Text

Additional Information Supporting Third Ten-Year Inservice Inspection (ISI) Interval Relief Request ISI-3-1 Request to Use Risk-Informed Inservice Inspection (Ri ISI)
	ML042610214
Person / Time
Site:	San Onofre
Issue date:	09/15/2004
From:	Scherer A; Southern California Edison Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML042610214 (59)
	v • d • e

SOUTHERN CALIFORNIA A. Edward Scherer ED ISON C Manager of Nuclear Regulatory Affairs An EDISON 1 TERN~ATIONAL~t Company September 15, 2004 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

Subject:

Additional Information Supporting Third Ten-Year Inservice Inspection (ISI) Interval Relief Request ISI-3-1 Request to Use Risk-informed Inservice Inspection (RI ISI)

San Onofre Nuclear Generating Station Units 2 and 3

Reference:

Letter from A. E. Scherer (SCE) to the Document Control Desk (NRC) dated July 2, 2003;

Subject:

Docket Nos. 50-361 and 50-362, Notification of Updating the Inservice Inspection Program and Submittal of Relief Requests for the Third 10-Year Inspection Interval, San Onofre Nuclear Generating Station Units 2 and 3

Dear Sir or Madam,

This letter provides additional information to support the Southern California Edison (SCE) Relief Request ISI-3-1, Request to Use Risk-Informed Inservice Inspection (RI ISI), which was submitted as part of the referenced American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code update.

In telephone discussions between the NRC staff and SCE staff, the NRC requested additional information to support the NRC review of ISI-3-1 and the associated WCAP-15882-NP, -RI ISI Program for Class 1 Piping at SONGS 2 & 3." Enclosed with this letter are the questions and answers that were discussed with the NRC staff.

P.O. Box 128 San Clemente, CA 92674-0128 949-368-7501 Fax 949-368-7575

Document Control Desk September 15, 2004 Should you have any questions, please contact Mr. Jack Rainsberry, Manager, Plant Licensing at (949) 368-7420.

Sincerely, Enclosure cc: B. S. Mallett, Regional Administrator, NRC Region IV B. M. Pham, NRC Project Manager, San Onofre Units 2, and 3 C. C. Osterholtz, NRC Senior Resident Inspector, San Onofre Units 2 and 3

ENCLOSURE Responses to RAIs to Support San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 Relief Request ISI-3-1

RESPONSES TO RAIS TO SUPPORT SAN ONOFRE NUCLEAR GENERATING STATION (SONGS) UNITS 2 AND 3 RELIEF REQUEST ISI-3-1 Question 1:

Regarding Table 3.3-1 "Degradation Mechanism Assessment Summary," please explain why stress corrosion cracking (SCC) and/or thermal transient (fatigue) are not addressed as potential failure mechanisms for the CVCS (Chemical and Volume Control System) and SIS (Safety Injection System). How will the failure probability be affected when they are considered as potential degradation mechanisms?

Response 1:

For the CVCS (Chemical and Volume Control System), thermal transients (TT) are listed in Table 3.3-1 as the primary cause of degradation due to thermal fatigue. For the SIS (Safety Injection System), thermal transients should have been included in addition to Thermal Stratification, Cycling and Striping (TASCS) as contributing to degradation due to thermal fatigue.

The potential for primary water stress corrosion cracking (PWSCC) is discussed in the response to Question 3 and Table 3.3-1 of the RI-ISI Program Evaluation report (WCAP-1 5882-NP) is updated to reflect these changes. The influence of these changes on the core damage frequency and large early release frequency is included in the response to Question 9.

Table 3.3-1 Degradation Mechanism Assessment Summary for SONGS Units 2 and 3 Thermal Stress Corrosion Cracking Local Corrosion Flow Sensitive System Fati que TT TASCS IGSCC TGSCC ECSCC PWSCC MIC Pitting CC E-Cav FAC RCS X X X _

CVCS X X X =

AS X X X SIS X X X SDC X X =

Nomenclature:

RCS - Reactor Coolant System, CVCS - Chemical and Volume Control System. MS - Main Spray, AS - Auxiliary

Spray, SIS - Safety Injection System, SDC -Shutdown Cooling, TT - Thermal Transient, TASCS - Thermal Stripping, Cycling and Stratification, IGSCC - Intergranular Stress Corrosion Cracking, TGSCC - Transgranular Stress Corrosion Cracking, ECSCC - External Chloride Stress Corrosion Cracking, PWSCC - Primary Water Stress Corrosion Cracking, MIC - Microbiologically Influenced Corrosion, Pitting - Pitting, CC - Crevice Corrosion Cracking, E-Cav -Cavitation, FAC - Flow Accelerated Corrosion.

Page I of 17

Responses to RAts to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Question 2:

Section 3.6 of the licensee's submittal addresses additional examinations. It states,

'The evaluation will include whether other elements on the segment or segments are subject to the same root cause and degradation mechanism. Additional examinations will be performed on these elements up to a number equivalent to the number of elements initially required to be inspected on the segment or segments. If unacceptable flaws or relevant conditions are again found similar to the initial problem, the remaining elements identified as susceptible will be examined. No additional examinations will be performed if there are no additional elements identified as being susceptible to the same service related root cause conditions or degradation mechanism.'

ASME Code directs licensee's to perform these sample expansions in the current outage. Confirm that the sample expansions of elements identified as being susceptible to the same service related root cause conditions or degradation mechanism will be completed during the outage that identified the flaws or relevant conditions.

Response 2:

SCE confirms that the sample expansions of elements identified as being susceptible to the same service related root cause conditions or degradation mechanism will be completed during the outage that identified the flaws or relevant conditions.

Question 3:

WCAP-1 5882-NP - p. 4 of 20. There are 73 Category 2 welds in the Unit 2 Reactor Coolant System (RCS) and 67 Category 2 welds in the Unit 3 RCS. Some are referred to as "bimetallic welds.' In the element selection process, only two of the highest risk welds (Category 2) in RCS were selected to monitor the effects of PWSCC, while the remainder of these high risk welds (18 for Unit 2 and 17 for Unit 3) were selected, but are only for thermal fatigue mechanism. Please provide information regarding the type of materials of the weld and the environment. Please explain how many of the 73 plus 67 welds are the so-called bimetallic welds, and how many are susceptible to PWSCC.

Please also explain why the selection of 2 welds is a reasonable ratio for PWSCC.

Response 3:

Locations of bimetallic weld joints in primary system components have been identified for each Combustion Engineering (C-E) designed nuclear steam supply system (NSSS) and discussed in CE NPSD-1211-P, Revision 1, Identification of Bi-metallic Weld Locations in C-E NSSS Primary Components." The number, location and materials for the bimetallic welds are listed in Tables 3-1A and 3-1 B for San Onofre Nuclear Generating Station Units 2 and 3, respectively. In all cases, the bimetallic welds are subject to operating pressure and temperatures at or above 5400 F of the reactor coolant system at normal chemistry conditions.

Page 2 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 Relief Request ISI-3-1 Table 3-1A SONGS Unit 2 Class I Piping Bimetallic Welds

. . t I Part/Nozzle Material Safe End Material ePart/NozzI Buttering Weld Filler PRIMARY PIPING RCP Suction to Reactor Coolant (RC) 4 SA-516 Gr. 70 SA-351 Gr. CF8M 182 182 Pipe _ _ _

RCP Discharge to RC Pipe 4 SA-516 Gr. 70 SA-351 Gr. CF8M 182 182 RC Pipe Surge Nozzle 1 SA-508 Cl. 2 SA-351 Gr. CF8M 182 182 Cold leg: Letdown & Drain Nozzles 4 SA-105 Gr. II SA-182 F316 182 82/182 Hot leg: Drain Nozzle 1 SA-105 Gr. II SA-182 F316 182 82/182 Charging Inlet Nozzle 2 SA-182 F1 SA-182 F316 182 82/182 Safety Injection Nozzle 4 SA-182 F1 SA-351 Gr. CF8M 182 182 Shutdown Cooling Nozzle 1 SA-105 Gr. ll SA-351 Gr. CF8M 182 182 Spray Nozzle 2 SA-105 Gr. ll SA-182 F316 182 82/182 PRESSURIZER Surge Nozzle I SA-508 Cl. 2 SA-351 CF8M 182 182 Spray Nozzle I SA-508 Cl. 2 SA-182 F316 182 82/182 Safety Valve Nozzles 3 SA-508 Cl. 2 SA-351 CF8M 182 821182 REACTOR VESSEL Incore Instrumentation (ICI) Upper Weld; 10 Alloy 600 SA-1 82 F304 I 182 182 ftting to Greylock flange I I I Page 3 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 Relief Request ISI-3-1 Table 3-1B SONGS Unit 3 Class I Piping Bimetallic Welds DecipinQty Part/Nozzle Safe End IPart/Nozzl Weld l Ict Material Material e Butterng Filler PRIMARY PIPING RCP Suction to RC Pipe 4 SA-516 Gr. 70 SA-351 Gr. CF8M 182 182 RCP Discharge to RC Pipe 4 SA-516 Gr. 70 SA-351 Gr. CF8M 182 182 RC Pipe Surge Nozzle I SA-541 Cl. 1 SA-351 Gr. CF8M 182 182 Cold leg: Letdown & Drain Nozzles 4 SA-105 Gr. 11 SA-182 F316 182 821182 Hot leg: Drain Nozzle 1 SA-105 Gr. 11 SA-182 F316 182 821182 Charging Inlet Nozzle 2 SA-182 F1 SA-182 F316 182 82/182 Safety Injection Nozzle 4 SA-182 F1 SA-351 Gr. CF8M 182 82/182 Shutdown Cooling Nozzle I SA-541 Gr. I SA-351 Gr. CF8M 182 182 Spray Nozzle 2 SA-105 Gr. 11 SA-182 F316 182 82/182 PRESSURIZER Surge Nozzle I SA-508 Cl. 2 SA-351 CF8M 182 182 Spray Nozzle I SA-508 CL.2 SA-182 F316 182 182 Safety Valve Nozzles 3 SA-508 Cl. 2 SA-351 CF8M 182 182 REACTOR VESSEL ICI Upper Weld; fitting to Greylock 10 Alloy 600 SA-182 F304 182 182 flange I 10 lo 0 AI2P0 8 I 8 Breach of the RCS pressure boundary due to PWSCC would result in a high consequence and thus be defined as a category 2 risk segment. Certain locations would be susceptible to both PWSCC and thermal fatigue. Consequently, the risk segments provided in the original submittal have been revised. While not affecting the risk category, the increased rupture frequency for welds susceptible to PWSCC and thermal fatigue has been factored into the Arisk calculations.

As a result of the revised risk segments, the selection of two bimetallic welds would no longer be adequate, as indicated in the original submittal. In response to request for additional information (RAI) #3, one hundred sixty-six (166) risk category 2 welds were identified for SONGS Unit 2 and one hundred sixty-one (161) risk category 2 welds were identified for SONGS Unit 3. Thirty-eight of the risk category 2 welds were identified as bimetallic for each unit. Of the thirty-eight bimetallic welds, eighteen of these welds were selected to inspect for the effects of PWSCC under the RI-ISI program. The number of risk category 2 welds, the number of bimetallic welds, and the number of bimetallic welds selected for inspection are distributed among the systems as follows for SONGS Units 2 and 3:

Page 4 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 Relief Request ISI-3-1 Risk Category 2 Weld Population BWmetalic No. of Bimetallic Unit 2 Unit 3 Population ' Welds Selected (1)

RCS 84 78 28 12 CVCS 8 10 2 1 MS 18 12 3 2 AS 10 10 0 0 SIS 35 40 4 2 SDC 11 11 1 1 Total 166 161 38 18 Note 1: - Applicable to SONGS Units 2 and 3.

The revised risk segments are incorporated in the revised RI-ISI Program Evaluation report (WCAP-15882-NP).

Question 4:

WCAP-15882-NP - p. 5 of 20. There are six Category 5 shutdown cooling system (SDC) system welds (subject to thermal fatigue) but none were selected for inspection.

Please explain.

Response 4:

The degradation evaluation identified the welds in the SDC system as being susceptible to thermal transient (11), thermal stratification, cycling and striping (TASCS), and PWSCC. Two of the welds from the risk category 2 segments were selected to monitor for TT. Six welds were included in a single risk category 5 segment. The risk category 5 welds were also identified as being susceptible to TT. Ten percent of the risk category 5 welds is required to be selected for inspection under the RI-ISI altemative approach.

Because the welds in risk category 2 are more risk-significant than welds in risk category 5 and the number of risk category 2 welds selected to monitor for TT exceeds the twenty-five percent inspection requirement, no risk category 5 welds were selected in the original submittal. However, as part of the revised evaluation for the risk segments that was performed to respond to RAI #3 a risk category 5 weld is now selected to monitor for TT in the SDC system. The following two paragraphs were incorporated in the revised RI-ISI Program Evaluation report (WCAP-15882-NP) to provide additional clarification:

Page 5 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Regarding Unit 2:

uThree risk category 2 segments were identified for the Shutdown Cooling System (SDCS). The degradation mechanism evaluation for this system identified the welds in two of the risk category 2 segments as being susceptible to either TT or TASCS. The weld in the remaining risk category 2 segment was identified as being susceptible to both PWSCC and TT. Two risk category 2 welds were selected to monitor for TT, one weld was selected to monitor for TASCS, and one weld was selected to monitor for PWSCC and TT. One risk category 4 weld was also selected from the two risk category 4 segments that were identified for this system. TT was also identified as the degradation mechanism for the welds in the risk category 5 segment for this system. One risk category 5 weld was selected for this system.'

Regarding Unit 3:

'Three risk category 2 segments were identified for the SDCS. The degradation mechanism evaluation for this system identified the welds in two of the risk category 2 segments as being susceptible to either TT or TASCS. The weld in the remaining risk category 2 segment was identified as being susceptible to both PWSCC and TT. Two risk category 2 welds were selected to monitor for TT, one weld was selected to monitor for TASCS, and one weld was selected to monitor for PWSCC and TT. Two risk category 4 welds were also selected from the two risk category 4 segments that were identified for this system. TT was also identified as the degradation mechanism for the welds in the risk category 5 segment for this system. One risk category 5 weld was selected for this system."

