Text

12-5023272-01, Risk Assessment for Alternate STS End States
	ML050560037
Person / Time
Site:	Oconee, Arkansas Nuclear, Crystal River, Nuclear Energy Institute, Crane
Issue date:	02/08/2005
From:	; AREVA, Framatome ANP, Siemens
To:	; NRC/FSME
References
	+KBR1SISP20050413, 43-2441Q-00 12-5023272-01
	Download: ML050560037 (96)
	v • d • e

1027-0 (6/8/2004)

SOURCE REFERENCE RECORD 43-2441 Q-OPRisk Informed LCO End State Changes, RAls Document NumberlTitle Source Reference for:

gk;rrlos File No.

12-5023272-01 Subject

~

Risk Assessment for Alternate STS End States Framatome ANP, Inc., an AREVA and Siemens company Remarks/Applicable Licensing Document

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question #I RG 1.177 requires that risk related Technical Specification (TS) changes address potentially high risk plant configurations that should be avoided/considered (Tier 2 constraints). BA W-2441 does not address these considerations; recommend that Tier 2 considerations be addressed.

Response To Question # 1 The risk-informed evaluation in BAW-244 1 relies upon the plant-specific configuration risk management programs (CRMP) that are required by the Maintenance Rule (10CFR50.65). The B&W Owners Group (B&WOG) plant programs for configuration risk management provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when equipment beyond the affected Limiting Condition for Operation (LCO) is taken out of service at the same time. The CRMP ensures that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity.

The plant-specific implementations of CRMP involve identification of potentially high-risk configurations that could exist when equipment is taken out of service simultaneously. In the case of the subject LCOs, that equipment may include the redundant train(s) of safety equipment, and associated support or dependent systems. It also includes any equipment out of service that could increase the likelihood of a challenge to the affected safety systems. The TSs already recognize the higher risk associated with more than one train of a safety system out of service; however, it is noteworthy that some of the mitigation equipment that the Modes 4 and 5 risk assessments have credited is not required by the TSs to be available below Mode 4. In addition to the protections provided by TSs in Mode 4, the CRMP ensure that the B&WOG utilities will evaluate defense-in-depth prior to taking equipment out of service coincident with the affected LCOs. The B&WOG commitments to their plant-specific CRMP satisfy the Tier 2 and Tier 3 requirements of Regulatory Guide 1.177.

Page 1 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Questions # 2,3 and 7 As justification for the proposed change of the end-state from Mode 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months to Mode 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for LCO 3.3.5 (ESFAS Instruments) Required Action 8.2.3 and LCO 3.3.6 (ESFAS Manual Initiation) Required Action 8.2, the "Basis for Proposed End-state" section states that when operating in Mode 4 there are more mitigation systems available to respond to initiating events that could challenge RCS inventory or decay heat removal than when operating in Mode 5.

Please provide a comparison of the availability of the mitigating systems (e.g., high pressure injection and emergency feedwater system) between Modes 4 and 5 operations.

Response To Questions # 2.3 and 7 Note: Plant outage planners are expected to provide for contingencies when equipmenthystems important to reactor coolant system (RCS) make-up and core heat removal are removed from service, i.e., make appropriate use of the configuration risk management requirements of the maintenance rule (1 OCFR50.65). The following discussions are based only on equipment/systems availability for the stated plant operating states in order to clarify their understanding.

Decay Heat Removal Considerations I

Decay Heat Removal Considerations - Mode 4 When in Mode 4 not on shutdown cooling (SDC)', reactor coolant pumps (RCPs) will be in service and the steam generators (SGs) will be removing core energy; the SDC system (also known as the decay heat removal system, DHR) is available as a backup method of core cooling.

In this plant condition, there are two trains of condensate/feedwater available to provide feed to the SGs; one is in service and one is in standby. In addition, for all but Davis-Besse (DB), there is also at least one [onsite standby power source] powered motor-driven emergency feedwater (EFW) pump available. Davis-Besse has a motor-driven feed pump and startup feed pump that are powered from [onsite standby power source] via manual control room power alignment For Davis-Besse, when Mode 4 is entered, SDC is aligned in parallel with forced RCS flow SG operation to accommodate low-temperature overpressure (LTOP) concerns. A relief valve in the SDC system serves to prevent overpressure of the RCS for LTOP control versus the pilot-operated relief valve (PORV) for all other plants.

Page 2 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" operations. For all plants, turbine-driven EFW pumps are available given that SG steam conditions are adequate2 or an auxiliary steam supply is available.

While in this plant operating condition, a loss of feedwater (FW) can be mitigated via use of standby condensate/feedwater train, motor-driven EFW pumps, and turbine-driven EFW pumps.

Should all of these systems become unavailable, then the SDC system can be used.

Decay Heat Removal Considerations - Mode 5 Prior to entering Mode 5, the RCPs are shutdown; net positive suction head becomes too low for continued operation. Once the RCPs are shutdown, the SGs are no longer in use as heat sinks for the RCS; the SDC system removes all of the core heat.. In this situation, if all SDC is lost, return to use of SGs can provide a means of restoring controlled core heat removal. However, as long as the RCPs are shutdown, the SGs are not immediately available for core heat removal. In addition, the further the cooldown proceeds, i.e., toward Mode 5 (< 200"F), the more time required to re-establish appropriate RCS conditions for RCP restart. Hence, the ability to immediately use SGs for core heat removal decreases as cooldown progresses. The SGs could be used in the natural circulation mode. However, this mode may not be immediately available if SGs are not operable (e.g., low SG pressure makes steam-driven feed pumps unavailable and the SGs may not be intact), or a significant reactor coolant (RC) heatup may be necessary to develop appropriate hydraulic heads for natural circulation (NC). Also, once in Mode 5, condensate/feedwater trains would not be available due to outage dependent realignments and/or maintenance requirements (systems may be disassembled).

Given these constraints, attempts to use SGs in Mode 5 would depend largely on motor-driven EFW pumps (or in Davis-Besse's case a motor-driven feed or startup pump). That is, SG(s) (if intact with RCS filled) will have very low pressure, near atmospheric, thus preventing use of turbine-driven feed pumps.

The Mode 5 probabilistic risk assessment (PRA) models used in BAW-2441 are conservative with respect to comparison of Mode 4 and Mode 5 risk, because they assume that while in Mode 5, the plant stays in the most-favorable plant operating state for availability of the SGs (i.e., SGs intact and RCS filled), even though this is not required by the Technical Specifications.

Turbine-driven EFW Pumps Davis-Besse: At the low end of operation of the turbine-driven auxiliary feedwater (AFW) (EFW at other plants) pumps, i.e., 43 psia steam inlet pressure, each pump will provide a flow rate - 200 gpm to a SG.

Mode 4 is entered at 5 280°F or a SG pressure of 49 psia. Because of this, on Mode 4 entry, these pumps can be used on a continuous basis as long as cooldown to Mode 5 is not initiated. However, the DB Mode 4 probabilistic risk assessment (PRA) model is conservative and assumes that the turbine-driven EFW pumps are unavailable unless the auxiliary boiler is on line.

All Other Plants: All other plants have typical low end EFW turbine-driven pump conditions of - 30 psia.

Mode 4 entry conditions for these plants are 5 280°F and 5 250°F (Oconee), which corresponds to 49 psia and 30 psia respectively. Because of this, on Mode 4 entry, these pumps can be used on a continuous basis as long as cooldown to Mode 5 is not initiated. However, the PRA model used in BAW-2441 for the generic non-DB plant is conservative and assumes that the turbine-driven EFW pump is unavailable in Mode 4 (and does not credit the auxiliary boiler).

