned outage' 3.5 2721 5.18E-3 115 kV unplanned loss of power 0.33 40 7.50E-5 7.61E-5 115 kV under voltage (total number 0.0 0 0.0 0.0 of 5 minute intervals source is under voltage)

Total Average Annual Unavailability 115 kV 5.25E-3 7.61E-5

'All planned 230 kV and 115 kV outages have been during shutdown periods. There have been no simultaneous planned outages of both the offsite sources. Thus, the planned outages are not included in the probability of loss of offsite power calculation.

2 One of the two unplanned 230 kV loss of power occurred 6/1/2001. With the plant in a refueling outage, a lighting strike on the 230 kV line damaged the TR-S high voltage transformer bushing. Since the plant was shutdown with two offsite sources available (115 kV and 500 kV) and plant loads being supplied by the 500 kV source, an expedited effort was not made to return the 230 kV source to service. This resulted in an artificially high unplanned loss of power duration of 8918 minutes. The unavailability probability calculation used a conservative value of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (1440 minutes) for this event. This is a conservative time required to bring in the 500 kV offsite source. The only other unplanned unavailability of the 230kV line lasted 10 minutes.

3 The 230 kV under voltage conditions were primarily due to switching and short-term events due to lines relaying off and back on. The longest period recorded was 40 minutes on 4/25/2003 from 05:25 to 06:05. The sample rate is every 5 minutes. Most of the transient under voltage recorded by BPA was less than 5 minutes. The period covered is from 2001 through 2003.

4 These times represent the time the source was either unavailable or under the required voltage as recorded by the BPA monitoring system. Restoration of the offsite source by the plant normally required additional time and is provided below in Table 5-14.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 39 of 52 The PRA assumptions for grid and weather related unavailability are:

Table 5-13 PRA Assumptions for LOOP Source of LOOP-PRA Initiation Frequency %of Total Initiation Frequency Plant Centered 2.98 E-2 /yr 82.5 %

Weather Related 3.61 E-3 /yr 10.0 %

Grid Related 2.72 E-3 /yr 7.5 %

Total 3.61 E-2 /yr 100%

When the predicted grid, weather related, and plant centered frequency based on actual BPA historical data of 1.68E-3/yr is compared to the value used in the PRA (3.61E-2/yr for Total LOOP) the PRA assumption is sufficiently conservative.

History of Offsite power outages at CGS:

There have been a number of momentary under voltage events that caused plant equipment or operator action due to lightening strikes, automatic load dispatch switching, equipment failure, errors in testing, and faults on the BPA grid. However none of these transient events resulted in a loss of all offsite power to the plant. Most of them affected the 500 kV system and with the plant at power, a few of them resulted in voltage swings sufficient to cause voltage dips at the emergency buses significant enough for the under voltage bus sensors to start but not load the DG. These momentary grid transients were stable, but did result in a short-term voltage dips that are detected by the CGS offsite power monitor oscillograph.

There has not been a condition where both lines had under voltage conditions concurrently for any duration that would lead to declaring the offsite power not available. There was a total of 57 five minute intervals that an under voltage condition was recorded at the ASHE substation for the 230 kV line (i.e. less than 236 kV at ASHE) over the three-year period following the shunt capacitor bank addition at ASHE. The average annual under voltage for the 230 kV was 95 minutes (longest period was 40 minutes on 4/25/2003). The 115 kV line has not experienced an unplanned under voltage period over the past 6 years.

There have been four occurrences where an unplanned loss of an offsite power source occurred during this 6-year period. The following table provides the event description, date and approximate outage duration.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 40 of 52 Table 5-14 Unplanned Loss of an Offsite Power Source To CGS 1998 to April 2004 Event Description Date Duration

1. With the plant at full power, a trip of the 115 kV oil circuit 7/23/03 24 minutes breaker (OCB) occurred due to a loss of 115 kV line during BPA testing on the 500 kV system. The 115 kV supply to the OCB was immediately restored. Following required SR testing and communication with BPA the OCB was closed and 115 kV supply restored to the plant.

2. With the plant at full power, a trip of the 230 kV supply 11/01/03 28 minutes occurred when a Plant maintenance error resulted in a trip and lock out of the TR-S supply.

3. With the plant in a refueling outage, a lighting strike resulted in 06/01/01 8908 minutes damage to the TR-S high voltage bushing. Since the plant was (-6 days) receiving back feed power via the 500 kV line and the 115 kV line at the time, there was no urgency to return the 230 kV line to service. A total of 8908 minutes of unplanned outage occurred to the 230 kV supply. Restoration of this condition would have been expedited if it had occurred with the plant at power or with less than N+ 1 offsite sources.

4. With the plant at full power, a trip of the 115 kV OCB 01/14/01 80 minutes occurred due to a fault at an offsite nearby federal facility.

This resulted in the 115 kV line relaying off and re-closing when the fault had cleared. Restoration of the 115 kV OCB occurred after confirming the cause of the fault with BPA.

Stability Analysis A transient stability analysis of the BPA grid was performed to determine the impact on the two independent offsite sources of power for CGS. The analysis included (a) the loss of the single largest power source feeding the transmission system, (b) the loss of the CGS generator, and (c) the loss of the most critical single transmission line in the vicinity of CGS. The primary source of independent offsite power is a network connection at the ASHE 230-kV substation and the backup source is a network connection at the Benton 115-kV substation. Previous studies have shown the worst case for transient stability is during off-peak load periods with high power flows through the system. Therefore, two seasons were studied to assess the transient stability impacts. The 1998 light (off-peak) summer case, defined by the Operating Capability Study Group (OCSG) operating case (Refer to FSAR Figure 8.2-1) was used to study the system. This case studied high north to south flows on the California Oregon Intertie (COI) and Pacific DC Inter-tie (PDCI). The 1998

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 41 of 52 light winter case, defined by the Western Systems Coordinating Council (WSCC) operating case (as shown in FSAR Figure 8.2-2) was used to study the system with high south to north flows on the COI and PDCI. In general, transient stability problems are worse during off-peak time periods with high flows through the system because the phase angles across the system are greatest for these conditions.

In the summer, the worst case of a loss of a generating source feeding the grid was loss of two of the three generating units at Palo Verde in Arizona. This is the limiting outage (specified by WSCC as a loss of two units at Palo Verde, a "single" source for this study),

which defines the system limits for the COI and PDCI. This swing case (98LsasOO2) was stable and damped and resulted in acceptable system performance of the BPA grid.

When it was assumed that CGS was lost simultaneously with two Palo Verde units, transient stability performance was improved because loss of CGS reduces the additional power picked up on the COI due to the Palo Verde generating unit outage (swing case 98LsasOl9) as shown in FSAR Figure 8.2-4. The worst single transmission line outage in the vicinity of CGS was a three-phase, 500-kV fault at ASHE and simultaneous loss of the ASHE-Marion and ASHE-Slatt 500-kV lines. This is considered a single line outage because these lines share common towers. This swing case (98LsasOO5a) was stable and damped and resulted in acceptable system performance of the BPA grid as shown in FSAR Figure 8.2-5.

In the winter, the worst case of a loss of a single generating source feeding the grid was loss of a single hydro unit at Grand Coulee Dam connected to the 500-kV system in conjunction with an assumed simultaneous loss at CGS. This swing case (98LwasO28) was stable and damped and resulted in good system performance of the BPA grid as shown in FSAR Figure 8.2-6.

The worst single transmission line outage in the vicinity of CGS was a three-phase, 500-kV fault at Hanford and simultaneous loss of the Hanford-John Day 500-kV line. This swing case (98LwasO2O) was stable and damped and resulted in acceptable system performance of the BPA grid as shown in FSAR Figure 8.2-7.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 42 of 52 BPA Grid Maintenance and Monitoring The stability of the BPA grid is continuously studied as the loads grow and additional lines and generating capacity are added. The future grid configuration during the life of CGS may differ from that assumed in the above studies. The reliability and availability of the BPA grid are stringently controlled in accordance with the BPA "Reliability Criteria and Standards." This document is continually updated and was applicable at startup and remains throughout the operating life of CGS. This document covers reliability criteria for the following areas:

a. Transmission planning,

b. Operations,

c. Maintenance,

d. Customer service, and

e. Transmission design.

This BPA document incorporates the "Western System Coordinating Council Reliability Criteria for Transmission Planning," the "North American Electric Reliability Council Operating Guides," and the "Northwest Power Pool Operating Manual." It is the operating policy of BPA not to interrupt intentionally or reduce intentionally the delivery of power to CGS without the prior concurrence of Energy Northwest. The priority that BPA provides for maintaining the offsite supply to CGS is addressed in a formal agreement with BPA.

The BPA agreement includes the following provisions to assure that a stable and reliable offsite power system is available to CGS.

1. BPA to conduct transient stability, voltage, and short circuit studies of the FCRTS biennially.

2. BPA will notify if study results adversely affect power deliveries to CGS per agreed standards.

3. Standards for delivery of power at minimum and maximum voltage schedules are established. These standards are established based on the minimum required voltage to supply LOCA loads and the maximum voltage limits to be within the medium voltage maximum short circuit ratings of the switchgear.

4. BPA will maintain interconnection facilities of the FCRTS to supply power at sufficient MW and MVAR minimums and frequency limits to CGS.

5. BPA will develop Dispatcher's Standing Orders necessary to meet the standards for CGS.

6. BPA will coordinate all outages of the FCRTS with CGS.

7. CGS will not be included as part of any automatic or manual load shedding schemes.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 43 of 52

8. BPA will not include CGS in such schemes without 1 year advanced notification to facilitate alternate emergency power supply options.

9. The primary preferred energy facility to the FCRTS is Grand Coulee Dam and the Alternate (backup) is McNary Dam. Both of these have black start capability.

Conclusion:

Based on the conservative treatment within the PRA of the grid and weather related unavailability and the strong stability of the BPA grid due to its large hydro electric base within and supplying the FCRTS network, the key assumptions associated with grid stability are well supported. Among the principle uses related to this key assumption is the treatment of conditional LOOP with loss of CGS. Based on the strong stability and in-depth analysis by BPA along with agreements to biennially re-evaluate the stability of the network, the conditional LOOP included in the CGS PRA is not generic based. The PRA uses an assessment of the conditional loss of transformers, transmission lines, etc. for the BPA-specific modeling. Further, CGS plant scrams from power have not resulted in a subsequent loss of an offsite power source due to the BPA grid becoming unstable over the history of operation.

Although past history could warrant a much less conservative treatment of grid and weather related LOOP, the CGS PRA retains the initiating event values derived from industry wide studies with only minor credit for the strong stability of FCRTS (i.e., not requiring a generic conditional LOOP) given a transient or LOCA signal.

The BPA grid stability has remained strong throughout the history of the operation of CGS.

The recent analysis of grid availability during the last 6 years, which includes the period of deregulation in California, has not impacted this conclusion. Considerable degradation of the FCRTS would have to occur in order to negate the assumptions used in the CGS PRA.

With biennial reanalysis, any deregulation impact would be seen within a sufficient enough lead time to take actions to correct the condition.

The Key Assumption associated with grid stability is fully supported by actual experience with the BPA supply to CGS.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 44 of 52 6.3. HPCS Sensitivity (12-hour versus 24-hour mission time)(AS-A5-3)

The PRA Revision 5 currently terminates HPCS availability at 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months during certain SBO/LOOP condition due to assumptions regarding containment interface. A sensitivity study of a 22-hour HPCS availability yields the following results.

HPCS is a Division 3 system for CGS. It has its own power supplies, controls, and cooling systems. The CGS PRA includes a detailed model with HPCS component failures, applicable common-cause events, operator errors, and maintenance unavailabilities.

Under postulated licensing "SBO" conditions, Division 1 and 2 systems are without AC power. Therefore, AC dependent systems in Divisions I and 2 are unavailable, and after batteries deplete (assume AACSBC is not available), the DC systems such as RCIC, SRVs for depressurization, and control room instrumentation are unavailable.

The unavailability of Division I and 2 DC power will lead to the SRVs reclosing and the RPV repressurizing. At extended times (> 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months ), this would result in operation of the plant outside the Heat Capacity Temperature Limit (HCTL). BWR PRAs in general, and CGS in particular, have credited the operation of the high pressure motor driven systems despite SRVs reclosing and the inability to maintain conditions inside the HCTL. These are conditions typically observed in the long term during loss of decay heat removal (DHR) sequences (e.g.,TW).

The crew will be using alternative methods to depressurize, including local manual actions.

Regardless of the success of these actions, the EOPs continue to direct RPV injection to maintain adequate core cooling. HPCS has the capability under these conditions to provide the needed RPV makeup.

Given these severe SBO conditions, HPCS operation with its dedicated diesel and standby service water (SW) system provides a self-contained system for RPV injection and inventory control.

The crew has the following RPV and containment information available at extended times into an SBO following the battery depletion on Divisions 1 and 2:

Local measurements from instrumentation not requiring power are available in the Reactor Building for RPV water level and containment parameters.

HPCS Level 2 and Level 8 automatic logics (sensors and relays) remain available to control HPCS automatically.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 45 of 52 Note that the HPCS Level 2 and Level 8 relays could also be used to identify the RPV water level control band such that HPCS could be manually controlled from the Control Room to minimize HPCS cycling.

In the unlikely event that RPV water level is declared unknown, the EOPs direct RPV flooding. Under these conditions HPCS is still used as the RPV make-up source. RPV injection is to be maintained and not terminated. Given the HPCS capability and the clear procedural guidance, RPV injection will be maintained using HPCS for as long as HPCS remains a viable injection source, i.e., at least until containment overpressure failures.

The MAAP calculations predict that during an SBO accident, when reactor core water level is maintained by HPCS, the wetwell will approach HCTL condition in approximately 10 hrs. The CGS EOPs directs an emergency depressurization whenever the HCTL is reached. Assuming no division 1 or division 2 DC during SBO at 10 hours1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months , the PRA model conservatively assumes core damage would occur.

A sensitivity calculation was performed for HPCS mission times of 22-hr during an SBO (relative to the 10-hr base case).

The non-recovery probability of offsite AC power corresponding to the new mission times were re-calculated.

After the SBO event tree was revised, the CDF and LERF were subsequently quantified.

The above processes were repeated for two more scenarios: 1) DG-1 out-of-service, and 2) DG-2 out-of-service [Both these cases included only the normal risk management measures: No elective maintenance to be performed for cross-train DGs, cross-train SWs, TR-S/B, HPCS, and RCIC.]

The ICCDP for a 14-day DG outage was calculated based on the baseline CDF and the DG-OOS CDF.

The results of CDF and ICCDP are summarized in the following table:

HPCS mission time CDF(b) CDF wvith DG out-of-service* ICCDP (14-day DG OOS)

(hrs) (3T@) DG-1 00S DG-2 00S DG-1 00S DG-2 00S 10 (Baseline) 7.33E-6 1.99E-5 Iyr 2.07E-5 IyT 4.82E-7 5. 14E-7 22 6.64E-6 1.20E-5 I T 1.24E-5 I T 1.79E-7 1.94E-7 The results of LERF and ICLERP are summarized in the following table:

HPCS mission time LERF(baw) LERF with DG out-of-service* ICLERP (14-day DG OOS)

(hrs) DG-1 00S DG-2 00S DG-1 00S DG-2 00S 10 (Baseline) 6.86E-7 7.44E-7 IrT 7.37E-7 AT 2.22E-9 1.96E-9 22 6.86E-7 7.44E-7 I T 7.37E-7 I T 2.22E-9 1.96E-9

These are Cases 1.3.1 and 2.3.1 from Table 5-1.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 46 of 52 Based on the sensitivity evaluation results shown in the above two tables (CDF and LERF),

the 22-hr HPCS mission times result in a significant effect with both total CDFs (-40%)

and ICCDPs (- 62%) decreasing from the 10 hour1.157407e-4 days 0.00278 hours 1.653439e-5 weeks 3.805e-6 months baseline values. The LERFs and ICLERPs results are virtually unchanged, as expected due to the relative insensitivity of the LERF metric to the SBO event. This sensitivity study shows that additional margin exists within the PRA modeling to the acceptance guidelines due to this conservatism embedded in the model.

6.4. Recirculation Pump Seal Leakage (AS-A5-2)

The potential impact of recirculation pump seal leakage up to 36 gpm has been evaluated from the processes listed below:

Thermal-hydraulic calculation using MAAP4.04 was performed for 18 and 36-gpm seal leakage cases. The 36-gpm leakage rate was more conservative and used for this evaluation.

The MAAP results indicate the following: (1) The time to reach a drywell pressure of 19 psig for RCIC turbine exhaust backpressure trip (considering discharge line head of water in the suppression pool and back pressure inside the exhaust line to the set-point 25 psig) is 10 hrs, (2) The time to reach the HCTL (and requiring EOP emergency depressurization) is 15 hrs.

Based on the above, an operator action of bypassing the RCIC turbine exhaust trip is judged necessary for justifying RCIC operation beyond 10 hrs. This operator action HEP has been evaluated to be 1.3E-3 based on the timing and SRO interviews.

The impact of RCIC operability beyond 10 hr is identified to be important in only two accident scenarios: (1) SBO with AACSBC, and (2) LOOP. The SBO sequence under the current plant configuration, is not affected since the RCIC operation is only credited up to 6 hrs based on the battery life.

In the SBO event tree with the AACSBC added to the current plant configuration, three sequences are impacted by adding the operator HEP. The sum of the CDF from the three sequences is 7.74E-7/yr (DG-1 out-of-service with risk management actions).

Applying the HEP would result in an increased CDF of 1.4E-8/yr, which is less than 0.1 % of the total CDF (1.45E-5/yr for DG-1 OOS with risk management actions). The impact to LERF was also evaluated and found to be negligible.

In the LOOP event tree, RCIC operability was assumed for 15 hrs in two sequences.

The sum of the CDF from these two sequences is 3.25E-11/yr. Applying the HEP would result in a negligible increase in CDF (i.e., below the truncation limit).

Based on the above evaluation, it is judged that the recirculation pump seal leakage (up to 36 gpm) would not significantly impact the risk measures (ICCDP, ICLERP) for the proposed DG CT.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 47 of 52 6.5. Level 2 Human Error Probability (HEP) NUREG/CR 6595 Sensitivity Results (LE-C2-1)

The CGS Level 2 uses primarily a 0.1 or 0.9 HEP for human errors. These probabilities do not explicitly link dependencies from the Level 1 sequences. As a sensitivity study, all HEPs in the Level 2 were set to 0.9, resulting in a LERF frequency of 1.4E-6/yr (an increase of 100%).

The effect of each event on the base case is shown below.

HUMAN ERROR BASELINE LERF IF SET CONIMENT HEP TO 0.9 Baseline LERF 6.86E-7 ADSHUMNSTARTH3LL* 0.1 1.26E-6 Increase of 5.31E-7 (74%)

HPLPHUMNSTART 0.1 6.86E-7 NO CHANGE HPSHUMNRESTART 0.1 6.88E-7 NO CHANGE LPSHUMNRESTORE* 0.1 9.38E-7 Increase of 2.52E-7 (35%)

SP-HUMN-RCSHNINJ 0.9 No Calc Base case HEP is already .9 SPHUMNSTART 0.1 No Calc Not in final cutsets for LERF SSWHUMNRESTORE 0.1 No Calc Not in final cutsets for LERF This shows the two most important events (*) that are sensitive to a change in human error are depressurize the RPV and restore injection flow to the RPV from low-pressure systems. The other HEPs when increased, did not significantly influence the risk metrics.

A 0.1 HEP value is a reasonable value for these events in the base case. These 2 events (depressurize and use low pressure systems) are normal actions, reinforced in operator training, which would be considered high priority actions.

The overall sensitivity impact to the ICLERP by using the bounding value of 0.9 for all the HEPs results in an increase from 1.46E-9 (base case of DG-1 out-of-service) to 2.8E-8, which is less than 5E-8. Therefore, it is judged that changes in HEP values currently modeled in the Level 2 calculations would not significantly impact the DG CT application.

6.6. Ex-Vessel Steam Explosion (Key Assumption, LE-B2-1, and LE-D1-1)

The PRA has modeled a probability of 0.7 for ex-vessel steam explosion and shell-debris interaction. The basis of this value was from pressure load estimation from Sandia National Lab small-scale test performed in 1991. A sensitivity evaluation has been performed using 1E-2 for the steam explosion and shell-debris interaction in the modeling of early containment failure. The baseline LERF was reduced from 6.86E-7/yr to 5.75E-7/yr. For the DG-1 out of service with the AACSBC and normal risk management

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 48 of 52 measures, the LERF is reduced from 7.24E-7/yr to 5.59E-7/yr. Therefore, the ICLERP impact is shown to be reduced.

