ML060310298

Response to NRC Request for Information Proposed Change Number-548 Battery and DC Sources Upgrades and Cross-Tie

ML060310298
Person / Time
Site:	San Onofre
Issue date:	01/26/2006
From:	Scherer A Southern California Edison Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
PCN-548
Download: ML060310298 (56)

Text

SOUTHERN CALIFORNIA U EDISONa An EDISON INTERNATIONAL9 Company A. Edward Scherer Manager of Nuclear Regulatory Affairs January 26, 2006 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001

Reference:

Docket Nos. 50-361 and 50-362 Response to NRC Request for Information Proposed Change Number (PCN)-548 Battery and DC Sources Upgrades and Cross-Tie San Onofre Nuclear Generating Station, Units 2 and 3 Letter from Dwight E. Nunn (SCE) to Document Control Desk (DCD),

dated December 17, 2004,

Subject:

'Proposed Change Number (PCN)-548), Battery and DC Sources Upgrades and Cross-Tie"

Dear Sir or Madam:

This letter responds to three sets of questions from the NRC staff reviewers regarding the subject license amendment request, PCN-548, included as Enclosure 1.

As part of the review to respond to these questions, several changes were identified to our original submittal (referenced above). The changed pages are included as. Please note Enclosure 2 includes changes to the numerical value of specific gravity in Limiting Condition for Clperation 3.8.6. The inclusion of specific gravity as a surveillance parameter was a carry over from the existing Technical Specifications and a site-specific difference from the implementation of Technical Specification Task Force (TSTF)-360, Revision 1; removing this parameter will make this feature in agreement with TSTF-360, Rev. 1.

In light of the above discussed changes and the intention to remove specific gravity as a surveilled parameter, there will be a complete revision to our original submittal to incorporate changes described in the responses to these questions. The revised amendment will be submitted to the NRC in February 2006 and this will completely supersede our submittal of December 17, 2004.

P.O. Box 128 San Clemente, CA 92672 949-368-7501 Fax 949-368-7575 Aoo I

Document Control Desk January 26, 2006 If you have any questions or require additional information, please contact Jack Rainsberry at (949) 368-7420.

Sincerely,

Enclosures:

1. Response to NRC Questions (includes three parts).

2. Changed pages to PCN-548.

cc:

B. S. Mallett, Regional Administrator, NRC Region IV C. C. Osterholtz, NRC Senior Resident Inspector, San Onofre Units 2 & 3 N. Kalyanam, NRC Project Manager, San Onofre Units 2 and 3 Response to NRC Questions

REQUEST FOR ADDITIONAL INFORMATION RESPONSE, PART 1:

PROBABILISTIC SAFETY ASSESSMENT BRANCH (SPSB) REQUEST FOR ADDITIONAL INFORMATION PROPOSED TECHNICAL SPECIFICATION CHANGE REQUEST FOR BATTERY AND DC SOURCES UPGRADES AND CROSS-TIE (PROPOSED CHANGE NUMBER (PCN)-548)

SAN ONOFRE NUCLEAR GENERATING STATION, UNITS 2 AND 3 (DOCKET NO'S 50-361 AND 50-362)

NOTES:

A. In the following, Southern Calflornia Edison (SCE) responds to the Request for Additional Information (RAI) issues concerning the original License Amendment Request (LAR), PCN-548. We have recently demonstrated that battery float current can be measured at *2.0 Amps. Consequently, there is no longer any reason to carry forward the present Technical Specification requirements to measure and maintain specific gravity in the applicable batteries. A supplement to the! LAR will be sent to the NRC in February 2006 removing all reference to specific gravity, thus restoring the LAR to be more like Technical Specification Task Force (TSTF)-360, Rev. 1.

B. In the following, SCE uses regular font for the NRC Question, bold font for the response, and italicized font where the LAR is cited.

Technical

1.

This License Amendment Request (LAR) contains a number of technical specification (TS) changes, but only TS 3.8.4 is addressed in the risk calculations. Please qualitatively address the risk impacts associated with the other TS changes (excluding editorial changes) that are included in this LAR.

RESPONSE

The LAR includes the following additional TS changes. Each of the changes is annotated with the qualitative risk assessment. Most of the requested changes are per the NRC approved TSTF-360, Rev. 1 and IEEE 450-2002 standard practice. The qualitative assessment has been generically made by SCE that those requested changes that conform with the NRC-approved TSTF-360, Rev. 1 and IEEE 450-2002 standard are permissible and would not significantly impact plant risk. Where this is applicable, the qualitative risk assessment refers to TSTF-360, Rev. 1 and/or IEEE 450-2002. Where it is not applicable, a specific risk assessment statement is provided.

Page 1 of 27

LCO 3.8.1 o

SR 3.8.1.1 The words in the NOTES Buses 3A04 and 3D1"and "Buses 3A06 and 302'are simplified to 'bus 3A04'and "Bus 3A06, 'respectively.

> Risk: The change deletes reference to bC buses. The TS definition of OPERABLE for Buses 3A04 and 3A06 considers the support system W: buses are capable of performing their related support function. Therefore, the change has no impact on plant risk.

LC03.8.4 o

The specification of the LM is revised from the "Train A, Train B, Train C, and Train D'electricalposver subsystems to "Train A and Train B. '

> Risk: The change is one of terminology and NRC approved train labeling convention consistent with the Standard Technical Specifications (STS), NUREG-1432, Rev. 0. Therefore, the change has no impact on plant risk.

o A new Condition A (compaiable to existing Condition C, which is deleted) is added "Required OCelectricralpower subsystem battery choryer or associated control equipment or cabling inoperable. '

)> Risk: The change is one of clarification consistent with the STS and is comparable to the existing TS Condition C. Therefore, the change has no, impact on plant risk.

o A new Condition B (comparable to existing Condition 0, which is deleted) is inserted to declare the associated battery inoperable should the battery parameters being monitored in the Required Actions for Condition A not be satisfactory.

)

Risk: The change is comparable to the existing TS Condition C.

Therefore, the change has no impact on plant risk.

o Existing Condition A is modified, as new Condition C, to specifically cover conditions not included in new Condition A.

> Risk: The change to existing Condition A is one of terminology.

It also adds a required action to allow cross-connect to the other DC subsystem on the same DC train. A successful cross-connect is quantitatively evaluated in the risk calculation as described in the lAR submittal.

Note: The additional choice of required action to cross-connect within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> allows entry to Condition D. Failure to cross-Page 2 of 27

connect within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> results in an entry to new Condition E (which is comparable to existing Condition B). When one DC subsystem cannot be restored to OPERABLE status within the allowed action period, the requirement to shut down the unit is maintained. Therefore, there is no change in risk.

o New Condition b is inserted to provide an upper limit for the duration of the time when DCsubsystems are cross-connected

> Risk: This risk is quantitatively evaluated in the LAR submittal.

o Existing Condition B is relabeled Condition Eand modified to include the failure to satisfy the new Conditions as entry conditions to mandate plant shutdown.

Risk: Existing Condition B provides for action to reduce power when the required actions for existing Condition A are not met.

Existing Condition B (relabeled as Condition E) includes the condition where the cross connected DC subsystem buses are not returned to the non-cross connected configuration within 30 days. Cross-connect use for up to 30 days is quantitatively evaluated in the risk calculation as described in the LAR submittal. When one DC subsystem cannot be restored to OPERABLE status within the allowed action period, the requirement to shut down the unit is maintained. Therefore, there is no change in risk.

o SR 3.8.4.1 is modified to provide surveillance of qreater than or equal to the minimum established float voltage' from the current requirement of

'Žl29Von float charge. ' Also, the frequency is extended from 7 to 31 days.

Both changes are consistent with TSTF 360 Rev I and IEE 450-2002.

> Risk: The terminology modification were made per TSTF 360, Rev. 1 and changed surveillance frequency were made per IEEE 450-2002 which are NRC approved practices.

o Existing SRs 3.&4.2, 3.8.4'3, 3.8.4.4, and 3.8.4.5 are relocated to the Licensee Controlled Specifications per the recommendations of TSTF360 Rev. 1. These include measures regarded asroutine preventive maintenance, such as inspecting for sigrivs of corrosion, physical damage, and electrical resistance measuring.

> Risk: The relocation of surveillance requirements to the LCS is per TSTF 360, Rev. 1.

o Existing SR 3.8.4.6 is renumbered to SP 3.8.4.2 and Page 3 of 27

a.

The NOTE 'Credit may be taken for unplanned events that satisfy this SR. 'is deleted as progmatically unhelpful,

b. In accordance with the recommendations of TSTF 360 Rev 1, the required duration for this surveillance is reduced from 12 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and

c. To facilitate upgrade of the batteries, the operability limits are relocated to the Licensee Controlled Specifications aCS), and the SR revised to:

The minimum specified current is changed from "300 amps' to lrated amps,'

The minimum spDecified voltage is changed from '129 V to the minimum established float voltage' Risk: The changes are per TSTF 360, Rev. 1 and the changed surveillance duration is per IEEE 450-2002 which are NRC-approved practice;.

o ExistingSR3.8.4.7isrenumbered toSR3.8.4.3, and

a.

NOTES 2 and 3 ore removed:

NOTE 2, This Surveillance shall not be performed in Mode 1,2,3, or 4, 'isa restriction that can be removed with the ability to cross-connectbCsubsystemsinagivenTrain. Whilecross-connectedone battery can provide electricalpower for both subsystems while the other battery is tested online.

> Risk: The successful cross connect is quantitatively evaluated in the risk calculation as described in the LAR submittal.

NOTE 3, 'Credit may be taken for unplanned events that satisfy this SR, 'is deleted as noted previously (see #9) as unhelpful

> Risk: The removal of the statement has no impact on risk.

b.

The following change is made per the recommendations of IEEE 450-2002:

NOTE Iis changed to specify, 'The modified performance discharge test in SR 3.8.6.6 may be performed in lieu of SR 3.8.4.3'(and the reference SR numbers are changed consistent with this amendment request)

> Risk: The modified performance discharge test is a combination of the existing battery performance discharge and service tests.

Therefore, there is no Impact on risk.

The 24-month frequency to perform this battery capacity test is extended to 30 months.

Page 4 of 27

> Risk: The test is performed to assess available battery capacity. From IEEE 450-2002 a service test should be scheduled at the discretion of the user at periodic times between performance tests. The changed performance test frequency is in accordance with IEEE 450-2002.

