ML052800403

Request for Additional Information for Proposed Technical Specifications Change Request to Increase ECCS-LHSI, AFW, Quench Spray and Chemical Addition Systems Completion Times

ML052800403
Person / Time
Site:	North Anna
Issue date:	10/07/2005
From:	Hartz L Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
05-553
Download: ML052800403 (23)

Text

VIRGINIA ELECTRIC AND POWER COMPANY

RICHMOND, VIRGINIA 23261 October 7, 2005 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, D.C. 20555 Serial No.05-553 NL&OS/ETS RO Docket Nos. 50-338 License Nos. NPF-4 50-339 NPF-7 VlRG lNlA ELECTRIC AND POWER COMPANY (DOMINION)

NORTH ANNA POWER STATION UNITS 1 AND 2 REQUEST FOR ADDITIONAL INFORMATION FOR PROPOSED TECHNICAL SPECIFICATIONS CHANGE REQUEST TO SYSTEMS COMPLETION TIMES INCREASE ECCS-LHSI, AFW. QUENCH SPRAY AND CHEMICAL ADDITION In a December 17, 2004, letter (Serial No.04-381), Dominion requested amendments to Facility Operating License Numbers NPF-4 and NPF-7 in the form of changes to the Technical Specifications for North Anna Power Station Units 1 and 2. The proposed changes would increase the completion times for the Emergency Core Cooling System (ECCS) - Low Head Safety Injection (LHSI) subsystem, Auxiliary Feedwater (AFW),

Quench Spray (QS) and Chemical Addition (CA) Systems from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days. The proposed changes are based on a risk-informed evaluation performed in accordance with Regulatory Guides (RG) 1.1 74, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis, and RG 1.1 77, An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications.

In letters dated August 8 and 9, 2005, the NRC staff requested additional information to complete the review of the license amendment request. The requested information is provided in the Attachment to this letter.

Should you have any questions or require additional information, please contact Mr. Thomas Shaub at (804) 273-2763.

Very truly yours, Leslie N. Hartz Vice President - Nuclear Engineering Attach me nt Commitments made in this letter: None

Serial No.05-553 Docket Nos. 50-338/339 Page 2 of 3 cc:

U.S. Nuclear Regulatory Commission Region I I Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23T85 Atlanta, Georgia 30303 Mr. J. E. Reasor, Jr.

Old Dominion Electric Cooperative lnnsbrook Corporate Center 4201 Dominion Blvd.

Suite 300 Glen Allen, Virginia 23060 Commissioner Bureau of Radiological Health 1500 East Main Street Suite 240 Richmond, Virginia 2321 8 Mr. J. T. Reece NRC Senior Resident Inspector North Anna Power Station Mr. S. R. Monarque NRC Project Manager U. S. Nuclear Regulatory Commission One White Flint North 1 1555 Rockville Pike Mail Stop 8-Hl2 Rockville, Maryland 20852 Mr. R. E. Martin NRC Lead Project Manager - North Anna and Surry U. S. Nuclear Regulatory Commission One White Flint North 1 1555 Rockville Pike Rockville, Maryland 20852

Serial No.05-553 Docket Nos. 50-338/339 Page 3 of 3

Subject:

RAI -TS Change Fluid System Completion Time Extensions COMMONWEALTH OF VIRGINIA

)

1 COUNTY OF HENRICO 1

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz who is Vice President - Nuclear Engineering of Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of her knowledge and belief.

, 2005.

'm Acknowledged before me this 7 = day of My Commission Expires:

Notary Public Notary Public (SEAL)

Attachment Serial No.05-553 Proposed Technical Specifications Changes For Increased Fluid Systems Completion Times Response to Request for Additional Information North Anna Power Station Units 1 and 2 Virginia Electric and Power Company (Dominion)

Serial No.05-553 Docket Nos.: 50-3381339 Proposed License Amendment Request to Increase the Completion Times for the ECCS-LHSI, Auxiliary Feedwater, Quench Spray and Chemical Additions Systems for North Anna, Units 1 and 2 Virginia Electric and Power Company (Dominion)

Docket Nos. 50-338 and 50-339 By letter dated December 17, 2004, Virginia Electric and Power Company (VEPCO) submitted a risk informed license amendment request to change the Technical Specifications (TS) for North Anna Power Station Units 1 and 2, to increase the completion times for the Emergency Core Cooling System-Low Head Safety Injection (ECCS-LHSI) subsystem, Auxiliary Feedwater (AM), Quench Spray (QS) and Chemical Addition Systems (CAS) from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days. Attachment 1 to the letter dated December 17, 2004, provided a discussion to support the proposed changes to the TS. The Nuclear Regulatory Commission (NRC) staff has the following requests for additional information regarding that attachment.

The following questions were provided in two letters dated August 8 and 9, 2005.

Auqust 8,2005 NRC letter NRC Question 1 Please resolve several apparent inconsistencies concerning the use of compensatory measures to manage risk during maintenance:

a. On July 23, 2004, VEPCO was granted [ADAMS Accession No. ML04205045711 an emergency one-time TS change to extend the CT of the "A" ECCS-LHSI to 7 days.

The NRC staff granted this change, in part, because VEPCO had proposed six compensatory measures. In contrast, VEPCO is proposing to permanently change the ECCS-LHSI pump CT to 7 days without offering any specific compensatory measu res.

Dominion Response As noted in the December 17, 2004 submittal, the risk assessment did not identify any plant specific configurations that should be avoided during the entry into the 7-day completion time (CT) for planned or emerging maintenancehesting activities of the low head safety injection train. The analysis performed to support the one-time, emergency CT extension request was not as rigorous as the analysis performed to support the subsequent permanent change request to the CT.

