ML052450148

Response to Request for Additional Information Related to License Amendment Request for One-Time Extension to the Technical Specification Action Completion Time for Restoration of a Service Water Train to Operable Status

ML052450148
Person / Time
Site:	Palisades
Issue date:	08/25/2005
From:	Harden P Nuclear Management Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML052450148 (100)

Text

NM C Palisades Nuclear Plant Committed to Nuclear Excelle Operated by Nuclear Management Company, LLC August 25, 2005 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555 Palisades Nuclear Plant Docket 50-255 License No. DPR-20 Response to Request for Additional Information Related to License Amendment Request for One-Time Extension to the Technical Specification Action Completion Time for Restoration of a Service Water Train to Operable Status By letter dated April 1, 2005, Nuclear Management Company, LLC (NMC) requested Nuclear Regulatory Commission (NRC) review and approval of a proposed license amendment for the Palisades Nuclear Plant. After subsequent discussions with the NRC staff, it was determined that a supplement was necessary. By letter dated May 26, 2005, NMC submitted the supplement.

By letter dated July 29, 2005, the NRC issued a request for additional information (RAI).

-Enclosure 1 contains the response to the RAI for the Palisades Nuclear Plant.

A copy of this RAI response has been provided to the designated representative of the State of Michigan.

Summary of Commitments This letter contains no new commitments and no revisions to existing commitments.

I declare under penalty of perjury that the foregoing is true and correct. Executed on August 25, 2005.

Paul A. Harden Site Vice President, Palisades Nuclear Plant Nuclear Management Company, LLC Enclosure (1)

Attachment (1)

CC Administrator, Region IlIl, USNRC

)DID Project Manager, Palisades, USNRC Resident Inspector, Palisades, USNRC 27780 Blue Star Memorial Highway

• Covert, Michigan 49043-9530 Telephone: 269.764.2000

ENCLOSURE I RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION LICENSE AMENDMENT REQUEST: ONE-TIME EXTENSION TO TECHNICAL SPECIFICATION ACTION COMPETION TIME FOR RESTORATION OF A SERVICE WATER TRAIN TO OPERABLE STATUS Nuclear Regulatory Commission (NRC) Request Risk Assessment

1.

Nuclear Management Company's (NMC's) letter of May 26, 2005, provided an estimated increase in core damage frequency (CDF) and large early release frequency (LERF) from this one-time service water (SW) Completion Time (CT) extension. Please provide the following information:

a.

Describe how NMC calculated the increases in CDF and LERF.

Specifically, what probabilistic risk assessment (PRA) model parameters were changed, and by how much? For example, were the 168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br /> added to the average test and maintenance for a cycle, a year, or some other period? Discuss the basis for the method used, and any assumptions used.

NMC Response

a.

The increases in CDF and LERF were calculated by assuming service water (SW) pump P-7C was out of service. Basic events representing the pump were set to TRUE in the model, and all internal event sequences were requantified with the pump effectively removed from the model. The resultant CDF and LERF values were used to calculate the core damage probability (CDP) and large early release probability (LERP), for both the currently allowed completion time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and the proposed completion time of 168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />. Because the request was for a one-time extension, the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) were calculated as the difference of the two conditions.

The method used was based on the methods used by other utilities in recent LARs. There were no additional assumptions, other than pump P-7C unavailability, used to implement the calculation.

Page 1 of 7

NRC Request

b.

How was the benefit of the compensatory measures calculated?

Provide the following:

(1) which compensatory measures were quantified NMC Response (1)

The compensatory measures quantified were those associated with commitments to maintain the following equipment operable and protected for the duration of the allowed completion time. The compensatory measures quantified were:

Service Water Pumps (P-7A & P-7B)

Containment Spray Pumps (P-54B & P-54C)

Emergency Diesel Generators (1-1 & 1-2)

A second sensitivity analysis was conducted by only crediting the diesel generators and SW pumps. This analysis demonstrated that the same benefit was achieved with this subset of equipment.

NRC Request (2) brief description of how they were modeled NMC Response (2)

Since the commitment was to maintain the equipment operable, the probabilities for test and maintenance were set to FALSE to represent the fact that the equipment would not be voluntarily removed from service during the completion time. Random failure probabilities for this equipment were left at their nominal values. A separate analysis was completed with the indicated probability changes.

NRC Request (3) failure probability of each Page 2 of 7

NMC Response (3)

As indicated above, the test and maintenance probabilities were removed (set to FALSE) from the model, and random failure probabilities for the equipment was left at the nominal value.

NRC Request

2.

NMC's letter of April 1, 2005, provided an estimate of the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) for this one-time SW CT extension. Please provide the following information:

a.

Was credit for compensatory measures used in the calculation of these metrics?

NMC Response

a.

No. Credit for the compensatory measures was not included in the values reported. Impact of the compensatory measures was evaluated as a separate sensitivity in the overall calculation.

NRC Request

b.

If "yes,"please provide the ICCDP and ICLERP without credit for the compensatory measures.

NMC Response

b.

Not applicable, see 2.a above.

NRC Request

3.

NMC's April 1, 2005, submittal states: "One hundred percent of the required SWS [service water system] post accident cooling capability can be provided by any two SWS pumps if SWS flow, either to the non-critical header or to the critical loads inside the containment, is capable of being isolated. One hundred percent of the required SWS post accident cooling capability can be provided by any one SWS pump if SWS flow, both to the non-critical header and to the critical loads inside the containment, are capable of being isolated. " The qualitative assessment of seismic risk states that the SWS is important to provide auxiliary feedwater (AFW) pump P-8C with a suction source.

Page 3 of 7

a.

How many SW pumps are required for seismic scenarios where the SWS is needed to supply a suction source for AFW pump P-8C, assuming SWS flow to the non-critical header, or to the critical loads inside the containment, is isolated? If greater than two, how did NMC factor this into the risk assessment?

NMC Response

a.

Two SW pumps would be required when the SWS is needed to supply a suction source for auxiliary feedwater (AFW) pump P-8C, assuming SWS flow to the non-critical header or to the critical loads inside containment, is isolated. The number of SW pumps required is based on whether the non-critical SW header, or the SW header to containment, is isolated. The amount of flow diverted to the non-critical header or to containment, and the associated heat loads, is such that an additional pump is required to assure that critical loads necessary to mitigate an event receive the necessary SW flow.

AFW flow requirements in the PRA are 150 gpm to each steam generator, or 300 gpm to one steam generator. These flow requirements are a small fraction (<4%) of the total flow (8000 gpm) from a single SW pump. Therefore, the PRA model assumes no additional SW pumps are required to provide a suction source for the AFW pumps.

NRC Request

b.

How many SW pumps are required for seismic scenarios where the SWS is needed to supply a suction source forAFW pump P-8C, assuming SWS flow to the non-critical header, and to the critical loads inside the containment, is isolated? If greater than one, how was this factored into the risk assessment?

NMC Response

b.

One SW pump would be required when the SWS is needed to supply a suction source for AFW pump P-8C, assuming SWS flow, to the non-critical header and to the critical loads inside containment, is isolated. The basis for the number of SW pumps required is described in the response to 3.a above.

Page 4 of 7

NRC Request

4.

The seismic risk discussion in NMC's letter of May 26, 2005, concludes that removing P-7C from service for the extended CT would not result in a significant change in the individual plant examination of external events results, and would not have a significant impact on the calculated delta CDF or LERF. Apparently, NMC considered only seismic scenarios where the SWS is needed to supply a suction source forAFW pump P-8C.

a.

Please provide an estimate of the change in risk from these scenarios when SW pump P-7C is out of service, or otherwise demonstrate that this change in risk is small.

NMC Response

a.

The PRA conducted for the individual plant examination of external events (IPEEE) used the same SWS requirements for the seismic analysis as for the internal events analysis, meaning all SW support system requirements were included in the seismic analysis, not just the function of providing AFW suction. The discussion provided in the submittal reflects the only insight from the IPEEE regarding the importance of the SWS that was different from the individual plant examination (IPE) results.

While the IPEEE report indicates that for a seismic event the induced failures of the fire protection system (FPS) result in the SWS being the principal long term suction source to AFW, there were no random (non-seismic) failures of components in the SWS identified as significant contributors to core damage. As noted in the IPEEE report, there are no significant seismic vulnerabilities associated with the SWS. In all other cases, the importance of the SWS was consistent with the IPE results. Since the SWS is considered seismically rugged relative to other systems, the expectation for the impact of extending the allowed completion time for SW pump P-7C, is that changes to CDF and LERF would be consistent with the impact in the internal events analysis, with the exception as noted for the AFW pump suction function. As noted in the response to question three above, removing P-7C from service will not result in a condition in which the remaining two pumps cannot provide the indicated functions. The CDF for the seismic portion of the IPEEE is approximately a factor of six lower than the CDF reported in the IPE (the current baseline CDF is approximately a factor of 1.2 higher than the IPE CDF) and represented 10% of the total CDF reported for the IPE and IPEEE.

Page 5 of 7

As noted in the IPEEE report, the dominant containment failure mode in Accident Classes IA and lB quantified in the seismic PRA is relocation of core debris to the auxiliary building. The total frequency of this failure mode is on the order of 2.3E-06/yr, or less than 20% of the frequency of this failure mode in the IPE. The timing of this failure mode is expected no sooner than eight to twelve hours following the seismic event, as it is dominated by depletion of the condensate storage tank before failure of secondary cooling occurs. Because of the availability of the safety injection refueling water tank inventory, there is little or no potential for early large volatile releases from seismic events.

Therefore, given that the changes to CDF and LERF for seismic events would be similar to the internal events results, the contribution would represent approximately 10% of the total CDF.

In addition, the potential for large early volatile releases from seismic events was determined to be negligible, and therefore, the changes in CDP and LERP are expected to be small NRC Request

b.

Are these the only seismic scenarios that are expected to be adversely impacted when SW pump P-7C is out of service? If "no,"

please provide an estimate of the change in risk from these scenarios when SW pump P-7C is out of service, or otherwise demonstrate that this change in risk is small for the other seismic scenarios.

NMC Response

b.

As noted in the response to question 4.a above, all sequences that require SW support are expected to have some level of adverse effect on the seismic results. Since the SWS is considered seismically rugged, it is expected that the impact to the seismic analysis for the removal of SW pump P-7C from service, will be the same as the impact reported in the submittal for the internal events results, with the exception as noted for the alternate AFW suction.

The CDF for the seismic portion of the IPEEE is approximately a factor of six lower than the CDF reported in the IPE (the current baseline CDF is approximately a factor of 1.2 higher than the IPE CDF), therefore, changes in the seismic results would be expected to have less impact to the total CDF and LERF. As noted in the response to question three above, the removal of pump P-7C from service will not result in a condition in which the remaining pumps cannot provide the functions included in the model.

Page 6 of 7

NRC Request PM Model Scope and Quality

1.

Attachment I to NMC's letter of May 26, 2005, listed the Level A peer review findings and their resolution. Attachment 2 listed Level B peer review findings remaining to be resolved. Please provide a listing of the resolved Level B peer review findings along with how they were resolved (in similar format to Attachment 1 of NMC's letter of May 26, 2005).

NMC Response

1.

A listing of the resolved Level B peer review findings, along with how each was resolved, is provided in Attachment 1.

NRC Request

2.

NMC's letter of May 26, 2005, provided the resolution of the PRA peer review comments. Combustion Engineering Owners Group fact and observation, "PEER-2000 AS-09 emergency diesel generator (EDG) repair," stated that the PRA model included repair of an out-of-service EDG, including support system failures. Service water is a support system for the Palisades EDGs. Does the current Palisades PRA model credit repair or recovery of service water? If "yes,"please provide information on the following:

a.

What is the CDF, LERF, increase in CDF, and increase in LERF for the extended SW CT assuming no recovery or repair is credited for an out-of-service SWpump?

b.

Calculate the ICCDP and ICLERP for the extended SW CT assuming no recovery or repair is credited for an out-of-service SW pump.

c.

Describe how service water recovery or repair is credited in the 10 CFR 50.65 (a)(4) risk assessment when the plant configuration includes an out-of-service SW pump or train.

NMC Response

2.

The current PRA model does not include repair or recovery of the SWS.

Page 7 of 7

ATTACHMENT 1 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION LICENSE AMENDMENT REQUEST: ONE-TIME EXTENSION TO TECHNICAL SPECIFICATION ACTION COMPETION TIME FOR RESTORATION OF A SERVICE WATER TRAIN TO OPERABLE STATUS RESOLVED LEVEL B PEER REVIEW FINDINGS 91 Pages Follow

- iJ FACT/OBSERVATION.REGARDING PSA TECNICAL ELEMENT it OBSERVATION (ID: AS-06)

/ Element AS I Subelement AS-4 Assumption 4.2 states that primary SRV opening (and subsequent failure to close inducing a small LOCA) is not modeled (except for ATWS) because no reactor trips have occurred that challenged an SRV. But there may be transients (e.g., loss of condenser vacuum) that have not been experienced and could challenge an SRV.

Have all (non-ATWS) transients that cause primary pressure to increase actually occurred at Palisades, so that this assumption is supported by plant experience? If not, you should have thermal-hydraulic analysis to support this assumption.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Provide thermal-hydraulic analysis to support assumption that SRV opening and reclosure not needed.

PLANT RESPONSE OR RESOLUTION CA01 7248 Past thermal hydraulic analyses (Reference 1) have not resulted in any calculated challenges to the pressurizer safety relief valves. Moreover, the plant in 30 plus years of operation has not experienced such an event.

Although such an incident is very unlikely it is not improbable. Hence a preliminary evaluation of this event with respect to the PSA calculated core damage frequency was analyzed. Logic models were developed, industry data were analyzed and conservatively applied and the resulting likelihood functions were calculated. The resulting increase in the plant's core damage frequency was about 1%. This analysis will be included in the 2004 PSA model update that is currently underway in support of the Palisades License Renewal application. EA-PSA-PSAR2-04-02 currently in development (in support of the License Renewal application) will formally document this event disposition.

-'AC/OBSERVATION REGARDING PSA TECH C

IAL E.L EMENTS OBSERVATION (ID: AS-11)

/ Element AS I Subelement AS-9 Transient Success Criterion 3.1.2 does not include requirements for steaming success.

There is an unstated assumption that between the automatic ADVs and the multitude of MSSVs, that failure is virtually impossible.

However, in at ATWS condition, Reactor power stabilizes at a high level (maybe 70 -

80%), so much more steaming capacity is required. Random failures still probably wouldn't be important. However, the steaming function with common-cause failures for both ADVs and MSSVs should be included in the modeling for this event.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Add steaming to the top event.

PLANT RESPONSE OR RESOLUTION CA017249 Discussion The PEER Review F&O (Fact and Observation) reference to transient success criterion 3.1.2 appears to be a typo. Section 3.1.2 of the IPE Reference 1 discusses containment isolation. Moreover steaming of the generators is only credited in the situation in which main or auxiliary feedwater flow to either steam generator cannot be established. In order to supply secondary feed flow with the condensate pumps, steam generator pressure must be reduced below the shutoff head of the pumps (about 500 psia). In order to reduce pressure, dumping steam to the main condenser through the turbine bypass valve or opening one of two atmospheric dump valves is required. The total capacities of the Atmospheric Steam Dump (ADVs) and Turbine Bypass Valves (TBV) are 30% and 4.5%, respectively, of steam flow with reactor at full power. The capacity of the atmospheric steam dump valves is adequate to prevent lifting of the main steam safety valves following a turbine and reactor trip.

Downstream of the atmospheric dump valve lines are a series of 12 safety valves in each main steam header. These twenty-four spring loaded ASME Code safety valves mounted on the main steam lines outside of the containment building provide over pressure protection for the secondary side of the steam generators. Secondary side depressurization with the MSSVs because of their high setpoints is not modeled. Their use requires the PCS temperature to be at least 5450F (corresponding to a saturation pressure of about 1000 psia). Successful low pressure feed requires steam generator pressure to be less than 500 psia.

lt~l

-FACT/OBSERVATION':EGREIGA+-RDING' PSA!>5535 TECHNICAL ELEMENTS OBSERVATION(ID:AS-11)

/ Element AS I Subelement AS-9 The ATWS model requires the successful opening of the three-pressurizer safety valves. There is no MSSV requirement. Because all three Pressurizer (PZR) code safety valves are required for success, common cause modeling among the three relief valves RV-1039, RV-1040 and RV-1041 is unnecessary.

Conclusion Regardinq MSSV and ADV Common Cause Modelinq There is no common cause modeling required due to the following:

N_--The MSSVs are not-credited in the Palisades core damage model.

The ATWS analyses relies on the Pressurizer safeties not the MSSVs.

ADV/TBV and PZR Safeties Common Cause Modeling Even though the F&O only questioned the ADVITBV and MSSV common cause modeling, for completeness, the ADVITBV and PZR safety relief valve common cause failure potential was reviewed. Common cause failures are distinguished from random failures by the coupling mechanism (Reference 4). Coupling mechanisms are expected to exist when two or more components failures exhibit similar characteristics, both in the cause and in the actual failure mechanism. The following table lists different coupling mechanisms as identified in Reference 4 and whether or not they could apply to the ADVsITBV and the PZR safeties.

Coupling ADVs TBV Pressurizer Safeties Comments M echanism Same Design 841,875 Ibm/hr [1J 528,000 Ibm/hr 230,000 121 Different design characteristics therefore this Is not considered a coupling mechanism.

Same 8" pneumatic globe caste 6" pneumatic globe 2 - 3.9" range globe Different manufacturer w.r.t. the Hardware carbon steel valve made caste carbon steel valve carbon steel made by ADVs/TBV and PZR Safeties by Masoneilan.

made by Masoneilan.

