ML052720032

Licensing Amendments 291 and 273 Safety Evaluation Regarding Allowed Outage Time Extension for the Emergency Diesel Generators

ML052720032
Person / Time
Site:	Cook
Issue date:	09/30/2005
From:	Spaulding D NRC/NRR/DLPM/LPD3
To:	Nazar M Indiana Michigan Power Co
Spaulding D, NRR/DE/EEIB, 415-2928
Shared Package
ML052720081	List: ML052720032 ML052730320
References
TAC MC4525, TAC MC4526
Download: ML052720032 (34)

Text

September 30, 2005 Mr. Mano K. Nazar Senior Vice President and Chief Nuclear Officer Indiana Michigan Power Company Nuclear Generation Group One Cook Place Bridgman, MI 49106

SUBJECT:

DONALD C. COOK NUCLEAR PLANT, UNITS 1 AND 2 - ISSUANCE OF AMENDMENTS RE: SAFETY EVALUATION REGARDING ALLOWED OUTAGE TIME EXTENSION FOR THE EMERGENCY DIESEL GENERATORS (TAC NOS. MC4525 AND MC4526)

Dear Mr. Nazar:

The U.S. Nuclear Regulatory Commission has issued the enclosed Amendment No. 291 to Renewed Facility Operating License No. DPR-58 and Amendment No. 273 to Renewed Facility Operating License No. DPR-74 for the Donald C. Cook Nuclear Plant, Units 1 and 2. The amendments consist of changes to the Technical Specifications (TS) in response to your application dated September 21, 2004, as supplemented by letters dated March 18, April 7, May 6, August 10, and September 19, 2005.

Your September 21, 2004, letter, proposed amendments that would extend the allowed outage times (AOTs) from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days for an inoperable emergency diesel generator (EDG),

an inoperable component cooling water (CCW) system loop, an inoperable essential service water (ESW) system loop, or an inoperable alternate offsite power circuit (69 kilovolt (kV) circuit). However, by letter dated April 7, 2005, you withdrew your amendment request for extended CCW and ESW AOT, and limited the extended 69 kV circuit AOT to a one-time usage. The amendment relating to the 69 kV offsite power circuit limiting conditions was previously issued on September 9, 2005.

This amendment addresses your request for extending the AOT for the EDGs.

M. Nazar A copy of our related safety evaluation is also enclosed. A Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely,

/RA/

Deirdre W. Spaulding, Project Manager, Section 1 Project Directorate III Division of Licensing Project Management Office of Nuclear Reactor Regulation Docket Nos. 50-315 and 50-316

Enclosures:

1. Amendment No. 291 to DPR-58

2. Amendment No. 273 to DPR-74

3. Safety Evaluation cc w/encls: See next page

ML052720032 (Letter)

ADAMS ACCESSION NUMBER: ML052720081 (Package)

ADAMS ACCESSION NUMBER: ML052730320 (TS)

OFFICE PDIII-1/PE PDIII-1/PM PDIII-1/LA DE/EEIB NAME AMuniz DSpaulding THarris RJenkins DATE 9/30/05 9/29/05 9/29/05 08/16/05 OFFICE DSSA/SPSB DRIP/IROB OGC PDIII-1/SC NAME MRubin TBoyce AHodgdon LRaghavan DATE 09/22/05 09/09/05 9/29/05 9/30/05

Donald C. Cook Nuclear Plant, Units 1 and 2 cc:

Regional Administrator, Region III U.S. Nuclear Regulatory Commission 2443 Warrenville Road, Suite 210 Lisle, IL 60532-4352 Attorney General Department of Attorney General 525 West Ottawa Street Lansing, MI 48913 Township Supervisor Lake Township Hall P.O. Box 818 Bridgman, MI 49106 U.S. Nuclear Regulatory Commission Resident Inspector's Office 7700 Red Arrow Highway Stevensville, MI 49127 James M. Petro, Jr., Esquire Indiana Michigan Power Company One Cook Place Bridgman, MI 49106 Mayor, City of Bridgman P.O. Box 366 Bridgman, MI 49106 Special Assistant to the Governor Room 1 - State Capitol Lansing, MI 48909 Mr. John A. Zwolinski Safety Assurance Director Indiana Michigan Power Company Nuclear Generation Group One Cook Place Bridgman, MI 49106 Michigan Department of Environmental Quality Waste and Hazardous Materials Div.

Hazardous Waste & Radiological Protection Section Nuclear Facilities Unit Constitution Hall, Lower-Level North 525 West Allegan Street P. O. Box 30241 Lansing, MI 48909-7741 Michael J. Finissi, Plant Manager Indiana Michigan Power Company Nuclear Generation Group One Cook Place Bridgman, MI 49106 Mr. Joseph N. Jensen, Site Vice President Indiana Michigan Power Company Nuclear Generation Group One Cook Place Bridgman, MI 49106

INDIANA MICHIGAN POWER COMPANY DOCKET NO. 50-315 DONALD C. COOK NUCLEAR PLANT, UNIT 1 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 291 License No. DPR-58 1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Indiana Michigan Power Company (the licensee) dated September 21, 2004, as supplemented by letters dated March 18, April 7, May 6, August 10, and September 19, 2005, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Facility Operating License No. DPR-58 is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 291, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented within 120 days.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

L. Raghavan, Chief, Section 1 Project Directorate III Division of Licensing Project Management Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications Date of Issuance: September 30, 2005

ATTACHMENT TO LICENSE AMENDMENT NO. 291 TO FACILITY OPERATING LICENSE NO. DPR-58 DOCKET NO. 50-315 Replace the following pages of the Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

REMOVE INSERT 3.8.1-2 3.8.1-2 3.8.1-3 3.8.1-3 3.8.1-4 3.8.1-4 3.8.1-5 3.8.1-5 3.8.1-6 3.8.1-6 3.8.1-7 3.8.1-7 3.8.1-8 3.8.1-8 3.8.1-9 3.8.1-9 3.8.1-10 3.8.1-10 3.8.1-11 3.8.1-11 3.8.1-12 3.8.1-12 3.8.1-13 3.8.1-13 3.8.1-14 3.8.1-14 3.8.1-15 3.8.1-15 3.8.1-16 3.8.1-16 3.8.1-17 3.8.1-17 3.8.1-18 3.8.1-18

INDIANA MICHIGAN POWER COMPANY DOCKET NO. 50-316 DONALD C. COOK NUCLEAR PLANT, UNIT 2 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 273 License No. DPR-74 1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Indiana Michigan Power Company (the licensee) dated September 21, 2004, as supplemented by letters dated March 18, April 7, May 6, August 10, and September 19, 2005, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Facility Operating License No. DPR-74 is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 273, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented within 120 days.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

L. Raghavan, Chief, Section 1 Project Directorate III Division of Licensing Project Management Office of Nuclear Reactor Regulation

Attachment:

Changes to the Technical Specifications Date of Issuance: September 30, 2005

ATTACHMENT TO LICENSE AMENDMENT NO. 291 FACILITY OPERATING LICENSE NO. DPR-74 DOCKET NO. 50-316 Replace the following pages of the Appendix A Technical Specifications with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