Therefore, compensatory measures were included to provide additional assurance that the low head safety injection function would be available, if required during the ongoing low head safety injection maintenance outage, and to reduce overall plant risk. Based on the plant condition at the time of the emergency one-time 7-day CT extension for Page 1 of 19

Serial No.05-553 Docket Nos.: 50-338/339 the LHSl pump, the compensatory measures identified were implemented without any significant operational burden. However, requiring additional compensatory measures for each entry into the 7-day completion time without specific consideration of need or applicability would represent an increase in the administrative burden on plant operations without identified commensurate benefit or any significant reduction in plant risk. In addition, plant equipment availability will continue to be maintained in accordance with the 10 CFR 50.65(a)(4) program

[Configuration Risk Management Program (CRMP)] when entering a 7-day CT on a LHSl subsystem.

b. Attachment 1, Table 7 of the submittal dated December 17, 2004, identifies some plant configurations that should be avoided during specific maintenance activities.

Yet, no specific compensatory measures are offered to manage the risk during these configurations. Regulatory Guide (RG) 1.177, An Approach for Plant Specific, Risk Informed Decision Making-Technical Specifications, Section 2.3.6 provides the guidance for the use of compensatory measures. Please list and discuss each of the compensatory measures you plan to take for ECCS-LHSI TS change to reduce risk.

Dominion Response Table 7 of the December 17, 2004 letter, addresses plant configurations that are to be avoided during planned maintenance activities, which include planned entry into the proposed increased CTs. Specifically, several equipment configurations are not to be voluntarily entered, but rather to be avoided, when performing planned AFW train maintenance. There were no configurations identified for the other systems, including LHSI, which require such restrictions. Based on this Tier 2 assessment and avoidance of the identified plant configurations during AFW train maintenance, additional compensatory measures are not necessary to maintain risk at an acceptable level consistent with RG 1.177.

In addition, prior to performing scheduled maintenance the plant equipment status and the risk monitor are assessed to maintain acceptable plant risk.

c. Attachment 1, Section 5.1.2 of the submittal dated December 17, 2004, states that risk achievement worth importance measures are used to identify Tier 2 configurations. In contrast, Section 5.1.3 states that the NUMARC 93-01 risk limits are used to identify high-risk plant configurations. What specific risk metrics are used to identify high-risk plant configurations?

Dominion Response Regulatory Guide 1.177 requires a Tier 2 evaluation to ensure avoidance of risk-significant plant configurations. This requirement looks for potentially risk significant maintenance configurations to be avoided by evaluating the risk statistics of other, modeled components on an individual basis. Dominion has compared the baseline risk achievement worth (RAW) of modeled components with their RAW values while one train is out of service in the proposed AOT extension. If a risk significant components RAW increased by 10% or more, it was flagged as requiring compensatory measures. This process has been used for the Tier 2 evaluation in Page 2 of 19

Serial No.05-553 Docket Nos.: 50-338/339 other NRC approved risk-informed technical specification changes for North Anna.

An example is the inverter completion time extension submitted December 12, 2002 and approved on May 12, 2004 as amendments 235 and 217 for Units 1 and 2, respectively.

Our December 17, 2004 submittal, Attachment 1, Section 5.1.3 addresses the role that the North Anna 10 CFR 50.65(a)(4) compliance program plays in satisfying the Tier 3 risk management requirement. Rather than looking at individual risk metrics for single components, the Configuration Risk Management Program (CRMP) looks at the risk impact of every unique maintenance Configuration in advance (or as they occur, in the case of emergent configurations). The risk associated with these unique configurations is compared to the regulatory limits of 1.OE-3/yr instantaneous core damage frequency, and the cumulative limits of 1.OE-6 core damage probability and 1.OE-7 large, early release probability. Procedures direct avoidance of these limits and compensatory measures if they are exceeded, This program addresses the combined risk impact of all concurrent equipment outage combinations and any applicable periodic tests.

This risk is rigorously assessed and managed in compliance with the (a)(4) regulatory requirement. It is a very effective method of ensuring that a high-risk configuration does not occur as a voluntary or planned action. The program also identifies when a high-risk configuration has occurred by inadvertent means, which is effective in ensuring that any high-risk situation is mitigated. This approach would apply to any expected use of the proposed CT extensions concurrent with any other (a)(4) evolution.

d. How does plant management decide how many compensatory measures to impose to mitigate a given high-risk plant configuration? If several types of compensatory measures are possible, how does plant management decide which one (or ones) to impose?

Dominion Response Compensatory measures are required by Dominion procedures when a unit exceeds the 1.OE-6 core damage probability and 1.OE-7 large, early release probability limits, consistent with the 10 CFR 50.65(a)(4) regulatory requirements. Plant procedures direct the avoidance of these risk overruns, but if one inadvertently occurs, then the procedures direct the Operations staff to identify the impaired key safety function(s)

(KSF) dominating the risk. Required compensatory measures must protect and/or restore the KSFs. Generic compensatory actions are listed in the plant procedures, consistent with NUMARC 93-01, and specific actions are also developed by the plant staff based upon the specific KSFs.