Page 3 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" FW System I Likely To Be Available In Mode 4 CondensateIFeedwater X

Motor-driven Feedwater Pumps X

Turbine-driven Feedwater Pumps X

Decay Heat Removal Considerations Summary The following table provides the likelihood of feedwater systems being available during Mode 4 and 5 operations:

Likely To Be Available In Mode 5 X

RCS Inventory Considerations RCS Inventory Considerations - High Pressure Iniection (HPI')

HPI is available in Mode 4 for all plants; this may be on a standby basis or a manual operations basis.

When entering Mode 4, HPI is in the standby mode for DB, Crystal River (CR 3), and Oconee3.

For Three Mile Island (TMI), due to higher RCS temperature LTOP limits, HPI is in a deactivated mode, but remains available on a manual operations basis. Thus, when operating in Mode 4 above the RCS LTOP temperature limits, HPI is available-on a standby basis for Oconee, CR 3 and Davis-Besse and on a manual operations basis for TMI. Once cooldown proceeds in Mode 4 below the LTOP temperature limits, then HPI may be available on a standby basis for Davis-Besse4 and is available on a manual operations basis for the other plants. Thus, when in Mode 4, HPI is available to provide RCS make-up, if necessary. The PRA models used in BAW-2441 are conservative and assume that the HPI pumps at all of the plants are deactivated in Mode 4 and require manual action to initiate.

When in Mode 5, RCPs are off and RCS conditions allow shutdown of systems that provide RCP seals. For all plants except Davis-Besse, the HPI and Makeup (MU) pumps are one in the same.

Thus, when in Mode 5, the Makeup and Purification System, which includes the MU (HPI) pumps will be secured when RCP seals are no longer needed. After this point, these systems may or may not be available based on outage dependent realignments/disassembly for maintenance/surveillance purposes.

At Davis-Besse, the HPI and MU systems are independent. For this reason, Mode 5 operations at Davis-Besse may allow for use of HPI pumps further into the cooldown depending on outage requirements, e.g., the need to realigddisassemble HPI systems for maintenance/surveillance purposes. In general, it is expected that the HPI system at Davis-Besse has a greater likelihood of being available in Mode 5, than for other plants.

ANO-1 did not participate in this project, and is therefore not included in this discussion.

Davis-Besse uses a relief valve on the SDC system for LTOP pressure control. This valve can pass full HPI flow while preventing RCS pressure from increasing beyond LTOP limits. For this reason, HPI need not be deactivated at Davis-Besse when its LTOP RCS temperature limit is reached.

3 4

Page 4 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification' For LCO End-State Changes" For the PRA models used in BAW-2441, the HPI pumps are assumed to be available in Mode 5 (on a manual operations basis), because this is the most conservative assumption with respect to comparison of Mode 4 and Mode 5 risk. If the HPI pumps are not available in Mode 5, then the PRA results would indicate an even larger contrast between the Mode 4 and Mode 5 risk than shown in this risk assessment.

HPI - Summary At all plants HPI is considered to be available when operating in Mode 4 on either a standby or manual operations basis. This is contrasted by operations in Mode 5, where HPI is unlikely to be available for all plants except Davis-Besse once RCP seals are no longer needed; at Davis-Besse, HPI may be available in Mode 5 since these pumps do not supply RCP seals and may remain in standby.

RCS Inventory Considerations - Low Pressure Ini ection (LPI)

When operating in Mode 4, one train of LPI' will be operable (i.e., in standby or able to be realigned to ECCS mode); the other train is not required and therefore may only be available on a delayed manual operations basis. This is contrasted with operations in Mode 5, where LPI is not required and therefore may not be available other than on a delayed basis due to potential need to realignheassemble from maintenance/surveillance conditions.

For the PRA models used in BAW-2441, LPI is assumed to be available in Mode 5 (on a manual operations basis) even though it is not required by Technical Specifications, because this is the most conservative assumption with respect to comparison of Mode 4 and Mode 5 risk.

LPI - summary In Mode 4, one LPI train will be available for RCS makeup, if necessary. In Mode 5, due to maintenance/surveillance considerations, LPI may not be available except on a delayed basis; depending on conditions, i.e., system may be disassembled, such delays can be lengthy.

DHR and Low Pressure Injection (LPI) are essentially the same systems. When aligned as DHR, the system provides core cooling via heat exchangers to the plant's ultimate heat sink. When aligned as LPI, the system adds inventory to the RCS. Having DHR (LPI) available means one train is operable in Mode 4, i.e., it can be manually realigned to the LPI mode.

Page 5 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Questions # 4,4.a, 4.b, 8, 8a and 8b In the "Basis for Proposed End-state" section, it provides a justification for the proposed change to allow for continued operation in MODE 4 by deleting the end-state of MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for LCO 3.4.6 (RCS Loops -Mode 4) Required Action A. 2 when one required loop is inoperable, and if one DHR loop is operable. It states that, "When operating in MODE 4 if both RCS loops and one DHR loop [are] inoperable, the existing LCO requires cooldown to Mode 5. In this situation, SGs are available for core heat removal and transpotf via NC in Mode 4 without the need for significant RCS heatup. "

a. Is the definition of RCS loop inoperability restricted to the situation in which a RCP is inoperable, or does it include unavailability of a SG, such as main feedwater and EFW not in operation?

b. For the situation for which the RCS loop inoperability is due to SG unavailability (with or without RCP inoperability), should the required action be the initiation of EFW to make a SG available for decay heat removal via forced circulation or NC depending on operability of RCPs? Should the proposed deletion of Required Action A.2 end-state be modified to require the verification of or initiation of action immediately to make at least one SG available?

Response To Questions # 4,4.a, 4.b, 8,8a and 8b The proposed deletion of Required Action A.2 from LCO 3.4.6 RCS Loops - MODE 4 is based on the plant condition where only one of the four required RCS Loops is available and that loop is a DHR system. Thus, in this condition, core heat is being removed via the available DHR system with both SG loops and the other DHR system loop not available.

In accordance with the basis for this LCO, i.e., B 3.4.6 RCS Loops - MODE 4, the intent of the LCO is to provide forced flow from at least one RCP or one DHR pump for decay heat removal and transport. This intent inherently includes operability of SG and/or DHR systems. In order to accommodate this intent, the Improved Standard Technical Specifications provide the following LCOs that address operability of SG and DHR systems while in Mode 4:

3.7.4 Atmospheric Vent Valves (AVVs) 3.7.5 Emergency Feedwater (EFW) System 3.7.6 Condensate Storage Tank (CST) 3.7.7 Component Cooling Water (CCW) System 3.8.8 Service Water System (SWS)

To further address loss of SG and DHR systems while in MODE 4, Required Action A.l of the LCO of interest, i.e., 3.4.6 RCS Loops - MODE 4 prescribes a completion time of immediate to "Initiate action to restore a second loop to OPERABLE status.1t Thus there is already a requirement (within Required Action A. 1) to immediately take action to restore a SG system to operable status in the event action is not already underway as a result of the LCOs listed above.

For this reason, there is no need to modify Required Action A.2 (of LCO 3.4.6) to provide such actions.

Page 6 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" With respect to the risk analysis, the calculations that were performed originally for BAW-244 1 assumed that the plant was in this LCO due to loss of forced flow from the RCPs, in other words, natural circulation cooling via the SGs was still possible. Because of this request for additional information (RAI), the PRA models for this LCO have been revised, and the risk results presented in this submittal (i.e., RAI responses) now assume that when in this LCO, that no SG cooling is available, in addition to unavailability of one DHR train.

Page 7 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" B.l Be in MODE 3.

AND B.2 Be in MODE 4.

Questions # 5 and 9 The proposed change is to replace the end-state of LCO 3.5.4 (BWST) associated with the boron concentration requirement from Mode 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months to Mode 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

However, Required Action E.2 in the table on Page 45 specifies that the plant be in Mode 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months for Condition E, which states that "Required Action and associated Completion Time not met. " Since Required Action E.2 is for the Conditions of BWST borated water temperature and volume not within their limits, should Condition E be modified to "Required Action and associated Completion Time for Conditions other than Condition A not met"?

