ML060610598

Request for Emergency Amendment to Technical Specifications 3.7.8, Essential Spray Pond System (Esps) and 3.8.1, AC Sources - Operating.

ML060610598
Person / Time
Site:	Palo Verde
Issue date:	02/23/2006
From:	Eubanks C Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-05420-CE/SAB/GAM
Download: ML060610598 (33)

Text

10 CFR 50.90 L Ai b A subsidiary of Pinnacle West Capital Corporation Cliff Eubanks Mail Station 7602 Palo Verde Nuclear Vice President Tel (623) 393-6116 PO Box 5.2034 Generating Station Nuclear Operations Fax (623) 393-6077 Phoenix, Arizona 85072-2034 102-05420-CE/SAB/GAM February 23, 2006 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Unit 2 Docket No. STN 50-529 Request for Emergency Amendment to Technical Specifications 3.7.8, "Essential Spray Pond System (ESPS)" and 3.8.1, "AC Sources

- Operating" Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) hereby requests a temporary, one-time emergency operating license amendment to revise the PVNGS Technical Specifications (TS). The proposed amendment would allow a one-time extension of the 72-hour allowed outage times (AOTs) of TS 3.7.8, Essential Spray Pond System (ESPS), Required Action A.1, and TS 3.8.1, AC Sources - Operating, Required Action B.4, which were entered at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 200)6, by an additional 4 days (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />) to complete repairs on the ESPS B train piping. The need for emergency approval of the proposed amendment exists in that failure to act in a timely way would result in shutdown of PVNGS Unit 2 upon expiration of the TS 3.7.8 Action A.1 and TS 3.8.1 Action B.4 72-hour AOTs at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 24, 2006.

APS requests approval of the proposed amendment by 0200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> on February 24, 2006 to be implemented upon issuance.

In accordance with the PVNGS Quality Assurance Program, the Plant Review Board and the Offsite Safety Review Committee have reviewed and concurred with this proposed amendment. By copy of this letter, this submittal is being forwarded to the Arizona Radiation Regulatory Agency (ARRA) pursuant to 10 CFR 50.91 (b)(1).

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde

• South Texas Project

• Wolf Creek

U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Request for Emergency Amendment to Technical Specifications 3.7.8, "Essential Spray Pond System (ESPS)" and 3.8.1, "AC Sources - Operating" Page 2 Commitments associated with this request are listed in Attachment 3 to Enclosure 2. If you have any questions, please contact Thomas N. Weber at (623) 393-5764.

Sincerely, CE/SAB/GAM

Enclosures:

1. Notarized affidavit

2. APS' evaluation of the proposed change(s)

Attachments:

1. Proposed Technical Specification Changes (mark-up)

2. Proposed Technical Specification pages (retyped)

3. Regulatory Commitments

4. Palo Verde PRA Quality and History cc: B. S. Mallett NRC Region IV Regional Administrator M. B. Fields NRC NRR Project Manager G. G. Warnick NRC Senior Resident Inspector for PVNGS A. V. Godwin Arizona Radiation Regulatory Agency (ARRA)

ENCLOSURE 1 AFFIDAVIT STATE OF ARIZONA

) ss.

COUNTY OF MARICOPA )

1,Clifford Eubanks, represent that I am Vice President Nuclear Operations, Arizona Public Service Company (APS), that the foregoing document has been signed by me on behalf of APS with full authority to do so, and that to the best of my knowledge and belief, the statements made therein are true and correct.

bifford Eubanks Sworn To Before Me This Day 0iCGU t , 2006.

U 0

, a')

ne-'A 11 Notary,)¶Iic 0 ,~1 A SUSIE LYNN ERGISH-4 Notary Pubtic - Arizona I M ComMa.copr County I

MyComm. Expires Jul 14, 2007 Notary Commission Stamp

I ENCLOSURE 2 ARIZONA PUBLIC SERVICE COMPANY'S EVALUATION OF PROPOSED AMENDMENT TO TECHNICAL SPECIFICATION 3.7.8 and 3.8.1

Subject:

Request for Amendment to Technical Specification 3.7.8, 'Essential Spray Pond System (ESPS)," and 3.8.1 "AC Sources - Operating"

1.0 DESCRIPTION

1.1 Description of Emergency Situation

2.0 PROPOSED CHANGE

3.0 EBACKGROUND

4.0 TECHNICAL ANALYSIS

4.1 Probabilistic Risk Assessment of the Proposed Essential Spray Pond/Diesel Generator AOT Extension 4.2 Compensatory Measures

5.0 REGULATORY ANALYSIS

5i.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/Criteria

6.0 ENVIRONMENTAL CONSIDERATION

7.0 PRECEDENT 1

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) hereby requests a temporary, one-time emergency operating license amendment to revise the Palo Verde Nuclear Generating Station (PVNGS) Technical Specifications (TS). The proposed amendment would allow a one-time extension of the 72-hour allowed outage times (AOTs) of TS 3.7.8, Essential Spray Pond System (ESPS), Required Action A.1, and TS 3.8.1, AC Sources - Operating, Required Action B.4, which were entered at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, by an additional 4 days (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />) to complete repairs on the ESPS El train. The need for emergency approval of the proposed amendment exists in that failure to act in a timely way would result in shutdown of PVNGS Unit 2 upon expiration of the TS 3.7.8 Action A.1 and TS 3.8.1 Action B.4 72-hour AOTs at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 24, 2006.

1.1 Description of Emergency Situation At 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, PV'NGS Unit 2 entered the 72-hour AOT of TS 3.7.8, Essential Spray Pond System (ESPS), Condition A, Required Action A.1 due to the identification of an apparent through-wall flaw in a low energy, ASME Class 3 ESPS underground pipe. As required by TS 3.7.8 Required Action A. 1, the 72-hour AOT of TS 3.8.1, AC Sources - Operating, Required Action B.4 was also entered at that time.

The Train B ESPS pipe is buried approximately 14 feet underground. Leakage was identified dripping from around the ESP%' pipe where it entered an underground pipe chase. The leakage was confirmed to be from the buried ESPS pipe because (1) the dripping increased when the ESPS pump was started and pressurized the line, and (2) the chemistry of the leaking water was similar to that of the ESPS. Work hals been ongoing to excavate the ESPS pipe to identify the exact location of the flaw, and preparations have been made to analyze the flaw and perform the necessary repairs.