NRC Question 2 Pages 7 and 8 of Attachment 1 of the submittal dated December 17,2004, evaluate the risk impacts of the proposed change to the ECCS-LHSI CT. The analyses differentiated between scheduled (preventative) activities and repair (unscheduled) activities. On Page 3 of 19

Serial No.05-553 Docket Nos.: 50-338/339 page 8, it is stated that Therefore, a higher failure probability is used for the operable train, which accounts for the possibility of common cause failure. Please explain this statement in detail, identifying which events in the probabilistic risk assessment (PRA) model have been modified and discussing how the higher failure probability was calculated. Was this approach also used during the risk evaluation of the proposed CT extensions for the QS and AFW systems? If so, provide the same information as requested above for the ECCS-LHSI subsystem.

Dominion Response Unscheduled maintenance is assumed to occur due to a component failure. It cannot be known whether any potential failures would be entirely random or a first manifestation of a common cause failure (CCF) that will also impact the redundant train(s).

In order to account for a potential common cause fault, the redundant components in each risk calculation are assigned an increased CCF risk in the corrective maintenance calculation. Their nominally low CCF terms are reset to the level of their a-factor, the conditional probability of failure given the prior failure of a redundant component. The same strategy was used for all systems included in the license amendment.

NRC Question 3 Section 5.1.3 of Attachment 1 of the submittal dated December 17, 2004, indicates that the Safety Monitor tool is used to monitor, analyze, and manage the systems addressed by the proposed TS change as part of the plants Maintenance Rule program, 10 CFR 50.65(a)(4). Page 13 indicates that the Safety Monitor model explicitly accounts for grid loading and stability. Please explain how the Safety Monitor achieves this capability.

Are the loss of offsite power frequency and offsite power recovery probabilities being changed as grid conditions change? What is the technical basis for changing the affected numerical values used in the PRA model? How often is the Safety Monitor updated to reflect current grid conditions?

Dominion Response The North Anna 10 CFR 50.65(a)(4) program has explicit requirements to address grid instability. First, the Operations staff will enter Abnormal Procedure (AP) 0-AP-8, Response To Grid Instability, upon system operator notification of grid disturbances or heavy loads; 500 kV voltage drops; or any annunciated off-normal switchyard bus frequency.

One of the required actions in the AP is an update of the current 10 CFR 50.65(a)(4) analysis. The Shift Technical Advisor (STA) performs this update.

The Safety Monitor software includes a specific term for 0-AP-8 entry. When activated, this term increases the nominal frequency for a potential loss of offsite power (LOOP) event. The term also increases the probability of the loss of the major switchyard buses that supply the Reserve Station Service Transformers. As per the 10 CFR 50.65(a)(4) guidance documentation, this term must remain in use until the Operations staff exits 0-AP-8.

Page 4 of 19

Serial No.05-553 Docket Nos.: 50-3381339 When in use, the 0-AP-8 term increases the nominal LOOP value (based upon industry data, updated via Bayesian methods to address actual plant history) from its median 50% value to the 95% upper limit on the LOOP probability distribution. A similar method is used to increase the bus failure terms.

These adjustments adequately bound potential grid vulnerability and thus the LOOP recovery probability remains unchanged.

Core damage and large, early release risk is then recalculated with these new values to identify any needed compensatory measures.

NRC Question 4, Section 5.1.4 of the submittal dated December 17, 2004, states that the risk assessment of external events has not been updated since completion of the individual plant examination of external events (IPEEE).

However, significant modifications (as identified in Attachment 1, Enclosure 2) have been made to the PRA since completion of the individual plant examination. Therefore, the conclusions of the IPEEE may no longer constitute an adequate technical basis for deciding whether or not a proposed plant maintenance configuration has acceptable risk. Assess the impact on the IPEEE conclusions concerning fire risk from each of the PRA modifications identified in Attachment 1, Enclosure 2.

Dominion Response, Enclosure 2 lists 24 significant changes made to the North Anna internal events model since the IPEEE was completed. These changes consist primarily of modeling improvements that have minimal impact upon the validity of the IPEEE.

These changes have largely been responsible for the order-of-magnitude reduction in the calculated core damage frequency in the approximate 15 years since the IPE was issued (currently 1.1 E-5/yr, down from the original IPE estimate of 7.1 E-5/yr for internal events plus flooding). While the IPEEE has not been updated, this fact does not reflect any deficiency, but instead means that the IPEEE likely retains considerable conservatism. Therefore, the IPEEE still constitutes an adequate technical basis for evaluating maintenance configuration risk due to external events, including fire risk.

NRC Question 5 Identify the risk-significant fire scenarios during scheduled (preventative) maintenance and repair (unscheduled) activities on the ECCS-LHSI subsystem, the QS system, and the AFW system.

Dominion Response The sequences identified in the table below contributed at least 2% to the total fire CDF.

Some of their cutsets included maintenance unavailability. None of these sequences fail the LHSI or QS systems.

Page 5 of 19

Serial No.05-553 Docket Nos.: 50-338/339 NRC Question 6 The fire-induced vulnerability evaluation (FIVE) methodology identifies risk-significant fire scenarios by performing a series of successive screening steps to the baseline internal events PRA. Justify the use of qualitative assessments, based on extrapolating the results of the FIVE methodology, to identity the risk-significant fire scenarios of a proposed plant maintenance configuration (i. e., when specific equipment is planned to be out of service).

Dominion Response The FIVE methodology was a valid screening process in support of the IPEEE fire analysis, which quantified the North Anna fire risk as a small fraction of the total internal events core damage frequency. Maintenance makes an even smaller contribution to fire risk. For example, the largest contributor of any fire sequence is an ESGR fire that destroys both motor-driven AFW pump breakers and contributes 8.2% to fire risk.

Maintenance contributes only approximately 0.6% of this sequences 8.2% contribution.