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours Response To Questions # 5 and 9 The table on page 45 is in error; it does not correctly reflect that Condition E should be modified to acknowledge that BWST water temperature and volume are not included in the requested change. The following revised ACTIONS table provides the proposed method to address this situation:

C.l Restore BWST to OPERABLE status.

CONDITIONS 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months A. BWSTboron concentration not within limits.

D.l Restore BWST to OPERABLE status.

B. Required Action and associated Completion Time of Condition A not met.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months C. BWST water temperature not within limits.

E.l Be in MODE 3.

AND E.2 Be in MODE 5.

D. BWST inoperable for reasons other than Conditions A or C.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours E. Required Action and associated Completion Time of Condition C or D not met.

A.l Restore BWST to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months OPERABLE status.

Page 8 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Questions # 6 and 10 The lower limit for the BWST boron concentration specified in SR 3.5.4.3 was established to ensure that, following a LBLOCA, the reactor will remain shutdown in the cold condition following mixing of BWST and RCS water, and the upper limit is to avoid boric acid precipitation from the core. In "Basis for Proposed End-state" section for LCO 3.5.4, it states that the boron concentration limit is very conservative with shutdown margin in excess of approximately 9%, and that deviations in boron concentration will be relatively slow and small and boric acid addition systems would normally be available. However, LCO Condition A only specifies "6 WST boron concentration not within limits" without specifying the maximum deviations.

Please provide the maximum allowable deviations, including justifications and bases, from both lower and upper boron concentration limits that the stated justifications as the basis for proposed end-state of Mode 4 remain valid, and propose change to Required Action consistent with the maximum allowable deviations.

Response To Ouestions # 6 and 10 The requested change to LCO 3.5.4 is to allow for Mode 4 operation if boron concentration is outside the operating limits for a period greater than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months and create a new action to maintain the current end state for other inoperabilities. The justification for this position lies in the reasons for the high and low boron limits.

The low BWST boron concentration limit is based on postulated Mode 1 large break LOCAs that assume that all rods remain withdrawn from the core following initiation of the event. However, upon entry into Mode 3, the reactor is shutdown (i.e., the core is subcritical - rods are inserted) and maintained shutdown by operating procedures and other administrative controls. When in Mode 4, the large break LOCA, which is the event of concern relative to the BWST low boron limit, is of very low probability. Also, decreases in BWST boron concentration, owing to the large amount of BWST water and the low capacity of associated dilution systems, will be slow, thus allowing ample time for operator recognition and restoration.

The high BWST boron concentration limit is also based on postulated Mode 1 large break LOCAs. For these LOCAs, boron is postulated to concentrate in the core with the time to implement actions that prevent coolant flow channel blockage being dependent on the initial power level; the higher the initial power level, the shorter the time available. Again, on entry into Mode 3, the reactor is shutdown and maintained shutdown with the event of concern, i.e.,

large break LOCA, being of very low probability once in Mode 4. Due to the low power levels associated with Mode 4, there will be ample time to establish boron dilution flow paths should the need arise.

In the event the high or low BWST boron concentration limit is exceeded when in Mode 4, operators will take the necessary actions to restore boron concentrations to within the existing limits; this is no different from the existing LCO. The only difference is that the operator is not required to enter Mode 5. In summary, this change is acceptable because the reactor will be shutdown (subcritical with rods inserted), core power level will be low and there is a very low probability of occurrence of a large break LOCA when in Mode 4. The impact from marginally Page 9 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" high or low boron concentration deviations (i.e., from prescribed limits) that might occur during operator action to restore such concentrations, has a negligible risk impact, especially when considering the limited time interval of such deviations. For these reasons, no additional specific delineation of deviations from limits is considered necessary.

Page 10 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question # 11 The submitted information does not provide sensitivity studies investigating the robustness of the results to uncertainties in data and modeling assumptions. Examples of potential uncertainties in data used during Modes 3, 4 and 5 are initiating event frequencies, recovery probabilities and common cause failure probabilities. This type of data are usually taken from the power operation risk models and adjusted to reflect the different shutdown conditions (e.g., LOCA) frequencies are often assumed to be one or two orders of magnitude lower in Mode 4 than in Mode I, due to the reduced RCS pressure. Such adjustments may not always be conservative and at times may include significant uncertainties. An example of potential non-conservative modeling assumption during Mode 4 (while on SG cooling) is the modeling of RCP seal LOCAs. Please investigate the robustness of the quantitative risk assessment results and provide your findings, including supporting discussions, for the staff's re view.

Response To Question # 11 The risk model for Mode 3 was created by making adjustments to the Mode 1 (at-power) PRA model as described in this RAI. However, Mode 3 is a transition mode, and the risk from that mode is the same regardless of whether going to the current end state (Mode 5 ) or the requested end state (Mode 4). Therefore the response to this RAI will address Modes 4 and 5. In the DB shutdown PRAY which was used as a basis for the analysis in BAW-244 1, the models for Modes 4 and 5 were not created by making adjustments to the at-power PRA. Separate PRA models were created for Modes 4 and 5. Various features of these PRA models and their sensitivities are discussed in the responses to these MIS.

Before discussing data sensitivities, it is useful to present the base case (i.e., no sensitivity) core damage frequency (CDF) results for each of the modeled LCOs, as well as the no-LCO case.

Page 11 of 33

Response to: Request For Additional Information Regarding BAW-2441, Risk-Informed Justification For LCO End-State Changes B. AC vital bus inoperable C. DC distribution subsystem inoperable 4.44e-5 4.60e-5 3.8.7 Inverters A. One inverter inoperable 4.44e-5 3.4.6 RCS loops-Mode 4 A. One RCS loop inoperable 4.47e-3 Base Case Results Using DB Shutdown PRA I CDF of End State (&-yr)

Tech Spec I Condition I Mode4 I Mode5 5.62e-5 1.42e-4 5.62e-5 4.83e-3 Base Risk I NoLCO I 3.37e-6 I 1.18e-5 3.7.7 ccw I A. One CCW train inoDerable I 7.60e-5 Note for Tables Note 1: The results for the cases one offsite circuit inoperable and two offsite circuits inoperable may be optimistic because the plant requires the emergency diesel generator(s) (EDGs) associated with the affected power division to be normally running (as well as the corresponding EFW pumps) while in the LCO. That improves the risk. However, the PRA model does not completely accommodate these LCOs because it does not include failure of the EDGs as an initiating event. Since the PRA model did not anticipate failure of EDGs as an initiating event, certain cut sets involving EDG run failures are underestimated. However, failure of all of the EDGs while in these LCOs will affect both Mode 4 and Mode 5 uniformly and add equally to both CDF estimates. Hence, the relative comparisons between Mode 4 and Mode 5 for these LCOs are valid.

Sensitivity to Initiating Event Frequency for Loss of RCS Inventory In the PRA models for Mode 4 and Mode 5 initiating event frequencies for loss of RCS inventory are broken out into events occurring inside or outside of the Reactor Building (RB).

RCS leaks less than about 100 gpm are not considered significant unless at mid-loop operation (which is not applicable for this submittal because the requested Mode 4 end state does not involve mid-loop operation, and the PRA model for the current Mode 5 end state assumes the plant is in the beginning of Mode 5 before RCS drain down). The initiating event frequencies used are shown in the table below6. Since DB aligns the RCS to SDC in Mode 4, and the end state RCS pressures are similar, the same initiating event frequencies are used for both Modes 4 and 5. The dominant contributors to the loss of inventory initiating events are failed open relief valves on the DHR (ie., SDC) lines. The flow rate for failure of the relief valve inside the RB is estimated at 100 to 200 gpm, and the relief valve outside the RB.is estimated at 400 gpm.