However, the excavation has been challenging because of the close proximity of other underground lines in the excavation area which limit the available excavation working space, and the nature of the soil being excavated requires careful shoring for personnel safety. After the source of the leakage is exposed, the time needed to implement the necessary repairs will be longer than the current 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> TS AOTs.

This emergency situation occurred because upon identification that the apparent through wall flaw was the source of observed leakage, the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> TS 3.7.8 and 3.8.1 AOTs would not provide enough time to identify, assess, and complete the repairs to the ESPS piping. This situation could not have been avoided because characterization and repairs of the apparent through wall flaw can not begin until the source of the leakage is identified.

2

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1

2.0 PROPOSED CHANGE

The proposed changes are:

• Add a footnote to the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time of TS 3.7.8 Required Action A.1 to specify the following:

"The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> completion time of TS 3.7.8 Condition A, which was entered in Unit 2 at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, may be extended in Unit 2 by an additional 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> to complete repairs on ESPS Train 13 piping."

• Add a footnote to the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and the 6 days Completion Times of TS 3.8.1 Required Action B.4 to specify the following:

"The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 days completion times of TS 3.8.1 Condition B, Required Action B.4, which were entered in Unit 2 at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, may be extended in Unit 2 by an additional 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, respectively, to complete repairs on ESPS Train B piping under TS 3.7.8 Condition A."

3.0 BACKGROUND

At 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, PVNGS Unit 2 entered the 72-hour AOT of TS 3.7.8, Essential Spray Pond System (ESPS), Condition A, Required Action A.1 due to the identification of an apparent through-wall flaw in a low energy, ASME Class 3 ESPS underground pipe. If one ESPS train is inoperable, TS 3.7.8 Required Action A.1 requires that the ESPS train be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, or the plant must be shut down in accordance with TS 3.7.8 required Actions B.1 and B.2. As required by TS 3.7.8 Required Action A.l, the 72-hour AOT of TS 3.8.1, AC Sources -

Operating, Required Action B.4 was also entered at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006.

The Train B ESPS pipe is buried approximately 14 feet underground. Leakage was identified dripping from around the ESPi pipe where it entered an underground pipe chase. The leakage was confirmed to be from the buried ESPS pipe because (1) the dripping increased when the ESPS pump was started and pressurized the line, and (2) the cheimistry of the leaking water was similar to that of the ESPS. Work heas been ongoing to excavate the ESPS pipe to identify the exact location of the flaw, and preparations have been made to analyze the flaw and perform the necessary repairs.

3

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 Bases for Current Requirements TS 3.7.8 Required Action A.1 Bases With one ESPS train inoperable, action must be taken to restore operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, the remaining operable ESPS train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the ESPS train could result in loss of ESPS function. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a design basis accident (DBA) occurring during this time period.

TS 3.8.1 Required Action B.4 Bases According to Regulatory Guide 1.93, operation may continue in Condition B for a period that should not exceed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

In Condition B, the remaining operable DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCFO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently returned operable, the LCO may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This could lead to a total of 144 hours0.00167 days <br />0.04 hours <br />2.380952e-4 weeks <br />5.4792e-5 months <br />, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored operable, and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total of 9 days) allowed prior to complete restoration of the LCO. The 6 day Completion Time provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The "AND" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 day Completion Times means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exception to the normal "time zero" for beginning the allowed time "clock." This will result in establishing the "time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

4

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1

4.0 TECHNICAL ANALYSIS

The proposed amendment would allow a one-time extension of the 72-hour allowed outage Itimes (AOTs) of TS 3.7.8, Essential Spray Pond System (ESPS), Required Action A. 1, and TS 3.8.1, AC Sources - Operating, Required Action B.4, which were entered at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, by an additional 4 days (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />) to complete repairs on an apparent through wall flaw in the ESPS B train piping.

4.1 Probabilistic Risk Assessment of the Proposed Essential Spray Pond/Diesel Generator AOT Extension The risk analysis presented herein generally conforms to the three-tiered approach that is identified in NRC Regulatory Guide (RG) 1.177, An Approach for Plant-Specific, Risk-Informed Decision-making: Technical Specifications, August 1998.

4.1.1 The following risk metrics are used for this analysis:

• CDF - Core Damage Frequency

• L.ERF - Large Early Release Frequency

• ICCDP - Incremental Conditional Core Damage Probability = [(conditional CDF with the subject equipment out of service) - (baseline CDF with nominal expected equipment unavailability)] * (duration of a single AOT under consideration).

• ICLERP - Incremental Conditional Large Early Release Probability = [(conditional LERF with the subject equipment out of service) - (baseline LERF with nominal expected equipment unavailability)] * (duration of a single AOT under consideration).

4.1.2 Results for Incremental Conditional CDP and LERP The NRC Regulatory Guides (RGs) provide guidelines for maximum increases for both incremental conditional risk (RG 1.177) and for average risk increase (RG 1.174):

• ICCDP: 5E-7

• ICLERP: 5E-8

• CDF: 1E-6/yr

• LERF: 1E-7/yr ICCDP = (CDF SPB - CDF base) x time ICCDP = (7.514E 1.751 E-5)/yr x 4d/365d ICLERP = (LERF: SPB- LERF base) x time ICLERP = (3.458E 1.029E-6)/yr x 4d/365d The conditional probabilities are shown in Table 1 for Combined Internal Events and Fire (excluding floods).

5

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 Table 1: Incremental Conditional CDP and LERP for 4-Day AOT Extension ICCDP 6.32E-7 ICLERP 2.66E-8 The results show that for a 4-day AOT extension, ICCDP slightly exceeds the guideline for ICCDP of 5E-7, but ICLERP is within the guideline for ICLERP of 5E-8.