A small contribution to fire risk, which is a small fraction of total plant risk, will not be significantly affected by a potential doubling of the CT for the AFW pumps. In fact, the actual maintenance unavailabilities are not expected to increase in proportion to the CT extension for any of these fluid systems. Therefore, it is valid to extend the use of the FIVE screenings in support of the proposed CT extensions.

NRC Question 7 Page 6 of 19

Serial No.05-553 Docket Nos.: 50-338/339 When was the industry peer review of the PRA conducted?

Do the facts and observations presented in Attachment 1, Enclosure 1 reflect all of the findings of this review having a significance level of A or B, or only the set of unresolved findings judged to be applicable to the proposed TS change? Please state what progress has been made in resolving the complete set of peer review facts and observations (including those having a significance level of A, B, C, or D), and describe the plan to reach complete resolution of them.

Dominion Response The North Anna PRA model peer review was conducted in July 2001. Enclosure 1 lists all of the A and B level findings and observations from the peer review. These findings have all been resolved, or are scheduled for resolution, by model or program changes.

Most of the remaining items are currently being addressed to support Dominions Mitigating Systems Performance Indicator (MSPI) implementation. The remaining C and D level items are of low significance and are scheduled for resolution at a later time. All outstanding items are scheduled for resolution during upcoming model or program revisions.

NRC Question 8 Concerning Attachment 1, Enclosure 1, please amplify the Impact on Application discussion about Peer Review Fact and Observation SY-14, which implies that the PRA model does not address the risk due to internal flooding scenarios.

In contrast,, Enclosure 2, Item 3 indicates that internal floods were added to the living PRA. Do the PRA and safety monitor models address internal floods?

Dominion Response Peer review fact and observation SY-14 discussion stated that There are no

[dependencies] between increases in test and maintenance unavailability for the affected systems in this application and the flooding model. This statement correctly notes that the proposed fluid systems CT changes are fully independent of flood risk.

Internal flooding was added to Dominions Licensing PRA model and to the Safety Monitor model in 2002, after the peer review was conducted.

NRC Question 9 Describe the process used to evaluate the risk of emergent conditions. Specifically, describe the following:

a. Who performs and reviews the risk evaluation?

b. How long does it take to perform and review the risk evaluation?

Page 7 of 19

Serial No.05-553 Docket Nos.: 50-338/339

c. Describe how the impact of external events (e.g., fires) is addressed when evaluating the risk of emergent conditions.

Dominion Response

a.

b.

C.

When an emergent configuration occurs, the Unit Senior Reactor Operator (SRO) is responsible for performance of the risk assessment. The SRO will usually delegate this responsibility to the STA.

The plant staff uses the Safety Monitor software for their risk assessments. The process for updating the Safety Monitor risk calculation requires only a few minutes.

There is no regulatory requirement for a formal review and none is performed.

Flooding risk has already been integrated into the 10 CFR 50.65 (a)(4) model.

Fire risk is not integrated into the 10 CFR 50.65(a)(4) risk assessment process.

North Anna has a comprehensive fire protection program, which includes detailed requirements for compensatory measures.

Similarly, seismic risk is not integrated into the 10 CFR 50.64(a)(4) program. This risk is addressed by crediting the existing seismic design requirements, snubber operability included in the Technical Requirements Manual, and the administrative requirements for seismic housekeeping.

NRC Question 10 Describe any reviews, benchmarking, or other approaches used to ensure the technical adequacy of the Safety Monitor.

Dominion Response The Safety Monitor is the PRA model for 10 CFR 50.65(a)(4) applications. It uses the same risk model as those used for all other regulatory applications. When the 10 CFR 50.65(a)(4) model was originally developed, it was benchmarked to the existing IPE based model. Since that time, the benchmarking has been repeated during every model revision. The benchmarking process includes a comparison of several dozen unique plant configurations as analyzed by the two models.

NRC Question 11, Section 5.2 of this license amendment provides the list of Defense-in-Depth Assessment elements. This section does not discuss how you meet these requirements for defense-in-depth for the ECCS-LHSI, QS and AFW system TS changes.

RG 1.1 77, Section 2.2.1 discusses the defense-in-depth guidance for risk-informed TS change. Please provide detailed discussion regarding each element of defense-in-Page 8 of 19

Serial No.05-553 Docket Nos.: 50-338/339 depth, how you meet these requirements for ECCS-LHSI with the increase in completion times from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days.

Dominion Response Auxiliary Feedwater (AFW) System Dominion is committed to a requirement that operator action cannot be assumed for 30 minutes after a Main Feed Line Break (MFLB). Originally, the system was designed with both motor-driven AFW pumps and the turbine-driven AFW pump aligned to all steam generators. With the original AFW System design, the limiting MFLB was a break between a steam generator and the first check valve upstream of the steam generator. This break could have resulted in the loss (out of the break) of flow from all AFW pumps and the inventory of the adjacent steam generator. The operator would then have less than 10 minutes (with availability of offsite power) in which to isolate flow out of the break before the possibility that core damage and overpressurization of the Reactor Coolant (RC) System could occur.

In order to meet the requirement of 30 minutes with no operator action, the original system alignment was modified so that each steam generator is fed by a dedicated AFW pump (one-to-one modification), resulting in three independent flow paths. The dedicated line-up ensured the required flow from one AFW pump to a single steam generator initially, and, assuming operator action within 30 minutes, from two AFW pumps to two steam generators after 30 minutes. The analysis assumed the turbine-driven pump flow was lost out of the break, one of the two motor-driven pumps was lost due to a single failure, and the remaining motor-driven pump fed its dedicated steam generator. Also, it was assumed that cross-connect valves on the pump discharge lines allowed any ARN pump to be aligned to any steam generator to allow feeding two steam generators within 30 minutes. MFLB analyses were conducted by Westinghouse for this dedicated pump approach, with and without offsite power available, and demonstrated that the results were less severe than the analyses for the original system alignment. The assumptions used in the historical dedicated pump approach analyses were identical to those used in the original analyses except as noted below.