Further sensitivity evaluation has been performed to provide insight in containment failure events and their relative importance. The CGS Level 2 analysis uses 5 different events for probabilities of containment failure due to energetic vessel failure. The most prominent of these events is steam explosion, but other types of energetic vessel failure can cause containment failure. As a sensitivity study, the value for each of the events was changed to 0.01 [in some cases, this meant the event failure probability decreased]. As a result the LERF decreased from 6.863E-7/yr to 5.947E-7/yr. The impact of each individual change against the base case is shown below.

EVENT USAGE IN PRA BASELINE l LERF IF SET PROBABILITY j TO.01 (Baseline LERF=6.86E-7/yr)

DCH Probability of containment failure upon vessel 1E-3 6.91E-7/yr failure due to direct containment heating.

H2- Probability that H2 combustion will occur and 5E-3 6.90E-7/yr COMBUSTION will lead to containment failure.

STMEXP-IN- In-vessel steam explosion generates missiles 1E-5 6.91E-7/yr VESSEL that fail containment. l STMEXP-OTHER Probability steam explosion will occur if 0.7 5.90E-7/yr water is in the pedestal region at the time of vessel failure.

STMEXP-PD- Probability a steam explosion will fail 0.7 5.90E-7/yr STRUCT containment if it occurs.

This result shows the CGS LERF is relatively insensitive to large changes in the assumed probability of steam explosions and other energetic modes of containment failure. That is because a primary portion (78%) of the baseline LERF does not result from these failure events. Based on the sensitivity evaluation and insight, it is judged that these F&Os and the Key Assumption do not produce a significant impact on the PRA.

6.7. HEP Sensitivity Results (HR-El, HR-E3, HR-E4, HR-G3, HR-G5, HR-G8, AS-B2-2/3)

Evaluation of the PRA using screening HEP values were performed to confirm the adequacy. Crew interviews were completed to support a revised HRA for those associated actions with sequences influencing the DG AOT risk change. These were performed subsequent to the PRA Peer Review to evaluate the F&Os related to human error.

Sensitivities to calculate the risk change, when new HEPs were inserted, were performed to show impact is small.

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 49 of 52 A comprehensive approach of HRA sensitivity evaluation has been performed using the following processes:

Conduct operator interviews for scenarios judged important to the DG CT application.

Review and revise all post-accident HEPs important to the DG CT application based on the interview results.

Develop HRA dependency factors for the post-accident HEPs.

Perform risk calculations using the revised HEPs and the developed HEP dependence values.

The minimum HEP that should be applied to combinations of HEPs has been established in the HRA dependency evaluation as follows:

Using 1E-6 for multiple dependent HEPs in the same cutest with HEPs occurring within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , and

Using 5E-7 for multiple dependent HEPs in the same cutset with HEPs occurring over 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The risk calculation results indicated that the ICCDP is increased from 2.76E-7 to 3.06E-7 for DG-1 14-day OOS (with risk management measures and AACSBC) condition. This represents a small increase (about 11%). The impact to the ICLERP is found to be negligible.

Based on the risk calculations, it is judged that the impact of the identified HRA issues associated with the post-accident modeling and HEPs does not alter the conclusion of the DG CT application analysis.

6.8. Component Sensitivity Results (DA-Bi-01)

The F&O questions the acceptability of combining all MOVs and all pumps into single component groups. The F&O suggests that motor driven pumps and MOVs should be subdivided into standby/running categories or non-safety/safety categories.

A sensitivity study was performed to investigate the impact of separating motor-driven pumps into running and standby. This categorization was preferred over non-safety and safety, because there is no generally acknowledged evidence that safety grade components have different reliability characteristics than non-safety grade components. This also allows the two continuously running non safety motor-driven pump related failures experienced at CGS to influence the safety related continuously running pumps.

A similar sensitivity study was not conducted for motor operated valves. Generic databases do not show a distinction between valves in running and standby systems. The failure

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 50 of 52 probability for MOVs is modeled as a time dependent function, depending only on the test interval. Required surveillance testing helps minimizes the failure probability between valves in standby and running systems.

The sensitivity study performed divided the pumps into running and standby and recalculated the failure rates of each, based on the collected plant specific data. The ACDF and ICCDP were recalculated based on the new estimated failure rates.

The data collection period extended for 5.625 years from January 1, 1997 through August 15, 2002. During this time, a 85% availability factor was estimated. The new exposure times were used in the Bayesian Update process.

In the Rev 5 base case, there are 2 failures recorded for pumps. Both failures occurred in the circulating water pumps. One failure was a fail to start and one failure was a fail to run. In the present sensitivity study, both failures are assigned to the pumps in running system category. There are no failures for standby pumps.

The random independent failure probabilities and the common-cause failure probabilities were changed and the global core damage equation was requantified.

The start-demands and run-times for each group were estimated. The failure experience over the last 5 years was assigned to the applicable group and the failure rates were calculated. The new failure rates were input into the main BED file and the CDF was recalculated.

The CDF of the base case was recalculated at 7.68E-6/yr, an increase of 5 % over the base case value of 7.33E-6/yr. The risk increase is principally due to the increase in CCF of the service water pumps and RHR pumps, due to the use of generic data for fail to run. The RG 1.177 risk parameters were recalculated for Cases 1.3.1 and 2.3.1 of Table 5-1. The changes are shown below.

Case ICCDPvvith Base Case CDF with Pump-Sensitivity ICCDP with Pump-Sensitivity l

Ias Data l Data l Data l Case 1.3.1 4.82E-7 2.05E-5/yr 4.91E-7 Case 2.3.1 5.14E-7 2.14E-5/yr 5.24E-7

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 51 of 52 Discussion of Results Alternate component grouping schemes for pumps can result in a small change in CDF.

The primary limitation of the CGS PRA is that there have only been two true pump failures in the last five years. The pumps were grouped in one large category for Rev 5 base case, because there are insufficient failures to discern if there is a difference between running pumps and standby pumps at CGS. The generic databases do not show a distinction between running pumps and standby pumps either. The candidate priors used for both the running and standby pumps in the sensitivity study were the same. Thus, assigning the pumps to two categories only subdivides the (already scarce) pump failures.

The results are inconclusive for several reasons:

Insufficient failures at CGS to discern a real difference between running and standby.

There are no studies, which show a real difference between running and standby pumps. Thus the prior for each group is the same.

Changing the failure rates for standby and running pumps shows a very small change in CDF.

7.0

SUMMARY

OF RESULTS The risk evaluation results in Table 7-1 are compared with the risk significance guidelines from RG 1.174 for the changes in the annual average CDF and LERF and from RG 1.177 for ICCDP and ICLERP from the internal events analysis. Also, presented below are the annual average CDF and LERF from fire initiators. Due to the differences in modeling detail and conservatism in the Fire PRA, the direct addition would provide more weight to risk from fire initiators than may be appropriate. However, there is sufficient margin in the results below to confidently support the risk decision to extend the DG CT to 14 days.

Table 7-1 Results of Risk Evaluation for the Extended DG CT Risk Metric Risk Significance Guideline J Risk Metric Results 3 ACDFAvGRA < l.OE-06/yr 3.09E-7/yr ICCDPaIA) <5.0E-07 2.76E-7 ICCDPrm) < 5.OE-07 2.92E-7 ALERFivGm < l.OE-07/yr 5.3 1E-9/yr CLERPRA, <5.OE-08 1.21E-9 ICLERPaA) <5.OE-08 7.67E-10 A CDFAvGREl < 1.OE-06/yr 9.42E-8/yr lICCDP/ FIRE) < 5.0E-07 3.45E-9 ICCDP(2FIRE <5.0E-07 1.70 E-7 ALERFAvG FRE < l.OE-07/yr 2.46E-9/yr ICLERPO,FIRE) < 5.OE-08 3.15E-10 FIICLERPaFIRE) <5.OE-08 3.30E-9

REQUEST FOR TECHNICAL SPECIFICATIONS AMENDMENT TO EXTEND THE ALLOWED COMPLETION TIME FOR EMERGENCY DIESEL GENERATORS Page 52 of 52

8.0 CONCLUSION

S The proposed extension of the DG-1 and DG-2 CT is acceptable based upon a risk-informed assessment. This risk-informed assessment concludes that the increase in plant risk is small and consistent with the US NRC "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement," Federal Register, Vol. 51 p 30028 (51 FR 30028), August 4, 1986, as further described by NRC RG 1.174 and RG 1.177. The proposed changes are consistent with the NRC policy and will continue to provide adequate protection of public health. The changes advance the objectives of the NRC's Probabilistic Risk Assessment Policy Statement, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p 42622, August 16, 1995 for enhanced decision-making and results in a more efficient use of resources and reduction of unnecessary burden.

Maintenance during power operation can improve overall DG availability and should result in reducing shutdown risk by increasing the availability of emergency power during refueling outages.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 98 Attachment 6 PRA QUALITY ASSESSMENT CONSISTENT WITH REGULATORY GUIDE (RG) 1.200, SECTION 4.2

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 2 of 98 Table of Contents Regulatory Guide 1.200 PRA Evaluation Results Section Page

1.0 INTRODUCTION

............................................. 3 1.1 Purpose ........................................... 3 1.2 Summary ........................................... 4 2.0 DG CT APPLICATION ........................................... 6 3.0 DOCUMENTATION OF THE CGS PRA . ........................................... 6 3.1 Level of Detail ........................................... 6 3.2 Key Assumptions ........................................... 12 4.0 MAINTENANCE OF THE PRA ............................................. 29 4.1 History of CGS PRA Models Maintenance ........................................... 29 4.2 Comprehensive Critical Reviews ..................... ...................... 35 4.3 Discussion of PRA Peer Review Facts and Observations ............. ............. 52 5.0 IDENTIFICATION OF PRA PARTS USED TO SUPPORT THE APPLICATION.. 94 6.0 PRA QUALITY

SUMMARY

............................................. 97

7.0 REFERENCES

........................................... 98

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 3 of 98

1.0 INTRODUCTION

A description of the Columbia Generating Station (CGS) probabilistic risk assessment (PRA) technical adequacy to support the diesel generator (DG) allowed completion time (CT) extension is provided in this assessment.

1.1 Purpose The technical adequacy of the PRA for the application is based on Capability Category II of the American Society of Mechanical Engineers (ASME) PRA Standard (Reference 1) for all Supporting Requirements as sufficient to meet adequacy requirements for most risk-informed applications including risk-informed CT applications. In cases where a peer review has identified supporting requirements as less than Capability Category II, then technical adequacy for the application is deemed sufficient when the peer review "facts &

observations," that are the basis of the reduced capability category determination, can be shown to have little or no impact on the calculated results and the decision-making relative to the application. The impact assessment is addressed by one or more of the following techniques: 1) model change, 2) sensitivity calculations, or 3) bounding risk-informed arguments.

The technical adequacy of the CGS PRA model used as the basis for risk-informed applications is consistent with the guidelines of Regulatory Guide (RG) 1.200 (Reference 4)

Section 4.2 (December 2003):

Treatment of permanent plant changes that affect the PRA but are not yet incorporated into the PRA model (see Sections 1.2.1 and 4.1)

Documentation of the consistency with the PRA Standard (see Sections 1.2.2 and 4.2)

Identification of key assumptions and the peer review of these assumptions (see Sections 1.2.3 and 3.2)

A discussion of the resolution of the PRA Peer Review comments (see Sections 1.2.4 and 4.3)

RG 1.200 was formally available in March 2004 for use in assessing the PRA quality. The peer review was completed prior to the availability of the RG. A review of the published RG was performed to determine if the changes created a significant impact that would change the overall conclusions for the application. The results of this qualitative review did not find any changes significant enough to change the conclusions of the DG CT evaluation. Where possible, additional information requested in the RG was produced and added to the evaluation presented in Attachment 5 but was not reviewed by the RG 1.200 Peer Review Team.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 4 of 98 In addition to the RG 1.200 Section 4.2 submittal guidelines, the Cause and Effect Relationships of portions of the PRA influencing the application assessment are provided in Section 5.

1.2 Summary 1.2.1 Maintenance of the PRA: Changes Since the Last PRA Update The Columbia PSA model has been maintained to reflect plant as-built and as-operated conditions to the extent required to support this submittal. The PSA model has undergone five revisions since the original IPE model developed for GL 88-20. A major update was performed for modeling improvement prior to the 1997 BWROG Certification Peer Review. The current revision (Revision 5) was performed to include the changes that enhance the model realism to support the submittal.

During the PSA updating process, as described in PSA Quality Configuration and Control Guidelines PSA-QA-001, plant modifications and procedure changes that could have an impact on the PSA model, data, or documentation were reviewed for incorporation into the PSA. This includes areas of potential PSA impact identified by peer review team F&Os.

Changes in operating procedures describing operator actions that are modeled in the PSA were reviewed for incorporation into the PSA. An exception is the recent EOP and SAG changes resulting from implementation of Revision 2 of generic BWROG EPG/SAG guidance, which are not included in this update. See HR-E1-3 for disposition.

Plant design changes that could affect the mitigating functions of the systems modeled in the PSA were reviewed for incorporation into the PSA. An exception is the thermal analyses (MAAP) to reflect the uprated reactor power operating condition. The PSA includes the SBO scenario but not other accident scenarios in this update. See F&O SC-Cl-1 for disposition.

Plant specific equipment failure data (June 2002) was retrieved from the Problem Evaluation Request (PER) database. System/component unavailabilities were derived from the Maintenance Rule Database. The CCFs were recalculated based on the revised failure rates.

Changes to equipment test intervals associated with implementing the Preventive Maintenance Optimization program are not included in this update. These changes were not associated with TS Surveillance intervals.

The exceptions discussed above are recently implemented plant changes, which do not adversely affect the results of the risk assessment of this submittal.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 5 of 98 The final exception is the proposed plant addition of an alternate AC source, which is treated as part of the implementation of the model to represent the extended DG CT along with associated crew actions.

1.2.2 Documentation of Consistency with the PRA Standard The level of detail included in the CGS PRA is compared to the ASME PRA Standard as supplemented by RG 1.200. The key PRA elements are discussed in Section 3.1.

Then, each of the key PRA elements is discussed relative to the Standard in Section 4.2.

Section 4.3.1 summarizes the parts of the PRA that conform to the less detailed .

capability categories, and the limitations these impose (See Sections 3.1, 4.2, and 4.3).

1.2.3 Key Assumptions A list of the key assumptions and approximations relevant to the results used in the DG CT application decision-making process provides information that the NRC staff may find useful to support the assessment of whether the use of these assumptions and approximations is either appropriate for the application, or whether sensitivity studies performed to support the decision are appropriate. (See Section 3.2) 1.2.4 Resolution of Peer Review Comments The PRA Peer Review assessment of supporting requirements and associated comments are evaluated as they may influence the DG CT extension in Sections 4.2 and 4.3. The peer review identified a small percentage of supporting requirements (SR) that are less than ASME Capability Category II. The effect of these supporting Requirements and the associated A or B F&Os on DG CT application decision-making are either evaluated or the resolution approach is identified through 1) model changes, 2) sensitivity calculations, or 3) qualitative discussions.

A discussion of the resolution of the importance level A and B peer review comments that are applicable to the parts of the PRA required for the application (DG CT extension) is provided in Tables 6-8 and 6-10.

The summary of all Supporting Requirements from the ASME standard and RG 1.200 and the adequacy of the PRA to support the application are provided in Tables 6-11 through 6-19.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 6 of 98 1.2.5 Cause and Effect Relationship The use of the parts of the PRA that conform to the less detailed capability categories and the limitations this imposes on the application are identified.

The Section 5 discussion of Cause and Effect relationships tie together the specific PRA elements that are modified in the proposed DG CT application with the effect of the PRA quality assessment.

Section 4 provides the quality effects and Section 5 provides those parts of the PRA model that are causal influences affecting the risk metrics used in the assessment.

2.0 DG CT APPLICATION The specific PRA application for which this PRA quality assessment is being developed is the extension of the Division 1 and Division 2 DG CT from the currently specified 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days.

The Division 3 DG currently has a Technical Specification (TS) format that allows an extended inoperability for up to 17 days.

The primary risk contributors affecting the risk metrics associated with this application involve accident sequences initiated by, or occurring coincident with, a loss of offsite power.

The DG CT extension is being requested in parallel with a plant modification to add an alternate AC source to the battery chargers (AACSBC) capable of supporting the batteries to supply the necessary DC loads during a station blackout (SBO).

3.0 DOCUMENTATION OF THE CGS PRA Two principal aspects of the technical adequacy of the PRA discussed in this section are level of detail and key assumptions.

3.1 Level of Detail The CGS PRA model is highly detailed, which includes a wide variety of initiating events, modeled systems, operator actions, and common-cause events. The PRA model quantification process used for the CGS PRA is based on the linked fault tree methodology, which is a standard methodology in the industry. The model quantification is performed using the WinNUPRA software.

A brief summary of the model level of detail is presented in the following subsections.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 7 of 98 Section 4.2 provides a summary of the PRA Peer Review of each of these PRA elements relative to the ASME PRA Standard and RG 1.200. Specifically, Section 4.2 provides the PRA Peer Review Team's assessment of compliance of the CGS PRA with the ASME PRA Standard and the expected level of detail.

The subsection provides a brief overview of the CGS PRA model and its level of detail.

3.1.1 Initiating Events The CGS at-power PRA explicitly models a large number of internal initiating events:

General transients

Loss of coolant accidents (LOCAs)

Support system failures

Internal flooding events The initiating events explicitly modeled in the CGS at-power PRA are summarized in Table 6-1. The peer review team indicated the number of internal initiating events modeled in the CGS at-power PRA is similar to the majority of U.S. BWR PRAs currently in use.

3.1.2 Accident Sequence Analysis The accident sequence analysis is a comprehensive set of event trees that are tailored to the specific initiating event. The systems analyses are inputs to the quantification of the individual nodes of the event trees. Accident Sequences are developed for each of the key groups of initiators identified. The end states include distinctions in accident end state types that lead to core damage.

3.1.3 Success Criteria Various thermal hydraulic analyses are used to support the success criteria in the event sequences. Both plant specific MAAP calculations and generic BWR calculations are used to support the success criteria and are detailed in the PRA documentation. These success criteria results are compared with other BWRs for reasonableness.

Detailed room cooling and battery depletion calculations are available to support the system success criteria determinations.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 8 of 98 Table 6-1 CGS INITIATING EVENT FREQUENCIES

.i n E Iitiatig Event Evento Designator Frequency Events/Year 1 General Transients Turbine Trip IT 1.13 Main Steam Isolation Valve (MSIV) Closure TM 3.00E-02 Loss of Condenser TC 0.11 Loss of Feedwater TF 9.70E-02 Loss of Offsite Power TE 3.61E-02 IORV/SORV TI 4.70E-02 Manual Shutdown MS 1.25 2 LOCA Reactor Pressure Vessel (RPV) Rupture RPVR 3.00E-07 Large LOCA A 3.00E-05 Medium LOCA Si 4.00E-05 Small LOCA S2 5.00E-04 Steam Line Break Outside AO 2.08E-04 Containment Interfacing System LOCA (ISLOCA) ISLOCA 2.26E-03 3 Anticipated Transient Without SCRAM (ATVS)'

ATWS following Turbine Trip with Bypass TTC 0.93 (100% power)

ATWVS following Turbine Trip with Bypass TTC2 0.20 (25% power)

ATWS following MSIV Closure TMC 3.00E-02 ATWS following Loss of Condenser TCC 0.11 ATWS following Loss of Feedwater TFC 9.70E-02 ATWS following SORV TIC"S 4.70E-02 4 Special Initiators Loss of a Division of DC

-Division 1 TDCI 3.50E-04

-Division 2 TDC2 3.50E-04

' The ATWS event trees use these transient frequencies as initiating events and are followed in the trees by events for failures of the mechanical and electrical portions of RPS.

OA combined IE-TIC is used in the Event Tree.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 9 of 98 Table 6-1 (Continued)

CGS INITIATING EVENT FREQUENCIES IEvent Frequency Event Dnitiating D Events/Year Loss of plant service water (TSW) TTSW 1.98E-03 Loss of CIA (Includes Loss of CN) TIA 1.25E-03 Loss of an AC Bus

-SM-1 (Ni-i) TSMI 6.86E-03

-SM-2 (N1-2) TSM2 6.86E-03

-SM-3 (NI-3) TSM3 6.86E-03

-SH-5 (N2-5) TSH5 6.86E-03

-SH-6 (N2-6) TSH6 6.86E-03 Loss of HVAC

-Control Room CRHVAC 1.93E-04

-Switchgear Rooms (Div 1 or 2) SGHVAC 4.19E-06 Instrument Line Break SR L.OOE-02 Loss of control and service air (CAS) TCAS 1.70E-02 Internal Flooding (Category 1) FLDR1 3.36E-05 Internal Flooding (Category 2) FLDR2 3.36E-05 Internal Flooding (Category 3) FLDR3 2.94E-04 Internal Flooding (Category 4) FLDR4 3.20E-06 Internal Flooding (Category 5) FLDR5 6.00E-07 Internal Flooding (Category 6) FLDR6 9.60E-06 Internal Flooding (Category 7) FLDR7 1.56E-05 Internal Flooding (Category 8) FLDR8 2.72E-05 Internal Flooding (Category 9) FLDR9 1.95E-07 Internal Flooding (Category 10) FLDTI 5.26E-03 Internal Flooding (Category I1) IE-FLI 9.1i7E-06 Internal Flooding (Category 12) IE-FL2 1.16E-04

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 10 of 98 3.1.4 System Models The CGS at-power PRA explicitly models a large number of frontline and support systems that are credited in the accident sequence analyses. The CGS systems explicitly modeled in the CGS at-power PRA are summarized in Table 6-5. The peer review team found the number and level of detail of plant systems modeled in the CGS at-power PRA is equal to or greater than the majority of U.S. BWR PRAs currently in use. Where other PRAs may not develop logics for such systems as instrument air, main steam and condenser, and fire protection, the CGS PRA specifically models these with fault tree logics.