REMOVE INSERT 3.8.1-2 3.8.1-2 3.8.1-3 3.8.1-3 3.8.1-4 3.8.1-4 3.8.1-5 3.8.1-5 3.8.1-6 3.8.1-6 3.8.1-7 3.8.1-7 3.8.1-8 3.8.1-8 3.8.1-9 3.8.1-9 3.8.1-10 3.8.1-10 3.8.1-11 3.8.1-11 3.8.1-12 3.8.1-12 3.8.1-13 3.8.1-13 3.8.1-14 3.8.1-14 3.8.1-15 3.8.1-15 3.8.1-16 3.8.1-16 3.8.1-17 3.8.1-17 3.8.1-18 3.8.1-18

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 291 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-58 AND AMENDMENT NO. 273 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-74 INDIANA MICHIGAN POWER COMPANY DONALD C. COOK NUCLEAR PLANT, UNITS 1 AND 2 DOCKET NOS. 50-315 AND 50-316

1.0 INTRODUCTION

By letter to the Nuclear Regulatory Commission (NRC, the Commission) dated September 21, 2004, as supplemented by letters dated March 18, April 7, May 6, August 10, and September 19, 2005, the Indiana Michigan Power Company proposed changes to Donald C. Cook Nuclear Plant, Units 1 and 2 (D. C. Cook) technical specifications (TSs). The September 21, 2004, letter, proposed amendments that would extend the allowed outage times (AOTs) from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days for an inoperable emergency diesel generator (EDG), an inoperable component cooling water (CCW) system loop, an inoperable essential service water (ESW) system loop, or an inoperable alternate offsite power circuit (69 kilovolt (kV) circuit). However, by letter dated April 7, 2005, the licensee withdrew the amendment request for extended CCW and ESW AOT, and limited the extended 69 kV circuit AOT to a one-time usage. The amendment relating to the 69 kV offsite power circuit limiting conditions was issued on September 9, 2005.

The proposed change to extend the AOTs specified in TS 3.8.1, "AC Sources - Operating," to restore an inoperable EDG to operable status from the current 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days is addressed by this NRC staff safety evaluation.

The supplemental letters contained clarifying information and did not change the initial no significant hazards consideration determination or expand the scope of the original Federal Register notice.

2.0 REGULATORY EVALUATION

The regulatory requirements that the NRC staff applied in its review of the application include:

2.1 Electrical and Instrumentation Controls Branch Evaluation General Design Criterion (GDC) 17, Electric power systems, of Appendix A, General Design Criteria for Nuclear Power Plants, to Part 50 of Title 10 of the Code of Federal Regulations (CFR) states, in part, that nuclear power plants have onsite and offsite electric power systems to permit the functioning of structures, systems, and components that are important to safety.

The onsite system is required to have sufficient independence, redundancy, and testability to perform its safety function, assuming a single-failure. The offsite power system is required to be supplied by two physically independent circuits that are designed and located so as to minimize, to the extent practical, the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. In addition, this criterion requires provisions to minimize the probability of losing electric power from the remaining electric power supplies as a result of loss of power from the unit, the offsite transmission network, or the onsite power supplies.

GDC-18, Inspection and testing of electric power systems, requires that electric power systems that are important to safety be designed to permit appropriate periodic inspection and testing to assess the continuity of the systems and the conditions of their components.

Section 50.65, Requirements for monitoring the effectiveness of maintenance at nuclear power plants, requires that preventive maintenance activities not reduce the overall availability of the systems, structures and components. It also requires that before performing maintenance activities, the licensee assess and manage the increase in risk that may result from the proposed maintenance activities.

Regulatory Guide (RG) 1.93, Availability of Electric Power Sources, provides guidance with respect to operating restrictions (i.e., AOTs) if the number of available alternate current (AC) sources is less than that required by the TS limiting condition for operation (LCO). In particular, this guide prescribes an AOT of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for an inoperable onsite or offsite AC source.

2.2 Risk Evaluation The regulatory criteria/guidelines on which the staff based its acceptance are:

RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed licensing-basis changes by considering engineering issues and applying risk insights.

This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," describes an acceptable risk-informed approach specifically for assessing proposed TS changes in AOTs. (The phrase completion time is used in some licensees technical specifications instead of allowed outage time. These phrases are considered the same when applying the guidance in RG 1.177.) This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

One acceptable approach to making risk-informed decisions about proposed TS changes is to show that the proposed changes meet five key principles stated in RG 1.174, Section 2 and RG 1.177, Section B:

1.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

2.

The proposed change is consistent with the defense-in-depth philosophy.

3.

The proposed change maintains sufficient safety margins.

4.

When proposed changes result in an increase in core-damage frequency or risk, the increases should be small and consistent with the intent of the Commissions Safety Goal Policy Statement.

5.

The impact of the proposed change should be monitored using performance measurement strategies.

For permanent TS changes, RG 1.174 and RG 1.177 provide numerical risk acceptance guidelines that are helpful in determining whether or not the fourth key principle has been satisfied. These guidelines are not to be applied in an overly prescriptive manner; rather, they provide an indication, in numerical terms, of what is considered acceptable. The intent in comparing risk results with the risk acceptance guidelines is to demonstrate with reasonable assurance that the fourth key principle has been satisfied.

3.0 BACKGROUND

The EDGs are monitored under the Maintenance Rule (MR) program in accordance with 10 CFR 50.65, and are currently in the 10 CFR 50.65 (a)(2) category. This indicates that the EDGs are meeting their established MR reliability and unavailability goals.

In addition to the above, the licensee would install two backup standby diesel generators (SDGs) to supply safe shutdown loads. These will be available whenever an EDG is removed from service for preplanned work requiring greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or if deemed necessary for corrective maintenance unplanned work that will exceed the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT. The two SDGs will be commercial-grade and will be permanently installed on-site or near, and connected to, the 69 kV substation. The SDG components will be protected against the effects of likely weather-related events. The electrical output of the two SDGs will be connected to 4.16 kV Bus 1, between the secondary side of transformer and circuit breakers 1EP and 2EP. The connections from the circuit breakers to the 4.16 kV ESF buses in the plant are routed underground.

Each SDG will have a rated capacity of 2250 to 2800 kW and will be installed within metal enclosures complete with fuel oil tank, closed loop radiator cooling system, engine and generator control panels. A 24-hour fuel supply will be provided for each SDG. The SDGs will have the capacity to power at least one train of vital equipment needed to ensure safe shutdown conditions following an station blackout (SBO).

Upon sustained loss of power on 4 kV Bus 1, a new motor-operated disconnect switch will open automatically to isolate the 69 kV system. When the motor-operated disconnect switch is confirmed open, the two SDGs will automatically start. When the first SDG reaches rated speed and voltage, its output breaker will close. When the second SDG reaches rated speed and voltage, the two will synchronize and the second SDG output breaker will close. With both SDGs operating, the tie breaker (52 T1) will close loading the SDGs on to Bus 1. The unit loads can be applied to the appropriate 4.16 kV ESF bus from the respective units control room in accordance with the emergency operating procedures.

The SDG will be located in the 69kV switchyard, which is physically separate from the 345 kV switchyard that provides the preferred offsite AC power to the units. The SDG components will also be physically separate from safety-related components. Each SDG will be separated from the Class 1E power system by two circuit breakers in series, one of which will be a Class 1E circuit breaker located at the class 1E bus. The SDG components will be protected against the weather-related events that could challenge a loss of offsite power.