Dresser Industries.

therefore not considered a coupling mechanism.

Same MSS relief - atmospheric MSS relief -turbine PCs steam relief.

Each component provides the same Function steam dump.

bypass to the function but for a different steam condenser.

source. Therefore this is not considered a coupling mechanism.

Same Same maintenance staff.

Same maintenance Same maintenance Although the plant maintenance staff Installation, staff.

staff.

is the same these valves have Maintenance different PM's. Tech Spec or Operations Surveillance procedures and vendor Staff support. Therefore this Is not considered a coupling mechanism.

FACTIOBSERVATION: REGA,#RDINGPSiA TECHNICAL ELEMENTS OBSERVATION(ID:AS-11)

/ Element AS

/ SubelementAS-9 Coupling ADVs

-;TBV Pressurizer Safeties Comments Mechanism Same T-207, MSS-094, MSS-T-207, MSS-015, MSS-S-R177, S-R177A, S-Each component has its own Procedures 095, MSS-096, MSS-097, 105, S-RI33 RT41, S-RI77C PPAC(s) as well as other supporting MSS-109, MSS-006, MSS-procedures. Therefore this is not 042 considered a coupling mechanism.

Same System main steam interface.

main steam interface.

PCS steam interface.

The ADVs/TBV interface with the Component MSS and the PZR safeties Interface Interface with the PCS. This Is not considered a coupling mechanism.

Same Located upstream of the Turbine building, 590' Located in containment. The valves are located in different Location MSSVs on the main steam elevation, room 131.

rooms inside and outside line.

containment. Therefore this is not considered a coupling mechanism.

Same Open to atmosphere Open to Turbine Open to containment These valves are located in different Environment building atmosphere.

amosphere environments. Therefore this is not

._A_____

Ad___ _

L______________

_._______considered a coupling mechanism.

(11 There are four Atmospheric Dump Valves, each with a capacity of 841,875 lbmlhr. The Atmospheric Dump Valves control the average coolant temperature, Tave, to 532 F. The Turbine Bypass Valve controls Tave to 532'F and secondary pressure to 900 +/-

5 psia, whichever parameter produces the dominant control signal (Reference 2).

[2] Capacity/Valve @ 2,575 psia, Ibmlhr Conclusion Recarding the ADV/TBV and PZR Safeties Common Cause Modelinq From the above table, there were no identified common cause coupling mechanisms.

ADVs and TBV Common Cause Failure to Onen Although not addressed by the PEER Review panel, a potential common cause coupling between the ADVs and the TBV exists, as both valves are pneumatic globe caste carbon steel valves made by Masoneilan. They only differ in size. Since only I depressurization path is required i.e., either CV-0779 or CV-0780 or CV-0781 or CV-0782 or CV-051 1, the likelihood of a non-lethal shock is not considered. A non-lethal shock is a failure mode that fails a subset of the valve population. For example, if only CV-0781 and CV-0511 fails then this represents a non-lethal shock valve combination.

Because all five valves would have to fail in order to prevent steam generator depressurization only a lethal shock (i.e., all valves failing) is examined.

From Reference 3, the following expression applies to a component population of five.

Q5

=

Pf -y-£-Qt

-3 05 =

3.64 xlO- ( '(13i"&c)

Where 3.64E-03 is the demand failure probability of the turbine bypass valve failing to open (the greatest failure probability between the ADVs and TBV failing to open is used in this expression) and 0.065 represents the Reference 3 multiple greek letter (MGL)

P*y*5*c demand generic product. Therefore the probability of all 5 valves failing as a

'FACT/OBSERVATION-REGARDING.PS A TECHNICAL ELEMENTS' OBSERVATION(ID:AS-11)

/ Element AS I Subelement AS 9 result of a common cause lethal shock is 2.39E-04, which is about 7% of the random failure rate.

Summary The MSSVs and ADVs shall not be modeled with common cause terms as recommended by the PEER Review F&O. Although not addressed by the PEER Review team, the PZR safeties and ADVs/TBV do not warrant common cause modeling. While not questioned by the PEER review team, a common cause term relating the TBV-and the ADVs (both valves are of the same design and manufacturer) will be added to the new Palisades core damage model (PSAR2) that is presently being updated.

References 1] CPCo to NRC Letter, January 29,1993, Palisades Plant Individual Plant Examination for Severe Accident Vulnerabilities (IPE), [F341/1523].

2] EA-PPD-02-01, revision 1.

3] EA-PSA-DATA-99-0014, "Generic MGL Demand and Mission Time Parameter Data as Applied to PSAR1 Common Cause Basic Events", November 1999.

4) NUREG/CR-5485, "Guidelines on Modeling Common-Cause Failures in Probabilistic Risk Assessment", November 1998.

.FACT/OBS'ERVATION REGARDING-PSAi--

TECHNICAL'ELEMENTS OBSERVATION (ID: DA-02)

/ Element DA I Subelement DA-4 In Attachment I to EA-PSA-DATA-99-0004, Rev 00 (draft), two component failure modes are given for each component failure listed in the attachment. For example, for ADMT, the failure modes are "Fails to Run" and "Loss of Function/fails to perform function". It appears that the second failure mode description is intended to provide more detail for the first failure mode. In most cases, the first failure mode seems appropriate and adequately descriptive. However, in a number of instances, the second failure mode description contains inappropriate failure modes for the component failure of concern. For example, CRMJ pertains to "Fittings, cooler", a mechanical component.

The first failure mode is "External Leakage/Rupture". However, the second failure mode is "Short circuit/line to ground/leak/rupture". The "short circuit/line to ground" is inappropriate for the specific component type and should be deleted. The document does show a strikeout for this. The second failure mode should be reviewed for all component failures to ensure that all of the cited failure modes are appropriate for the component type LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above.

PLANT RESPONSE OR RESOLUTION CA01 7250 The original PRA development included a listing of component type designators (2 letter code) and failure mode designators (2 letter code). The combination of component type code, failure mode code, system code designators and component specific identifiers allowed unique basic event identifiers to be created for use in the PRA model. In addition, listings of generic data to be used in conducting risk analyses were generated by creating a listing that included a combination of component type codes and failure mode codes with applicable data to be used. The failure mode codes were developed to be dual purpose codes and many had two descriptions. The same code could represent an electrical component failure mode or a mechanical component failure

ii7.'i FACT/OBSERVATION REGARDING PSA- ; f o TECHNICAL ELEMENTS OBSERVATION (ID: DA-02)

/ Element DA I Subelement DA-4 mode. Since the listing of generic data or the creation of basic event identifiers was accomplished manually it was the individual analyst's responsibility to assure that the appropriate description was used. In EA-PSA-DATA-99-04 an attempt was made to automate some of the data generation process via a database. However, as noted there were many instances where incorrect descriptions were applied to the developed listing of generic data and were not corrected. The listing of generic data was extracted from the database used in EA-PSA-DATA-99-04 and a corrected table was created and included as attachment I to Risk Informed Engineering Guideline 03, Generic Data, revision 1.

CT/OBSERVATION REGARDIANG PSA

-TECHNICALE LEENS OBSERVATION (ID: DA-03)

/ Element DA I Subelement DA-04 EA-PSA-DATA-99-0009 presents the Palisades specific failure data for mechanical components for the time interval from 1994 to August 1999. This document presents a total of 21 failures. This seems to be somewhat lower than would be expected given the component population and the time window.

The data is based on the maintenance rule functional failure counts. Palisades may want to check to ensure that the maintenance rule functional failure definitions are consistent with the PSA failure definitions and confirm that failures were not missed based on definition differences.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above.

PLANT RESPONSE OR RESOLUTION CA01 7251 - Due 7/15/05.

A review of the Maintenance Rule data that existed during the time interval indicated in EA-PSA-DATA-99-0009 was completed by Applied Reliability Engineering (ARE) Inc (see PA-03-002-02 letter attached). The review included a determination whether the failures in the Maintenance Rule data should have been considered for equipment that is included in the PRA or could affect the initiating event frequencies currently used in the PRA. The Maintenance Rule data included 286 failure events. Of these ARE identified 62 that were determined to be applicable for use in updating the PRA data.

An additional 11 were identified as having a potential to impact PRA data, but further evaluation of the source of the information would be required to make a final determination.

As a result of the review, it appears that the issue identified in the PEER review is not the concern. The issue is why all of the indicated failure information was not used in the PRA data update. A review the EA determined that there is no information included to justify any information not used or why only certain failure rates were updated. The individual who completed the EA is no longer a member of the plant staff. Therefore, it is not possible to determine what the basis was for only including 21 of the potential 73 failures in the data update.

FACT/OBSERVATION REGARDING PSAv'rt -

-;Xei-:TECHNIC-AL -ELEMENTS' E

OBSERVATION (ID: DA-03)

/ Element DA

/ Subelement DA-04 As a result there is no reason to believe that the Maintenance Rule Functional Failure reports do not provide a reasonable source of information for the PRA data updates. It is also understood that the Maintenance Rule Functional Failure information would not necessarily be all encompassing and that other sources (e.g. corrective action, work order history, etc) should also be examined to determine whether other failure information exists that should be included in the data update. Data not used in EA-PSA-DATA-99-0009 will be included in the next PSA data update. No further action regarding the PEER review finding is required.

OTH014363 was generated to include an evaluation in the next PRA data analysis of the data not used in the data analysis reviewed by the PEER review team.

FACT/OBSERV.ATION REGARDINGPSA`

C' ECHNICAL ELEME OBSERVATION (ID: DA-04)

/ Element DA I Subelement DA-4, DA-5 Currently there is no plant specific data for electrical type components. There is generic electrical failure data.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Palisades has stated that they plan to gather electrical plant specific data and add this to the plant model.

PLANT RESPONSE OR RESOLUTION CA017253 Use of plant specific data is not required by any of the guidance documents (e.g. ASME RA-S-2002, AMSE Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, or NRC RG 1.200, An Approach For Determining The Technical Adequacy Of Probabilistic Risk Assessment Results For Risk-informed Activities) for conducting PRAs. The ASME Standard states, "The parameter estimates shall be based on relevant generic industry or plant specific evidence. Where feasible, generic and plant specific evidence shall be integrated using acceptable methods to obtain plant specific parameter estimates. Parameter estimates for the important parameters shall be accompanied by a characterization of the uncertainty." The NRC guidance in Regulatory Guide 1.200 included an evaluation of the current guidance including the ASME standard. The evaluation of the standard did not identify any objections to the statements presented above regarding use of data in risk assessments.

Use of plant specific data is recommended in particular for cases where component performance is not within the expected range of the industry data. However, the poor performance could also be accommodated in the model by adjusting generic data to reflect the extent that component performance deviates from the mean of the generic industry data. Palisades has used plant specific electrical data in the past for certain components (e.g. diesel generator output breakers). In general, there has been no recent indication that electrical component performance within specific groups (e.g.

480VAC breakers, 2400VAC breakers, etc.) is substantially different from industry data.

The replacement in recent years of many breakers to important plant equipment

'"FACT/OBSERYATION REGARDING;. PSA TECHNIAL -ELEMENT OBSERVATION (ID

DA-04)

/ Element DA

/ Subelement DA-4, DA-5 represents a condition in which the initial performance of the breakers is best represented by generic data until the equipment has been in place for a sufficient time to establish a component specific performance history.

An update of the parameters used in the PRA is planned to begin by the fourth quarter of 2005. (OTH014363). In the process of completing the data update consideration will be given to the need for development of plant specific data for electrical components.

FACT/OBSERVATION.REG'ARDING PSA'".^;,,,

Ew TECHNICAL ELEMENTS.

OBSERVATION (ID: DA-05)

/ Element DA I Subelement DA-05 Turbine-driven AFW pump run failure rate is calculated from Bayesian update of a generic failure rate for motor-driven AFW purnps. Since there is only about 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> of plant-specific run time, the Bayesian update has little effect and the plant-specific failure rate is almost the same as the generic rate. Most generic data bases have much higher run failure rates for turbine-driven AFW pumps than for motor-driven AFW pumps. Use of the generic motor-driven run failure rate produces a plant-specific turbine-driven AFW pump run failure much lower that supported by industry data.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Recalculate this failure rate using a turbine-driven pump run failure rate for the generic Bayesian prior mean.

PLANT RESPONSE OR RESOLUTION The failure rates for 'failure to start' and 'failure to run' for the turbine-driven AFW pump (P-8B) were recalculated as documented in analysis PA-003-06-2 (Palisades PSA Turbine Driven Pump P-8B Failure Probability Bayesian Update), revision 0, dated 1/29/04. The analysis was conducted by ARE (Applied Reliability Engineering) Inc. The analysis was technically reviewed and approved per Administrative Procedure 9.11 and is documented in EA-PSA-AFW-04-05, revision 0, dated 3/22/04. The analysis provides an acceptable resolution to the peer review comment DA-05 and PSA issue #176.

Closeout was documented in Corrective Action CA 017254

FACT/OBSERVATION REGARDING PSA 7 TECHNICAL ELEMENTS OBSERVATION (ID: DE-01)

/ Element DE I Subelement DE-3 No guidance could be found applying to dependency determinations.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Build guidance document.

PLANT RESPONSE OR RESOLUTION CA01 7255 RIE Guideline 01 Control of the Plant PSA Model was revised (revision 7) to include; guidance on the types of dependencies to be included in the PSA models, establish how the dependencies are identified, methodologies to generate probabilities for specific dependent events that are incorporated into the model, and reference to other documents that implement dependency analyses (common cause analysis, human error analysis, etc.).

The guidance on dependency determinations was included as section 6.0 of the guideline. The revision of the guideline has been reviewed and approved

1-FACT/OBSERVATION.>REGARDING UPSA"

'TECHNICAL ELEMENTS OBSERVATION (ID: DE-03)

/ Element DE I SubelementDE-10 Flood - Fire protection The flooding analysis does not appear to address the likelihood of the failure of fire protection system in the switchgear and cable spreading rooms.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Address the impact of this potential flood initiating event.

PLANT RESPONSE OR RESOLUTION CA01 7256 Fire protection system (FPS) piping was explicitly investigated as a flooding source in both the Bus 1C switchgear and cable spreading rooms.

The following statements are taken from Appendix A "INTERNAL FLOODING EVALUATION" of the Palisades IPE submittal.

"Bus 1 C provides power to one train of safety related equipment, with D!G 1-1 providing backup power to that bus. Flood sources for the Bus 1 C zone is service water cooling to both diesels or fire protection system piping."

"Bus 1 D, Cable Spreading and the Battery Rooms' electrical panels are protected against the spray sources in the zone, with the floor drain system being sufficient to preclude accumulation of water on the floor from calculated FPS line failures."

Reference 1 provides a detailed discussion of the evaluation and the resulting quantification of the effects of FPS piping failures resulting in flooding. Appendix B of that document is based upon a plant walkdown performed in 1992, in support of the Palisades IPE. That appendix specifically identifies FPS piping as a potential flooding source in both the Bus 1C switchgear and cable spreading rooms. Other parts of

7 FACT/OBSERVATION REGARDING' PSA

-TECHNICL ELMENTS.

Reference 1 describe the quantification of core damage sequences due to flooding events resulting from postulated failures of the piping. This updated analysis specifically identifies the likelihood of occurrence of each flood source and the corresponding core damage frequency for each source The flooding analysis does address the likelihood of the failure of fire protection system in the switchgear and cable spreading rooms. No further action is required.

Reference 1: Applied Reliability Engineering, Inc., Palisades Internal Flood Analysis Update, PA-02-002-4, Rev. 3, June 15, 2004.

-ACT/OBSERV'ATION REGARDING'.PSA<,

TECHNICAL :ELEMENTS8 OBSERVATION (ID: DE-04)

/ Element DE

/ Subelement DE-10 CST-T-2 Inventory-Diversion CST T-2 has a 12" line leading to condensate make-up and reject. This line branches to two make-up lines and one return line fed by the condensate pumps. The two make-up lines are a 12" fast make-up for main steam dump and a 6" make-up for condensate fill and maximum blow down. The 6" make-up is controlled from a hotwell level controller LC 0732 and the 12" make-up is controlled by LC 0731. The associated valves for operation of make-up appears to require instrument air.

The spurious operation of this system which could result in the loss of CST T-2 is not included in the Palisades' PSA. Only the CST T-2 ruptured/leakage failure mode is considered (A-TKMJ-T-2).

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Appropriately address CST T-2 inventory diversion.

PLANT RESPONSE OR RESOLUTION CA017257 The valves in question provide makeup to the hotwell from Condensate Storage Tank T-2 to makeup for losses resulting from operation of the Atmospheric Steam Dump or Main Steam Relief valves. As noted in the Peer review comment the valves are air to open. Without air they could not spuriously open to cause.the diversion of flow.

Therefore the discussion will not include any impact from a loss of instrument air.

A-PAL-89-151 evaluated the impact of a failure of CV-0733, CV-0732 or CV-0729 failing open and resulting in the Condensate Storage Tank (CST) dumping water to the hotwell. While the valves are normally closed, they may cycle after a plant trip. In performing the analysis a review of plant trip reports was completed to evaluate the performance of the valves in response to a plant trip. The review determined that the average valve demands were: CV-0733 - 0.22/trip, CV-0732 - 4.3/trip and CV-0731 -

9.9/trip). CV-0729 is manually operated and therefore had no recorded demands. The analysis used 0.25, 5 and 10 demands/plant trip for the respective valves.