The LOCA Frequency for Mode 4 and 5 for Davis-Besse loss of coolant initiating event was obtained from Wells, J., et al., An Analysis of Loss of Decay Heat Removal Trends and Initiating Event Frequencies (1989-1998); EPRI Report TR-113051, October 1999.

6 Page 12 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Large Loss of RCS Inventory Inside the Reactor Building Large Loss of RCS Inventory Outside the Reactor Building Mode4 Mode5 8.41e-3/yr 8.41e-3/yr 1.26e-2/yr 1.26e-2/yr The loss of inventory initiating event frequencies used in the DB Mode 4 and Mode 5 PRA models are much higher than the corresponding LOCA frequencies used in Mode 1 or Mode 3.

By comparison, the LOCA frequencies used in the at-power (Mode 1) PRA for DB are: large LOCA 5e-6/yr, medium LOCA 4e-5/yr, small LOCA 5e-4/yr. The DB Mode 3 PRA model uses the Mode 1 values divided by 7.5.

For DB, the loss of inventory frequency difference between Modes 4 and 5 may be small, and in the PRA model it was assumed to be the same. Therefore, a sensitivity run was made to determine the impact upon the results if the Mode 4 loss of inventory frequency is significantly worse than in Mode 5. A set of runs was made with the Mode 4 loss of inventory frequencies increased by a factor of 5 and the Mode 5 frequencies left the same. This sensitivity case (see tables below) shows the robustness of the results even if the frequency of these initiating events is significantly worse in Mode 4 than Mode 5.

Mode4 Mode5 Large Loss of RCS Inventory Inside the Reactor Building 4.2 1 e-Yyr 8.41 e-3/yr Large Loss of RCS Inventory Outside the Reactor Building 6.30e-2/yr 1.26e-2/yr Initiating Event Frequency Sensitivity (DB model)

Page 13 of 33

Larne Loss of RCS Inventorv Inside the Reactor Building:

I Large Loss of RCS Inventory Outside the Reactor Building I 5.4e-3/yr I 1.26e-2/yr I Mode4 Mode5 8.41e-3/vr 8.41e-3/vr Large Loss of Inventory Initiating Event Frequencies used in Non-DB Loss of Inventorv Sensitivitv Runs Large Loss of RCS Inventory Inside the Reactor Building Large Loss of RCS Inventory Outside the Reactor Building Mode4 Mode5 4.2 1 e-2/yr 8.41 e-3/yr 5.4e-3/yr 1.26e-2/yr Page 14 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Initiating Event Frequency Sensitivity (non-DB Model)

The DB PRA model for Modes 4 and 5 was modified to reflect differences that exist in other B&WOG plants. See BAW-2441 and the response to RAI #12-2 for a description of the changes that were made to the DB PRA model so that it would be representative for plant configurations such as may exist in the other B&WOG plants.

7 Page 15 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Sensitivity to Initiating; Event Frequency for RCP Seal LOCA The representative Mode 4 PRA model (DB) does not include RCP Seal LOCAs. The justification for not including RCP seal LOCAs in Mode 4 is:

0 The likelihood of a seal LOCA is less than at power because the RCS pressure in Mode 4 is less than in Mode 1. The pressure dissipated by the entire three-stage seal package in Mode 4 (where RCS pressure is less than 700 psi) is same or less than the pressure dissipated by a single seal stage (i.e., approximately 700 psi) during normal non-faulted operation.

The reduced temperature in Mode 4 decreases the rate of seal thermal degradation relative to an event in Mode 1, which significantly extends the time until seal failure.

The resulting flow rate from a seal LOCA is much less in Mode 4 due to lower RCS pressure and fewer RCPs running, and is expected to be within the capacity of a single makeup pump.

Nonetheless, a sensitivity case was performed where seal LOCA sequences (extracted from the Mode 3 PRA model) were put into the Mode 4 model. For the purpose of screening, the operator action associated with failure to trip RCPs was given a probability of 1.O. The Mode 4 model was insensitive to the seal LOCA contribution, generating no new cut sets for either the base case (no LCO) or any of the LCOs. Core damage from loss of RCP seals requires a transient initiating event, failure of the operator to trip the RCPs (screening probability =1.O), failure of seal injection and cooling, and for core damage also failure of either safety injection or recirculation. The probability of these sequences is insignificant relative to the generic loss of RCS inventory initiating event already included in the model.

Sensitivity to Initiating; Event Frequency for Transients Initiating events for transients in Mode 4 and Mode 5 involve loss of the operating decay removal method: either SDC (i.e., the DHR system) or SG cooling, including associated support systems (e.g., power, cooling water). For this sensitivity study, the investigation focused on initiating events that have the potential to affect Mode 4 risk to a greater extent than Mode 5 risk.

The loss of feedwater initiating event has the potential to affect Mode 4 risk, since SG cooling is the main cooling method in Mode 4. However, the DB Mode 4 risk mo'del was not sensitive to the loss of feedwater initiating event frequency. Power system failures were more dominant because they have greater potential for affecting backup mitigation systems as well. Therefore, the sensitivity analysis for loss of feedwater was run on the modified model that was created to show the sensitivity to B&WOG plant differences. The "non-DB" risk model is more sensitive to loss of feedwater frequency because that model takes no credit for the auxiliary boiler (thus defeating the turbine-driven EFW pump) and takes no credit for the non-safety related pumps (such as the startup feed pump). The sensitivity runs shown in the table below increase the loss of feedwater initiating event fi-equency by a factor of five (from 0.22/yr to 1. Uyr). This change applies to Mode 4 only. Mode 5 results are the same as the base model because there is no loss of feedwater initiating event in Mode 5. This sensitivity analysis (see table below) shows that the results of the Mode 4 versus Mode 5 end state comparison are robust even considering uncertainties in loss of feedwater initiating event frequency.

Page 16 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Initiating Event Frequency Sensitivity (non-DB Model) 5X Increase in (Mode 4) Loss of Feedwater Another initiating event that is important to risk is loss of offsite power (LOOP). The LOOP initiating event is important because loss of power sequences have the potential to disable the preferred, the backup, and the emergency cooling methods, whichever the operating mode.

Therefore a set of sensitivity cases was run where the loss of offsite power initiating event frequency was increased by a factor of five (to 0.5/yr). The initiating event frequency for LOOP is the same for both Mode 4 and Mode 5, the value used in the base models (O.l/yr) is higher than is typical for at-power operation and is intended for shutdown operating states where activity may be occurring in the switchyard. It was applied to Mode 4 as well as Mode 5 under the conservative assumption that the proposed end state of Mode 4, when implemented, may see the same sort of switchyard activity that otherwise might occur in Mode 5. As expected, the risk in both end states is sensitive to loss of offsite power frequency, as the table below shows.

Dominant cut sets involving LOOP coincident with failure of onsite standby power sources are consistently present in most of the runs. However, the relative relationship of Mode 4 to Mode 5 risk is similar to the base case. Therefore, the uncertainty in LOOP initiating event frequency does not affect the robustness of the results.

Page 17 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Initiating Event Frequency Sensitivity 5X Increase in LOOP 1 CDF of End State URx-vrl I Another sensitivity case for transient initiating events is failure of support systems associated with cooling. A set of cases was run varying the initiating event frequencies for loss of component cooling water (CCW) and service water (SW). The initiating event frequencies for loss of CCW and SW pumps were increased by a factor of five. The changes to CCW pump failure frequency (from 0.1 14/yr to 0.57/yr) and SW pump failure frequency (from 7.51e-2 to 0.376/yr). were made simultaneously. The results for Mode 5 were affected more by this change than Mode 4, therefore another set of cases were run where the same initiating event frequencies were reduced by a factor of five. The results are shown in the set of tables below.