3.1.5 Operator Actions The CGS at-power PRA explicitly models a large number of operator actions, including:

Pre-Initiator actions

Post-Initiator actions

Recovery actions Explicit evaluation of dependent human actions is included in the analysis.

Approximately one hundred and thirty one (131) operator actions (approximately 37 pre-initiators, approximately 89 post-initiators, approximately 5 recovery actions) are explicitly modeled. These operator actions are detailed in the PRA documentation.

The human error probabilities for the actions are modeled with accepted industry HRA techniques (e.g., Accident Sequence Evaluation Program (ASEP)) and include input based on discussion with plant operators, trainers, and other cognizant personnel.

With regard to dependent actions, the human reliability analysis of the CGS PRA explicitly considers:

The dependency of effects of individual modeled operator actions (i.e., relevant timing among actions and similar cues)

Development of dependent operator actions that replace various combinations of independent human actions appearing in the quantification results where deemed appropriate The number of operator actions modeled in the CGS at-power PRA, and the level of detail of the HRA, is sufficient to characterize the risk significant accident sequences.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 11 of 98 3.1.6 Data The data (component reliability data and selected initiating event data) have been Bayesian updated to incorporate the most recent CGS operating experiences of critical components into the PRA model.

3.1.7 Common-Cause Events The CGS at-power PRA explicitly models a large number of component common-cause failures (CCFs). The components explicitly modeled in the CGS at-power PRA with CCFs are summarized in Table 6-2. Over one hundred and forty common-cause terms are explicitly included in the CGS PRA. CCF terms modeled in the CGS internal events PRA are detailed in the PRA documentation. The peer review team found the number and level of detail of common-cause component failures modeled in the CGS PRA is equal to or greater than the majority of U.S. BWR PRAs currently in use. The data provided from the INEL-94/0064 common-cause database (Reference 7)is used in the CGS PRA Revision 5.

3.1.8 Internal Flooding The internal flooding evaluation has been performed using a plant specific computer code that models the propagation of floods and their flood rates. This intricate code provides a detailed modeling approach to the determination of flood zones affected by the flood sources and flood propagation. The analysis resulted in ten significant flood initiators that contributed to the calculated core damage frequency (CDF).

3.1.9 Quantification The PRA quantification is performed using WinNUPRA software and is performed consistent with that standard software package. The model is quantified for the appropriate end states of core damage. A truncation study demonstrates convergence of the model risk metric of CDF. The truncation values used in the Level 1 and Level 2 PRA are 5E-12 and IE-13 respectively. The top sequence contributors and cutsets are detailed in the PRA documentation.

The importance measures for the model basic events are along with the contribution to total CDF by initiator and accident class are identified in the PRA documentation.

3.1.10 Large Early Release Frequency (LERF)

A LERF model was developed based on NUREG/CR-6595 (Reference 8) and provides the necessary information to support the inputs to risk-informed decision-making.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 12 of 98 3.1.11 Documentation The documentation of the PRA includes the supporting documentation shown in Table 6-5.

Table 6-2 COMPONENTS RECEIVING COMMON-CAUSE TREATMENT IN CGS PRA WITHIN SYSTEMS Diesel generators (failure to start and run)

Pumps (failure to start and run)

Motor operated valves (failure to open or close on demand)

Circuit breakers (failure to open or close on demand)

Batteries Battery chargers Air operated valves (failure to open or close on demand)

Safety/relief valves (failure to open or close on demand)

Check valves (failure to open on demand, failure to remain closed)

Instrument and control components (failure to send signal or actuate equipment)

Explosive valves (failure to open)

Fans (failure to start and run)

Compressors (failure to start and run)

Strainers/filters 3.2 Key Assumption Consistent with the ASME PRA Standard, RG 1.200, and RG 1.174, key assumptions are identified in this evaluation to ensure they are treated in the decision-making process.

Section 4.2 of RG 1.200 specifies that the following be provided:

a) Identification of the key assumptions relevant to the results used in the decision-making process.

b) The peer reviewers' assessment of those assumptions.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 13 of 98 3.2.1 Definition of Key Assumption The definitions from RG 1.200 Section 4.2 are used to clarify the nature of the "key assumptions."

key assumption: an assumption made in response to a key source of uncertainty key source of uncertainty: a source of uncertainty that is related to an issue where there is no consensus approach or model (e.g., choice of data source, success criteria, RCP seal LOCA model, and human reliability model) and where the choice of approach or model is known to have an impact on the determination of PRA results in terms of introducing new accident sequences, changing the relative significance of sequences, or affecting the overall CDF or LERF estimates that might have an impact on the use of the PRA in decision-making.

Section 2.2.5.5 of RG 1.174 (Rev 1) states:

While the analysis of parametric uncertainty is fairly mature, and is addressed adequately through the use of mean values, the analysis of the model and completeness uncertainties cannot be handled in such a formal manner. Whether the PRA is full scope or only partial scope, and whether it is only the change in metrics or both the change and baseline values that need to be estimated, it will be incumbent on the licensee to demonstrate that the choice of reasonable alternative hypotheses, adjustment factors, or modeling approximations or methods to those adopted in the PRA model would not significantly change the assessment. This demonstration can take the form of well formulated sensitivity studies or qualitative arguments. In this context, "reasonable" is interpreted as implying some precedent for the alternative, such as use by other analysts, and also that there is a physically reasonable basis for the alternative. It is not the intent that the search for alternatives should be exhaustive and arbitrary. For the decisions that involve only assessing the change in metrics, the number of model uncertainty issues to be addressed will be smaller than for the case of the baseline values, when only a portion of the model is affected. The alternatives that would drive the result toward an unacceptable level should be identified and sensitivity studies performed or reasons given as to why they are not appropriate for the current application or for the particular plant. In general, the results of the sensitivity studies should confirm that the guidelines are still met even under the alternative assumptions (i.e., change generally remains in appropriate region). Alternatively, this analysis can be used to identify candidates for compensatory actions or increased monitoring. The licensee should pay particular attention to those assumptions that impact the parts of the model being exercised by the change.

Based on these definitions, the list of areas of uncertainty in the PRA is compiled along with their dispositions.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 14 of 98 3.2.2 Development of Key Assumption List The definitions of key assumptions and key sources of uncertainty are provided above in Section 3.2.1 based on RG 1.200. Using these definitions, a review of the PRA elements is performed to identify those areas related to each element that meets these definitions.

The method presented here is a qualitative approach and is derived from the definition of key sources of uncertainty in Section 4.2 of RG 1.200. Figure 6-1 provides a simplified flow chart of the approach, which is summarized as follows:

1) Identify the uncertainties that may influence the PRA and the PRA application.

This identification of uncertainty contributors makes use of information provided in past uncertainty evaluations, past PRAs (such as NUREG-1 150), and insights from the ASME PRA Standard and RG 1.200. The evaluation of the uncertainties is performed on a PRA element basis. The compilation is based upon judgment.

Table 6-3 provides the identification of these uncertainties in the first column of the table. Table 6-3 also cites the basis or nature of the uncertainty including the categories of uncertainty that are attendant to each of the sources of uncertainty, for example:

(a) Uncertainty related to a lack of knowledge or realism. This may be conservative assumptions that are imposed or best judgments made due to lack of precise knowledge.

(b) Uncertainty related to plant specific features that are not fully captured in the PRA model.

(c) Uncertainty due to the level of detail that is captured in the PRA model.

2) Using this list, the process examines each uncertainty to identify those uncertainties that meet the definition of key sources of uncertainty. The process is to screen out those uncertainties that do not meet the definition of key uncertainties. The screening process is based upon two criteria:

The negligible impact of the uncertainty on the application OR

The use of a consensus approach to address the area of uncertainty Table 6-3 uses these two criteria then to disposition the uncertainty contributors to ascertain the key sources of uncertainty as they impact the decision-making for the

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 15 of 98 PRA application. If either criterion is satisfied, the RG 1.200 definition would screen the uncertainty as not a key source of uncertainty. The decision matrix below shows the combinations of possible results:

Consensus Model or l Impact on l Key Source Approach Appl. Is Negligible of Uncertainty Yes Yes No Yes No No No Yes No No No I Yes

3) The evaluation of the impact of the uncertainty on the specific application is based upon one of the following:

a) The uncertainty does not influence the evaluation of the accident sequences that determine the changes in the risk metrics (delta risk) used to compare with acceptance guidelines.

b) A sensitivity evaluation has been performed to establish that potential changes associated with the uncertainty range do not significantly impact the risk metrics used to compare with acceptance guidelines.

c) The uncertainty impact is judged to have a negligible impact on the risk metrics used to compare with acceptance guidelines.

4) The screening process is continued using qualitative engineering judgment regarding the availability of a consensus model or approach based on a comparison with typical methods and processes used in BWR PRAs and NUREG-1 150. If there is a consensus model or approach used then the contributor is not a "key source of uncertainty." The evaluation is based upon judgment because no list of consensus approaches for the different identified areas of uncertainty is currently available.

5) Once the key uncertainties are identified then the associated key assumption is identified to reflect how it is implemented in the PRA model.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 16 of 98 3.2.3 Key Source of Uncertainty Using the RG 1.200 definitions and Table 6-3, the following key sources of uncertainty are identified:

Unusual alignments

Grid instability

Recirc pump seal leakage model

All containment alignments

Ex-vessel steam explosions Figure 6-1 Process for Identification of Key Uncertainties Identify List of Potential Uncertainties Is Potential Area of Yes Screen out Uncertainty a Negligible of further consideration Impact on Application as a key uncertainty t NO Is Potential Area of Uncertainty Based on a Yes Screen out Consensus Model or of further consideration Approach as a key uncertainty No Identify as a Key Source of Uncertainty and Perform Necessary Sensitivities

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 17 of 98 3.2.4 Key Assumption List The key assumptions then reflect these key sources of uncertainty as follows:

Key Source of Uncertainty "Key Assumption" Unusual Alignments The Columbia Generating Station (CGS) configuration control management (imposed by on-line program evaluates the on-line plant configuration to ensure that no undue risk is maintenance, testing, introduced. The PRA relies on this process to ensure that a configuration is not or emergent work) entered that would compromise the validity of the PRA results.

(Section 6. 1, SY-A5-1/2)

Grid Stability The grid stability to CGS is high and the grid unavailability remains low.

(Table 5-7, Agreements with Bonneville Power Administration (BPA) provide periodic AS-A2-1) confirmation that these remain as evaluated. Energy Northwest has determined the generic values of conditional LOOP given a transient or LOCA do not apply to CGS. The conditional loss of offsite AC power given a LOCA or transient is explicitly modeled using fault tree techniques Recirc Pump Seal The CGS PRA does not currently include the recirculation pump seal leakage in Leakage the base model calculations (probabilistic or deterministic).

The recirculation pump seal leakage during an SBO has been modeled in MAAP (Section 6.4, sensitivity cases for a variety of assumed leak rates and it has been determined AS-A5-2) to have no impact on the accident sequence progression as modeled in the CGS PRA.

All Containment During the process of a core melt progression the containment parameters may Alignments significantly change in terms of water inventory and oxygen concentration. (No F&Os; Peer Review Team considered model acceptable as is.) The initial control of water inventory, oxygen concentrations, plus Emergency Operating Procedure (EOP) directions during accidents are sufficient to minimize the change in the containment parameters during a process of core melt such that their impact on the failure location or failure size remains as modeled in the PRA.

Ex-Vessel Steam The PRA model uses a potentially conservative estimate of the probability of Explosion containment failure due to ex-vessel steam explosion and shell-debris interaction failures. This results in a conservative estimate of the LERF risk metric. For (Table 5-7, specific applications, the change in LERF or ICLERP may be suppressed LE-D1-1, LE-B2-1) because of the conservative assumption regarding the early containment failure mechanisms. A sensitivity case to demonstrate the ICLERP for smaller values of the probability of ex-vessel steam explosion and shell-debris interaction failures is one way to demonstrate the impact of this key source of uncertainty.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 18 of 98 Table 6-3 POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** - Appl. is Negl. Approach of Uncert.

Initiator Uncertainty Effect

New initiators (not observed or (1), (2) Yes No dismissed)

Design or Construction Flaws (1), (2) (4) (4) (4)

System interactions (3) U Yes No

Unusual alignments imposed by on-line (2), (3) U No Yes maintenance, testing, or emergent work create aggravated initiating event

Grid instability (1), (2) No No Yes

Ultimate heat sink failure modes (1), (2) Yes No

- Initial failures

- Recovery actions

- Preventive actions

Frequencies (Including Aging) (2) No (5) Yes (5) No (5)

Restoration of loss of air initiators (1), (2) Yes No

Applicability of past performance to (1) U Yes No future operation

Applicability of generic data (2) U Yes No

Unusual susceptibility to LOCA (2) No Yes No

- Corrosion

- Poor weld repair

- Poor inspection techniques

- Hidden flaws

Unusual susceptibility to LOCA (1), (2) (5) (5) (5)

- Aging

.11 L ______________ U

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 19 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** Appl. is Negi. Approach of Uncert.

Flooding / Flood response (2), (3) Yes No

Impact of RPV breach blowdown on (1), (2) Yes No

- ECCS functionality

- Scram function Accident Sequence Uncertainty Effect

Initial power level (2) Yes No

Feedwater level control (2), (3) Yes No

Control Rod Drive (CRD) adequacy (2) Yes No for level control

Set point drift (1), (2), (3) U Yes No

Reactor Core Isolation Cooling (RCIC) (1), (2) Yes No capability at low RPV pressure

High Pressure Core Spray (HPCS) or (2), (3) No Yes No RCIC operation on min flow discharges condensate storage tank (CST) volume (Discharge of CST to suppression pool through min. flow valve)

Use of pressure control mode of RCIC (2), (3) Yes No

"Bang-Bang" logic impact (2), (3) No Yes No

Spurious trip on high steam flow (1), (2) No Yes No

Water hammer in discharge line (1), (2), (3) Yes No

RPV overfill (induced LOCA or (1), (2) Yes No induced failures)

Room cooling loss cause high temp (2) Yes No isolation

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 20 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** Appl. is Negl. Approach l of Uncert.

Accident Sequence Uncertainty Effect (cont'd)

Steam tunnel temperature causes high (2), (3) Yes No temp isolation

Adequacy of manual actions (1), (2), (3) No Yes No

Pressure control with SRVs (training (2), (3) Yes No issue)

Operation of RHR in suppression pool (1), (2) Yes No cooling given high DW pressure or low level

Treatment of operator action for (1) Yes No suppression pool cooling

Repair (1), (2), (3) No Yes No

Containment failure modes (leak vs. (1), (2), (3) No Yes No rupture)

Impact on plant RPV injection systems (1), (2), (3) No Yes No given failure mode or failure location

Steam binding effect (1), (2), (3) No Yes No

Environmental impacts (1), (2), (3) No Yes No

Alternate injection system capability (2) Yes No (discharge head)

Alternate injection system alignment (1), (2) No Yes No success probability

ATWS Level 1 power control (1) Yes No

MSIV isolation bypass (2) Yes No

Power response to level reduction (1) Yes No (ATNVS)

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 21 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** Appl. is Negl. Approach l of Uncert.

Accident Sequence Uncertainty Effect (cont'd)

Boron mixing (1), (2) Yes No

Number of control rods inserted (1) Yes No (ATWVS)

Treatment of low pressure systems for (1), (2) Yes No RPV injection under ATWS conditions

Ability to maintain or restore RHR to (2) Yes No suppression pool cooling

Loss of service water (SW) impact on (1), (2), (3) Yes No BOP (immediate or significantly delayed)

Run failures assumed to occur at t = 0 (1) No Yes No

Recirc pump seal leakage model (1) No No Yes

Recirc pump seal leakage impact on (1), (2) U Yes No DW temp

Code capability to model DW temp (1), (2), (3) U Yes No

Operation of pumps w/o min. flow line (1), (2), (3) No Yes No operation (deadhead pump operation)

Operation of pumps w/o SW cooling (1), (2) No Yes No Success Criteria Uncertainty Effect

Computer Code Capability (1), (2), (3) No Yes No

Computer code capability to model (1), (2) Yes -- No BOP response given different initiators

Fuel parameters impact on calculated (1), (2), (3) Yes -- No response

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 22 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Su maryImpact****

Consensus l Basis for Impact on Model or Key Source Element Issue Uncertainty** Appl. is Negl. Approach of Uncert.

Success Criteria Uncertainty Effect (cont'd)

Time in life modeled (1), (2), (3) Yes No (BOC, EOC, etc.)

Axial power shape (1), (2), (3) Yes No

Core constituents (1), (2), (3) Yes No

Core nodalization (1), (2), (3) Yes No

Definition of core damage (1) Yes -- No

Design or construction flaw (1), (2) (4) (4) (4)

Recovery Uncertainty Effect

No repair (1), (3) No Yes No

AC Recovery (2) Yes No

- No lights

- No room cooling

- No switchyard DC or air

Access (2) Yes No

Personnel availability (maintenance, (2) No Yes No I&C, electrical, etc.)

System Uncertainty Effect

No partial failures included (1), (3) No Yes No

No degraded performance credited (1), (3) No Yes No

Operation outside EQ envelope (1), (3) No Yes No

Rectification (2) No Yes No

Alignments (special) (1), (2), (3) No No Yes

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 23 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Sum aryImpact***

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** Appl. is Negl. Approach of Uncert.

System Uncertainty Effect (Cont'd)

All failure modes (1), (2), (3) No Yes No

Unique components (data) (1), (2), (3) No Yes No

RPS reliability (1), (2), (3) Yes No

FW trip given ATWS (1), (2) Yes No

CST refill capability (1), (2) No Yes No

Cross-tie to opposite unit N/A N/A N/A N/A

- CRD

- RHR

- AC power

- Emergency AC power

Alternative offsite resources (1), (2) No Yes No

- Water

- Generator

Non-proceduralized actions (1), (2) No Yes No

Vent impacts (1) No Yes No

FPS or SW cross-tie credit (1) No Yes No

Battery life (1), (2), (3) No Yes No

Need for battery to supplement charger (1), (2) Yes No

Spare batteries N/A N/A N/A N/A

Spare chargers*** N/A*** No Yes No

Charger restoration (1) No Yes No

Manual breaker operation (1) No Yes No AL AL AL

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 24 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

l Consensus Basis for Impact on Model or IKey Source Element Issue Uncertainty** App. is Negl. l Approach of Uncert.

System Uncertainty Effect (Cont'd)

Local manipulation of valves (1), (2), (3) No Yes No

Use of single DG to shut down 2 plants N/A N/A N/AN/A Data Uncertainty Effect

Applicability of past plant data to (1) No Yes No future operation

Applicability of "generic prior" to (1), (2) No Yes No plant

Maintenance changes (1), (2) No Yes No

- Personnel

- Training

- Philosophy

- Working conditions

- Union conflicts

Increase or decrease in on-line (1), (2) No Yes No maintenance

Unique environmental issue (1), (2) No Yes No (cleanliness, clams, Zebra mussels, corrosion)

Failure of weld repairs causing not (1), (2), (3) Yes No "good as new" conditions

Assumption of "good as new" (1) No Yes No following refuel, repair, or surveillance

Common-cause model (1), (2) No Yes No

- Applicability of model

- Sufficient data

- Applicability of generic data

Rectification (2) No Yes No

Rectification (2) No Yes No

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 25 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** Appl. is Negl. __Approach of Uncert.

HRA Modeling Uncertainties

Nominal crew (1) No Yes No

Experienced (1) No Yes No

No new personnel (1) No Yes No

W~ell trained (1) No Yes No

Good working relationships (1) No Yes No

No errors of commission (1) No Yes No

No fitness for duty personnel problems (1) No Yes No on the crew

Interface with TSC treated superficially (1) No Yes No

Management interference not addressed (1) No Yes No

Organizational influences on HRA not (1) No Yes No included

Time of day not addressed (1) No Yes No

Minimum vs. maximum crew not (1) No Yes No addressed

Quantification Basis (1), (2) No Yes No Instrumentation

Crew has indication of critical plant (1), (2) No Yes No variables except in very limited sequences where this is explicitly accounted for

False indications are not present (1) No Yes No

Unique plant readout features that may (3) No Yes No adversely impact crew are not included

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 26 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** Appi. is Negi. Approach of Uncert.