The SDGs will be load tested every quarter, and automatic features (startup, synchronization, breaker and disconnect alignment) will be tested every 18 months. The SDGs will be included in the MR Program. This program is based on NUMARC 93-01, as endorsed by Regulatory Guide 1.160, Monitoring the Effectiveness of Maintenance at Nuclear Power Plants.

Additionally, the SDGs will be designated as high safety significant components in the Cook Nuclear Plant (CNP) MR program. This program requires that performance criteria for high safety significant components correspond to a reliability goal of 95 percent.

4.0 TECHNICAL EVALUATION

4.1 EEIB Evaluation The licensee has proposed to increase the AOT for one inoperable EDG from the current 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days.

The current TS LCO 3.8.1, Action b, reads as follows:

b.

With a diesel generator of the above required A.C. offsite sources inoperable demonstrate the OPERABILITY of the A.C. offsite sources by performing Surveillance Requirements 4.8.1.1.1.a within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter; and if the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining OPERABLE diesel generator by performing Surveillance Requirement 4.8.1.1.2.a.4 within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, unless the absence of any potential common mode failure for the remaining diesel generator is demonstrated; restore diesel generators to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The proposed Action b is as follows:

b.

With a diesel generator of the above required A.C. offsite sources inoperable demonstrate the OPERABILITY of the A.C. offsite sources by performing Surveillance Requirements 4.8.1.1.1.a within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter; and if the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining OPERABLE diesel generator by performing Surveillance Requirement 4.8.1.1.2.a.4 within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, unless the absence of any potential common mode failure for the remaining diesel generator is demonstrated; restore diesel generators to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in at least HOT STANDBY within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />, unless the following conditions exist:

1. The requirement to restore the diesel generators to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> may be extended to 14 days if both SDGs are verified available, and

2. If at any time during the above identified 14-day period, one or both SDGs become unavailable, either restore both SDGs to available status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> ( not to exceed 14 days from the time the required diesel generator of LCO 3.8.1.1.b originally became inoperable), or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

The licensee stated that extending the AOT would facilitate on-line performance of more comprehensive overhaul, maintenance, inspection, and upgrade activities, thereby helping to maintain or improve reliability of these systems. The proposed 14-day AOT provides a work window that will significantly increase the scope of maintenance, inspection, and upgrade activities that can be performed with the unit on-line. Performance of maintenance activities with the unit on-line allows support organizations to focus on the specific maintenance activity, rather than the multitude of activities that are in progress during a unit outage, which can benefit the quality of the activity.

The SDGs will be available whenever an EDG is removed from service for preplanned maintenance work known to require greater than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or if deemed necessary for unplanned corrective maintenance work that will exceed the 72-hour AOT. The licensee stated that the SDG availability will be demonstrated by performance of periodic testing and inspections. When an EDG is inoperable and the SDGs are needed as a backup power source, SDG availability is verified by: 1) verifying the SDG equipment is mechanically and electrically ready for automatic operation; verifying 24-hour onsite fuel supply is available for each SDG; and 3) ensuring the SDGs are aligned to automatically supply power to 4.16 kV Bus 1. In determining the appropriate frequency for SDG load testing, the licensee has utilized existing guidance for a station blackout alternate alternating power source, even though SDGs are not credited for fulfilling 10 CFR 50.63, Loss of all alternating current power, requirements.

However, the staff was concerned that since the SDGs are tested every 3 months, there is no adequate assurance that the SDGs will operate when called upon and that they should be tested before entering the action statement for extended AOT. In a letter dated April 7, 2005, the licensee stated that it intends to routinely exercise the SDGs on a nominal twice-per-month basis, by running the engine unloaded for several minutes as per the Administrative Technical Requirements manual. Further, this testing will be controlled by the current Administrative Technical Requirements (ATR) manual, or by the Technical Requirements manual, which will replace the ATR manual as part of the Improved Technical Specifications. These exercises are intended to inhibit rust accumulation in the cylinder bores and bearing surfaces, thereby enhancing the reliability of the engines. The staff finds that two weeks time interval between tests should provide adequate assurance that the SDGs will start when called upon; therefore, the above response satisfies the staffs concern.

The licensee stated that procedures for operation of the SDGs have not been finalized.

Performance of operator actions needed to manually connect the SDGs to the safety bus following an SBO has been informally timed at approximately 10 minutes.

Additional Operational Restrictions In the event an EDG is inoperable, all of its redundant systems, subsystems, trains, components and devices that depend on the remaining operable EDG as a source of emergency power are verified operable. This required action provides assurance that a LOOP event will not result in a complete loss of safety function of critical systems during the period one of the EDGs is inoperable.

Since the extension of the EDG AOT is based on the finding of a deterministic and probabilistic safety analysis, entry into this action requires that a risk assessment be performed in accordance with a Configuration Risk Management Program (CRMP). The above ensures that a procedurlized probabilistic risk assessment (PRA) informed process is in place that assesses the overall impact of plant maintenance on plant risk prior to entering the limiting condition for operation (LCO) Action statement for planned activities.

Electrical and Instrumentation and Controls Branch Conclusion Based on the above considerations, the NRC staff finds that the licensees proposed request to revise the TS to permit extending the AOT for an inoperable EDG from the current 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days, is acceptable.

Further, the NRC staff believes that for the EDG AOT extension, the SDGs will provide additional defense-in-depth by providing another source of emergency power, since the combined capacity of both SDGs will exceed that of an EDG. The NRC staff also concludes that the proposed changes will not affect the compliance of D. C. Cook with the requirements of GDCs 17 and 18.

4.2 Risk Evaluation The risk evaluation presented below addresses the last two key principles of the staffs philosophy of risk-informed decision making, which concern changes in risk and performance measurement strategies. These key principles were evaluated by using the three-tiered approach described in Chapter 16.1 of the Standard Review Plan (SRP) and RG 1.177.

Tier 1 - The first tier evaluates the licensee's probabilistic risk/safety assessment (PRA/PSA) and the impact of the change on plant operational risk, as expressed by the change in core damage frequency (CDF) and the change in large early release frequency (LERF). The change in risk is compared against the acceptance guidelines presented in RG 1.174. The first tier also aims to ensure that plant risk does not increase unacceptably during the period when equipment is taken out of service per the license amendment, as expressed by the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP). The incremental risk is compared against the acceptance guidelines presented in RG 1.177.

Tier 2 - The second tier addresses the need to preclude potentially high-risk plant configurations that could result if equipment, in addition to that associated with the proposed license amendment, are taken out of service simultaneously, or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. The objective of this part of the review is to ensure that appropriate restrictions on dominant risk-significant plant configurations associated with the AOT extension are in place.

Tier 3 - The third tier addresses the licensee's overall CRMP to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities and taking appropriate compensatory measures to avoid such configurations. The CRMP is to ensure that equipment removed from service prior to or during the proposed extended AOT period will be appropriately assessed from a risk perspective.

4.2.1 Tier 1: PRA Capability and Insights The Tier 1 staff review involved two aspects: (1) evaluation of the adequacy of the PRA and its application to the proposed AOT extensions, and (2) evaluation of the PRA results and insights stemming from its application.