The results show that uncertainty in the initiating event frequency for loss of cooling water support systems does not affect the robustness of results.

Page 18 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Tech Spec Base Risk Initiating Event Frequency Sensitivity 5X Increase in Loss of CCW and SW 1 CDF of End State (IRg-vrl I I

Condition Mode4 I Mode5 No LCO 3.42e-6 1 1.55e-5 Initiating Event Frequency Sensitivity 5X Decrease in Loss of CCW and SW I CDF of End State (IRg-vr) 1

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Sensitivity to Recovery Probabilities The recovery model in the DB shutdown PRA was examined to determine if there is more uncertainty in the recovery probabilities in Mode 4 than the Mode 5. The recovery probabilities are based in part on the time available, e.g., until RCS level drops due to boiling and uncovers the top of the fuel. The time to boil and uncover the core is a function of the decay heat, which is dependent on time since shutdown. The decay heat in Mode 4 is highest during the first 8 to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , when the plant is normally cooling down to Mode 5. The risk accumulated during this time is the same whether the end state is Mode 4 or Mode 5. After that time the decay heat load is the same whether the plant is in Mode 5 or Mode 4.

The RCS temperature is initially higher in Mode 4, but so is the subcooled margin. Even if the time to boil were slightly shorter in Mode 4, this difference is small relative to the time available until sufficient inventory boils off to uncover the core. The initial RCS inventory is also the same for both end states (assuming the operators have not started draining the RCS once into Mode 5). Therefore, the timing for human reliability analysis for the Mode 4 and Mode 5 end states is similar. More importantly, there is no reason to assume that uncertainty differentially affects Mode 4 recovery probabilities over Mode 5. Therefore, the sensitivity adjustment was applied to both Mode 4 and Mode 5 equally. A set of sensitivity runs was made for both modes with all of the failure probabilities for recovery increased by a factor of ten (any that were greater than 0.1 were changed to 1.O). The results are in the table below. The results of the Mode 4 versus Mode 5 end state comparison are robust even considering order of magnitude uncertainties in the recovery probability model.

Data Sensitivity Page 20 of 33

Response to: Request For Additional Information Regarding BAW-2441, Risk-Informed Justification For LCO End-State Changes Sensitivity to Common Cause Failure Probabilities A set of sensitivity analysis runs was made with the DB Mode 4 and Mode 5 PRA models to investigate sensitivity to common cause failure (CCF) probability. In these runs, all of the CCF probabilities were increased by a factor of three. This adjustment was applied to both Mode 4 and Mode 5, because there is no reason why CCF would favor one end state over the other.

These adjustments resulted in some very high values for the CCF parameters (i.e., beta-factors and other multiple Greek letters). Typical examples of post-adjustment beta-factors are 0.15 for HPI pump fails to start, and 0.48 for check valves fail to open. Results are shown in the table below, and demonstrate that uncertainty in CCF data does not affect robustness of results.

Data Sensitivity 3X Increase in Common Cause Failure Probabilities Additional Comments Regarding Sensitivity The sensitivity analyses shown above demonstrate that the risk of core damage in Mode 4 is favorable compared to the risk in Mode 5, even if uncertainties are considered. In addition to these uncertainties, the adjustment that was made to the DB shutdown PRA model, so that it would include features of other B&WOG plants, shows that the results are robust even considering differences in certain plant features. These differences are discussed in BAW-244 1, and are elaborated on further in the response to RAI #12-2. The alternate risk model not only shows the applicability of the Topical Report findings to the other B&WOG plants, it also is a sensitivity analysis of sorts because it demonstrates that the impact of some modeling assumptions and configuration differences do not affect the conclusions of the topical report.

Page 21 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question # 12-1 Please provide risk assessment results for each individual LCO and identify any potential high risk configurations which must be allowed only in conjunction with risk management actions based on approved implementation guidance. The quantitative risk assessment results, in terms of core damage frequency (CDF), are provided only as numerical averages of several LCOs. In addition, it is stated that the Mode 4 (on SG cooling) end state is associated with less risk than the Mode 4 (on shutdown cooling (SDC)) and Mode 5 end states, for all the individual LCO conditions for which end state change is proposed. However, this information does not provide any insights about potential high risk configurations-that may occur when additional equipment, beyond the one associated with the non-met LCO, is inoperable.

Insights about potential high risk configurations are needed, according to applicable regulatory guidance, to identify risk management actions and ensure that the proposed changes will be safely implemented.

Response To Questions # 12-1 The risk assessment results for each individual LCO have been provided in the response to RAI

11. These risk results cover all of the LCOs that could be explicitly modeled in the PRA. As explained in BAW-2441, for some of the LCOs, the equipment of interest is not explicitly modeled in the PRA for Modes 4 and 5. These systems are not modeled in the PRA because they have a negligible or intangible contribution to CDF in these modes (e.g., boron concentration, containment). For these LCO conditions, the general trend exhibited by the modeled LCOs, and the base case (i.e., no LCO condition) is relied upon. That is, since the base case and the modeled system LCOs all show reduced CDF in Mode 4 versus Mode 5, then it is logical that the differences in CDF for the m o d e l e d systems are in the same direction and less significant. This taken with the qualitative analysis, supports the assertion that the CDF is better in the proposed Mode 4 end state with the RCS on SG cooling than the Mode 5 end state, for all of the proposed LCO end state changes.

Examination of the cut sets for the proposed end state (Mode 4) (see also response to RAI #14) provides a general insight into the high risk contributors for the base (non-LCO) case. The table below summarizes the top contributors for the LCO cases. Dominant contributors when in the LCOs are similar to the base cases, with the most important contributions coming from failures of the redundant or functionally redundant systems or trains. Failures that affect normal cooling (feedwater) and also backup and emergency cooling methods (i.e., DHR and ECCS) are the most important contributors. The most common reasons for those failures are cut sets involving LOOP and failure of the diesel generators, because these affect SG cooling as well as back up DHR and ECCS cooling. (Similar results would be expected for the plants that have a standby onsite power source other than diesel generators, i.e., Oconee). When the reason for being in an LCO is inoperability of one train of a safety system, (such as EDG, batteries, CCW, or SWS) then CCF of the remaining train(s) is often a risk contributor. Loss of RCS inventory events are also important contributors, especially when the LCO reduces the redundancy of the ECCS.

Examination of the cut sets indicates that the equipment that dominates risk while in these LCOs are generally in the systems that are already recognized as important contributors by the TSs and for which the conditions and compensatory action statements are written. One insight that is clear is that having ECCS capability is important, even if operator actions are required to reactivate the HPI pumps. Availability of ECCS in the current Mode 5 end state is not Page 22 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" guaranteed by TSs, even though it was credited in this PRA evaluation. The systems that tended to be dominant in this risk evaluation also have high priority in the plant-specific CRMP, and are not likely to be overlooked when making preparations for maintenance activities and equipment outages.

However, it must be cautioned that insights drawn from these results can only be used for general guidance. The CRMP used by the participating B&WOG plants evaluate the potential high risk configurations in real or near-real time. This has the advantage of being able to consider the specific combinations of equipment out of service for both the LCO and the balance of the plant, and the ability to evaluate the risk for the specific plant configurations (i.e., which trains normally operating, in standby, the alignments, etc.), which are too numerous to evaluate in their entirety here. Furthermore, the LCO evaluations performed for this risk evaluation may be conservative because they assume the complete unavailability of all of the equipment associated with the particular LCO condition (such as an entire division or train), whereas the CRMP can consider the specific conditions that are applicable at the plant. Consequently, it is the B&WOG plant programs for configuration risk management that ultimately provide the assurance that risk-significant plant equipment outage configurations will not occur when equipment beyond the affected LCO is also taken out of service.