Instrumentation (Cont'd)

SPDS not credited (1), (2) Yes No Structural Uncertainty Impacts

Containment analysis (1), (2) No Yes No

- Failure modes as function of challenge

-- Quasi static

-- Hydrodynamic

-- Dynamic

-- Temperature and pressure

Include all alignments and containment (1), (3) No No Yes configurations:

-- Flooded

-- Deinerted

-- Loss of pool

- Failure location variation

- Failure size variation

Low pressure pipe capability to survive (3) Yes No high RPV pressure

RPV structural capability (pressure and (1), (2), (3) No Yes No temperature)

- Bottom head

- Bottom head penetrations

Modeling of core melt progression and (1), (2) No Yes No impact on structural analysis

Flood barrier structural capability N/A N/A N/A N/A

Aging (1), (2) (5) (5) (5)

Design or Construction Flaws (1), (2) (4) (4) (4)

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 27 of 98 Table 6-3 (Continued)

POTENTIAL SOURCES OF UNCERTAINTY* AFFECTING DG CT APPLICATION Summary Impact****

Consensus Basis for Impact on Model or Key Source Element Issue Uncertainty** l Appl. is Negl. Approach of Uncert.

Level 2 Core Melt Progression and Fission Product Retention

RPV Temperatures (1), (2) No Yes No

RPV Coolability (1), (2) No Yes No

RPV Failure modes (1) No Yes No

Dynamic RPV Interactions (1), (2) No Yes No

Debris Available for discharge (1), (2) No Yes No

RPV pressure at debris discharge (1), (3) No Yes No

Timing of fission product evolution (1) No Yes No

Scrubbing or deposition of fission (1) No Yes No products

Timing of RPV breach (1), (2) No Yes No

Ability to terminate core melt (1) No Yes No progression in-vessel Core-Concrete interaction (1), (2) No Yes No Vertical Horizontal Degree of pool bypass (1), (2) No Yes No Ex-vessel steam explosion (1), (2) No Yes Yes Direct containment heating (1), (2) No Yes No DW shell failure due to debris interaction (1), (2) No Yes No Containment flooding (1), (2) No Yes No DW vent - (1), (2) No Yes No RB fission product retention (1), (2) No Yes No

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 28 of 98 Table 6-3 Legend U = Unknown impact on the decision making for the DG CT Application.

Endnotes

These potential sources of uncertainty are listed to indicate those PRA items that may influence the uncertainty distribution on risk metrics and may be used to assist in identifying a more limited set of "key uncertainties" consistent with RG 1.200, i.e., no consensus on the approach or model or negligible impact on decision-making for this application.

- The basis for the uncertainty reflects the general types of uncertainty that are most significant for each issue. The nomenclature for this column is as follows:

(1) Degree of Realism or Lack of Knowledge (2) Plant Specificity (3) Level of Detail

- - CGS has implemented spare chargers in the plant and they are modeled in the PRA.

- - - Two Endnotes are used in the "Summary Impact" columns. These are:

(4) Design or construction flaws are controlled by testing and inspection programs that are oriented to uncover these "flaws" before they impact safety.

(5) The effects of plant aging are controlled by testing, inspection and preventative maintenance programs that are oriented to uncover adverse impacts of plant age related phenomena.

3.2.5 Peer Reviewers' Assessment of Key Assumptions The peer review team reviewed the PRA, Revision 5. The modeling assumptions were generally well defined and captured within the base model PRA documentation. The PRA peer review team reviewed the assumptions embodied in the PRA documentation, but did not explicitly review a separate listing of assumptions. The peer review team's comments clearly indicate their review of the assumptions used in the model and documented within the PRA documentation. The majority of the Key assumptions derived from the above methodology were also identified by peer review team as evidenced in F&Os.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 29 of 98 4.0 MAINTENANCE OF THE PRA The maintenance of the PRA is discussed in the following areas:

The Energy Northwest efforts to maintain the PRA representative of the as-built, as-operated plant (Section 4.1)

The comprehensive and critical reviews of the PRA to identify areas of potential enhancement (Section 4.2)

Discussion of PRA Peer Review Results (Section 4.3) 4.1 History of CGS PRA Models Maintenance The CGS PRA model and documentation has been maintained living and is routinely updated to reflect the current plant configuration and to reflect the accumulation of additional plant operating history and component failure data. The Level 1 and Level 2 CGS PRA analyses were originally developed and submitted to the NRC as the WNP-2 Individual Plant Examination (IPE) Submittal. The CGS PRA has been updated many times since the original IPE. A summary of the CGS PRA history is provided in Table 6-4.

The CGS Revision 5 PRA model was the model presented to the PRA peer review team and is documented in a series of modular reports as listed in Table 6-5. It quantifies the CDF and LERF. The Revision 5 model upgrade was performed to include the modifications summarized below:

Power Uprate of 5 %

Maintenance unavailability data based on the most recent plant operating experience

Plant modifications affecting the PRA model

Bayesian updated selected initiating event frequencies utilizing the most recent CGS operating experience

Individual component random failure probabilities Bayesian updated (as applicable) based upon the most recent plant specific data and the most current generic sources

CCF calculations were revised to incorporate the updated Multiple Greek Letter (MGL) parameters from NUREG/CR-5497 (Reference 9) and INEL-94/0064 (Reference 7) for component groups where plant specific data were available.

The CGS Revision 5 update was performed to ensure that the risk significant BWROG PRA Peer Review comments and those identified internally through the PRA Maintenance and Update process were incorporated into the quantified PRA model.

The PRA models are continually implemented and studied by plant PRA personnel in the performance of their duties. Potential model modifications/enhancements are itemized and maintained for further investigation and subsequent implementation, if necessary.

Formal comprehensive model reviews are discussed in Section 4.2.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 30 of 98 Table 6-4 l _ CGS PSA REVISION RECORDS Issue l Rev # Date Revisions Highlights and Documentation Results 0 8/28/92 Original submittal to NRC (GL 88-20) Level 1 (CDF) =5.42E-5/Yr Level 2 (Release Frequency) = 5.09E-6/Yr 7/1994 A request was made to NRC to discontinue reviewing Level 1 the original submittal, and replaced it with this revision (CDF) =1 .75E-5/Yr as the GL 88-20 response. Level 2 (Release Major revisions performed in the following: Frequency) = 1.07E-Common-cause Factor for SRVs, MSIVs, and circuit 6/Yr breakers LOOP initiating frequency, event tree structure, and power recovery factors HRA methodology Enhanced MAAP calculations 2 8/1996 In response to the NRC's RAIs (first round had 39 Level 1 questions and second round had 3 questions), the (CDF) = 1.43E-5/Yr following tasks were performed: Level 2 (Release Updated the "Initiating Frequency", and developed a Frequency) did not Failure Modes Effects Analysis update Added the following Event Trees:

Loss of Div2 DC Loss of AC Bus (SM1/2/3, S115/6)

Loss of Control Room HVAC Loss of SM-7 HVAC Loss of SM-8 HVAC Deleted the following Event Trees:

Loss of Service Water Loss of CN (including in Loss of CIA)

Added RCIC as success path in the SORV event tree 4/118/97 NRC issued Safety Evaluation Report

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 31 of 98 Table 6-4 (Continued)

CGS PSA REVISION RECORDS Issue Rev # I Date I Revisions Highlights and Documentation Results 3 9/1997

A major documentation enhancement and modeling Level 1 (CDF)=1.71E-improvement were performed for the BWROG PSA 5/Yr Certification Program. Level 2 (Release

The documentation is categorized in the following: Frequency) =9.94E-Tier 1: 6/Yr SM (Summary Report)

QA (Quality Assurance)

Tier 2:

AS (Accident Sequence)

DA (Data Analysis)

DP (System Dependence)

HR (Human Reliability)

IE (Initiating Events)

L2 (Level 2)

ST (Structure Analysis)

SY (System Information Notebooks and Fault Trees)

TH (Thermal Hydraulics)

QU (Quantification)

VV (NUPRA Validation and Verification)

FT Preparations Tier 3:

Computer Run Records Walkdown Records Guidance & References

The modeling improvements included the following:

1. Updated the "Test and Maintenance" unavailability rate using data up to 3/31/97

2. Updated all random failure data using Bayesian method

3. Recalculated the Common-cause Failure Data using Multiple Greek Letter Method

4. Revised the LOCA (large, medium, small) initiating frequency using EPRI/TR-102266 methodology with plant specific data

5. Recalculated the ISLOCA initiating frequency using NSAC-154 methodology

6. Improved the TW sequences in all event trees 11/1997 11/1997 .* BWR PSA peer review

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 32 of 98 Table 6-4 (Continued)

CGS PSA REVISION RECORDS Issue Rev # Date Revisions Highlights and Documentation Results 4 9/1999

This revision was made primarily to incorporate the Level 1 (CDF)=2.lE-LOOP related comments received from the BWROG 5/Yr PSA Certification Report. Level 2 (Release

The major tasks included the following: Frequency) did not

1. Modified the LOOP Initiating Frequency using update NUREG-1032 & NUREG/CR-5496

2. Added the EDG recovery node in the LOOP Tree

3. Implemented the decay heat removal (DHR) success after AC recovery in the LOOP Tree

4. Added the "Load Shed" node and 30 minutes Offsite Recovery" node to the LOOP Tree

5. Deleted the success path of using water make-up from the Diesel Fire Pump in the LOOP Tree based on the MAAP calculations

6. Updated the EDG failure rate data using plant specific data collected from 1/1/88 to 8/25/98

7. Improved the data base (common-cause failure, failure mode consistency) 4.1 9/2001

Updated Level 1 data based on Maintenance Rule Level 1 (CDF)=2.24E-5/Yr 4.2 6/2002

Added MOC Switch model Level 1 (CDF)=1.83E-

Added Firewater for post containment failure 5/Yr injection

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 33 of 98 Table 64 (Continued)

CGS PSA REVISION RECORDS Issue Rev # I Date I Revisions Highlights and Documentation I Results 5.0 1/2004

This revision was made primarily to prepare the Level 1 DG CT extension licensing submittal (CDF) =7.33E-6/Yr,

The major tasks included the following: LERF=6.86E-7/Yr

1. Added the RPV rupture as an initiating event

2. Revised the LOOP event tree sequence (using convolution treatment for the DG-1, -2 mission time, separating HPCS FT1S from FTR, applying average power recovery, developing new offsite power recovery curves)

3. Revised the SBO event tree sequence (using convolution treatment for the HPCS-DG mission time, using new battery life calculations, performing the MAAP4 results for recovery timing)

4. Updated the transient and LOCA initiating event frequency based on NUREG/CR-5750

5. Revised the AC fault tree to include a second battery charger per division 1 & 2 as-built plant

6. Revised the AC fault tree to include a second inverter per division 1 & 2 as-built plant

7. Applied the ECCS pump room HVAC engineering calculations

8. Added Rx Building HVAC fault tree

9. Documented success criteria for selected systems

10. Updated the failure data using latest Problem Evaluation Report database and component failure studies

11. Updated the unavailability data using Maintenance Rule database

12. Revised the CCF data base

13. Revised Level 2 analysis focusing on LERF (NUREG/CR-6595)

14. Performed significant updates to majority of the PRA documentations

15. Upgraded to WinNupra to perform the 4

Ouantification 4 2/2004

RG 1.200 PRA peer review

- ---------- I APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 34 of 98 Table 6-5 ENTERGY NORTHWEST CGS PSA Documents Type Document Number Title AS PS-2-AS-0001 Accident Sequence Evaluation Plant Data Collection and Component Failure Rate DA PSA-2-DA-0001 Calculation DA PSA-2-DA-0002 Bayesian Update Failure Data DA PSA-2-DA-0003 Unavailability Data Analysis DA PSA-2-DA-0004 Common-cause Failure Data DA PSA-2-DA-0005 PSA Basic Event Data Listing DE PSA-2-DP-DEPEND System Dependency Matrix IF PSA-2-FL-0001 Flooding - Book 1: Main Analysis Flooding - Book 2: Flood Lv1 Computer Program IF PSA-2-FL-0001 Input and Results, Volume 1 IE PSA-2-IE-0001 Initiating Events WNP-2 PSA Quality Configuration & Control QA PSA-1-QA-0001 Guidelines TH(SC) PSA-2-TH-0001/0002 PSA Thermal Hydraulic Analysis HR PSA-2-HR-0001 Human Reliability Analysis SM PSA-1-SM-0001 PSA Internal Event Summary SN PSA-2-SN-0002 Plant Modification*

SY PSA-2-SN-ARI Alternate Rod Insertion SY PSA-2-SN-CAS Control and Service Air System SY PSA-2-SN-CIA Containment Instrument Air SY PSA-2-SN-COND Condensate System SY PSA-2-SN-EAC AC Distribution System Notebook SY PSA-2-SN-EDC DC Electrical System SY PSA-2-SN-DPR Primary System Pressure Control SY PSA-2-SN-FPW Fire Protection Water SY PSA-2-SN-HPCS High Pressure Core Spray SY PSA-2-SN-LPCS Low Pressure Core Spray SY PSA-2-SN-NSSSS Nuclear Steam Supply Shutoff

PSA-1-PI-001 is documentation produced post peer review to document modification and other changes reviews.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 35 of 98 Table 6-5 (Continued)

ENERGY NORTHWEST CGS PSA Documents Type l Document Number Title SY PSA-2-SN-PCS Power Conversion System SY PSA-2-SN-RCIC Reactor Core Isolation Cooling SY PSA-2-SN-REA Reactor Building Ventilation and Heating System SY PSA-2-SN-REC Reactor Building Emergency Cooling SY PSA-2-SN-RFW Reactor Feedwater System SY PSA-2-SN-RHR Residual Heat Removal SY PSA-2-SN-RPT Recirculation Pump Trip SY PSA-2-SN-SLC Standby Liquid Control SY PSA-2-SN-SW Standby Service Water SY PSA-2-SN-TSW Plant Service Water SY PSA-2-SN-VENT Containment Vent System LE PSA-2-L2-0001 Containment Performance Analysis ST PSA-2-ST-0001 Structural Response QU PSA-2-QU-0001 Quantification 4.2 Comprehensive Critical Reviews The CGS PRA model has benefited from the following technical reviews:

Scientech (previously NUS) review in 1994

BWROG PSA peer review in 1997

Selective review by independent consultants in 1998 (LOOP and SBO), and in 2002 (MOC Switch model)

Scientech review and upgrade in 2002 and 2003

Selective self assessment in 2003 for the following elements:

- SY

- IE

ASME PRA Checklists modified by RG 1.200 used in a complete PRA Peer Review - 2004

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 36 of 98 Of these multiple reviews, the two that provide a comprehensive treatment of the models, inputs, and maintenance and update process are the following:

1997 BWROG PSA peer review.

2004 PRA peer review using the ASME PRA Standard as modified by the RG 1.200 (December 2003).

4.2.1 BWROG PSA Peer Review The CGS internal events PRA received a formal industry peer review in November 1997 (Reference 3). The purpose of the peer review process was to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA could be used. The peer review process used a team composed of PRA and system analysts with significant expertise in both PRA development and PRA applications. This team provided both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements. The team used a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA elements available.

The review team used the BWROG PSA Peer Review Process Guidelines (Reference 2) as the basis for the review.

The general scope of the implementation of the BWROG PSA peer review included review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events, internal flooding, and containment performance. The intensive peer review involved approximately two person-months of engineering effort by the review team and provided a comprehensive assessment of the strengths and limitations of each element of the PRA.

The F&Os from these assessments that the review team indicated were important and those that involved risk elements needed to evaluate the proposed CT extension were dispositioned. This resulted in a number of enhancements to the PRA models prior to their use to support the proposed change.

4.2.2 CGS PRA Selected Self-Assessment A self-assessment of two elements of the CGS at-power Level 1 PRA models was performed in 2003.

The scope of the self-assessment review included the following key aspects for the Initiating Events and System elements:

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 37 of 98

1. Identified and addressed areas where the CGS PRA may require additional or alternative documentation, technical upgrades, or process improvements.

The self-assessment was performed prior to the CGS PRA peer review of 2004. (See Section 4.2.3.)

2. Identified areas for PRA improvement to meet a Capability II rating per RG 1.200.

4.2.3 RG 1.200 Peer Review As an additional check on the PRA prior to its use for the DG CT extension risk-informed application, Energy Northwest commissioned a PRA peer review in 2004 to make use of the recently issued ASME PRA Standard RA-SA-003 and the NRC's comments or changes to the ASME PRA Standard identified in RG 1.200 (December 2003). This peer review consisted of a five-member team spending one week in preparation, one week on-site to assess the quality of the PRA, and one week of documenting the review and review comments.

Table 6-6 summarizes the qualifications of the peer review team members.

A Columbia Generating Station PRA Peer Review Report using ASME PRA Standard Addendum A and RG 1.200 (Reference 5) (RG 1.200 Peer Review Report) consistent with the content and requirements specified in the ASME PRA Standard was developed for Energy Northwest. A number of conservatisms and areas of additional documentation were identified in the PRA peer review as desirable to incorporate as resources permit. In addition, the peer review identified support requirement improvements that could be performed to meet the ASME PRA Standard Capability Category II as supplemented by RG 1.200 guidelines.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 38 of 98 Table 6-6 RG 1.200 PEER REVIEW CERTIFICATION TEAM EXPERIENCE EXPERIENCE

SUMMARY

TEAM Years Years PRA MEMBERc__ Degree Experience Selected PRA Projects E. T. BS, Engineering 32 28

PRA Peer Review Team leader or Burns Science - RPI member on 23 BWR Peer Reviews MS, Nuclear

Technical reviewer of Level I IPEs for Engineering - RPI fifteen BWR plants Ph.D., Nuclear . Manager, technical advisor, or lead Engineering - RPI engineer on many IPEs/PRAs for BWR plants

Lead engineer on several containment safety studies V. M. BS, Mechanical 16 16

Level 1: Dresden, Quad Cities, Duane Andersen Engineering - SJSU Arnold, San Onofre, Pilgrim, Lungmen ABWR, Monticello MBA - SJSU

Level 2: Duane Arnold, Peach Bottom, Limerick, Fermi, Nine Mile Point, l_ Shoreham, Cooper, Vermont Yankee L. K. Lee BS, Mechanical 12 12

Technical reviewer or modeler for over Engineering - 10 Level l and Level 2 IPEs UC Berkeley

Lead engineer on over 10 Probabilistic Shutdown Safety Assessments

PRA Engineer for applying risk-informed evaluations to support plant l_ ISI programs D. E. BS, Nuclear 9 9

Lead analyst on several HRAs and HRA MacLeod Engineering - RPI updates

Primary analyst for V.C. Summer, H.B. Robinson, Peach Bottom, and Brunswick SAMA analyses

Contributor to a wide range of PSA updates, including Byron/Braidwood, Peach Bottom, Limerick, and Susquehanna K. L. Zee BS, Electrical 23 13

Fire IPEEE: Duane Arnold, Cooper, Engineering - SJSU Ft. Calhoun

Fire PRA: Quad Cities, Dresden, Peach Bottom, Limerick, Braidwood, Byron

NFPA 805 Implementation Guide, ANS Fire PRA Standard, SDP, Farley Risk-informed Appendix R Exemption Request The following is a discussion of the general findings of the 2004 PRA peer review. The details of the F&Os are contained in the RG 1.200 Peer Review Report.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 39 of 98 4.2.3.1 Initiating Event Analysis - IE The entire initiating event analysis was reviewed. The results are presented below:

Identification The Initiating Event analysis identifies and calculates frequencies for a robust list of initiators. The identification aspect of the Initiating Event analysis is consistent with industry standards. The identification process considers plant experience, past PRAs and industry studies. A failure modes and effects analysis (FMEA) of systems is documented for the assessment of support system initiators.

Grouping The peer review team found the grouping of individual plant upsets into IE categories to be generally consistent with industry practices. Recommendations for documentation improvements were provided.

Quantification The IE analysis uses significant plant-specific information as input. Bayesian updates are performed when judged appropriate. When plant specific Bayesian updates are not appropriate, current industry information is used to quantify initiators. Recommendations associated with improvements to the IE element were provided, but did not impact the risk metrics for the DG CT submittal.

Documentation Like much of the CGS PRA, the IE analysis is well documented. Some documentation enhancements are recommended, including the following:

Initiator grouping details (especially for transients)

Approach assumptions for the FMEA

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 40 of 98 4.2.3.2 Accident Sequence Analysis - AS A review was performed on selected accident sequences. The portion of the accident sequences selected for review included:

(a) Accident sequence model for a balance-of-plant transient (b) The accident sequence model containing LOOP/Station Blackout considerations (c) Accident sequence model for a loss of a support system initiating event (d) LOCA accident sequence model (e) ISLOCA accident sequence model (f) ATWS accident sequence model The results of the review are presented below:

Accident Sequence Analysis The CGS PRA provides an analysis of accident sequences derived from each of the initiating events developed in the Initiating Events Notebook. The accident sequences are developed in WinNUPRA and show the system and crew responses by functional events in an event tree format.