To determine the effect on annual CDF and LERF, 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> was added to the existing unavailability value for ESPS train B. The resulting changes to internal events CDF and LERF are presented in Table 2:

Table 2: Changes to Average Internal Events CDF and LERF

-_ I 4.1.3 Risk Results Conclusion The results of this analysis show that the AOT the ESPS and EDGs may be extended by 4 days (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />). The average change to CDF and LERF are well within the guideline values in RG 1.174. Even though ICCDP exceeds the 5E-7 guideline value, the calculated increase in risk can be characterized as "small" as defined in RG 1.177.

4.1.4 Quality of the PVNGS PRA provides details of the various aspects of establishing and maintaining the quality of the PVNGS PRA model, including:

• Qualification of staff

• Model control and documentation

• Software control

• Model update process

• External reviews 6

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 4.2 (',ompensatory Measures Appropriate restrictions and compensatory measures will be established to assure that system redundancy, independence, and diversity are maintained commensurate with the risk associated with the extended ACOTs. These include TS and Maintenance Rule (10 CFR 50.65) programmatic requirements as well as administrative controls in accordance with the configuration risk management program (CRMP). To allow continued plant operation with an inoperable EDG, TS 3.8.1 currently requires all emergency equipment aligned to an operable EDG to have no inoperable components.

This requirement is intended to provide assurance that a Loss of Offsite Power (LOOP) occurring concurrent with an inoperable E-DG does not result in a complete loss of safety function of critical systems. In addition, provisions for implementing the following compensatory measures and configuration risk management controls during the extended AOTs to assure the functions of the systems are maintained and the philosophy of defense-in-depth, as defined in Regulatory Guide 1.177, is maintained:

• During the extended AOTs, the redundant EDG (along with all of its required systems, subsystems, trains, components, and devices) will be verified operable (as required by TS) and no elective testing or maintenance activities will be scheduled on the redundant (operable) EDG.

• During the extended AOTs, no elective testing or maintenance activities will be scheduled on the gas turbine generators (GTGs).

• During the extended AOTs, no elective testing or maintenance activities will be scheduled on the Startup Transformers.

• During the extended AOTs, no elective testing or maintenance activities will be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge offsite power availability to the unit with the inoperable EDG.

• During the extended AOTs, all activity, including access, in the Salt River Project (SRP) switchyard shall be closely monitored and controlled. Elective maintenance within the switchyard that could challenge offsite power supply availability will not be allowed.

• During the extended AOTs, the GTGs will not be used for non-safety functions (i.e., power peaking to the grid).

• During the extended AOTs, all maintenance and testing activities in Unit 2 will be assessed and managed per 10 CFR 50.65 (Maintenance Rule).

7

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.71.8 and 3.8.1

• Prior to entering the extended AOTs, APS will contact the grid system dispatcher to ensure that no short-term activities adversely affecting grid stability are planned or are in progress.

• Prior to entering the extended AOTs, APS will confirm that the grid system dispatcher will notify the Unit 1 control room or shift manager in the event of severe weather, system degradation, or perturbations do occur so that an appropriate plant response can be determined.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration The proposed amendment would allow a one-time extension of the 72-hour allowed outage times (AOTs) of TS 3.7.8, Essential Spray Pond System (ESPS), Required Action A.1, and TS 3.8.1, AC Sources - Operating, Required Action B.4, which were entered at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, by an additional 4 days (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />) to complete repairs on an apparent through wall flaw in the ESPS B train piping.

APS has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

Since only one train of components is affected by the condition and single failure is not considered while a plant is in an LCO ACTION, the operable engineered safety features (ESF) trains are adequate to maintain the plant's design basis.

Thus, this condition will not alter assumptions relative to the mitigation of an accident or transient event. Considering compensatory action and risks involved in a plant shutdown, APS has determined that there is no significant risk associated with extending the allowed outage time for the ESPS and the systems it supports, including the Emergency Diesel Generator (EDG), for an additional 4 clays (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />). Based on this evaluation, there is no significant increase in the probability or consequence of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

8

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 This proposed action only extends an allowed outage time and will not physically alter the plant. No new or different type of equipment will be installed by this action. The changes in methods governing normal plant operation are consistent with current safety analysis assumptions. No change to the system as evaluated in the PVNGS safety analysis is proposed. Therefore, this proposed action does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

Considering compensatory action and risks involved in a plant shutdown, APS has determined that there is no significant risk associated with extending the allowed outage time for the ESPS and the systems it supports, including the EDG, for an additional 4 days (96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br />). Based on the availability of redundant systems, the compensatory actions that have been taken, and the extremely low probability of an accident that could not be mitigated by the available systems, APS concludes that there is no significant reduction in the margin of safety.

Based upon the analysis provided herein, APS concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CF:R 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria With the implementation of the proposed change, PVNGS Unit 2 continues to meet applicable design criteria. The proposed change is a one-time extension to the TS AOT. It does not affect the design basis of the plant. In addition, PVNGS Ulnit 2 will remain within the scope of the TS Limiting Conditions for Operation and is still subject to the requirements of the action statements.

Since the mid-1 980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on PRA insights. In its final policy statement: on TS improvements of July 22, 1993, the NRC stated that it expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA (probabilistic safety assessment) or risk survey and any available literature on risk insights and PSAs. Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specification related submittals. Further, as a part of the Commission's ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future 9

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 generic Technical Specification requirements. The NRC reiterated this point when it issued the revision to 10 CFR 50.36, "Technical Specifications," in July 1995.

In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that improve safety decision making and regulatory efficiency. The PRA policy statement included the following points:

1. The use of PRA technology should be increased in all regulatory matters to the extent supported by state-of-the-art in PRA methods and data and in a manner that compliments the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements.

3. PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review. In conclusion, based on the deterministic and PRA considerations discussed in this submittal, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51 .22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

10

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 7.0 PRECEDENT South Texas Project, Unit 1 License Amendment No. 169, dated January 10, 2005,

Subject:

South Texas Project, Unit 1 - Issuance of Amendment Concerning One-Time Allowed Outage Time Extension for Train B Essential Cooling Water (TAC NO.

MC5529) (Accession No.: ML050100291) 11

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 Attachment 1 Proposed Technical Specification Changes (mark-up)

Pages:

3.7.8-1 3.8.1-3

ESPS 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Essential Spray Pond System (ESPS)

LCO 3.7.8 Two ESPS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2. 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train A.1 -------- Notes--------

inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1.