- ;;;t -FACT/OBSERVATION REGARDING PSA'

..!-'-',-:, -; - '.;.TECHNICAL ELEMENTSS-'.'..-"'

The analysis also evaluated the likely flow rate through the valves if they failed open and the time that it would take to deplete the Condensate Storage Tank (T-2) at those flow rates assuming T-2 level at 72%0(NOTE T-2 Low Level is alarmed in the control room at 73%). The results of the evaluation were that with CV-0733 failed open the CST would be depleted in 15.8 minutes (5897 gal/min). CV-0729 failed open would deplete T-2 in 71.2 minutes (1307 gal/min). With CV-0732 open the CST would be depleted in 298 minutes (312 gal/min). Flow through CV-0731 was not analyzed since its function is to reject water from the hotwell (via condensate pump discharge) to T-2.

Since A-PAL-98-151 was conducted, current operating practice has changed regarding operation of CV-0773. EAR-2001-0116 was issued to determine a permanent solution to an Appendix R issue of a fire induced hot short causing spurious operation of CV-0733. The resolution was to maintain CV-0733 closed and now maintaining its manual isolation valve MV-CD138 normally closed.

The probability of the control valve CV-0733 and the manual isolation valve both failing to remain closed during the mission time of the plant response to a transient event is as follows. For CV-0733 the probability it may be open is 8.04E-05 (failure to remain closed (5.36E-07/hr

• 24hours) 1.29E-05 OR failure to close on demand 6.75E-05 (2.69E-04/d

• 0.25)). Combining the failure of CV-0733 with the manual isolation valve failure to remain closed 1.79E-05 (7.44E-07

• 24) for MV-CD1 38 results in a probability of failure of both valves of 1.44E-09. This probability is just above the truncation value used in the solution of the CDF. Since it is near the truncation value and does not constitute a set of conditions that would result in core damage (requires additional equipment failures), it will not be included in the model.

For CV-0729 since there are no automatic demands, the probability it is open is 1.29E-05 (5.36E-07/hr

• 24hrs). The probability of depletion via CV-0729 is therefore the probability CV-0729 is open (1.29E-05)

• the probability its manual isolation valve fails to close (1.22E-03) or the operator fails to complete the isolation (1.OOE-03) = 2.68E-08 (1.29E-05 * (1.OOE-03 + 1.22E-03). This probability is close enough to the truncation value given that other failures are required for core damage to occur that inclusion in the model is not warranted.

For CV-0732 the probability of failure to close given a demand is 2.69E-04/demand

• 5 demands = 1.345E-03. The probability of depleting the CST is the probability of CV-0732 failing to close AND its manual isolation valve failing to close 1.64E-06 (1.22E-03

• 1.345E-03) OR Operator fails to close the manual isolation valve. As noted above depletion of T-2 would take - 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (298 minutes). However, the analysis completed for A-PAL-89-151 does not include consideration of the concurrent operation of an

Zl,',,',lFACT/OBSERVATION

-REGARDING iPSA; w

• .. TECHNICAL ELEMENTS -

Auxiliary Feedwater Pump in addition to the losses through the valves in question.

Considering a constant 300gpm flow through an AFW pump in addition to the flow

~through-CV-0732 results in a net drain down rate of 612 gpm which would result in.

depleting T-2 in 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. Given the time available to complete the action (an operator error of 1.OOE-03 is reasonable. The probability of CV-0732 failing open and the operator fails to complete isolation is 1.35E-06 (1.345E-03

• 1.OOE-03). The total probability of failure associated with CV-0732 is 3E-06 (1.64E-06 + 1.35E-06).

This evaluation has not credited the automatic replenishment of T-2 from T-939 (Demineralized Water Storage Tank) when T-2 reaches 76% until it reaches 84%. This makeup would occur for events that do not include a loss of offsite power. If a condensate pump is operating or can be restarted and CV-0731 functions water from the hotwell can be rejected to T-2 compensating for the losses through the makeup valves. In addition, any water lost to the condenser through the valves in question results in more inventory available for low pressure feed of the steam generators via the condensate pumps. Low pressure feed via the condensate pumps is a backup to the AFW function for secondary cooling.

Therefore only the scenario for failure CV-0732 will be included in the model - PSA Model Rev 2.

FACTIOBSERVATION REGARDING' PSA

"'TECHNICAL ELEMENS OBSERVATION (ID: HR-01)

/ Element HR I Subelement HR-1 The specific human action methodology utilized in Palisades PRA is not documented.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Document the human action methodology.

PLANT RESPONSE OR RESOLUTION CA01 7258 The PEER review issue (HR-01) was that the methodology being used in the Palisades PSA was not documented. Documentation of the HRA methodology currently implemented in the Palisades PSA was included as section 7.0 of Risk Informed Engineering Guideline, RIE-01, Control of PSA Model, Revision 6, 12/14/04.

' FACTIOBSERVATION REGARDING'-PS'A..

'.TECHNICAL ELEMENTS OBSERVATION(ID: HR-03)

/ Element HR

/ Subelement HR-11, HR-13, HR-15, HR-16 HRA - Methodolociy NUREG/CR-4772, Accident Sequence Evaluation Program Human Reliability Analysis Procedure, provides specific requirements for adjusting the HEP downward if the following criteria are met:

1. The initiating event is covered in EOP

2. Control Operators have been trained

3. Symptom-oriented EOPs are used (memory actions can not use downward values)

4. -EOPs are well designed Operator action H-AVOA-HPISUBCLG, Operator fails to align HPSI subcooling, is stated as having governing procedures EOP 4, symptom-oriented, and EOP 9, function-based. This action would not meet the above criteria, but uses the lower bound HEP value.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Ensure that the use of the lower bound value is consistent with the guidelines.

PLANT RESPONSE OR RESOLUTION CA01 7259 Resolution of the Comment.

The peer review comment was based on a misunderstanding of the procedures and their role in the operator performance of the action. The fact that one of the procedures is function based versus symptom oriented would not disallow the credit taken in developing the Human Error Probability (HEP). The principal procedure providing direction is EOP 4.0, which is a symptom-oriented procedure. The fact that supplemental guidance is included in EOP 9.0, which is a function-based procedure, is not an issue. The comment was also evaluated by Applied Reliability Engineering (ARE). ARE has provided support to the Palisades PSA in several areas including

.1 t':FACT/OBSERVATION REGARDING PSA- -.

TECHNICAL-ELEMENTS expertise in the development of HEPs. The evaluation provided by ARE attached (ARE Memo 032904) supports the conclusion that the credit taken was appropriate.

The conditions for adjusting the HEP downward have been met and no further action is required.

FACT/OBSERVATION REGARDING PSAk- ;; t;-t-TECHNICAL ELEMENTS-;

=

OBSERVATION (ID: HR-04)

/ Element HR

/ Subelement HR-11, HR-13, HR-15, HR-16 HRA - Methodology - Stress Level Determination NUREG/CR-4772, Accident Sequence Evaluation Program Human Reliability Analysis Procedure, provides guidance on the determination of stress level.

Moderately High Stress is defined as a level of disruptive stress that will result is a moderate deterioration on performance effectiveness of system-requires behavior for most people.

Disruptive Stress is defined a the bodily of mental tension resulting from the response to a stressor that threatens, frightens, worries, or angers a person, or increases that person's uncertainty, so that usual tasks are performed at a decreased level of effectiveness or efficiency.

High Stress is defines as a level of stress higher than optimum stress, i.e. moderately high or extremely high stress level.

Optimum Stress is defined as the level of stress that is conductive to optimal performance. Most of the estimated human error probabilities in this document are predicated on the assumption of an optimum stress level and must be adjusted upwards when non-optimum stress levels are assessed.

From Table 8-1, the methodology provides the following guidance to establish the stress level:

At least a moderately high level of stress is assessed for a minimum of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the initiating of an abnormal event Extremely high stress is assessed for occasion in which more than two primary systems fail to function. However, if it can be determined that frequent simulator training has made control room personnel very familiar with the accident sequence being evaluated, the lower bound of the estimated HEP may be assessed.

Moderately High Stress results in a value of 0.02 per step. Extremely High stress results in a value of 0.05 per step. In no case was the value of 0.05 used even though many actions are used when more than two primary systems fail such as once-through-cooling. Although the methodology does state that frequent simulator training may be used to justified a lower value, it is difficult to believe that the sometime complex conditions that the actions are used would not result in some high-stress conditions.

LEVEL OF SIGNIFICANCE B

';.;'FACT/OBSERVATION REGARD'ING -PSA'

-TECHNICAL ELEMENTS!;

-'--I';'

POSSIBLE RESOLUTION Re-assess the stress evaluation in context of the accident sequences being recovered.

- PLANT1RESPONSE OR RESOLUTION-CA017260 PEER Review Comment HR-04 was issued to document a review observation regarding the stress level determinations in the development of Human Error Probabilities (HEPs) for the PSA model. The peer team reviewer questioned the fact that none of the HEPs for post-initiating event human actions had applied the extremely high stress factor in the calculation of the HEPs. The HEPs were developed in analysis "Palisades PRA (Post Initiating Event Reliability Analysis (HRA) Application of NUREG/CR 4772", Tenera Energy Document File 99143001-006, 5/21/99 (EA-PSA-2001-15). The reviewers concern was based on the observation that none of the HEPs developed determined that the actions were performed under high stress conditions although some of the scenarios warrant the assignment of a high stress level. A cursory review of the operator actions in the referenced analysis and a another analysis

("Post Initiating Event Human Etror Probability Analysis ASEP - NUREG/CR 4772, Additional Post Initiating Event HEPs", Tenera Energy Document File 99143001-007, 1999 (EA-PSA-2001 -15)", confirmed their concern as a few of the actions may be performed under high stress conditions but were not assigned high stress factors. To address this concern, a reevaluation of the stress level associated with all operator actions assessed in both analyses was performed.

The analysis identified 3 human actions that were assigned optimistic stress factors (too low) in the original ASEP analysis as shown in the table in the attached document.

Stress level for 5 other actions were determined to be conservatively assigned (too high) but these actions were not requantified as their current contributions are not significant enough to warrant a reduction of their HEPs. The rest of the human actions were assessed to have the correct stress assignment in the original ASEP analysis. The 3 actions were requantified with the higher stress factors in Attachment A of the attached document and the new HEPs are listed in the table on page 3 of the attached document. Since the updated values resulted in a less than 2% change in the core damage frequency no immediate change to the model is required. They will be included in the update to the PSA currently being developed.

FACT/OBSERVATION REGARDINGvPSA.4'.-

TECHNICAL ELEMENTS' OBSERVATION (ID: HR-06)

/ Element HR I Subelement HR-13 In reviewing the post-accident operator actions, some actions use screening values, some use human action methodologies described in the IPE, and yet others use the new ASEP methodology. The majority of the human actions quantified using ASEP have MAAP runs to back up the time constraint used.

LEVEL OF SIGNIFICANCE B

--POSSIBLE RESOLUTION Those actions that use screening values and other human actions described in the IPE all need to be quantified using the ASEP methodology with the appropriate MAAP runs to back up time constraints. However,' per Palisades staff, these actions have little risk significance and may be removed from the model.

PLANT RESPONSE OR RESOLUTION CA017261 Resolution The Palisades PSA model presently includes 113 pre-and post-initiator (events that trigger sequences of events that challenge plant control and safety systems) Human Error Probability (HEP) models. Four of this total, employ screening values. Replacing these values with fully developed modes is not necessary or an efficient use of resources. These four actions are not probabilistically important. However, by retaining the actions in the logic, potential dependencies with other distinct modeled actions are retained in the cutset (minimum combination of a set of events that, if they occur, will result in an undesired event such as the failure of a system or the failure of a safety function) list. This serves as a check to ensure that 'human' commonalities are correctly accounted for, which is very important.

It should be noted that the Palisades PSA continually re-assesses the plant specific HEP models. Present updates have and continue to include the following references:

- ASEP (NUREG/CR-4772)

FACT/OBSERVATION REGARDING~-PSA' SEV I

TECHNICAL ELEMENTS&

-.'.;-1 OBSERVATION (ID: HR-06)

/ Element HR I Subelement HR_13

-THERP (NUREG/CR 1279)

- ATHEANA (NUREG-1 624)

- EPRI Sponsored HRA Calculator The ASEP methodology is a conservative and simpler extension of the very labor-intensive THERP technique. The ATHEANA process includes both acts of commission and omission and is also very labor-intensive. These techniques were used in the development of the Palisades Pressurized Thermal Shock HEP models (it should be noted that both the NRC and their contractors were available to support this development). Finally Palisades is re-assessing the many developed ASEP HEP's using the HRA calculator developed by SCIENTECH. The goal of this new methodology is to incorporate many of the key elements of the above listed techniques (e.g., ASEP, THERP and ATHEANA) in a more efficient framework.

CA017261 Conclusion At this time fully developed HEPs are not going to be created for these four 'screening' HEP values.

-FACT/OBSERVATION'REGARDING PSA'

+.'0-'--

'if TECHNICAL ELEMENTS'a OBSERVATION (ID: HR-07)

/ Element HR I Subelement HR-14, HR-19, HR-21 All operator actions utilized in Palisades PRA do not have input from licensed operations personnel.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION All human actions should receive input from licensed operations personnel. It is preferred that more than one person be utilized to minimize overconfidence.

PLANT RESPONSE OR RESOLUTION CA01 7262 The Palisades Human Error Development process has since it began the early 1980s included information obtained from operators and verified information used to develop Human Error Probabilities (HEPs) with operators. When possible individuals with current or recent operating licenses were included in the PSA staff. The problem is that most of the interactions were not formally documented. To resolve this issue, a new paragraph was added to section 5.2.2 of Risk Informed Engineering (RIE) Guideline 01, revision 4. This paragraph identifies the need for operations personnel to provide input and validate the information used in the development of HEPs. Attachment 6 was added to the guideline as an example of the documentation to be developed to demonstrate that operator input is occurring.

FACT/OBSERVATION'REGARDING TECHNICAL ELEMENTS .

OBSERVATION (ID: HR-09)'

Element HR I Subelement HR-17, HR-19 Human Actions - OTC Timing The human action analysis for the timing of OTC (H-ZZOA-OTC-INIT) states the time compelling signal received is S/G level at 28.7% and that the latest time the action can be completed is when the S/G wide range level reaches -84% or operating getting to step 8 of EOP 7.0.

1 It appears that the compelling signal is inappropriate in that the EOP directs at the action at -84% not 28.8%. The actions at 28.8% will be focused on recovering AFW.

However, if this becomes the start time the'n the'r-eis zero time available to implement the action. This is further confused since the timing used in the event trees for station blackout is a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> recovery.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Establish a consistent timing bases for OTC and update H-ZZOA-OTC-INIT PLANT RESPONSE OR RESOLUTION CA01 7263 The comment was evaluated and determined to be correct. The compelling signal being used was incorrect. The HEP analysis was revised to include the appropriate compelling signal and reassess the time available to complete the action. The revised HEP is documented in EA PSA-OTC-04-05, revision 0, dated 3/24/04. The Engineering Analysis (EA) documents the change in compelling signal as noted in the Peer Review comment. In addition, the EA references a more recent analysis that establishes the time available as approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This time is more than adequate for completion of the action and is consistent with the station recovery time as noted in the comment.

b j FACT/OBSERVATION REGARDING"PSA TECHNICAL ELEM ENTS'-

OBSERVATION(ID:HR-11)

/ ElementHR I Subelement HR-25 Human action Y-AVOB-RAS-VLVS does not have different flavors corresponding to the different LOCA break sizes when paired with its counterpart action H-AVOA-HPISUB-LB/MB/CLG.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Formally quantify three flavors of Y-AVOB-RAS-VLVS to correspond to the different LOCA break sizes.

PLANT RESPONSE OR RESOLUTION CA01 7264 Y-AVOB-RAS-VLVS is an operator action to close the minimum flow valves from the discharge of the HPSI pumps to the SIRWT on initiation of recirculation from the containment sump. Failure to close these valves diverts coolant from the containment sump back to the SIRWT. Sufficient diversion in this manner is assumed to lead to eventual NPSH problems with the pumps taking suction from the containment sump as the elevation head in the containment gradually decreases.

A review of the development of the HEP for Y-AVOB-RAS-VLVS (Reference 1) reveals that the diagnosis part of this action has been developed and is already included in the recognition of the need to align HPSI subcooling for the various size LOCAs modeled in the PRA (e.g., H-AVOA-HPISUB-LB/MB/CLG for large, medium, small breaks and transients in which OTC is initiated). Diagnosis error for these operator actions does vary with timing and appropriately reflects the effects of the different break sizes. The development of the HEP for Y-AVOB-RAS-VLVS reflects the fact that alignment of HPSI subcooling already incorporates the diagnosis part of this HEP (see Section 2.2 of Reference 1).

As a result, derivation of the failure probability for Y-AVOB-RAS-VLVS contains only the executions part of the HEP. Because the variation in timing for this action is associated with only the diagnosis and there is no difference in the time available to execute this action for the different break sizes, one HEP for this action is appropriate for all accident sequences in which it is modeled in the PRA.

-,-,-FACTIOBSERVATION 'REGARDING- 'PSA'..

.:TECHNICAL ELEMENTS.:":',-"--7"~

OBSERVATION(ID:HR-11)

/ ElementHR I Subelement HR-25 Thevalue of Y-AVOB-RAS-VLVS should not change for the spectrum of events in which closure of these valves is needed. Therefore, the current HEP for this action is appropriate and no further HEP derivation is needed for this event. This closes the actions necessary to address Finding and Observation HR-1 1.

Reference 1: Tenera Inc., "Post Initiating Events Human Error Probability Analysis ASEP -

NUREG/CR 4772 Additional Post Initiating Event HEPs".

Note that EA-PSA-2001-015; Rev 0, "Owners Review of Tenera Energy's Calculation of Palisades PSA HEPs" documents the Palisades review of this analyses.

Ae<

d<[

FACTIOBSERVATION REGARDINGPSA i

TECHNICALELEMENTS.