4.2.1.1 Evaluation of PRA Adequacy To determine whether the PRA used in support of the proposed AOT extension is of sufficient quality, scope, and level of detail, the staff evaluated the relevant information provided by the licensee in its submittal, as supplemented (References 1, 2, 3,and 8). The staff's review of the licensee's submittal focused on the adequacy of the licensee's PRA model to analyze the risks stemming from the proposed AOT extension and did not involve an in-depth review of the licensee's PRA. The following excerpts from the licensee's submittal provided the basis for this portion of the NRC staff's review.

Description of Models In 1992, the licensee submitted responses, including a Level 3, internal events PRA, seismic PRA, and a fire PRA, to fulfill the requirements of NRC Generic Letter (GL) 88-20. In 1995, the licensee submitted extensive revisions to the human reliability analysis (HRA), seismic, and fire models (References 6 and 7) in response to NRC questions and site audits. The NRC staff reviewed the IPE and IPEEE information submitted by the licensee. The NRC staff concluded that the individual plant examination (IPE) and individual plant examination of external events (IPEEE) (as supplemented) were complete with regard to the information requested in GL 88-20, and that the licensee's IPE and IPEEE processes were capable of identifying the most likely severe accidents and severe accident vulnerabilities (References 4 and 5).

The internal events PRA model used for this EDG AOT extension request and one-time 69kV bus AOT extension request is an update of the original IPE model developed in response to GL 88-20. The scope of this PRA model encompasses both Level 1 and simplified LERF for internal initiating events during power operation. The external events risk assessment for this amendment request was qualitative and based in part on the 1995 IPEEE update. Shutdown risk was not assessed for this application, which the staff finds acceptable because the affected TSs are not applicable except in modes 1 through 4.

Internal events PRA model updates have been performed regularly since the initial submittal of the IPE in 1992.

Internal Events Model Peer Review In September 2001, the updated PRA model received a certification review in accordance with the Wesginhouse Owners Group (WOG) certification process. This review led to a number of facts and observations (F&Os), including three "A" significance level F&Os and 24 "B" significance level F&Os. The WOG certification process assigns "A" level significance to F&Os that are considered extremely important and necessary to address in order to assure the technical adequacy or quality of the PRA model, while "B" level significance is assigned to F&Os that are considered important and necessary to address, but may be deferred until the next PRA model update.

The staff reviewed the significance level A and B F&Os identified by the WOG peer review and the licensee's resolution of these F&Os. The licensee stated that all level A and B F&Os were addressed in the updated PRA model except one level A finding regarding internal flooding.

The staff also reviewed the significance level C and D F&Os. No F&Os were identified that would be expected to adversely impact the risk analysis of the EDG AOT extension request.

Model Update and Quality Control The licensee stated that all PRA system notebooks and other supporting documentation are controlled in accordance with site procedures, utilizing the licensee's document control system.

Full revisions of PRA system notebooks are prepared, reviewed, and approved by different individuals. When potential model issues are identified, they are entered into the licensee's corrective action program to assure that they are tracked to resolution.

Model quantification is documented as a calculation in accordance with the licensee's calculation procedure.

The licensee also said that a similar approach was taken to assure the quality of the risk evaluation supporting the proposed amendment. Initial PRA calculations with an independent preparer and reviewer were performed and reviewed by a contracted company. These calculations were accepted by the license in accordance with the licensee's owner acceptance procedure. Final PRA calculations to create the PRA information included in the submittal were performed by licensee personnel and documented in accordance with the licensee's calculation procedure.

Modeling Changes to Support the Application The licensee updated the CNP PRA model for this application. The major changes reported by the licensee (Reference 3) may be summarized as:

CCW modeling changes to resolve two issues concerning CCW pump modeling.

SDG fault tree to represent the various ways that the SDGs could fail to provide power to the 4 kV safety buses. This was done in a manner that accounts for the possibility that the SDGs may be aligned to different trains following an SBO initiator.

Event trees changed to explicitly represent the SDGs in the event trees. New event trees were created to account for the unique support state that exists when a single-unit or dual-unit loss of system pressure initiator occurs, both EDGs subsequently fail, and the SDGs are successfully loaded onto a safety bus. Separate event trees address a stuck-open pressurizer relief valve, a stuck-open safety valve, and a loss of CCW for the unit specifically for this new support state.

The licensee stated that in order to assure that the SDGs were appropriately included in the PRA model used for the risk evaluation supporting the proposed amendment, meetings were held in which PRA modeling assumptions were discussed with representatives of the engineering design team, project management, operations, and licensing.

In response to a staff question, the licensee confirmed that their PRA model does not allow any credit for repair or recovery of any component within an EDG component boundary and that recovery of failures in support systems for the EDGs are not credited during the EDG mission time.

Human Reliability Analysis The licensee stated that the SDG units will be self-contained, requiring no external support systems except for fuel replenishment. Power to SDG controllers in the control rooms will be provided by the technical support center uninterruptible power supply. However, operator action is required to utilize the SDG. The licensee stated (Reference 8) that, upon a sustained loss of power on 4 kilovolt bus 1, both SDGs will start automatically. The SDG programmable logic controller will automatically open the power operated disconnect switch on 4 kilovolt bus 1 to isolate the bus from the 69 kilovolt/4 kilovolt transformer. Upon attaining rated speed and voltage, and confirming the power operated disconnect is open, the SDGs will automatically synchronize with each other and the SDGs' output circuit breakers will automatically close onto the de-energized 4 kilovolt bus 1. The two diesel generators, when connected to the bus, will be capable of parallel operation. The applicable emergency operating procedure will direct the operators to confirm that 4 kilovolt bus 1 is energized. Following confirmation that 4 kilovolt bus 1 is energized, the control room operators will energize a safety bus from 4 kilovolt bus 1, manually start one ESW pump and one CCW pump, verify proper alignment of the coolant charging pump (CCP) suction and discharge paths for reactor coolant system (RCS) loop injection and start the CCP after the local operator reports the seal injection is isolated, initiating RCS loop injection.

The licensees detailed HRA for the operator actions to align the SDGs is based on the draft procedure and yields a human error probability (HEP) of 2.1E-2. For the purposes of the risk assessment, a representative HEP of 5E-2 was employed for these actions, which the licensee expects to bound the HEP that will result when the procedure is finalized. The staff finds this acceptable, because a slight conservatism in the HEP will allow less credit for the SDGs, resulting in conservative estimates of the risk increase as a result of the increased EDG AOT.

The NRC staff concluded that the HRA performed at this stage was indeed detailed and appeared appropriate for this application.

The licensee also provided the methodology used to assess the dependency of this operator action on other operator actions within a given core damage scenario, including actions to recover offsite power. The licensee stated that the PRA model was solved with all post initiator operator action HEPs set to 1.0 to allow identification of operator action combinations. The licensee then determined the order in which the operator actions would occur and assessed the dependency between the actions. The NRC staff considers this methodology acceptable for this application.