Question 5:

Please identify the SONGS probabilistic risk assessment (PRA) used in support of the RI-ISI application by version and date.

Response 5:

The SONGS PRA is a living PRA in the actual sense in that it is continuously maintained and updated as model improvements, updated data, and corrections are identified. This is done to ensure that the PRA models reflect the as-built plant. Therefore, a model version identifier is not used at SONGS. Instead the date of the model is used. For the SONGS RI-ISI application, the date of the model used is October 2, 2001.

Page 6 of 17

Responses to RAIs to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Question 6:

Regulatory Guide (RG) 1.178, An Approach for Plant-Specific Risk-Informed Decision making for Inservice Inspection of Piping, Revision 1, dated September 2003, replaced the original TFor Trial Use" RG dated September 1998. Revision I of the RG 1.178 includes guidance on what should be included in risk informed-inservice inspection (Rl-ISI) submittals, particularly in dealing with probabilistic risk assessment (PRA) issues.

Specifically, on page 28 of RG 1.178, the following is stated regarding the information that should be included in a submittal:

A description of the staff and industry reviews performed on the PRA. Limitations, weakness, or improvements identified by the reviewers that could change the results of the PRA should be discussed. The resolution of the reviewer comments, or an explanation of the insensitivity of the analysis used to support the submittal to the comment, should be provided.

Your submittal mentions several different reviews of the SONGS PRA conducted since the individual plant evaluation (IPE), but not the IPE itself. The Staff Evaluation Report (SER) for the IPE appears to indicate no weaknesses with that document. Please confirm that this is your understanding, or indicate 1) what weaknesses were identified and 2) what was done to correct the identified weaknesses, or why the uncorrected weaknesses are not relevant to this application.

In addition, there is no specific mention of an owner's group (CEOG) peer certification of the SONGS PRA. Please confirm if this has or has not been completed. If it has, please identify any A or B level Facts and Observations, what was done to addresses them, or why the uncorrected Facts and Observations are not relevant to this application. If there has not been a CEOG certification review, please indicate SONGS' plans for one.

Finally, please indicate any findings equivalent to CEOG Certification A or B level Facts and Observations that were identified in the reviews noted in your submittal (e.g. -

comprehensive independent peer review 8/96 - 4/97, Westinghouse pre-certification evaluation February 2002, etc), as well as the disposition of these findings. If any findings have not yet been addressed, please explain why they are not relevant to this application.

Response 6:

a) One of the high-level purposes of the Individual Plant Examination, as identified in Generic Letter 88-20, was to identify any vulnerabilities to severe accidents initiated by internal events. Our conclusions from our examination were that SONGS 2/3 had no vulnerabilities and that plant modifications to address vulnerabilities were not warranted. These conclusions are in agreement with the SER.

Page 7 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 b) At the time of this submittal, the results of an owner's group peer review were not known. InJune 2003, a CEOG sponsored peer review team visited SONGS. The peer review was performed against the requirements of the ASME PRA Standard.

The facts and observations from the peer review were proprietarily published in November 2003. Attached are the A & B Facts and Observations (F & O's) from the peer review and the assessed impact of the F & 0 on the SONGS 2/3 RI-ISI application. Ingeneral, Edison has determined that the F & O's had either no impact or negligible impact on the RI-ISI application.

c) The issues/proposed changes identified in the comprehensive independent peer review performed between August 1996 and April 1997 were entered in SONGS PRA Punch List Database. The purpose of the punch list is to track proposed changes to the PRA. Each proposed change is given a priority from 1 to 10 with a priority 10 given immediate attention due to it's impact on the PRA's assumptions or results. Issues with priority 7- 10 are considered essentially equivalent to A and B F & Os. All priority 7 -10 issues identified in the comprehensive independent peer review have been incorporated into the model.

Question 7:

The paragraph at the bottom of page 2 of 3 of 10CFR50.55a Relief Request ISI-3-1 refers to Reference (3). Please confirm that it was intended to refer to Reference (2).

Also, page 3 of 3 of 10CFR50.55a Relief Request ISI-3-1 cites Reference (2) as UEPRI TR-1 1657...' Please confirm that Reference (2) is EPRI TR-1 12657. Finally, the last word in the top paragraph on page 3 of 20 in WCAP-15882-NP is testing". Please confirm that the word uinspection" was intended.

Response 7:

SCE confirms that the paragraph at the bottom of page 2 of 3 of 10CFR50.55a Relief Request ISI-3-1 it was intended to refer to Reference (2). Reference 2 is W. H. Bateman (U.S. NRC) to G. L.Vine (EPRI) letter dated October 28, 1999 transmitting 'Safety Evaluation Report Related to EPRI Risk-informed Inservice Inspection Evaluation Procedure (EPRI TR-112657, Revision B, July 1999)."

The last word in the top paragraph on page 2 of 20 in WCAP-15882-NP was intended to be uinspection" instead of 'testing." The change is incorporated in the revised RI-ISI Program Evaluation report (WCAP-15882-NP).

Page 8 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Question 8:

On page 3 of 20 in WCAP-15882-NP the bottom paragraph indicates that the direct effects associated with the rupture of any of the Class I piping (all of which is inside containment) cause a loss of reactor coolant initiating event. Following this statement is a discussion on indirect/spatial effects. Since detailed results of the consequence analysis were not provided in the submittal, please clarify if there were any other direct effects considered (e.g. - a loss of a train of injection associated with the rupture of some of the Class I emergency core cooling system (ECCS) piping segments along with the loss of reactor coolant IE, etc.)

Response 8:

The consequence evaluation for the Class I piping at SONGS Units 2 and 3 was performed based on the guidance provided in approved EPRI methodology. The evaluation focused on the failure impact of each piping segment (i.e., pressure boundary failure) on the capability of the system to perform its design function(s), and on the overall operation of each unit. Depending on its location, failure of a piping segment can result in an initiator (i.e., loss of coolant accident (LOCA)) and/or the loss or degradation of one or more trains of a mitigating system, such as the ECCS. Such impacts were considered in performing the consequence evaluation. For example, failure of a piping segment in an ECCS injection path (downstream of an ECCS injection check valve) would result in a large LOCA. The consequence evaluation assumed that in addition to the LOCA impact one ECCS injection path would be unavailable for delivering makeup to the RCS. The remaining three ECCS injection paths would be unaffected. The overall failure impact of this piping segment causes a large LOCA initiator and loss of one ECCS injection path to the RCS. The consequence evaluation for the Class 1 piping segments is summarized in plant documentation for each unit.

Question 9:

Page 3-85 of EPRI TR-1 12657 Rev. B-A discusses the quantitative guidelines on the change in risk. The EPRI topical states that,

"[t] he decision criteria that is used is to ensure that the cumulative change in CDF and LERF is less than IE-7 per year per system and 1E-8 per year per system, respectively. (If a Class I only evaluation is being performed per N560, then for the purpose of the risk impact assessment only, the Class I piping may be treated as a single system.) Those values are selected so that a potential screening of multiple systems would not impact the results, and that the requirements of RG 1.178 and RG 1.174 will still be met.

Page 9 of 17

Responses to RAIs to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 If the criteria are not met in the bounding risk analysis, a more realistic quantitative analysis should be performed. The numerical criteria are the same as in the bounding analysis. Those numerical criteria are based on the assumption that a full plant level RI-ISI program should strive to ensure that the cumulative risk impacts for the full plant are maintained at levels less than 1E-6 per year for CDF and IE-7 per year for LERF."

InTables 3.8-1A and B in WCAP-1 5882-NP, the risk impact for the RCS system exceeds the delta core damage frequency (CDF) guideline of 1E-7 per year per system. No further analysis was apparently performed to refine this delta CDF and no discussion is provided regarding exceeding the guideline. Please provide additional analysis and/or discussion demonstrating that the change in risk associated with implementation of the RI-ISI program at SONGS is consistent with the change in risk guidelines in the EPRI Topical.

Response 9:

The original submittal of the RI-ISI Program Evaluation (WCAP-15882-NP), which conservatively took no credit for increased probability of detection (POD), demonstrated that the plant level risk requirements are met with adequate margin. In response to RAI

9, the analyses were modified using the uSimplified Risk Quantification Method" described in Section 3.7 of EPRI TR-1 12657 Rev. B-A. This method credited the enhanced inspection effectiveness due to an increased POD from application of the RI-ISI approach. The simplified analyses were based on Equation 3-9 of EPRI TR-1 12657 Rev. B-A. The change in risk due to change in inspection effectiveness for a particular location was calculated using the following expression:

ACDFj = (Irj- lej)* Foj*CCDP (1)

Where:

ACDFj = Change in CDF for location j Irj = Inspection effectiveness factor under the RI-ISI program lej = Inspection effectiveness factor under the current ASME Section Xl program Foj = Rupture frequency per location without examination CCDP = Conditional core damage probability given a pressure boundary failure at location j Consistent with the approach in EPRI TR- 12657 Rev. B-A for calculating the change in risk, the inspection effectiveness factor is the equivalent to the complement of the POD (i.e., 1-POD). Equation (1) can then be expressed as:

ACDFj = (PODej- PODrj)*Foj *CCDP (2)

Page 10 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Where:

PODS = Probability of detection under the RI-ISI program at location j PODej = Probability of detection under the current ASME Section Xl inspection program at location j A risk segment is defined as weld locations in same size of continuous piping that are susceptible to the same degradation mechanism(s) and the same consequence resulting from a pressure boundary failure. Using this definition, the following expression was used for calculating the change in risk for each segment within a system.

ACDFj = (Nej* PODej- Nrj* PODrj)*Foj*CCDP (3)

In Equation (3), Nej represents the number of locations within segment j that are inspected under the current ASME Section XI program and Nrj represents the number of locations within segment j that are inspected under the RI-ISI program. The change in risk for each system within the RI-ISI evaluation scope was calculated by summing the changes in risk for each individual segment within the system.

In Equations (1)- (3), the risk is measured in terms of change in core damage frequency (ACDF). The change in risk for large early release frequency (ACLERF) was calculated by substituting the conditional large early release probability (CLERP) for CCDP in Equations (1) - (3).

The POD values used in the simplified calculations are consistent with those used in the approved RI-ISI pilot applications at Arkansas One Unit 2 and Vermont Yankee as documented in References 9 and 14 of EPRI TR-1 12657 Rev. B-A. The PODs used in the simplified calculations are as follows:

POD of 0.3 was used for welds susceptible to thermal fatigue under the current ASME Section Xl program

POD of 0.9 was used for welds susceptible to thermal fatigue under the RI-ISI program

POD of 0.5 was used for welds susceptible to other degradation mechanism under either the current ASME Section Xl or RI-ISI program.

Under the RI-ISI program, inspections will be performed to monitor welds susceptibility to specific degradation mechanism(s) (i.e., inspection for cause). The inspection volume will also be expanded when welds are susceptible to thermal fatigue. These types of inspections are currently not performed under the ASME Section Xl program. The inspection for cause and expanded volume for thermal fatigue under the RI-ISI program result in a significant POD improvement over the current ASME Section Xl program.

Page 11 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 The pressure boundary rupture frequencies used in the simplified calculations were obtained from Table A-8 of EPRI TR-1 11880. For pipe segments that were found to be susceptible to one degradation mechanism such as thermal fatigue or stress corrosion cracking, the rupture frequency for the segment was determined by summing the rupture frequency for the applicable degradation mechanism and the rupture frequency attributed to design and construction errors. For pipe segments that were found to be susceptible to no active degradation mechanism, the rupture frequency for design and construction errors was used as the only failure mechanism found from the service data that could be identified in a pipe inspection with no other know degradation mechanisms.

The CCDP and CLERP values used in the simplified calculations were obtained from the SONGS PRA model and are provided in Table 9-1.

Table 9-1 SONGS Units 2 and 3 LOCA Conditional Probabilities Event Initiator Frequency CCDP CLERP

______ _____ (per year) _ _ _ _ _ _ _ _ _ _ _ _ _ _

Large LOCA 6.5E-5 7.4E-3 2.8E-5 Medium LOCA 7.1E-5 5.1E-3 2.3E-5 Small LOCA 2.9E-3 3.3E-3 6.1E-5 Because the bounding analysis did not meet the system level guideline for the RCS, the

'Simplified Risk Quantification Method" described above was used to calculate the change in risk for SONGS Units 2 and 3. The change in risk obtained from the bounding and simplified calculations are provided in Tables 9-2A and 9-2B for SONGS Units 2 and 3, respectively. As noted in question #9, the ACDF for the RCS system for SONGS Units 2 and 3 is greater than the system level guideline of I E-7Iyr when using the bounding analysis without POD. Using the simplified analysis with POD, the ACDF for the RCS system for SONGS Units 2 and 3 is 2.28E-8/yr and 5.20E-8/yr, respectively. All other systems resulted in similar ACDF and ALERF reductions when recalculated using the simplified analysis with POD. Consequently, the ACDF and ALERF for each system and for the total plant are consistent with the guidelines from EPRI TR-1 12657 Rev. B-A.

Page 12 of 17

Responses to RAIs to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Quantitative Support for RAI Question #1 and #3 The change in risk provided in Tables 9-2A and 9-2B reflects the revised evaluation for the risk segments that resulted from responses to RAls #1 and 3. As a result of the revised evaluation, the ACDF and ALERF for the revised bounding analysis calculations increased over the bounding analysis calculations provided in the submittal by a factor of approximately 2 or less. The increased magnitude of the change in risk is attributed to the greater number of high risk segments that resulted from the revised risk segments.

The increased magnitude is also attributed to the higher rupture frequency due to stress corrosion cracking. However, notwithstanding the increase in the bounding calculation results, the simplified analysis calculations show that all systems meet the system level risk guideline.

Sensitivity Analysis Two sensitivity cases were performed to assess the impact of the change in PODs under the current ASME Section Xl and RI-IS- inspection programs.