Tech Spec 3.7.7 ccw 3.7.8 SWS 3.8.1 AC sources TOD Mc Condition A. One CCW train inoperable A. One SWS train inoperable A. One offsite circuit inoperable B. One diesel generator inoperable ie 4 Risk Contributors' Top Failures Contributing to CDF LOOP Station blackout (SBO) diesel or associated operator actions EDG associated with operable CCW train CCF of other CCW pumps LOOP SBO Diesel or associated operator actions EDG associated with operable SWS train CCF of other SWS pump Feedwater LOOP EDGs SBO Diesel or associated operator actions Unaffected power bus Loss of inventory event Feedwater Operator actions (feed and bleed)

LOOP CCF of unaffected EDG SBO Diesel or associated operator actions Diesel S U D D O ~ ~

svstems Top contributors are taken from both the DB and the generic "non-DB" Mode 4 PRA models, based on Fussell-8 Vesely importance.

Page 23 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Tech Spec 3.8.4 DC sources 3.8.9 AC/DC Distribution 3.8.7 Inverters

~~

Condition C. Two offsite circuits inoperable D. One offsite circuit and one diesel generator inoperable E. Two diesel generators inoperable A. Battery charger[s]

on one train inoperable B. Batter[y][ies] on one train inoperable C. One DC subsystem inoperable - other A. AC distribution subsystem inoperable B. AC vital bus inoperable C. DC distribution subsystem inoperable A. One inverter inoperable Top Failures Contributing to CDF EDGs SBO Diesel or associated operator actions Batteries Diesel-backed DHR or feed pumps Loss of inventory event Operator actions (feed and bleed)

LOOP CCF of unaffected EDG SBO Diesel or associated operator actions Diesel sumort svstems LOOP SBO Diesel or associated operator actions LOOP EDGs SBO Diesel or associated operator actions Battery Loss of inventory event Operator actions (feed and bleed)

LOOP EDG associated with operable DC train SBO Diesel or associated operator actions CCF of other battery Unaffected power bus LOOP EDG associated with operable DC train SBO Diesel or associated operator actions Battery associated with operable power bus Unaffected power bus LOOP EDG associated with operable AC subsystem SBO Diesel or associated operator actions HPI pump associated with operable AC subsystem Operator actions (feed and bleed)

Feedwater LOOP EDG associated with operable AC train SBO Diesel or associated operator actions Battery associated with operable power bus Unaffected power bus Loss of inventory event Operator actions (feed and bleed)

LOOP EDG associated with operable DC train SBO Diesel or associated operator actions Battery associated with operable power bus Unaffected power bus LOOP EDG associated with operable power bus SBO Diesel or associated operator actions Battery associated with operable power bus Unaffected power bus Loss of inventory event ODerator actions (feed and bleed)

Page 24 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Mode 4 Condition A. One RCS loop inoperable DHR pump Operator actions (feed and bleed)

CCW pumps

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question # 12-2 There are differences in the RCS pressures allowed while the plant is in Mode 4 (on SG cooling). As a consequence, following a total loss of feedwater, there will be cases where a plant may need to enter SDC from relatively high pressures. Please list the means (and required actions) the various Babcock and Wilcox-designed plants have to depressurize the RCS to SDC entry conditions and discuss how these means and actions were modeled in the risk assessments.

Response To Questions # 12-2 All plants have a pressurizer spray, PORV and pressurizer vent available to reduce RCS pressure to SDC implementation pressures. CR 3, Oconee and DB have an auxiliary high pressure spray source that allows for spray at pressures above SDC when RCPs are off.

The PORV and pressurizer vent are available via operator action from the control room.

Auxiliary high pressure spray sources are available via manual operator action; actions external to the control room may be necessary depending on plant-specific designs.

Risk Assessment for other B&WOG plants In BAW-244 1 a PRA sensitivity case was made to account for the pertinent differences between DB and the other B&WOG plants, and to show that the conclusions are applicable generically to B&WOG plants. Those plant differences are discussed in BAW-2441. Briefly recapping the changes that were made to the DB model to show sensitivity to other B&WOG features, the major differences are:

Deleted separate makeup pumps because other B&WOG plants have combined makeup and HPI.

Reduced the Mode 4 initiating event frequency for loss of RCS inventory outside of the RB because the other B&WOG plants do not align to the SDC for LTOP in Mode 4.

Replaced one of the two turbine-driven EFW pumps in the DB PRA with a motor-driven EFW pump.

Deleted credit for the auxiliary boiler.

As the RAI points out, an additional difference is the higher Mode 4 starting pressure at some other B&WOG plants. As described above, in order to get onto SDC from Mode 4 there might be situations where other B&WOG plants must rely upon another means to depressurize if there is a total loss of feedwater. In the DB Mode 4 PRA model, depressurization is not necessary because the RCS is already aligned to SDC for LTOP pressure control. However, in the PRA modification that is described in BAW-2441 for the non-DB plants, the means to depressurize the RCS to initiate SDC for the case of a total loss of feedwater was inadvertently omitted.

Therefore, a new modification to the non-DB sensitivity model was made to include additional modeling for RCS depressurization. Although there may be multiple ways to depressurize, the method credited in the PRA is use of the PORV. Since this change affects only Mode 4, it is conservative to ignore the other depressurization methods (discussed above) that provide backup to the PORV. Adding the PORV failure modes to the model did not have a significant effect on the Mode 4 risk results because the failure modes that dominate the cut sets tend to be power Page 26 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" system failures that cut across the mitigating systems (DHR, feedwater, ECCS) and would result in PORV failure also.

In addition to the PORV modeling addition, some other new changes were made to the non-DB shutdown PRA model to better represent the generic B&WOG plant. These include:

Deleted credit for the non-safety motor-driven feed pump and startup feed pump because these DB pumps are not generic to all of the B&WOG units.

The difference between the raised-loop and lowered-loop SG on the human recovery model was examined and included in the model. The human recovery probabilities are based upon calculations of time available. In the lowered-loop plants, less SG inventory is available to drain back into the RCS. This affects boil-off time until the core is uncovered, and drain time in case of a drain down event. Because of the low decay heat in the Modes 4 and 5 end states, there is plenty of time available to perform recovery actions for events where the boil off of RCS inventory is the contributing factor, even without crediting the extra SG inventory. However for drain down events, the reduced inventory may affect the time available before the RCS level reaches the DHR suction.

The DB PRA credits 180,000 gallons of inventory that must be drained and boiled off before the ability to use the DHR suction is lost. Even for large leaks the time available is in excess of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . For the lowered-loop plant, the time available is less than at DB.

Therefore, for recovery actions involving the time until loss of DHR suction (starting from a full RCS), the human error probability for recovery was increased to an arbitrarily conservative value of 0.1 (about two orders of magnitude worse than for DB).

These latter changes to the PRA models tended to affect the risk in Modes 4 and 5 uniformly compared to the previous results reported in BAW-2441. Hence the non-DB CDF results are revised up from the values in BAW-244 1, but the relative comparison favoring Mode 4 is unchanged. The revised results for the non-DB sensitivity case are shown in a table contained in the response to RAI #11. These results should still be considered a generic approximation for the B&WOG plants because there are other less-important plant differences. However, these results demonstrate the sensitivity of the results to the most important plant configuration assumptions, and hence show that the conclusions of BAW-2441 are generically applicable to the B&WOG plants.

Page 27 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question # 13 At Davis-Besse (DB) the DHR suction is aligned to the RCS before shutdown cooling is initiated (due to low temperature overpressure protection (L TOP) considerations). Thus, the draining-related risk at DB is not only associated with Mode 4 (on SG cooling) operation but also appears to be higher than during transition to Mode 5 because of the longer time the plant stays at a higher pressure where a pressure spike or LTOP valve drift can cause an LTOP valve lift. Please discuss how this feature is modeled in the risk assessments supporting the proposed end state changes.