"AC Sources -

Operating," for emergency diesel generator made inoperable by ESPS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6.

"RCS Loops -

MODE 4," for shutdown cooling made inoperable by ESPS.

Restore ESPS train to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s*

OPERABLE status.

B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time of Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> oririe /e nuur5 cuwpieuuon t~ime Ur Iaa.1.0 L6uruliuuil t, MrICHr Waserierunu e.au UaUe hours on February 21, 2006, may be extended in Unit 2 by an additional 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> to complete repairs on ESPS Train B piping.

PALO VERDE UNITS 1,2,3 3.7.8-1 AMENDMENT NO. 117

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s*

to OPERABLE status.

AND 6 days" from discovery of failure to meet LCO C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from circuits inoperable. feature(s) inoperable discovery of when its redundant Condition C required feature(s) concurrent with is inoperable. inoperability of redundant required feature(s)

AND C.2 Restore one required 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> offsite circuit to OPERABLE status.

• The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 days completion times of TS 3.8.1 Condition BI Required Action B.4, which were entered in Unit 2 at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, may be extended inUnit 2 by an additional 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, respectively, to complete repairs on ESPS Train B piping under TS 3.7.8 Condition A.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDIVIENTNO. 117 '

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 Attachment 2 Proposed Technical Specification Changes (retyped)]

Pages:

3.7.8-1 3.8.1-3

ESPS 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Essential Spray Pond System (ESPS)

LCO 3.7.8 Two ESPS trains shall be OPERABLE.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESPS train A.1 -------- Notes--------

inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1.

"AC Sources -

Operating," for emergency diesel generator made inoperable by ES PS.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6.

"RCS Loops -

MODE 4," for shutdown cooling made inoperable by ESPS.

Restore ESPS train to 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s*

OPERABLE status. I B. Required Action and B.1 Be in MODE 3. 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> associated Completion Time of Condition A AND not met.

B.2 Be in MODE 5. 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />

• The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> completion time of TS 3.7.8 Condition A, which was entered in Unit 2 at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21, 2006, may be extended in Unit 2 by an additional 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> to complete repairs on ESPS Train B piping.

AC Sources; - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />s* I to OPERABLE status.

AND 6 days* from I discovery of failure to meet LCO C. Two required offsite C.1 Declare required 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from circuits inoperable. feature(s) inoperable discovery of when its redundant Condition C required feature(s) concurrent with is inoperable. inoperability of redundant required feature(s)

AND C.2 Restore one required 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> offsite circuit to OPERABLE status.

• The 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and 6 days completion times Df TS 3.8.1 Condition B. Required Action B.4, which were entered inUnit 2 at 0302 hours0.0035 days <br />0.0839 hours <br />4.993386e-4 weeks <br />1.14911e-4 months <br /> on February 21. 2006. may be extended in Unit 2 by an additional 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, respectively, to complete repairs on ISPS Train B piping under TS 3.7.8 Condition A.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO. 447,

Enclosure 2 APS' Evaluation of Proposed Amendment to TS 3.7.8 and 3.8.1 Attachment 3 Regulatory Commitment Due Date During the extended AOTs, the redundant EDG (along with all of its During the required systems, subsystems, trains, components, and devices) will be extended verified operable (as required by TS) and no elective testing or maintenance AOTs.

activities will be scheduled on the redundant (operable) EDG.

During the extended AOTs, no elective testing or maintenance activities will During the be scheduled on the gas turbine generators (GTGs). extended AOTs.

During the extended AOTs, no elective testing or maintenance activities will During the be scheduled on the Startup Transformers. extended AOTs.

During the extended AOTs, no elective testing or maintenance activities will During the be scheduled in the APS switchyard or the unit's 13.8 kV power supply lines extended and transformers which could cause a line outage or challenge offsite AOTs.

power availability to the unit with the inoperable EDG.

During the extended AOTs, all activity, including access, in the Salt River During the Project (SRP) switchyard shall be closely monitored and controlled. extended Elective! maintenance within the switchyard that could challenge offsite AOTs.

power supply availability will not be allowed.

During the extended AOTs, the GTGs will not be used for non-safety During the functions (i.e., power peaking to the grid),.extended AOTs.

During the extended AOTs, all maintenance and testing activities in Unit 2 During the will be assessed and managed per 10 CIFR 50.65 (Maintenance Rule). extended AOTs.

Prior to entering the extended AOTs, APS will contact the grid system Prior to the dispatcher to ensure that no short-term activities adversely affecting grid extended stability are planned or are in progress. AOTs.

Prior to entering the extended AOTs, APS will confirm that the grid system Prior to the dispatcher will notify the Unit 1 control room or shift manager in the event of extended severe weather, system degradation, or perturbations do occur so that an AOTs.

appropriate plant response can be determined.

1

Enclosure 2 Attachment 4 PRA Quality and History Palo Verde PRA Quality and History Table of Contents

1. PALO VERDE PRA QUALITY OVERVIEW ................................... 2 1.1. QUALIFICATION OF PRA STAFF 2 1.2. PRA PROCEDURES 2 1.3. INDEPENDENT REVIEWS 2 1.4. PRA CONFIGURATION CONTROL PROGRAM 3 1.5. PEER REVIEWS 3 1.6. CEOG CROSS-COMPARISON PROCESS 4 1.7. CEOG PSA TECHNICAL POSITIONS 6 1.8. CONTINUOUS QUALITY IMPROVEMENT PROCESS 6