NOTE2 is added Io specify, The battery-performance discharge test in SR 3.8.6.6 may be performed in lieu of SR 3.8.4.3 once per 48 months.' This includes the revised reference SR numbers and a reasonable replacement frequency for using SR 3.8.6.6 without the modifiedperformance discharge test option.

> Risk: The battery performance discharge test is a constant current discharge test to assess battery capacity. It is currently allowed by the existing TS's in lieu of SR 3.8.4.3 once per 48 months. Therefore, there is no impact on risk.

Existing SR 3.8.4.8 is revised and relocated per TS7F360 Rev. 1 to be the new SR 3.8.6.6, as a more appropriate location.

> Risk: The changes and relocation of text are per TSTF 360, Rev. 1.

LCO 3.8.5 o

The word 'The'is added to the beginning of the LCO. This is an editorial change.

> Risk: This editorial change has no impact on risk.

o Conditions and RequiredActions are modified consistent with the changes to LCO 3.8.4. The entry Condition for Required Action Cis revised from

'One...'to One or more... 'per TSTF 360, Rev 1. Also, proposed Required Action C 2.3 is 'Suspend operations involving positive reactivity additions that could result in loss of required SDM or boron concentration." This is consistent with the current licensing basis.

> Risk: Condition C is clarified per TSTF 360, Rev. 1 without change to the required action or completion time.

o SR 3.8.5.1 is modified to reflect changes previously described in 3.8.4, DC Sources - Operating:

The DCsources are OPERA8LEwhen the following SRsore satisfied: 3.8.4F.1, 3.8.4.2, and 3.8.4.3.

This SR is modified by a NOTE that the following SRsore not required to be performed: 3.8.4.2 and 3.8.4.3.

Page 5 of 27

> Risk: The change is per TSTF 360, Rev. 1 and has no impact on risk.

• CO 3.8.6

1. (eneral comment: LCO 3. 8.6 undergoes the most editorial chanyes of any ICO in this Amendment Request, in updating to the recommendations of IEE450-2002 In maintalining compliance with the upgraded IEEE standard, the equivalent level of operational reliability is assured

> Risk: The editorial changes are per TSTF 360. Rev. 1 and IEEE 450-2002 approved practices.

2. The LCO is relabeled from! 'Battery CellParaimeters' to 'Battery Parameters ' Similar to the nomenclature change in LCO 3.8.4, the LCO 3.8.6 is changed from.

"Battery cellparameters iA'r the Train A, Train B, Train C, and Train b batteries shall be within the Category A and B limits of Table 3.8.6-1.'

To read:

'Battery parameters for the Train A and Train B batteries shall be within limits. '

This modification is more consistent with the S TS, and denotes that there are two electrical Trains, A and B. As noted elsewhere, subsystems A and C batteries support Train A, subsystems Band D support Train B.

Note that discussion referring to Table 3.8.6-1 is removed in its entirety.

Subsequent discussion in this change will include deletion of this Table, while the Tabe's requirements are included in new SRs (and any deficiencies in satisfying these are accommodated in the Conditions).

> Risk: The re-labeling of LCO 3.8.6 is per TSTF 360, Rev. 1.

3. Existing Condition A is deleted This Condition was entered upon failing to meet the Category A and B values of existing Table 3.8.6-1. In accordance with the recommendations of IEE 450-2002, this table andspecific action keels are superceded by new Conditions.

> Risk: The changes are per TSTF 360, Rev. 1 and IEEE 450-2002 approved practices.

Page 6 of 27

4. New Condition A is inserted In this Condition, float voltage of 2.07 VC has not been met (this is the equivalent of the Category C limit in Table 3.8.6-1).

This requires performance of SR 3.8.4.1 (battery terminal voltage) and SR 3.8.6.1 (float current or specificgravity verification) within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in addition to restoration of Mhe affected cell float voltage within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Note that IEEE 450-2002 provides float current as an alternate test to verify specific gravity.

Risk: The new condition and action statement are per TSTF 360, Rev. 1.

5. New Condition B is inserted In this Condition, float current exceeds 2 amps or specificgravity is less than 1.195 (this is the equivalent to the Category B and C limits in Table 3.8.6-1 for specificgravity, with float current as an alternative parameter). The Required Actions specify performance of SR 3.8.4.1 (battery terminal v,71tage) within 2hoursand restoration of either float current or specific gravity within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

> Risk: The new condition and action statement are per TSTF 360, Rev. 1 and per existing TS requirements.

6. New Condition Cis added if battery electrolyte levelis not maintained (this is the equivalent to Category A, B and C for electrolyte level in Table 3.8.6-1). The overall recovery of electrolyte level within 31 days is consistent with the Completion Time for e.'asting Condition A. However, NOTES are added to Required Actions to denote remedial measures should the electrolyte level fall below the top of the battery plates:

`Required Actions Cl and C2 are only applicabl if electrolyte level was below the top of plates.'

'Required Action C2 shall be completed ifelectrolyte evel was below the top of plates. a These NOTES are consistent with IEEE 450-2002 in addition to current TS practices.

New Required Action Cl dIrects restoration of the electrolyte level to above the top of the plates within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. New Required Action C2 directs completing an investigation of potential battery celljar leakage within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. New Required Action C3, as noted above, is comparable to existing Action A.3, in that it restores electrolyte level to limits within 31 days.

> Risk: The new condition and action statement are per TSTF 360, Rev. 1 and consistent with IEEE 450-2002 in addition to current TS practices.

Page 7 of 27

7 New Condition D provides cr Required Action and Completion Time should the battery pilot cell temperatures be found low, in accordance with IEEE 450-2002. This surveillance is currently in existing Condition B (for remainder of parameters in Condition B, see item 9, below)

>k Risk: The new condition D and action statement (same as existing Condition B) are per TSTF 360, Rev. 1.

8. New Condition Eprovidesa RequiredAction and Completion Time should redundant Trains of batteriesnot be within limits. This is consistent with T5TF360: "Restore battery parameters for batteries in one train to within limits'with a Completion flme of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

> Risk: The new condition E and action statement are per TSTF 360, Rev. 1.

9. Existing Condition B is relabeled as Condition F, and

a. Required Actions and Completion Times A through Enot met is specified as the reason for entering this Condition, and

b. Technicalparameter limits in the Condition are re-specifiedper the recommendations of IEEE 450-2002:

"One or more bcrtteries'isreworded as "One or two batteries on one train' for claritysince there are two required batteries on a given train "with average electrolyte temperature of the representative cells

<60 0F'is replaced with 'one or more battery cells float voltage

<2.07Vand float current >Z amps, 'and, parameters not within category C values'is replaced with 'cells float voltage <2 07Vand specific gravity -4. MJ7 1.195"(Note:

as described in the cover letter, this item has been edited above to correct a transcription error in the LAR submittal (bold for an addition, strike-out for a deletion). A clean page of this correction is included in Enclosure 2; this correction will also be included in the forthcoming Supplement).

> Risk: The new condition and action statement are per TSTF 360, Rev 1 and per the; recommendations of IEEE 450-2002.

10 SR 3.8.6.1 In accordance with the recommendations of IEEE 450-2002, this surveillance:

rather than meet rabe 3.8.6-1 category A limits, is re-specified to verify *2 amps float current or verify pilot cellspecificgravity

Ž1.200 for each baftery.

Page 8 of 27

the specified frequtency for this surveillance is extended from 7 days to 31 days.

This surveillance is modified by a NOTE that this does not need to be met if the float voltage of SR 3.i.4.isnot being met. That is, one isalready in a Condition in LCO 3.8.4, so further performance of this SR is not required

> Risk: The revised condition and action statement are per TSTF 360, Rev. 1 and IEEE 450-2002 standard practice.

11.

Existing SR 3.8.6.2 is deleted; its verifications are now contained in new SRs 3.8.6.2, 3.8.6.3, and 3.8.6. 4.

> Risk: The new condition and action statement are per TSTF 360, Rev. 1.

12. New SR 3.8.6.2 verifies pilot cell voltage Ž2.07Vevery 31 days. This is the equivalent of the existing Category A limit of Table 3.8.6-1, which is currently surveilled every 7 daWA? dads and wffhvn 7 da:s after bett er di hcr er or e wrcem. This change in surveillance frequency is per the recommendations of MEEE 450-2002. (Note: as described in the cover letter, this item has been edited above to correct a transcription error in the LAR submittal (bold for an addition, strike-out for a deletion). A clean page of this correction is included in Enclosure 2; this correction will also be included in the forthcoming Supplement).

> Risk: The revised condition and action statement are per TSTF 360, Rev. 1 and IEEE 450-2002 standard practice.

13. New SR 3.8.6.3 verifies each connected cell electrolyte level every 31 days.

This is the equivalent of the current Category 8 limit of Table 3.8.6-1, which is surveilled every 92 day.

This increase in surveillance frequency is per the recommendations of tEEE 450-2002.

> Risk: The revised condition and action statement are per TSTF 360, Rev. 1 and IEEE 450-2002 standard practice.

14. Existing SR 3.8.6.3 is renumbered to SR 3.8.6.4. This SR replaces verification of average electrolyte temperature to >600F with verification of each pilot cell temperature togreater than or equal to minimum established design limits. Also, the specified frequency for this new pilot cell surveillance is increased from once per 92 days to once per 31 daysenee per 34 a per TSTF 36C ARe

1. These changes are made per the recommendations of IEE 450-2002. (Note: as described in the cover letter, this item has been edited above to correct a transcription error in the LAR submittal (bold for an addition, strike-out for a deletion). A Page 9 of 27

clean page of this correction is included in Enclosure 2: this correction will also be included in the forthcoming Supplement).

> Risk: The revised condition and action statement are per TSTF 360, Rev. 1 and IEEE 450-2002 standard practice.

15. New SR 3.8.6.5 verifies connected cell voltage every 92 days. This is the equivalent of the current Category B limit in Tabk 3.8.6-1, which is also surveil/ed every 92 days.

Risk: The revised condition and action statement are per TSTF 360, Rev. 1 and IEEE 450-2002 standard practice.

16. New SR 3.8.6.6 is the relocated existing SR 3.8.4.8. Thissurveillance is modified to allow a modifiedperformance discharge test per TSTF360, Rev.

1. This change is per the,recommendations of IEEE450-2002.

> Risk: The revised condition and action statement are per TSTF 360, Rev. 1 and IEEE 450-2002 standard practice.

17 Tabke 3.8.6-1 is deleted in its entirety. As discussed previously, the limits are incorporated in the previous SRs.

> Risk: The revised condition and action statement are per TSTF 360, Rev. I and IEEE 450-2002 standard practice.