OBSERVATION (ID: HR-12)

/ Element HR I Subelement HR-25, HR-26 Given that the ASEP human action methodology is being utilized which is very time dependant, those sequences that use more than'one human action need to be evaluated.. The'evaluation should pay special attention to address the total time available and if all human actions credited in the sequences are possible.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above PLANT RESPONSE OR RESOLUTION CA01 7265 This issue is addressed by EA-PSA-2001-015 Revision 0. The HRA process including the initators is described in this document. Human error dependency issues are addressed by EA-PSA-HRA-DEP-01-33.

-t FACTIOBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION(ID:IE-01)

/ Element IE I Subelement IE-3 The documentation of the selection and quantification of the initiating events for the latest revision of the PSA is distributed over multiple documents. Several of these documents have not been completed and are not fully reviewed. The documentation that was available appeared to be good and will meet expectations when completed and signed off. EA-PSA-DATA-99-0019 is a very thorough presentation of the quantification of the non-LOCA andnon-LOOP initiators and has very good traceability.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Complete the review and sign-off of the new IE selection and quantification documentation.

PLANT RESPONSE OR RESOLUTION CA01 7266 EA-PSA-DATA-99-0019 has been updated, tech reviewed and signed. However, the EA reference number has been changed from EA-PSA-DATA-99-0019 to EA-PSA-DATA-04-08 rvO.

-r

~'FACT/OBSERVATION REGARDING PSA' TECHNICAL ELEME TSJ 9

yY Z.

OBSERVATION (ID: IE-03)

/ Element IE I Subelement IE-4 Flood - Initiating Event Frequencies The flood initiating event frequencies have two components: passive breaks and maintenance. Table 7 of the flood analysis shows the total flood frequencies due to all causes. It shows that Passive Breaks = 1.87E-2 and Maintenance Floods = 3.56E-3.

It is expected that the maintenance-induced floods would be more likely than the passive failures.

In addition, a single value of 4E-1 0 /hr/ft for all systems was used based on INEEL "Component External Leakage And Rupture Frequency Estimates", Nov 1991.

The flood analysis report states "Palisades has not experienced a flooding event that affected safety significant equipment in its 27 years of operation." DBD-1.03 Rev 3 discusses a flooding event that impacted the AFW pump room (it is unclear if this was a pipe break). A second flood event was discussed during the plant tour that impacted a switchgear room.

Also, using the restriction that the flood "affected safety-significant equipment" as the requirement to count it in the initiating event analysis appears too restrictive. This includes an impact assessment in the initiating event assessment.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Flooding initiating event frequencies should be re-assessed considering the relationship between maintenance and passive failures and plant experience.

PLANT RESPONSE OR RESOLUTION CA017267 Following an update to the calculation of the initiating event frequency for internal flooding (Reference 1), the total frequency for internal floods is 2.4E-2/year. This value was calculated by performing a Bayesian update of generic flood events with Palisades specific events. Generic events were determined through an examination of LERs; industry events that could potentially occur at Palisades were identified and included as

.' FACT/OBSERVATION REGARDING PSA'-

S TECHNICAL ELEMENTS" applicable events. Plant-specific events were based on operating history-specifically, deviation reports. Review of the deviation reports identified two events that have occurred at Palisades: one in 1982 affecting the Condensate Pump Room and one in 1983 occurring as a result of an overfill of the Spent Fuel Pool. The 1982 event is the same event as included in DBD-1.03 Rev. 3. The Spent Fuel Pool event impacted the switchgear room and is the same event "discussed during the plant tour". Thus, plant experience has been incorporated into the initiating event frequency.

Reference 2 describes the distribution of the total frequency into "passive" and "non-outage maintenance" flood events. From Reference 2, the total Passive Flood initiating event frequency is 1.87E-2 per year (i.e., the same value as included in the F&O). Non-outage maintenance floods are estimated to occur with a frequency of 5.2E-3/year (50%

higher than the value included in the F&O).

No attempt was made to use different pipe failure frequencies based on pipe size or nominal pressure of the fluid within the pipe. Although using different failure frequencies will of course lead to changes to the total flood frequencies calculated for individual flood areas, that impact has not been calculated. The total flood frequency calculated using plant-specific and generic experience remains unchanged.

The analysis focuses on non-outage maintenance-induced flood events in order to be consistent with the "at power" nature of the Palisades PSA. Non-outage maintenance events are assumed to comprise 30% of the total number of maintenance flooding events. This distribution is based on engineering judgment and "...on conversations with plant personnel, which determined that the majority of the flooding potential from maintenance activity occurs during plant outages. Plant outages are the most common time for maintenance activity that involves opening, modifying or renovating systems.

Whether during an outage or operating at full power, early detection of a maintenance or testing initiated flooding event is highly likely because of the presence of plant personnel performing the activities which could initiate the flooding." (See Reference 2)

Using the conservative approach described in Reference 2 for estimating the total maintenance-induced flood frequency, the total for maintenance floods is 1.7E-2/year.

This is roughly the same frequency as that for passive failures. Thus, although not "more likely than the passive failures", as expected by the peer review team (see the text of the F&O observation), this value is believed to be representative of the potential for maintenance-induced floods while the plant is in a non-outage condition. Again, regardless of the split between passive and maintenance-related failures, the total flooding frequency (based on plant-specific event history) remains unchanged.

i,', -, FACTIOBSERVATION REGARDING'.'PS TECHNICAL ELEMENTS References I1]-A-pplied-R iibility -Egiieeririnc., lhtern-al FldodingInitiating-Event-Fre-q-u-e-n-cy Calculation, PA-02-01 0-01, November 26, 2003.

2] Applied Reliability Engineering, Inc., Palisades Internal Flood Analysis Update, PA-02-002-4, pending.

I

r,

,""FACT/OBSERVATION REGARDING' PSA

,{C -% -,,,-S -, -'TECHNICAL ;ELEMENTS'oh'

-f'i 'O OBSERVATION (ID: IE-04)

/ Element IE I Subelement IE-5 Loss of HVAC systems (CR, CSR, SWGR) were not considered as initiating events.

The loss of a HVAC system is usually cornbined with a human action if a standby train is available.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Per Palisades PRA staff, HVAC calculations are being performed and will eventually be incorporated into the model. It is important to note that loss of these HVAC systems as initiating events not be neglected if a plant trip is a feasible outcome.

PLANT RESPONSE OR RESOLUTION CA017268 Per Reference 1, HVAC cooling of switchgear room's IC and 1 D is not necessary.

Refer to CA017289 for further discussion with respect to the control room and the cable spreading room HVAC requirements.

1] EA-APR-95-023, Rev. 1, "Room Heat-up After Loss of Ventilation Under Appendix R Scenario in the Control Room (325), Cable Spreading Room (224), IC Switchgear Room (116A), Battery Rooms (225, 225A), Containment Area and the Diesel Generator Rooms (116,116B)", [4396/0157].

FACT/OBSERVATIONAREGARDINGPSA TECHNICAL ELEMENTS OBSERVATION (ID: IE-05)

/ Element IE I Subelement IE-5 While the set of support system initiators appears to be quite comprehensive, the process used to evaluate support system initiators is not well documented.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Document process for selecting the support system initiators so that it is reproducible.

PLANT RESPONSE OR RESOLUTION CA01 7269

'Palisades Init Events Notebook.doc' documents the process for selecting support system initiators.

F-ACTIOBSERVATION REGARDING PSAX'-

TECHNICAL ELEMENTS-OBSERVATION (ID: IE-06)

/ Element IE

/ Subelement IE-7 The initiating event frequencies calculated in EA-PSA-DATA-99-0019 uses data from1987 through 1995 because that is the time frame basis for their primary reference, NUREG/CF-5750. All initiating events are listed in Attachment 1 to EA-PSA-DATA 0019. However, there is no indication that pre-1987 events were reviewed to ensure that all plant specific vulnerabilities have been covered.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Review the pre-1987 to ensure that any vulnerabilities have been captured or eliminated.

PLANT RESPONSE OR RESOLUTION CA017270 Resolution of this CA includes a brief recounting of the Palisades PSA history as well as several corrective actions. Hence the following subjects will be briefly discussed:

SEP Topic XV-2 IPE and IPEEE CA017271 CA017269 CA017248 CA017289 These topics are discussed in the following sections.

SEP Topic XV-2 As part of SEP Topic XV-2 "Spectrum of Steam System Piping Failures Inside and Outside Containment," a previously unanalyzed transient was identified for the Palisades Plant that assumed a rupture of one of the two main steam lines inside containment with a concurrent single-failure of the main steam isolation valve (MSIV) in the other main steam line (Reference 1).

-,FACT/OBSERVATION REGARDING. PSA'

,TECHNICAL ELEMENTS" OBSERVATION(ID

IE-06)

/ Element IE

/ Subelement IE-7 As a resolution to the deficiencies identified in this SEP Topic, Consumers Power committed to backfit the plant eliminating single-failure. As a result, a PSA evaluation of this issue began in 1982 evaluating the risks/benefits associated with alternate modifications. To inaugurate the PSA evaluation, the Palisades team was staffed with plant analytical and operation personnel (e.g. former Shift Supervisor) as well as members of the Consumers Power Big Rock Point team0 that just completed a detailed Level 3 PSA submittal in 1981. Hence the team consisted of experienced plant personnel as well as the supporting Big Rock Point contractors who were part of the NRC sponsored WASH-1400 study.

The result of this initiative is simply that Palisades began developing detailed risk models (e.g., initiators, fault trees, event trees, deterministic capabilities etc.) some 6 years prior to issuance of Generic Letter 88-20 (Reference 5).

The risk study submitted in 1985 resulted in a single failure exemption granted by the Staff.

IPE and IPEEE The IPE (Reference 2) and IPEEE (Reference 3) submitted in 1993 and 1995 respectively, built upon the developed risk.model infrastructure that began, as mentioned above, in 1982.

Corrective Actions Because the history of the Palisades PSA development is summarized not only in the NRC submitted reports, but also spread among a variety of data sources, the PEER review team could not review all the available plant developed analysis at the time of their assessment. Consequently four related initiating event findings were identified.

Resolution of these findings is now briefly discussed.

CA017271 This CA was concerned with the LBLOCA frequency basis. This comment is a non-issue as it is considered the Palisades historical documentation (EAs) adequately discussed the basis.

Moreover, Reference 7, a draft letter report issued October 6, 2004 corroborates this conclusion. This letter report, a companion to NUREG-xxxx, summarizes the probabilistic risk assessment (PRA) work (only) performed for the Palisades analysis.

'U'.

iFACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS:-`I

OBSERVATION (ID: IE-06)

/ Element IE I Subelement IE-7 During the Palisades study, a separate effort was underway at the NRC to review and revise the LOCA frequencies from NUREG/CR-5750 for use particularly in work associated with 10CFR50.46 but with applicability for other risk-informed applications such as the PTS project. There was a concern that the LOCA frequencies in NUREG/CR-5750 did not account for age-related factors important to deriving the frequencies and an expert elicitation effort at NRC was conducted to account f6r these adjustments.

The results from that elicitation were not entirely appropriate for use in the Palisades PTS study because the elicitation structure and results involved both piping and non-piping causes-for-the various size breaches. --Discussions were held between the Reference 7 NRC contractors and the NRC 'elicitation' subject matter experts. It was concluded, based on these discussions, that the Palisades plant specific initiating event frequencies (including large break LOCAs) were nearly the same as that developed in the elicitation effort. Therefore no change was made to the Palisades values.

CA017269 This CA was concerned with the lack of support system initiator documentation. This CA was addressed by creating a 55-page report discussing how the Palisades support systems initiator selection was performed.

CA017248 This CA was written to address a PEER review comment about the lack of a inadvertent pressurizer safety valve opening initiating event in the plant core damage model. This event has been investigated since 1982. Past thermal hydraulic analyses have not resulted in any predicted calculated challenges to the pressurizer safety relief valves.

Moreover, the plant in 30 plus years of operation has not experienced such an event.

Nevertheless, although such an incident is very unlikely it is not improbable. Hence another probabilistic assessment of this event with respect to the PSA calculated core damage frequency was analyzed. The resulting increase in the plants core damage frequency was about 1%.

CA017289 This CA was focused on the fact that Control Room HVAC is not modeled in the Palisades' PSA. As part of the disposition of this EA, industry data were reviewed and it was determined that the damage frequency was about 1.6E-07 per year. Given an average HVAC contribution of 1.6E-07 and comparing to the present Palisades average core damage frequency of 6.24E-05, the effect of loss of HVAC whether as an event initiator or as a conditional failure was negligible.

":i.'.'"'

FACT/OBSERVATION-REGARDING"PSA TECHNICAL ELES OBSERVATION(ID:IE-06)

/ Element IE I Subelement IE-7 CA017270 Summary The Palisades staff with the support of WASH-1 400 contributors commenced developing PSA logic models, data, and deterministic techniques in 1982. This effort continued through the 1980s and 1990s given the issuance of the Generic Letter 88-20 (Reference 5). Every time a Palisades risk related submittal has been made (References 1, 2 and 3), the plant historical initiating event data was reviewed.

Moreover, the assessment of the additional PEER review comments regarding specific initiating events showed that exclusion of these events had a negligible affect on the results. This was expected given the number of years that the Palisades staff has spent in developing, analyzing and maintaining risk data.

In addition, from a statistical perspective, data prior to 1987 is now excluded from review as it is judged not applicable. This is because given the changes in plant maintenance, the advent of multiple plant reliability programs in support of the planned preventative maintenance activities, the new behaviors with respect to plant operations, the many plant modifications as well as the sufficiently broad statistical data set available and employed (1987 to December of 2003 - Reference 4) any analysis prior to 1987 is not warranted. Furthermore, it has been clearly demonstrated that the past transient initiating event data has been more conservative than that reported in Reference 6. This conclusion is noted in Reference 4, which has replaced EA-PSA-DATA-99-0019.

This PEER review comment is considered closed.

References 1] "Evaluation of Palisades MSLB Single Failure Backfits", May 23,1985 [UFI 950-42*40*01*01 and 950-03110/15100].

2] Letter CPCo to NRC, Palisades Plant - Individual Plant Examination for Severe Accident Vulnerabilities (IPE), January 29,1993 (F341/1523) 3] Letter CPCo to NRC, "Palisades Plant - Response to Generic Letter 88-20, Supplement 4, Individual Plant examination of External Events for Severe Accident Vulnerability Final Report," dated June 30, 1995 (G326/2286).

i {l FACT/OBSERVATION REGARDING PSA -5siif TECHNICAL ELEMENTS OBSERVATION (ID: IE-06)

/ Element IE

/ Subelement IE-7 4] EA-PSA-DATA-04-08 rv 0, "Determination of Palisades Initiating Event (IE)

Frequencies using INEEL Prior Data", September 2004.

5] USNRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 1OCDF50.54(f), November 23,1988 [D641/1855].

6] INEEL/EXT-98-00401, "Rates of Initiating Events at U.S. Nuclear Power Plants:

1987-1995", February 1999, U.S. Nuclear Regulatory Commission, Washington D.C.

7] D.W.Whitehead et.al, "Palisades Pressurized Thermal Shock (PTS) Probabilistic Risk Assessment (PRA)", Date Submitted: October 6, 2004.

REGARDING.

FACTOBSERVATION'REGARDINGPSA.

-s'TECHNIC-AL ELEMENTS OBSERVATION (ID: IE-07)

/ Element IE I Subelement IE-10 Section 6.1.4 of EA-PSA-IE-0010 discusses the calculation of the LBLOCA freq. The value calculated using the CEOG approach yields a very low value for the break size range used by Palisades. Thus, a 1 E-05 frequency was assumed but no basis was given. The value is somewhat conservative but not unreasonable. NUREG/CE-5750 provides a value of 5E-06 that is comparable to the availability adjusted value used by Palisades.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above PLANT RESPONSE OR RESOLUTION CA01 7271 Resolution of this CA is first going to repeat the Reference 1 Medium Large and Large Break event calculations. This will be followed by excerpts from the recently Reference 2 draft NRC sponsored Palisades Pressurized Thermal Shock (PTS) Probabilistic Risk Assessment (PRA) letter report.

Medium Large and Large Break Initiating Event Calculations - Reference I Medium Large Break LOCA The MLBLOCA has a range of 0.20 ft2 to 1.8 ft2, which includes the entire range for the large (0.20 ft2 to 0.50 ft2) and very large (0.50 ft2 to 1.0 ft2) categories and part of the very very large (1.0 ft2 to 3.0 ft2) category. The mean LOCA frequencies for the large and very large categories are: 3.3E-5/yr and 1.11 E-5/yr, respectively. The frequency function for the very very large category is 2.5E-9. The following equation is used to calculate the MLBLOCA frequency for Palisades:

MLBLOCA Freq = (3.3E-5/yr) + (1.1 1 E-5/yr) + (1.8 ft2 - 1.0 ft2) x (2.5E-9/yr/ft2)

= (3.3E-5/yr) + (1.1 1 E-5/yr) + (0.8 ft2) x (2.5E-9/yr/ft2)

= (3.3E-5/yr) + (1.1 1 E-5/yr) + (2.OE-9/yr)

= 4.4E-5/yr The Palisades availability factor used in the PSA (Ref 2.3) is 0.78. The MLBLOCA initiating event frequency based on a calendar year is 4.4E-5/yr x 0.78 = 3.43E-5/yr.

EFACT/OBSERVATION' REGARDING PSA-.'-'t;

.:-TECHNICAL ELEMENTS.