2. PVNGS PRA MODEL ...................... 7 2.1. MODEL OVERVIEW 7 2.2. PALO VERDE PRA DEVELOPMENT HISTORY 8

3. COMBUSTION ENGINEERING OWNERS GROUP TECHNICAL POSITIONS . .10 3.1. CEOG PSA STANDARD: EVALUATION OF TFE INITIATING EVENT FREQUENCY FOR THE LOSS OF COOLANT ACCIDENT 10 3.2. CEOG PSA STANDARD: EVALUATION OF THE INITIATING EVENT FREQUENCY FOR MAIN STEAM LINE BREAK EVENTS 10 3.3. CEOG PSA STANDARD: EVALUATION OF THE INITIATING EVENT FREQUENCY FOR STEAM GENERATOR TUBE RUPTURE 10 3.4. CEOG PSA STANDARD: SUCCESS CRITERIA FOR THE MINIMUM NUMBER OF SAFETY INJECrION PATHWAYS FOLLOWING LARGE AND SMALL BREAK LOCAS FOR CE PWRs 10 3.5. CEOG PSA STANDARD: BEST ESTIMATE ATWS SCENARIOS AND SUCCESS CRITERIA 11 3.6. CEOG PSA STANDARD: EVALUATION OF THE MECHANICAL SCRAM FAILURE FOR ATWS OCCURRENCE FREQUENCY I1 3.7. CEOG PSA STANDARD: REACTOR COOLANT PUMP SEAL FAILURE PROBABILITY GIVEN A LOSS OF SEAL INJECTION I1 3.8. CEOG PSA STANDARD: EVALUATION OF THE INITIATING EVENT FREQUENCY FOR REACTCR VESSEL RUPTURE I 1

4. INDEPENDENT EXTERNAL REVIEWS .11

5. REFERENCES.12 1

Enclosure 2 Attachment 4 PRA Quality and History

1. Palo Verde PRA Quality Overview PVNGS utility personnel have constructed the PRA with a strong commitment towards developing a complete and accurate PRA. This commitment can be seen through the following elements'

• Formal qualification program for the PRA staff

• Use of procedures to control PRA processes

• Independent reviews (checks) of PRA documents

• Comprehensive PRA Configuration Control Program

- Quarterly plant change monitoring program

- Process to control PRA quantification software

- Active open items list (Impact Review database)

- Interface with the site's corrective action program

- Process to maintain configuration of previous risk-informed decisions

• Peer reviews

• Participation in the CEOG cross comparison process

• Incorporation, where applicable, of CEOG PRA Technical Positions

• Commitment of continuous quality improvement These elements are used to achieve a quality PRA and are described in the remainder of Section 1.Section 2 provides an overview of the development history of the PRA since the IPE submittal in April of 1992. Section 3 describes the significant PRA open items. Section 4 lists the CEOG Technical Positions and describes the PVNGS position on each of these documents.

Section 5 discusses the independent (external) reviews that have been performed on PRA. A summary of the significant issues and their status is provided.

1.1 Qualification of PRA Staff Risk analysts are qualified in accordance with the PVNGS Engineering Training PrDgram, which meets the INPO requirements for a Systematic Approach to Training and 10CFR50.120.

1.2 PRA Procedures The PRA model is controlled by station procedure 7ODP-ORA03, PRA Model Control, Ref. 1.

The PRA model is documented by way of Engineering Studies, which are controlled by station procedure 81 DP-4CC03, Engineering Studies, Ref. 2.

PRA model documentation is maintained by the Nuclear Information Records Management Department in accordance with administrative controls meeting the requirements of Reg. Guide 1.33, Ref. 3.

1.3 Independent Reviews The Engineering Studies, which document the PRA, receive independent technical review, as required by station procedure 81 DP-OCCO5, Design and Technical Document Control, Ref. 4.

2

Enclosure 2 Attachment 4 PRA Quality and History 1.4 PRA Configuration Control Program 1.4.1 PRA Open Items (Impacts)

To evaluate and track items that may lead to a change to the model or its documentation, an "impact review database" is maintained. Dispositions and change records are sent to Nuclear Information Records Management and maintained per the above-mentioned requirements.

1.4.2 Monitoring Plant Changes Documents used in the development of the PRA are periodically compared to the station document database to identify revisions to referenced documents. Documents that have been revised are then reviewed to determine if there is any impact to the model. Changes are identified and evaluated using the impact database and process described above.

1.4.3 PRA Updates Updates to the PRA model to incorporated changes required due to plant changes are typically made annually.

1.4.4 Software Quality Control Software, including Risk SpectrumTM, MAAP, etc. is verified and controlled in accordance with the PVNGS Non-process Software QA Program, station procedure 8ODP-OCC01; along with implementing procedures 8ODP-OCCO2, Non-process Qualified Software Development, Process and Upgrades, Ref. 6; and 8ODP-OCCO6, Control and Use of Qualified Non-process Software and Data, Ref. 7.

Electronic data and databases are controlled in accordance with station procedure 8ODP-OCCO6, Control and Use of Qualified Non-process Software and Data. The databases are stored in a controlled, limited access location. Copies for use are required to be verified against the controlled version.

1.5 Peer Reviews Section 5 describes the external independent reviews and their findings.

The nuclear industry has adopted a PSA Peer Review Process originally developed by the Boiling Water Reactor Owners Group (BWROG). This original BWROG Process was provided to the other owners groups. In a cooperative undertaking, this process was modified by the WOG, the B&WOG and the CEOG to be applicable to both BWRs and PWRs. The result is a common, consistent PRA peer review process that is applicable to any commercial nuclear power plant in the U.S. At the same time, it is flexible enough to incorporate individual owners group programs to enhance the technical quality and adequacy of the plant PRAs.

Combustion Engineering Owners Group performed a review of the Palo Verde PRA as part of the industry-wide PRA quality initiative in November 1999.

3

Enclosure 2 Attachment 4 PRA Quality and History 1.6 CEOG Cross-Comparison Process In 1995, the CEOG PSA Working Group funded the first in a series of five cross-comparison review tasks to identify similarities and differences among CEOG member PRAs and where the results are perceived to be different, to investigate the potential causes for differences. In general, differences in PRA results were attributed to one of the following:

a) Plant specific design or operational differences.

b) Data selection.

c) Selection of success criteria.

d) PRA modeling assumptions and modeling philosophy.

The primary interest of this effort was to highlight areas where additional attention may be desirable as the PRA evolves. Besides the knowledge and insights gained through participation in this activity, the primary product was the identification of areas where additional guidance is required and the development of this guidance is discussed in Section 1.7.