LCO 3.8.7

1. For clrity, the WCO is restoted from: 'The required Train A, Train B, Train C, and Train D inverters shall be OPERABLE

• to read: The required Channel A, B, C, and D AC inverters shall be OPERABLE ' This is an editorial change.

> Risk: The change is one of terminology and NRC approved train labeling convention consistent with the STS. Therefore, the editorial change has no impact on plant risk.

WCO 3.8.9

1. Similar to editorial changes clarifying the two electrical Trains configuration, the LCO is restated from:

Train A and Train B AC; Trains A, BA C, and D DC; cvnd Trains A, B. C, and D AC vital bus electricalpower distribution subsystems shall be OPERABLE -

Page 10 of 27

to read:

Train A and Train R AC, subsystems A, B, C, and D OWand Channels A, B, C, and D AC vital bus electricalpower distribution systems shall be OPERABLE" This is an editorial change.

> Risk: The change is one of terminology and NRC approved train labeling convention consistent with the STS, NUREG-1432.

Therefore, the editorial change has no impact on plant risk.

S552.16

1. A newProgram is added: 'Battery Monitoring and Mornfenance Program'asnew section 5.5.2.16 to the Procedures, Programs, and Manuals Section of the Technical Specifications The Proaram description is verbatim per the recommendations of TSTF 360 Rev. 1, andprovides the programmatic changes necessary to warrant the changes previously citing that ZEEEstandard The Bases would similarly be modified to reflect the above changes.

> Risk: The new program and actions are per TSTF 360, Rev. 1.

2.

The LAR states (page 5 of Attachment l) that it is "expected" to have a pre-alignment procedure. However, there is no commitment for such a procedure. The SPSB staff sees this as an important consideration since it appears that the licensee did not include operator failures in the cross-tie analysis (or set their probabilities to 0).

Further, the LAR states that bus voltage current readings in the control room provide indication that the cross-tie is properly connected and also states that the model does not consider cross-tie connection errors since if the cross-tie is not performed properly within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, then the extended completion time is not allowed and the plant would enter shutdown TS conditions. Is the action to check and verify appropriate bus voltage current readings from the control room expected to be included in the battery cross-tie procedure? Are there other (local) indications that the cross-tie is properly connected and are (or should) these indications expected to be included within the cross-tie procedure? Based on the SONGS human reliability analysis (HRA) approach, what is the estimated human error probability (HEP) associated with performing the cross-tie (with and without procedures) that would result in an improper/non-functional DC bus cross-connection? Is the licensee committing to proceduralize the pre-alignment cross-tie actions, including verification of a proper cross-tie, within the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> completion time?

RESPONSE

SONGS is committing to control the battery/bus cross-tie using a step-by-step procedure with local independent (second checker) verification and to complete this verification within the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> completion time. It Is stated in the LAR that positive verification of the proper alignment of the cross-tie will include use of in-control room Page-11 of 27

bus voltage and current readings. This wlas not correct. It will be revised in the forthcoming Supplement and submittal.

In lieu of in-control room bus voltage and current readings, which will not provide sufficient confirmation of the cross-tie, proper local connection of the cross-tie will rely on an approved step-by-step procedure. These procedural steps are performed locally at the buses. The cross-tie switch and main battery breaker positions also feature positive tactile, audible, and visual feedback to the operator when the switch or breaker is moved to the correct position. These multiple feedback cues are used to confirm that the procedural steps have been completed. An independent verifier (second checker) will confirm that the switches and breakers have been correctly manipulated. Local indication of proper cross-tie will be verified by observing the two cross-tie switches (non-automatic molded case breakers) in the closed position and one battery breaker in the open position. In addition, bus voltages and charger current will be verified locally.

HEP Calculation:

As stated in the LAR, the proposed Technical Specification will permit an allowed outage time of 30 days in the cross-connected configuration. Prior to successful alignment of the cross-tie, the allowed outage time is 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. If an operator fails to cross-tie properly, the allowed outage time is, by definition, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which matches the current allowed outage time (AOT). Therefore, cross-tie alignment failure was not considered with a 30-day allowed outage time calculation in the LAR. However, as requested in the RAI question, a cross-lie alignment failure probability is calculated.

Using NUREG/CR-4772, 'Accident Sequence Evaluation Program Human Reliability Analysis Procedure," the mean HEP for performing the cross-tie with a procedure is calculated to be BE-3/demand.

SONGS would assume an HEP = 1.0/demand if the cross-tie were not proceduralized. These values, however, were not used in the LAWs calculation.

3.

Please describe the modeling changes incorporated to address the maintenance configuration. As the maintenance configurations would impact the DC bus failure initiating event frequency, battery common cause failure (CCF) grouping (i.e., changes from 4 component group to 3 component group for preventive maintenance configuration), and 'CCF failure rates (for corrective maintenance, may have higher CCF failure rate for other battery components with the affected battery unless a CCF operability analysis is performed to ensure the other batteries are not susceptible to the same failure cause). Specifically describe changes to the model to represent the above aspects or provide the rational for not making these changes to the model.

RESPONSE

There are four 1E DC batteries per operating unit. The CCF modeling of batteries includes CCF groupings of two, three, and all four batteries.

For example, in the fault tree modeling for battery 2B007, basic events are included in its modeling for Page 12 of 27

CCF with 2B008, with 2B009, and with 28010 (i.e., doublets).

Basic events for a group of three are included for CCF of 28007 with 28008 and 28009, and with 2B008 and 2B010, and with 2B009 and 2B010. Another is Included for CCF of all four batteries (28007, 28008, 2B009, and 2B010).

Batteries 28008, 28009, and 2B010 each have similar groupings in their fault tree logic. If 28007 is removed from service for preventive maintenance, the CCF modeling (i.e., groupings and probabilities) for the other batteries were not changed. However, if 2B007 is removed from service to perform corrective maintenance, the common cause failure probability of a second battery failing is adjusted upward to the CCF alpha factor for doublets (from 1.05E-6 to 2.62E-3). The common-cause failure probability of two additional batteries failing given 2B007 failed was adjusted to the triplet CCF factor (from 4.79E-7 to 1.20E-3).

A similar adjustment was done for the remaining three batteries failing due to common cause given 28007 failed (i.e., a quadruplet).

4.

The LAR states (page 4 of Attachment l) that generic data is used for circuit breakers, battery charges, and batteries and there was a peer review fact and observation (F&O) on this topic. Please describe how the plant-specific experience compares with the generic data for these components.

RESPONSE

Page 4 of Attachment I of the LAR incorrectly implied only generic data was used. As used in the PRA calculations to support the LAR, the failure probabilities for the batteries and battery chargers are generic failure probabilities [Ref: NUREG/CR-4550] updated with plant-specific data.

The generic battery charger failure rate is 6.OE-7/hr. After Bayesian updating, the battery charger failure rate used for the analysis Is 1.68E-6/hr. This indicates that the SONGS battery charger failure rate is higher than the generic failure rate.

The generic probability of battery failure to operate when demanded is 4.OE-4/demand. After Bayesian updating, the battery demand failure probability did not change. That is, the updated demand probability is the some as the generic demand probability. This indicates that the SOG6S battery failure rate is consistent with the generic Industry failure rate.

The bus cross-ties will utilize switches Instead of circuit breakers. The original analysis for the LAR is slightly conservative since the failure probability of switches to close and open are lower than circuit breakers rGeneric Component Failure bata Base for Light Water & Liquid Sodium Reactor PRAs, EG&S Idaho, Inc., EGG-SSRE-8875, 1990]. The use of switches instead of breakers results in a more reliable connection.

The cross-tie switches are less prone to spurious opening than circuit breakers since the switches do not have an overcurrent trip mechanism. An overcurrent trip mechanism has a very small potential of spurious, inappropriate operation.

Bus protection Is maintained on the buses by other supply and load breakers.

Pagem 13 of 27

5.

The LAR states (page 5 of Attachment I) that no credit is taken for swing battery chargers in the base and maintenance cases. However the discussion on CCF (page 6 of Attachment I) indicates that CCFs were developed for the swing and dedicated battery chargers. Please clarify the apparent inconsistency.

Specifically, if any credit is taken for the swing battery chargers, please discuss if this will be a proceduralized action, describe the indications available to verify the connections are properly established, and the potential for operator failure to properly align the swing battery chargers (including the estimated HEP associated with performing this action - with and without a procedure).

RESPONSE

The PRA model was adjusted for this application to reflect the expected design when the LAR for the DC battery and DC bus extension is approved. Swing battery chargers are to be installed in 2006 and will be used to allow Isolation of the dedicated charger for test and maintenance. Similar to SONGS' High Pressure Safety Injection (HPSI) and Component Cooling Water (CCW) pumps, proceduralized alignment of the swing battery charger permits testing and maintenance flexibility while maintaining the full system design function within the limiting conditions of operation under the Technical Specifications. The swing punps and battery chargers also provide additional system reliability and availability: therefore, for completeness, the swing battery chargers were modeled with common cause failures (CCFs) included. However, for this application, the unavailability of the swing battery chargers were set to 1.0 to specifically isolate the risk impact of the battery cross-tie. The swing battery charger Is not necessary to perform a battery cross-tie. Since no credit is taken for the swing battery chargers for the appliication, an HEP was not calculated.

6.

The LAR states (page 8 of Attachment I) that the technical adequacy of the PRA for the application is based on an assumption that a Capability Category II for all supporting requirements is inherently sufficient to meet adequacy requirements for risk-informed applications. Though a PRA that meets Capability Category II for all supporting requirements may be adequate for this specific application, it cannot be and should not be assumed that this is sufficient for all potential risk-informed applications. Such a determination must be made for the specific application. In addition, industry peer review F&Os can be made for supporting requirements that meet Capability Category II (not just those that do not meet Capability Category II). This could mean that though the PRA meets Capability Category II for a specific supporting requirement, a related F&O could make the PRA unacceptable for the application unless it is addressed. Please confirm that all A and B F&Os have been reviewed and addressed for this application (not just those related to supporting requirements that were not met).

RESPONSE

SONGS affirms that all A and B Facts and Observations (F&Os) were reviewed and addressed individually for this applicatkn and not just those related to supporting requirements that were not met.

Page-14 of 27

7.

The LAR refers (page 11 of Attachment l) to results from a sensitivity study in which the cross-tie breakers failure probability was set to 0.1 as opposed to 0.0.

The staff views this as an important sensitivity study and as such request that the results (CDF and LERF) of this calculation be provided.