Case 1 - Improved POD for stress corrosion cracking under the RI-ISI program For the first case, it was assumed that inspection for cause of welds susceptible to stress corrosion cracking under the RI-ISI program will increase the POD for most flaws. A POD value of 0.75 (instead of 0.5 for the base case) for stress corrosion cracking was assumed for this case. The PODs used for this sensitivity case are as follows:

POD of 0.3 was used for welds susceptible to thermal fatigue under the current ASME Section Xl program (same as the base case)

POD of 0.9 was used for welds susceptible to thermal fatigue under the RI-ISI program (same as the base case)

POD of 0.5 was used for welds susceptible to other degradation mechanisms under either the current ASME Section Xl or RI-ISI program (same as the base case)

POD of 0.75 was used for welds susceptible to stress corrosion cracking under the RI-ISI program (0.5 used in the base case).

Page 13 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Case 2 - Reduced POD for thermal fatigue under the RI-ISI program For the second sensitivity case, the detection of a flaw was assumed to be less likely for welds susceptible to thermal fatigue under the RI-ISI program. A POD value of 0.8 (instead of 0.9 for the base case) was assumed for welds inspected for thermal fatigue for this case. The PODs used for this sensitivity case are as follows:

POD of 0.3 was used for welds susceptible to thermal fatigue under the current ASME Section Xl program (same as the base case)

POD of 0.8 was used for welds susceptible to thermal fatigue under the RI-ISI program (0.9 used in the base case)

POD of 0.5 was used for welds susceptible to other degradation mechanism under either the current ASME Section Xl or RI-ISI program (same as the base case).

The results for the sensitivity cases are provided in Tables 9-3A and 9-3B for SONGS Units 2 and 3, respectively. The results obtained for the sensitivity cases show that all systems meet the system level risk guideline.

Page 14 of 17

Responses to RAIs to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Table 9-2A Risk Impact Results for SONGS Unit 2 Bounding Analysis (1 Simplified Analysis '

System Risk Category w/o POD w___

OD ACDF ALERF ACDF ALERF (per year) (per year) (per year) (per year) 2 6.67E-07 2.97E-09 -1.33E-08 -2.09E-09 RCS 4 7.22E-08 2.73E-10 3.61 E-08 1.37E-10 5 -8.27E-12 -1.51 E-13 -7.45E-12 -1.36E-13 2 2.62E-08 4.77E-10 -1.36E-08 -2.48E-10 CVCS 4 5.58E-09 1.02E-10 2.79E-09 5.08E-11 6 2.60E-08 4.74E-10 1.30E-08 2.37E-10 2 5.97E-08 2.71E-10 -3.79E-08 -1.72E-10 MS 4 4.13E-08 1.88E-10 2.07E-08 9.38E-1 1 2 0.00E+00 0.OOE+00 -1.72E-08 -3.14E-10 AS 6 1.30E-11 2.37E-13 6.51E-12 1.19E-13 2 2.69E-08 1.01 E-10 -1.27E-08 -4.77E-1 1 4 1.84E-09 8.36E-12 9.22E-10 4.18E-12 SIS 5 2.38E-10 7.56E-11 1.65E-11 5.23E-12 6 3.28E-10 1.02E-10 1.64E-10 5.12E-11 2 -1.55E-09 -5.81E-12 -1.04E-08 -3.90E-11 4 2.68E-09 1.01 E-11 1.34E-09 5.04E-12 SDC 5 -1.55E-09 -5.81E-12 -1.39E-09 -5.23E-12 6 0.OOE+00 0.OOE+00 0.OOE+00 0.OOE+00 Total 9.27E-07 5.04E-09 -3.15E-08 -2.33E-09 Note 1: -A positive value Indicates an Increase Inrisk while a negative value Indicates a decrease Inrisk Page 15 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Table 9-2B Risk Impact Results for SONGS Unit 3 Bounding Analysis (1) Simplified Analysis '

Risk wo POD wlPOD System Category ACDF ALERF ACDF ALERF (per year) (per year) (per year) (per year) 2 6.77E-07 3.87E-09 1.40E-08 -1.59E-09 RCS 4 7.61 E-08 3.01 E-10 3.80E-08 1.51 E-10 5 1.65E-11 3.02E-13 O.OOE+00 O.OOE+00 2 4.53E-08 8.25E-10 -1.36E-08 -2.48E-10 CVCS 4 3.72E-09 6.78E-11 1.86E-09 3.39E-1 1 6 2.42E-08 4.40E-10 1.21 E-08 2.20E-10 2 -1.26E-08 -5.73E-1 I -5.39E-08 -2.44E-10 MS 4 3.50E-08 1.59E-10 1.75E-08 7.93E-11 2 -9.56E-09 -1.74E-10 -2.01E-08 -3.66E-10 AS 6 3.72E-12 6.78E-14 1.86E-12 3.39E-14 2 2.53E-08 9.50E-11 -1.41E-08 -5.29E-11 4 1.38E-09 6.27E-12 6.91E-10 3.14E-12 SIS 5 3.47E-10 1.1OE-10 6.03E-11 1.92E-11 6 2.63E-10 8.14E-11 1.32E-10 4.07E-11 2 O.00E+00 O.OOE+00 -9.92E-09 -3.72E-1 1 4 3.35E-09 1.26E-1II 1.68E-09 6.29E-12 SDC 5 -1.55E-09 -5.81E-12 -1.39E-09 -5.23E-12 6 1.34E-09 5.04E-12 6.71E-10 2.52E-12 Total 8.69E-07 5.73E-09 -2.63E-08 -1.99E-09 Note 1: -A positive value indicates an Increase Inrisk while a negative value indicates a decrease In risk.

Page 16 of 17

Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS)

Units 2 and 3 Relief Request ISI-3-1 Table 9-3A Risk Impact Results for SONGS Unit 2 System Sensitivity Case 1 (1) Sensitivity Case 2 (

ACDF ALERF ACDF ALERF (per year) (per year) (per year) (per year)

RCS -6.94E-08 -2.32E-09 7.06E-08 -1.44E-09 CVCS 2.19E-09 4.09E-11 5.43E-09 9.90E-11 MS -2.90E-08 -1.32E-10 -7.45E-09 -3.38E-1 I AS -1.72E-08 -3.14E-10 -1.46E-08 -2.66E-10 SIS -1.16E-08 1.29E-11 -8.48E-09 2.72E-11 SDC -1.04E-08 -3.92E-11 -8.81 E-09 -3.31 E-11 Total -1.35E-07 -2.75E-09 3.67E-08 -1.65E-09 Note 1: - A positive value indicates an increase in risk while a negative value indicates a decrease in risk.

Table 9-3B Risk Impact Results for SONGS Unit 3 System Sensitivity Case 1 (1) Sensitivity Case 2 (1)

ACDF ALERF ACDF ALERF (per year) (per year) (per year) (per year)

RCS -4.01 E-08 -1.80E-09 9.62E-08 -9.67E-10 CVCS 3.98E-10 6.97E-12 4.43E-09 8.08E-11 MS -4.82E-08 -2.19E-10 -2.89E-08 -1.31 E-10 AS -2.01 E-08 3.66E-10 -1.75E-08 -3.19E-10 SIS -1.32E-08 1.01 E-11 -9.96E-09 2.44E-11 SDC -8.96E-09 -3.36E-1 1 -7.34E-09 -2.75E-1 1 Total -1.30E-07 -2.41 E-09 3.70E-08 -1.34E-09 Note 1: - A positive value indicates an increase in risk while a negative value indicates a decrease in risk.

Page 17 of 17

ATTACHMENT to Responses to RAls to Support San Onofre Nuclear Generating Station (SONGS) Units 2 and 3 Relief Request ISI-3-1 Facts & Observations (F & 0's) from the Pilot Application of the ASME PRA Standard Peer Review Process

FACTS & OBSERVATIONS (F & O's) FROM THE PILOT APPLICATION OF THE ASME PRA STANDARD PEER REVIEW PROCESS The risk assessment portion of the analysis is based on the pipe break frequency and the conditional core damage probability given a pipe break (LOCA). For each of the F & O's, the impact on the pipe break frequency and conditional core damage probability (CCDP) and conditional large early release probability (CLERP) are assessed. The results will have an impact on the application if it either 1) results in a change in consequence category (i.e., from none to low, low to medium or medium to high) that consequently causes an increase in the risk category, or 2) causes an increase in the overall risk inconsistent with RG 1.174 (i.e., ACDF > I E-6fyr or ALERF > IE-7/yr).

Item CaaiiyPropose d Resoblution eS - Obervation from impact on RI ISI

.P Rvie6eerTeamn Re 1 AS-A2-01 Ill/lri The Loss of Control Room HVAC accident sequence analysis appears Consider re-evaluating No negative Impact.

to be overly conservative. A number of simplifying assumptions have both the initiating event been made that result In a model that does not seem to reflect a frequency fault tree and The loss of control HVAC does not reasonable accident progression, and which result in internal events the accident sequence increase the likelihood of a pipe cutsets contributing roughly 7% to the overall Internal events CDF. model for this support break. Since HVAC Is modeled system initiator to credit conservatively, a more accurately According to the event discussion in Section 15.4 of IPE-ETA-000, the likely mitigating actions modeled HVAC would yield smaller set of simplifying assumptions includes: (a) no credit for operator available to the operators, risk than currently analyzed.

response to the total loss of control room HVAC (normal and e.g., performing a room emergency) Initiator (e.g., opening of doors, establishing temporary heatup analysis for the ventilation, controlled shutdown of the plant prior to overheating to the control room to determine point of generation of spurious reactor trip signals, etc.); (b) operators the heatup rate and ait until overheating is so severe that spurious trip occurs and then ultimate temperature, and abandon the control room for the remote shutdown panel; (c) no credit defining possible recovery for any mitigation systems not controllable from the remote shutdown actions available to the panel. operators.

Per discussion with the cognizant SONGS PRA engineer, this event was added to support a tech spec AOT application for the control room HVAC systems.. There was no analytical basis for Justifying more detailed (and less conservative) sequence modeling, so the simplistic model was Implemented. However, review of the CDF cutsets, (in file 13-1 IE CDF.doc) shows that the Loss of Control Room HVAC initiating event appears in cutsets #4,5,11, and 12, contributing roughly IE-6 CDF (about 7& of the internal events CDF total; the total percentage Is higher). Hence, this Is not an insignificant contributor to CDF. A less pessimistic approach should be considered Page 1 of 38

-A'.',;^.' ......... _0Capability;-:--.........................-;.---

item Ite Category-Capby ,Proposed Resolution --

F&O " ffSR: ;: - - Observation ffSt- pa t on RI

_ -Peer Review Team 2 AS-A2-02 1/lf/lil In the event tree pictures for ATWS and for Loss of Offsite Power and For SBO, consider adding No impact.

Station Blackout, success at the first top event is Indicated as complete a similar note to Section mitigation of the event resulting in a success (no core damage) path. 6.3 as Is present in ATWS, LOP, and SBO do not result Section 4.3 either (a) in an Increased likelihood of pipe In the ATWS tree (Figure 4.1 of IPE-ETA-000), the first top is Manual stating the fact that the break nor does it impact the Reactor Scram Successful', and success (event tree path S01) is restart has been explicitly consequence.

labeled as 'OK'. However, a successful trip at this point would result In modeled, or (b) a transient for which normal plant response (e.g., decay heat removal, addressing the relative possible ECCS injection if a primary safety valve opened and failed to insignificance of the non-reclose, etc.). This is discussed in Section 4.3 (Event Tree modeled sequence (after Assumptions), where it Is noted that the additional cutsets that would confirming that it Is result if this were modeled would not be significant relative to the cutsets appropriate to do so). Also already modeled. consider using a different notation on the event tree In the SBO tree, the first top is 'AC Power Recovered Within 60 representations of these Minutes," and success (event tree path S01) is labeled as 'OK'. sequences.

However, a successful restoration of power after 60 minutes Is not a guaranteed success, since plant mitigation systems would need to start For LOOP, logic should be and provide necessary critical safety functions. For this event, the added to the top event discussion in Section 6.3 (Event Tree Assumptions), does not address model to account for the additional cutsets that would result if this were modeled. Review of the possibility that after the 1-CCW fault tree indicated that PUMP FAILS TO RESTART hour recovery, PCS fails FOLLOWING LOOP' appears in the fault tree, e.g., under Gate GEX- with some higher 320. Restart signal/operator action failures are also modeled, e.g., probability than for a loss under gate GEX-392. So it appears that attention has been paid to this of PCS Initiating event.

scenario.

In the LOP sequence, the Impact is more Important. The top success path (recovery after I hr) effectively credits recovery of PCS. This is likely optimistic after one hour, since MFW may not be recoverable.

Given that power may not be restored until 60 minutes, that leaves only 30 minutes to re-establish the necessary PCS operating condition to provide condensate makeup to an SG. MFW seems unlikely to be recoverable after 60 minutes of being without power.

Page 2 of 38

_ . ; - : ~Capability'..:

Itm^-Capabioiy Itemegrn -----osed

-::Prop Resolution--:v-

-of SR Obseration from o i 1Stimpact Peer RevlewTeam 3 AS-A2-03 1/11111 The following observations were made regarding the modeling of the Correct the discrepancies No impact.

Loss of CCW event. in the model and documentation. Loss of CCW as an initiator is o Figure 15.2 does not Indicate a transfer to the ATWS model on Correct the ATWS outside the scope of interest for the failure of top event K, Instead assigning this path to CD PDS sequence, or address the RI-ISI application.

IIA. However, a check of the SONGS SMTOP CDF top event impact of the non-modeled fault tree logic shows that Loss of CCW Is included in the set of ECCS dependency noted ATWS initiators under Gate GSMT900. above.

o However, the dependency is not effectively transferred to the ATWS logic on failure of top event K. The current approach to the transfer fails to identify cutsets following failure of pressurized safety valves to close, since the loss of all CCW would, as explained in Section 15.3.1, affect the ECCS pumps.

o Similarly, Path S01 in the event tree is labeled OK' (I.e., no core damage), and it appears that no further modeling occurs.

However, this path is essentially a recovered loss of all CCW path, and it is necessary to model plant response for this Initiator. If a stuck open SV were to occur following the plant trip, then HPSI would be unavailable. This is currently not treated.