1.6.1 PHASE 1: Comparison of Dominant Modeling Parameters and Results A methodical approach was used to companr the PRAs, The earliest comparison 1:ask (PHASE

1) focused on a review of overall PSA predictions and key inputs, such as selection of Initiating Event Frequencies (IEFs) and success criteria for selected initiating events. The plant-to-plant modeling variability and robustness was assessed for each initiating event by dividing the IE core damage probability by the IEF. This division yields the Conditional Core Damage Probability (CCDP) for a particular event. Ideally identically designed plants, identically modeled, will have equal CCDPs, even if the selected IEF for each plant were very different.

Differences and similarities in CCDP were noted among the group. Plant uniqueness and key modeling assumptions impacting the results were identified to aid in understanding these differences. When no clear basis for difference was defined, the issue was tagged for future investigation.

1.6.2 PHASE 2: Comparison of PSA Data The PHASE 2 PRA comparison task was focused on identifying plant data used in various PRAs. The primary focus of the task was to identify any significant differences in input parameters (failure rates, probabilities and common-cause factors) that may bias FPRA predictions. This data collection in part supported the development and support of various Joint Applications. The data request was sufficiently global to highlight any important plant-to-plant differences. Component data assembled and compared included demand and run-time failure rates for:

• Emergency Diesel Generators (EDGs)

• Batteries

• Motor-Driven Pumps

• Motor-Operated Valves (MOVs) 4

Enclosure 2 Attachment 4 PRA Quality and History

• Air-Operated Valves (AOVs)

• Check Valves

• Solenoid Valves

• Buses, Breakers and Relays Areas where plant differences occurred were noted for utility review.

1.6.3 PHASE 3: Comparison of Human Action Data Phase 3 of this effort was focused on defining the human actions credited in the plant PRAs, the methodology used to establish the Human Error Probability (HEP) and the HEPs used for the various actions. A discussion of variability suggests that HEPs reflected plant culture, training, availability and clarity of proceduralized actions and elements involved in the HEP development methodology. Issues addressed in this comparison included:

a) Selection of Human Actions to be Modeled b) Comparison of Risk Achievement Worth (RAW) of Top 10 Human Actions c) Operator Action Specific HEP Comparison d) Treatment of Pre-Existing Maintenance Errors e) Modeling of Recovery Actions Differences among plants were highlighted and summarized.

1.6.4 PHASE 4: Comparison of Common Cause Modeling and Treatment of Dependencies This task was performed concurrently with PHASE 3 and had two distinct activities.

Common Cause Modeling Assessment This phase consisted of a comparison of howv common cause effects were incorporated into the plant PRAs. Specific items compared included:

• Selection of Common-Cause Methodology

• Elements considered in common-cause assessment

• Common-cause data This task resulted in recommendations for the minimum selection of common-cause elements.

This information was factored into the CEOG peer review process.

Treatment of Dependencies This task consisted of response to the following questions regarding:

• Pump dependencies on Heating, Ventilation and Air Conditioning (HVAC) and/or Component Cooling Water (CCW) 5

Enclosure 2 Attachment 4 PRA Quality and History

• Relationship between loss of Containment Heat Removal (CHR) and Safety Injection (SI)

• Treatment of Reactor Coolant Pump (RC:P) seal failure

• Important electrical dependencies

• Existence of unique plant support systems Differences in the treatment of dependencies were identified and discussed among the PSASC, and where possible, unique plant features driving dependencies were identified.

1.6.5 PHASE 5: Comparison of Dominant Cutsets PHASE 5 is the last of the global comparison tasks performed by the group. This effort required utilities to identify the top 100 accident sequences, or cutsets. These cutsets were compared to assess that all dominant risk contributors are considered.

The comparison process was evolutionary, in that findings in earlier comparisons were often reviewed by members and, when appropriate, resulted in modeling changes. Even when PRA changes did not occur, philosophical modeling issues associated with selection of parameters and models were highlighted so that PRA results would be better understood.

1.6.6 IPEEE Comparison This effort was a comparison task to assess key insights gained from the Individual Plant Examination of External Events (IPEEE) assessments. As many members did not do full fire and seismic PRAs, only key insights and dominant initiators were identified and compared.

Insights were generally consistent among member utilities. Comparisons indicated that actual external event risk values were likely distorted, since the simplified methodologies typically used in these assessments produced conservative results.

1.7 CEOG PSA Technical Positions CEOG PSA Technical Positions (Standards) and Guidelines were developed to either address a specific application need or were an outgrowth of the results of quality-related tasks, such as the CEOG plant cross-comparison, CEOG risk-informed joint applications, and resolution of PRA issues raised by individual member utilities. Section 4 lists the CEOG Technical Positions and describes the Palo Verde position on each of these documents.

1.8 Continuous Quality Improvement Process The Palo Verde PRA has undergone considerable evolution since the original Individual Plant Examination (IPE) submittal. The history of the PRA model updates is described in Section 2.

A strong level of commitment over the last twelve years is demonstrated by this development history.

The Palo Verde PRA staff has been maintained at a level such that nearly all technical work is performed in-house by qualified staff with strong plant-specific knowledge. The PRA Group consists of a supervisor, or Group Leader, one consulting engineer and six senior engineers.

Five of these engineers held Senior Reactor Operator Licenses or SRO certification on Palo 6

Enclosure 2 Attachment 4 PRA Quality and History Verde or other stations. The Engineering Support Group collects failure, success, unavailability and plant operating data for various plant needs, including the Maintenance Rule and the PRA.

The Palo Verde PRA Group has also actively participated in the industry peer review process.

One engineer has participated in every CEOG peer review (five reviews to date). This participation is an effective means of understanding the plant design differences, and an excellent means of seeing the different modeling techniques.

2. PVNGS PRA Model 2.1 Model Overview Palo Verde uses the large fault tree/small event tree, also known as the linked fault tree, methodology. Basic failure events are modeled down to the component level. Level 1 (Core Damage Frequency, or CDF) and Level 2 (Large Early Release Frequency only, or LERF) are fully developed. A Level 3 (Dose Consequence) analysis was done to support the Individual Plant Examination (IPE), but has not been maintained.