RESPONSE

As requested, the result of the sensitivity analysis are shown in Table RAI-1:

TABLE RAI-1 Avg Maintenance CDF LERF Battery B007 OOS - cross-tie fails to close with P=0.0 3.24E-05 1.12E-06 Battery B007 OOS - cross-tie fails to close with P=0.1 4.93E-05 1.88E-06

8.

Table 1 of Attachment I identifies proactive replacement of multiple jars as a maintenance activity that requires a cross-tie. However, this activity is not reflected in the Table 2 preventive maintenance calculation. Please revise the table to include this activity or provide a justification for its exclusion.

RESPONSE

Below is the revised Table 2 from the LAR which includes proactive replacement of multiple battery jars. Inclusion of this maintenance activity slightly increased the downtime frequency (line 8) and mean duration (line 9) for preventive maintenance.

The resulting change in single AOT risk was small (line 10). The single AOT core damage probability (CbP) changed from 5E-10 to 6E-10, while the single AOT large early release probability (LERP) remains 'lE-9.

With such small changes, the yearly increase in risk for preventive maintenarce is essentially unchanged (line 11).

Page 15 of 27

TABLE 2 SONGS Conditional CDF & LERF Contributions for 'Preventive' Maintenance TS 3.8.4 CDFd I

LERFd 1 Present Allowed Outage Time (AOT) 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2 Proposed AOT - aligned tW alternate power source 30 ays 3 Baseline (CDF/LERF) - nominal maintenance 3.235E-5/r 1.425E-68yr Conditional CDF/LERF for PM (Component 4 UNAVAILABLE, others nominal maintenance) 3.237E-51r 1.425E-61yr Conditional CDF/LERF for PM (Component 5 AVAILABLE, others nominal maintenance) 3.235E-SW 1.425E-61yr Increase in CDF1LERF for PM 6 (Une 4 - Line 5) 2E-8/yr

<1 E-9/yr Single AOT Risk (ICCDPIICLERP) for PM -

proposed AOT (RG 1.177): 30 days 7 (Line 6)301365 2E-9

<9E-11 Downtime Frequency for IMa 8(from Table 1) 3.47 hyeart' 9 Mean Duration of PM 10.26 days Single AOT Risk for PM - based on mean duration 10 (Une 6) * (line 9)/365 6E-10

<3E-1 1 Yearly AOT Risk for PM - based on mean duration (RG 1.174) 11 (Line 10) * (Line 8) 2E-91yr

<1E-10/yr a

Frequency represents the combined downtime frequency of all four sub-systems.

b Preventive maintenance consists of tests and proactive battery replacements: 2 performance tests in 10 years and 5 service tests in 10 years. This is a total of 7 tests in 10 years times 4 batteries.

7 tests

• 4 batteries/10 years = 2.8 tests/year; four battery replacements every 15 years or 0.267/year; proactive multiple jar replacementsfor four batteries every 1Oyears or 0.4/year; total downtime frequency = 2.8 + 0.267 + 0.4 - 3.47/year c

Mean duration = [2.8 (7 days) + 0.267 (30 days) + 0.4 (20 days)]/3.47 = 10.26 days d

Cull level = SE-I O/yr CDF, 5E-I 1/yr LERF Bolded values are measured against RG 1.174/1.177 acceptance guidelines

9.

Table 2 of Attachment I calculates the single AOT risk for preventive maintenance based on the mean duration. However, the 12-month cycle that includes the replacement of all 4 batteries will have a much greater battery outage duration (upwards of 140 outage days as opposed to about 27 outage Page! 16 of 27

days for the average year). Please perform a specific calculation of the expected AOT risk for the year involving replacement of all 4 batteries, including the expected outage times associated with other maintenance activities that will require the cross-tie.

RESPONSE

Our current plans no longer require all four batteries for a unit to be replaced in the same 12 month window. Two of the batteries (B009 and BOlO) for each unit have been recently replaced on each unit by aligning a qualified spare battery during the replacement period. The remaining two battery replacements for each unit (four total) will not be installed until approximately 2009 (one battery) and 2011 (three batteries).

However, as requested, the following table reflects the change in risk should all four batteries be replaced in a twelve month window.

TABLE RAI-2 SONGS Conditional CDF & LERF Contributions for 'Preventive' Maintenance TS 3.8.4 CDFd I

LERFd T Present Allowed Outage Time (AOT) 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2 Proposed AOT - aligned 1. alternate power source 30 dSy 3Baseline (CDF/LERF) - nominal maintenance 3.235E-Wyr 1.425E-61yr Conditional CDF/LERF for PM (Component 4 UNAVAILABLE, others nominal maintenance) 3.237E-54'r 1.425E-ftr Conditional CDF/LERF for PM (Component 5AVAILABLE, others nominal maintenance) 3.235E-51yr 1.425E-6Iyr Increase in CDF/LERF for PM 6 (Line 4 - Line 5) 2E43/yr

<IE-9tyr Single AOT Risk (ICCDPIICLERP) for PM -

proposed AOT (RG 1.117): 30 days 7 aine 6d30,365 2E-9

<9E-11 8 Downtime Frequency for PM" 7.2 Iyearb 9 Mean Duration of PM 19.50 days Single AOT Risk for PM -based on mean duration 10 (Line 6) * (line 9)1365 1 E-9

<6E-11 Yearly AOT Risk for PMIll - based on mean duration (RG 1.174) 11 (Line 10) * (Line 8) 8E-9,yr

<4E-1Ohr a

Frequency represents the combined downtime frequency of all four sub-systems.

Page 17 of 27

b Preventive maintenance consists of tests and proactive battery replacements: 2 performance tests in 10 years and 5 service tests in 10 years. This is a total of 7 tests in 10 years times 4 batteries.

7 tests

• 4 batteries/10 years = 2.8 tests/year;four battery replacements in I year or 4/year; proactive multiple jar replacements for four batteries every 10 years or 0.4/year; total downtime frequency = 2.8 + 4 + 0.4 = 7.2/year c

Mean duration = [2.8 (7 days) + 4 (30 days) + 0.4 (20 days)]/7.2

= 19.50 days d

Cull level = 5E-10/yr CDF, SE-I 1/yr LERF Bolded values are measured against RG 1.174/1.177 acceptance guidelines

10.

The staff is aware that the SONGS PRA includes external events and yet the LAR discussion does not mention external events considerations (e.g., seismic capability of the replacement batteries and supports, hydrogen generation of batteries). In the context of external events and operational considerations, please compare the replacement: batteries against the existing batteries and describe any modeling changes required to reflect these differences. In addition, please discussfjustify the quality of the external events portion of the SONGS PRA for this application, consistent with Regulatory Guide 1.174 Section 2.2.3 and Regulatory Guide 1.177 Section 2.3.1. Include in this discussion any peer reviews that have been performed on this portion of the SONGS PRA and address any F&Os that resulted from these reviews.

RESPONSE

The seismic portion of the SONGS PRA is based on the SONGS Individual Plant Examination of External Events (IPEEE). In the IPEEE, batteries B007, 8008, 8009 and 8010 were probabilistically screened from further analysis due to the high seismic fragility of the batteries and battery racks. Given the plant specific seismic hazard curve and the battery fragility curves, the batteries were below the screening criteria of 1E-7/year failure likelihood and their seismic fragility was not explicitly included in the PRA model. The replacement batteries have a capacity of 1800 AH each which is larger than the existing batteries. Batteries 8009 and B010 had a capacity of 1500 AH each and have been upgraded to the larger capacity batteries. Since the replacement batteries are heavier than the existing batteries, the seismic fragility of the existing battery racks was also evaluated. The seismic fragility of the battery rack anchorage was reduced from a spectral acceleration of 12.5 g to 10.5g which is still greater than the seismic fragility of 1og that was estimated for the batteries in the IPEEE. Therefore, no seismic PRA modeling changes were necessary for the replacement batteries.

Existing batteries BW7 and B008 with a capacity of 1260 AN each are planned to be upgraded to the 1800 AN capacity batteries in the future. When the upgrade occurs, the existing battery racks will also be replaced with new racks. Even though the new Page 18 of 27

battery rocks are anticipated to be of high seismic capacity as to not adversely affect the SONGS PRA, the seismic PRA model will be reviewed again when the upgrade is actually designed and implemented.

With respect to hydrogen generation, a calculation was performed to evaluate hydrogen generation for the larger batteries. The calculation demonstrates that it will take at least 2 days to reach the 37. hydrogen concentration limit by volume (4% is permitted by Regulatory Guide 1.7). This is sufficient time for mitigative actions to be taken prior to reaching this hydrogen concentration.

SEISMIC PRA:

The SONGS seismic PRA was reviewed against the ANS External Events Standard by ABS Consulting. This review was documented in EPRI 1009074, 'Trial Plant Review of an ANS External Event PRA Standard," 2003. In the report, it states:

'Overall, it is concluded that the SONGS seismic PRA (SPRA) meets the requirements of Capability Category I and in most cases Capability Category II.

In order to comply with all technical requirements of Category II, a full uncertainty analysis would be required that includes the uncertainties in the seismic hazard, the uncertainty in the fragilities and the HRA. In addition, a complete sensitivity study would be required to address the effect of correlation assumptions on the computed CDF and LERF. The level of documentation would also have to be enhanced to summarize the information requested in the Standard, or to clearly list or reference all supporting Tier 2 documentation and to expand on the peer review conducted.'

The SONGS seismic PRA utilized the mean seismic hazard curve and mean equipment fragility curve. Comprehensive propagation of the uncertainties in the seismic hazard, equipment fragilities and HRA would have provided comprehensive CDF and LERF distributions. For this application, where the risk increase is a measure of acceptability, this comment does not impact the conclusions of the LAR.

In terms of seismic failure correlation, the ANS Standard requires that sensitivity studies be performed to assess the sensitivity of CbF and LERF to the assumptions used for dependency and correlations. SONGS assumed complete seismic correlation for like components in a redundant safety train and no seismic correlation for dissimilar components. In the EPRI report, It states that this conservative treatment is typical and that 'hardly any SPRAs conducted over the past 20 years would satisfy this requirement. The EPRI report also states "At this point in time, meeting this requirement is difficult to meet for two reasons:

1) there is little background and experience on correlation of seismic failures.

Assignment of partial correlation on response and capacity would be subjective.

Page 19 of 27

2) the software to treat partial correlation of seismic failures is not readily available to the public."