4.2.1.2 Evaluation of PRA Results and Insights EDG AOT Combined Change Request CDF, LERF, Delta CDF, and Delta LERF The licensee's amendment request may be considered a combined change request (CCR) as discussed in Section 2.1.1 of RG 1.174, since addition of SDGs is being used to offset the risk of extending the EDG AOT. Since extending the EDG AOT increases risk and adding the SDGs decreases risk, this combined change falls into the first category described in RG 1.174, CCRs in which any individual change increases risk." The licensee provided results of a risk assessment showing the total impact of these two changes taken together. The licensee also provided a risk assessment showing the risk increase of the EDG AOT change, assuming the SDGs already existed in the plant (i.e., credited in both the baseline and extended EDG AOT cases). These tables are reproduced below (from Reference 8).

The information in the tables allows estimation of the risk reduction that would occur if the only change being made were addition of the SDGs (Unit 1 numbers):

Delta CDF

=

2.42E-5 - 4.15E-5

= -1.73E-5 Delta LERF

=

4.21E-6 - 7.23E-6

= -3.02E-6 The licensee's risk assessments included sensitivity analyses that show very similar results for different units, EDG out of service, and SDG bus alignment. Based on the first table below, the overall impact of the combined change is a decrease in CDF and LERF. Considered separately, addition of the SDGs would decrease plant risk. As shown in the second table below, the EDG AOT extension alone would result in risk increases that are slightly above the threshold for "very small changes" in Figures 3 and 4 of RG 1.174.

RG 1.174 states that combined changes should be related to one another, although this is not a requirement. The licensee's combined changes are directly related to each other, since the SDGs may be aligned to supply AC power to the same electrical buses supplied by the EDGs.

In addition, the licensee provided information to demonstrate that the risk from significant accident sequences will not be increased and that the frequencies of the lower ranked contributors will not be increased so that they become significant contributors to risk.

Since the combined change results in a decrease in plant risk, the staff considers that the extended EDG AOT meets the guidance in RG 1.174 with respect to CDF and LERF from at-power internal initiating events.

Risk Assessment of Total Change - Add SDGs and Extend EDG AOT Case Definition CDF LERF CDF LERF Unit 1 Current Base Case:

No credit for SDGs.

All other components T&M set to average yearly values.

4.15E-5 7.23E-6 Unit 1 Projected Base Case with SDGs aligned to T11A/B:

Current Base Case but with credit allowed for SDGs.

SDG function unavailable 3 days per year for T&M.

Each EDG unavailable 8 days per year for T&M.

All other components T&M set to average yearly values.

2.53E-5 4.36E-6

-1.6E-5

-2.9E-6 Unit 2 Current Base Case:

• No credit for SDGs.

• All other components T&M set to average yearly values.

4.14E-5 7.20E-6 Unit 2 Projected Base Case with SDGs aligned to T21C/D:

Current Base Case but with credit allowed for SDGs.

SDG function unavailable 3 days per year for T&M.

Each EDG unavailable 8 days per year for T&M.

All other components T&M set to average yearly values.

2.53E-5 4.34E-6

-1.6E-5

-2.9E-6 Risk Assessment of EDG AOT Extension - SDGs Credited in All Cases Case Definition CDF LERF CDF LERF Unit 1 Interim Base Case with SDGs aligned to T11C/D:

• SDG function unavailable 3 days per year for T&M.

• All other components T&M set to average yearly values.

2.42E-5 4.21E-6 Unit 1 Projected Base Case with SDGs aligned to T11A/B:

• SDG function unavailable 3 days per year for T&M.

• Each EDG unavailable 8 days per year for T&M.

• All other components T&M set to average yearly values.

2.53E-5 4.36E-6 1.1E-6 1.5E-7 Unit 2 Interim Base Case with SDGs aligned to T21C/D:

• SDG function unavailable 3 days per year for T&M.

• All other components T&M set to average yearly values.

2.42E-5 4.19E-6 Unit 2 Projected Base Case with SDGs aligned to T21C/D:

• SDG function unavailable 3 days per year for T&M.

• Each EDG unavailable 8 days per year for T&M.

• All other components T&M set to average yearly values.

2.53E-5 4.34E-6 1.1E-6 1.5E-7 EDG AOT ICCDP and ICLERP The licensee provided an estimate of the ICCDP and ICLERP given an EDG is unavailable for 14 days. The analysis included a number of combinations of unit, SDG alignment to electrical buses, and unavailable EDG. Reference 3 demonstrated that the results are very similar between units and do not vary much among cases where the SDGs are credited on the unit that has the EDG out of service. The results of these analyses are summarized in the following table (Reference 8):

Comparison of Unit 1 and Unit 2 EDG Outages with Projected Base Cases SDGs Aligned to:

EDG Out of Service CDF LERF ICCDP Based on Projected Base Case & 14 Day AOT ICLERP Based on Projected Base Case & 14 Day AOT Unit 1 Risk T11A/B 1AB 5.51E-5 8.82E-6 1.14E-6 1.71E-7 1CD 5.55E-5 8.77E-6 1.16E-6 1.69E-7 2AB 2.50E-5 4.25E-6

-1.46E-8

-4.10E-9 2CD 2.49E-5 4.25E-6

-1.57E-8

-4.33E-9 Unit 2 Risk T21C/D 1AB 2.50E-5 4.23E-6

-1.07E-8

-3.91E-9 1CD 2.50E-5 4.23E-6

-1.27E-8

-3.99E-9 2AB 5.73E-5 8.69E-6 1.23E-6 1.67E-7 2CD 5.57E-5 8.75E-6 1.17E-6 1.69E-7 Notes: SDG T&M unavailability and other EDG T&M unavailabilities set to 0.0 for each case. Negative values show a risk decrease on the unit when (1) the SDGs are assumed to be aligned to that unit, and (2) the EDG that is out of service is on the other unit.

As shown in the table, the largest ICCDP (1.23E-6) is somewhat above the RG 1.177 guidance of 5E-7. The largest ICLERP (1.71E-7) is somewhat higher than the RG 1.177 guidance of 5E-8.

The licensee provided a number of conservatisms that are embodied in the risk assessment, including:

No credit is taken for later use of the SDGs if the operators fail to align the SDGs and restore RCS injection within the first 30 minutes from the start of the event.

No credit is taken for an HEP below the bounding value assumed in the risk evaluation.

An HRA based on the final version of the operations procedure for aligning the SDGs will likely result in an HEP below the assumed bounding value. A more optimistic HEP would make the risk increases smaller, as demonstrated in the licensees sensitivity analysis shown in the table below.

No credit is taken for the opposite, unaffected units capability to provide RCS make-up through the charging pump cross-tie for single-unit LOOP events.

No credit is taken for any compensatory actions associated with use of the extended AOT, including no credit for a reduced probability of a LOOP because of protecting the switchyard. Normal station risk management practices direct the switchyard to be protected when specific AOTs, including the EDG AOT, are entered.

No credit is taken for extending the availability of direct current (DC) power, beyond the current 4-hour station battery life, during SBO scenarios. With the SDGs, the battery chargers will be powered, and reliance on the batteries during SBO conditions would be greatly reduced.

No credit is taken for the availability of the SDGs in the convolution analysis associated with the recovery of offsite power. If one of the two SDGs were to fail to provide power, the remaining SDG would still be capable of providing sufficient power to restore injection capability to a single unit. This alignment may require additional operator actions associated with blocking non-essential loads, and manually aligning the required loads.