The end states of the event trees are either core damage accident classes, which are then used to transmit information into the Level 2 LERF model, or safe stable states.

The peer review team examined the event trees and many of the sequences. Specific detailed issues are identified in the F&Os.

The event trees are generally adequate to support Capability Category II. The enhancements identified are not considered critical to the use of the PRA for applications such as the DG CT or integrated leak rate test (ILRT) extension.

Recommendations for additions to critical safety functions are considered minor enhancements.

The accident scenarios and success criteria use generic evaluations for primary support of non-LOOP sequences. MAAP 3 and MAAP 4 models of CGS are used to confirm specific scenario conditions, timing, and success criteria.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 41 of 98 Dependency in Sequences The peer review team found the CGS PRA treats dependencies consistent with industry practice, which includes:

Functional dependencies

Support system dependencies

Human error dependencies

Common-cause dependencies

Spatial dependencies These are addressed in the CGS PRA evaluation. The peer review team found the dependencies to be well treated. Recommendations were made to improve treatment of a few specific accident sequence functional dependencies. Examples of these are identified in the F&Os (some are C level) and include:

RCIC dependency on back pressure trip during the loss of DHR sequences

Crew actions to lower RPV water level during ATWS and its impact on maintaining the MSIVs open

SW cross tie dependency on Reactor Building environmental conditions given a wetwell failure

Vent effects on continued operability of systems due to steam binding

HPCS conservative treatment in LOOP sequences

CRD is not credited in Long Term Accident scenarios Documentation The Accident Sequence Notebook PSA-2-AS-0001 provides the summary of the accident sequence treatment and the assumptions used in the model.

The peer review team found the documentation to be generally clear and to explain the majority of the assumptions in accident sequence development.

However, it is necessary to have the model available to support a review of the event sequences because the specific model fault trees used in each event tree branch (top logic) are not otherwise available.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 42 of 98 4.2.3.3 Success Criteria - SC A review was performed on success criteria definitions and evaluations. The portion of the success criteria selected for review included:

(a) The definition of core damage used in the success criteria evaluations and the supporting bases (b) The conditions corresponding to a safe, stable state (c) The core and containment response conditions used in defining LERF and supporting bases (d) The core and containment system success criteria used in the PRA for mitigating each modeled initiating event (e) The generic bases (including assumptions) used to establish the success criteria of systems credited in the PRA and the applicability to the modeled plant (f) The plant-specific bases (including assumptions) used to establish the system success criteria of systems credited in the PRA (g) Calculations performed specifically for the PRA, for each computer code used to establish core cooling or decay heat removal success criteria and accident sequence timing (h) Calculations performed specifically for the PRA, for each computer code used to establish support system success criteria (e.g., a room heat-up calculation used to establish room cooling requirements or a load shedding evaluation used to determine battery life during an SBO)

(i) Expert judgments used in establishing success criteria used in the PRA The peer review team's results are provided below:

Overall Success Criteria The overall success criteria are defined in the Accident Sequence Notebook.

Reference to generic thermal hydraulic analysis is provided for the transient and LOCA sequences.

The CGS success criteria are similar to other BWRs and do not significantly deviate from those results for similar BWRs.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 43 of 98 The success criteria are generally consistent with the plant features, procedures, and operating philosophy. Items for consideration in setting success criteria are:

A 1989 RETRAN ATWS study of CGS is used as a supporting reference for the ATWS sequence, for which additional justification is recommended.

Subsequently, support information confirmed the adequacy of RETRAN for ATWS study.

Some success criteria (e.g., SW cross tie for RPV injection, RCIC success for extended time periods) require plant specific analyses, which are not referenced.

RCIC benefit in SORV sequences to remove current conservatism

Completion of the Switchgear Room Heat Up Calculations

RCIC operation without RHR Engineering Basis The plant specific thermal/hydraulic analysis capability allows the use of MAAP 4 and is capable of providing success criteria and event timing to support the PRA model for CDF and LERF for most accident scenarios defined. The specific cases evaluated with MAAP for Revision 5 are the SBO and LOOP sequences. Exceptions related to items that do not have a specific thermal hydraulic reference include:

ATWS pressure response

Level 2 phenomena The Level 2 phenomena are treated using accepted industry evaluations of these phenomena.

The structural analysis and supporting engineering calculations are considered adequate to support the CDF and LERF determinations. Exceptions include:

Room cooling for SWGR rooms*

Battery calculations*

Hydrodynamic load capability of containment under ATWS conditions

Analysis was in progress and has subsequently been completed.

The first item is reflected in the PRA using the preliminary results of the calculations. The last item is addressed in a conservative quantitative manner in Level 2. The battery calculations have not been reviewed as a basis for supporting 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months with no load shed (i.e., not in the model).

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 44 of 98 The full capability of the CGS code and MAAP 4 has not been implemented in the PRA model. Therefore, there are specific accident sequences that continue to depend on generic analysis or previous (pre uprate MAAP 3) calculations. CDF and LERF; structures, systems and component (SSC) impacts; and crew actions can be adequately assessed with the CGS code capability, MAAP 4.

Documentation The success criteria are documented in:

Accident Sequence Evaluation Notebook

Thermal Hydraulic Analysis Notebook

Containment Structural Analysis Notebook The documentation provides the results of the success criteria and the thermal hydraulic analysis. Providing references to the specific calculations that support each success criterion is recommended.

The assumptions in the SBO accident sequence evaluation are listed explicitly in the Accident Sequence Report; however, a list of all assumptions and code limitations is not provided in the cited documentation. The ASME PRA Standard specifies the desire to provide a list of all assumptions.

4.2.3.4 Systems Analysis - SY A review was performed on the systems analysis.

The portion of system models selected for review included a sample of the systems where failure contributes to significant sequences (CDF or LERF), including:

(a) Different models reflecting different levels of detail (b) Front-line system for each mitigating function (e.g., reactivity control, coolant injection, and decay heat removal)

(c) Each major type of support system (e.g., electrical power, cooling water, instrument air, and HVAC)

(d) Complex system with variable success criteria (e.g., a cooling water system requiring different numbers of pumps for success dependent upon whether non-safety loads are isolated)

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 45 of 98 The peer review team's results are provided below:

Causes of System Failure The system models appear to have been thoroughly developed and focused at a level of detail appropriate for representing system operation in the PRA model. With the exception of enhancements that could be made to eliminate model asymmetry and minor details required to meet specific ASME Standard Supporting Requirements, no major issues have been identified for the CGS system models. A sampling of the fault trees, fault tree logic, and supporting information was reviewed. The fault tree quantitative estimates and cutsets were reviewed for reasonableness. No major issues were identified for any of the fault tree models.

Common-cause Common-cause failure is generally well developed and covers the appropriate range of events. The analysis treats intra-system CCF in a manner sufficient to capture the nature of failure dependencies, with minor recommendations relating to component groupings. Inter-system dependencies are not addressed other than for the miscalibration of the low pressure permissive, which is consistent with the ASME PRA Standard Capability Category II.

Documentation The level of documentation is generally adequate to support the base PRA model and risk-informed applications. Minor recommendations from the peer review team include defining system boundaries and how the system fault trees are integrated for quantification. No significant system analysis documentation issues have been identified.

4.2.3.5 Human Reliability Analysis - HR A review was performed on the human reliability analysis (HRA).

The portion of the HRA analysis selected for peer review included a sample of the human failure events (HFEs) whose failure contributes to significant sequences (CDF or LERF). This review included:

(a) The selection and implementation of any screening human error probabilities (HEPs) used in the PRA (b) Post-accident HFEs and associated HEPs (c) Pre-initiator HFEs and associated HEPs for both instrumentation miscalibration and failure of equipment

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 46 of 98 (d) HEPs for the same function but under the influence of different Performance Shape Factor (PSFs)

(e) HEPs for dependent human actions, including dependencies of multiple HEPs in the same sequence (f) HFEs and associated HEP involving remote actions in harsh environments (g) The selection and identification of the HFEs associated with the HEP for the above review topics The peer review team's results are provided below:

Pre-Initiators The procedures linked to the miscalibration HEPs are identified in the HRA documentation; however, documentation that shows other procedures were reviewed to identify potential actions was not provided. Specifically, no maintenance mis-alignment actions have been identified in the PRA documentation. Reviews of procedures in an effort to find potential mis-alignment vulnerabilities were not documented in the PRA. No basis was provided in the PRA to exclude mis-alignment HEPs.

Post-Initiator HRA Method The ASEP HRA model is described by the ASME standard as a Capability Category I methodology. While a rigorous application of ASEP could generally account for most differences between accident scenarios, it does not explicitly include provisions for workload level, indication/annunciator availability, or procedure clarity. The latest CGS dependency analysis follows the expected process and includes a reasonable level of documentation; however, the conclusions reached in the analysis indicate no significant HRA dependencies and no minimum HRA HEP were needed.

The peer review team provided recommendations for evaluation and inclusion of HRA dependencies.

Documentation The HRA document generally describes the process that was used by CGS. The peer review team provided F&Os to enhance HRA documentation.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 47 of 98 4.2.3.6 Data Analysis - DA A review was performed on the data analysis.

The portion of the data analysis selected for review included:

(a) Data values and associated component boundary definitions for component failure modes (including those with high importance values) contributing to the CDF or LERF calculated in the PRA (b) Common cause failure values (c) The numerator and denominator for one data value for each major failure mode (e.g., failure to start, failure to run, and test and maintenance unavailabilities)

(d) Equipment repair and recovery data The peer review team's results are provided below:

Data Grouping Consistent with industry standard techniques, the CGS PRA includes a grouping of various individual components for the purpose of data analysis. The peer review team provided component grouping recommendations for recalculating failure rates using plant specific data.

Data The models used to calculate component unavailabilities, random failure probabilities and CCF probabilities are consistent with standard industry techniques.

Bayesian analysis is performed for a robust number of component failure modes.

CCF parameters are based on an accepted industry source, NUREG/CR-5497 Oct 1998.

Documentation The data analysis is well documented. Some documentation enhancements are recommended, including:

Failure identification guidance/criteria

Component boundary definitions

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 48 of 98 4.2.3.7 Internal Flooding - IF A review was performed on the internal flooding analysis.

The portion of the internal flooding analysis selected for review included a sample of the screening of flood areas and the flooding scenarios contributing to significant sequences (CDF or LERF). The review included:

(a) Internal flood initiating event frequencies (b) Internal flooding scenario involving each identified flood source (c) Internal flooding scenarios involving flood propagation to adjacent flood areas (d) Internal flooding scenario that involves each of the flood-induced component failure mechanisms (i.e., one flood scenario for each mechanism)

(e) One internal flooding scenario involving each type of identified accident initiator The peer review team's results are provided below:

Flood Areas The flood areas in the plant have been identified based on plant information including plant drawings and the shutdown flooding calculations. The SSCs within these areas have been identified based on plant walkdowns documented with detailed notes. The level of detail documented in the walkdown notes is a strength of the internal flooding evaluation.

Flood Sources The potential flooding sources and flooding mechanisms (e.g., rupture or spray) have been identified for each area and confirmed via plant walkdowns.

Flood Scenarios The potential flooding scenarios for each flood source have been modeled using a detailed computer program. The flooding computer program dynamically evaluates the propagation paths between flood areas and accounts for items such as flow rate, drain paths, and area water level at any time after flood initiation. The flooding propagation computer program is a strength of the internal flooding evaluation.

Initiating Events Flood-induced initiating events for multiple scenarios have been identified. Initiating event frequencies have been quantified based on pipe length, type of piping and number of components (e.g., valves) in the piping.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 49 of 98 Each flooding initiating event is quantified with an individual event tree based on modifying an associated transient event tree. The sequence modeling may conservatively fail equipment for certain initiators where additional mitigation systems (e.g., an additional low pressure core injection train) may be available.

The peer review team recommended that maintenance induced flood contributions be addressed qualitatively or quantitatively, and operator action analysis be expanded to assess a more realistic quantification of crew response.

Documentation The internal flooding documentation is detailed and thorough. However, it is recommended that flooding documentation include the existing calculations used to derive the flooding initiating event frequencies. Otherwise, the documentation supports the ability to reproduce the analyses and supports PRA applications and upgrades.

4.2.3.8 Quantification - QU Level 1 quantification results were reviewed.

The portion of Level 1 quantification process selected for review included:

(a) Appropriateness of the computer codes used in the quantification (b) The truncation values and process (c) The recovery analysis (d) Model asymmetries and sensitivity studies (e) The process for generating modules (if used)

(f) Logic flags (g) The solution of logic loops (h) The summary and interpretation of results The peer review team's results are provided below:

Quantification Inputs The Level 1 model is quantified using initiating events, system models, and accident sequence event trees to calculate the CDF. The CDF results are reviewed with respect to the contribution from initiating event frequency, accident sequence and plant damage states (PDS).

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 50 of 98 Model and Software The Level 1 model is quantified using WinNUPRA 2.1. WinNUPRA 2.1 is qualified under a Quality Assurance program in accordance with 10 CFR 50, Appendix B. A Verification and Validation (V&V) evaluation was performed for WinNUPRA 2.1 to ensure that the quantification software code provides valid and reproducible results. The WinNUPRA 2.1 software limitations are documented in the WinNUPRA 2.1 users manual.

Dependencies The PRA model quantification accounts for initiating event, system, spatial, common-cause, and accident sequence functional dependencies. In addition, the PRA evaluated the potential dependency of multiple operator actions.

Uncertainties The uncertainties in the model were characterized based on performing sensitivity studies and a parametric uncertainty analysis. The sensitivity and uncertainty analyses provide an understanding for the potential variability of the model results.

Sensitivity analyses are performed to gain insights into human errors, test and maintenance, and common-cause failures.

Documentation The PRA model quantification results are documented in a format that facilitates a peer review. The documentation supports future upgrades and applications.

The PRA quantification notebook documents the review of significant CDF contributors such as initiating events, accident sequences, accident classes, and basic events. The results are traceable to PRA model inputs and assumptions.

4.2.3.9 LERF Analysis - LE The LERF analysis and the Level l/LERF interface process were reviewed.

The portion of Level 1 and LERF interface process selected for a detailed review included:

(a) Accident characteristics chosen for carryover to LERF analysis (and for binning of PDS)

(b) Interface mechanism used (c) CDF carryover

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 51 of 98 The portion of the LERF analysis selected for review included:

(a) The LERF analysis method (b) Demonstration that the phenomena that impact radionuclide release characterization of LERF have been appropriately considered (c) Human action and system success considering adverse conditions that would exist following core damage (d) The sequence mapping (e) Evaluation of containment performance under severe accident conditions (f) The definition and bases for LERF (g) Inclusion in the containment event tree of the functional events necessary to achieve a safe stable containment endstate (h) Sensitivity analysis (i) The containment response calculations, performed specifically for the PRA, for the dominant plant damage states The peer review team's results are provided below:

Interface The interface of Levels 1 and 2 is performed by grouping similar plant damage states for transferring information into the Level 2/LERF evaluation to support a Capability Category I dependency analysis as part of the Level 2.

The accident sequence characteristics from Level 1 are well represented in the transfer of information for individual Plant Damage States. In addition, the total level 1 CDF is transferred to the Level 2/LERF evaluation, therefore, there are no "carryover" problems identified in the RG 1.200 Peer Review.

Accident Progression An evaluation of the credible contributors to LERF are included in an extensive qualitative evaluation. The containment event tree and its quantification is similar to that used in NUREG/CR-6595 with conditional probabilities (split fractions) assigned. In the ASME PRA Standard Addendum A, this was acceptable for all capability categories. The NRC in RG 1.200 has stated that the NUREG/CR-6595 approach supports Capability Category I.

There are some conservatisms in the model that influence LERF. These conservatisms could increase the calculated LERF and ICLERP values for applications.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 52 of 98 The LERF event trees are adequately developed to allow the development of accident scenarios that would result in a Large Early Release consistent with a Capability Category I LERF evaluation. This assignment to Capability Category I recognizes that the resulting risk metrics are conservative.(')

Structural Capability The Level 2 evaluation includes a plant specific evaluation of the containment ultimate capability to withstand severe accident loads. The evaluation is supportive of the LERF evaluation for pressure and temperature challenges to containment.

Some conservative assessments are made relative to some severe accident phenomena such as debris interaction with the shell and ex-vessel steam explosion.

Quantification The quantification of the LERF model produces results consistent with the inputs from Level 1, the phenomena considered, the assumptions made, and the process used. These results are reviewed and the contributors presented in the LERF Notebook.

Documentation The LERF analysis and its documentation is clear and consistent. The process used is described. The assumptions used are generally described. The LERF assessment is supportive of applications and can be generally characterized as a Capability Category I although individual Supporting Requirements may be fully met or met at Capability Category II.

4.3 Discussion of PRA Peer Review Facts and Observations In addition to the general summary of the key PRA elements as reviewed in the RG 1.200 peer review, this section provides the specific capability category ratings determined for the CGS PRA along with a tabular description of the status of the PRA by individual SR.

This review of the PRA by the Peer Review Team resulted in the assignment of capability categories plus the identification of specific issues to be resolved, i.e., F&Os. This section addresses both of the following:

F&Os that could influence the DG CT - Section 4.3.1

SRs noted below Capability Category II - Section 4.3.2

'The implication of a conservative treatment of the risk metrics is that the LERF is overestimated. Similarly, this generally leads to an overestimation of the change in LERF and ICLERP for PRA applications. (See key sources of uncertainty discussion in Section 3 and specific disposition in Tables in Section 4.3.)

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 53 of 98 4.3.1 Summary of RG 1.200 Peer Review F&Os Table 6-7 summarizes the following RG 1.200 peer review results for the internal events at-power PRA:

The number of individual capability category ratings by PRA element

The number of SRs that are "met", "not met", or "not applicable"

The specific A or B F&O designator developed for each PRA element This summary table is compiled to provide an overview of the results of the peer review relative to the ASME PRA Standard as modified by RG 1.200 (December 2003). This overview table totals the number of Supporting Requirements into one of several categories as follows:

Met: This category includes SRs for which the SR extends across multiple capability categories. "Met" means that the CGS PRA lies at least in Capability Category II.

Not Met: This category of SRs means that the CGS PRA does not meet the ASME PRA Standard as supplemented by RG 1.200 for any capability category.

N/A: This category means that the SR is not applicable to the CGS PRA.

Capability Categories I, II, or III: These capability categories are based on the guidelines provided in RG 1.200 and the ASME Standard for each SR.

Table 6-8 summarizes the specific "A" or "B" F&Os related to each internal events PRA element and how the resolution of each specific item affects the DG CT application. The peer review team F&Os were identified based on a review of the CGS Revision 5 PRA versus the high level and SRs of the ASME PRA Standard as supplemented by RG 1.200 (December 2003). Each F&O was graded based on the type of finding. Sixty-two (62) comments are of type A/B.

By definition, Importance Levels A or B F&Os are:

"ImportanceLevel A - Extremely important and necessary to address to assure the technical adequacy of the PSA or the quality of the PSA or the quality of the PSA update process. "

"ImportanceLevel B - Important and necessary to address, but may be deferred until the next PSA update. Consider necessary to meet Capability Category II. "

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 54 of 98 All type A or B F&Os were reviewed for possible impact on the results and conclusions of this DG CT application. Twenty-three (23) F&Os were determined to potentially have an impact on the results. Sensitivity calculations, model changes, or qualitative evaluations were performed on each of these 23 F&Os. The results of these evaluations show that these F&Os do not impact the acceptability of the DG CT extension risk decision. Table 6-8 provides a listing of these F&Os for internal events and the associated risk impact assessments. A listing of "No or Negligible Impact" indicates this F&O does not significantly influence the risk metrics associated with the DG CT application.