FIRE PRA:

The fire PRA was independently reviewed by Erin Engineering as part of the Fire Protection Program Self-Assessment. The review was performed against the IPEEE fire PRA. The study, performed in October 2000 and documented in ERIN Report 108-0003.RO1, identified several technical and documentation issues that were grouped in 2 bins. The first bin involves 'overly conservative analyses.' The second bin involves 'incomplete treatment of fire scenarios.'

Overly conservative analysis: A major part of the original fire analysis assumed that any fire would result in maximum consequential damage regardless of the location of the fire in the room. This issue was focused on the safety related Train A and B switchgear rooms.

Incomplete treatment of fire scenarios: The study identified that only a large fire in the AFW pump room was analyzed and that smaller partially damaging fires were non-conservatively excluded.

To address these two issues, two studies were performed by ABS Consulting: 1) "Fire Risk Analysis: AFW Pump Room Reassessment, August 31. 2001" and 2) "Fire Risk Analysis: Switchgear Room Reassessment, September 30, 2001." The risk analysis for the switchgear room was revised to remove overly conservative assumptions, and updated with newer techniques and data. With these revisions, the total fire COF for this zone is 1.9E-6/year. The risk analysis for the AFW pump room was revised to include a comprehensive set of fire scenarios. With these revisions, the total fire COF for this zone was revised from 6.5E-7/yr to 6.9E-8/yr. Although additional fire scenarios were added which increased risk, the overall risk was reduced due to the presence of two automatic fire suppression systems that were not previously included in the original analysis. These fire revisions were included in the calculations for this LAR.

Peer reviews have not been performed an any other external events.

11.

The LAR is based on results from the safety monitor, as opposed to quantified results from the SONGS PRA model. Please describe any reviews, benchmarking, or other approaches used to ensure the technical adequacy of the safety monitor, and address any F&Os that resulted from these reviews.

RESPONSE

The SONGS Safety Monitor (SM) model and the SONGS WINNUPRA model are virtually identical. The SM model is generated from the WINNUPRA model. The difference in modeling pertains to 1) logically subsuming some event tree sequences into Page! 20 of 27

more minimal sequences (see question 12), 2) allowances for code specific differences and 3) allowances for configuration specific modeling (as opposed to average alignments). An example of this configuration specific modeling allowance is permitting the user to choose a specific train alignment of any swing component, whereas WINNUPRA models an average probability of alignment to either train of 50%. In all other significant aspects, the SONGS PFRA models for the SM and WINNUPRA are identical.

In terms of processes to ensure technical adequacy of the SONGS SM quantification, SONGS regularly compares the results between the two models to ensure fidelity of the results generated by the Safety Monitor.

For example, when model or data changes are made to the model through the SONGS PRA Change Package process, the change is incorporated Into the model for both codes. The results are compared to ensure consistency before the models are released for general use for PRA and Maintenance Rule Risk Management Program use.

The June 2003 ASME peer review of SONGS PRA was performed against the Safety Monitor model and results. The top logic modeling of the event trees was discussed during the peer review. The discussions were focused on how top logic modeling captures the event tree sequences. No F&O's, however, regarding the use or development of top logic modeling were generated by the peer review team.

Three facts and observations (F&Os) specifically addressing the Safety Monitor software were generated from the 2003 ASME peer review (Table RAI-3). These F&Os pertained to installation validation and verification (V4V) and did not pertain to other approaches or to technical adequacy. No other external peer reviews have been performed on the Safety Monitor.

Page 21 of 27

Table RAI-3 (Safety Monitor Facts & Observations)

Level Of F&O Text Significance Assigned by Review Team MU-7-1 The ***SAFETY MONITORi'** 3.5 V&V Plan PRA-02-010 C

Section 4.2 only tests a clean install. The installation program must perform an uninstall first before installing the new software to meet this test configuration with the installed cnfiguration. This did not have an impact on revision 3.5 as he 3.5 version was coincident with installation of Windows 000, but this will be important with the next revision.

MU-7-2 The ***SAFETY MONITOR" 3.5 V&V Plan PRA-02-010 C

Section 4.3 and Report PRA4-02O11 did not provide any requirement or information on the number of cutsets to be reviewed or which were reviewed when comparing the cutset results from the old and new revisions. The Engineer involved said that only 1000 could be printed out and they looked at the top 500. A sample selection should look at cutsets from within the whole available population (bottom as ell as top).

MU-7-3 The *SAFETY MONITOR"** 3.5 V&V Report PRA-02-011 C

states that the comparison run was performed at I E-9, however, the PRA is solved for CDF at I E-10. The comparison between the old and new versions should use he same truncation as normally used for PRA applications to ensure that it is valid.

12.

Based on the staff site visit, the staff is aware that the licensee converts the SONGS PRA event tree model into a fault tree model that is imported into the safety monitor. In the process of this conversion, and since success branches in the event tree model are not tracked or solved by the licensee, the licensee eliminates unon-minimal" event tree sequences during the conversion. This results in the elimination of entire sequences in which the only difference is the success or failure of a specific branch in the event tree (with the success branch sequence carried forward and the failure branch eliminated). In addition, licensee checks the safety monitor output results against the event tree and cutsets that would have resulted in failures instead of success for the subject success branches (most likely due to support system failures) are then eliminated from the results. However, by performing the elimination during the conversion, the licensee has effectively eliminated the branch point and success or failure of the subject branch point should not be considered in the post-process review of cutsets. The licensee's two elimination steps in concert (one pre-conversion and the other post-quantification) raise the potential for eliminating valid results. Please provide the risk results (baseline and maintenance configuration) without the post-quantification cutset elimination step. In addition, please describe the licensee's approach to LERF quantification Page 22 of 27

using the safety monitor as this may require the incorporation of sequences that were eliminated during the conversion process to address CDF.

RESPONSE

SONGS understands that the NRC is concerned with the potential elimination of valid core damage or large early release cutsets when two processes are applied to the same sequence cutsets.

In the first process, event trees are converted into 'top logic' fault trees where some sequences are subsumed into similar more minimal sequences. For example, if a core damage sequence in an event tree contains failures of system A, B, and C (written as ABC) and another core damage sequence from the same event tree contains success of system A and failure of system 8 and C (written as BC) then ABC is subsumed Into BC since BC is a minimal sequence. In this 'super' sequence BC, the success or failure of system A is not relevant since BC is minimal. Therefore, BC correctly includes ABC.

When solving the entire 'top logic' modell (which includes all event trees) with the Safety Monitor, cutsets were observed that simultaneously contained failure and success of the same component. In the second process, these cutsets are removed from the results using a post-processing feature of the Safety Monitor. This process is called 'success term deletion.'

Both processes, subsuming and success term deletion, correctly produce core damage and large early release results except possibly when success term deletion is applied to a super sequence containing subsumed sequences. When this occurs, there may be sequences in the super sequence that are deleted that represent valid subsumed sequences. The SONGS PRA does not perform success term deletion on super sequences. To verify this, all of the super sequences were identified and all component success and failure event pairs used for success term deletion were identified and then manually compared to ensure both are not simultaneously applied.

Of the 193 sequences modeled in 15 event trees, 15 super sequences were created from 16 subsumed sequences. The only success term deletion pair used in the SONGS model is OG-OK/DG-FAILURE.

This pair was not applied to the super sequences.

The results below represent the results when the success term deletion term pair is not post-processed.

Case Dsescription CDF LERF o

Base - Normal plant configuration 3.22E-5/yr 1.12E-6/yr 1

Subsystem Battery B007 00S/Cross-tie connected 3.22E-5/yr 1.12E-6/yr The results below represent the results when the success term deletion term pair is post-processed.

Page 23 of 27

Case bescription CDF LERF 0

Base - Normal plant configuration 3.22E-5/yr 1.12E-6/yr 1

Subsystem Battery B007 OOS/Cross-tie connected 3.22E-5/yr

1. 12E-6/yr With respect to LERF quantification, the core damage cutsets from the top logic solution are directly transferred to the large early release sequences for LERF quantification. Since the event tree core damage sequences were appropriately treated in the top logic, the cutsets transferred to the LERF sequences represent a comprehensive set (i.e., no additional crtsets need to be reincorporated for LERF purposes).

In summary, sequence subsuming and cutset deletion in the SONGS top logic model were performed appropriately and without impact on the results and conclusions.

13.

The LAR compares the risk results against the risk acceptance guidelines (Tier

1) required by Regulatory Guides 1.174 and 1.177, but does not discuss Tier 2 (Avoidance of Risk-Significant Plant Configurations) and Tier 3 (Risk-Informed Configuration Risk Management) considerations and does not identify any compensatory measures (e.g., no maintenance in the switchyard during battery replacements). Please provide a discussion of Tier 2 and Tier 3 considerations, consistent with Regulatory Guide 1.177 Sections 2.3.6 and 2.3.7.

RESPONSE

From Regulatory Guide 1.174, the licensee must appropriately restrict dominant risk-significant configurations associated with the proposed TS change (Tier 2). Based on the low risk increase of the cross-connected configuration (2E-8/yr CbF, 'lE-9/yr LERF), there are no Tier 2 plant configurations that should be explicitly avoided.

Specific configurations will be assessed as part of the Tier 3 configuration risk management program (recently renamed the Maintenance Rule Risk Management Program - MRRMP). The MRRMP is an integral part of SON"S Maintenance Rule (MR) program.

The SONGS MRRMP program matches that stated for the Configuration Risk Management Program (CRMP) on page 1.177-15 of Regulatory Guide 1.177. In RS 1.177, the CRMP applies to Systems, Structures and Components (SSCs) for which a risk-informed AOT has been granted. SONGS has chosen to integrate use of the CRMP on a daily basis as part of the MR program and not limit its implementation to a risk-informed AOT.

The MRRMP consists of the following procedurolized processes:

The Work Control department assesses the planned risk configuration using the Safety Monitor several weeks in advance and again a week in advance to assure that no unacceptable risk configurations are planned. If the risk is unacceptable, then the schedule is first modified to attempt to reduce the risk Page 24 of 27

to an acceptable level. Risk management actions will be reviewed and implemented if the unacceptable risk condition cannot be resolved.

On a shiftly basis, the Shift Technical Advisor (STA) runs the Safety Monitor to assess the current configuration and verify that the plant is not in an unacceptable risk configuration. On an emergent change to the plant, the STA runs the Safety Monitor as time permits.

Editorial A.

Equations I and 2 on page 2 of attachment I are not consistent with the equations in Tables 1 and 2. The! cited equation should display the conversion of 1 year/365 days in the equation since the CDF is in per year. This would make the equation results unitless (core damage probability).