OBSERVATION (ID: IE-07)

/ Element IE

/ Subelement IE-10 Large Break LOCA The LBLOCA includes sizes greater than 1.8 ft2, which includes part of the very very large category (1.0 ft2 to 3.0 ft2) and all of the near DEGB category (>3.0 ft2). The frequency function for the very very large category is 2.5E-9. The mean LOCA frequency for the near DEGB category is 5.OE-10/yr. The following equation is used to calculate the LBLOCA frequency for Palisades:

LBLOCA Freq = (3.0 ft2 - 1.8 ft2) x (2.5E-9/yr/ft2) + (5.OE-1 0Qyr)

= (1.2 ft2) x (2.5E-9/yr/ft2) + (5.OE-10/yr)

- = (3.0E-9/yr) + (5.0E-1 0/yr)

= 3.5E-9/yr This initiating event frequency was considered too low and inconsistent with the other LOCA frequencies (see the Medium Large event development above). A I E-5/yr LBLOCA initiating event frequency was used in the PSA. This was determined to be the same order of magnitude and more consistent with the other LOCA frequencies calculated in the Reference 1 EA.

The Palisades availability factor used in the Reference 1 calculation was 0.78. The LBLOCA initiating event frequency based on a calendar year was calculated to be 1.OE-5/yr x 0.78 =

7.80E-6/yr.

Conclusions Regarding the Reference 1 Analysis The Reference 1 analysis correctly assessed that the Reference 3 owners group methodology regarding large break LOCAs was inconsistent with the other calculated frequencies.

Furthermore, it is considered that the Reference 1 analysis correctly and conservatively selected a frequency of 1 E-05 /yr for large break LOCAs. This observation is corroborated by the recently released NRR sponsored Pressurized Thermal Shock evaluation for Palisades discussed in the following.

NRR Sponsored "Palisades Pressurized Thermal Shock (PTS) Probabilistic Risk Assessment (PRA) Letter Report - Reference 2 The draft NUREG-xxxx, Technical Basis for Revision of the Pressurized Thermal Shock (PTS)

Screening Criteria in the PTS Rule (10CFR50.61): Summary Report, is the main report documenting the latest work in characterizing the understanding of PTS risk for the following plants: Oconee 1, Beaver Valley 1, and Palisades.

FTACTIOBSERVATION'.REGARDINGRPSA.-':-',Sr TECHNICAL ELEMENTS.

OBSERVATION (ID: IE-07)

/ Element 1E I Subelement IE-10 Reference 2 is a draft letter report issued October 6, 2004. This letter report, a companion to NUREG-xxxx, summarizes the probabilistic risk assessment (PRA) work (only) performed for the Palisades analysis. It does not address the thermal hydraulic or probabilistic fracture.

mechanics portions of the Palisades study. Other companion reports address these other aspects as well as the other plants.

During the Palisades study, a separate effort was underway at the NRC to review and revise the LOCA frequencies from NUREG/CR-5750 for use particularly in work associated with 1 OCFR50.46 but with applicability for other risk-informed applications such as the PTS project.

There was a concern that the LOCA frequencies in NUREG/CR-5750 did not account for age-related factors important to deriving the frequencies and an expert elicitation effort at NRC was conducted to account for these adjustments.

The results from that elicitation were not entirely appropriate for use in the Palisades PTS study because the elicitation structure and results involved both piping and non-piping causes for the various size breaches. To fit the Palisades specific application, just the piping contribution was required. Since the elicitation had not been formatted in a way to decompose the two parts, it was not possible to directly discern the appropriate frequencies to use in this evaluation. Hence discussions were held between the Reference 2 NRC contractors and the NRC 'elicitation' subject matter experts. It was concluded, based on these discussions, that the Palisades plant specific initiating event frequencies were nearly the same as that developed in the elicitation effort. Therefore no change was made to the Palisades values.

Table 3.9: Comparison of LOCA, SGTR and SLB initiating events to NUREG/CR-15750.

Initiating Event NUREG/CR-5750 Palisades Factor Frequency Frequency Very Small LOCA 6.20E-03 1.90E-03 0.3 Small LOCA 5.OOE-04 1.90E-03 3.8 Med/Med-Lg 4.OOE-05 5.70E-05 1.4 LOCA Large LOCA 5.00E-06 6.50E-06 1.3 SGTR.

7.OOE-03 2.50E-03 0.36 SLB Outside Cont 1.OOE-02 3.60E-03 0.36 SLB Inside Cont 1.00E-03 4.1OE-04 0.41 Note the Palisades data represent the evaluated hot-full power condition. Therefore the frequencies are slightly different from that used in the plants baseline core damage model.

FACT/OBSERVATION REGARDING, PSA ;

TECHNIC-AL ELEMENTS OBSERVATION (ID: IE-07)

/ Element IE

/ Subelement IE-10 Conclusions Regarding the Reference 2 Letter Report NRC's subject matter experts concluded that (for the PTS initiative),

".... the Palisades plant specific initiating event frequencies were nearly the same as that developed in the elicitation effort. Therefore no change was made to the Palisades values."

The Palisades large break LOCA frequency is conservatively greater than the Reference 2 NUREG/CR-5750 comparison (Table 3.9).

CA017271 Conclusion The Reference 1 analysis provided a sufficient basis for the chosen Large Break LOCA IE frequency. Moreover, NRR's subject matter expert elicitation committee agreed that the chosen frequencies were acceptable.

No additional work is necessary regarding this issue.

References 1] EA-PSA-IE-00-0010, Calculation of Initiating Event Frequencies in Accordance with CEOG Standards, April 20, 2000.

2] D.W.Whitehead et.al, "Palisades Pressurized Thermal Shock (PTS) Probabilistic Risk Assessment (PRA)", Date Submitted: October 6, 2004.

3] CEOG PSAWG Technical Position Paper, Evaluation of the Initiating Event Frequency for the Loss of Coolant Accident, CEOG Task 941, January 1997.

' ';' FACT/OBSERVATION REGARDING PSA TECHN AL ELEMENTS OBSERVATION (ID: IE-08)

/ Element IE I Subelement IE-16, IE-17. IE-

18. IE-19 The frequencies for LOOP were not formally documented. The values themselves did look reasonable.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Per Palisades PRA staff, documentation will occur.

PLANT RESPONSE OR RESOLUTION CA01 7272 Analysis completed per PA-02-001-01L and EA-PSA-LOSDC-03-13 rO

.1 FACT/OBSERVATION',REGARDING.PSA

-.i',TECHNICAL ELEMENTS; OBSERVATION (ID: IE-09)

/ Element IE I Subelement IE-19 The PSA documents are covered by Administrative Procedure 9.11. This procedure requires sign-off of Engineering Analyses by the initiator, the technical reviewer and an approver. This is the procedure applied to all engineering calculations. Not all of the PSA calculation documents have been completed and thus do not have the appropriate signatures in place. The completed calculations reviewed did have the signatures LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Complete calculations and get required signatures PLANT RESPONSE OR RESOLUTION CA017273 - Due 8/30/05

'FACT/OBSERVATION REGARDING:'PSA

!,-TECHNICA -ELEMENTS....:,.-_

OBSERVATION (ID: L2-02)-

-/--Element -L2 I -Subelement L2-7 The level 2 and LERF analyses are still in the process of being updated to incorporate the results-of the RIA version of-the level 1-analyses.-The review-ofthese-elements was based on the IPE report models and the draft report EA-PSA-LERF-99-0020, RO LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Complete EA-PSA-LERF-99-0020, RO--

PLANT RESPONSE OR RESOLUTION CA01 7274 EA-PSA-LERF-99-0020, RO has been completed. Independent Tech reviews were peformed by Applied Reliability Engineering and ERIN engineering.

i FACTIOBSERVATION REGARDING PSA TECHNICAL ELEMENTS';

OBSERVATION (ID: L2-03 )

/ Element L2 I Subelement L2-12, L2-25 The IPE level 2 analyses included four recovery actions and one operator action specific to the level 2 analyses. For the IPE quantification of the level 2 analyses, these actions were conservatively set to guaranteed failure. We were told that in the update, more realistic values that reflected the SAMGs were being established. There was no documentation on the values that are being used or their bases.

EA-PSA-LERF-99-0020, RD (draft) points to the IPE for most specific values which implies that the original values are being used.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Document the values used for the level 2 operator actions and the basis for selecting these values. This could be included in EA-PSA-LERF-99-0020 or in the HRA document with suitable references in EA-PSA-LERF-99-0020, RO.

PLANT RESPONSE OR RESOLUTION CA017275 As noted the values used in the IPE for the four recovery actions and one operator action were set to zero (failure). They were built into the model to perform sensitivity analysis and if justifiable allow for recovery of failed safety systems important to the level 2 analysis. Also as noted in the PEER review comment an update Engineering Analysis (EA-PSA-LERF-99-0020, RO (draft)) was examined and referenced the values used in the IPE. The EA was examined as part of this corrective action and confirmed that the values for the events in question had not been changed. The only implication of change was a discussion that implied that a change was being made but in fact the changes were not made. A more recent conversion of the Containment Event Tree (CET) to new software still uses zeroes for the probabilities of these events.

Should we choose to exercise the recovery/operator actions Human Error Probability calculations (HEPs) or other analysis to justify the values used would be created. Since there were no cases identified where values other than zero were used for the probabilities of these events no further action is required.

-1S K.t FACT/OBSERVATION REGARDING PSAr

-TECHNICAL ELEMENTS:- ;

OBSERVATION(ID:MU-02)

/ Element MU I Subelement MU-5 REI Guideline 01 indicates that plant data should be updated to the most recently completed year for a-major update.-The procedure should-address-update of data for minor updates and for major updates that are required sooner that 2 fuel cycles.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above.

PLANT RESPONSE OR RESOLUTION CA01 7276 Issue addressed in release of RIE Guideline 01 on 11/14/2003.

-'.-.>i^;e"FACT/OBSERVATION':REGARD'ING PSAir't,'i j'i TEC NIC L-AL ELEMENTS' '

OBSERVATION (ID: MU-04 I Element -MU I Subelement MU-8, MU-11 MU-12 Section 5.3.3 of REI Guideline 01 describes the reviewer responsibilities. These responsibilities do include identifying past PSA based applications that may be impacted by a model issue or enhancement, evaluating the impact, and resolving the issue. This section specifically applies to model issues or enhancements.

It does not address review of general PSA model changes (major or minor) for potential impacts on past PSA applications nor does it require the past applications affected by the update be re-performed. REI Guideline 01 should be expanded to incorporate a section addressing review and update of past applications following a model update.

The Guidelines do not identify that the EOOS models should be updated at the conclusion of the PSA update. This should be specifically incorporated in the Guideline.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above for REI Guideline 01 recommendations Also, the PSA applications should be reviewed with respect to the impact of the Rev la model changes.

PLANT RESPONSE OR RESOLUTION CA017277 Sections 5.2.5 and 7.0 were added to the Risk Informed Engineering Guideline RIE-01, revision 5, Control of Plant PSA model. Section 5.2.5 adds requirements to evaluate the impact of changes made in a major update to previously developed risk informed applications. Section 7.0 formally incorporates requirements to create an update of the EOOS cutset file that is based on the completion of a major model update. No further action is required.

AdizK

. F-';AC TVOBSERVATIQN REGARDINGPSA' TECH NICA ELEMENTS.

OBSERVATION (ID: MU-05)

/ Element MU I Subelement MU-10 REI Guideline 01 does not specifically call for the review of the results of the update by

-a knowledgeable person prior to-using -the results. However,-the-updates and associated documentation are specifically covered by Admin procedure 9.11 which does require technical review. The guideline should specifically call for review of the cutset results as minimum LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Update RE[ Guideline 01 to specifically require review of results by knowledgeable PSA person prior to use.

PLANT RESPONSE OR RESOLUTION CA01 7278 Issue addressed in release of RIE Guideline 01 on November 14, 2003.

FACT/OBSERVATION REGARDING PSA TEC HNIAL ELEMENTSi OBSERVATION (ID: MU-06)

/ Element MU I Subelement MU-09 REI Guideline 01 specifies a major PSA update every two fuel cycles but minor updates are at the discretion of the PSA supervisor. The Guidelines should set some specific criteria to trigger a minor update. The criteria should be related to potential risk impact or insights impacts. Likewise there should be criteria to trigger a major update if needed sooner than once every 2 cycle..

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above.

PLANT RESPONSE OR RESOLUTION CA01 7279 Issue addressed per release of Risk Informed Guideline RIE Guideline 01 rev 1 on 11/14/2003.

ACT/OBSERVATIONl REGARDING PSAIOt TECHNICAL E LEMENTS a

OBSERVATION (ID: (MU-07)

/ Element MU I Subelement MU-13 Palisades has not implemented a CRMP yet. The CRMP is not addressed in REI-01, Rd (draft). The CRMP needs to be specifically addressed in REI-01 LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION See above PLANT RESPONSE OR RESOLUTION CA01 7280 Section 6.0 Configuration Risk Management Program (CRMP) was incorporated into Risk Informed Engineering Guideline RIE-01, Control of Plant PSA model. This section identifies how CRMP is currently performed at Palisades and the plant procedures that direct activities that implement CRMP at the site are identified and included in the reference section of the procedure. No further action is required.

' FACT/OBSERVATION' REGARDING' SA

'7TECHNICAL ELEMENTS. 1'-

OBSERVATION (ID: QU-01)

/ Element QU I Subelement QU-1 The electronic documents identify the code files used for sets solution, others identify the Definitions and Basis for Event Tree Top Headings for quantifying the model with SAPHIRE, but no single document provides clear instruction for the quantification process.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Produce a quantification procedure identifying where files are maintained, how they are developed, and how they are used to quantify the model.

PLANT RESPONSE OR RESOLUTION CAO1 7281 Palisades documents the files used in developing and quantifying the PSA logic models according to Admin 9.11. In addition the Risk Informed Engineering Quantification Notebook has been developed.

FACT/OBSERVATION REGARD'ING PSA

-rTECHNICAL 'ELEMENTS4:

OBSERVATION (ID: QU-02)

/ Element QU I Subelement QU-10 A number of cutsets contain multiple human actions. Some combinations may have truncated but contain dependent recoveries that can combine to large recovery rates.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Complete review for dependent recoveries as was performed for the IPE.

PLANT RESPONSE OR RESOLUTION CAO1 7282 The analysis has received an owners review and approval under EA-PSA-2001-015 Revision 0. The HRA process including the initiators is described in the vendor document. The dependencies are address by EA-PSA-HRA-DEP-01-33.

-FACT/OBSERVATION -REGARDINGPS'A TECHNICAL ELEMENTS OBSERVATION (ID: QU-04)

/ Element QU

/ Subelement QU-24 The basis for the selection of the mutually exclusive events is not documented.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Document the mutually exclusive events file and the basis for selection of the mutually exclusive events.

PLANT RESPONSE OR RESOLUTION CA01 7283 Per CEOG PSA peer review comment PEER-2000 QU-04, the basis for the selection of the mutually exclusive events is not documented.

The Reference 1 PSA model project SAPHIRE (Reference 2) recovery rules file

'PSAR1 B-M-WEQ.FAY' is repeated in Table 1 below. The basis for the mutually exclusive event assignment is provided in the table.

The general format of a SAPHIRE mutually exclusive rule is; if (A-PMOO-P-8A

• A-PMOO-P-8C) then DeleteRoot; For further information regarding logical and illogical event modeling refer to Reference 3.

.v.Sv-"a.FACT/OBSEr..FC./OSRVA-TION'.REGARDING PSA :'r.;..'t '*>.

TECHNICAL-ELEMENTS"'

OBSERVATION (ID: QU-04)

IElement QU ISubelement QU-24

_4 Table 1 Mutually Excluded Events' Basis for Exclusion';

/DG-REC-2HR

• E-DGME-K-6A Event /DG-REC-2HR (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) represents successful EDG

/DG-REC-2HR

• E-DGME-K-6B repair. Events E-DGME/MG/OO-K-6A(B) represent failure f

/DG-REC-2HR

• E-DGMG-K-6A the EDG to-start, or to-run or that the EDG remains out-of-IDG-REC-2HR

• E-DGMG-K-6B service. It is illogical to state the EDG has been repaired a d DG-REC-2HR *E-DGOO-K-6A that the EDG remains unavailable in the same cutset.

/DG-REC-2HR

• E-DGOO-K-6B

/DG-REC-2HR

• REC-2HR The event /DG-REC-2HR (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) represents successful DG

/DG-REC-2HR

• REC-4HR repair. Event REC-2HR(4HR) represents successful offsite power recovery. It is illogical to state that recovery' worked nd then subsequently failed.

/DG-REC-4HR

• E-DGME-K-6A Event /DG-REC-4HR (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) represents successful EDG

/DG-REC4HR

• E-DGME-K-6B repair. Events E-DGME/MG/OO-K-6A(B) represent failure f

/DG-REC-4HR

• E-DGMG-K-6A the EDG to-start, or to-run or that the EDG remains out-of-

/DG-REC-4HR

• E-DGMG-K-6B service. It is illogical to state the EDG has been repaired a d

/DG-REC-4HR

• E-DGOO-K-6A that the EDG remains unavailable in the same cutset.

/DG-REC4HR

• E-DGOO-K-6B

,3_

/DG-REC-4HR

• REC-4HR The event /DG-REC-4HR (4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) represents successful DG repair. Event REC-4HR represents successful offsite powe recovery. It is illogical to state that recovery worked and th n subsequently failed.

A-PMOO-P-8A

• A-PMOO-P-8B These events state that P-8A and P-8B or P-8A and P-8C c p A-PMOO-P-8A

• A-PMOO-P-8C 8B and P-8C are simultaneously out-of-service. Not allowe per A-PMOO-P-8B

• A-PMOO-P-8C Tech Specs.