4 AS-A7-03 11 The ATWS-specific assumptions with respect to the MTC and the Provide a more detailed No Impact.

ancillary basis in section 4.3 of the IPE-ETA-00 (Page 44) appear to be description of how MTC is out-of-date. Z250-2 represents the fraction of fuel cycle where the MTC addressed in the ATWS ATWS consequences do not Impact is unfavorable. The reference is a 1979 calculation. The fraction Is model. this application since the ATWS dependent upon fuel loading. The definition of unfavorable MTC and induced LOCA frequency would not fraction of time during the operation may vary from fuel cycle to cycle. be expected to change with a The fraction may be quite different based on the current fuel loading. change In Inspection population.

ATWS Induced pipe failures would result from significant overpressure due to an uncontrolled power excursion. The overpressure Is greater than the design of the piping and beyond failure mechanisms identified by the ISI program. That is a change In the unfavorable MTC fraction from cycle-to-cycle is immaterial to the RI-ISI application.

Page 3 of 38

. . ....... -Capability ............. .. :. .-- :

Item Category Observatio Proposed Resolution; F&O of SR from Impact on RI 1St :

Peer Review Team.

5 AS-A9-01 I Plant specific T-H analyses have been performed (using RETRAN or Consider a more detailed No impact.

MAAP) to determine the accident progression parameters. It is not clear review of the supporting T-that the assumptions made Inthese analyses have been explicitly H runs and assess the A negative impact on the application included in the event trees. For example, the status of RCPs (whether impact of key assumptions will only occur If the conditional core running or not), charging pumps (whether assumed running or turned affecting the accident damage probability (CCDP) for off), initial water level, and pressurizer spray, etc, may affect the timing. progression. A sensitivity LOCAs increases. This occurs If This interface Is Important to provide a more realistic modeling of plant study may be a practical any LOCA event tree success response following different initiators. means to gain additional criteria are made more restrictive as insights on these key a result of including previously parameters. excluded MAAP assumptions.

Except for containment cooling requirements, the success criteria for LOCA mitigating systems (including AFW for small LOCAs) are based on design basis LOCA requirements and not thermal hydraulic analyses. Other non-LOCA initiating events are more dependent on T/H calculations where there are more thermal-hydraulic timing dependent operator actions.

The design basis LOCA success criteria for containment systems is one of two trains of CSS must operate. Based on MAAP calculations, containment cooling Is sufficiently supplied by either 1 of 2 CS pumps or I of 4 containment emergency fan coolers.

Page 4 of 38

.- : - .-. Capability--....-.

Item Item Cap Caegoryy ..Proposed . Resolution F&O ofSR Observation. from Im pact an RI ISI Peer Review Team 6 AS-B6-01 1IlIA11i DLMPSEAL4HD is defined as 'RCP Seal Failure Prob. Given Correct the seal failure No Impact.

LOCCW>4 Hr." The value for this event was selected from markup of probability number.

CE NPSD-1199P generated Inresponse to NRC RAls. However, the The likelihood of an RCP seal value selected was the probability of seal failure between 0 and 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . failure given a loss of CCW Initiating The probability of seal failure between 0 and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is 1.81 E-04. The event does not impact this value for probability of seal failure between 4 and 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is the application since it neither impacts difference between these values (1.81 E 5.07E-05 ) which is 1.3E- the consequence of a small,

04. Note that the values in CE-NPSD-1199-P are also per pump so if medium or large LOCA nor all RCPs are affected, the value must be multiplied by four. There also increases the likelihood of a pipe seems to be a discrepancy between the RCP Seal Failure treatment for break. This F&O had already been SBO and for LOCCW even thought both Initiators cover a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months resolved and incorporated into the period. San Onofre PRA model at the time of this RAI response. As expected, its resolution did not cause the values provided in San Onofre's RI-ISI submittal to be exceeded or invalidated.

7 AS-C3-02 JI/llJil In CDF Group #2(Cutsets #2,17), ZI 26-1 COMPLEMENT is used to Adjust BE to reflect proper No impact.

determine the fraction of time in mode 1 that the reactor Is above 20% fraction power. The current value is 81 %. This seems quite low. Typically, The fraction of time In mode 1 is transition times in Mode 1 are a very small fraction of the year (approx questioned only for ATWS events 1%). and does not Impact this application since it neither impacts the consequence of a small, medium or large LOCA nor increases the likelihood of a pipe break due to the inspected pipe degradation mechanisms (see response to item 4). Also, this F&O had been resolved and incorporated into the San Onofre PRA model at the time of this RAI response. As expected, its resolution did not cause the values provided in San Onofre's RI-ISI submittal to be exceeded or invalidated.

8 AS-C3-03 II/IiIi Consideration should be given to changing success criteria with an Use human actions as SCE considers the modeling of event tree regarding human actions. For example, in the ATWS tree the interviewed HRA events in the fault trees human action recoveries model in the normally tree may not be appropriate if the HRAs are properly appropriate as interviewed (e.g. AFW recovery, HPSI recovery) (sic). modeled (I.e., only apply to

c. scenarios that bounded by the assumptions of the HRA). This method is consistent with small event tree-lame fault tree Page 5 of 38

Capability' Propo'sed Resolution' ItemCatgory.

of SRObservation' fOMMP o Peer Review Team' methodology. The F&O is consistent with the large event tree-small fault tree methodology.

Terefore, it Is concluded that this F& has no impact.

9 DA-Al-01 NM The component boundaries for common cause have not been Develop documentation No impact.

adequately defined. This has resulted in instances of non-realistic which defines component common cause modeling. For example: the component boundary for boundaries and ensure The F&O states that we are double LPSI, AFW, etc. in NUREG/CR-5497 includes 'the pump itself, the driver consistency when using counting since we explicitly model including the circuit breaker, however, the SONGS model includes a generic and plant specific supply breakers in addition to the common cause factor for the 4160V breakers as well as for the pump. data. load itself. Removing the explicit modeling of breakers would reduce conservatism and lower the overall risk.

10 DA-CI-01 1/11/111 Common cause Alpha factors used In the CCW system model are from Ensure appropriate No impact.

the ESW distributions in NUREGICR-5497. ESW is typically taken from generic data is applied to an ultimate heat source (e.g. lake, river, reservoir, etc.) and can component data The F&O suggests that the use of therefore, experience much harsher environmental conditions than COW parameters. Document more appropriate CCF alpha factor pumps. No documentation Isprovided discussing the appropriateness the justification for using would yield a lower CCF of using ESW Alpha factors for the CCW pumps. generic data parameters contribution and reduce overall risk.

The CCF parameters (i.e., alpha-factors) for CCW pumps taken from EPRI TR-016780, -Advanced Light Wter Reactor (ALWR) Utility Requirements Document, Revision 8, 1999, Volume Ill, Annex A,Table A2-1', are smaller by about a factor of 2, compared to the current ones used In the PRA. Additionally, the latest plant-specific CCW pumps failure rates have been reduced.

This would result in smaller OCC probabilities for CCW pumps by approximately a factor of 3 for failure to start and a factor of 2.5 for failure to run. Therefore, there Is no

____ ________ ___ ____ ____ ___negative Impact on the results.

Page 6 of 38

^-:> : . :: .Capability '...---

Item . : . ... Categoory .t; - ...........................

. Pooe Resolution:

tm F&O CF&O

'of SRfrom . Observatlon Po o Rm' -s;u.pact on RI ISI:e Peer Review Team 11 DA-C3-01 NM The ASME SR DA-C3 states the following: Ensure that data used in The time-frame for which COLLECT plant-specific data from as broad a time period as possible, the PRA is consistent with unavailability and unreliability data consistent with uniformity in design, operational practices, and PRA component is collected has been revised to experience. JUSTIFY the rationale for screening or disregarding plant- boundaries and failure address this F&O. Inaddition, the specific data (e.g., plant design modifications, changes In operating modes. Document this component boundaries have been practices). There should be documentation which discusses the analysis and ensure that redefined so as to eliminate double-appropriateness of the data collected. For example, if data Is used future data processing is counting. These data and model without discrimination from the System Engineers collecting data for the consistent with this changes were simulated to Maintenance Rule, the applicability of that data for use Inthe PRA analysis. determine the impact of the should be assessed and documented. resolution of this F&O on the results provided in San Onofre's RI-ISI submittal. The CCDP and CLERP values obtained were lower that those provided in the RI-ISI submittal. Therefore, it Is concluded that this F&O has no impact on the results or conclusions of the

__ submittal.

12 DA-C3-02 NM Some significant components (e.g., LPSI pumps, AFW pumps, and The time-frame for which Service Water pumps) were assumed some demand rate as 12 years unavailability and unreliability data ago and adopted the demand data collected from 1985 to 1991 as is collected has been revised to current demand data. Especially, the demand data of Tank 121 was address this F&O. These data adopted from the P140 demand data from control room log from 1997 to changes were simulated to 2001, but, P140 did not apply its own data, Instead of, P140 applied the determine the impact of the demand data from 1985 to 1991. Furthermore, most of the components resolution of this F&O on the results applied a time period 54 months, but P140 applied 10 months only provided in San Onofre's Ri-ISI ithout reasonable reason documented. submittal. The CCDP and CLERP values obtained were lower that those provided In the RI-ISI submittal. Therefore, it Is concluded that this F&O has no impact on the results or conclusions of the submittal.

Page 7 of 38

Capability P o Re:solutio Item Category Proposed Resolution

-F&Oo-F&O.of SR - Obsevaion-- from; . Impact on RI ISI Peer Review Team 13 DA-C3-03 NM SCE assumed that 70% T/D AFW pump failed to run Is due to A sensitivity analysis was performed overspeed and it Is recoverable. There Is no bases can be found to which set the credit for recovery of support this assumption. Plant data showed 0 failure to run in 295 hours0.00341 days 0.0819 hours 4.877645e-4 weeks 1.122475e-4 months the TDAFW pump failures to zero.

and 0 failure to start on 38 demands. Furthermore, there Is no The CCDP and CLERP values ustification to apply this recoverable credit to failure to start not the obtained were lower that those failure to run. (Note that Failure to start has higher failure rate than provided Inthe RI-ISI submittal.

failure to run.) Therefore, it is concluded that this F&O has no impact on the results or conclusions of the submittal.

14 DA-C14-01 NM Recovery of common cause failure of AFW and Diesel Generators does Review plant specific data A sensitivity analysis was performed not use plant-specific data and the applicable Common Cause has not to Identify actual or which set the credit for recovery of been reviewed. Common cause failure to run events for the EDGs and potential common cause the AFW and Diesel Generators to AFW pumps are recovered using data from an EPRI report. It Is not failure of the AFW and zero. The CCDP and CLERP clear that the data from that reference report (NSAC-1 61) applies to diesel generators and values obtained were lower that common cause failure events. document that these those provided in the RI-ISI failures can be recovered. submittal. Therefore, it is concluded Update recovery rates and that this F&O has no Impact on the common cause failure results or conclusions of the factors using plant-specific submittal.

data.

15 DA-D3-01 Ill Consider modifying the SONGS 2/3 Generic Data for TP and BC. A Review current PRA data No impact.

mean of 3.OE-2 for turbine driven pump failure to start on demand studies and update appears to be significantly conservative before factoring the SONGS generic data for these The generic TDAFW pump failure to failure experience with condensate trips. PLG-500 has a value of 1.3E-7 components. start data is based on INEL and EF 4.The SONGS experience that Is Included in the generic data should given a value of 6E-3 which Is be removed for determining the generic component, as long as it is significantly less than NUREGICR-included in the Bayesian update. A mean of 6.0E-7 for battery charger 4550's value of 3E-2, San Onofre failure to operate appears to be non-conservative since a value of 1E-5 strongly believes that a value on the EF 5 Isavailable from EGGSSRE-8875. order of 1E-7 Is not supportable.

The generic value for battery charger failure to operate has been revised to be consistent with ALWR data (I.e., 7E-61hr). A review of generic data was performed and the PRA was updated accordingly.

Using these updated generic data, the resulting CCDP and CLERP values obtained were lower that those vrovided in the RI-ISI Page 8 of 38

Capability P R Ite : :vCtgory '-;ro e 'e 0I teCa# Ftegory Observation-- ^ from Impact on RI :SI Peer Review Team submittal. Therefore, it is concluded that this F&O has no Impact on the results or conclusions of the submittal.

16 HR-A2-01 NM Most of potential miscalibration failures are not modeled. (The only No impact.

miscalibration failure found is H-HARAS-U - Miscalibrated the bistables (each sub-systeml90 days) and refueling water level sensors A sensitivity study was conducted in (each sensor/ 18 months). Inthe SCE self-assessment, the following which common-cause miscalibration ustify is provided: failure of CCAS, CIAS, CSAS, EFAS, RAS, and SIAS were set to SCE Is aware of potential miscalibration failures as well as other failure I E-3 based on Table 4-3 (Case VI) modes for instrumentation. Miscalibration errors were included Inthe of the ASEP Methodology overall signal failure probability. Furthermore, operator action to recover (NUREGICR-4772). Post-initiator from a failed signal initiation was conservatively not credited. The PRA operator action to manually initiate a results were insensitive to this treatment. Miscalibration errors causing failed signal is set to 0.1. This is common cause failure of redundant equipment (e.g., signal failures) conservative since:

have been Implicitly included as part of hardware common cause failure a) standard post trip actions (SPTA) probabilities. For example, all the PPS signal failures for redundant Step 8 VERIFY feedwater trains Includes a conservative 10% common cause failure contribution adequate. If not, the response not hich represent both hardware failures and miscalibration errors. obtained column says THEN ENSURE EFAS -actuated.

CCF cannot replace miscalibration. They are different failure modes. b) Subsequent LOCA procedure Furthermore, the failure rate of CCF is based on hardware random states InStep 4: ENSURE the failure. A 10% common cause failure contribution assigned cannot following - actuate: SIAS, CCAS, guarantee the failure rate is conservative either. CRIS.

c) Step 13 of LOCA procedure says to verify containment pressure is less 3.4 psig or CIAS Is actuated manually or automatically.

d) Under floating step 11 In the LOCA procedure, it states to ensure CCAS Is actuated if containment P

> 3.4 Dsia. The results of this Page 9 of 38

Capability item CaeoyProposed Resolution' F&O ofSR Observation from . Impact o RI It!