For fire events, Table 6-9 summarizes the following peer review results for the fire events at-power PRA:

The number of individual capability category ratings by PRA element

The number of SRs "not met", "met", or "not applicable"

The specific A or B F&Os developed for each PRA element Lastly, Table 6-10 summarizes the specific F&Os related to each fire PRA element and how the resolution of each specific item affects the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 55 of 98 Table 6-7 I -__ 2004 PEER REVIEW APPLICATION PSA

SUMMARY

Level 1 or 2 PRA Element Met NIA Not Met I J mI.. Total F & Os- A & B Initiating Event (IE) 23 1 2 2 2 0 30 IE-C3-1, IE-C7-1, IE-C9-1 Accident Sequence (AS) 17 1 0 1 1 1 21 AS-A2-1, AS-A2-2, AS-A4-1, AS-A4-2, AS-A4-4, AS-A5-3, AS-A5-4, AS-A5-6, AS-B2-

. 2, AS-B2-3, AS-B3-1, AS-B3-2 Success Criteria (SC) 8 1 6 - - 0 15 SC-A6-2, SC-A6-3, SC-BI-2, SC-BI-4, SC-B1-5, SC-B3-1, SC-B5-1, SC-Cl-I System Analysis (SY) 36 1 3 0 1 41 SY-A8-1, SY-A17-2, SY-A19-1, SY-B5-1 Human Reliability (HR) 18 0 9 4 2 1 34 HR-El-I, HR-E1-2, HR-EI-3, HR-E3-1, HR-F2-1, HR-F2-2, HR-F2-3, HR-G3-1, HR-G4-1, HR-G5-1, HR-G5-2, HR-G8-1, HR-H2- 1 Data Analysis (DA) 17 1 4 3 3 1 29 DA-BI-I, DA-DI-1 Internal Flood (IF) 24 1 1 - - 2 28 IF-E5-1, IF-E7-1 Quantification (QU) 23 1 4 I 2 31 QU-C2-1, QU-D2-1, QU-D4-1 LERF Analyses (LE) 14 2 7 8 6 0 37 LE-A4-1 (LE-E2), LE-A4-2, LE-B2-1, LE-C2-1, LE-C3-2, LE-C4/C5-1, LE-C4-2, LE-C7-2, LE-D1-1, LE-E3-1, LE-F1-1, LE-

. F2-1, LE-G5-1 Total l180 [9 36 18 15 8 266 __

Note: Fire PRA capability rating criteria were developed by consultants as no standard currently exists.

Fire (FPRA) l 23 l 4 l 3 5 6 7 48 See Table 6-9

° It is noted that for many of the ASME PRA Standard SRs the same requirement is applicable to all Capability Categories. In this compilation, the fact that a SR is determined to be met means that it meets at least Capability Category II.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 56 of 98 Table 6-8 2004 PEER REVIEW

SUMMARY

F&Os RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS PRA A or B F&O l Issue j Resolution Method for DG CT Application IE-C3-1 Conservative calculation of transient initiating event Slight conservatism in model.

frequency does not impact the DG CT application. No impact.

IE-C7-1 ISLOCA model changes may influence the ISLOCA CDF No impact.

and therefore the LERF, however this does not influence the DG CT application.

IE-C9-1 The initiating event for loss of switchgear room cooling No impact.

appears to be inconsistent with the calculation.

AS-A2-1, AS-A2-2 A conditional probability of a LOOP induced by a transient Unique CGS grid stability supports the current model.

or LOCA is explicitly quantified, but at a very low Grid Stability evaluation performed.

conditional failure probability. A qualitative assessment of the BPA grid reliability indicates that this is a negligible impact on the DG CT application..

AS-A4-1, AS-A4-2, ATWS related F&Os. No impact.

AS-A4-4 AS-A5-3 Conservative treatment of HPCS operation may reduce the Conservatism may lead to an overestimate of risk impact of DG CT application. increase. Sensitivity performed to demonstrate impact.

AS-A5-4 ISLOCA related observation. ISLOCA does not influence No impact.

the DG CT application.

AS-A5-6 MSIV closure on lowering RPV level below MSIV closure No impact.

setpoint not accounted for during ATWS.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 57 of 98 Table 6-8 (Continued) 2004 PEER REVIEW

SUMMARY

F&Os RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS PRA A or B F&O Issue l Resolution Method for DG CT Application AS-B2-2, AS-B2-3 Vent impacts associated with non-SBO and non-LOOP Performed HRA evaluation and determined that crew sequences. This does not influence the DG CT application. interpretations of procedures were appropriate and consistent Vent Impact on operating systems verified during with the modeling in the PRA.

interviews that vent would be tightly controlled. No impact due to proper control.

AS-B3-1, AS-B3-2 SW XTIE credit for RPV injection is found to be Negligible Impact. This does not influence the DG CT potentially non-conservative but to have a negligibly small application.

impact on the LOOP and SBO sequences. FV=7.2E-5 RAW = 1.1.

SC-A6-2, SC-A6-3 Missing ATWS calculations to support the ATWS No impact.

sequences.

SC-BI-2, SC-Bl-4, SC- SW XTIE credit for RPV injection is found to be Negligible Impact. This does not influence the DG CT BI-5 potentially non-conservative but to have a negligibly small application.

impact on the LOOP and SBO sequences. FV=7.2E-5 RAW = 1.1.

SC-B3-1 SW XTIE credit for RPV injection is found to be Negligible Impact. This does not influence the DG CT potentially non-conservative but to have a negligibly small application.

impact on the LOOP and SBO sequences. FV=7.2E-5 RAW = 1.1.

SC-B5-1 Missing ATWS calculations to support the ATWS No impact.

sequences.

SC-Cl-i Increase the level of detail in the MAAP documentation to Documentation; No impact.

promote its understanding and usability.

SY-A8-1 Lack of component boundary definitions could influence the Qualitatively assessed.

application of data. This is judged not to significantly affect the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 58 of 98 Table 6-8 (Continued) 2004 PEER REVIEW

SUMMARY

F&Os RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS PRA A or B F&O Issue Resolution Method for DG CT Application SY-A17-2 RCIC back pressure assumption affects non LOOP and non- MAAP evaluations performed to demonstrate deterministic SBO sequences. effects. Sensitivity case performed.

SY-A19-1 Changes response in LOCA. No impact.

SY-B5-1 The chargers appear to receive credit for a specific AC bus The dependency was verified to be presented. See Gate transfer that may depend solely on DC availability. GXDC2012.

HR-El-i Documentation. No impact.

HR-EI-2 ATWS. No impact.

HR-E1-3 HEP justification needed. Interviews conducted subsequent See HEP Sensitivity.

to PRA Peer Review.

HR-E3-1 HEP justification needed. Interviews conducted subsequent See HEP Sensitivity.

to PRA Peer Review.

HR-F2-1 Timings are reasonable and adequate for HRA. This does Considered to be a negligible variation in HEPs.

not influence the DG CT application.

All HEPs affecting DG CT recalculated. See HEP Sensitivity.

HR-F2-2 Vent timings are reasonable and adequate for HRA. No impact.

HR-F2-3 DFP alignment is not significant for LOOP/SBO No significant impact.

FV=8.7E-4 RAW=1.0.

HR-G3-1 HEPs significantly affecting the DG CT extension were re- See HEP Sensitivity.

evaluated with the Cause Based HRA Method subsequent to the PRA Peer Review and this F&O.

HR-G4-1 ATWS related. No impact.

HR-G5-1 Gathering basis for required action times occurred after the See HEP Sensitivity.

PRA Peer Review.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 59 of 98 Table 6-8 (Continued) 2004 PEER REVIEW

SUMMARY

F&Os RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS PRA A or B F&O Issue [ Resolution Method for DG CT Application HR-G5-2 Gathering basis for required action times occurred after the See HEP Sensitivity.

PRA Peer Review.

HR-G8-1 Establish a minimum HEP that should be applied to See HEP Sensitivity.

combinations of HEPs.

HR-H2-1 Recovery factors are potentially optimistic for the non No impact.

LOOP non-SBO sequences.

DA-B1-1 Recalculate the failure rates for components which are Perform a sensitivity to establish the risk metric changes.

inappropriately grouped for the purpose of combining plant l_ specific data.

DA-DI-1 Unavailabilities for individual trains are calculated in a Conservatism may lead to overestimate of risk increase.

conservative fashion. These may result in a conservative bias of the risk metrics in the DG CT application. l IF-E5-1 The HEP derivation for isolation of the flood source could Documentation; No impact be better documented. This is not expected to affect the base model or the DG CT application.

IF-E7-1 The Level 2 accident treatment of internal floods appears No impact.

conservative.

QU-C2-1 Evaluation of HEP dependencies among actions within a Sensitivities performed as part of HR-EI-3, HR-E3-1, HR-G8-cutset. 1.

QU-D2-1 There is a conservative assessment of HPCS viability See HPCS Sensitivity.

applied in the model. This may introduce a conservative bias in the DG CT application risk metric calculations.

QU-D4-1 Certain long term loss of DHR sequences are treated non- No impact.

conservatively.

LE-A4-1, LE-A4-2 Assessed as meeting at least Capability Category I. (See LE-C9, IF-E7-1)

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 60 of 98 Table 6-8 (Continued) 2004 PEER REVIEW

SUMMARY

F&Os RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS PRA A or B F&O Issue I Resolution Method for DG CT Application LE-B2-1 The ex-vessel steam explosion may be conservatively This may conservatively bias the LERF risk metric in the DG treated in the Level 2 model. CT application. See ex-vessel steam explosion sensitivity evaluation.

LE-C2-1 The HRA implementation in the Level 2 is thought to be See Level 2 HEP Sensitivity.

generally conservative. However, dependencies are treated in an approximate manner. There would be some small impact on the DG CT application.

LE-C3-2 The use of arbitrary availability numbers for train Negligible impact.

availability and their treatment as independent failures may be non-conservative in certain cases. Some already low frequency contributors to LERF are reduced even further.

LE-C4/C5-1, LE-C4-2 The use of arbitrary availability numbers for train Negligible impact.

availability and their treatment as independent failures may be non-conservative in certain cases. Some already low frequency contributors to LERF are reduced even further.

LE-C7-2 Level 1 dependencies are transferred into Level 2 in an Negligible impact.

approximate manner. Level 2 dependencies are generally treated explicitly.

LE-DI-1 The ex-vessel steam explosion may be conservatively This may conservatively bias the LERF and ICLERP risk treated in the Level 2 model. metric in the DG CT application. Assessed as meeting at least Capability Category 11. However, the ICLERP and delta LERF risk metrics should be evaluated in a sensitivity case with the ex-vessel steam explosion probability reduced. See ex-vessel steam explosion sensitivity evaluation.

LE-E2 (LE-A4-1) NUREG/CR-6595 type LERF evaluation. Considered acceptable for DG CT application.

LE-E3-1 Level 2 (ATWS Sequences) has not been updated to The calculations have been performed to update the Level 1 Revision 5 Level 1. and subsequently Level 2. The total LERF actually reduced from 6.986E-7 per year to 6.858E-7 per year. The revised SBO contribution to the LERF is less than 10 percent.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 61 of 98 Table 6-8 (Continued) 2004 PEER REVIEW

SUMMARY

F&Os RELATED TO DG CT APPLICATION FOR FULL POWER INTERNAL EVENTS PRA A or B F&O I Issue I Resolution Method for DG CT Application LE-F1-1 Documentation related item. No impact.

LE-F2-1 Uncertainty not performed. No impact.

LE-G5-1 Documentation and sensitivities not performed. No impact.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 62 of 98 Table 6-9 2004 PEER REVIEW APPLICATION FPRA

SUMMARY

Level 1 or 2 FPSA Element [Met lN/A NotMet I l II m Total l F & Os-A & B Fire Areas and Fire Compartments (FC) 2 1 2 0 5 none Cable and Equipment Location Data (CE) 4 - 1 3 8 CE-B31-2, CE-2-3, CE-133-4 Development of Fire Ignition Frequencies (Fl) 4 - 0 1 5 none FPRA Model Development - Plant Response (FM) 7 3 - 1 0 0 11 FM-C4-1, FM-Dl-1 Fire Scenario Development (FS) 4 - 3 1 2 3 13 FS-Cl/C2-1, FS-C4-

__________________________________ ____2, FS-C5-1 FPRA Model Quantification (MQ) 2 - - 3 1 0 6 none Total [ I l l l l l l Note: Fire PRA capability rating criteria developed by consultants because no standard exists Fire (FPRA) l 23 l 4 l 3 l 5 6 7 48 lSee above

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 63 of 98 Table 6-10 l 2004 PEER REVIEW

SUMMARY

FIRE F&Os RELATED TO DG CT APPLICATION Resolution Method for DG CT A or B F&O Issue Application CE-B1-2 The treatment of the CARPS data includes many instances where cables identified as Appendix R Negligible impact.(X) required circuits are screened from the analysis. While many of these are associated with the indication function only, other circuits which appear to be associated with ADS control are also excluded. The exclusion of functionally required circuits would represent a significant deficiency in Documentation to be enhanced.

the analysis.

No examples of excluded Appendix R Cables that are important in the PRA were identified during the Peer Review.

CE-B2-3 The Fire PRA analysis includes treatment of the offsite power supply connection via startup The PRA Fire Model was revised to transformer TR-S. A review of the plant three line diagram found that the transformer is provided include these cables.

with differential relay protection. The current transformer (CT) circuits which provide input to this protective relay include ASH5-65, ASMI-14, ASM3-15, B1SH6-65, and BSM2-95. A fire induced failure of any these cables could appear to the differential relay as a short circuit on the transformer secondary circuit. In response to such a spurious signal, the differential relay is expected to generate a switchyard breaker trip signal to open the transformer primary breakers.

These cables have been screened from the Fire PRA. As such, it appears that an important fire induced circuit failure has been inadvertently excluded from the analysis. Given the proposed EDGCTCT application, this specific failure mode is critical to the analysis.

CE-B3-4 The analysis process incorporates the complete scope of CARPS data. A review of the analysis The PRA Fire Model was revised.

database found numerous instances where cables identified as being applicable to the analysis - not The database analysis was updated screened - are not associated with a model basic event. As such, it would appear that potential fire to disposition these cables.

induced cable failures that affected credited systems or functions may not have been treated in the analysis. Can this be annotated with a resolution statement?

') Note: "Negligible impact" implies that the F&O, while it may affect the total CDF and total LERF, does not impact the ICCDP or ICLERP or ACDF or ALERF for the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 64 of 98 Table 6-10 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F&Os RELATED TO DG CT APPLICATION Resolution Method for DG CT A or B F&O Issue I Application FM-C4-1 The Fire PRA includes explicit treatment of fire induced spurious equipment actuation. This The PRA Fire model was revised to use treatment uses a generic value of 0.10 as the conditional probability given fire damage. This EPRI recommended value.

value is indirectly discussed and not adequately justified in the analysis documentation. In addition, the 0.10 value is lower than the EPRI recommended value by a factor of 3. The EPRI value was developed based on generic testing combined with an Expert Elicitation that reviewed the testing results. Given the current industry focus on fire induced spurious actuation - both single and multiple, this treatment is expected to be questioned.

FS-ClI/C2-1 The scenarios involve relatively small fire events. The maximum heat release rate considered is The cabinets of interest are relatively limited to less than 600 KW. This compares to an EPRI/NRC recommended value of 800 KW closed and have IEEE-383 qualified of open electrical cabinets with non-IEEE 383 qualified cables. Postulated combustible fluid cables, the heat release rates based fires often have values of several megawatts. The analysis methodology as implemented recommended by EPRI were used.

requires the treatment of any fire that exceeds the fire modeling input parameters to be treated as Switchgear cubicles with incoming causing zone wide failure. However, in cases where the zone boundaries are also based on a power, such as, the yard transformer

'limited' fire scenario, it is unclear how the resulting scenario can be justified. feeder cubicles and DG cubicles, were assumed to have higher heat release The consequence of the fire modeling treatment and application may include instances where the rates. Large quantities of transient quantification is overly conservative or other instances where it may be non-conservative. combustibles cannot be stored in the safety-related areas. Small quantities must be stored in spill proof containers.

However, in many compartments it was conservatively assumed that the transient fires spread throughout the compartment.

Fire propagation was based on EPRI FEDB. Modeling treatment is sufficiently conservative. No impact anticipated to DG CT.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 65 of 98 Table 6-10 (Continued) l _ _

A or BF&O 2004 PEER REVIEW

SUMMARY

FIRE F&Os RELATED TO DG CT APPLICATION Issue t Resolution Method for DG CT Application FS-C4-2 The treatment of the postulated fire in the main control room includes the application of multiple

Although the HEP treatment is judged factors. These factors include an HEP for fire suppression, an HEP for shutdown from outside adequate, the Fire PRA was modified the main control room, and the treatment of the availability of plant systems following control to a higher HEP of IE-2. A sensitivity room abandonment. The basis for the selection of several key input parameters is not adequately was performed by increasing to IE-1.

justified in the documentation reviewed. The resulted CDF is 2. 1E-5Iyr and DG2 ICCDP is 4.7E-8.

MThe analysis describes the use of a screening HEP of 3.0E-03 for errors associated with the

In the procedure, HPCS is tripped to execution of the ABN-CR-EVAC. A review of the procedure flow chart shows parallel prevent overfill. In the fire PRA, actions required by five operators all of which are required to implement the single train credit is given to using unprotected A shutdown strategy directed by that procedure. Given the number of actions, the apparent train and HPCS, if they are not complexity of those actions, and the 10 minutes demanded for the completion of some of damaged by the fire, and if the B train those actions, the use of an HEP of 3.0E-03 would require more rigorous HRA treatment to and RCIC are not available.

justify.

The use of the 3.01E-4 HEP was not for

The event tree treatment includes a node for the conditional probability that HPCS is use of A train equipment outside of the available following control room abandonment. However, ABN-CR-EVAC directs the control room. This HEP was used operators to ensure that HPCS is tripped within 10 minutes of abandonment. when the control room fire was

The treatment of the control room abandonment includes credit for the conditional successfully extinguished, and the availability of Train A from outside the main control room for selected fire sequences. This control room did not need to be treatment includes the use of a reduced HEP of 3.0E-04. Given that the ABN-CR-EVAC is evacuated, but B train cabinets were still the applicable procedure and the steps to implement a potential Train A appear late in involved in the fire. A train equipment the procedure, it is unclear whether the HEP is appropriate or whether this actually and HPCS are not affected by the fire, represents a success path. and, if they do not start automatically,

The plant damage state (PDS) assigned for the scenario that involves control room can be operated and controlled abandonment and successful implementation of the procedure is TFN. This is the same as normally from the control room.

that used for the non-abandonment case. Given the limited controls and systems that can be

Because of the various scenarios in the confirmed to be available given abandonment, the basis for this treatment should be control room fire analysis, the event documented in greater detail. A cursory review of the event tree for TFN indicates that it trees used transfers to group the may be applicable only for the non-abandonment case. As a consequence, the control room sequences for further level I analysis.

abandonment case may credit mitigation beyond that which is available. This treatment is The TFN transfer category contributes equally applicable for many other sequences. In general, the basis for the PDS assignments less than 5E-09/yr to CDF, and is not should be documented and justified in greater detail. important to LERF.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 66 of 98 Table 6-10 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F&Os RELATED TO DG CT APPLICATION

__ Resolution Method for DG CT A or BF&O I Issue Application FS-C5-1 The screening analysis is judged The event trees presented in the Screening Fire Event Trees Report (FPSA-2-ET-0001) include adequate for the following reasons:

instances where automatic fire suppression is credited. The treatment in the event trees is such that successful suppression is assumed to result in only loss of the single 'worst case' component.

. First, the "worst case" single failure in This treatment is applied without any supporting fire modeling analyses or discussion. The the entire compartment was always application of this approach may result in non-conservative treatment. The scenario of interest is assumed to fail, which is very a case where a fire involving a fixed fire ignition source occurs and is not self-extinguished. The conservative.

treatment assumes that the environment in the fire zone is such that conditions necessary to actuate the automatic fire suppression system occur. However, without analysis or some other

Second, based on EPRI FEDB assessment of the fire zone it is unclear how it can be concluded that an intervening target is precluded from being disabled. In addition, treatment of the suppression system actuation time analysis, it was assumed that a fixed ignition source fire (other than yard versus the target damage time does not appear to have been considered. The quantification using transformers) would be limited to the the TFS designator indicates that only the single worst case component is assumed to be failed.

If the scenario actually results in fire damage to an intervening cable tray, then additional failures initial ignition source if automatic suppression is successful. A fault tree would have been inappropriately excluded.

was developed to model failure of the automatic fire suppression systems.

Third, since the automatic fire suppression systems at CGS actuate at relatively low temperatures (generally 165F) and cable has a damage threshold of about 700F, the assumption was made that the fire suppression system would actuate before target cables were damaged Documentation will be enhanced.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 67 of 98 Table 6-10 (Continued) 2004 PEER REVIEW

SUMMARY

FIRE F&Os RELATED TO D( CT APPLICATION Resolution Method for DG CT A or B F&O Issue Application FM-DI-I The Fire PRA analysis methodology describes a post-processing of outside control room operator Negligible impact.

actions. This is described in Appendix J. However, the post-processing described in Appendix J There is an extensive document on was not performed. The concern is that the quantification results include the inappropriate operator actions in the Post Fire Safe crediting of an operator recovery action that is actually precluded by the postulated fire event. Shutdown analyses. This was used to verify that there were no actions incorporated into the fire PSA that would require an operator to pass through or take actions in the area of a fire. The only exception was for the main control room fire, where the operators must trip the plant and close the MSIVs before evacuation of the main control room.

Based on the PFSS analyses, no ex-control room operator actions were removed from the analysis. However, credit could not be taken for some equipment (and associated operator actions) after certain fires in the main control room, since the control and actuation cables could be damaged.