Response

SONGS agrees that the units of the equations do not match up. Equations 1 and 2 should read:

ICCbP =

[(conditional COF with a battery out of service) -

(baseline COF with battery available)] X (1 year/365 days) X (30 days)

ICLERP = [(conditional LERF with a battery out of service) -

(baseline LERF with battery available)] X (1 year/365 days) X (30 days)

B.

The discussion of CCF on page 6 of the attachment refers to "Tables C-1 and C-2," which could not be found in the attachment. Please provide these tables or provide the appropriate reference.

Response

Following are the requested tables.

Page 25 of 27

Table C-I COMMON-CAUSE FAILURE PROBABILITIES Battery Chargers (including swing chargers B021 and B022)

-Mean Common Cause Groupings -

Basic Event Failure to Run U-BCCCOI-IDR 2.70E-07 Battery charger BOO1, B002, B003, B004, B005, B015, B017, B021, B022 (Global CCF of 3 or more BCs)

U-BCCC02-lDR 6.25E-08 Battery charger B001, B002 U-BCCC03-IDR 6.25E-08 Battery charger B001, B003 U-BCCC04-IDR 6.25E-08 Battery charger B001, B004 U-BCCC05-IDR 6.25E-08 Battery charger B001, B005 U-BCCC06-IDR 6.25E-08 Battery charger BOO1, B015 U-BCCC07-IDR 6.25E-08 Battery charger B001, B017 U-BCCC23-lDR 6.25E-08 Battery charger B001, B021 U-BCCC08-IDR 6.25E-08 Battery charger B002, B003 U-BCCC09-IDR 6.25E-48 Battery charger B002, B004 U-BCCC10-IDR 6.25E-48 Battery charger B002, B005 U-BCCCI I-IDR 625E-08 Battery charger B002, B015 U-BCCC12-IDR 6.25E-08 Battery charger B002, B017 U-BCCC24-1DR 6.25E408 Battery charger B002, B021 U-BCCC13-IDR 6.25E-08 Battery charger B003, B004 U-BCCC14-IDR 62E-08 Battery charger B003, B005 U-BCCC15-IDR 625E-08 Battery charger B003, B015 U-BCCC16-IDR 6.25E-08 Battery charger B003, B017 U-BCCC25-1DR 6-25E-08 Battery charger B003, B021 U-BCCC17-IDR 6.25E-08 Battery charger B004, B005 U-BCCC18-IDR 6.25E-48 Battery charger B004, B015 U-BCCC19-lDR 6.25E-48 Battery charger B004, B017 U-BCCC26-lDR 6.25E-48 Battery charger B004, B021 U-BCCC20-lDR 6.25E-48 Battery charger B005, B015 U-BCCC21-lDR 6.25E-08 Battery charger B005, B017 U-BCCC27-IDR 6.25E-48 Battery charger B005, B021 U-BCCC22-1DR 6.25E-08 Battery charger B015,1B017 Page! 26 of 27

Mean Common Cause Groupings -

Basic Event Failure to Run U-BCCC28-1DR 625EA08 Battery charger B015, B021 U-BCCC29-1DR 62508 Battery charger B017, B021 U-BCCC30-1DR 6.25E-08 Battery charger B021, B022 U-BCCC31-1DR 6.25E-08 Battery charger B001, B022 U-BCCC32-1DR 6.25E-08 Battery charger B002, B022 U-BCCC33-1DR 6.25E-08 Battery charger B003, B022 U-BCCC34-1DR 6.25E-08 Battery charger B004, B022 U-BCCC35-IDR 6.25E-08 Battery charger B005, B022 U-BCCC36-1DR 6.25E-08 Battery charger B015, B022 U-BCCC37-1DR 6.25E-08 Battery charger B017, B022 Bolded items in Table C-I are additions or changes to the SONGS 2/3 Living PRA reflecting the installation of battery chargers B021 and. B022.

Table C-2 COMMON-CAUSE FAILURE PROBABILITIES WITH BATTERY B007 OUT-OF-SERVICE FOR CORRECTIVE MAINTENANCE Mean Common Cause Groupings -

Basic Event Failure to Operate U-BYCC0001-S 2.62E-3 Batteries B007 & B008 U-BYCCO002-S 1.05E-6 Batteries B008 & B009 U-BYCCO003-S 2.62E-3 Batteries B007 & B009 U-BYCCOOO4-s 1.05E-6 Batteries B009 & BOO U-BYCCO005-S 1.05E-6 Batteries B008 & B010 U-BYCCO006-S 2.62E-3 Batteries B007 & B010 U-BYCCO007-S 1.20E-3 Batteries B007, B008, B009 U-BYCCO008-S 1.20E-3 Batteries B007, B008, B010 U-BYCCO009-S 1.20E-3 Batteries B007, B009, B010 U-BYCC0010-S 4.79E-7 Batteries B008, B009, B010 U-BYCC0011-S 4.53E-3 Batteries B007, B008, B009, B010 Page 27 of 27

REQUEST FOR ADDITIONAL INFORMATION RESPONSE, PART 2:

ELECTRICAL & INSTRUMENTATION & CONTROLS BRANCH (EEIB)

REQUEST FOR ADDITIONAL INFORMATION PROPOSED TECHNICAL SPECIFICATION CHANGE REQUEST FOR BATTERY AND DC SOURCES UPGRADES AND CROSS-TIE (PROPOSED CHANGE NUMBER 548)

SAN ONOFRE NUCLEAR GENERATING STATION (SONGS), UNITS 2 AND 3(DOCKET NOS 50-361 AND 50-362)

In the licensee submittal, neither the licensee's amendment change request nor the UFSAR describe the SONGS safety-related battery sizing criteria, the existing battery size or the modified battery size. It is the stafs understanding that the original independent batteries were sized as 1500 Amp-hour and 1200 Amp-hour batteries and that the new batteries are sized at 1800 Amp-hour. It is your intent to be able to power both channels from one battery during power operation.

Q1.

LCO 3.8.4.C.2, LCO 3.8.5.A.1.2 Please describe how you intend to power the loads, which originally required a total of 2700 Amp-hours (1500 + 11200) with a 1800 Amp-hour battery. Compare the battery sizing factors such as Temperature, Design and Aging factors as well as the combined duty cycle profile.

Response

Subsystem A and B batteries have an 8-hr rating of 1260 amp-hours, and subsystem C and D batteries had an 8-hr rating of 1500 amp-hours. Each subsystem replacement battery has an 8-hr rating of 1800 amp-hours.

The actual loads on these batteries are significantly less than the battery rating.

The following Tables show each battery's nominal rating, and the amp-hours removed during a Design Basis Event (DBE) (Loss of Voltage Signal (LOVS)/Safety Injection Actuation Signal (SIAS)) and a Station Blackout (SBO) event.

Page 1 of 4

Train A Subsystem Subsystem Nominal (8-Hr) Rating 1260AH i500 AH Available Capacity 908 AH 1081 AH OBE Load Demand 262 AH 125 AH l

SBO Load Demand 628 AH 293 AH Train B l Subsystem Subsystem Nominal (8-Hr) rating l

1260 AH 1500 AH Available Capacity 908 AH 1081 AH DBE Load Demand 270 AH 109 AH SBO Load Demand 644 AH 260 AH Combined A&C Cross-Connect IEEE 485 1800 AH Calculated Margin 1297 AH 387 AH 5.20%

808* AH 2.77%

Combined B&D Cross-Connect IEEE 485 1800 AH Calculated Margin 1297 AH 379 AH 8.45%

804* AH 4.42%

Note: *During SBO cross connect configuration one Inverter is isolated after 120 minutes.

SONGS Class I E batteries are sized in accordance with the guidelines of IEEE Standard 485 by using LOVS/SIAS, Degraded Grid Voltage with SIAS Signal (DGVSS) and Station Blackout (SBO) duty cycle profiles. Each subsystem load profile also included a margin of 10.0 Amps for future load growth. The available capacity is calculated for each battery using a Correction Factor of 1.11 for 60'F battery electrolyte temperature, and 1.25 for aging.

As shown in the Table above, all batteries have sufficient capacity for DBE and SBO events.

Q2.

SR 3.8.4.2 Confirm that the term Arated Amps@, when referring to the battery charger, is the nameplate continuous output current.

Response

ARated Ampse is the nameplate continuous output current rating of each Class 1 E battery Charger.

Q3.

SR 3.8.4.3 Please confirm that the Service Discharge Test and the Modified Performance Discharge Test will use the combined duty cycle of the cross-connected channels.

Page 2 of 4

Response

For 1800 Amp-hour batteries, the Service Test and Modified Performance Test will use the combined duty cycle of the cross-connected subsystems.

The existing Service Profile load (which does not include cross-connected Mode 1-4 loads) and Performance Test load will be used to test 1260 amp-hour batteries.

Q4.

LCO 3.8.6.B.2.2 An average specific gravity (SG) of all connected cells of 1.195 is indicative of a degraded battery. Please confirm by analysis or test that a SONGS battery with an average SG of 1.195 will have adequate capacity and capability to provide sufficient voltage to the connected safety-related loads.

Response

Recent work at SONGS demonstrated the capability to measure battery float current at 52.0 Amps. Consequently, it will no longer be required to pursue the methodology in the proposed amendment request to continue to measure and maintain battery specific gravity. This change will be made in a Supplement to this amendment request, which will be submitted by the end of February 2006.

Q5.

LCO 3.8.6.D.1 Please clarify what action will be taken to confirm that the remaining cells in the battery are above the minimum established design temperature within the same 12-hour completion time.

Response

No action will be taken. TSTF-360, Rev. 1 LCO 3.8.6.D specifically applies to pilot cells only and does not require confirmation that the remaining cells in the battery are above the minimum established design temperature within the same 12-hour completion time.

Q6.

SR 3.8.6.1 [sic], SR 3.8.6.5 Please provide your administrative limit for cell minimum voltage.

Response

For SR 3.8.6.2 & SR 3.8.6.5, the SONGS administrative limit for cell minimum voltage is 2.13 V. The administrative limit will be added to the LCS.

Page 3 of 4

Q7.

SR 3.8.6.6 Please confirm that the SONGS definition for a degraded battery includes a change in measured capacity > 1I1% from the previous performance capacity discharge test (or modified performance test) or a capacity < 90% of the manufacturer=s rating for the required discharge period.