The licensee also noted in Reference 8 that the bounding HEP of 5E-2 was used for the above analyses. A sensitivity of the ICCDP and ICLERP to this assumption was performed by determining these risk measures using the best-estimate HEP of 2.1E-2. The results are shown in the table below.

Sensitivity: Comparison of Unit 1 and Unit 2 EDG Outages with Projected Base Cases - Using Best-Estimate Human Error Probability (0.021)

SDGs Aligned to:

EDG Out of Service CDF LERF ICCDP Based on Projected Base Case &

14-Day AOT ICLERP Based on Projected Base Case &

14-Day AOT Unit 1 Risk T11A/B 1CD 4.99E-5 7.82E-6 9.69E-7 1.37E-7 Unit 2 Risk T21C/D 2AB 5.18E-5 7.75E-6 1.04E-6 1.35E-7 The licensee concluded that, given the decrease in baseline risk resulting from installation of the SDGs and the above identified conservatisms in the risk evaluation, the proposed change should be acceptable.

The staff notes that addition of the SDGs result in a lower risk increase when an EDG is out of service. Because the licensee has elected to keep the SDGs available a large fraction of the time, not only when an EDG is out of service, the plant baseline risk has decreased. This results in the calculated ICCDP and ICLERP being higher than if the licensee had only used the SDGs as a backup when an EDG is out of service (since the plant baseline risk would not change much in that case). This is demonstrated by the simplified, confirmatory calculation by the staff, using the licensees reported risk numbers, shown in the table below (Unit 1). The table uses the best estimate HEP of 0.021. As shown in the table, the 14-day ICCDP and ICLERP would be within the RG 1.177 guidelines if the current base risk (i.e., without credit for the SDGs at other times) were used.

Staff Confirmatory Calculation: Comparison of Unit 1 EDG Outage with Current Base Case (Unit 1) -

Using Best-Estimate Human Error Probability (0.021)

CDF LERF SDGs aligned to T11A/B 1CD EDG out of service 4.99E-5 per year 7.82E-6 per year Unit 1 Current Base Case 4.15E-5 per year 7.23E-6 per year Risk increase 8.4E-6 per year 5.9E-7 per year Incremental conditional risk over 14-day completion time ICCDP = 3.2E-7 ICLERP = 2.26E-8 Because of the conservatisms noted by the licensee and the fact that the combined change results in a decrease in plant risk, the staff considers that the extended EDG AOT is acceptable.

EDG AOT Sensitivity and Uncertainty The licensee provided a comparison of dominant accident sequences as defined in RG 1.174 (i.e, sequences contributing more than 5 percent to risk) for CDF and LERF, for both the base case and the case with the SDGs installed. Based on the information provided in Reference 3, the SDGs result in a decrease of almost 40 percent in CDF and LERF, depending upon the unit and alignment. The decrease is due to a reduction in loss of offsite power scenarios, as would be predicted. The licensee concluded that the addition of the SDGs lowers overall risk and does not exacerbate the existing risk outliers or create new risk outliers. The NRC staff finds this acceptable.

The licensee provided the percentage contributions to CDF and LERF from each initiating event, for both the base case and for when an EDG is unavailable and the SDGs are available.

Similar information was provided showing the contribution of each sequence type (e.g., LOCA, transient, etc.). The contribution to CDF and LERF from loss of offsite power initiating events, both single and dual unit, show the largest increase when an EDG is unavailable. The relative ranking of the contribution of initiating events to core damage and LERF does not change significantly between the base case and the configuration with an EDG unavailable. The licensee concluded that the information provided indicates that the SDGs effectively replace the assumed out-of-service EDG. Their conclusion is supported by the similarity in contributions to CDF and LERF between the two cases based on either internal initiating events or event type.

The staff finds this to be acceptable.

The licensee provided the results of an uncertainty analyses for both the Unit 1 and Unit 2 new base-case models with the SDGs aligned to the T11C/D safety buses (Reference 3). The results show good agreement between the results for Unit 1 and Unit 2. In addition, the licensee considered the sensitivity of the results to the human error probability assumed for the operator action to align the SDGs when needed. The ratio of the 95th percentile to the median ranges from about 2.5 to 3.6. The licensee judged that the proposed AOT changes would not significantly change the uncertainties associated with the current PRA results because uncertainties associated with the AOT changes generally affect the base case in a similar fashion (Reference 1).

EDG AOT External Events Risk Assessment External event contributions to CDF and LERF are not included in the CNP internal events PRA model. The licensee provided a qualitative assessment of the potential external events risk increase due to the EDG AOT extension to demonstrate that any increase in risk from external initiating events would be small. The licensee's qualitative discussion is summarized below.

Change in Seismic Risk The licensee stated that the EDGs were not found to be dominant contributors to seismic risk based on the IPEEE seismic analysis. The existing EDGs are rugged and the high confidence of low probability of failure (HCLPF) values compared to the sensitive components (such as miscellaneous motor control centers) are relatively large. The risk significant aspect of the EDGs is the fuel oil day tanks, each of which is located in close proximity to a block wall having a relatively low HCLPF and a correspondingly high contribution to seismic CDF. The addition of the SDGs will provide an improvement to this performance aspect, because the SDGs and their fuel supply are installed in a separate location.

The licensee concluded that, in summary, the components of interest associated with the proposed amendment play minimal roles in mitigating seismic events. Increased AOTs for these components will have minimal impact on the seismic core damage frequency. In addition, with the installation of the SDGs, the significance of the contribution from the EDG fuel oil day tanks to the seismic risk profile will be reduced.

The staff finds the above qualitative discussion to be reasonable and concludes that the proposed AOT extension would not be expected to result in an unacceptable increase in seismic risk.

Change in Flooding Risk The licensee also reviewed the effect of the proposed AOT extension on the current IPEEE flooding analysis. The plant areas reviewed were the ESW pump rooms, the CCW pump area of the auxiliary building, and the EDG rooms. The conclusion of the current flooding analysis is that the flooding contribution to CDF associated with these components is sufficiently small.

Therefore, these areas were eliminated from additional flooding analysis during initial screening in the IPEEE. The licensee concluded that the proposed AOT extension would have no effect on the CDF contribution due to flooding.

The staff considered that addition of the SDGs in the switchyard, which is a diverse location from the floods considered by the licensee, could reduce the risk of any flooding scenarios where one or both EDGs failed due to the flood, provided switchgear and mitigation equipment remained available. For any flooding scenarios that failed switchgear or mitigation equipment, the status of the EDGs would not be expected to be important. The staff agrees that the proposed AOT extension would have little or no impact on CDF due to flooding.

Change in Fire Risk The licensee qualitatively evaluated the effects of the proposed extended EDG AOT on the results of the IPEEE fire analysis. Per the IPEEE, fires in the control room dominate the CDF for internal fire events with a contribution of 1.81E-6 per year. The CDF contribution for a fire in an EDG room was estimated to be 3.04E-7 per year for EDG 1CD and 3.50E-7 per year for EDG 1AB. The fire analysis evaluation of control room cabinet fires that could cause a SBO determined that the control room SBO frequency is sufficiently small that it could be ignored.

This included the failure of the normal AC power supply for the unit and both units' EDGs. The licensee concluded that the proposed AOT extensions would have no effect on CDF due to control room cabinet fires that could cause a SBO.