1. At the time of reactor trip, the intact steam generator water levels were at the low-level trip setpoint and the faulted steam generator water level was at the low-low level trip setpoint.

2. The AFW System delivered 340 gpm (total) to the intact steam generators in the dedicated pump analyses instead of the 350 gpm used in the original analyses.

The referenced analyses demonstrated that the operator had in excess of 30 minutes in which to take action to increase the AFW flow to the intact steam generators. During this interval of time, the RC System pressure did not exceed the safety valve setpoint (plus 3 percent accumulation) and the RC System water level did not fall below the top of the core.

Page 9 of 19

Serial No.05-553 Docket Nos.: 50-338/339 To accommodate the dedicated pump approach, an additional discharge path was added such that the turbine-driven AFW pump could be realigned to the A steam generator while being isolated from the original redundant headers. An MOV was added in this line to allow remote isolation of the turbine-driven pump in event of a feedline or main steam line break. An orifice was also added to limit the turbine-driven pump flow to less than or equal to 900 gpm, which was the requirement at that time, to a faulted generator to prevent overpressurization of the containment. The original flow paths and motor-driven pumps were aligned to provide dedicated alignments to the B and C generators. The alignment requires the positioning of the AFW flow-control valves and locking open or closed appropriate manual valves to ensure the dedicated alignment.

As a result of the above change, the system required three independent trains, each of which was dedicated to a single steam generator during the first 30 minutes of the line-break events. The change also required that the system have the capability for the operators to realign the pumps to provide flow to at least two steam generators within 30 minutes of the start of the event. In addition, the change precluded operation of the plant with one steam generator isolated.

Emergency Core Cooling System - Low Head Safety Injection (ECCS-LHSI)

The ECCS consists of two separate subsystems: High Head Safety Injection (HHSI) and Low Head Safety Injection (LHSI). Each of the two subsystems consists of two 100% capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences.

This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.

Three accumulators are provided, each containing a minimum volume of 7580 gallons of borated water. The accumulators provide rapid refilling of the lower core basket in the event of a Loss of Coolant Accident (LOCA). In analyzing the LOCA, the contents of one accumulator are assumed to spill into the containment via the postulated break.

Assuming that all accumulator water injected prior to the end of the blowdown phase bypasses the core and is lost out of the break adds conservatism to the safety analysis.

Three HHSl pumps are provided. On receipt of a Safety Injection (SI) signal, only two (HHSI pumps A and B) of the three HHSl pumps automatically start. These two pumps will be powered from separate buses to minimize loads on each emergency bus. HHSl pump A receives 4160V ac power from bus H and the B pump receives 4160 V ac power from bus J. HHSl pump C (swing pump) can only be manually started, but can be powered from either the J or H emergency buses. An interlock prevents HHSl pump C from being powered from both emergency buses simultaneously. In the event of a Safety Injection signal coincident with a loss of offsite power, interlocks prevent automatic operation of two HHSl pumps on the same emergency bus to prevent overloading the emergency diesel.

Two LHSl pumps are provided. In the recirculation mode, all the water to the HHSl pumps is provided from the LHSl pumps. Under a postulated single active failure of a Page 10 of 19

Serial No.05-553 Docket Nos.: 50-338/339 LHSl pump, the remaining LHSl pump has enough NPSH available to supply water to two HHSl pumps.

The Boron Injection Tank (BIT) contains concentrated boric acid solution (1 2,950 ppm to 15,750 ppm) and is connected to the discharge of the HHSl pumps. Upon actuation of the SI System, the HHSl pumps provide the motive force necessary for the flow of the boric acid into the RCS. The redundant design of the HHSl pumps, BIT isolation valves, tank heaters, and the recirculation of the BIT contents ensure proper operation of the BIT on receipt of a SI signal.

Quench Spray (QS) System The QS System is composed of two independent trains, each of which is capable of performing the system design bases requirements without the operation of the other train. The A train is powered from the 480V, H Emergency Bus and the B train is powered from the 480V, J Emergency Bus (Unit 1, Unit 2 similar). Each train of the QS system is equipped with a stainless steel strainer on the discharge of its associated QS pump. The strainer ensures that no debris will reach and clog the spray array.

The QS system is initiated by a Phase B containment isolation signal. The Phase B containment isolation is initiated either by high-high containment pressure or by manual actuation of the containment pressurization circuitry. The Phase B isolation requires a two-out-of-four logic, which will provide a defense-in-depth.

Chemical Addition System (CAS)

The chemical addition tank and the RWST are connected by a pipe that conveys the sodium hydroxide solution from the bottom of the chemical addition tank through a 6-inch diameter opening to the volume within the weir in the RWST. There it mixes with the borated water flowing to the QS subsystems and flows through two 1 O-inch diameter openings located symmetrically on either side of the 6-inch inlet.