Response To Question # 13 The initiating event frequency for loss of inventory events is described in the response to RAI

11. Since DB aligns the RCS to SDC in Mode 4 as well as Mode 5, and uses a relief valve on the SDC line for LTOP, the same initiating event frequencies are used for both Modes.

Furthermore, the initiating event frequency for a loss of inventory outside of the RB in Mode 4 is higher for DB than for the other B&WOG plants. The SDC relief valves are considered the dominant contributors for a loss of inventory initiating event at DB (this is also consistent with the findings of NSAC-176L).

The initiating event frequencies used in the DB Mode 4 and Mode 5 PRA model are relatively high compared to the LOCA frequencies used in the Mode 1 PRA. This reflects the increased risk of pressure spikes and LTOP valve failure, as well as plant activity that may inadvertently result in valve misalignment. The judgment was made to use the same initiating event frequencies for both Mode 4 and Mode 5 except for the case of the loss of inventory outside of the RB prior to SDC alignment (non-DB plant model). The considerations affecting this decision are, on the one hand, pressure spikes due to higher RCS pressure may be more likely in Mode 4; however, on the other hand, containment access in Mode 4 is more limited than Mode 5 due to higher containment temperature and shorter stay times. Nonetheless, it is appropriate to examine a sensitivity case where the Mode 4 loss of RCS inventory is assigned a higher frequency than Mode 5. These sensitivity cases were run, and their results are described in the response to RAI #11.

Page 28 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question # 14 Please list the initiating event categories that were considered in the risk assessments for both the current and the proposed end states. Also, please provide the base case (no LCO) dominant cutsets (e.g., top 700; less than 100 cutsets will be adequate if they are contributing to at least 90% of the end state's CDF) with a brief discussion.

Response To Question # 14 Initiating Event Catevories The shutdown PRA addresses a plant shutdown condition having two safety function events:

insufficient removal of decay heat and insufficient inventory. Initiating events that can initiate an accident sequence leading to these events must originate in systems that normally provide the required support for core decay heat removal control and inventory control. While other systems may be available for recovery, they are in standby when the initiating event occurs and, therefore, cannot initiate the sequence themselves. For this reason, initiating events are those associated with failure of the DHR system, primary-to-secondary heat transfer (SG cooling), or control of the RCS inventory. The initiating event categories are summarized in the table below.

The decay heat removal function is defined as the removal of decay heat from the core using systems normally designed to perform this function. This function is performed by the DHR system and by SG cooling, depending upon operating mode. In Mode 5, the decay heat is normally removed by the DHR system. In Mode 4, the decay heat is primarily being removed by the SGs. However, each system is a backup to the other in the opposite mode.

Of the initiating events challenging the DHR system, one is unique to midloop operations (i.e.,

loss of RCS level control leading to vortexing at the pump suction causing loss of DHRS flow) and is therefore not applicable to the end states comparison. Other initiating events challenging the DHR system encompass any failure that prevents the DHR system from successfully performing its function. These failures could be caused by failure of a DHR pump or loss of a support system function, e.g., loss of the ultimate heat sink. Loss of DHR due to isolation of the DHR process fluid flow could be caused by inadvertent closure of DHR drop line valves due to operation of overpressure protection interlocks. Failures of DHR pumps and supporting systems can also be caused by loss of electrical power, e.g., loss of offsite power.

Initiating events challenging SG cooling encompass any failure leading to loss of the operating feedwater source. These could be caused by loss of the operating feedwater or condensate pump(s), or loss of a support system such as power source, instrument air, or cooling water.

Successful RCS inventory control is defined as maintaining inventory sufficient for adequate core cooling. There are mechanisms that can potentially cause insufficient inventory control:

random RCS pipe breaks, potential stuck open DHR relief valves, and inventory drain down.

Large random pipe breaks are not considered to be contributors to the shutdown risk because of their low probability for occurrence, especially in Mode 4 and Mode 5 when the RCS is cooled down and depressurized. A large loss of inventory in the DB model is assumed to be around 400 gpm (e.g., at DB, a likely location for a leak is a stuck relief valve on the DHR system, this Page 29 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" would be 100 to 200 gpm for the relief valve outside containment and 400 gpm for the relief valve inside containment). Drain down challenges to inventory control could be caused by such things as misaligning or failing to close valves, DHR system relief valve leakage following operationhesting and inappropriate maintenance practices leading to improper valve control schemeshet points. (There are also other potential drain down causes such as cold leg nozzle dam and fuel transfer canal seal plate failures that are not applicable until later shutdown operating states.) The specific causes are not modeled individually in the PRA, but are rolled up into categories.

In order to characterize the drain down initiating events, the location of diverted reactor coolant was considered. If the drain down occurs with the reactor coolant directed to the RB, then this diverted RCS inventory may be recovered for cooling and/or makeup via RB emergency sump recirculation. However, if the RC is drained to a location outside the RB, then it is assumed that this RCS inventory is lost and cannot be used for recirculation cooling or makeup. Drain down is assumed to terminate, with or without operator action, when the RCS level reaches the midpoint of the hot leg (i.e., reactor vessel failure was not considered).

Initial Initiating Event Category Insufficient decay heat removal via DHR system Insufficient decay heat removal via steam generators Insufficient inventory ig Event Categories for Mode 4 and Mode 5 Example Initiating Events Included in the PRA Loss of running DHR pump DHR system auto suction valve closure Loss of power bus(s)

Loss of offsite power Loss of cooling water (CCW, SWS)

Floods in pump rooms (DHRS, CCW, SWS)

Loss of feedwater (MDFP, MFW, condensate as applicable)

Loss of offsite power Loss of power bus(s)

Loss of cooling water Loss of instrument air Floods in pump rooms Large loss of inventory outside RB Large loss of inventory inside RB Small loss of inventory outside RB (applies to midloop operation)

Small loss of inventory inside RB (applies to midloop operation)

Page 30 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Dominant Cut Sets Attachments A and B provide the top 100 cut sets for the base case (no LCO) for the proposed (Mode 4) and current (Mode 5) end states, respectively. These cut sets were generated using the DB Mode 4 and Mode 5 PRA models. Attachments C and D provide similar information for the other B&WOG plants that was generated with the "non-DB" sensitivity modelg.

Using the DB model, the top cut set in Mode 4 (Attachment A) is a loss of RCS inventory outside of the RB. Here the operators fail to take action to stop the drain down before losing the DHR suction (their backup cooling method) and also fail to initiate ECCS before exposing the top of the fuel." For these recovery actions, there is significant time estimated before the RCS level decreases enough to threaten the core, and many alerts in the mean time associated with dropping RCS level and leaking inventory. However, the events that dominate the risk for this operating mode are LOOP events with subsequent failure of onsite standby power sources (i.e.,

diesel generators), because the loss of power sequences cut across the primary and backup core cooling options including SG Cooling, DHR system cooling, and ECCS (feed and bleed).

Collectively, the LOOP sequences make up a much greater portion of the CDF than the loss of inventory or any other sequence.

In Mode 5 (Attachment B), initiating events involving loss of the operating DHR train (ie.,

SDC) are important with subsequent failure of operator recovery actions to establish backup cooling with the standby DHR train, SG cooling, or ECCS. LOOP sequences are also important contributors, for the same reason as in Mode 4. There is also a significant contribution from failure of the CCW system (sometimes from internal floods), which affects the function of the DHR and other systems.