The NRC staff considered whether there could be non-control room fires that could fail the available EDG and also cause a loss of offsite power to the unit. In Section 4.2 of its 1995 IPEEE submittal (Reference 6), the licensee states that a fire-induced loss of offsite power at the CNP is not a credible event, because there is adequate spatial separation, both inside and outside the auxiliary building, to preclude the possibility of a fire causing the loss of more than one source of offsite power. Based on this, the staff concluded that the risk contribution from non-control room fires would not affect the decision to extend the EDG AOT.

Other External Events The licensee stated that other external events (external flooding, high winds, etc.) were not impacted by the proposed license amendment. The staff finds this reasonable, since the change involves extending the AOT and should not impact the plant's ability to withstand such events.

Overall Tier 1 Conclusion The licensee has shown that the combined EDG AOT change results in a decrease in plant risk from internal events. The licensee has provided estimates of the ICCDP and ICLERP from internal events when an EDG is out of service that are above the guidelines in RG 1.177, but has listed conservatisms in the analysis that would reduce these numbers. The staff noted that the internal event ICCDP and ICLERP values are elevated because the base risk of the plant has been reduced by addition of the SDGs. The licensee provided a qualitative assessment of the risk from external events that concludes that the risk impact from the EDG AOT extension would be small.

Therefore, the staff finds that the licensees first tier risk evaluation, as described in Chapter 16.1 of the SRP and RG 1.177, is acceptable.

4.2.2 Tier 2: Avoidance of Risk-Significant Plant Configurations The second tier evaluates the capability of the licensee to recognize and avoid risk-significant plant configurations that could result if equipment, in addition to that associated with the proposed license amendment, is taken out of service simultaneously or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved.

The goal of the Tier 2 portion of the assessment is to provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service consistent with the proposed TS change.

The licensee describes the Tier 2 program in Sections 4.1 and 4.2.2 of the submittal (Reference 1). Procedures will be modified or developed as necessary to support use of the SDGs for an extended AOT. The licensees risk evaluation credited the availability of the SDGs when an EDG is taken out of service. The licensee stated that there were no other specific compensatory measures needed to meet the quantitative risk guidelines in RG 1.174. The existing CNP configuration risk management program, described under Tier 3 below, includes risk management compensatory measures that the licensee intends to implement for the extended EDG, as appropriate. These measures are summarized below:

Evaluate weather conditions prior to entering an extended EDG for voluntary planned maintenance. An extended AOT would not be entered for voluntary planned maintenance purposes if official weather forecasts for the plant site are predicting severe conditions (tornado, thunderstorm, or ice storm warnings). Monitor weather conditions daily in accordance with the CNP on-line risk management program, and take appropriate actions if severe weather is expected.

Restrict elective switchyard maintenance during an extended EDG AOT. In addition, restrict elective maintenance on the main, auxiliary, or startup transformers associated with the unit.

Restrict maintenance or testing that affects the reliability of the train associated with the operable EDG during an extended EDG AOT. If any testing and maintenance activities must be performed while the extended AOT is in effect, an evaluation per 10 CFR 50.65 (a)(4) would be performed.

Also, the licensee intends to restrict elective maintenance activities on the SDGs during the time they are used to support an extended AOT. Elective maintenance does not include surveillance activities, such as verifying fuel oil level. (Refer to the commitment in Section 4.0:

the SDGs will be designated as guarded equipment when the SDGs are credited as available for extending an EDG AOT.)

The information provided by the licensee indicates the capability of the licensee to recognize and avoid risk-significant plant configurations that could result if equipment, in addition to that associated with the proposed license amendment, is taken out of service simultaneously or if other risk-significant operational factors, such as concurrent system or equipment testing, are also involved. Therefore, the staff finds that the licensees second tier risk evaluation, as described in Chapter 16.1 of the SRP and RG 1.177, is acceptable.

4.2.3 Tier 3: Risk-Informed Configuration Risk Management The third tier assesses the licensees program to ensure that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. The need for this third tier stems from the difficulty of identifying all possible risk-significant configurations under the second tier that could ever be encountered. Section 4.2.3 of the licensees submittal discusses implementation of the third tier:

The goal of the Tier 3 portion of the assessment is to ensure that the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. The program is intended to provide the ability to identify risk-significant plant equipment outage configurations in a timely manner during normal plant operation.

The licensee has a configuration risk management program in place that has been developed in accordance with 10 CFR 50.65(a)(4). This program is a proceduralized risk-informed assessment process to manage the risk associated with planned and unplanned plant maintenance activities. The procedure governing the program requires an integrated (i.e., both quantitative and qualitative) review of maintenance activities to identify risk significant plant equipment outage configurations. This review is required both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities such as testing, and weather conditions. The procedure includes provisions for performing a configuration-dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. This includes consideration of appropriate defense-in-depth aspects associated with the activities.

A quantitative risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the Safety Monitor The amendment relating to the 69 kV offsite power circuit limiting conditions was previously issued on September 9, 2005. model, which is based on the CNP level 1 PRA model. The Safety Monitor software is used to assess the impact on CDF and LERF for both scheduled maintenance activities and actual plant conditions.

The results are used to support the management of the risk associated with planned and unplanned plant maintenance activities. In addition, a risk assessment is performed for both units whenever the following systems/components (as applicable), with cross-unit PRA impact, become unavailable: ESW, CCW, non-essential service water, plant air compressors (including backup air compressor), motor-driven auxiliary feedwater pumps, chemical and volume control system, AC and DC electrical distribution systems and EDGs (as support systems for the above systems/components),

Proceduralized risk management actions restrict elective risk significant plant equipment outage configurations compliant with the following comprehensive philosophy:

Weather conditions are evaluated prior to starting significant maintenance activities; The condition of the offsite power sources and switchyard are assessed prior to starting significant maintenance activities that could potentially have an effect on offsite or onsite electric power; Restrictions are imposed on switchyard maintenance; Restrictions are imposed on elective maintenance activities on redundant components; Restrictions are imposed on elective maintenance activities on components identified as risk significant given the specific maintenance activity and the current plant configuration; Requirements for pre-job briefs are specified; and Risk is re-assessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed.

The licensee stated that the The amendment relating to the 69 kV offsite power circuit limiting conditions was previously issued on September 9, 2005. model will be updated to include the SDGs prior to use of the extended AOT for the EDGs. The Safety MonitorTM model is used to perform 10 CFR 50.65(a)(4) risk assessments. This will assure that the 10 CFR 50.65 (a)(4) risk assessments take into account the availability of the SDGs. The SDGs will not be credited as "available" for extending an EDG AOT in more than one unit at a time. This restriction will be included in the bases changes associated with the proposed TS changes.

The licensee indicated that the SDGs will be designated as guarded equipment when they are credited as available for extending an EDG AOT. The CNP on-line risk procedure requires that any work activity in a guarded equipment area be reviewed to determine if the activity may cause an adverse impact on the guarded equipment. If the activity is determined to result in an adverse impact, the work may not proceed unless two individuals qualified to perform risk assessments using the Safety MonitorTM configuration risk management software determine the risk to be acceptable. This process would preclude performance of elective maintenance on the SDGs when they are credited as available for extending an EDG AOT.