Two parallel redundant motor-operated valves are located in the line between the chemical addition tank and the RWST. The valves are closed during normal unit operation to prevent mixing of the sodium hydroxide solution with the water in the RWST. As water is pumped out of the RWST, the sodium hydroxide solution flows under its hydrostatic head from the chemical addition tank to the RWST, keeping the liquid levels in the two tanks together once the connecting valves are opened. The height of the chemical addition tank has been chosen so that the column of sodium hydroxide in the chemical addition tank and the column of water in the RWST are in hydrostatic balance after the valves open. When 400,000 gallons of water have been withdrawn from the RWST, the chemical addition tank is empty. The only active component in the system is the parallel discharge isolation valves. Although the iodine removal capability is reduced when the CAS is inoperable, the QS system is still capable of removing iodine from the containment atmosphere.

Page 11 of 19

Serial No.05-553 Docket Nos.: 50-3381339 ECCS - LHSl Subsystem - RG 1.177 Defense is Depth The LHSl subsystem has two trains to perform its safety function and provide defense-in-depth. Its overall risk significance is due to the combined likelihood of initiating events leading to LHSl subsystem demand and the system unavailability.

The LHSl subsystem is credited for mitigation of accidents where a loss-of-coolant accident (LOCA) occurs, and low-pressure injection and post-LOCA recirculation is required. These LOCA events include small break LOCAs, large break LOCAs, RCP seal LOCAs, and feed & bleed scenarios where steam generator makeup capability is lost. The specific sequences requiring LHSl mitigation are relatively low frequency.

The combined effect on defense-in-depth from the proposed AOT extension is minor as demonstrated by meeting the acceptance criteria in Regulatory Guides 1.174 and 1.177. The risk significance of this change is low due to the small change in LHSl unavailability combined with the low likelihood of events requiring its function.

The specific criteria of RG 1.177, Section 2.2.1 for maintaining defense-in-depth are listed in double quotes (") as follows.

"A reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation is preserved, i.e., the proposed change in a TS has not significantly changed the balance among these principles of prevention and mitigation..."

The proposed AOT change maintains the balance between prevention and mitigation. An extension of the existing LHSl AOTs does not increase the likelihood of any accident, nor create the probability of any new accident. Mitigation capability is maintained because the overall LHSl subsystem unavailability is not significantly increased. The proposed AOT extension is a minor adjustment below the level of risk significance, as demonstrated by compliance with the numerical RG 1.174/1.177 risk limits.

"Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided, e.g., use of high reliability estimates that are primarily based on optimistic program assumptions."

North Anna was designed with significant and appropriate layers of defense-in-depth. This fact is demonstrated in the low overall plant risk (nominal CDF approximately 1.1 E-5/yr) and the scarcity of highly risk-significant components.

While programmatic protection plays an important role in maintaining low plant risk, North Anna does not rely excessively upon any program for protection. In fact, the historical maintenance unavailability of the LHSl trains has been below the Maintenance Rule performance criteria set for this system.

"Whether there are appropriate restrictions in place to preclude simultaneous equipment outages that would erode the principles of redundancy and diversity... I '

Page 12 of 19

Serial No.05-553 Docket Nos.: 50-338/339 Technical Specifications already limit the outages of redundant trains of safety-related equipment.

In addition, the Dominion 10 CFR 50.65(a)(4) compliance program quantitatively evaluates all maintenance configurations to ensure that risk is adequately managed. This evaluation addresses redundant trains and all risk significant dependencies. Historically, the North Anna units have been shown to consistently operate far below the NUMARC 93-01 risk levels where compensatory measures are required.

"Whether compensatory actions to be taken when entering the modified AOT for preplanned maintenance are identified..."

No compensatory actions have been identified as necessary. The risk analyses have shown that the RG 1.174 and 1.177 limits are satisfied without the use of any compensatory measures, even if actual unavailability increases in proportion to the proposed AOT extension.

"Whether voluntary removal of equipment from service during plant operation should not be scheduled when adverse weather conditions are predicted or at times when the plant may be subjected to other abnormal conditions..."

In the event of severe weather, the North Anna Operations staff will enter their Abnormal Procedure for severe weather. This procedure includes steps to close various doors and take other actions to protect safety-related equipment from severe weather. It also includes a requirement to update the (a)(4) analysis, which will increase the calculated risk of a potential loss of offsite power. If the results approach or exceed the (a)(4) regulatory limits for instantaneous or sustained risk, then plant procedures require the implementation of compensatory measures to reduce risk by protecting the key safety functions. This program is comprehensive and has consistently maintained North Anna plant risk far below the NUMARC 93-01 risk levels where compensatory measures are required.

Therefore, it is not necessary to supplement this program with additional precautionary measures.

"Whether the impact of the TS change on the safety function should be taken into consideration. For example, what is the impact of a change in the AOT for the low-pressure safety injection system on the overall availability and reliability of the low-pressure safety injection function?"

The current risk contribution of LHSl pump unavailability is not risk significant. The LHSl risk contribution remains below the RG 1.174/1/1.177 limits when the AOT is increased from 3 to 7 days.

"Defenses against potential common cause failures are maintained and the potential for introduction of new common cause failure mechanisms is assessed, e.g., TS change requests should consider whether the anticipated operational changes with a change in an AOT or STI could introduce any new common cause failure modes not previously considered."

Page 13 of 19

Serial No.05-553 Docket Nos.: 50-338/339 No new CCF vulnerabilities are expected. These proposed TS changes have been requested to reduce the potential number of plant transients (i.e., shutdowns and restarts) when maintenance requires more than three days. The changes will allow the plant staff to continue to operate at a steady state 100% while maintenance is completed.

"Independence of physical barriers is not degraded" No physical barriers will be degraded by the proposed TS change. The LHSl subsystem provides protection of the fuel cladding and RCS barriers.