Peer RevieW Team sensitivity study showed that the CCDP and CLERP values associated with small, medium, and Large LOCAs remained below those provided in San Onofre's RI-

[SI submittal.

17 HR-D4-01 M/11/111 SCE take recovery credit for monthly check for some pre-initiator HFEs No Impact.

SONGS believes the credit given is appropriate. To not credit monthly check is overly conservative.

18 HR-D4-03 MIMI SCE used ASEP to evaluate the pre-initiator HEPs. ASEP assigns 0.1 No impact.

as the RF for a daily or shiftly check of component status. SCE did not apply 0.1 as the RF, instead of, 3.OE-3 was used. This 3.0E-3 is adopted SONGS believes the surveillance from THERP table 20-7. Table 20-7 is used for omission error. Table 20- check is given appropriate credit.

7 is not correct table to evaluate the RF. (Table 20-22 of THERP may be To not credit monthly check Is applied) overly conservative.

Page 10 of 38

Capability Item : Category Proposed Resolution

&O ofSR Observation f-om Ip a t on RI ISI Peer Re.view Team 19 HR-FI-01 I/111II In the SGR event tree, the HFE for operator actions to Isolate the faulted Expand treatment of No impact.

and depressurize the RCS early were lumped into a single event. The human actions in the SGR plant response, equipment involved and subsequent operator actions event tree Steam tube rupture Is outside scope are different depending on the whether depressurization or isolation of analysis and does not increase failed. the likelihood of pipe failure of pipes within the scope of this analysis nor does it impact the consequences of a LOCA.

20 HR-G1-01 II Cutset #13 includes a screening value for the human action to backup a Use realistic human action No impact.

failure of the RAS circuitry. This appears to overstate the significance of value.

the human action and the circuitry failure. The basis for the screening Use of a more realistic human error value (IPE-HC-039) is that it did not appear in a cutset greater than I E- probability would yield lower risk 7/yr. Cutset #13 has a value of 2.7E-7/yr. Other examples of significant results.

HFE basic events that appear to use screening values include:K-HCCIAS-U, K-HCEFAS-U, K-HCMSIS-U, L-HCHV4716PU, URHCFASTXFRU, E-HCSWINGB-Z.

21 HR-G1-02 If The probability of T-HCDEPRESLU is set to 0.0. This seems optimistic. Use realistic human action No impact.

The basis is engineering Judgment based on 'the time available and past value.

experience". The basis is inadequate. This human error probability pertains to steam generator tube rupture. Steam tube rupture is outside scope of analysis and does not increase the likelihood of pipe failure of pipes within the scope of this analysis nor does it impact the consequences of a LOCA.

22 HR-G2-01 (II/Ill The diagnosis errors of some post-initiators were set to 0. For example, Negligible impact.

the diagnosis error of K-HCSCRAM was set to 0, even if the available diagnosis time is only 58 seconds. Based on the ASEP Figure 7-1, the The CCDP and CLERP calculated lower bound of the diagnosis error should be 0.3. D-HCBORATE-U Is for LL, ML, and SL when the another example. Based on the ASEP model, the diagnosis error should diagnosis error probabilities for K-be 0.01, but it was re-assessed as 0 diagnosis errors. HCSCRAM-U and D-HCBORATE-U are changed from zero to 0.3 and 0.1, respectively, remain bounded by the CCDPs and CLERPs in the submitted application.

Page 11 of 38

. . ---- .Capability :- -. -:....... .-.

erItm _

F8O Category-CapabrvtytPopose Resluio ipat on RI ISI

.___ ___}

of SR

...Peer

. Observation from Review Team 23 HR-G4-01 II Some human actions are applied for multiple initiating events and No Impact.

multiple abnormal sequences. The thermal hydraulic analyses of these events are based on one specific abnormal sequence. No any The human actions found in LOCA justification to prove this selected sequence Isthe suitable (worst) one. cutsets are typically specific for LOCAs. These actions Include starting the standby HPSI pump, re-aligning the swing HPSI and aligning CS pumps for injection.

The following actions were applied to LOCA events but were based from other initiators:

CCW pump: The mission time to start a standby CCW pump is 30.

minutes and is based on a loss of CCW resulting In an RCP seal failure. The limiting time for this application Is a large LOCA. The mission time for a large LOCA for CCW cooling Is> 30 minutes.

Condensate Storane Tank (CST):

The mission time to provide make-up to the CST Is 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months following a LOMFW and is based on continuous AFW flow for heat removal. This bounds AFW requirements following a LOCA where some RCS energy is lost to containment via the LOCA Instead of through the steam generators.

Consequently a large, medium or small LOCA transfers to recirculation mode prior to inventory depletion of CST T-1 21.

In both instances, the initiator specific operator action applied to a LOCA Is an appropriate operator action but the mission times are different. The difference is more conservative and therefore bounded by the original mission time.

Therefore, there Is no Impact from this F&O on the RI-ISI application.

Page 12 of 38

Capability Item Category Proposed solution F&O of SR^ Observation Peer from: impact on RI IS ;

Peer Review Team 24 HR-G4-04 II The time available to depressurize the SGs for use of condensate is Clarify proper time No impact.

described as -60 min In the analysis of F-HCDEPRESSU. However, in available and provide the evaluation of the time available, there does not appear to be any basis for timing. Revise This human error probability consideration of other actions that would be going on concurrently to HEP as necessary. pertains to steam generator tube recovery AFW and MFW that might delay emergency depressurization. rupture and does not appear In In fact, the calculation implies that 59 of the 60 minutes would be LOCA cutsets. Steam tube rupture available to perform the action. The timeline in the calculation does not is outside scope of analysis and match the preceding text In the evaluation. does not increase the likelihood of pipe failure of pipes within the In addition, the cool down action (Ta) Is said to be accomplished in 5 scope of this analysis nor does it minutes, but no basis is provided. Procedure S02-12-6 says that the impact the consequences of cool down must be performed within certain limits (Saturation Margin LOCAs.

between 20F and 150F). It is not clear that this limit was considered.

25 HR-G4-05 II Human action should only be used as Interviewed. This means Use human actions as Negligible Impact.

scenarios where Indication Is lost (e.g., Loss of 125 VDC pre-trip and interviewed post trip) the human actions that credited this indication should not be In responding to F&O item #23, used. post-initiator operator actions were set to 1.0 to Identify all operator actions in LOCA cutsets. In cases where battery power to a bus fails, any associated components on that bus also fail. Operator actions modeled involve HPSI pumps, CCW pumps and SWC pumps. Loss of a DC bus leads to failure of any associated CCW, HPSI, and SWC pumps. Loss of flow from these pumps due to loss of DC will Initiate the operators to obtain flow from redundant pumps following multiple indications of low level, no pump running, etc.. A review of the LOCA cutsets with battery loss, loss of the opposite train, and a failed operator action do not start to appear until E-9/yr CDF. Therefore, this F&O has negligible on this RI-ISI application.

Page 13 of 38

Capability Item Category Prop sed Res lution F&O of SR Obse vation from Impac n RI ISI Peer Review Team 26 HR-G5-01 1I a) Mis-applied the table in ASEP or THERP to assess the HEPs. For See observation. No Impact.

example, item 10 of table 8-5 of ASEP Is used to failure rate of performing a post-diagnosis immediate emergency action for the reactor a) Adjusting E-HCP024-U, E-vessel/containment critical parameters, .... Operator Fails to Start HCP025, and E-HC-026-U by Standby CCW Pump should not be satisfied this category, and SCE using Table 20-7 (THERP),

applied it to evaluate the HFEs: E-HCP024-U, E-HCP025-U, and E- increases the HEP by a factor of 10.

HCP026-U. The result Is a change of CCDP from 3.35E-3 to 3.55E-3 (large b) The HFE of Operator Fails to Manually Actuate EFAS Given Common LOCA). The Large LOCA CCDP Cause Failure of EFAS to Automatically Actuate Is another example: provided In the application Is 7.4E-

3. Similarly, Post-Diagnosis Action HEP(s) (median) = 0.02 0.001 = 2E-5 Table Application Adj. HEP 8-5, Item # 3 & Table 8-5, Item #10 MLOCA 5.1E-3 3.74E-3 SLOCA 3.3E-3 2.61 E-3 Item #3 of Table 8-5 Is the failure rate of performing a critical action as a step-by-step task. The application results bound the results after accounting for c) There also exists inconsistent between HFEs. For example, Fig 7-1 resolution of the F&O.

was applied to evaluate the diagnosis errors of most of HFEs, but some HFEs (e.g., DTHCNOSIAS-U) applied Table 20-23 to evaluate the b) This operator action was diagnosis errors. Table 20-23 is designed to model the operator failed to developed but was not included In respond alarms In a series alarms generated. It is not suitable to the PRA used for this application.

evaluate the diagnosis error.

c) Basic event DTHCNOSIAS-U is d)Another example of mis-application of THERP tables is to apply Table not applicable to LOCAs and Is not 20-22. There Is footnote of this table to address this table applies to used In the PRA (i.e., originally cases during normal operating condition. It should be applied to pre- developed but no longer used).

initiator HFEs recovery not applied for post-initiator HFEs. (Note that the table 20-7 was applied to evaluate the pre-initiator recovery.) d) Two operator actions related to LOCA use Table 20-22. They are operator fails to align hot leg injection 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months post-LOCA, and, operator fails to make-up to condensate storage tank to support AFW (small LOCA). Table 20-22 refers to actions during normal operating condition. Although, post-LOCA actions are off-normal, the extended time before these actions take place and the available step-by-step procedures in place to perform these actions, SCE feels the use of this table Is justified.

Page 14 of 38

-..-.-Cap ab ility .,:-

Ite. .Proposed Capabi.ity Resolution FeO - o SR Ob sev ation from i. pat oa RI ISI .

Peer RevieWv Team::

27 HR-G7-02 NM SCE did not justify the dependency if a HFE Is using the screening value (none given) No impact.

0.1 to 0.5. This Is not suitable, because if it is HD, the failure rate will be

> 0.5, and, if it is CD, the failure rate will be 1. Therefore, 0.1 or 0.5 may All HRAs with screening values of not be conservative. 0.1 to 0.5 were set to 1.0.

Recalculation of the CCDP and CLERP for LL, ML, and SL are lower and bounded by the CCDP and CLERP from the submittal.

28 HR-G7-03 NM To apply Table 20-17 of NUREGICR-1278, a clear criteria should be See observation. No impact. Criteria on HRA developed to justify the dependency level (e.g., which conditions, the dependency level were provided in dependency level should be CD, which conditions should be HD, ...) the PRA documentation and are consistent with NUREG/CR-1 278.

However, the documentation of such criteria needs to be improved.

SCE will Improve the documentation to resolve this F&O.

29 HR-H3-01 NM The statistical analysis performed on the recovery of MFW & condensate Treat pool of data as No impact.

appears to treat the events as independent (F-HCDEPRESSU & dependent.

FGHCMFWREC-U). By definition, the events that lead to failure of Loss of feedwater Is outside the condensate also lead to failure of MFW. The two data sets used are scope of interest for this application.

considered independently so the probabilities are considered This was confirmed by a sensitivity independent. In cases where the condensate Is credited with MFW, it study which set these operator seems that the failure probability should be limited to the condensate actions to 1.0. The results of the recovery. Although these are labeled as human actions, the sensitivity study showed that setting quantification does not rely upon any human reliability analysis. these human error probabilities to unity had no impact on the results.

Page 15 of 38

- - : - ~Capabilityk.-I-ItCapaboiy Proposed Resolution

-F&O of SR

.of Observation ;-fr Impact on RI iSIt

- -Peer Review Team 30 IE-A4-01 I SR IE-A4 explicitly calls for treating initiators due to multiple failures if Evaluate the system No impact.

the failures could be the result of a common cause. Section 1.1.4.1 of impacts associated with IPE-ETA-000 discusses the electrical system initiators. Loss of a single loss of two buses. If there Loss of DC power as an initiator is 125 VDC bus Istreated as an initiator for two specific VDC buses and are adverse effects outside the scope of interest for this these initiators are modeled using a point value. However, loss of two beyond those for a single application.

125 VDC buses Is not treated as an initiator. The basis for this exclusion bus loss, dual bus losses is that the frequency for this event is less than1 E-07. No basis for this shouldbe directly value is provided other than a reference to NUREG!CR-2815 in the modeled using a fault tree original IPE submittal. Analyses at other plants have indicated that loss of two 125 VDC vital buses can have some rather significant effects, depending upon plant-specific design features. Treatment of dual bus initiators may need a fault tree model to address the effects of loss of two buses and to properly the potential for common cause in the quantification.

Loss of a single vital 120 VAC bus does not cause a plant trip.

However, Loss of two vital 120 VAC buses would cause a plant trip, but is excluded because the frequency is less than 1E-07. Again, no basis for this value Is provided other than a reference to NUREG/CR-2815 in the original IPE submittal. A loss of two vital 120 VAC buses should also be considered, but this event could probably bu subsumed with in the loss of two 125 VDC buses.

31 IE-A4-02 I Without operator action, the loss of certain 120 VAC buses can cause a Consult, the AOI Impacts No impact.

plant trip. For example, if Y01 Is lost and PZR sub-system X is selected, for all systems without an then all three charging pumps will start. This could result in a trip. IEin the model. If Plant trip due to loss of 120VAC is operator actions are outside the scope of Interest for this required to prevent a trip, application.

then model those actions to develop the IE frequency. This goes beyond 120 VAC (e.g.

4kV, 480VAC, etc.)

Page 16 of 38

Item -- :- Capabgorty Category .. Resolution

,Proposed i-pact f R Obser ation from on RI ISI, Peer Review Team .

32 IE-A6-01 I In their self-assessment, SCE indicates that they have had operations Other than for the No Impact.

review of their initiating event definitions. However, no documentation of exceptions noted In other the operations review of the initiating events definition could be found F&Os, SCE has a Other than for the exceptions noted and discussions with the PRA staff Indicated that the operations input reasonably complete set in other F&Os, SCE has a had occurred during the original IPE development and had been largely of lEs, Additional reasonably complete set of Initiating informal. operations review Is events. Additional operations unlikely to affect the set of review Is unlikely to affect the set of initiators. initiators nor create additional LOCA initiators.