The licensee indicated (Reference 2) that the SDGs will be included in its MR Program prior to crediting them as available for extending an EDG AOT. Continued SDG availability will be verified quarterly by the performance of load testing. Automatic separation of the bus powered by the SDGs (4 kilovolt bus 1) from the 69 kilovolt alternate offsite circuit will be tested once every 18 months. The verifications to be performed prior to entering an extended AOT are: 1) verifying the SDG equipment is mechanically and electrically ready for automatic operation; 2) verifying 24-hour on-site fuel supply is available for each SDG, and 3) ensuring the SDGs are aligned to automatically supply power to 69 kilovolt substation 4.16-kV bus 1.

Based on the licensees description of their program for complying with paragraph (a)(4) of 10 CFR 50.65, the staff finds that the licensees third tier risk evaluation, as described in Chapter 16.1 of the SRP and RG 1.177, is acceptable.

RISK CONCLUSION The NRC staff finds that the licensee's proposed change to revise the TS to permit extending the AOT from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 14 days for an inoperable EDG is acceptable because the five key principles of risk-informed decisionmaking identified in RG 1.174 and RG 1.177 have been satisfied.

5.0 REGULATORY COMMITMENTS The licensee has provided the following regulatory commitments:

A.

Prior to entering an extended EDG AOT, the following compensatory actions will be implemented:

Hold discussion with the system load dispatcher to 1) ensure no significant grid perturbations are expected during the extended AOT, and 2) request that the system load dispatcher inform CNP if conditions change during extended AOT such that unacceptable voltage would occur following a unit trip.

Evaluate weather conditions. An extended AOT would not be entered if official weather forecasts for the plant site are predicting severe conditions (tornado, thunderstorm, or ice storm conditions).

Evaluate the condition of the switchyard, offsite power supply, and the grid. An extended EDG AOT will not be entered to perform elective maintenance when grid stress conditions are high such as during extreme summer temperatures and /or high demand.

B.

During an extended EDG AOT, the following compensatory actions will be implemented:

Monitor weather conditions daily in accordance with the CNP on-line risk management program, and take appropriate actions if severe weather is expected.

Perform an evaluation per 10 CFR 50.65 (a)(4) if any testing and maintenance activities must be conducted.

Designate the turbine driven auxiliary feed water (TDAFW) pump as guarded equipment.

C.

The following additional compensatory actions will be implemented during an extended EDG AOT extension:

Prohibit elective switchyard maintenance during an extended EDG AOT.

In addition, prohibit elective maintenance on the main, auxiliary (Unit Auxiliary),

or startup (reserve auxiliary) transformers associated with the unit.

Prohibit maintenance or testing that affects the reliability of the train associated with the operable EDG.

Designate the SDGs as guarded equipment.

The licensee committed to designate the SDGs and TDAFW pump as guarded equipment when they are credited as available for extending an EDG AOT. The licensees on-line risk procedure requires that any work activity in a guarded equipment area be reviewed to determine if the activity may cause an adverse impact on the guarded equipment. If the activity is determined to result in an adverse impact, the work may not proceed unless two individuals qualified to perform risk assessments using the Safety Monitor TM configuration risk management software determine the risk to be acceptable. This process would preclude performance of elective maintenance on the SDGs and TDAFW pump when they are credited as available for extending an EDG AOT.

The NRC staff concludes that reasonable controls for the implementation and subsequent evaluation of the proposed changes pertaining to the above regulatory commitments are best provided by the licensees administrative processes, including its commitment management program. The above regulatory commitments do not warrant the creation of regulatory requirements.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Michigan State official was notified of the proposed issuance of the amendments. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

These amendments change the requirements with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendments involve no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration and there has been no public comment on such finding (69 FR 62476). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

8.0 CONCLUSION

The NRC staff has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

9.0 REFERENCES

1.

Letter from J. N. Jensen, Indiana Michigan Power Company to U.S. Nuclear Regulatory Commission, Donald C. Cook Nuclear Plant Units 1 and 2, Docket Nos. 50-315 and 50-316, Extension of Allowed Outage Times for Emergency Diesel Generators, 69 kV Offsite Power Circuit, Component Cooling Water, and Essential Service Water, AEP:

NRC: 4811, September 21, 2004 (ADAMS Accession No. ML042780478).

2.

Letter from J. N. Jensen, Indiana Michigan Power Company to U.S. Nuclear Regulatory Commission, Donald C. Cook Nuclear Plant Units 1 and 2, Docket Nos. 50-315 and 50-316, Partial Response to Request for Additional Information Regarding License Amendment Request to Extend the Allowed Outage Times for Emergency Diesel Generators, 69 kV Offsite Power Circuit, Component Cooling Water, and Essential Service Water (TAC Nos. MC4525 and MC4526), AEP: NRC: 5811, March 18, 2005 (ADAMS Accession No. ML050890319).

3.

Letter from J. N. Jensen, Indiana Michigan Power Company to U.S. Nuclear Regulatory Commission, Donald C. Cook Nuclear Plant Units 1 and 2, Docket Nos. 50-315 and 50-316, Remainder of Response to Request for Additional Information Regarding License Amendment Request to Extend the Allowed Outage Times for Emergency Diesel Generators, 69 kV Offsite Power Circuit, Component Cooling Water, and Essential Service Water (TAC Nos. MC4525 and MC4526), AEP: NRC: 5811-02, May 6, 2005 (ADAMS Accession No. ML051380429).

4.

Letter from U.S. Nuclear Regulatory Commission to E. E. Fitzpatrick, Review of D. C.

Cook Individual Plant Examination Submittal - Internal Events (TAC Nos. M74398 and M74399), September 6, 1996 (ADAMS Accession No. ML9609110060).

5.

Letter from U.S. Nuclear Regulatory Commission to John R. Sampson, Donald C. Cook Nuclear Plant, Units 1 and 2 Review of Individual Plant Examination of External Events (TAC Nos. M83609 and M83610), August 5, 1998 (ADAMS Accession No. ML9808110232).

6.

Letter from E. E. Fitzpatrick, Indiana Michigan Power Company to U.S. Nuclear Regulatory Commission, Donald C. Cook Nuclear Plant Units 1 and 2, Individual Plant Examination of External Events, Response to NRC Audit Concerns and Request for Additional Information, AEP: NRC: 1082K, February 15, 1995 (ADAMS Accession No. ML9502280019).

7.

Letter from E. E. Fitzpatrick, Indiana Michigan Power Company to U.S. Nuclear Regulatory Commission, Donald C. Cook Nuclear Plant Units 1 and 2, Individual Plant Examination, Response to NRC Audit Concerns and Request for Additional Information, AEP: NRC: 1082O, October 26, 1995 (IPE study, revision 1) (ADAMS Accession No. ML9510310313).

8.

Letter from J. N. Jensen, Indiana Michigan Power Company to U.S. Nuclear Regulatory Commission, Updated Information Regarding License Amendment Request to Extend the Allowed Outage Time for the Emergency Diesel Generators (TAC Nos. MC4525 and MC4526), AEP: NRC:5811-04, September 19, 2005 (ADAMS Accession No. ML052710181).

Principal Contributor: O. Chopra S. Laur Date: September 30, 2005