NRC 2008-0032, License Amendment Request 260, One-Time Extension of Completion Time for Technical Specification 3.7.5, Auxiliary Feedwater System

License Amendment Request 260, One-Time Extension of Completion Time for Technical Specification 3.7.5, Auxiliary Feedwater System

ML081510464
Person / Time
Site:	Point Beach
Issue date:	05/29/2008
From:	Mccarthy J Florida Power & Light Energy Point Beach
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NRC 2008-0032
Download: ML081510464 (31)

Text

FPL Energy Point Beach, LLC, 6610 Nuclear Road, Two Rivers, WI 54241 FPL Energy Point Beach Nuclear Plant May 29,2008 NRC 2008-0032 10 CFR 50.90 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555 Point Beach Nuclear Plant, Units 1 and 2 Dockets 50-266 and 50-301 Renewed License Nos. DPR-24 and DPR-27 Response to Request for Additional lnformation License Amendment Recluest 260 One-Time Extension of Com~letionTime for Technical Specification 3.7.5. Auxiliarv Feedwater System

References:

(1) FPL Energy Point Beach, LLC to NRC Letter Dated December 29,2007, License Amendment Request 260 One-Time Extension of Completion Time for Technical Specification 3.7.5, Auxiliary Feedwater System (2) NRC to FPL Energy Point Beach LLC Letter Dated April 29,2008, Point Beach Nuclear Plant, Units 1 and 2 - Request for Additional lnformation (RAI) Related to Technical Specification 3.7.5 C Completion Time Extension (MD7672 and MD7673)

(3) FPL Energy Point Beach, LLC to NRC Letter Dated May 16, 2008, Response to Request for Additional Information, License Amendment Request 260 One-Time Extension of Completion Time for Technical Specification 3.7.5, Auxiliary Feedwater System (4) FPL Energy Point Beach, LLC to NRC Letter Dated December 12,2007, Response to Request for Additional lnformation License Amendment Request 256 One-Time Extension of Containment Integrated Leakage Rate Test Interval (ML073540524)

Via Reference (1) FPL Energy Point Beach, LLC submitted a proposed license amendment request for Commission review and approval pursuant to 10 CFR 50.90 for the Point Beach Nuclear Plant (PBNP), Units 1 and 2. The proposed amendment would allow two separate one-time extensions of the completion time (CT) of LC0 3.7.5.C from seven days to 16 days.

An FPL Group company

Document Control Desk Page 2 On April 24, 2008, a telephone conference was held between representatives of the NRC staff and FPL Energy Point Beach to discuss a pending request for additional information in support of License Amendment Request 260 to enable further review of the application. It was agreed that the response to the request for additional information would be submitted by May 29, 2008.

The enclosure of this letter provides the FPL Energy Point Beach response to Reference (2).

FPL Energy Point Beach has determined that the response to this request for additional information does not alter the conclusions contained in the no significant hazards consideration nor the environmental consideration associated with the proposed amendment and associated Technical Specification changes.

Summarv of New and Revised Commitments This submittal contains the following revised Regulatory Commitments:

(Revised Commitment) - There will be no planned hot work in fire areas other than the area in which the MDAFW pumps are being replaced for the duration of the proposed TSAC 3.7.5.C.

(Revised Commitment) - There will be no transient combustibles permitted in areas other than the area in which the MDAFW pumps are being replaced for the duration of the proposed TSAC 3.7.5.C.

This submittal contains the following new Regulatory Commitments:

(New Commitment) -The five fire areas for which feasible and reasonable compensatory manual actions can be implemented are A01-6/46, A02, A15, A25 and A26. A temporary change to FOP 1.2 will be made to provide augmented manual compensatory actions for these five areas prior to entry into TSAC 3.7.5.C.

(New Commitment) - OM 3.1, Operations Shift Staffing Requirements, will be temporarily revised prior to entry into TSAC 3.7.5.C to ensure personnel availability of two Operations personnel to implement augmented manual actions for the duration of the TSAC.