33 IE-A7-01 I SCE did not explicitly account for Initiating event precursors in their SR IE-A7 explicitly No impact.

process for identifying Initiating events and for quantifying initiating event requires that Initiating frequencies. event precursors be Accident precursors apply to addressed for transients and non-LOCA initiators.

identification of potential Initiating event frequencies for this initiating events and application are based on pipe quantification of initiating rupture models and statistical data frequencies for Capability obtained from the CEOG LOCA Categories II and Ill. Initiating Event Position Paper.

There Is currently no industry guidance on exactly what constitutes a precursor, how to factor It into the Identification of initiating events or quantification of initiating frequencies nor is there any definition of sources of data to use In the process. As such, it Is felt that the requirement is more appropriate for

_Capability Cateqory Ill.

Page 17 of 38

IteiltmOsrvto Proposed Resolution F of SR fromrai Jimoact on RI ISIt Peer Review Team 34 IE-B33-01 NM SCE essentially uses only two transient groups, 'Transients With PCS Evaluate all of the No impact.

Aailable" and 'Loss of PCS', and maps most transient initiators Into initiators mapped into the tese two groups. SCE does not appear to have performed and/or two large groups to ensure Plant trip Is outside the scope of documented an evaluation of the Individual transients to ensure that the that the accident interest for this application.

progression was equivalent to that for the group or bounded by it. One progression for each exampleIs Loss of Condenser Vacuum (LOCV). This event causes a initiator Is bounded by the loss of PCS and Is the event most likely to challenge the PSVs. The modeled accident PSV event tree does include an event for PSV being challenged (Y- progression. This may OORV-DEM-Z), but this event Is quantified based on a valve opening lead to developing new due to a low setpoint. It does not address the relative frequency of initiator groups to reduce LOCVs and the higher potential for actually challenging the PSVs at their conservatism that would nominal setpoint. Furthermore, an LOCV will render the Turbine come from modeling the Bypass valves unavailable for steam removal, and it is not clear this Is worst aspect of each ddressed. Also, an LOCV will render the hotwell unavailable for Initiator for all initiators.

fedwater or condensate suction. However, the PCS event tree appears tocredit recovery of FW and Condensate, even for LOCV events.

Aother example Is loss of Instrument air. A loss of instrument air will cause a loss of PCS. It Will also lead to a loss of RCP seal cooling when te AOVs in the COW lines close. This direct impact is not reflected In te model due to the grouping.

Aother example is that Loss of condensate pumps are properly mapped into Loss of PCS but the model is such that FW and condensate recovery can credited.

35 IE-C2-01 II SONGS does not employ Bayes updating when calculating IE Either use Bayesian No impact.

frequencies. Either generic OR plant specific data is used. Reference updating when quantifying IPE-PI-004. initiating event frequencies Based on industry data, Bayesian or provide a statistical updating would yield lower pipe basis for not using generic break frequencies than Is currently data. used.

Page 18 of 38

Capability Item Category Proposed Resolution of SR ~ ~ ~ -'~,ObservationfrmI atonRIl Peer Review Team 36 IE-C3-02 I /I1II The loss of CCW initiator includes a basic event entitled E-CFCCW- Delete modification No Impact.

1YR which was erroneously intended to correct the frequency described in basis for E-calculated. The basis for this correction factor is wrong. In addition, the CFCCW-1YR and add Loss of CCW Initiating event is loss of CCW model uses a 365 day mission time which does not account plant availability factor to outside the scope of interest for this for the fact that the plant Isonly operating at power some fraction of the reduce the exposure time. application.

year.

37 IE-C4-01 NM The internal flooding study screened Initiating events with CDF values of Internal flooding events No impact.

less than 1E-06. This is not consistent with the ASME standard, which with CDF contributions of allows screening of event frequencies (i.e. not CDF) of less than 1E-06. 1E-06 should be included. Internal flooding is outside the This Is especially scope of Interest for this application.

necessary when using the model for maintenance configurations.

38 IE-C4-02 NM SONGS has screened some Initiating events on the basis that they do Should provide a more No Impact.

not cause a plant trip. This Isnot consistent with the paragraph (c)of expansive explanation of the SR IE-C4 of the ASME PRA Standard. However, the events may how these initiating events Events causing a manual shutdown require an Immediate shutdown (i.e. not a slow, controlled shutdown). are Included in the PRA are outside the scope of interest for An example is loss of the I E 4kV bus. While the loss of 4kV Is captured model. The this application.

in the CCW initiating event fault tree, the Impact from the loss of the 4kV documentation currently bus requires an additional failure. However, the loss of the 4kV bus states that the 4kV bus would put you in a situation requiring Immediate shutdown under has been screened as an complicated circumstances. initiating event.

39 IE-C12-01 NM Intheir Interfacing System LOCA analysis, SCE screened out any piping This F&O had already been less than 1"Indiameter based on an assumption the flow was low resolved and Incorporated into the enough not to worry about. However, SCE's Small LOCA Initiators San Onofre PRA model at the time include piping in the range of 3/8 Inch to 2 inch in diameter. Given this, It of this RAI response. Its resolution seems inappropriate to exclude these from the ISLOCA analysis did not cause the values provided in because the basic T/H challenge isthe same with the added San Onofre's RI-ISI submittal to be complication of the loss of RWT inventory. exceeded or invalidated.

Page 19 of 38

Capability Item. Proposed Resolution

: ofR SF&O - Observation : :.ifrom mpct onRIS PeerRevew Tearnm 40 IE-C12-02 NM Intheir evaluation of the ISLOCA for the RHR suction line, SCE used a No Impact.

conditional probability of failure for the low pressure piping of approximately 1E-04 when the piping was exposed to full system Interfacing system LOCA Is typically pressure. This is extremely optimistic. This value Is of the order of their not a pipe break Initiator but a valve Large break LOCA frequency. A more reasonable conditional probability failure initiator followed by of rupture given exposure to full system pressure would be of the order downstream pipe break of Class II of 0.5 system piping. As such, valve failure with failure of Class II piping is outside the scope of Interest for this application. This F&O had already been resolved and Incorporated into the San Onofre PRA model at the time of this RAI response. As expected, its resolution did not cause the values provided in San Onofre's RI-ISI submittal to be exceeded or Invalidated.

41 IE-C12-03 NM The model for the evaluation of the ISLOCA via the LPSI injection lines No Impact.

contains several logic errors. First, failure of the interior check valve (I.e., -075) Is undetectable. The model assumes that the exterior check Interfacing system LOCA Is typically valve (i.e. -033) always fails first. This is not necessarily true and this not a pipe break initiator but a valve affects the exposure times used to calculate the probability of both check failure initiator followed by valves failing. Second, failure of the limit switch for the MOV does not downstream pipe break of Class II result Inthe valve being left open. The scenario is the MOV is left open system piping. As such, valve after the test (human error) and it is not detected because either the limit failure with failure of Class II piping switch falls (hardware failure) or the crew failed to recognize that the is outside the scope of Interest for valve was open. Currently these three elements are modeled as ORed this application. This F&O had events. already been resolved and incorporated Into the San Onofre PRA model at the time of this RAI response. As expected, its resolution did not cause the values provided In San Onofre's RI-ISI submittal to be exceeded or invalidated.

Page 20 of 38

. . Caabliy a--b i.;l-i : : :-^-p Proposed Resolubion

- F&O . : iof lt. Obsevati . . from -: - impact 6n1 RI ISt

-_ ;_ - _ :_-_ ^ _ -_-_-_^_--_:_.. Peer Rev_ew Team 42 IF-Al-01 Not rated The current approach to flood modeling involves a relatively simplistic Update the analysis No impact.

multi-step screening at a high level, and is not realistic, for the following following a process that reasons. does not focus on Internal flooding is outside the screening based on scope of Interest for this application.

o Screening was done on an estimated CDF Impact basis rather estimated CDF Impact.

than on the basis of no sources or no Impacts as specified In Steps in such a process the Standard. would include:

1.) Develop a barrier-o The flood areas are defined at the building level, and thus go oriented set of flood areas well beyond physical barriers as suggested in the Standard. 2.) Identify all PRA components In each of the o Drains and sumps are considered to be able to handle a design internal model.

flood areas in the gpm flow, without an assessment of the actual capacity, overflow location / propagation potential, or possibility of blockage.

o Spray effects are required to be considered in the Standard, but do not appear to have been addressed in the SONGS assessment. Similarly, the possibility of effects of Jet impingement, pipe whip, humidity, condensation, and high temperature fluids on PRA equipment were not considered.

o Floods were basically categorized as large or not large (smalllmedium) using conservative source capacity estimates, but other flood characteristics (e.g., leak, rupture, spray) were not addressed.

o Propagation paths (e.g., through drains, HVAC ducts, cable penetrations, as well as under doors) do not appear to have been evaluated in detail; instead simplifying assumptions were used.

O The pipe failure likelihoods are based on the out-of-date generic data; more current data and other state of the technology approaches are available for determination of frequency values.

o The analysis does not properly consider the complete set of current PRA-modeled SSCs.

.o Documentation of the analysis and of the plant walkdown is not detailed enough to support a realistic identification of scenario jI___ _ _ _ _ _ I _ _ _ _ I details and oossible DroDaaation oaths. IPE-IFA-000 I. _ _ _ _ _ _ I Page 21 of 38

Item apa biy

i~~~~C~aflty: -;- -^- Proposed Resolution F&O of SR Observation: fro Impact on RI ISI Peer Review Tea summarizes what was done for the Internal flooding analysis, but most details appear to have been screened out of the documentation during the flood screening process.

43 IF-A3-01 Not rated The SONGS PRA internal flooding analysis is documented in IPE-IFA- Check the bases for the No impact.

000. That document references the IPE Internal flooding analysis, which screening and scenario is referred to as 'San Onofre Units 2 and 3,IPE Internal Flood Analysis," modeling assessment Internal flooding is outside the Revision A, July 1992. The following observations were noted with (e.g., changes to the plant scope of interest for this application.

respect to the currency of the internal flooding analysis. since the time of the IPE o The Information provided for the peer review did not indicate analysis) to ensure that that plant information sources had been reviewed to determine the model isvalid.

If there might be any Impact on the analysis from changes to the plant since the time the IPE internal flooding analysis was Update the generic performed. initiating event frequency o There does not appear to have been a flooding walkdown, to data source, or use confirm that flooding analysis assumptions remain valid, since another approach (e.g.,

the time of the IPE. pipe segment failure o The flooding Initiating event frequencies are taken from generic frequency assessment) to data from a report from 1988. Since there was no SONGS- estimate initiating event specific experience at the time of the IPE, generic-only data frequencies.

were used. The generic data are now more than 15 years old.

Since this Is the sole basis for the frequencies, a more recent data source should be used, or another approach implemented.

Page 22 of 38

Ca ty Proposed Resolutioy..

Item Categoryf ISt of SR Observation- Peer Review Team 44 IF-B2-01 Not rated An AFW Steam Line Break inTurbine Driven Pump could occur. It is AFW Determine the No Impact.

possible that operations/or MSIS would close the MSIVs. The amount of time It takes for steamlflood could Impact the success likelihood of the AFW pumps. The the AFW PP room SLB to Intemal flooding Is outside the failure rate basis for the AFW pumps Is not basis on operation Inthat cause a MSIS. Determine scope of Interest for this application.

environment. If the MSIVs close and the AFW pumps must function In a if operations is required to degraded condition or the AFW pumps fail, then this could be a shut the MSIVs on a significant flood eventlSLB event. The chilled water system Is directly uncontrolled steam above the control room. Ducts for the chilled water system are directly release (e.g. maybe due over key control room panels. The failure of the chilled water system to personnel safety [the (due to a piping breach, coupled with failed control room panels could exact location of the lead to significant events. steam lake may not be initial known]). If a plant trip is possible as a result of this SLB, then determine the Impact on the AFWs (failed or degraded). Note the failure data for the AFW pumps are not based a this environment. The failure rates should be adjusted. Document findings. Chilled Water to CR. Determine the possible pipe break locations. Determine if water can reach the CR.

Document results of findings._

45 IF-C2-01 Not rated A Water tight door separates the turbine building and the CCW rooms. Assign non-closed No impact Per the SONGS UFSAR (10.4-20), there are a number of manholes In probability to door.

the control building that will allow water to drain into sump. Inthe Determine effective flow Intemal flooding is outside the SONGS model, these manholes are assumed to cause a large flow area around (if closed) or scope of interest for this application.

source Inthe control building. No documentation exists within the PRA through (if open) the model on the size of the manhole or the flow rate into the control manholes. Determine if building. - the estimated flow rate throughlaround flow rates will exceed the drain capacity in the control building. Credit any recovers possible.

Document the results of the evaluation including references to UFSAR and design calculations used.

Page 23 of 38

Item Category Proposed Resolution tFeo FOof toSR': Observation, from Impact on RI ISI Peer Review Team 46 IF-El-01 Not rated PRA Change Package PRACP-02-027 was reviewed. This documents Determine an appropriate No impact.

the implementation of the IPE flooding sequences Into the single top plant response for the model. The sequences that were Identified were incorporated into the missing sequences and Internal flooding Isoutside the model Ina manner consistent with the rest of the PRA accident add to the CDF fault tree. scope of Interest for this application.

sequence modeling. Existing initiators were selected for each scenario, and modifications to the logic were made to Include the flood sequence impacts. In implementing the two Turbine Building flood scenarios that are modeled, only the portions of the sequences involving failure of operator action to terminate the flood source were modeled. However, the portions of these sequences with success of flood source termination ould also result In a trip, with some degradation of available equipment, and should also have been modeled. The sequences that were modeled are treated as loss of offsite power, and it appears that the missing sequences would also be loss of offsite power. A quick estimate of the potential CDF cutset impact from the missing sequences indicated that each cutset could be of the order 1E-7, which is comparable to the impact from other events that are modeled.