E-DGOO-K-6A

• E-DGOO-K-6B These events state that EDG1-1 and EDG1-2 are simultaneously out-of-service. Not allowed per Tech Specs H-PMOO-P-66A

• H-PMOO-P-66B These events state that P-66A and P-66B are simultaneou y out-of-service. Not allowed per Tech Specs.

X-HSE-2SG-BLDN

• X-HSE-2SG-BLDN-A These events represent multiple combinations of seconda side X-HSE-2SG-BLDN

• X-HSE-2SG-BLDN-B excess steam demand events. Multiple combinations are X-HSE-2SG-BLDN

• X-HSE-SGA-BLDN illogical. Only one excess steam demand event can occur er X-HSE-2SG-BLDN

• X-HSE-SGB-BLDN cutset combination. Note that these combinations were X-HSE-2SG-BLDN-A

• X-HSE-2SG-BLDN-B purposely modeled as concurrent events in order to simplif the X-HSE-2SG-BLDN-A

• X-HSE-SGA-BLDN fault tree construction. It is simpler to remove illogical combinations after the fact than to try and anticipate the X-HSE-2SG-BLDN-A

• X-HSE-SGB-BLDN precursor combinations.

X-HSE-2SG-BLDN-B

• X-HSE-SGA-BLDN X-HSE-2SG-BLDN-B

• X-HSE-SGB-BLDN X-HSE-SGA-BLDN

• X-HSE-SGB-BLDN

r FACT/OBSERVATION REGARDING-iPSA T-ECHNICAL ELEMENTS OBSERVATION (ID: QU-04)

/ Element QU I Subelement QU-24

'cutset - minimum combination of a set of events that, if they occur, will result in an undesired event such as the failure of a system or the failure of a safety function.

References:

1]

EA-PSA-CCW-HELB-02-17, "Evaluation of the Impact of a High Energy Line Break in CCW Room with either Dopr 167 to 590 Corridor Auxiliary Building or 167B to the West Engineered Safeguards Room Open", September 2002.

2]

INEEL, "Systems Analysis Programs for Hands-on Integrated Reliability Evaluations - SAPHIRE", v7.21.

3]

NUREG/CR-2300 volume 1, "PRA Procedures Guide", January 1983 (R0834).

FACTIOBSERVATION REGARDING PSA TECHNICAL ELEMENTS OBSERVATION (ID: QU-06)

/ Element QU I Subelement QU-26 An uncertainty assessment has not been performed. This assessment should evaluate model sensitivity to assumptions made that inherently contain a relatively large amount of uncertainty. Specific examples of typically sensitive events include human recovery actions and common cause events.

LEVEL OF SIGNIFICANCE B.

Uncertainty analyses are important tools in developing insights from the quantification results.

POSSIBLE RESOLUTION Develop guidance for performing uncertainty analyses followed by the performance of the analyses with appropriate documentation of each analysis.

PLANT RESPONSE OR RESOLUTION CA01 7284 PA-03-004-1, "Parameteric Uncertainty Analysis for the Palisades Level 1 Internal Events".

The objective of the completed PA-03-004-1 engineering calculation was to perform an uncertainty analysis Palisades PSA core damage frequency. Distributions were assigned to each basic event in the latest Palisades CDF model. Also, basic events that were related (i.e., similar component types and failure modes, operator actions, etc) were correlated. The core damage sequences were quantified yielding a mean core damage frequency and an uncertainty distribution. Sensitivity studies were performed to determine which basic events drive the results of the uncertainty analysis.

This parametric uncertainty study reinforced the conclusions of the Level 1 internal events analysis. Dominant accident sequence types were station blackout and small LOCA with failure of recirculation. Important basic events in terms of their contribution to the total uncertainty associated with the core damage frequency were also found to be associated with these two accident sequence types. Dominant human actions were similar to those that are important to the Level 1 internal events analysis.

.1 ii;'

FACT/OBSERVATION REGARDING PSA;:

TEH IC AL" ELEMENTS OBSERVATION (ID: ST-01)

/ Element ST I Subelement ST-4 Palisades does not include reactor vessel rupture as a placeholder initiating event nor do they address it in any write-up. This is not consistent with the CEOG standard (CE NPSD-1072-P, Volume II, Tab 9). Reactor vessel rupture is very low frequency so this does not significantly affect CDF or risk insights. Furthermore, Palisades is performing a PTS analysis. When this analysis is complete, it will meet/exceed the expectations with respect to addressing the reactor vessel capability.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Complete PTS analysis.

PLANT RESPONSE OR RESOLUTION CA01 7285 Completing the PTS analysis as recommended by the PEER review comment above, is obviously the goal of this joint NRC/Industry effort. However, the scheduled completion of the

• technical work,

• incorporation of review comments, and

• the promulgation of a rule change is beyond the authority and resources of the Palisades plant staff. However, the following discussion provides the background and the latest available set of results.

Pressurized Thermal Shock (PTS) Backqround One of the potentially most significant challenges to the structural integrity of the reactor pressure vessel (RPV) in a pressurized water reactor (PWR) is posed by a pressurized thermal shock (PTS) event wherein severe cooling of the core occurs together with, or followed by, pressurization. Several operational sequences can thermally shock the vessel (either with or without significant internal pressure); these include a break of the main steam line, secondary depressurization through a relief valve, a loss of coolant accident (LOCA), or extended injection of high-pressure water to name just a few. During these events, water level in the primary system is restored since it will have dropped due to contraction resulting from overcooling, and in cases involving a primary system breach (e.g., a LOCA) additional water level drop

--,FACT/OBSERVATIQON'REGARDING "PSA-TECHNICALELEMENTS.

OBSERVATION (ID: ST-01

/ Element ST I Subelement ST-4 occurs due to leakage from the primary. The water added is much colder water than that present in the reactor coolant system (PCS). The temperature differential between the nominally ambient temperature emergency coolant water and the operating temperature of a pressurized water reactor (OT = 5500F - 600F = 4900F) produces significant thermal stresses in the thick section steel wall of the RPV. These stresses could be high enough to initiate a running cleavage crack, a crack that could propagate all the way through the vessel.

In the early 1980s the nuclear industry and the Nuclear Regulatory Commission (NRC) staff performed a number of investigations aimed at assessing the risk of vessel failure posed by PTS, and on establishing the limits needed to reduce failures caused by PTS transients to a' tolerable level. These efforts led to the publication by the Staff of a document [SECY-82-465]

that provided the -technical basis for-subsequent development of what has come to be known as the "PTS Rule" [10CFR50.61].

As PWRs approach the end of their original 40-year operating licenses, and consider requesting a 20-year license extension, compliance with the PTS Rule [10CFR50.61] can become a factor that limits the operational life of the plant. Addressing this issue on a plant-specific basis has consumed considerable resources within both the regulatory and operational communities.

Additionally, it is now widely recognized that state of knowledge and data limitations in the early 1980's necessitated a conservative treatment of several key parameters and models used in the probabilistic calculations that provide the technical basis [SECY-82-465] of the current PTS rule.

[1 OCFR50.61].

The cost associated with demonstrating and checking compliance with the current PTS screening criteria, the conservatisms known to underlie the screening criteria, and the considerable technical advancements that have occurred in the 20 years since the technical basis for the PTS Rule was established all combined to motivate the NRC Office of Nuclear Regulatory Research to undertake a project aimed at developing the technical basis to support a fundamental revision of the PTS rule and the associated PTS risk and screening criteria.

Overview of the Technical Approach This new project makes use of three specific analytical models (shown in Figure 1) that, together, allow an estimate of the yearly through-wall crack frequency (TWCF) in a RPV. First a Probabilistic Risk Assessment (PRA) event-tree analysis is performed to define both the sequences of events that are likely to produce a PTS challenge to RPV integrity and to define the frequency with which such sequences can be expected to occur. The sequence definitions are then passed to a thermal-hydraulic (TH) model that estimates the temporal variation of temperature, pressure, and heat-transfer coefficient in the RPV down-comer characteristic of each of the sequence definitions. These pressure, temperature, and heat transfer coefficient histories are passed to a selected probabilistic fracture mechanics (PFM) model. The PFM model uses the thermal hydraulics output along with other information concerning plant design and materials of construction to estimate the time variation of the driving force to fracture produced by a particular sequence of events. The PFM model compares this estimate of fracture driving force to the fracture toughness, or fracture resistance, of the RPV steel. This

l FACT/OBSERVATIONREGA NG PSA" TECHNICAL ELEMENTS PSA OBSERVATION (ID: ST-01)

/ Element ST

/ Subelement ST-4 comparison allows us to estimate the probability that a particular sequence of events will produce a crack all the way through the reactor pressure vessel wall were that sequence of events to actually occur. The final step in the analysis involves a simple matrix multiplication of these probabilities of through-wall cracking (from the PFM analysis) with the frequency at which a particular event sequence is expected to occur (as defined by the PRA event-tree analysis).

This multiplication establishes an estimate of the yearly frequency of through wall cracking (i.e.,

TWCF) that can be expected for a particular plant after a particular period of operation.

-}FACT/OBSERVATION REGARDING.PSAi TECHNICAL ELEMENT OBSERVATION (ID: SY-Ol-) ---/ -Element SY-1/-Subelement SY-I,-SY-3 No process has been documented for how to perform a system analysis for purposes of fault-tree modeling.-Thus, reproducing a-fault tree-model would-be difficult. -This F&O also applies to subelement SY-3.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Write guideline for performing system analyses.--

PLANT RESPONSE OR RESOLUTION CA01 7286 RIE Guideine 02, "End Event Identifiers" was revised. Revision 2 is now titled "System Fault Tree Development and Analysis". The procedure now includes fault tree development guidelines and documentation requirements. End Event identification is a subset of the process and was retained as an attachment to the procedure.

'FACTIOBSERVATION REGARDING.'PSA Ws TECHNICAL.ELE ENTSX OBSERVATION (ID: SY-02)

/ Element SY I Subelement SY-4, SY-12.

SY-17, SY-18 AFW Flow Control - Instrument Air Dependency Instrument Air and power dependencies are not modeled as a support to the AFW flow control valves. Although the control valves fail open ensuring the minimum flow requirement is met, the impact of excessive flow is not addressed..

The flow control valves associated with AFW Pumps A (motor) and B (steam) are normally supplied by non-safety grade instrument air and backed by a nitrogen station.

The nitrogen station for the AFW flow control valves have a design capacity of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and a tested capacity of 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Flow control valves for AFW Pump C (motor) are.

supplied by non-safety-grade instrument air. These valves do not have nitrogen back-up.

The failure of air to these valves will result in the valves failing to the full open state causing the potential overfilling pnd/or overcooling of the S/Gs. Since the AFW Pumps are started in a preset order, Pump A, C, then B, it appears that the first pump it is less likely to be impacted since it has nitrogen backed air. However, the second pump, Pump C, does not have nitrogen backed-up flow control valves and will more likely impacted. This would result in weakening the benefit of Pump C.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Appropriately model AFW flow control air dependency. This should include the failure of the boundary check valves between the instrument air system and the nitrogen station.

PLANT RESPONSE OR RESOLUTION CA01 7287 Analyses (Reference 1) were performed to evaluate the impact of Auxiliary Feedwater Steam/ Generator (AFW S/G) injection flow control valves failing in the full open position.

.-FACTIOBSERVATION REGARDING'-PSA -,,.....

TECHNICAL ELEMENTS

The overall Core Damage Frequency (CDF) increased by about 1% when pneumatic dependencies were included as additional failure modes of the AFW turbine-driven pump P-8B3.- -sepected,-most oFthfeincrease in CDFis due to Sta-tion Blakout sequences. This small increase is attributed to the fact that both Flow Control Valves (FCVs) CV-0727 and CV-0749 on the discharge of the turbine-driven pump are backed up by a separate nitrogen supply. In the event the nitrogen supply fails, the operators would have more than an hour to locally operate the valves.

Per review of the latest draft analysis in support of the revision of the Pressurized Thermal Shock (PTS) Screening Criteria in the PTS Rule (10CFR50.61), the conditional likelihood of a secondary side transient resulting in a Through Wall Vessel Crack (TWCF) is less than 4% (assuming 60 Effective Full Power Years).

These transients include sequences such as:

- Reactor trip with I stuck-open Atmospheric Dump Valve (ADV) on SG-A.

- Turbine/reactor trip with 2 stuck-open ADVs on SG-A combined with controller failure resulting in the flow from two AFW pumps into affected steam generator.

- Turbine/reactor trip with 1 stuck-open ADV on SG-A. Failure of both main steam isolation valves (SG-A and SG-B) to close.

Because the annual likelihood of a TWCF due to LOCA's and primary coolant system transients (the dominant scenarios) is less than 1 E-08, the consequential failure of overfillingfovercooling the steam generators from failed open AFW FCVs and resulting in a PTS event, is considered negligible.

References:

[1] PSzetu, "Evaluation of Instrument Air Dependency for AFW valves", Applied Reliability Engineering Inc., Document No: PA-03-007-5.doc.

• -



I>.-.,.

FACT/OBSERVATIONi REGARD)IN PSA 3

T*ECHNICAL ELEMENTS A

OBSERVATION (ID: SY-03)

/ Element SY I Subelement SY-4 AFW Flow Control - Operator Action The response operator action of controlling AFW flow is not included the Palisades PSA. This should be evaluated in conjunction with the s~tatus of instrument air and control power dependencies. Note instrument air and power dependencies for these flow control valves were not modeled.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Add the appropriate flow control operator actions.

PLANT RESPONSE OR RESOLUTION CA01 7288 AFW Flow Control - Operator Action The response operator action of controlling AFW flow is not included the Palisades PSA. This should be evaluated in conjunction with the status of instrument air and control power dependencies. Note instrument air and power dependencies for these flow control valves were not modeled.

An Operator Action A-AVOA-THROTTLE-FCV was added to the PSA model. This event was developed as part of the evaluation of the effects of the loss of instrument air to the AFW flow control valves (PA-03-007-5, Evaluation of Instrument air Dependency for AFW valves, by Applied Reliability Engineering Inc. The evaluation is also documented in CA01 7287 Level B Peer Review Comments for the Palisades PSA. As noted in that CA the only impact of the AFW flow control valves failing full open on loss of air is a mild overcooling of the PCS (vessel) which prior and current PTS analysis indicate is not enough to be a significant contributor to Pressurized Thermal Shock and therefore not a significant contributor to core damage.

Addition of the operator action to the model resolves the Peer Review Comment. No further action is required.

FACTIOBSERVATION REGARDING PSA.

a-,': '

-;TECHNICAL ELEMENTS OBSERVATION(ID: SY-04)

/ Element SY I Subelement SY-4, SY-12 SY-17, SY-18, SY-19 HVAC The failure of Control Room and Cable Spreading Room HVAC is not modeled in the Palisades' PSA. DBD 1.06 Rev 4 indicates that following the loss of service water, the CR's temperature will reach 11 OF within 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Under SBO conditions, it is shown to reach 120F within 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. It also shows that the CSR will reach 104F in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

Engineering Analysis EA-APR-95-023 also states that the control room and cable spreading room require room cooling. This same analysis also shows that the switchgear rooms do not require HVAC.

The CSR HVAC system appears to have only a single fan, V33, to provide cooling.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Appropriately address Control Room and Cable Spreading R HVAC.

PLANT RESPONSE OR RESOLUTION CA017289 The following discusses the cable spreading room HVAC considerations:

First the FSAR is cited for the present cable spreading room design basis information, Next the EA-APR-95-023 rev.1 design basis case results are reviewed, This is followed by a summary of the EA-APR-95-023 rev.1 nominal test results, and Why the Phase II Tests are considered the more appropriate calculation for the Palisades PSA Model is presented.

FSAR Chapter 9, rv 24 The FSAR summarizes the EA-APR-95-023 rev.1 Design Basis analysis as follows:

.:.,,~FACT/OBSERVATION REGARDING:PSA__..I.,'

TECHNICALELEMENTS "Ventilation tests were conducted in July and August of 1982 to investigate loss of offsite power to the ventilation fans. These were reported in a November 1, 1982 letter to the NRC.

The ventilation tests showed that certain equipment in the cable spreading room cannot withstand a loss of normal ventilation for an indefinite period of time. Upon loss of normal ventilation, the operator has sufficient time, however (up to six hours), to take action to ensure that the room's design temperature of 1040F is not exceeded."

EA-APR-95-023 rev 1 Reference 1 (Design Basis Results)

This EA evaluated room heat-up after loss of ventilation under Appendix R scenario in the control room (325), cable spreading room (224), 1 C switchgear room (116A), 1 D switchgear room (223) battery rooms (225, 225A), containment area and the diesel generator rooms (116, 116B).

As a reminder from the FSAR, the cable spreading room cooling must be established within approximately 5.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> to maintain the temperature below the design temperature of 1040 F. The Reference 1 analysis model that generated this result, assumed only the four walls, floor and ceiling as heat sinks. Furthermore to generate the worst-case results, the initial air temperature in the cable spreading room and exterior heat sinks (excluding the 1 -C switchgear room and the 116 and 11 6B diesel generator rooms which were assumed to initially be at their maximum design temperatures) was taken to be at the assumed worst-case ambient air temperature of 95F. This was the worst recorded on site temperature measured during the years 1976 through 1982.

EA-APR-95-023 rev 1 Reference 1 (Nominal Analytical Results)

As noted above, in response to SEP Topic IX-5, Palisades verified by test that the cable spreading room would not heat up excessively due to loss of ventilation fans. The Phase II test showed that the cable spreading room temperature increased by approximately 7F and reached equilibrium in about six hours following the loss of room ventilation. The initial measured starting temperature was 90F. Hence the final measured equilibrium temperature of 97F was below the cable spreading room design value of 104F. Note, the results of this test were only used to estimate the heat load that was subsequently employed in the above design basis calculation.