The Internal Events model consists of twenty-eight (28)-initiating events, which proceed through their respective event trees. Failure branches are assigned a plant damage state (PDS) CM (Core Melt) or ATWS (Anticipated Transient Without Scram) and an appropriate Level 2 damage state. ATWS is modeled in separate event trees. Failure branches there are also assigned CM and the appropriate Level 2 PDS. Core Melt is defined as initiation of sustained uncovery of the top of the active fuel.

Internal flooding was analyzed using a screening process for the IPE. That analysis is still considered to be valid. Internal flooding is not currently modeled using event and fault trees. A task is currently underway to update the flooding analysis.

External Events were examined as required by Generic Letter 88-20 Supplement 4, the IPE for External Events (IPEEE). None was analyzed by a fully developed PRA. Recently a full fire PRA was developed and incorporated into the PVNGS PRA model. Only buildings and external areas where a fire could not credibly interfere with normal plant operations were screened from consideration. No compartments within buildings housing plant equipment used for normal power production or emergency operations were screened. There are approximately 135 fire initiating events. These proceed first through fire event trees, which determine potential fire damage states (FDS). Each FDS is then carried through an event tree mimicking the internal events event trees. CM, ATWS and Level 2 PDSs are assigned as in the internal events event trees.

Although a full Level 2 analysis was performed for the IPE, it has since been reduced to considering only Large Early Release Frequency (LERF) consistent with Reg. Guide 1.174, which is of more relevance to actual public risk. The various CM sequences, both from the internal events and fire event trees, have been assigned to LERF damage states, of which there are approximately thirty (30) for internal events and thirty (30) for fire events.

Separate from the full-power internal events analysis, the model has also been expanded to include Transition Risk, which covers Modes 2 and 3, along with Mode 4 steaming (prior to alignment of shutdown cooling), which was a Combustion Engineering Owners Group initiative.

7

Enclosure 2 Attachment 4 PRA Quality and History 2.2 Palo Verde PRA Development History Numerous revisions to the PVNGS PRA model have been implemented since the Individual Plant Examination was performed. These revisions include thousands of changes to event sequence and fault tree modeling, as well as data changes. Changes to the model and data are made in response to:

• Physical changes to the facility

• Changes to operating and maintenance procedures, as well as administrative controls

• Errors found in reviews of the model, or during its use

• Enhancements where experience has indicated that greater accuracy is needed to remove unnecessarily conservative assumptions Coincident with conversion of the PRA model from Unix-based software and platform to a Winclows-based platform using Relcon's Risk SpectrumTM software in 1996, the model was completely rebuilt to ensure complete documentation and control of the model and associated software. This effort led to the following improvements:

• Equipment failure rates were updated with referenceable sources;

• Control circuit failure analyses were completely re-performed and documented;

• Initiating Event methodology was documented and the initiating events were recalculated and Bayesian-updated;

• Common-cause failure methodology was re-performed and documented;

• Human Recovery Analysis was completely re-performed and documented based on current operating, maintenance, emergency and administrative control procedures;

• System modeling was reviewed and numerous updates made to such systems as Engineered Safety System Actuation, Auxiliary Feedwater, Low and High Pressure Safety Injection, Essential Spray Ponds (ultimate heat sink) and Chemical Volume and Control. Modeling of the non-class 1E electrical distribution systems was expanded to better capture power loss impact on non-class equipment credited in the model.

• Changed the focus of Level 2 modeling to Large Early Release Frequency.

• Since Risk SpectrumTm has extensive documentation capability, all references to station and external documents are included within the PRA database. This allows periodic comparison to the station's document database to identify revision changes.

The following changes represent corrections and enhancements to the model that improve its fidelity and accuracy, but did not necessarily have a significant impact on CDF or LERF:

• Refined modeling of power distribution failures as initiating events to ensure completeness. Definite system boundaries were defined. The two initiators, Loss of Channel A Vital AC and Loss of Channel B Vital AC, were changed to capture all losses of power due to station equipment failure from the Start-up Transformers, the 13.8KV, 4.16KV and 480VAC distribution systems to the battery chargers and the back-up voltage regulators for the Vital AC system. A more recent change split this nitiator into several pieces to better capture where in the distribution systems problems originate that lead to plant trips or shutdowns.

8

Enclosure 2 Attachment 4 PRA Qualitit and History

• Updated Human Recovery Analysis, both to capture procedure changes and to ensure consistent and defensible modeling methodology.

• Added Reactor Coolant Pump High Pressure Seal Cooler Rupture as an initiating event.

This was identified as a potential containment bypass event.

• Improved Steam Generator Tube Rupture modeling as the industry and NRC have addressed this issue. The model now includes multiple tube rupture sequences and pressure-induced tube rupture.

• Data update was performed in January 2006. As more plant-specific data has become available through failure data trending and Maintenance Rule requirements, failure rates for risk-important equipment have been Bayesian-updated.

• Added more detail to the switchyard modeling to better assess maintenance activities.

• Removed Reactor Coolant Pump seal leakage modeling following Westinghouse evaluation of CE seal designs and acknowledgement of Palo Verde's unique design.

• Added thermally-induced SG tube rupture following steam line break. This had no impact on results, but conforms to the industry standard.

Changes that had a significant impact on the Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) are summarized below:

• Added modeling of the Station Blackout Gas Turbine Generators (GTGs), which were installed to address the Blackout Rule, 10CFR50.46. While the modeling of the GTGs was not credited in the IPE directly, it was used to address and close out USI A-45, which was included as part of the GL 88-20 submittal.

• Dependence of Train A Auxiliary Feedwater on room cooling was removed. Best-estimate room heat-up calculations showed that temperature does not exceed the qualification temperature of the equipment. This improves the overall calculated reliability of the Auxiliary Feedwater system to better reflect the plant capability.

• Refined the GTG modeling to allow success with one GTG rather than requiring both for certain sequences. The GTGs have an output less than that of the Emergency Diesel Generators. One GTG is not capable of powering both an electric Auxiliary Feedwater Pump and a HPSI pump, along with support equipment. Since most sequences only require AF, and not HPSI, one GTG is adequate for those sequences.