Using the non-DB model, some of the cut sets for Mode 4 (Attachment C) are similar to the DB case. LOOP continues to be a dominant contributor, due to the ability of the loss of power sequences to cut across the lines of redundancy and defense-in-depth that are present in this operating mode. Diesel generators are assumed in this model for the onsite standby power; however similar results can be expected for plants that use other standby power sources (i.e.,

Oconee). The cut set involving loss of RCS inventory has a larger probability than in the DB case because of diminished credit (due to less SG inventory available to drain back into the RCS in a lowered-loop plant) for the recovery action of stopping the leak before DHR suction is lost combined with the dependent action of recovery via ECCS. Loss of feedwater is more important as an initiating event than in the DB model. There are two reasons for this: first, the non-DB model deletes credit for the backup non-safety startup feedwater pump as well as the auxiliary boiler (for the turbine-driven EFW pump). Second, it is not quite as easy to initiate DHR as in the DB plant, where it is already aligned in Mode 4.

~

~~~

'The "non-DB" model is a modified version of the DB model created to show the impact of B&WOG plant features that are different from DB.

Operator actions are assigned a probability of 0.1 for cut set generation (screening). Then the individual operator actions are reassigned values of 1.O in the cut set quantification. Recovery probabilities are then generated, which are calculated for each combination of human actions that appear in the top cut sets so that dependencies can be properly accounted for. Only one recovery probability is allowed per cut set. The only exception is recovery of offsite power, which is applied independently of actions that are occurring in-plant.

10 Page 3 1 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" In Mode 5 (Attachment D), the non-DB PRA model also includes the loss of inventory sequences, except the initiating event frequency is higher than Mode 4 because of the alignment of SDC. Loss of DHR system initiating events are important just as in the DB model, being caused by both DHR system failures as well as failures of support systems (e.g., CCW) or related internal floods. As with all of the other cases, this case also includes LOOP sequences.

All of the cases have significant contributions from operator actions related to recovery. This is to be expected in Modes 4 and 5 because much of the plant systems are in operator control at this time. There is also significant time available to perform most operator actions because of the low decay heat levels relative to the heat removal requirements at power. Nonetheless, operator action probabilities carry a relatively high level of uncertainty. The sensitivity analyses presented in response to RAI #11 should be beneficial in demonstrating the robustness of results in light of these uncertainties. In addition, examination of the cut sets should be informative in demonstrating the defense in depth that is present with respect to operator recovery options that are available in the current and proposed end states. In most cases, these include startup of the standby DHR train(s), establishing SG cooling or backup feedwater sources, and establishing ECCS cooling. The PRA takes credit for these options in Mode 4 and (conservatively) in Mode 5 as well, although from a Technical Specifications perspective, the minimum equipment requirements in Mode 4 operation do not apply (and are therefore voluntary) in Mode 5.

Page 32 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Question # 15 The quantitative risk assessments do not include external events, such as seismic, internal fires and internal floods. This implies that it is assumed that the results and conclusions would not change had external event risks been considered. Please provide arguments to justify this assumption.

Response To Question # 15 The DB PRA, which was used as the basis for this risk assessment, does include internal floods.

However, it does not include fires, seismic, or other external events. While internal floods do not represent a comprehensive list of external events, they do provide some assurance that the results are robust when considering the types of failures that external events can cause, such as those that reach across systems or trains.

For fires, Appendix R evaluations address the safe shutdown requirements. Consequently, the operating procedures are designed to deal with fires. The operators will deal with fires occurring in Mode 4 and Mode 5 similarly, although the minimum complement of safety system equipment that is guaranteed by TSs in Mode 4 provides additional assurance of success for fires and all external events.

With respect to seismic events, a seismic PRA is not available for Modes 4 and 5. However, examination of the PRA in light of which equipment is seismically qualified provides some insights. For DB, the non-safety feedwater pumps that may be used in Modes 4 and 5 are non-seismic. The turbine-driven EFW pump could be used, and is more likely to be useful in Mode 4, but is not credited in this risk assessment without the auxiliary boiler. The DHR system and ECCS and their support systems are seismic and can be relied upon in both modes. Since the DHR system is already aligned to the RCS in Mode 4, it will be immediately available.

Therefore the expectation for DB is that the risk profiles should be similar for the unlikely seismic event occurring in Modes 4 or 5.

For the other B&WOG plants, the addition of the motor-driven EFW pump(s) improves the likelihood of success of SG cooling during a Mode 4 or Mode 5 seismic event. Therefore, the systems that are generally relied upon in the PRA, that is EFW, the DHR system, ECCS, cooling water systems, and the onsite standby power sources, can be expected to be available in a seismic event. Hence the relative Mode 4 and Mode 5 risk for a seismic event is expected to be in similar proportion to what has been estimated for non-seismic initiating events.

In summary, although the risk is not quantified for every external event, the risk should be lower in Mode 4 because more core cooling options are likely to be available to the operators (see RAI

2), and there are minimum safety equipment requirements dictated by TS. With more options available to start with, there is less likelihood in Mode 4 than Mode 5 that all redundancy and defense-in-depth will be defeated by the external event.

Page 33 of 33

Response to: Request For Additional Information Regarding BAW-2441, "Risk-Informed Justification For LCO End-State Changes" Attachment A Top 100 Cut Sets for the Base Case (no LCO) for the Proposed End State (Mode 4)

Davis-Besse Model

Cutset Prob H

H 1

2 3

4 5

6 IE-SVL2 LHADHRSE LHASDVZE SDHADHRBAE EDGOSBOA EDGBET2A EDGCC02A T3 SDOP007R EDGOO11 F EDG0012F EHASBLOE MODE-4-FLAG SDHASBLOR T3 SDOP001 R EDGOSBOA EMFCC19A EMFDLTAA MOD E-4-F LAG T3 SDOP007R IE-SVLI LHADHR5E LHASDV2E SDHADHRBAE EC2BEl 1 D EC2CCI 1 N EDGOSBOA MODE-4-FLAG T3 SDOP007R MODE-4-FLAG MODE-4-FLAG MODE-4-FLAG 1.26E-07 1.12E-07 1.08E-07 8.60E-08 8.41 E-08 7.95E-08 Event Prob 1.26E-02 l.OOE+OO l.OOE+OO l.OOE+OO 1.00E-05 1.55E-02 1.36E-02 1.00E-01 1.70E-01 8.34E-02 8.34E-02 l.OOE+OO l.OOE+OO 5.00E-02 1.00E-01 3.10E-03 3.51E-03 9.30E-02 3.12E-02 1.00E+00 1.55E-02 l.OOE+OO 1.00E-01 1.70E-01 8.41E-03 l.OOE+OO 1.00E+00 1.00E+00 1.00E-05 6.22E-02 4.85E-03 1.55E-02 1.00E-01 l.OOE+OO 1.70E-01 Cutsets with Descriptions Report MODE4 = 3.37E-06 C

Rate U

Exposure UlEvent Description 1.360E-02 3.630E-03 H

3.630E-03 H

l.OOOE+OO 3.510E-03 4.850E-03 1.26E-2 0.1 0.1 1.oo 1.55E-02

,0312 1

1.oo 1.00E-01 24 24 0.1 1.oo 1.00E-01 1.55E-02 1

,093 1.oo 1.00E-01 8.41 E-3 0.1 0.1 1.oo 0.0622 1

1.55E-02 1.oo 1.00E-01 Large Loss of Inventory Outside of Reactor Building Operator fails to start HPI or LPI pump for Makeup Cooling Failure to stop loss of inventory before loss of decay heat pump MODE 4 (FLAG)

SBODG FAILS TO START CC FACTOR FOR 2 OF 2 DIESEL GENERATORS FAILING TO START MODE 4 (FLAG)

Loss of offsite power <initiating events EITHER EDG 1-1 OR 1-2 FAILS TO START EDG 1-1 FAILS TO RUN EDG 1-2 FAILS TO RUN OPERATORS FAIL TO ADD SBODG FUEL OIL MODE 4 (FLAG)

ML050560037

Text

Navigation menu

Search