The independent containment cooling (spray) systems provide protection of the Contain men t barrier.

"Defenses against human errors are maintained, e.g., TS change requests should address whether the anticipated operational changes... could change the expected operator response or introduce any new human errors... such as the change from performing maintenance during shutdown to performing maintenance at power when different personnel and different activities may be involved."

No new potential human errors are expected. The proposed extensions have been requested to provide additional time for the completion of maintenance that would have required a plant shutdown during the current 72-hour AOTs. Maintenance, whether extending three days or seven days, requires the support of different maintenance shifts and thus, no new risk factors due to personnel change are introduced. The overall risk impact of performing maintenance at power is not significantly changed (less than the RG 1.1 74/1.177 limits) between a 7-day AOT relative to the 72-hour AOT. In fact, the risk increase of the proposed change will be partially or wholly offset by the absence of the shutdown/restart transient risk.

"The intent of the General Design Criteria in Appendix A to 10 CFR Part 50 is maintained" The General Design Criteria are fully satisfied by the existing Technical Specifications Allowed Outage Times. The proposed extensions are only slight perturbations of the risk associated with these AOTs, offset by the reduction in shutdownhestart transient risk, and therefore do not affect compliance with Appendix A.

NRC Question 12, Section 5.1 stated the following:

"The Chemical Addition System is not mode,&( in the North Anna PRA model due to its limited ability to impact the magnitude of a radioactive release from the Containment in severe accidents and the limited corrosion damage which might occur to equipment over the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> from a non-alkaline pH.

In severe Page 14 of 19

Serial No.05-553 Docket Nos.: 50-338/339 accidents, the iodine release is so large that the Chemical Addition System is assumed incapable of scavenging a significant portion of the iodine. Also, as long as the Containment integrity is maintained in a severe accident, studies have shown that the radioactive release from the Containment cannot cause a large early release as defined in Regulatory Guide 1.1 74. If the Containment fails in a severe accident,

[then] there is insufficient NaOH available in the Chemical Addition System to impact the consequences of the large iodine release.

The licenses is requested to respond to the following questions related to the text above:

a. The role of the CAS is to maintain sump water pH at or above 7 by the addition of NaOH. When this is performed, most of the radioactive iodine will stay dissolved in the sump water and is prevented from leaking to the outside. Why is the CAS system incapable of maintaining dissolved (scavenged) iodine in the sump water?

Dominion Response The NaOH tank was designed to mitigate the consequences of an iodine release with an intact containment. The tank meets its design and licensing requirements. It was not designed to mitigate the consequences of a release with containment failure. Further, iodine is only one of the isotopes which would be released to containment during a severe accident. When containment is maintained intact, the risk consequences of the proposed AOT remain negligible and have been screened out. If the containment fails, then the tank will not significantly mitigate the release at either the current or the proposed AOT.

b. What quantifies a relatively small radioactive iodine release?

Dominion Response Dominion did not use this expression in the subject license amendment nor is aware that the magnitude of such release has been quantified. The license amendment addresses the likelihood of large, early releases associated with the proposed changes in accordance with Regulatory Guide 1.174.

Regulatory Guide 1.174, Section 2 defines a large, early release as follows.

In this context, LERF is being used as a surrogate for the early fatality QHO.

It is defined as the frequency of those accidents leading to significant, unmitigated releases from containment in a time frame prior to effective evacuation of the close-in population such that there is a potential for early health effects. Such accidents generally include unscrubbed releases associated with early containment failure at or shortly after vessel breach, containment bypass events, and loss of containment isolation. This definition is consistent with accident analyses used in the safety goal screening criteria discussed in the Commissions regulatory analysis guidelines.

Page 15 of 19

Serial No.05-553 Docket Nos. : 50-338/339 Since there is no known regulatory definition for a "relatively small" radioactive release, this parameter cannot be quantified.

c. Since NaOH is normally added to the sump water by the chemistry addition system to keep most of the iodine dissolved, the amount of iodine released to the outside should be, therefore, only a function of the condition of the containment.

Obviously the amount of iodine released to the outside will be higher for a failed containment. Therefore, why is the amount of NaOH insufficient to impact the consequences of the large iodine release?

Dominion Response The NaOH tank was designed to mitigate the consequences of an iodine release with an intact containment. The tank meets its design and licensing requirements. It was not designed to mitigate the consequences of a release with containment failure. Further, iodine is only one of the isotopes which would be released to containment during a severe accident. When containment is maintained intact, the risk consequences of the proposed AOT remain negligible and have been screened out. If the containment fails, then the tank will not significantly mitigate the release at either the current or the proposed AOT.

NRC Question 13 The licensee should provide justification for the proposed completion time for the CAS, including how the proposed CT takes into account the ability of the spray system to remove iodine at a reduced capability and the low probability of the worst case Design Basis Accident occurring during this period.

Dominion Response The Chemical Addition Tank (CAT) has been screened out of the PRA model. This screening occurred because none of the CAT functions was found to be risk significant.

The CAT contains a sodium hydroxide solution that performs three functions:

The sodium bonds with iodine, forming sodium iodide, which is a less mobile radioiodine molecule. This function was screened out because much of the radioiodine already remains in solution in the sump where it does not transport easily. This is not a CDF function and it is not a significant LERF issue.

The hydroxide provides long-term sump protection from the boric acid in the RCS.

Its function was screened out because there were no short-term concerns.

The CAT provides additional inventory for RCS cooling. It is a small volume compared to the RCS and not a significant contributor.