Why The Phase II Tests are Considered the More Appropriate Calculation for the Palisades PSA Model There are several reasons why the Phase II tests are the more appropriate set of results that should be considered.

-.'FACT/OBSERVATION'-'REGARDING :PSA..

'TECHNICAL ELEMENTS"'

Heat Sinks First and foremost, the cable spreading room design basis calculation is modeled in a very conservativemannei r with respect t6heatsiiiks:

The walls, ceiling and floor are modeled as solid concrete, which provides for limited heat transfer to adjacent rooms. Two steel doors are associated with the cable spreading room,: one to the turbine building hallway, which is well ventilated, and one to the 1 D switchgear room. These doors are not leak tight.

There is ductwork passing through-the cable spreading room. The ductwork travels from a fan room adjacent to the turbine building hallway to the 1 D switchgear room and on into the electrical equipment room. While there are fire dampers in the ductwork, the metal construction of the ductwork allows for heat transfer into adjacent rooms (i.e., convective heat transfer via leakage).

Again as a reminder from above, a steel door connects the cable spreading room and the turbine-building hallway. The hallway is well ventilated from the outside and is not likely to heat up. Consequently, a significant amount of heat can be removed from the cable spreading room to the hallway.

Once more, a steel door, as well as some ductwork, connects the cable spreading room to the 1 D switchgear room. While the 1 D switchgear room is not well ventilated, it has better heat removal mechanisms than what the Reference 1 analysis considers. First, it is connected to the electrical equipment room by a steel door and ductwork, permitting some heat transfer.

The electrical equipment room is not well ventilated, but it is connected to the outside by a large armored door, permitting heat transfer and it is relatively cold with respect to the other rooms. The 1 D switchgear room is connected to the north penetration room by a large opening in its ceiling, permitting a significant chimney effect. A steel door to another room that is connected to the outside by a steel door connects the north penetration room. The heat removal mechanisms for the I D switchgear room that are not modeled provide a cooler boundary condition for the cable spreading room, resulting in more heat loss from the cable spreading room.

In summary, there is significant ability for the cable spreading room to reject heat to surrounding rooms that is not modeled. This fact is simply borne out from the Phase 11 test results in that the room reached equilibrium (97F) while experiencing only a 7F temperature rise. Furthermore, this underscores the importance of heat sinks that are often very conservatively neglected in these types of analyses (as is the case in the Reference 1 evaluation).

.FACT/OBSERVATIONAREGARDING PSA TECHNICAL ELEMENTS:

Initial Temperature As discussed earlier, to generate the worst-case results, the initial air temperature in the cable spreading room and exterior heat sinks was taken to be at the assumed worst-case ambient air temperature of 95F. This was the worst recorded on site temperature measured during the summer months from 1976 through 1982.

A cornerstone premise in any risk analysis is the use of nominal conditions. As a result the Palisades meteorological temperature data (Reference 2) was evaluated. This information is recorded hourly per day for 365 days a year. The years 1999 through 2003 were investigated. The following table summarizes the recorded ambient temperature readings:

11999 1 2000 20011 2002_

2003_

Peak Measured Temperature, F 96.3 87.3 88.7 91.8 91.9 Average Temperature, F 50.6 49.2 50.3 50.2 48.2 Median Temperature, F 51.4 51.3 50.9 46.3 48.6 Number of hours > 90F 10 0

0 5

2 Percent of time > 90F 0.11%

0.00% 0.00%/ 0.06%

0.02%

The data certainly demonstrates that assuming the cable spreading room is initially at 95F is conservative. Two of the evaluated 5-year periods did not record any temperatures in excess of 90F. Moreover, the hottest year 1999 recorded only 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> of temperatures that exceeded 90F (about 0.1 % of the total). Furthermore, only 3.4% of the hourly temperature measurements from 1999 ranged between 80 to 90F. Therefore it is clear from a risk perspective that any HVAC analysis should employ an initial room temperature well less than that considered in the Reference 1 Attachment 6.5.A (Nominal Analytical Results) of 90F.

Note, even though the 1999 peak temperature of 96.3F is I.3F greater than that assumed in the Reference 1 design basis analysis, the design basis assumption of 95F remains valid due to the many inherent conservatisms in the calculation.

Conclusion (Cable Spreading Room)

Cable spreading room loss of HVAC during the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the Palisades PSA analysis is not a concern.

Disposition of CA017289 (Control Room HVAC)

The Reference 1 analysis of the control room temperature without HVAC showed that the 11 OF (personnel habitability limit) would be reached in about 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and it would take approximately 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> for the temperature to reach the Technical Specification limit of 120F. At the end of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> the temperature is estimated to remain below 130F.

i'.':

f r-"'-;FACT/OBSERVATION 'REGARDING PSA TECNIALELEMENT Specific Component Temperature Limits As noted in Section 9.8 of the FSAR (Reference 3), the Thermal Margin Monitor (TMM) was originally qualified to 131'F. However, the location of the TMM in the panel is such that cooling is required. Analysis shows that, with forced air cooling, 131'F is reached by the TMM when the control room ambient temperature is 106'F. Because the TMM portion of the RPS is no longer capable of operating at the nominal control room design temperature of 1200F, a control room administrative limit of 900 F was imposed.

Other portions of the Reactor Protective System located in the control room were designed to operate up to 1350F and 90% relative humidity. Individual components and modules of the RPS have been factory tested at design temperature and humidity conditions. With the exception of the TMM, the RPS cabinet (including all portions of the system located in the control room) has been tested for operation as a system at temperatures in excess of 1350F.

Other electronic equipment used in plant safety related components can operate at 1200 F continuously and at 1400 F intermittently as proven by experience.

Industry Results when Considerinq Loss of HVAC A review of over 50 plants that are featured in the Westinghouse Owners Group PSA Model Methods and Result Comparison listed 14 plants that evaluated the impact of a Loss of HVAC. The average contribution to the internal events core damage frequency was about 1.61 E-07 per year (with a median value of approximately 1.31 E-07).

Plant Event CDF IE Frequency Diablo Canyon 5.81 E-07 2.56E-02 South Texas 3.58E-07 5.44E-02 Calvert Cliffs 1,2 1.60E-07 1.59E-03 Beaver Valley 1 1.49E-07 1.49E-07 Surry 1.31 E-07 5.86E-04 Vogtle 4.89E-08 9.09E-03 North Anna 7.35E-09 6.58E-03 ASCO 6.06E-09 5.87E-09 Palo Verde 1,2,3 5.15E-09 8.44E-03 Indian Point 3 1.03E-04 Indian Point 3 1.03E-04 Average 1.61 E-07 9.68E-03 Median 1.31 E-07 1.59E-03

K;IWJ'

.FAC-T/OBSERVATIONAREGARDING'PSA

'>i;'

TECHNICAL ELEMENTS.

Given an average HVAC contribution of 1.6E-07 and comparing to the present Palisades average core damage frequency of 6.24E-05, the effect of loss of HVAC on Palisades would be less than 0.5%.

ONP-25.2 (Reference 4)

This procedure addresses the inability to maintain contr6l of the plant from the Control Room. Implementation of this procedure may require Control Room evacuation.

However, per discussion with the operators in the event of a loss of HVAC, they would likely don ice vests and remain in the control room rather than shutdown the plant from the alternate shutdown panels.

As noted above, with the exception of the TMM, the operators would have access to the RPS instrumentation and controls for the 24 assumed mission of the PSA analysis. The aforementioned components have been proven to operate intermittently up to 140F.

The expected peak room temperature in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> would be less than 130F. It should be noted that the Reference 1 calculated temperature at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> includes many of the same model conservatisms as discussed above for the cable spreading room. That is, heat sinks were ignored.

Conclusion (Control Room)

Failure to model HVAC control room cooling in the Palisades PSA is not considered an issue:

Because of the high design temperature limits of the major control room components, the general conservative modeling assumptions employed throughout the Reference 1 analysis, the philosophy of the operators with respect to remaining in the control room during such an event, and the relative un-importance of HVAC failure on a variety of plant PSA studies.

Therefore it is considered unnecessary to model either loss of HVAC as an initiator or as a support system.

7"t FACT/OBSERVATION REGARDING PSA TECHNICAL ELEMENTS References 1] EA-APR-95-023, Rev. 1, "Room Heat-up After Loss of Ventilation Under Appendix R Scenario in the Control Room (325), Cable Spreading Room (224),IC Switchgear Room (1 16A), Battery Rooms (225, 225A), Containment Area and the Diesel Generator Rooms (116, 116B)", [4396/0157]

2]

Palisades Meteorological Monitoring.-:

Semiannual'Data Reports Year Months Cart/Frame 1999 Jan-Jun 5691/1211 Jul-Dec 5691/1211 2000 Jan-Jun 4846/1418 Jul-Dec 4942/2376 2001 Jan-Jun 5103/1673 Jul-Dec to be filed 2002 Jan-Jun 5691/1211 Jul-Dec 5503/1042 2003 Jan-Jun 5691/1211 Jul-Dec 5688/2497 3] FSAR, Section 9.8, revision 24.

4] ONP-25.2 Rev. 19.

FAGTIOB SERVATION.REGARPDING.PSA-;'-

TECHNICAL ELEMENTS,"

OBSERVATION (ID: SY-05)

/ Element SY I Subelement SY-4 Flood Recovery The internal flood analysis assumes a 30 minute flood duration before a flood is terminated. This limit is based on the operator response time versus flood inventory. It therefore should be evaluated as a human action for the identification of the flood, the determination of the flood source and the action necessary to terminate the flooding. It appears that 30 minutes for an action that is assumed to have a zero probability is optimistic.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Evaluate the failure probability of the operator to terminate a flood within 30 minutes and the consequences of failing. Or consider using a significantly longer response time to bound the operator failure likelihood.

PLANT RESPONSE OR RESOLUTION CA01 7290 The PEER Review Comment is appropriate. It was incorrect to assume that an operator would terminate the flood source in any area within 30 minutes without having included in the model an operator action to terminate the flood source with a probability of failure to perform the action. The 30 minute criteria is from EA-C-PAL-95-1526-01 which states "The 30 minute isolation time for non-directly detectable breaks is consistent with industry practice for operating plants". However, rather than evaluate the operator ability to terminate a flood within 30 minutes, the assumption has been eliminated from the analysis until sufficient justification can be developed to support the development of a human error probability if necessary. In addition, a review of information in the current updated flood analysis indicates that the only areas where operator intervention to terminate a flood source would be a beneficial are the diesel generator rooms.

' '..F ST/OBSERVATION.REGARDING'-PSA TECHNICALELEMENTS OBSERVATION (ID: SY-06)

/ Element SY I Subelement SY-4, SY-19 DBD-1-1.03-(page-76) states that the AFW pump room was flooded due to flooding in the adjacent condensate pump room. The resolution was to install a sump pump. It then states that the modification to permanently install this pump was cancelled due to reliance on AFW Pump P-8C.

It further states "A check valve CK-FW419 is installed in the ST-0576 moisture separator condensate discharge line to prevent an additional flood path into the AFW pump room from the condensate pit, since the condensate pit is subject to flooding up to the maximum Turbine Building flood height.

The flood documentation, pages A7 and A8, screens this flood. It is unclear whether CKV-FW419 was added to prevent the original flood or prevents an additional flood.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Evaluate whether current approach is adequate. Consider adding CKV-FW419 to the model.

PLANT RESPONSE OR RESOLUTION CA01 7291 While the documentation indicates that the modification to permanently install the sump pump in the AFW room was cancelled. A sump pump is in the AFW pump room with a remote local start at the 590' elevation (above the AFW room). The operator would be alerted to the possibility of the event by a control alarm of flooding in the condensate pump room. The operator response to the alarm (see excerpt below) includes direction to check the AFW Pump room and start the sump pump if flooding of the AFW Pump Room is occurring.

ARP-1, Annunciator 71, Condensate Pump Room Flooding includes the following guidance.

"Check AFW Pump Room for flooding and start installed submersible pump using local switch if required (590', top of stairs)."

FACT/OBSERVATIONE RGARDNPS

TECHNICA :ELEMENT The probability of flooding the AFW Pump Room and failing the components in the room (primary components are AFW pumps P-8A and P-8B) is based on the frequency of a flood occurring in the Condensate Pump Room AND the probability of backflow through the AFW pump room drain (includes a backwater valve) or the drain line from the moisture separator from the steam line for pump P-8B through a one-inch line including check valve CK-FW419 to the Turbine Building Sump in the Condensate Pump Room AND failure of the operator to respond to the alarm and start the sump pump in the AFW Pump Room. In the current flooding analysis the highest frequency of flooding in the Condensate Pump room is 1.52E-04/yr. The failure probability of a check valve failing to close in the current PSA model is 2.69E-04. Using a screening value of 1 E-01 for an operator error (detailed would likely result in a value of 1 E-02 to 1 E-03 given explicit procedural guidance) the probability of flooding the AFW Pump Room would be 4.09E-09. An improved probability of operator would result in this flood frequency being below the current truncation value for quantification of core damage of 1.OOE-09. This value does not include the probability of failure of the remaining mitigating components (AFW pump P-8C and both trains of feed & bleed components). Therefore the decision to screen this scenario from the flooding analysis can be shown to be adequate. No changes are required. However, to avoid future confusion the disposition of this scenario will be documented in the current update to the flooding analysis.

.:j77Y/-2w"@-i:F

',ACTIOBS'ERVATION REGARD'ING PSAt@Hj-"'

a

<-.f ; ;

.w -TECHNICAL ELEMENTS--

OBSERVATION (ID: SY-07)

/ Element SY

/ Subelement SY-6 SWS model does not consider pipe flow path failures. This is being considered in the Risk-based ISI study in progress.-

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Incorporate piping failure information in the IPE model to indicate flow path failures.

PLANT RESPONSE OR RESOLUTION CA01 7292 To address the PEER review comment, the following discussion focuses on:

An overview of the Palisades RI-ISI program, A description of the calculation techniques employed in the RI-ISI program, specifically the SRRA computer code, General conclusions reached by the RI-ISI expert panel, and A description of the Palisades internal flooding analysis.

Subsequent to this discussion a conclusion regarding the PEER review comment is provided.

Overview of Palisades Risk Informed ISI Program (RI-ISI)

Inservice inspections (ISI) are currently performed on piping to the requirements of the ASME Boiler and Pressure Vessel Code Section XI, 1989 Edition as required by 1 OCFR50.55a. Palisades is currently in the third inspection interval as defined by the Code for Program B.

Palisades developed a risk-informed ISI program in order to change the aforementioned IS! program with respect to class 1, 2 and 3 piping. The risk-informed process employed is described in Westinghouse Owners Group WCAP-14572, "Westinghouse Owners Group Application of Risk-Informed Methods to Piping Inservice Inspection Topical Report," Revision 1-NP-A and WCAP-14572, Supplement 1, "Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed In-service Inspection," Revision 1-NP-A (herein referred to as WCAP-14572).

'." FACT/OBSERVATION REGARDING PSA TECHNICALELEMENTSn OBSERVATION (ID: SY-07)

/ Element SY

/ Subelement SY-6 SRRA Analysis General Description The structural reliability and risk assessment (SRRA) models and software that are used for the evaluation of piping RI-ISI have been developed to allow traditional engineering information to be converted into a probability of failure with time, including any effects or in-service inspection (ISI). The SRRA models are simplified structural reliability calculations incorporating some of the following principles:

The primary purpose is to allow deterministic engineering inputs, including insights from plant/industry-failure data, to be-consistently converted to probability with time.

Only the predominant material failure modes (fatigue, stress corrosion cracking and wastage) are to be considered. Other failure modes are to be considered with special analytical methods or expert judgment.

Calculated probabilities must agree with expected results (e.g., data for flow assisted corrosion, PC-PRAISE (a fracture mechanics computer code) for fatigue). Accuracy below I E-08 is not considered to be a requirement.

Simplifying assumptions must err on the conservative side.

The SRRA code was developed to address the simple geometry of a circumferential flaw in a girth welded pipe joint. Application of SRRA to more complex geometries requires conservative assumptions.

The code calculates failure probabilities using NRC approved statistical and probabilistic methods. The code uses type Monte-Carlo methods in performing the fracture mechanics analysis over the 40-year plant design life in estimating the likelihood of piping segment failure.

RI-ISI Process Comparison to Classical Fracture Mechanics Analvsis As stated above, the Palisades RI-ISI program employs the WCAP-14572 methods including the SRRA computer code to support the piping failure assessment and the attendant risk evaluation. This recipe for evaluating risk is correct in the context of the relative application; however, the generated pipe segment failure frequencies are not equivalent to what would be generated from classical fracture mechanics analyses.

Although the SRRA code has been extensively benchmarked and reviewed it is not a surrogate technique to replicate mechanistic calculations. Moreover, the results are in units of plant design life, i.e., 40 years. This means they cannot be used in PRA models as PRA models are based on annual frequencies (different units). And simply dividing the SRRA result by 40 is incorrect, as several modeled failure modes are time dependent and do not manifest themselves as failures in a single year.

. '-.'"FACT/13EOBSERVATION! REGARDING'PSA, TECHNCALELEMENTS OBSERVATION (ID: SY-07)

/

Element SY

/

Subelement SY-6 Expert Panel Review of the Critical and Non-Critical Service Water System(s)

As part of the RI-ISI process, plant subject matter personnel (operations, system engineering, design, PSA etc.) convened to review all evaluated.systems. The following is a brief synopsis of the committee's review of service water.

"Discussions within the group came to the following conclusions:

Failure mechanisms associated with CSW include thermal fatigue, mechanical fatigue, vibratory fatigue, and flow accelerated corrosion.