• Change of the test interval for ESFA'S relay testing from 62-day to 9-month staggered as a result of a Tech Spec change; resulting common-cause failure value changes were also incorporated. This resulted in a significant increase in both CDF and LIERF. At the urging of the PRA group, these test intervals were later shortened to quarterly for the relays associated with Auxiliary Feedwater injection valves. This reduced CDF and LERF by about 10%.

• Credited an additional check valve in the charging line to remove conservatism in the containment penetration model. This change significantly reduced LERF.

• Removed Loss of Control Room HVAC as an initiating event. This event had been modeled in a highly conservative and unrealistic manner. Since the Control Room is continuously manned, and since at least twelve hours are available before equipment failure temperatures would be reached, it would be virtually certain that either equipment could be repaired or temporary cooling could be established.

• Updated Initiating Event Frequencies in 2001 resulting in significant decreases to Uncomplicated Reactor Trip and Turbine Trip frequencies. The definition of Uncomplicated Reactor Trip (called Miscellaneous Trip in the model) was narrowed to 9

Enclosure 2 Attachment 4 PRA Quality and History be consistent with the rest of the industry. Previously, all manual shutdowns, including for planned outages, were counted as initiators. This in turn resulted in much lower CDF and LERF, and significantly affected importance measures.

• Addition of the alternate off-site power supply to each ESF bus. This plant feature had not been procedurally allowed due to Technical Specification interpretation.

• Physical plant change adding a redundant power supply to the BOP ESFAS' cabinet cooling fans. This change makes spurious load shed actuation much less likely.

• Added alignment of the Gas Turbine Generators to the initiating event trees for loss of off-site power to Train A or B ESF Bus. This provides a more realistic treatment of these initiators.

• Changed the treatment of the Loss of Instrument Air initiating event to allow use of low-pressure condensate (Alternate Feecdwater) in its mitigation. This was possible due to removal of an incorrect dependence of the Condensate system on Instrument Air.

• Reduced the Reactor Coolant Pump seal failure probability based on new information.

• Corrected modeling of spurious load shed. Certain failures had been incorrectly modeled as preventing closure of the Emergency Diesel Generator output breaker.

Internal Events CDF and LERF have varied significantly as the above changes were implemented. Compared to the IPE, CDF- has decreased from 9.0E-5/yr to 1.27'E-5/yr. LERF cannot be compared to the overall Level 2 value presented in the IPE, but compared to when it was first determined in 1998, it has decreased from 2.5E-6/yr to 1.57E-3I/yr. When internal events and fire are quantified to the same truncation level, fire contributes about 24% to total CDF and 10% to total LERF. These results are documented in Ref. 9, Interim PRA Change Documentation.

3. Combustion Engineering Owners Group Technical Positions 3.1 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for the Loss of Coolant Accident This CEOG PSA Standard is no longer used; LOCA frequencies are based on NUREG/CR-5750, Ref. 8. The NUREG values were used in lieu of the CEOG standard because the NUREG is a more recent document and more publicly available.

3.2 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for Main Steam Line Break Events The CEOG standard is used as the basis for developing large steam and feedwater line break IE frequencies.

3.3 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for Steam Generator Tube Rupture The CEOG standard is used as the basis for calculating the PVNGS SGTR frequency.

3.4 CEOG PSA Standard: Success Cril:eria for the Minimum Number of Safety Injection Pathways Following Large and Small Break LOCAs for CE PWRs 10

Enclosure 2 Attachment 4 PRA Quality and History The CEOG standard is used.

3.5 CEOG PSA Standard: Best Estimate ATWS Scenarios and Success Criteria The CEOG standard is used.

3.6 CEOG PSA Standard: Evaluation of the Mechanical Scram Failure for ATWS Occurrence Frequency The CEOG standard is used.

3.7 CEOG PSA Standard: Reactor Coolant Pump Seal Failure Probability Given a Loss of Seal Injection The CEOG standard was used in the development of RCP seal failure probability. Modeling showed that RCP seal failure is not a significant contributor to CDF or LERF under any circumstances. It was subsequently removed from the model.

3.8 CEOG PSA Standard: Evaluation cf the Initiating Event Frequency for Reactor Vessel Rupture Reactor vessel rupture is not explicitly modeled in the PVNGS PRA. Its frequency is less that 1E-7/yr allowing it to be screened. It is not possible to mitigate the event, so modeling it provides no insight. Palo Verde's reactor vessel is less susceptible to brittle fracture due to a lower than typical copper content in the steel alloy used for the vessel.

4. Independent External Reviews

• Combustion Engineering Owners Group performed a review of the overall PRA modeling as part of the industry-wide PRA quality initiative in November 1999. All F&Os are addressed in PRA's Impact Database, as well as by the station's Corrective! Action Program (CRDR 113787).

• Erin Engineering performed a review of Large Early Release Frequency methodology and results in December 2000.

• In early 2001 Erin Engineering reviewed all Category A and B Facts and Observations (F&Os) from the CEOG peer review. The results are as follows:

o Category A - 8 F&Os. 4 were closed and the responses deemed satisfactory, 4 were later closed.

o Category B - 26 F&Os. 7 were closed and the responses deemed satisfactory, 12 were later closed, 5 were judged to be Category C and are still open (all documentation issues), one was redundant to another F&O. The open item is lack of flooding analysis documentation. The flooding analysis is being updated at this time.

11

Enclosure 2 Attachment 4 PRA Qualitit and History

5. References

1. Station Procedure 7ODP-ORA03, PRA Model Control

2. Station Procedure 81 DP-4CC03, Engineering Studies

3. Reg. Guide 1.33, Quality Assurance Program Requirements

4. Station Procedure 81 DP-OCCO5, Design and Technical Document Control

5. Station Procedure 80DP-OCCO1, PVNGS Non-process Software QA Program

6. Station Procedure 8ODP-OCCO2, Non-process Qualified Software Development, Process and Upgrades

7. Station Procedure 8ODP-OCCO6, Control and Use of Qualified Non-process Software and Data

8. NUREG/CR-5750, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995

9. Engineering Study 13-NS-C029, Interim PRA Change Documentation, Rev 14.

12