Response

The SONGS definition for a degraded battery includes a change in measured capacity > 10% from the previous performance capacity discharge test (or modified performance test) or a capacity < 90% of the manufacturer=s rating for the required discharge period.

Page 4 of 4

REQUEST FOR ADDITIONAL INFORMATION RESPONSE, PART 3:

REQUEST FOR ADDITIONAL INFORMATION (RAI)

BY THE ELECTRICAL & INSTRUMENTATION & CONTROLS BRANCH (EEIB)

FOR SAN ONOFRE NUCLEAR GENERATING STATION, UNITS 2 AND 3 IN THE OFFICE OF NUCLEAR REACTOR REGULATION The application dated December 17, 2004 (Agency-wide Documents Access Management System (ADAMS) Accession No. ML043570322) was submitted by Southern California Edison (SCE) to reflect direct current (DC) electrical subsystem design upgrades that are in progress at for San Onofre Nuclear Generating Station (SONGS), Units 2 and 3. RAI questions were developed by EEIB to clarify the situation when the units may be operated in the abnormal line-up of a closed cross-tie between the same train subsystem or operated with the swing battery charger in service. These questions are in addition to questions froim this branch that have previously been submitted to SCE. The questions are the following:

1. Discuss if the swing battery charger is sized no less than the normal required battery chargers and can be powered from a diesel generator-backed bus under all operating conditions. Include in the discussion, when the swing battery charger is expected to be used, how long it may be used, and what are the restrictions on using the charger. (RAI Category Code 4.b)

Response

The swing battery chargers are rated 400 Amps. The normal required subsystem (dedicated) battery chargers are rated 300 Amps. The swing battery chargers may be used as a full replacement for the existing dedicated battery chargers. The swing battery charger is powered from a diesel generator-backed bus under all operating conditions as required by Technical Specifications (TS's) 3.8.1 and 3.8.2. The swing battery charger can stay in service indefinitely, and there are no TS restrictions on the swing battery charger use.

2. Because there are no proposed completion times (CTs) for restoration of the normal dedicated battery charger whether the swing battery charger is fed from its associated unit or from the other unit, discuss if such a CT should be added to the Technical Specifications (TSs). (RAI Category Code 2.b)

Response

The swing battery charger and the normal dedicated battery charger are equally qualified. When required, the swing battery charger can replace the normal dedicated battery charger using the provided circuit breakers. Accordingly, as an equivalent charger, no completion time for the swing battery charger is required or proposed.

Page 1 of 4

3. Discuss if the proposed Surveillance Requirement (SR) 3.8.4.2 applies to the swing battery chargers, as well as to the dedicated battery chargers. Explain, if SR 3.8.4.2 does not apply to these chargers, why such a surveillance requirement should not be proposed for the swing battery chargers. (RAI Category Code 4.b)

Response

The swing battery charger requires the same surveillances (TS 3.8.4.2) as the dedicated charger in order to be considered OPERABLE.

4. With the cross-tie connection closed, discuss the limits on the operation of the required battery chargers operating in parallel for the 30-day CT. (RAI Category Code 4.b)

Response

With the cross-tie connection closed, there are no restrictions on battery charger operation as long as the OPERABLE charger(s) can deliver at least 400 amps. The background section of TS B 3.8.4 specifically states:

'With same train DC buses cross-coninected, an OPERABLE charger or chargers with a combined rated capacity greater than or equal to 400 Amps is required."

5. Discuss if the battery chargers are designed to operate in parallel with another battery charger such that these batteiy chargers share the load. (RAI Category Code 4.b)

Response

Swing and dedicated battery charger; are designed to operate in parallel.

6. There is no condition for Limiting Condition for Operation (LCO) 3.8.4, "DC Sources -

Operating," for two or more installed chargers being inoperable. Discuss what the proposed TSs would require for this situation, and address why such a condition should not be included in the proposed TSs. (RAI Category Code 2.b)

Response

PCN-548 reflects TSTF-360, Rev 1 and the existing SONGS TS requirements to enter TS 3.0.3, if two or more required battery chargers are INOPERABLE.

7. Proposed LCO 3.8.4 Condition A is for an inoperable required DC electrical power subsystem battery charger. The LCC) 3.8.4 Required Actions A.1, and A.2.1 or A.2.2 are to restore the battery terminal to at least the minimum established float voltage and verify that the battery float current, or cell specific gravity, is acceptable.

Discuss if the proposed TSs allow a unit to complete the Required Actions A.1, and A.2.1 or A.2.2, by use of a battery charger other than the affected DC bus's Page 2 of 4

dedicated charger or the installed swing battery charger. Also, discuss how, with the cross-tie connection closed and only one battery charger operable, is it ensured that both batteries are being adequately charged. (RAI Category Code 2.b)

Response

The proposed TSs allow a unit to complete the Required Actions A.1, and A.2.1 or A.2.2, by use of the affected DC bus's dedicated charger or the installed swing battery charger.

Two batteries will be only momentarily in parallel when placing or removing the cross-tie from service. When cross-tied only one battery is connected to the two cross-tied subsystem buses. When the cross-tie connection is used there is no intention to charge two batteries from the same charger(s).

8. If a dedicated battery charger is inoperable and the DC busses are cross-tied, discuss the situation of a battery that has been discharged for a test, addressing how and when it would be determined that the battery is operable and, if it is not operable, how it will be recharged to restore it to operability. Describe the connection to recharge the discharged battery without loss of both channels powered from the good battery. (RAI Category Code 2.b)

Response

With a dedicated battery charger inoperable and the DC buses cross-tied, the discharged battery will be recharged to restore its operability using a non-1 E battery charger. After completion of the recharge and the TS 3.8.6 requirements are satisfied, the tested battery would be returned to OPERABLE status.

9. Upon review of the application, it is the! Nuclear Regulatory Commission staffs understanding that the "required battery charger" refers to one of the 8 normally connected battery chargers and the "swing battery charger" refers to one of the 4 battery chargers that can be temporarily connected to 1 of the 2 DC buses in its associated power train. Discuss if the staffs understanding of the application is correct. (RAI Category Code 4.b)

Page 3 of 4

Response

This characterization is not correct.

A "required battery charger" is one of:

v the "dedicated charger" aligned to its respective DC bus,

• the "swing battery charger" aligned to the respective DC bus,

• two "dedicated chargers" aligned to cross-tied DC buses, or

• the "swing battery charger" aligned to cross-tied DC buses.

Page 4 of 4 Changed Pages

Changed Pages 7 and 8 of Licensee's Evaluation

9. Existing Condition B is relabeled as Condition F, and

a. Required Actions and Completion Times A through E not met is specified as the reason for entering this Condition, and

b. Technical parameter limits in the Condition are re-specified per the recommendations of IEEE 450-2002:

• "One or more batteries" is reworded as "One or two batteries on one train", for clarity since there are two required batteries on a given train

• "with average electrolyte temperature of the representative cells

<600F" is replaced with "one or more battery cells float voltage

<2.07V and float current >2 amps," and,

• "parameters not within category C valups2,ieplaced with "cells float voltage <2.07V and specific gravit

.19

10. SR 3.8.6.1

a. In accordance with the recommendations of IEEE 450-2002, this surveillance:

• rather than meet Table 3.8.6-1 category A limits, is re-specified to verify <2 amps float current or verify pilot cell specific gravity Ž1.200 for each battery.

• the specified frequency for this surveillance is extended from 7 days to 31 days.

b. This surveillance is modified by a NOTE that this does not need to be met if the float voltage of SR 3.8.4.1 is not being met. That is, one is already in a Condition in LCO 3.8.4, so further performance of this SR is not required.

11. Existing SR 3.8.6.2 is deleted; its verifications are now contained in new SRs 3.8.6.2, 3.8.6.3, and 3.8.6.4.

12. New SR 3.8.6.2 verifies pilot cell voltage Ž2.07V every 31 days. This is the equivalent of the existing Category A limit of Table 3.8.6-1, which is currently surveilled every 7 days. This change in surveillance frequency is per the recommendations of IEEE 450-2002.

13. New SR 3.8.6.3 verifies each connected cell electrolyte level every 31 days.

This change in surveillance frequency is per the recommendations of IEEE 450-2002.

14. Existing SR 3.8.6.3 is renumbered to SR 3.8.6.4. This SR replaces verification of average electrolyte temperature to >600F with verification of each pilotcelltemperature to greater than or ea u mid ium established design

~.jimlis~lso, the specified frequency for this surveillance is increased from oe per 92 days to once per 31 daare ae p recommendations of IEEE 450-2002.

Page 7 of 32

15. New SR 3.8.6.5 verifies connected cell voltage every 92 days. The changes are made per the recommendations of IEEE 450-2002. C)

16. New SR 3.8.6.6 is the relocated existing SR 3.8.4.8. This surveillance is modified to allow a modified performance discharge test per TSTF 360, Rev. 1.

This change is per the recommendations of IEEE 450-2002.

17. Table 3.8.6-1 is deleted in its entirety. As discussed previously, the limits are incorporated in the previous SRs.

LCO 3.8.7

1. For clarity, the LCO is restated from: uThe required Train A, Train B, Train C, and Train D inverters shall be OPERABLE." to read: 'The required Channel A, B, C, and D AC inverters shall tie OPERABLE." This is an editorial change.

LCO 3.8.9

1. Similar to editorial changes clarifying the two electrical Trains configuration, the LCO is restated from:

"Train A and Train B AC; Trains A, B, C, and D DC; and Trains A, B, C, and D AC vilal bus electrical power distribution subsystems shall be OPERABLE."

to read:

"Train A and Train B AC, subsystems A, B, C, and D DC and Channels A, B, C, and D AC vital bus electrical power distribution systems shall be OPERABL.E."

This is an editorial change.

§ 5.5.2.16

1. A new Program is added: uBattery Monitoring and Maintenance Program" as new section 5.5.2.16 to the Procedures, Programs, and Manuals Section of the Technical Specifications. The Program description is verbatim per the recommendations of TSTF 360 Rev. 1, and provides the programmatic changes necessary to warrant the changes previously citing that IEEE standard.

The Bases will similarly be modified to reflect the above changes.

Page 8 of 32

Changed Page Attachment C

Battery tul-Parameters l 3.8.6 ACTIONS (Continued)

CONDITION REQUIRED ACTION COMPLETION TIME Fe. Required Action and Fft.1 Declare associated Immediately associated Completion battery inoperable.

Time of Condition A, B. C. D. or E not met.