Documentation will be revised to describe the process used.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 68 of 98 4.3.2 Technical Adequacy by Individual Supporting Requirements Tables 6-11 through 6-19 provide a detailed listing of each ASME PRA Standard Supporting Requirement. For each Supporting Requirement, the following information from the RG 1.200 peer review is provided in the table:

The Capability Category assigned Identification if a Supporting Requirement is "met", "not met", or is "not applicable" The number of associated A or B priority Facts and Observations

The disposition of the SR as to its applicability to the DG CT In addition, Tables 6-11 through 6-19 also provide the disposition of the Supporting Requirement insights as they apply to the DG CT extension.

The disposition includes the identification of how those SRs that could influence the DG CT application are treated if they do not meet at least Capability Category II.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 69 of 98 Table 6-11 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS (QEI Capability Category l l lNot

[ Associated A & B Facts &

HILR SR I Il III Met Met N/A Observations Disposition HLR-IE-A IE-A = Assessed as Meeting at Least Capability Category 11.

IE-A2 / Assessed as Meeting at Least Capability Category 11.

IE-A3 = = Assessed as Meeting at Least Capability Category 11.

IE-A4 _ Assessed as Meeting at Least Capability Category 11.

IE-A5 Assessed as Meeting at Least Capability Category 11.

IE-A6 _ Assessed as Meeting at Least Capability Category 11.

IE-A7 = = Assessed as Meeting at Least Capability Category 11.

IE-A8 Temporary alignments were not explicitly investigated. No temporary alignments are known to affect the DG CT application.

IE-A9 Assessed as Meeting at Least Capability Category 11.

IE- N/A - (multi-unit site)

AI0 HLR-IE-B TE-BI = = Assessed as Meeting at Least Capability Category 11.

_IE-B2 _ Assessed as Meeting at Least Capability Category 11.

HLR-IE-B IE-B3 / Assessed as Meeting at Least Capability Category 11.

(cont'd)

IE-B4 _ Assessed as Meeting at Least Capability Category 11.

HLR-IE-C IE-CI _ = Assessed as Meeting at Least Capability Category II.

IE-C2 = = Assessed as Meeting at Least Capability Category 11.

IE-C3 / IE-C3-1 Conservative calculation of transient initiating event frequency does not impact the DG CT application.

IE-C4 = = = Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 70 of 98 Table 6-11 l _ ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INITIATING EVENTS (IE)

Capability Associated A & B Category Facts &

HIn Met Not SR I IM m I Met N/A Observations Disposition IE-C5 Assessed as Meeting at Least Capability Category 11.

IE-C6 Assessed as Meeting at Least Capability Category 11.

IE-C7 /IE-C7-1 ISLOCA model changes may influence the ISLOCA CDF and therefore the LERF, however this does not influence the l DG CT application.

IE-C8 = Assessed as Meeting at Least Capability Category 11.

IE-C9 / IE-C9-1 The initiating event for loss of switchgear room cooling appears to be inconsistent with the calculation. This does not influence the DG CT application.

IE-CIO = = = Assessed as Meeting at Least Capability Category 11.

IE-CI / Assessed as Meeting at Least Capability Category 11.

IE-C12 l _ Assessed as Meeting at Least Capability Category 11.

HLR-IE-D IE-DI All documentation is met except for the guideline to document the assumptions. This is judged not to impact the DG CT application. (See also Section 3.2.)

IE-D2 / _ Assessed as Meeting at Least Capability Category 11.

IE-D3 = Assessed as Meeting at Least Capability Category 11.

IE-D4 _ Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 71 of 98 Table 6-12 ASSESSMENT OF SUPPORTING REQzUREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCES (AS)

Capability Associated A & B Category Facts &

IIRL SR I [ II I Met Not Met N/A Observations Disposition HLR-AS-A AS-Al _ Assessed as Meeting at Least Capability Category II.

AS-A2 / AS-A2-1, AS-A2-2 A conditional probability of a LOOP induced by a transient or LOCA is explicitly quantified, at a low conditional failure probability. A qualitative assessment of the BPA grid reliability indicates that this is appropriate for CGS. No further investigation for the DG CT is performed.

AS-A3 Assessed as Meeting at Least Capability Category 11.

AS-A4 AS-A4-1, AS-A4-2, ATWS related F&Os. These do not influence the DG CT AS-A44 application AS-A5 /AS-A5-3, AS-A54, #3: Conservative treatment of HPCS operation. A AS-A5-6 realistic treatment of HPCS would reduce the changes in risk metrics calculated for the DG CT application.

4: ISLOCA This does not influence the DG CT application.

5: Vent impact on operating systems verified during crew interviews to be tightly controlled. No impact.

AS-A6 V Assessed as Meeting at Least Capability Category II.

AS-A7 = Assessed as Meeting at Least Capability Category 11.

AS-A8 Assessed as Meeting at Least Capability Category 11.

AS-A9 Missing ATWS calculations to support the ATWS sequences may cause loss of HPCS given current procedures. This does not influence the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 72 of 98 Table 6-12 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR ACCIDENT SEQUENCES (AS)

Capability Associated A & B Category Facts &

lHRL SR I II m Met Not Met N/A Observations Disposition AS-A10 Assessed as Meeting at Least Capability Category II.

AS-A I I Assessed as Meeting at Least Capability Category 11.

HLR-AS-B AS-BI _ Assessed as Meeting at Least Capability Category 11.

AS-B2 AS-B2-2, AS-B2-3 Vent impacts associated with non-SBO and LOOP sequences. This does not influence the DG CT application.

AS-B3 AS-B3-1, AS-B3-2 SW XTIE credit for RPV injection is found to be potentially non-conservative but to have a negligibly small impact on the LOOP and SBO sequences. FV=7.2E-5 RAW = 1.1 for LOOP sequences. This does not influence the DG CT application.

AS-B4 V RISKMAN related issue; CGS uses NUPRA AS-B5 V Assessed as Meeting at Least Capability Category 11.

AS-B6 V Assessed as Meeting at Least Capability Category 11.

HLR-AS-C AS-Cl = Assessed as Meeting at Least Capability Category 11.

AS-C2 Assessed as Meeting at Least Capability Category 11.

AS-C3 Assessed as Meeting at Least Capability Category 11.

AS-C4 = Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 73 of 98 Table 6-13 ASSESSMENT OF SUPPORTING REQUIREMENT CAPARTTBIT CATEGORIES FOR SUCCESS CRITERTA (SC)

Capability Associated A & B Category Facts &

HLR SR I J II [ III Met Not Met N/A Observations Disposition HLR-SC-A SC-Al Assessed as Meeting at Least Capability Category II.

SC-A2 = Assessed as Meeting at Least Capability Category 11.

SC-A3 Assessed as Meeting at Least Capability Category 11.

SC-A4 Assessed as Meeting at Least Capability Category 11.

SC-A5 = Assessed as Meeting at Least Capability Category 11.

SC-A6 SC-A6-2, SC-A6-3 Missing ATWS calculations to support the ATWS sequences. This does not influence the DG CT application.

HLR-SC-B SC-B1l SC-B1-2, SC-B1-4, SW XTIE credit for RPV injection is found to be SC-B1-5 potentially non-conservative but to have a negligibly small impact on the LOOP and SBO sequences.

FV=7.2E-5, RAW = 1.1. This does not influence the DG CT application.

SC-B2 = Assessed as Meeting at Least Capability Category 11.

SC-B3 SC-B3-1 SW XTIE credit for RPV injection is found to be potentially non-conservative but to have a negligibly small impact on the LOOP and SBO sequences.

FV=7.2E-5, RAW = 1.1. This does not influence the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 74 of 98 Table 6-13 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SUCCESS CRITERIA (SC)

Capability Associated A & B Category Facts &

HLR SR I II m Met Not Met N/A Observations Disposition SC-B4 Assessed as Meeting at Least Capability Category II.

SC-B5 SC-B5-1 Missing ATWS calculations to support the ATWS sequences. This does not influence the DG CT application.

HLR-SC-C SC-C1 SC-Cl-I Increase the level of detail in the MAAP documentation to promote its understanding and use-ability. This does not influence the DG CT application.

SC-C2 SR is not applicable to CGS and does not impact the

__ ability to meet Capability Category II.

SC-C3 Documentation items that are expected to be part of the PRA documentation are not currently included.

Their absence in the CGS PRA documentation is judged not to impact the DG CT application.

SC-C4 Documentation items that are expected to be part of the PRA documentation are not currently included.

Their absence in the CGS PRA documentation is judged not to impact the DG CT application. This is the subject of a specific deterministic analysis and PRA sensitivity calculation.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 75 of 98 Table 6-14 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEM ANALYSIS (SY)

Capability l Associated A & B Category M Facts &

HLR SR I II m Met Not Met N IA Observations Disposition HLR-SY- SY-Al Assessed as Meeting at Least Capability Category 11.

A SY-A2 Assessed as Meeting at Least Capability Category 11.

SY-A3 Assessed as Meeting at Least Capability Category 11.

SY-A4 / Assessed as Meeting at Least Capability Category 11.

SY-A5 Assessed as Meeting at Least Capability Category 11.

SY-A6 Assessed as Meeting at Least Capability Category 11.

SY-A7 Assessed as Meeting at Least Capability Category 11.

SY-A8 $ SY-A8-1 Lack of component boundary definitions could influence the application of data. All listed failure modes not formally dispositioned. This does not influence the DG CT application SY-A9 Assessed as Meeting at Least Capability Category 11.

SY-A10 Super components are not used.

SY-All _ Assessed as Meeting at Least Capability Category 11.

SY-A12 Assessed as Meeting at Least Capability Category 11.

SY-A13 All listed failure modes not formally dispositioned. This does not influence the DG CT application.

SY-A14 / All listed failure modes not formally dispositioned. This does not influence the DG CT application.

SY-A 15 /Assessed as Meeting at Least Capability Category 1.

SY-A16 Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 76 of 98 Table 6-14 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEM ANALYSIS (SY)

Capability Associated A & B Category Facts &

HLR SR I II Met Not Met N/A Observations Disposition HLR-SY- SY-A17 SY-A17-2 RCIC back pressure assumption affects non LOOP and A non-SBO sequences. This does not influence the DG CT (cont'd) application. This is the subject of a specific deterministic analysis and PRA sensitivity calculations.

SY-A18 / Assessed as Meeting at Least Capability Category 11.

SY-A19 SY-A19-1 Changes response in LOCA accident sequences. This does not influence the DG CT application.

SY-A20 Assessed as Meeting at Least Capability Category 11.

SY-A21 Assessed as Meeting at Least Capability Category 11.

SY-A22 VI Assessed as Meeting at Least Capability Category 11.

HLR-SY- SY-B13/Assessed as Meeting at Least Capability Category 11.

B SY-B2 = Assessed as Meeting at Least Capability Category II.

SY-B3 Assessed as Meeting at Least Capability Category 11.

SY-B4 /Assessed as Meeting at Least Capability Category 11.

SY-B5 SY-B5-1 The chargers appear to receive credit for a specific AC bus transfer that may depend solely on DC availability.

Perform Sensitivity to account for DC battery dependency.

SY-B6 Assessed as Meeting at Least Capability Category 11.

SY-B7 AsdAssessed as Meeting at Least Capability Category 11.

SY-B8 = = Assessed as Meeting at Least Capability Category 11.

SY-B9 /Assessed as Meeting at Least Capability Category 11.

SY-B10 / Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 77 of 98 Table 6-14 (Continued) l__ _ ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR SYSTEM ANALYSIS (SY)

Capability Associated A & B Ca t egory Facts& l HLR SR II m - Met Not Met N/A Observations Disposition HLR-SY- SY-Bil / Assessed as Meeting at Least Capability Category 11.

B AssesseasMetingatLeastapabiliyCateory_11 (Cont'd) SY-B132 . Assessed as Meeting at Least Capability Category II.

SY-B13 _ Assessed as Meeting at Least Capability Category II.

SY-B134 Assessed as Meeting at Least Capability Category 11.

SY-B15 _ _ Assessed as Meeting at Least Capability Category 11.

_____SY-B16 __ /Assessed as Meeting at Least Capability Category 11.

HLR-SY- SY-C /Assessed as Meeting at Least Capability Category II.

SY-C2 /Assessed as Meeting at Least Capability Category 11.

_____SY-C3 __0______ Assessed as Meeting at Least Capability Category 1I.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 78 of 98 Table 6-15 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY (11R)

Capability Associated A & B Category Facts &

HLR SR I_ _II Met Not Met N/A Observations Disposition HLR-HR-A HR-Al / Formal review not observed or documented. This does

__ not influence the DG CT application.

HR-A2 _ _ Assessed as Meeting at Least Capability Category II.

HR-A3 Assessed as Meeting at Least Capability Category 11.

HLR-HR-B HR-B1 _ _/ Assessed as Meeting at Least Capability Category 11.

HR-B2 V Assessed as Meeting at Least Capability Category 11.

HR-Cl / Assessed as Meeting at Least Capability Category 11.

HR-C2 Formal review not observed or documented. This does not influence the DG CT application.

HR-C3 _ _ Assessed as Meeting at Least Capability Category 11.

HLR-HR-D HR-D1 _ / Assessed as Meeting at Least Capability Category I.

HR-D2 1 Assessed as Meeting at Least Capability Category 11.

HR-D3 ' Quality of written procedures not required to be evaluated for Capability Category 1. As part of the DG CT application, the procedures affecting RCIC, HPCS, and the Diesel Generator were reviewed and found to be of high quality and straightforward. Therefore, this does

_ _not influence the DG CT application.

HR-D4 = = = = Assessed as Meeting at Least Capability Category 11.

HR-D5 _ Assessed as Meeting at Least Capability Category 11.

HR-D6 Uncertainty on the individual HEPs is not provided.

This does not influence the DG CT application risk metric calculation.

HR-D7 / Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 79 of 98 Table 6-15 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR HUMAN RELIABILITY (HR)

Capability Associated A & B Category Facts &

HLR SR I l III 7 Met Not Met N/A Observations Disposition HLR-HR-E HR-El _ HR-El-i, HR-E1-2, #1: Documentation related issue. This does not influence HR-EI-3 the DG CT application.

2: ATWS accident response issue. This does not influence the DG CT application.

3: Interviews conducted subsequent to PRA Peer

__ . Review. See HRA sensitivities.

HR-E2 _ Assessed as Meeting at Least Capability Category 11.

HR-E3 HR-E3-1 Interviews conducted subsequent to PRA Peer Review.

See HRA sensitivities.

HR-E4 / No simulator observations. This does not influence the DG CT application. Subsequent to the PRA Peer Review, simulator observations of LOOP/SBO conditions were observed to confirm insights from crew interviews.

HLR-HR-F HR-F1 / Assessed as Meeting at Least Capability Category II.

HR-F2 / HR-F2-1, HR-F2-2, #1: Timings are reasonable and adequate for HRA.

HR-F2-3 Need updated analysis with specific references for some scenarios. This does not influence the DG CT application.

2 Vent timing is reasonable and adequate for HRA.

This does not influence the DG CT application.

3 DFP alignment is not significant for LOOP/SBOl FV=8.7E4, RAW= 1.0. This does not influence the

_ __ DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 80 of 98 Table 6-15 (Continued)

ASSESSMENT OFFqTPPORTTNr RVOTTIRFMFNT rAPABTYTTV CATEGORTFI FOR HTUMAN RETLABRTITV (fiRI l Capability Associated A & B lCategory lFacts &

HC LR SR I H In Met Not Met N/A Observations Disposition HLR-HR-G HR-G1 = - = = Assessed as Meeting at Least Capability Category 11.

HR-G2 _ _ Assessed as Meeting at Least Capability Category 11.

HR-G3 V HR-G3-1 HEPs significantly affecting the DG CT extension were re-evaluated with the Cause Based HRA Method subsequent to the Peer Review. (See HRA Sensitivity --

See HR-El)

HR-G4 HR-G4-1 ATWS related scenarios are affected. This does not influence the DG CT application.

HR-G5 HR-G5-1, HR-G5-2 H #1: Gathering basis for required action times occurred after the PRA Peer Review.

2 Gathering basis for required action times occurred after the PRA Peer Review.

Sensitivity case to reflect the revised results. (See HRA l_ Sensitivity - See HR-El)

HR-G6 _ Assessed as Meeting at Least Capability Category 11.

HR-G7 / Assessed as Meeting at Least Capability Category 11.

HR-G8 HR-G8-1 Establish a minimum HEP that should be applied to combinations of HEPs and develop a sensitivity to l_ incorporate this minimum. (See HRA Sensitivity.)

HR-G9 / No uncertainty quantification. This does not influence

_ _ I the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 81 of 98 Table 6-15 (Continued)

ASSESSMENT OF SUPPORTING REQUIREME T CAPABILITY CATEGORIES FOR HTUMAN RELIABILITY (RR)

Capability Associated A & B Category Facts &

HLR SR I II e Met N N/A Observations Disposition HLR-HR-H HR-H1 / Assessed as Meeting at Least Capability Category II.

HR-H2 HR-H2-1 Recovery factors are potentially optimistic for the non-LOOP non-SBO sequences. Assessed as Meeting at Least Capability Category II.

HR-H3 / Assessed as Meeting at Least Capability Category II.

HLR-HR-I HR-I1 Documentation does not enumerate each of the SR guidelines. This does not influence the DG CT

__ application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 82 of 98 Table 6-16 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS (DA)

Capability Associated A & B Category Facts &

HLRSR I II Met Not met N/A Observations Disposition HLR-DA-A DA-Al = Assessed as Meeting at Least Capability Category 11.

DA-A2 / Assessed as Meeting at Least Capability Category 11.

DA-A3 V Assessed as Meeting at Least Capability Category 11.

HLR-DA-B DA-BI VI DA-B1-1 Recalculate the failure rates for components which are inappropriately grouped for the purpose of combining plant specific data. Perform a sensitivity to establish the risk metric changes.

DA-B2 Assessed as Meeting at Least Capability Category 11.

HLR-DA-C DA-Ci / Assessed as Meeting at Least Capability Category 11.

DA-C2 V Assessed as Meeting at Least Capability Category 11.

DA-C3 Assessed as Meeting at Least Capability Category II.

DA-C4 A formalized, clear definition of a "failure" to be used in the data evaluation was not identified. This may lead to some conservative assignments of failures and thereby calculated failure rates.

DA-C5 = Assessed as Meeting at Least Capability Category 11.

DA-C6 Assessed as Meeting at Least Capability Category 11.

DA-C7 Assessed as Meeting at Least Capability Category II.

DA-C8 / Assessed as Meeting at Least Capability Category 11.

DA-C9 Assessed as Meeting at Least Capability Category 11.

DA-CIO / The treatment of test demands may differ slightly from the ASME Standard. No significant change in risk metrics is anticipated to result from these differences.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 83 of 98 Table 6-16 (Continued)

ASSF.._ .,NT OF SUIPPORTING RFOTTRFMFNT CAPABILITY CAT.GORES FOR DATA ANAINSUR MAI Capability Associated A & B Category Facts &

HLR SR I 11 m Met Not met N/A Observations Disposition DA-C I I Assessed as Meeting at Least Capability Category 11.

DA-C12 Assessed as Meeting at Least Capability Category 11.

DA-C13 Coincident outage times for key equipment are not calculated based on actual plant experience or generic information. This may result in a small non-conservatism in the risk metrics for the base model and the DG CT application. Coincident outages on the DGs could be added to both of the risk calculations. The delta risk is expected to be only slightly affected. A sensitivity case could be performed to demonstrate this. Add coincident DG outages of DGs I & 2, DGs I & 3, DGs 2 & 3.

DA-C14 Repair times are not collected on a plant specific basis.

No repair is included in the CGS PRA model except for offsite power and DGs, which are based on recognized industry sources. In total, this approach may result in some conservatisms in the model. These may result in a conservative bias of the risk metrics in the DG CT

_ _ application.

DA-C15 Assessed as Meeting at Least Capability Category 11.

HLR-DA-D DA-DI V DA-DI-I Unavailabilities for individual trains are calculated in a conservative fashion. These may result in a conservative bias of the risk metrics in the DG CT application.

DA-D2 Assessed as Meeting at Least Capability Category II.

DA-D3 Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 84 of 98 Table 6-16 (Continued) l_____ ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR DATA ANALYSIS (DA)

Capability Associated A & B Category Facts& J HLRSR II Met Not met N/A Observations Disposition DA-D4 Bayesian updating of data was used in the CGS PRA. No formalized tests or examinations were performed to confirm the accuracy of the Bayesian update. The PRA Peer Review did not identify any Bayesian update anomalies nor are any expected that would affect the DG CT application.

DA-D5 Assessed as Meeting at Least Capability Category II.

DA-D6 _ No plant specific screening of CCF probabilities is performed. Plant specific screening and mapping has been shown to generally result in reduced conservatism.

The use of these may result in a conservative bias of the risk metrics in the DG CT application.