Page 16 of 19

Serial No.05-553 Docket Nos.: 50-3381339 NRC Question 14, Table 7 lists Tier 2 considerations for when one AFW pump is out of service (inoperable). Insert 4 is a TS Bases addition listing these considerations andlor constraints. The licensee is requested to provide a discussion and justification of these constraints.

Dominion Response These Tier 2 constraints were developed by examining the risk achievement worth (RAW) for various plant components with and without an AFW pump removed from service for maintenance. In the Dominion Maintenance Rule program, a component is considered risk significant if its RAW exceeds 2. Dominion has concluded that if the RAW for a risk significant component increases by more then 10% with an AFW pump out of service, relative to its baseline risk, then that component could potentially contribute to a Tier 2 configuration. These components were identified and listed in Table 7 of the original submittals Attachment 1.

These constraints are redundant with the Dominion Configuration Risk Management Program [lo CFR 50.65(a)(4)], which already monitors all components in all configurations.

Planned maintenance configurations are analyzed in advance to determine whether any 10 CFR 50.65(a)(4) limit might be approached or exceeded. If so, the Dominion Maintenance Rule program addresses the regulatory requirement by rescheduling to avoid the conditions approaching the risk limit or, if necessary, implementing compensatory measures.

August 9,2005 NRC letter The NRC staff has the following requests for additional information on the AFW system.

NRC Question 1 The proposed CT change for TS 3.7.5 will allow parts of the AFW system to be unavailable for additional time, while inoperable equipment is being restored. There is a need to determine how this unavailability will impact plant safety and operation.

As pointed out below, explain how the impact of the proposed CT change is consistent with maintaining the following attributes of the defense-in-depth (DID) philosophy for the AFW system. In addressing each DID attribute, explain the basis for the conclusion reached.

a. A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

For this attribute, address the part referring to consequence mitigation. Since the proposed completion time change increases the time that one AFW system train is inoperable, explain how consequence mitigation associated with AFW train Page 17 of 19

Serial No.05-553 Docket Nos.: 50-338/339 inoperability remains unaffected using an example (e.g., mitigating loss of main feedwater).

Dominion Response In this specific case, the consequence to be mitigated is a loss of decay heat removal. The PRA model includes the AFW pumps and their dependencies. The model includes accurate point estimates for the initiating events, including a potential loss of Main Feedwater (MFW), that may require AFW and the potential loss of the redundant trains of AFW. The model also includes the capability of the MFW and Condensate Systems to serve as backups in the unlikely event of a complete loss of AFW. In the event of a loss of all three of these systems, decay heat can also be removed by primary feed and bleed. This detailed model was used to establish that the potential use of a 7-day CT results in an excess risk that is well below RG 1.174 and 1.1 77 limits.

b. System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties.

On page 11 of the license amendment request, the licensee states that the North Anna probabilistic risk assessment model requires AFW for decay heat removal for all events except for large loss-of-coolant (LOCA). Success criteria is 1 of 3.

AFW pumps for all events requiring the AFW system for decay heat removal, except for: 1) station blackout which requires 1 of 1 TD pump and 2) for small and medium LOCAs with HHSl failure which requires 2 of 3 AFW pumps.

The frequency of small and medium LOCAs is high and the consequences of a station blackout event with an inoperable turbine-driven pump are very significant.

Given the proposed completion time change, explain how maintaining the redundancy and diversity of the AFW system will be affected for event challenges to the system, as noted above. In particular, address the inoperability of a turbine-driven pump.

Dominion Response The North Anna Auxiliary Feedwater System consists of two independent, motor-driven 100% capacity pumps powered from different emergency buses, plus a turbine-driven 200% capacity pump. This design provides both redundancy and diversity. The turbine-driven pump provides AFW flow during a station blackout event when all electrical power is lost. The proposed CT extension meets the Regulatory Guides risk criteria because the SBO is a very low frequency event. In order for an SBO to occur, there must be a loss of offsite power (LOOP) and a loss of both emergency buses on one unit. The current CT is short (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />), and the proposed extension to 7 days is only a slight increase. The concurrent probability of Page 18 of 19

Serial No.05-553 Docket Nos.: 50-3381339 a LOOP AND the loss of both emergency buses AND an AFW outage is so small that it meets the RG criteria with margin to spare. Thus, the redundancy and diversity of the AFW system will not be significantly affected by the proposed CT extension.

NRC Question 2 The proposed CT changes will make the CT to be 7 days and the total time from discovery of the failure to meet the limiting condition for operation to be 14 days for Required Actions A.l and 6.1 of TS 3.7.5. Since the completion time and the total time are the same for the two required actions, address making Required Actions A.l and B.l into a single action with an action condition that states "one AFW train inoperable in MODE 1, 2 or 3."

Dominion Response Required Actions A.1 and 6.1 are specified for different degrees of equipment inoperability. Condition A deals with an inoperable steam supply to the turbine driven AFW pump. There are two steam supplies to the turbine driven AFW pump. Thus, this condition and the associated completion time deals only with the reliability of the steam supply and not with the inoperability of an AFW train.

This CT is supported deterministically. Whereas, Condition B deals with an inoperable train of AFW, where that train is not capable of performing its intended safety function. This CT is supported by the risk assessment provided in the original license amendment. Combining the two Conditions would be overly restrictive for an inoperable steam supply to the turbine driven AFW pump. Although the CTs are the same, the two Conditions address different levels of system degradation.

Therefore, consistent with the Standard Technical Specifications, Dominion will maintain the two Conditions, as discussed in the original December 17, 2004 submittal.

Page 19 of 19