OR One or two murt batteries on one train with one or more battery cells float voltage < 2.07 V and float current > 2 amps.-witnh EvT-dyU tempei tuie of tile Ieptes¢eiLtive >ells OR One or two muse batteries on one train with one or more battery cells float voltage < 2.07 V and C gravit.y va~_

W r L1r n uLd euquy k, SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.6.1 -NOTE------------------

Not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1.

(continued) l 1

I I

SAN ONOFRE--UNIT 2 3.8-31 Amendment No. t2f I

Changed Page Attachment D

Battery teii Parameters l 3.8.6 ACTIONS (Continued)

CONDITION REQUIRED ACTION COMPLETION TIME Fi. Required Action and Ff.1 Declare associated Immediately associated Completion battery inoperable.

Time of Condition A_

B. C. D. or E not met.

OR One or two murt batteries on one train with one or more battery cells float voltage < 2.07 V and float current > 2 amns. with, uvifr-dg el e, Ir uly le L~IIlpeIdLUI't Uf blat epi esll to Li e s ilt OR One or two mur.

batteries on one train with one or more battery cells float vnltage c 2.07 V and

-a~3 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.6.1 -NOTE------------

Not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1.

(conti nued_

l I

I SAN ONOFRE--UNIT 3 3.8-31 Amendment No. tt
I

Changed Page Attachment E

Battery Parameters l 3.8.6 ACTIONS (Continued)

CONDITION REQUIRED ACTION COMPLETION TIME F Required Action and F.1 Declare associated Immediately associated Completion battery inoperable.

Time of Condition A, B, C, D, or E not met.

OR One or two batteries on one train with one or more battery cells float voltage < 2.07 V and float current > 2 amps.

OR One or two batteries on one train with one or more battery cells Lv

_oltage < 2.07 V and s fic gravity SURVEILLANCE REQUIREMENTS SURVEILLANCE:

FREQUENCY SR 3.8.6.1

-NOTE-------------------

Not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1.

Verify each battery float current is < 2 31 days amps or verify pilot cell specific gravity is 2 1.200.

I I

I (continued) I SAN ONOFRE--UNIT 2 3.8-31 Amendment No.

Changed Page Attachment F

Battery Parameters l 3.8.6 ACTIONS (Continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. Required Action and F.1 Declare associated Immediately associated Completion battery inoperable.

Time of Condition A, B. D, or E not met.

OR One or two batteries on one train with one or more battery cells float voltage < 2.07 V and float current > 2 amps.

OR One or two batteries on one train with one or more battery cells voltage < 2.07 V and sp ific gravity SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.8.6.1 NOTE--------------------

Not required to be met when battery terminal voltage is less than the minimum established float voltage of SR 3.8.4.1.

Verify each battery float current is <2 31 days amps or verify pilot cell specific gravity is 21.200.

I (continued)

SAN ONOFRE--UNIT 3 3.8-31 Amendment No.

Changed Page 2 Attachment I

Regulatory Guide 1.177:

Regulatory Guide 1.177 requires the licensee to demonstrate that the proposed TS CT change has only a small quantitative impact on plant risk. An incremental conditional core damage probability (ICCDP) of less than 5.OE-7 is considered small for a single TS CT change. An incremental conditional large early release probability (ICLERP) of less than 5.OE-8 is also considered small. As defined in RG 1.177, ICCDP* =

[(conditional CDF1 with the subject equipment out of service) - (baseline CDF with subject equipment in service)] X (duration of the single CT under consideration)

ICLERP*

[(conditional LERF2 with the subject equipment out of service) - (baseline LERF with subject equipment in service)] X (duration of the single CT under consideration)

• nominal maintenance unavailabilities are assumed for all other equipment To demonstrate that the change in risk is small for TS 3.8.4, ICCDP and ICLERP are calculated for a battery out-of-service as follows:

ICCDPbattey =

[(conditional CDF with a battery out of p 0 i

(baseline CDF with battery available)]

(1 yearn (30 days)

[1]

ICLERPbattemy -

[(conditional LERF with a battery out of serv4 (baseline LERF with battery available)]

days)

(30 days)

[2]

These calculations are performed for preventive and corrective maenance an compared to the RG 1.177 guidelines. Since the allowed outage time extensions are to be applicable to all four electrical sub-systems, calculations should be performed for all four sub-systems. However, to simplify the analysis, the most bounding sub-system is determined and all subsequent calculations are based on the bounding case.

Regulatory Guide 1.174:

The anticipated changes in overall annual core damage frequency (CDF) and large early release frequency (LERF) are calculated and compared to the risk acceptance guidelines in Figures 3 and 4 of RG 1. 174. This is calculated using an expected annual frequency and duration of corrective and preventive maintenance multiplied by the CDF/LERF with the subject component out-of-service.

PRA Model:

The SONGS 2/3 Living PRA (as of November 3, 2003) is modified to reflect the proposed design change to the l E DC system. All calculations are performed with this modified model.

1 Core Damage Frequency (CDF) 2 Large Early Release Frequency (LERF)

Changed Page 6 Attachment I

extension. That is, the extension to operate in the cross-tied alignment for 30 days is permitted only upon successful alignment of the alternate power source. Therefore, during preventive maintenance, the probability of failure for operator actions to align the alternate power source is set to zero.

Common-Cause Failure (CCF) Analysis:

Common-cause failures of swing and dedicated battery chargers are directly modeled in the electrical power system fault tree and quantified using the alpha factor method [5]. Common-cause failure of cross-tie and swing battery charger breakers is not required since the breakers are operated in series where a single breaker failure is sufficient to fail power from the alternate source. Common-cause failure modeling for batteries is included in the base model. The CCF probabilities for batteries are not modified for the preventive maintenance case. CCF probabilities for batteries are modified upward, however, for corrective maintenance of a battery.

Modifications are necessary since an emergent battery failure may impact other batteries due to common failure mechanisms. CCF probabilities are summarized in Tables C-1 and C-2.

Uncertainty Analysis:

Parameter uncertainty calculations were not performed since the base case CDF and LERF are essentially the same as those calculated when either two buses are cross-tied. This expectation is similarly stated in Section 2.3.5 of Regulatory Guide 1.177. Modeling uncertainties were assessed via sensitivity analysis of key assumptions. This is described in more detail in the following sensitivity analysis section.

Sensitivity Analysis:

Sensitivity analysis was addressed in several areas: cull level, operator action, bounding sub-system and operation in Modes 2 - 4.. These areas are discussed specifically below.

Cull Level: Analyses to assess sensitivity to cull level for both CDF and LERF were performed.

The base analysis was performed at a cull level of 5E-iO/yr and 5E-1/yr for CDF and LERF, respectively. Sensitivity runs for CDF with cull levels of lE-10/yr and lE-i1/yrwere performed.

Similar runs for LERF were performed at lE-l I/yr and lE-12/yr. The calculated CDF/L}ERF and increase in baseline CDF/SERF are very small and less than 1E-7/yr and lE-8/yr, respectively.

Reducing the cull levels did not change the single AOT risk from that calculated using a cull level of 5E-l0/yr (CDF) and 5E-1 1/yr IR.).

Operator Action: Sensitivity analysis on operator action values was not performed for alignments.

Operator actions to align the cross-tie to another DC bus to perform preventive maintenance were assumed to be successful since alignment must be successful po mo equipm nt for preventive maintenance (i.e., also known as "make before bre uccessful mnt will be based on an approved step-by-step procedure w:.

en verification (second checker).

, vnipclon time extension to 30 days is dependent on successfMl alignment to the o r

bus within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. If successful alignment is not or cannot be performed in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, then the extension is not permitted and the allowed outage time remains at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (as it is in the current TS). Therefore, since operator success is a condition of the extension, no sensitivity analysis is required.

Changed Page 11 Attachment I

RESULTS:

Table 2 provides results for removing a lE DC battery for preventive maintenance. Lines 4 and 5 show CDF/LERF results when a battery is out of service (OOS) and in-service, respectively. The results show that the cross-tie alignment yields minimal change in risk. This result is expected because of the availability and high reliability of an alternate aligned qualified source of power.

TABLE 2 SONGS Conditional CDF & LERF Contributions for Preventive Maintenance (PM)

TS 3.8.4 CDFd I

LERFd I

Present Allowed Outage Time (AOT) 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2 Proposed AOT - aligned to alternate power source 30 da 3 Baseline (CDF/LERF) - nominal maintenance 3.235E-51yr 1.425E-6yr Conditional CDF/LERF for PM (Component 4 UNAVAILABLE, others nominal maintenance) 3.237E-,/y 1.425E-Wr conditional CDF/LERF for PM (Component 5 AVAILABLE, others nominal maintenance) 3.235E-5hW 1.425E-6/yr Increase in CDF/LERF for PM 6 (Line 4 - Line 5) 2_

_1_E-9/yr Single AOT Risk (ICCDP/ICLERP) for PM -

proposed AOT (RG 1.177): 30 days 7 (Line 6)"30/365

_2E-9

<9E-1_

I Downtime Frequency for PM' 8

from Table 1) 3.47 /yearb 9 Mean Duration of PM 10.26 days Single AOT Risk for PM - based on mean duration 10 Line 6) (line 9)1365 6E-10

<3E-11 Yearly AOT Risk for PM - based on mean duratio (RG 1.174)

\\

11 Line 10) * (Line 8) 2E-9gyr

-1 E-10/yr v

I a

Frequency represents the combined downtime frequency of all four sub-systems.

b Preventive maintenance consists of tests and proactive battery replacements: 2 performance tests in 10 years and 5 service tests in 10 years. This is a total of 7 tests in 10 years times 4 batteries.

7 tests

• 4 batteries/lO years =2.8 tests/year; 4 battery replacements every 15 years or 0.267/year; total downtime frequency = 2.8

+ 0.267 = 3.07 c

Mean duration = [2.8 (7 clays) + 0.267 (30 days)]/3.07 = 8.99 days d

Cull level = 5E-10/yr CDF, 5E-1/yr LERF Bolded values are measured against RG 1.174/1.177 acceptance guidelines The change in LERF (line 6) is smaller than the last significant digit in the calculation (IE-9/yr). To test whether the calculation is performed correctly and the model changes completed accurately, the cross-tie breakers were set to 0.1 failure probability instead of 0.0. In this test case, valid cutsets with an increase in CDF/LERF were expected and observed. This confirms that the same identical case was not performed for base and maintenance cases. However, since the change in LERF is less than the last significant digit of the Safety Monitor output (lE-9), calculations for lines 7, 10, and 11 are based on ALERF < lE-9/yr.