DA-D7 Assessed as Meeting at Least Capability Category 11.

DA-D8 /Plant specific repair data is not used. These may result in a conservative bias of the risk metrics in the DG CT application.

HLR-DA-E DA-El Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 85 of 98 Table 6-17 l____ ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD (IF)

Capability Associated A & B Category Facts &

lILR SR I 11 I1 Met Not Met N/A Observations Disposition HLR-IF-A IF-Al / Assessed as Meeting at Least Capability Category 11.

IF-A2 . Assessed as Meeting at Least Capability Category II.

IF-A3 V Assessed as Meeting at Least Capability Category 11.

IF-A4 = Assessed as Meeting at Least Capability Category II.

HLR-IF-B IF-BI Assessed as Meeting at Least Capability Category II.

IF-B2 Assessed as Meeting at Least Capability Category II.

IF-B3 Assessed as Meeting at Least Capability Category II.

IF-B4 Assessed as Meeting at Least Capability Category I.

HLR-IF-C IF-Cl . Assessed as Meeting at Least Capability Category II.

IF-C2 / Assessed as Meeting at Least Capability Category II.

IF-C3 Assessed as Meeting at Least Capability Category II.

IF-C4 Assessed as Meeting at Least Capability Category II.

IF-C5 == / Assessed as Meeting at Least Capability Category II.

IF-C6 V Assessed as Meeting at Least Capability Category II.

HLR-IF-D IF-DI Assessed as Meeting at Least Capability Category II.

IF-D2 Assessed as Meeting at Least Capability Category II.

IF-D3 . Assessed as Meeting at Least Capability Category II.

IF-D4 CGS is not a multi-unit site.

IF-D5 I / Assessed as Meeting at Least Capability Category 11.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 86 of 98 Table 6-17 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR INTERNAL FLOOD (IF)

Capability Associated A & B Category Facts &

lHLR SR I II II Met Not Met N/A Observations Disposition HLR-IF-E IF-El Assessed as Meeting at Least Capability Category II.

IF-E2 Assessed as Meeting at Least Capability Category 11.

IF-E3 Assessed as Meeting at Least Capability Category II.

IF-E4 Assessed as Meeting at Least Capability Category II.

IF-E5 / IF-E5-1 The HEP derivation for isolation of the flood source could be better documented. This is not expected to affect the base model or the DG CT application.

IF-E6 Assessed as Meeting at Least Capability Category II.

IF-E7 /IF-E7-1 The Level 2 accident treatment of internal floods appears conservative. These sequences do not affect the DG CT

__ _ _application.

HLR-IF-F IF-Fl Assessed as Meeting at Least Capability Category II.

IF-F2 Assessed as Meeting at Least Capability Category II.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 87 of 98 Table 6-18 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION (QU)

Capability Associated A & B Category Not Facts &

HRL SR I II III Met Met N/A Observations Disposition HLR-QU-A QU-A1 _ _ Assessed as Meeting at Least Capability Category II.

QU-A2 = = = Assessed as Meeting at Least Capability Category II.

QU-A3 _ Assessed as Meeting at Least Capability Category II.

QU-A4 Assessed as Meeting at Least Capability Category II.

HLR-QU-B QU-B1I _ _ Assessed as Meeting at Least Capability Category II.

QU-B2 = = = Assessed as Meeting at Least Capability Category II.

QU-B33 VI Assessed as Meeting at Least Capability Category II.

QU-B4 _ V Assessed as Meeting at Least Capability Category II.

QU-B5 _/ Assessed as Meeting at Least Capability Category II.

QU-B6 VI = Assessed as Meeting at Least Capability Category II.

QU-B7 __ Assessed as Meeting at Least Capability Category II.

QU-B8 _ Assessed as Meeting at Least Capability Category II.

QU-B9 Modules are not used in the CGS PRA.

HLR-QU-C QU-C1 __ Assessed as Meeting at Least Capability Category II.

QU-C2 QU-C2-1 Assessed as Meeting at Least Capability Category II.

HRA dependency addressed with sensitivity calculation.

QU-C3 Assessed as Meeting at Least Capability Category 11.

HLR-QU-D QU-D1 VI Assessed as Meeting at Least Capability Category II.

QU-D2 QU-D2-1 There is a conservative assessment of HPCS viability applied in the model. This may introduce a conservative bias in the DG CT application risk metric calculations.

(See AS-A5)

QU-D3 =- Assessed as Meeting at Least Capability Category II.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 88 of 98 Table 6-18 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR QUANTIFICATION (Q)1 l Capability Associated A & B

_ Category Not Facts &

R SR I _ m Met Met N/A Observations Disposition QU-D4 QU-D4-1 Certain long term loss of DHR sequences are treated non-conservatively. This does not significantly affect the DG l__ _CT application.

l QU-D5 Assessed as Meeting at Least Capability Category II.

HLR-QU-E QU-E13 Assessed as Meeting at Least Capability Category 11.

QU-12 _ __ Assessed as Meeting at Least Capability Category 11.

QU-E33 Assessed as Meeting at Least Capability Category 11.

QU-24 Key model uncertainties are not enumerated. This does l_ . not influence the DG CT application.

HLR-QU-F QU-F1 Assessed as Meeting at Least Capability Category 11.

QU-F2 _Assessed as Meeting at Least Capability Category 11.

QU-F3 /Key model uncertainties are not enumerated. This does Inot influence the DG CT application.

QU-F4 /Documentation of asymmetries was not performed. This l_ does not influence the DG CT application.

QU-F5 Assessed as Meeting at Least Capability Category 1I.

QU-F6 / Key model uncertainties are not enumerated. This does not influence the DG CT application. All limitations of the winNUPRA code are documented in the winNUPRA Users manual. All limitations must be observed in all modules for all applications. Model implementation l___ limitations are not included in the documentation.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 89 of 98 Table 6-19 ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF ANALYSIS (LE)

_ Associated A & B Not Facts &

HLR SR I H IIm Met Met N/A Observations Disposition HLR-LE-A LE-Al / Assessed as Meeting at Least Capability Category 11.

LE-A2 / Assessed as Meeting at Least Capability Category 11.

LE-A3 $ Assessed as Meeting at Least Capability Category 11.

LE-A4 / LE-A4-1, LE-A4-2 Assessed as Meeting at Least Capability Category 11. (See (Duplicate) LE-C9, IF-E7-1)

LE-A5 _ _ Assessed as Meeting at Least Capability Category 11.

HLR-LE-B LE-Bi / Assessed as Meeting at Least Capability Category I.

LE-B2 LE-B2-1 The ex-vessel steam explosion may be conservatively treated in the Level 2 model. This may conservatively bias the LERF risk metric in the DG CT application. However, the ICLERP and delta LERF risk metrics should be evaluated in a sensitivity case with the ex-vessel steam explosion probability reduced.

HLR-LE-C LE-CL / NUREG/CR-6595 type LERF evaluation.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 90 of 98 Table 6-19 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF ANALYSIS (LE)

Associated A & B Not Facts &

TILR IIRSSR I I I HI I I Met Met N/A Observations Disposition LE-C2 LE-C2-1 The HRA implementation in the Level 2 is thought to be generally conservative. However, dependencies are treated in an approximate manner. There would be some small impact on the DG CT application. Consistent with ASME PRA Standard Addendum A as updated in RG 1.200, the guidelines and capability category affected by use of a NUREG/CR-6595 type LERF analysis. Capability Category I is all that is allowed to be assigned.

A sensitivity involving the following is performed:

Set HEPs to 0.9

Set system nodes to 0.5.

Assess the impact on A LERF and ICLERP.

LE-C3 V LE-C3-2 The use of arbitrary availability numbers for train availability and their treatment as independent failures is non-conservative. Some already low frequency contributors to LERF are reduced even further. This does not significantly influence the DG CT application.

LE-C4 V LE-C4/C5-1, LE- The use of arbitrary availability numbers for train C4-2 availability and their treatment and independent failures is non-conservative. Some already low frequency contributors to LERF are reduced even further. This does not influence the DG CT application.

LE-C5 / LE-C4/C5-1 The use of arbitrary availability numbers for train availability and their treatment as independent failures is non-conservative. Some already low frequency contributors to LERF are reduced even further. This does not influence the DG CT application.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 91 of 98 Table 6-19 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF ANALYSIS (LE) l jAssociated Not A &B Facts &

HLR SR I H m Met Met N/A Observations Disposition LE-C6 LE-C2- 1 The HRA implementation in the Level 2 is thought to be generally conservative. However, dependencies are treated in an approximate manner. There would be some small impact on the DG CT application. Consistent with ASME PRA Standard Addendum A as updated in RG 1.200, the guidelines and capability category affected by use of a NUREG/CR-6595 type LERF analysis. Capability Category I is all that is allowed to be assigned.

A sensitivity involving the following is performed:

Set HEPs to 0.9

Set system nodes to 0.5.

__ _ Assess the impact on A LERF and ICLERP.

LE-C7 /LE-C7-2 Level 1 dependencies are transferred into Level 2 in an approximate manner. Level 2 dependencies are generally treated explicitly. This does not influence the DG CT

__ application.

LE-C8 / NUREG/CR-6595 type LERF evaluation.

LE-C9 LE-A4-1 NUREG/CR-6595 type LERF evaluation.

LE-CIO Assessed as Meeting at Least Capability Category 11.

HLR-LE-D LE-DI LE-DI-I The ex-vessel steam explosion may be conservatively treated in the Level 2 model. This may conservatively bias the LERF risk metric in the DG CT application, but requires a sensitivity case to assess the ICLERP impact.

Assessed as Meeting at Least Capability Category 11.

LE-D2 /Assessed as Meeting at Least Capability Category 11.

LE-D3 /Assessed as Meeting at Least Capability Category II.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Attachment 6 Page 92 of 98 Table 6-19 (Continued) l ~~ASSEDS MENST OF SUPPOIRTING REQUIREMENT CAPABILITY CAT EGORIES FOR LERF ANALYSIS (LE)l Associated A & B Not Facts &

SLR I II III Met Met N/A Observations Disposition LE-D4 / N/A PWR related LE-D5 /N/A PWR related LE-D6 Assessed as Meeting at Least Capability Category 11.

HLR-LE-E LE-EI Assessed as Meeting at Least Capability Category 11.

LE-E2 = LE-A4-4 NUREG/CR-6595 type LERF evaluation.

LE-E3 LE-E3-1 Level 2 (LOOP Sequences) has not been updated to Revision 5 Level 1. This update would need to be

__ completed for the DG CT extension.

LE-EX " NUREG/CR-6595 type LERF evaluation.

HLR-LE-F LE-F1 LE-F1-1 Documentation related item. This does not influence the

__ DG CT application.

LE-F2 LE-F2-1 Uncertainty not performed. This does not influence the DG l_ _ _CT application.

HLR-LE-G LE-GI Assessed as Meeting at Least Capability Category 11.

LE-G2 _ Assessed as Meeting at Least Capability Category 11.

LE-G3 Assessed as Meeting at Least Capability Category 11.

LE-G4 Assessed as Meeting at Least Capability Category 11.

HLR-LE-G LE-G5 LE-G5-4 Documentation and sensitivities not performed. This is (cont'd) judged not to appreciably influence the DG CT application calculated risk metrics.

LE-G6 Z LE-G5-1 Documentation and sensitivities not performed. This is judged not to appreciably influence the DG CT application calculated risk metrics.

LE-G7 / LE-G5-1 Documentation and sensitivities not performed. This is judged not to appreciably influence the DG CT application calculated risk metrics.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 93 of 98 Table 6-19 (Continued)

ASSESSMENT OF SUPPORTING REQUIREMENT CAPABILITY CATEGORIES FOR LERF ANALYSIS (LE)

Associated A & B Not Facts &

HLR SR I II m Met Met N/A Observations Disposition LE-G8 VLE-G5-1 Documentation and sensitivities not performed. This is

_ l G l l l

judged not to appreciably influence the DG CT application calculated risk metrics.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 94 of 98 5.0 IDENTIFICATION OF PRA PARTS USED TO SUPPORT THE APPLICATION The ASME PRA Standard (Reference 1) and the PSA Applications Guide (Reference 6) recommend consideration of the application in terms of the PRA elements that may be adversely impacted by the application.

Therefore, the analysis associated with a PRA application involves the identification of the PRA elements or Supporting Requirements affected by the issue being evaluated. This includes (1) identification of the specific PRA model elements impacted, (2) an assessment of the portions of the model that are influential in the application, and (3) identification of supplemental tools and methods which could be used to support the application.

The first item involves the identification of the affected portions of the model. The second item involves the assessment of how much of the PRA needs to be manipulated as part of the application. That is, can the issue be treated as part of an integrated PRA model or can/should it be evaluated separately? The third item considers whether additional PRA modeling is needed to supplement the existing models or if deterministic methods are needed and can be used to supplement the PRA.

A cause and effect evaluation applicable to the Diesel Generator CT extension was performed.

The following summarizes the conclusion from the cause and effect evaluation:

1. PRA model elements impacted by the Diesel Generator CT extension.

PRA Structures Systems Components (SSC):

The implementation of the DG CT includes the following:

A change to one parameter of the PRA, that is, the test and maintenance unavailability of each system protected during the DG CT extension (DGs, SSW, HPCS, and RCIC).

A plant modification implemented in parallel with the DG CT is the Alternate AC Source to the Division 1 & 2 Battery Chargers (AASCBC). It allows longer recovery times for AC power and improves the mission times for RCIC, and ADS.

Changes in allowed out of service of other equipment are coincident with the extended DG CT.

Initiating Events: Initiating Event frequencies or groups are not changed.

Success Criteria: No changes in success criteria are imposed.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 95 of 98 Event Trees: The event trees were modified to remove excess conservatisms, but are not impacted by the application.

System Reliability Models: Systems remain the same. The availability of the diesels is slightly decreased.

Parameter Data Base: No data changes are appropriate except the on-line unavailability of the diesels.

Dependent Failure Analysis: No new dependencies are created.

Human Reliability Analysis: No operator actions require change. However, the change in the plant to provide an alternate AC power source does require crew actions for alignment.

This, therefore, requires a new HRA evaluation to support its probabilistic assessment in the model.

Quantification: Quantification process is unaffected.

Analysis of Results: The importance of contributors to risk metrics is changed. The most important SSCs related to the application are identified as follows:

Diesel generators DG room coolers DG-SW cooling AC load breaker, relays and the control circuits that control them Batteries ADS HPCS RCIC Other important contributors to changes in the risk metrics include:

LOSP initiating event frequency AC power non-recovery probabilities RCIC control actions Level 2 (Containment Analysis PSA): No Level 2 systems or functions are modified.

Level 3 (Consequence Analysis PSA): No radionuclide release dose impacts given a release are expected to change.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 96 of 98 External Events PSA (Hazard Analysis): No appreciable change in fire or seismic risk metrics are considered to derive from the application.

Shutdown PSA: The risk associated with shutdown is expected to decrease due to increased diesel availability during outages.

2. Portions of the model that are to be used to support the risk metric changes.

The only portion of the model that is changed as part of the extended DG CT implementation is the diesel unavailability and certain risk management actions of which the Alternate AC Source, AACSBC, is the dominating feature. The at-power internal events PRA model can be recalculated to assess the risk metrics.

The primary influence of the change in DG unavailability is associated with the loss of offsite AC power sequences. Therefore, these sequences and the associated SSC modeling including crew actions are the PRA items of greatest influence on the CDF assessment. F&Os that affect these Level 1 sequences are investigated for their impact on decision-making for this application (See Sections 4.2 and 4.3).

The Level 2 evaluation is slightly different in that most of the Level 2 modeling is "tested" by the resulting loss of offsite AC power sequences. However, most of the loss of offsite AC power sequences lead to "late" accident sequences and non-LERF contributors. For the LERF contributors, the RG 1.200 Peer Review has identified that there are some conservatisms (e.g.,

ex-vessel steam explosion probability) that may mask the ICLERP for the short term (early) SBO sequences. Sensitivity cases are used to support the evaluation of this potential effect on risk metrics.

3. Identification of supplemental tools and methods.

The base PRA model is found to be robust and at the Capability Category II level for the critical Supporting Requirements or there is justification to support deviations from Capability Category II. (See Section 4 and Attachment 5).

A supplemental model to account for the positive effect of the Alternate AC Source to the Division 1 & 2 Battery Chargers (AASCBC) was developed. It allows longer recovery times for AC Power and improves the mission times for RCIC and ADS.

No other supplemental models or tools are required for the application evaluation.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 97 of 98 6.0PRA QUALITY

SUMMARY

The quality of data, inputs, modeling, and documentation of the CGS PRA models has been demonstrated by the foregoing discussions on the following aspects:

Level of detail in PRA

Maintenance of the PRA

Comprehensive critical reviews

Cause and effect relationship Results of previous internal and external reviews have identified various items that could be modified in the models. These items have been incorporated in the model or are judged to not discernibly affect the change in risk metrics associated with the DG CT extension change. The CGS Level 1 and Level 2 PRAs provide the necessary and sufficient scope and level of detail to allow the calculation of ACDF and ALERF changes and the ICCDP and ICLERP for the Diesel Generator CT extension risk-informed application as supported by the sensitivity cases identified as part of the resolution of PRA peer review comments.

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO. NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 98 of 98

7.0 REFERENCES

[1] ASME RA-SA-2003, Addenda to ASME RA-S-2002, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, December 2003.

[2] BWROG PSA Peer Review Certification Implementation Guidelines, January 1997.

[3] WNP-2 PRA Peer Review Certification Report, GE Document BWROG/PRA-97-08, November 1997.

[4] NRC Draft Regulatory Guide, RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, (Draft) December 2003.

[5] Columbia Generating Station PRA Peer Review Report Using ASME PRA Standard Addendum A and RG 1.200 (Draft), December 2003.

[6] D.E. True, et. al., PSA Application Guide, EPRI-TR-105396, dated August 1995.

[7] INEL-94/0064, Common-Cause Failure Data Collection and Analysis System, Volume 6-Common-Cause Failure Parameter Estimation, Idaho National and Engineering Laboratory, dated December 1995.

[8] W.T. Pratt, et. al., An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, NUREG/CR-6595, Revision 1, dated August 2003.

[9] NUREG/CR-5497, Common-Cause Failure Parameter Estimation, Idaho National and Engineering Laboratory, dated October 1998

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO.

NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 1 of 2 Attachment 7 RISK MANAGEMENT ACTION COMMITMENTS FOR THE EXTENDED DG CT

_4- . , - *-I_

APPLICATION FOR AMENDMENT OF FACILITY OPERATING LICENSE NO.

NPF-21 FOR EXTENSION OF DIESEL GENERATOR COMPLETION TIME Page 2 of 2 Location of Risk Management Commitment Actions Commitment for the extended DG CT , The design of the AACSBC includes permanent cabling from a 480 volt DG Page 9 to a load center in the area of the battery rooms. Distribution will be from the load center to key lock transfer switches associated with the Division 1 250 volt and 125 volt battery chargers and the Division 2 125 volt battery charger will also be permanently installed. The key lock transfer switches will allow manual transfer from the normal Class 1E bus to the AACSBC. , Until the permanent portions of AACSBC are installed, the use of the Page 10 extended CT will only be used if temporary cabling, control panel, and wiring are pre-staged prior to exceeding the 72-hour CT for establishing the risk management action. , The DG extended CT will not be entered for scheduled maintenance purposes Page 18 if severe weather conditions are expected. , The condition of the offsite power supply and transmission yard, including Page 18 transmission lines and the stability of the Federal Columbia River Transmission System, will be evaluated through contact with the BPA dispatcher. , No elective maintenance will be scheduled within the transmission yard that Page 18 would challenge the TR-S or TR-B connections or offsite power availability during the proposed extended DG CT. , Operating crews will be briefed on the DG work plan, with consideration Page 18 given to key procedural actions that would be required in the Loss Of Offsite Power (LOOP) or SBO. , While in the proposed extended DG CT, the following systems are risk Page 18 significant during the extended DG CT period and will be protected so that elective maintenance and testing are not performed:

Cross train DGs and their respective Service Water Systems TR-S and TR-B and the associated breakers and relay logic (protective and control)

HPCS system RCIC system , While in the proposed extended DG CT, additional elective equipment Page 18 maintenance or testing that requires any other risk significant equipment to be removed from service will be evaluated and activities that yield unacceptable results will be avoided. , Emergent conditions that result in the protected systems being challenged will Page 18 be managed to minimize the risk impact.

ML041540545

Text

SUBJECT:

REFERENCES:

Dear Sir or Madam:

Subject:

1.0 INTRODUCTION

SUMMARY

3.0 BACKGROUND

11.0 CONCLUSION

SUMMARY

8.0 CONCLUSION

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

Conclusion:

SUMMARY

8.0 CONCLUSION

1.0 INTRODUCTION

SUMMARY

7.0 REFERENCES

1.0 INTRODUCTION

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

SUMMARY

7.0 REFERENCES

Navigation menu

Search