Page 24 of 38

.--. -- - .C apability . .........- : -. . . . . -:.. - - :.- ........ ::

Item. Item .:Capiy Categoryon -Pro sed Resolu tion-frm Impa o RI ISI F&O, AofSRIRS Peer Review Team 47 MU-4-1 Non- IPE-PI-001 Step 5.2.1 uses the 10CFR50.59 process to obtain Expand scope of model No impact.

compliance information to keep the PRA aligned with the as-built plant and change reviews to include procedures. However, the 1ICFR50.59 process does not look at all areas missed by 50.59 The additional sources that are changes that may Impact the PRA, since it allows changes reviewed process. recommended for monitoring would under other rules to be excluded from the 50.59 process. For example, not result in a change in pipe break 50.59 screens and evaluations are not required for changes to the frequency. Physical design Technical Specifications or Operating License, changes to the IST and changes to LOCA mitigation ISI programs (which can change the type or frequency of testing used to systems (HPSI, LPSI, CCW, SWC, develop basic events), changes to Fire Protection program (impact fire EDGs) would be picked up through model), temporary modifications <90 days (on-line risk assessment), or review of the 50.59 program.

ODCM. Inaddition, the NEI guidance for configuration control states that Impact of any TS, IST, ISI changes he following additional areas should be monitored: Operational are inherently and Implicitly included Experience, Operator Training, Maintenance Policies, Emergency Plan, in the reliability and availability data Accident Management Programs, and Industry Studies. used In the PRA for the LOCA mitigation systems and therefore included in the calculations performed for this application.

48 MU-6-1 Compliance The Bayesian Update software program should be controlled under the Include the Bayesian No impact.

plant's Software Quality Assurance program, since it is used in the Update program in the development of posterior values for parameters in the model. plant SQA program. The code used for San Onofre's Software Impacting the Bayesian update analyses was model results should be V&V'd using the same processes controlled. outlined in the site's software quality assurance program. Therefore, it Is believed that not having the Bayesian update code under the site's software QA program has no impact on the code's capability or the validity of the results generated.

Page 25 of 38

- : - - ~Capability ---^..Y-^i It item Category or Obseration - Proposedfrom Resolution Iipact o IS

- -- :- Peer Review Team 49 MU-6-2 Compliance PRA-REV-001, Rev. 6 and S0123-XIV-9.1 both indicate that changes PRA-REV-001, Rev. 6 No Impact.

are to be made on copies of the controlled model and the 'controlled and/or S0123-XIV-9.1 model on the network drive" is not to be revised until the changes have should be revised to More specific definition of the been V&V\ed. There is no definition of what files and documents Include a specific controlled model is not expected to constitute the 'controlled model". The actual location of the "controlled efinition of what change this application's supporting model' Is not specified. Individual(s) are not procedurally specified as constitutes the "Controlled calculations.

responsible for establishing and controlling the model to ensure that It Is model', (software, data not inadvertently changed, damaged or lost (inpractice two Individuals files, sensitivity analyses, control all changes). documents, etc.), where it is located, and who is responsible for establishing and maintaining the controlled copy. The results of any sensitivity analyses used to verify the model and results should also be explicitly included as part of the controlled model 50 MU-1 1-01 Non- IPE-PI-001, Maintenance of SONGS 2&3 Living PRA, does not provide Add a programmatic No impact.

compliance any requirements for the PRA engineer performing a PRACP to requirement to evaluate qualitatively or quantitatively determine the impact of a model change on either qualitatively or Impact on other programs does not any previous PRA application. Since PRA input is used as an input for quantitatively the impact of impact the results of this example for the Maintenance Rule, ISI, and MOV/AOV testing, if there Is PRA model changes on application.

significant Impact it should not be delayed until a periodic update. PRA applications.

51 QU-A2-01 11 The uncertainty analysis attempting to address the correlation of Make sure that inputs for No impact.

parameter Inputs does appear to yield results that would be expected. both cases are -

The results of the case accounting for the impact of parameter appropriate and/or The reviewer was Incorrect in that correlation yielded a reduction Inthe mean CDF as compared to the benchmark code to assure the presented results were not a uncorrelated results. This should not be the case. It appears that either appropriate treatment to comparison of correlated vs non-the inputs are Incorrect (for example, the translation from the histogram resolve problem. correlated distributions. Instead the to code inputs) or there is a computational problem. reviewer was presented results comparing the point estimate result from propagating point estimates through the PRA model versus the mean from propagating failure probability distributions (with parameter correlations) through the model. However. the result from Page 26 of 38

Capability Resolutio Item itmCategory ^:^.;Ct Resolutio'n o^~-;-Proposeri Impactea RIIS F&of SR - Observation .- from. impact on 151 Peer Reiw Team propagating correlated distributions did yield a mean lower than the point estimate result. This is unexpected and SCE is addressing this issue. The RI-ISI application Is unaffected since the program, as most PRA applications in the industry are, Is based on the results from propagating point estimates through the model.

52 QU-A4-01 11111111 Recoveries - Post Processing (Appendix A-7 Post Processing Incorporate these A sensitivity analysis was performed Explanation Report) - a number of post processing action (9 of 23) corrections into the fault in which all post processing basic increase the basic event probability in the minimum cutset, some by trees events used In the SONGS PRA significant factors (i.e., multiplication factors of 34.2 and 90.9). Applying model having values greater than increasing factors after solution will allow cutsets which should have one were replaced with basic been above the truncation limit and part of the solution to be missing events less than one. This required from the final analysis, since they were dropped by the truncation and the setting of certain basic events to were not present to have the multiplier applied. This also impacts the 1.0 and revision to the 'rule' importance of components for applications such as the Maintenance associated with the post-processing Rule. basic event. The model was re-quantified. Review of the revised cutsets showed that for LOCA initiating events, the CCDP values remained relatively unchanged, while the CLERP values increased only slightly. This F&O has no impact on the results or conclusions of San Onofre's RI-ISI submittal.

Page 27 of 38

Capability Item Category ObIervation Proposed Resolution

# -F&O

-' ofSR Pr from Impacton i i Peer Review Team 53 QU-B3-01 NM The truncation limits selected for CDF and LERF were not selected My experience is that No impact.

sufficiently low enough to capture an adequate number of cutsets, truncation usually falls especially for applications involving component importance such as the between 5 to 6 decades The SL, ML, and LL initiating events Maintenance Rule. One Industry rule of thumb Is to use a truncation that below the CDF or LERF were re-quantified using the lowest captures 90% of the CDF obtained when 1%change InCDF occurs value. The Industry thumb- culling limit the Safety Monitor could when dropping the truncation one decade. From the figures provided in rule can be used. Since a successfully quantify (i.e., 1E-13).

IPE-MR-000, there was a 4.2% drop at 5E-12 truncation for CDF and fast analysis engine is The resultant CCDP and CLERP 9.0% drop at 1E-12 truncation for LERF for the lowest solved analyses. being used the time values remained below those Therefore the value assumed to be "close' to the final value was not needed for the solutions provided in San Onofre's RI-ISI valid. Even though the selected truncation captures 94% of the lowest should not be excessive. submittal. Therefore, this F&O has analyzed value for CDF and 92% for LERF, it is capturing a much lower Enough calculations need no impact on the results or the ratio of the actual CDF and LERF. The statement Inthe reports that 95% to be performed that it Is conclusions of the RI-ISI study.

of the CDF Is being captured Is not accurate. This Is also why the clear that the 'curve' has number of minimum cutsets is less than usually observed at other truly flattened and the utilities. From experience, the truncation would be expected to be about selected value adequately a decade lower for CDF and between 1-2 decades for LERF. (Note: SR captures CDF and LERF.

QU-B3 requires that truncation be such that no significant accident sequences are inadvertently eliminated. The NRC quantitative interpretation of significant Is that you need to have enough cutsets such have 95% of final CDF/LERF for solution with convergence sufficient to demonstrate the 95% of CDF/LERF.)

54 QU-C1-01 NM SCE evaluates dependency between multiple human actions in a single Revise the dependency Minimal impact expected. Cutsets cutest by setting all human actions to 1.0, sorting the cutsets and review process to evaluate below the top 100 are typically 2 to reviewing the cutsets containing two or more human actions to a larger sample (i.e., CDF 3 orders of magnitude below the top determine if the actions are independent or dependent. However, SCE cutsets down to 1E-6Iyr). event frequency. After returning only reviews the top 100 such cutsets when evaluating the potential for HFE's to nominal probabilities and dependency between multiple human actions. their potential dependencies, these cutsets below the top 100 would drop further down the cutset list as to have minimal impact.

55 QU-C2-01 NM The human action for tripping the RCPs on loss of CCW does not Revise HRA to address No Impact.

appear to account for (a)previous human errors may have occurred in time constraints and responding to the Initial CCW fault (e.g., failure of running loss of CCW dependence of human Loss of CCW initiating event and pump) and (b) the time used by the operators in attempting to diagnose actions to maintain CCW potential LOCA via failed RCP seals and respond to the CCW trouble alarm. and trip RCPs. are outside the scope of this application.

Page 28 of 38

Capability .

ItemI ; Category Observation-Proposed Resolutlon F&O of SR bservation

- Impact on RI ISI Peer Review Team 56 QU-C2-02 NM The loss of CCW event tree analysis does not appear to address a loss Consider adding loss of No impact.

of CCW flow to non-critical loads. These events, while not as severe as non-critical CCW flow as the complete loss of CCW, could lead to a demand to trip the RCPs and an accident sequence. Loss of CCW initiating event and could introduce additional dependent human actions and timing issues potential LOCA via failed RCP seals that are not addressed Inthe complete loss of CCW event. The are outside the scope of this frequency of the loss of non-critical flow would be expected to be higher application.

than the total loss of CCW and one division of CCW could be lost. Thus, the mitigation capability could be reduced.

57 QU-D4-01 NM SCE only reviews the top 200 cutsets for reasonableness and physical The decision on when To be non-significant, the cutsets meaning. SR QU-D1 addresses the review of significant cutsets. QU- non-significant cutsets must not be Inthose cutsets that D4 calls for review of a sample of non-significant cutsets. There is should be reviewed should comprise 95% of the CDF. Using a evidence that such a review was done when the top logic tree was be dependent on the culling limit of I E-12, the top 1000 created, but, since then, the focus appears to be on the top 501100/200 changes being made to cutsets made up approximately cutsets. the model. Suggest 95% of the total CDF for the INIT-developing criteria for SL, INIT-ML, and INIT-LL cases.

identifying when non- The remaining cutsets (e.g., 23,000 significant cutsets should for INIT-SL) were sampled and be reviewed. In major reviewed for reasonableness.

updates, suggest Reasonableness was generally reviewing groups of confirmed; however, the review cutsets (e.g., by initiator) Identified a string of logic that to allow assessment of incorrectly over-estimated the both significant and non- consequence of SL Initiating events.

significant cutsets. Correcting this error would only serve to reduce the resultant CCDP; therefore, it Isconcluded that this F&O does not invalidate the RI-ISI submittal results.

58 QU-E4-01 I Inthe IPE-MR-000 under sensitivity analysis, what is described is more Perform an actual Per Regulatory Guide 1.200 a key closely a verification of results than a sensitivity analysis. There is no sensitivity study which assumption Is one that addresses a evaluation of the impact from assumptions, only whether certain cases evaluates the impacts of key uncertainty for which 1)there is are consistent with previous quantifications. Additionally, a parameter key assumptions. no consensus approach or model; uncertainty analysis was performed; however, no assessment has been Evaluate the results of the AND 2)the choice of the approach done to interpret the results of the analysis. parameter uncertainty or model used is known to have an analysis and document impact on the PRA results. The the assessment. assumptions associated with the Large LOCA, Medium LOCA, and Small LOCA Event trees and the systems that respond to them (e.g.,

HPSI. LPSI. Containment SDrav.

Page 29 of 38

-:--: -- . : Capability X .- 9 -::-- -

itetemCategory 2Category : Proposed Resolution Iipc nR F&O of SR Observation'" from ISI

_ ___ _ ____Peer Review Team ___

AFW, etc.) were reviewed to Identify any which might be considered

'key' per Regulatory Guide 1.200 keeping In mind that only those which may be considered non-conservative are of most concern for this application. The review determined that the assumptions are based on Design Basis Input (FSAR, EOI's, etc.), vendor-specific guidance (i.e., CE NPSD reports) or plant-specific thermal hydraulic analyses considered best estimate calculations - all of which would NOT be considered non-conservative in nature.

Therefore, it is concluded that resolution of this F&O would have no Impact on the results or conclusions presented In San Onofre's RI-ISI submittal.

59 QU-F2-01 I Section 12.2 of IPE-MR-000 provides the results of the SCE PRA for Expand the grouped To be significant, the cutsets must internal events. This section presents the results by Initiator, a listing of outset descriptions in be In those cutsets that comprise the top 50 cutsets and a detailed description of the top 50 cutsets section 12.2.3 to cover the 95% of the CDF. Using a culling grouped by common factors. This section explicitly states that there top 400 cutsets. One limit of 1E-12, the top 1000 cutsets were over 3000 cutsets covering 95% of the CDF and that this could be alternative might be to made up approximately 95% of the reduced to about 400 cutsets If two Initiator fault trees were replaced by provide descriptions by total CDF for the INIT-SL, INIT-ML, point estimates for those two initiators. SR QU-F2 clearly states that the accident sequence. and INIT-LL cases. These cutsets results summary should Include descriptions of significant event were reviewed and categorized as sequences or function failure groups. To be consistent the ASME follows: INIT-SL: 1-ECCS common standard definition of significance, SCE should provide descriptions of mode failure; 2-HPSI System the cutsets covering 95% of the CDF. Failure with independent CS Backup Failure; 3-AFW Failure; and 4-Containment Heat Load Removal Failure. INIT-ML: 1-HPSI Failures; and 2- Containment Heat Load Removal Failure. INIT-LL: 1-ECCSIHPSI Failure, and 2-LPSI Failures. These categorizations are consistent with expectations for LOCA initiating events. Therefore, this F&O Is considered to have no impact on this application.

Page 30 of 38

_te . - - Propo sed Resolution .

F&O' SR .