Operator action listed for the CSW system are credible actions. CSWpipe failures would be quickly recognized in the control room, and recovery actions would be made.

The segments in the high safety significance category (except CSW-009) all have low RRW values with credit taken for successful operator action.

Operator actions would not likely be taken to prevent of stop spray affects. Operator would not likely identify a leak and take action if the break is not system disabling.

Segments CSW-004, CSW-005A, CSW-005B, CSW-006A, and CSW-006B were initially in high safety significant category. The segments were in the low safety significance category with credit taken for operator action. The Ops representative on the expert panel expressed high confidence in the ability of operators to correctly identify and take the listed recovery action."

Regarding the Non-Critical Service Water System (NSW):

"- All NSW segments were generally Service Water to non-safety related equipment, or SWreturn piping. The only significant consequences associated with NSWpiping were the result of flooding.

Operator action to close CV-1359 to isolate Non-Critical SW is a credible action.

Isolating NSW would not prevent flooding. Water could flow back through return piping to continue to flood after closure of CV-1359. Closing CV-1359 would recover all Critical

'SW.

All NSW segments were unanimously voted low safety significant by the expert panel. "

H' 77J-E FAC TIOBSERVATION REGARDING PSA

--:TECHNICAL ELEMENTS OBSERVATION (ID: SY-07)

/ Element SY I Subelement SY-6 Summary Regarding Expert Panel Review of the Critical and Non-Critical Service Water System(s)

If mechanistic pipe failure frequencies were calculated they would be further reduced by the ability of the operator to isolate the leak. These recoveries were deemed credible by the expert panel. Furthermore in the absence of probabilities it is clear that such failures would likely be screened. Moreover, the NSW that could cause flooding were classified as low safety significant pipe segments by the expert panel. NSW flooding is addressed in the Palisades internal flooding analysis.

Internal Flooding Analysis The Palisades internal flooding analysis (Reference 1) evaluated the effects of service water flooding in a variety of rooms including the east & west engineering safeguards rooms, the EDG rooms, the screen house and the turbine building. The internal flooding analysis generated a core damage frequency. This internal flooding assessment was consistent with industry practice. The internal flooding assessment was a separate evaluation apart from Palisades PSA internal events analyses.

Conclusion As an observation, the Rl-ISI expert panel concluded that credible operator actions would preclude service water flooding.

The Palisades PSA does consider pipe flow path failures. The Palisades PSA internal flooding analyses evaluated these effects.

It is inappropriate to include RI-ISI pipe failure modeling in the Palisades PSA.

Therefore, the incorporation of piping failure information in the IPE model is inappropriate.

References 1] CPCo to NRC Letter, January 29, 1993, Palisades Plant Individual Plant Examination for Severe Accident Vulnerabilities (IPE), [F341/1523].

-.',i. FACT/OBSERVA-TION' REGARDINOG PSA--'i' TECHNICAL ELEMENTS OBSERVATION (ID: SY-09)

/ Element SY I Subelement SY-7 No document for determining the common cause values for the events in the model. A calculation to document this is in progress.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Complete calculation PLANT RESPONSE OR RESOLUTION CA01 7293 ERIN Engineering at the request of Palisades has completed a common cause data analysis. This analysis has been reviewed and deemed acceptable for use by the plant. The results of this assessment will be used in the present update of the Palisades core damage model.

Atr

'eoFACT/OBSERVATION. REGARDING; PE:SALaI' TECHNICAL ELEMENTS OBSERVATION (ID: SY-11

/-Element SY I Subelement SY-7 Spurious ESFAS actuations were not properly accounted for. SIS will load shed bus I E, which trips the plant through loss of condensate pumps. Also, the loss of two vital AC buses simultaneously (which is modeled as an IE) will cause the MSIVs to close. (See also F&O AS-10.)

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Determine the risk effect of these impacts and incorporate into the model as appropriate.

PLANT RESPONSE OR RESOLUTION CA017294 As noted in the comment a SIS signal with Standby Power available on Bus 1 C and bus 1 D will actuate the SIS-X relays that will actuate the SIS Loadshed. The SIS Loadshed will trip the incoming breakers to Bus 1 E. In addition, the SIS relays (SIS-1 and SIS-2) will generate a signal to close the non-critical service water header isolation valve (CV-1359). The non-critical header provides cooling to most equipment on the secondary side of the plant (Condensate Pumps,' Main Feedwater Pumps, Generator Exciter, Turbine Lube Oil, etc.). Without flow to the non-critical header, continued operation cannot be maintained.

A review of the industry data in NUREG/CR 5750, Rates of Initiating Events at U.S.

Nuclear Power Plants: 1987 - 1995, was performed to determine initiating event frequencies for spurious ESFAS signals. Appendix D Table D-5 includes a category QR9 for spurious ESFAS actuations that resulted in plant trips. There are 36 entries in this category. Each entry is an LER that describes the plant event and response. The identified LERs were downloaded from the INPO website (except 315/88-011 this LER was not available on the website). A screening of the 1988 DC Cook unit 2 LERs disclosed that the missing LER is likely 88-013 "Spurious ESF Actuation (Reactor Trip) With Concurrent Loss of the Reactor Coolant Pumps." As part of the evaluation, EA-PSA-DATA-99-019 was reviewed to assess what initiating event frequencies were developed in that analysis. Descriptions of the current event trees were also reviewed to determine whether an existing event tree adequately represented the conditions associated with the plant response to a spurious ESFAS signal. The review of the EA

'FACT /OBSERVATIONl:REGARPING'p.

TECHNICAL ELEMENTS: '.'.v;i OBSERVATION(ID:SY-11)

/ Element SY I Subelement SY-7 resulted in a re-review of the NUREG-5750 data. The review determined that of the 36 events in category QR9, 23 were included in Appendix D, Table D-7 category L. Table D-7 is the result of categorizing the events by the functional impact of the event on the plant response. The functional impact is a determination whether consequential failures of risk significant equipment, used to mitigate the event, occurred. Category LI represents events with a functional impact that all MSIVs were closed as a result of the event. The analysis conducted in EA-PSA-DATA-99-019 evaluated the events in category LI and created an initiating event (IE LOMSIV) with a calculated initiating event frequency of 9.OOE-02/yr. Therefore 23 of the 36 events that were the result of a spurious ESFAS signal had been included in EA-PSA-DATA-99-019. This is not obvious since the initiating event designator created represents the functional impact versus the cause.

The remaining 13 events in category QR9 have no functional impact categorization (they are not included in Table D-7 of Appendix D. Not being included in Table D-7 implies that the individuals that conducted the analysis for NUREG/CR-5750 determined that there was no functional impact from the remaining 13 events and that they therefore represent reactor trips with no consequential failures of mitigating equipment.

This would be the current Palisades initiating event TRANS-WC. However, as noted above a review of the SIS actuation logic identified two conditions that impact the availability of plant equipment credited in the Palisades PSA for mitigation of the event.

The ability to lower steam generator pressure and use condensate pumps to feed the steam generators is credited in the Palisades PSA. The loadshed of bus I E and the closure of CV-1 359 isolating the non-critical Service Water header result in the unavailability of the condensate pumps to feed the steam generators. Realigning power to bus 1 E if available and opening CV-1 359 or its manual bypass valve (MV-SW1 01) will enable the use of the condensate pumps for events where it can be successful.

This especially true for a spurious ESFAS event in which it is likely that operators will quickly discern that the signal was not legitimate and once it is verified, reset SIS, restore necessary equipment and return to power.

Currently the model includes logic to include the probability of failure to restore power to bus 1 E for events that generate a SIS signal. The current model does not include actions and components necessary to re-open CV-1 359 or MV-SW101 to reestablish cooling to the condensate pumps. This is a shortcoming in the current model since credit is taken for operation of the condensate pumps for events that result in the generation of a SIS signal. The model needs to include an AND gate with inputs gate SISINIT and a new gate representing failure of an operator action to restore flow to the non-critical Service Water header OR failure of (CV-1359 AND MV-SW101) to open.

'FACT/OBSERVATION REGARDING,:SA.

OBSERVATION (ID: SY-1I)

/ Element SY I Subelement SY-7 A review of the LER descriptions of the remaining thirteen events determined that two events -sh6uld be tre6ated separately from the re'st.l The two evenrts (285/94-001-0 and 530/91-003-1) were the result of spurious signals similar to a Containment High Pressure (CHP) signal at Palisades. These two events had the added impact of resulting in isolation of Component Cooling Wat6r to the Reactor Coolant Pumps.

These events would have the same response to the Palisades Initiating Event Loss of Component Cooling Water to Containment (LOCCW-1) and the transfer event trees for Medium or Small Reactor Coolant Pump Seal LOCAs. The calculated initiating event frequency for this event based on the data for all PWRs is 4.OOE-03. The initiating event designator for this event should be included in the CHPINIT control logic to assure proper control of mitigating system response.

One of the remaining events occurred during start-up testing and is not considered applicable. The remaining ten events are considered a category of events that result in a plant trip with Low Pressure Feed (via condensate pumps) unavailable unless the SIS signal is reset, power is restored to bus 1 E and SW flow to the non-critical header is restored. This calculated initiating event frequency for this group of events is 9.OOE-

03.

Since the event represents a total loss of condensate flow (both pumps affected) it would most appropriately be categorized in the IE-LOCND event frequency. Since this event is easily recoverable its characterization should include consideration of the operator response. A standard screening value of 0.1 for an undeveloped Human Error Probability (HEP) will be used to assess operator response. Successful operator response results in restoration of condensate pump availability and would be included in the frequency of the plant transients with the condenser available (IE-TRANS-WC). At a frequency of 9.OE-03 (9.OE-03

• 1) with successful operator intervention this would be an insignificant change in the frequency of 0.5 calculated in EA-PSA-DATA-99-019 for IE-TRANS-WC. If operator response fails then the event frequency would be 9.OE-04 (9.OE-03

• 0.1) and would be included in the IE-LOCND frequency (3.67E-02). This case would also be an insignificant change in the currently calculated initiating event frequency. Both conditions will be dispositioned by including the results of the evaluation in the currently ongoing update of analysis EA-PSA-DATA-99-019. The discussion of the development of each initiating event frequency discussed in this evaluation (IE-LOMSIV, IE-TRANS-WC and IE-LOCND) will be updated to indicate the disposition of the spurious ESFAS event evaluation.

The issue related to spurious closure of MSIVs due to loss of two preferred AC buses will be resolved under peer review comment AS-1 0.

, ti FACT/AION REGARDING? P TEHNICAL ELEMENTS OBSERVATION (ID: SY-13)

/ Element SY I Subelement SY-19 Internal flood frequencies due to maintenance were determined in a generic fashion that does not appear to take into account frequently performed maintenance activities that are more likely than others to result in a flood, such as those creating large system openings and limited isolation from active systems.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Review flood-likely maintenance activities and determine the explicit flood frequencies.

PLANT RESPONSE OR RESOLUTION CA01 7295 Although a "generic" approach was used to determine the overall frequency of non-outage maintenance-induced floods (see Reference 2), the distribution of this total into contributions from individual compartments is based upon compartment-specific information regarding the number of components that might undergo maintenance within the compartment. This approach represents, to some degree, the fact that some compartments may experience a higher frequency of maintenance activities and therefore may have a higher frequency for maintenance-induced flooding events.

In addition, as described in Reference 2, the amount of maintenance performed while the plant is in a non-outage condition is small when compared to that performed during an outage.

Also, the total flood frequency will not be any greater than that already calculated using plant-specific operating history (Reference 1). Therefore, regardless of the split between maintenance and non-maintenance related flood events, the overall frequency will not change.

The approach used in the flooding analysis results in maintenance-induced flooding frequencies, on a per-compartment basis, ranging from 5E-5/year to 2E-3/year. To determine the potential impact on flooding frequency if a more explicit examination of.

maintenance events was performed, the following approach was used:

1i'at;'>' jK FACT/OB'SERVATION"REGARDING PSA TECHNICAL ELEMENTS OBSERVATION(ID:SY-13)

/ Element SY I Subelement SY-19

1. Assume maintenance that could result in a flood is performed one time per quarter in a given compartment, on a component or system that could be a flooding source.

Therefore, the maintenance frequency (per year) = 4.

2. Assume that the failure probability per occurrence for maintenance personnel creating a flood event during their maintenance activities as a result of improperly following procedures is 1 E-3.

3. The frequency of a flood event, per compartment, is therefore 4 x I E-3, or 4E-3 per year.

Although higher than the upper bound of the per-compartment values used in the analysis,-it is within a factor of 2.

Given:

- that not every compartment has components that could be major flooding

sources,

- that maintenance is not performed on potential flood sources in each compartment as often as assumed for the example,

- and that maintenance personnel should be able to mitigate the event (i.e., halt the flood) in most instances before the event becomes significant the current approach is deemed to be reasonable and to adequately estimate the impact of maintenance on flooding frequency.

Overall the perception that maintenance activities are more likely to result in a flood is plausible. However, industry data suggests that passive and maintenance induced failure probabilities are not that different.

References 1] Applied Reliability Engineering, Inc., Internal Flooding Initiating Event Frequency Calculation, PA-02-01 0-01, November 26, 2003.

2] Applied Reliability Engineering, Inc., Palisades Internal Flood Analysis Update, PA-02-002-4, pending.

'uj'.%j FACT/OBSERVATION REGARDING PPSAki'`

'a

-'-TECHNIC AELEMENT-S OBSERVATION (ID: SY-14)

I Element SY I Subelement SY-28 Since no process has been documented for how to perform a system analysis for purposes of fault tree modeling, this element cannot be met. It is recognized that this is in the process of being addressed.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Write guideline for performing system analyses.

PLANT RESPONSE OR RESOLUTION CA01 7296 RIE Guideine 02, "End Event Identifiers" was revised. Revision 2 is now titled "System Fault Tree Development and Analysis". The procedure now includes system analysis guidelines and documentation requirements. End Event identification is a subset of the process and was retained as an attachment to the procedure.

FACT/OBSERVATION REGARDING' PSA TECHNICAL ELEM NS OBSERVATION (ID: TH-01)

/ Element TH I Subelement TH-4, TH-8, TH-10 The event tree analysis provides a pointer to references for success criteria utilizing thermal-hydraulic calculations (MAAP runs). The specific MAAP runs have not yet been approved or checked that they have indeed been run for the appropriate boundary conditions. The few human action analyses that were looked at had specific MAAP runs to justify the timing basis utilizqd in the human action. However, all human actions were not verified.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Palisades has agreed to verify the MAAP runs as they are referenced in the event tree analysis.

PLANT RESPONSE OR RESOLUTION CA017297 At the time of the PEER review the figures correlating the MAAP runs to the human error analyses were missing from the hard copy. Subsequent to the PEER review, the figures were reconstituted and are attached as files 99143001-006 Figures.doc and 99143001-007 Figures.doc. EA-PSA-2001-15 documents the owner's review of the analyses that employ these figures. The data employed in the human error analysis correctly references the MAAP results.

Moreover, the Risk Informed Engineering PSA Event Tree Notebook has been released for review. This document includes additional MAAP analyses that have been examined. The key data are noted in this document. The MAAP results match the boundary conditions presently considered in the latest Palisades PSA model (EA-PSA-PSAR2-04-02 rO).

FACT/OBSERVATION RE GARDING PA TECHNICAL ELEMENTS OBSERVATION (ID: TH-03)

/ Element TH I Subelement TH-7 Palisades performed a plant specific room heat-up calculations for the ESF pumps rooms, EA-C-PAL--98-1574. This-analysis-supported their modeling decision not to model HVAC for the ESF pump room. (This analysis was well prepared and documented.) However, Palisades did not perform room heat-up calculations for the Control room or the switchgear rooms. DBD 1.06, Rev. 4 did indicate that some sort of Control Room heatup calculations had been performed which showed that on loss of HVAC, the control room temperature would reach 110 *F in 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> and under SBO conditions it would reach 120 'F in 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. Likewise, on loss of HVAC, the cable.

spreading room temperature would reach 104 'F in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. These results are not consistent with the decision not to model HVAC dependencies for the control room and the cable spreading room.

LEVEL OF SIGNIFICANCE B

POSSIBLE RESOLUTION Document the heat-up calculations for the control room and the switch gear rooms.

Provide additional justification for the decision not to model the HVAC dependencies for the control room and the cable spreading room given the information in DBD 1.06, Rev.

4.

PLANT RESPONSE OR RESOLUTION

FACTIOBSERVATION REGARDING-PSA -i:.1 Hi

,-'TECHNICAL ELEM NS-I, Misi>a..

ST A

EE ENTS OBSERVATION (ID: TH-03)

/ Element TH

/ Subelement TH-7 CA017298 The above issues have already been addressed in CA017289 and CA017268. Briefly, the PEER review comments for these CA's are repeated below:

CA017268 Track closure of CEOG PSA peer review comment PEER-2000 IE-04, Loss of HVAC (PSA issue #168).

'Loss of HVAC systems (CR, CSR, SWGR) were not considered as initiating events.

The loss of a HVAC system is usually combined with a human action if a standby train is available."

CA017289 Track closure of CEOG PSA peer review comment PEER-2000 SY-04, HVAC Dependencies (PSA issue #120).

"HVAC The failure of Control Room and Cable Spreading Room HVAC is not modeled in the Palisades' PSA. DBD 1.06 Rev 4 indicates that following the loss of service water, the CR's temperature will reach 11 OF within 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br />. Under SBO conditions, it is shown to reach 120F within 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. It also shows that the CSR will reach 104F in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />."

"Engineering Analysis EA-APR-95-023 also states that the control room and cable spreading room require room cooling. This same analysis also shows that the switchgear rooms do not require HVAC."

"The CSR HVAC system appears to have only a single fan, V33, to provide cooling."