Obseration from. Impact on RI ISI

. Peer ReVvew Team 60 QU-F3-01 NM There was some discussion in Section 12.5 of the Main Report of the The presence of impacts No Impact.

assessment of Impact of assumptions that could Impact PRA results. of such assumptions and This focused on results of a series of sensitivity cases that were run. sources of uncertainties Per Regulatory Guide 1.200 a key Within this set of cases, the impacts of selected modeling assumptions can affect risk-informed assumption is one that addresses a were quantified and evaluated Individually. decisions made using the key uncertainty for which 1) there Is PRA. Consider no consensus approach or model; However, SR QU-F3 (and also SR QU-E2 and QU-E4) of the ASME developing a process for AND 2) the choice of the approach Standard should be interpreted as requiring a more structured approach identifying key or model used is known to have an to: (a) identifying what the key assumptions and key sources of assumptions and key impact on the PRA results. The uncertainty are, and (b) for evaluating and documenting both Individual sources of uncertainty In assumptions associated with the and, to the extent practical, cumulative or overlapping impacts. the PRA, and developing Large LOCA, Medium LOCA, and meaningful sets of Small LOCA Event trees and the Some items of particular interest would be assumptions that may sensitivity cases to identify systems that respond to them (e.g.,

introduce significantly conservative bias into the results (e.g., the their impacts. HPSI, LPSI, Containment Spray, simplifying assumptions made for loss of control room HVAC), and AFW, etc.) were reviewed to identify assumptions that result in the screening of potential contributors from any which might be considered the model (e.g., the process used in the internal flooding analysis), or 'key' per Regulatory Guide 1.200 assumptions and uncertainties associated with success criteria. Some keeping in mind that only those additional guidance Is provided In the SRs noted above. which may be considered non-conservative are of most concern for this application. The review determined that the assumptions are based on Design Basis input (FSAR, EOlCs, etc.), vendor-specific guidance (i.e., CE NPSD reports) or plant-specific thermal hydraulic analyses considered best estimate calculations - all of which would not be considered non-conservative in nature. Additionally, internal floods do not impact RCS pipe break frequency and do not impact LOCA mitigation response and are therefore outside the scope of this application.

Therefore, it Is concluded that resolution of this F&O would have no Impact on the results or conclusions presented in San Onofre's RI-ISI submittal.

Page 31 of 38

Capability P Reso.,.ion ItmY.:-.Catedor~ . .....e's' I'.

ro'p . 1n ,-,.. ,

F&O -of SR - from Impact on RI I,-

'Observaton

-~Peer Review Team 61 QU-F6-01 NM The main report describes the overall results and provides some Add a section to the main No Impact.

sensitivity analyses. No description of the limitations of the PRA model report that discusses was identified. Inthe self-assessment, the focus of SCE's response was limitations of the PRA SCE believes the reviewer missed on limitations in scope (i.e., shutdown, Level 3, etc.). However, the model. the statement Inthe main report on intemal events CDF1LERF model has limitations in and of Its self. limitations. In the main report, it states, "...These limitations include:

lack of industry-accepted methodologies to explicitly model sabotage, error of commission, aging and degradation, organization and management culture; lack of detailed Level IlIl analyses; and lack of guidelines for the treatment of external event initiators for shutdown risk analysis."

62 SC-B3-03 1/1/111 Section 5.3 of IPE-ETA-000 references a plant-specific RETRAN No impact.

Analysis as the basis for the criteria that 60 minutes are available to recover secondary side heat removal. A review of the referenced The F&O refers to the time available analysis revealed that the purpose of the calculation was to determine for operator actions in response to a time to RAS and that AFW was available during the transient. HEP non-LOCA transient. Non-LOCA FGHCMFWREC-U (IPE-HC-7) uses a 90 minute time which Is transients are outside the scope of inconsistent with the value Inthe assumption. It is not indicated whether this evaluation.

the various times reflected the SG level at time of trip or whether the time was to SG dryout or to the top of the hot leg 63 SC-C1-01 1/11/1II SCE provided documentation of their success criteria with reference to SCE should develop a No impact.

supporting analyses. However, SCE did not thoroughly document all the compilation of assumptions made with respect to the selection of the success criteria. assumptions and Identify Documentation of the key success SCE did not Identify the key success criteria that were either optimistic the conservative and criteria is not expected to change or conservative and did not provide a basis for using such optimistic or optimistic assumptions. the results nor affect this conservative assumptions. For each such application.

assumption, SCE should at least qualitatively assess the potential impact of the assumption on the PRA results and provide a justification for the use of any such assumption that had the potential to impact the overall results.

Page 32 of 38

ItmCapabiliy Proposed Res'olutio'n

_m FO Observation -rom on RI iSI; Impact o-R -- Peer Review Team 64 SY-A7-01 Ir/I/ill The RPS model does not contain detailed modeling of the RPS Provide detailed RPS No Impact.

components Including the RTCB, shunt coils, UV coils, etc. The human modeling with the proper action to manually Initiate a reactor trip includes de-energizing the MG dependencies. This F&O would affect ATWS sets from the control room. No dependencies associated with this action likelihood. ATWS consequences do are mentioned. It seems that breaker control power would be required not Impact this application since the for this action. ATWS induced LOCA frequency would not be expected to change with a change in inspection population. ATWS Induced pipe failures would result from significant overpressure due to an uncontrolled power excursion. The overpressure is greater than the design of the piping and beyond failure mechanisms Identified by the ISI program.

65 SY-A7-02 MI/II1 Consequential LOOP following a trip Is only modeled for loss of PCS Model this possibility for A sensitivity analysis was performed and Tr. The Impact to the grid of a plant trip caused by loss of PCS or all trips. to determine the impact of including any other cause should be similar. Further, other IE.s such as LOCA all initiating events (including would have different cutsets and in combination could be a noticeable LOCAs) as possible causes of contribution to risk. induced-LOPs. The results of the sensitivity analysis determined that the resolution of this F&O has no impact on the results or conclusions of the San Onofre RI-ISI submittal.

66 SY-A8-01 I /II/IIISR SY-A6 requires that the boundaries of the components required for See observation. No Impact.

system operation be Identified. Furthermore, SR SY-Cl item 1 requires a list of all components and failure modes included in the model. There Defining the a component/system are no definitions of component boundaries and there is no such list of boundary will not Impact the results.

modeled components and failure modes in the system notebooks. That Initial PRA maintenance work in could affect the consistency between data collection, system modeling sponding to this F&O shows that and CCF. boundary definitions will reduce plant risk by eliminating double counting of component data.

67 SY-A 1I-01 /11/111 The DG mission time is limited to 8 hrs. This Isbased on the data that Model the full spectrum of SCE agreed that the EDG mission no LOOP In excess of 8 hrs have occurred in this region. There Is some possible LOOP durations time should be extended from 8 likelihood that a LOOP in excess of 8 hrs. Assigning a zero likelihood to up to 24 hrs. If the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months hours to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and the model this possibility seems overly optimistic. mission time is retained, was revised accordingly. This add an operator action resolution of this F&O had already In Recoveries, Post Processing Basis Code #1,Changes the Mission with this recovery to been incorporated into the San Time of the Diesel Generators from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for Internal account for restoration of Onofre PRA model at the time of initiators. The basis for this change Is recovery of offsite power having a offsite power. this RAI response. Its resolution did high probability of recovery within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . However, recovery of offsite not cause the values provided In oower requires manual oWerator action and such action is not beinaSan Onofre's RI-ISI submittal to be Page 33 of 38

. . .: - -. :.Capability .--....--:.

i.Capabity -Proposed Resolution e F&O C-eof Observation from impact on RI ISI

'of SR Peer Review Tem added to the recovered cutset to account for failure to restore power. exceeded or Invalidated.

68 SY-A13-02 I/MM/III The simplified P&ID shows a normally closed manual valve between Revise model to include No Impact.

CST T-120 and CST T-121 (V-476) to support refill of T-121 that is not failure to open of valves.

modeled. Unavailability of T-120 Is (-1.3E-6), but the valve failure to A sensitivity analysis was performed open (>>1E-6) Is not. No basis or assumption could be found to to include the probability of the describe why. Based on the plant P&ID, there may be multiple flow subject manual valve failing to open paths, but that Is not clear from the systems analysis or simplified P&ID. of 1E-4/demand 'or' a failure of the High RAW would be expected for this valve based on human action to operator to provide makeup to the refill T-121. F-V could be significant if only a single path is available, CST of 3E-5/demand. The resulting too, based on importance of HEP. CCDP and CLERP for LOCAs are bounded by that provided in the submitted application. Therefore, this F&O has no impact on this

__ application.

69 SY-A13-05 I/lI/III The system analysis for AFW does not consider the need for the AFW Address the need for No Impact.

flow control valves to cycle over the mission time. As a result, the failure cycling of valves in probability does not consider the multiple demands required. systems analysis. The probability of AFW fow control valves HV4705, 4706, 4712, and 4713 to open was increased by a factor of 5 to account for possible cycling of up to 4 additional open/close cycles. The choice of 4 cycles is conservative since the valves typically cycle close once before the secondary system board operators requests to manually control AFW (per SONGS simulator instructor). The results show no change in the CCDP for LOCAs.

70 SY-A13-06 III/II One of the top cutsets for loss of CCW has two SWC pumps in Investigate the concurrent No impact.

maintenance. The basic events are the same value and appear to be unavailability of SWC independent. Concurrent unavailability of two pumps in the same pumps and document Two SWC pumps (one from each systems is seldom independent. Often, the plant may prefer to have resolution/revise train) In one Intake structure are both out at the same time, or preclude the concurrent unavailability. probability of occurrence. taken OOS together when the This should be investigated. opposite unit Is Inan outage and the intake Isdewatered. This occurs every 18-month cycle with an outage duration of 45 days. This averaaes aoDroximatelv 30 davs/vr Page 34 of 38

Capability Item C o Proposed

_:^-i Resolution F&O of SR Observation from Impact on RI ISI Peer RievieW Team or 1 month/yr. Taking this into account, the CCDP & CLERP remain bounded by the submittal results.

71 SY-A13-07 1/11/111 Standby faults were not modeled (e.g., an open valve failed to remain Develop the standby faults No Impact.

open, standby filter plugged during standby, ...) for these standby components and evaluate Modeling of standby failures is the failure rate based on consistent with Industry and the the testing interval. level of available data. Standby failures such as those given by the example are discovered during demand tests. Any failures are included in reliability and availability data for SONGS.

72 SY-BI-01 [/111I11 The basis for documenting the grouping of component failure rates for Document the criteria and No impact.

updating is not well documented. There Is at least one instance results of basic events (instrument air compressors) where common cause was not included, grouped for data updating. Documenting the current treatment but no Justification was documented for the exclusion. The statement 'Grouping of CCF will not change the of components was based treatment itself.

upon engineering udgment. does not sufficiently capture the assumptions used In grouping the components.

Document the exclusion of any potential common cause groups.

73 SY-B3-02 I/111111 The system analysis for AFW does not account for the potential for Add common cause failure A sensitivity study was performed to common cause failure of all three AFW pumps. While the TD AFW event for 3 of 3 AFW determine the impact of including pump does not have the same susceptibility as the two identical motor pumps. common cause failure of all three driven pumps, there Is some potential due to the system operational and AFW pump bodies Inthe model. It maintenance activities. was determined from this sensitivity study that this F&O has little impact on the acceptability of the RI-ISI submittal results.

74 SY-B3-04 I/I1/Ill No CCF modeled for any Fan, Filter, and Strainer. A sensitivity study was performed to determine the impact of including common cause failure of the AFWP suction filters and the containment emergency sump strainer (screens).

Note: The CCF of Train A and Train B sump screens are considered to be completely

_ __ dependent In the model due to the Page 35 of 38

. '.: ' ' Capabiility . .................. .: -- : ' -'-

Item Catepaot.y Resolutio Proposed n .

- f SR oF&O 'Observation' from' 'Iact on Rl IS'.

Peer Review Team sump design. It was determined from this sensitivity study that this F&O has little impact on the acceptability of the RI-ISI submittal results.

75 SY-B15-01 1/111/111 The system analysis for SWC does not include a failure event that An event disabling both No impact.

impacts both SWC intake structures. External factors such as seaweed, intake structures should fish, etc. have been experienced in the Industry. This Is particularly be added to the system Pipe break concurrent with a important since common cause failure of the all SWC pumps is not analysis. sudden loss of the intake structures modeled. is extremely unlikely. Seaweed/fish infestation has resulted Ineither a power reduction or a shutdown of the plant. However, the flow requirements of the circulating water system are much larger (207,000 gpmlcIrc pump vs.

17,000+gpm/SWC pump) than the saltwater cooling system. The suction of the SWC pump suction is also lower than the circulating water pumps such that the CW pumps would lose suction much earlier than the SWC pumps. Also, from plant experience, any unusual Influx of sea life causes an increase in pressure differential across the traveling screens. Operators decide whether to remove 1 or more circulating water pumps. Should all four be removed, there remains sufficient water despite the Influx to keep SWC running.

A recent large Infestation of seaweed caused a shutdown of Unit

3. Despite the forced shutdown, the saltwater cooling pumps from the intake could have supplied sufficient water to support SWC. Historically, SONGS has never had a loss of SWC because of Insufficient ocean water suoolv. Given the rarity of Page 36 of 38

emCa ty Proposed Resolution t F&O Caeor Obsenvatlon from Impact on RI ISI

. -... : . Peer Review Team such an Infestation of the magnitude that shuts down a plant, post-LOCA infestation is extremely unlikely.

Page 37 of 38

Note 1: As of the current Safety Monitor model (6/7/04), the following F&O's have been resolved and incorporated:

IE-C12-01, IE-C12-02, IE-C12-03, AS-B6-01, AS-C3-02, SY-Al 1-01 After including these resolutions and other model refinements (since the version of the plant model used in the RI-ISI submittal ), the conditional core damage probability has decreased.

Page 38 of 38

ML042610214

Contents

Text

Subject:

Reference:

Subject:

Dear Sir or Madam,

Navigation menu

ML042610214

Text

Subject:

Reference:

Subject:

Dear Sir or Madam,

Navigation menu

Search