(New Commitment) - Operations personnel designated as performing augmented compensatory actions in five fire areas will receive a pre-job brief on required augmented compensatory manual actions.

This submittal has been reviewed by the Plant Operations Review Committee.

Document Control Desk Page 3 In accordance with 10 CFR 50.91, a copy of this response is being provided to the designated Wisconsin Official.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on May 29,2008.

Very truly yours, FPL Energy Point Beach, LLC James H. McCarthy Site Vice President Enclosure cc: Administrator, Region Ill, USNRC Project Manager, Point Beach Nuclear Plant, USNRC Resident Inspector, Point Beach Nuclear Plant, USNRC PSCW

ENCLOSURE FPL ENERGY POINT BEACH, LLC POINT BEACH NUCLEAR PLANT, UNITS I AND 2 LICENSE AMENDMENT REQUEST 260 ONE-TIME EXTENSION OF COMPLETION TIME FOR TECHNICAL SPECIFICATION 3.7.5, AUXILIARY FEEDWATER SYSTEM RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION The following information is provided by FPL Energy Point Beach, LLC in response to the NRC staffs request for additional information dated April 29, 2008 associated with License Amendment 260 for Point Beach Nuclear Plant (PBNP) Units 1 and 2.

PRA RAI-1 The discussion of PRA reviews (section 3.1.1.3of Enclosure 2) identi& that the licensee has performed gap assessments of the PRA model using Regulatory Guide (RG) I.200 and the internal events PRA standard American Society of Mechanical Engineers (ASME)-RA-Sb-2005, and state that observations from the assessment are being addressed in an ongoing upgrade project, The licensee is requested to provide a disposition of any identified and unresolved deficiencies as to their potential impact on the risk assessment results used to support this application.

FPL Energv Point Beach Response An assessment of the PBNP PRA was performed to determine what gaps existed between the model and the requirements of the ASME PRA Standard (ASME-RA-Sb-2005). The gaps that are "documentation only," were not examined for their potential effect on the application. The LE (Level 2) and IF (Internal Flooding) supporting requirement gaps were also not examined for their potential effect on the application. Large early release is typically dominated by containment bypass s uences, so addressing the internal events gaps would also be sufficient k

for LERF concerns. ince all of the auxiliary feedwater (AFW) pumps are in the same flood area, the impact of having a single motor-driven auxiliary feedwater (MDAFW) pump out of service on internal flooding sequences is decreased; making the lack of an IF gap analysis less of a concern. Therefore, gaps in these areas are not expected to have a measurable effect on this application.

An assessment of the remaining gaps' potential effect on the analysis supporting the one-time AFW Completion Time (CT) extension request has been performed. Only two gaps were determined to potentially have a measurable effect on the analysis as discussed below.

1. Limited-Scope Human Failure Event (HFE) Dependency Analysis. The effect of this gap will be included in the revised, expanded dependency analysis being performed as a part of the upgrade of the model to meet RG 1.200 Category II requirements. The maximum calculated ICCDP for a 9-day extension of the MDAFW CT is 2.30E-07. This is less than one-half of the RG 1.I77 definition of a small increase in risk of 5.OE-07 for a permanent change. This margin would tend to offset the potential impact of the resolution of this gap.

Page 1 of 28

2. Recovery of Offsite Power for Loss of Offsite Power Cases. The recovery of offsite power for LOOP cases is not currently modeled in the PBNP PRA because of limited modeling of the initiator. This could have a measurable effect on the application; however, the effect would be to lower the risk associated with the CT increase, therefore, providing additional margin to the RG 1.I 77 acceptance criteria. Crediting recovery of offsite power, when applicable, would lower the Incremental Conditional Core Damage Probabilities for this application.

PRA RAI-2 The discussion of the internal events risk (section 3. I.1.3 of Enclosure 2) identified that the cutset results of the PRA analysis were revised to take credit for recovery actions (which the staff therefore assumes are not included in the baseline PRA model), and to eliminate sequences which are stated to not actually lead to core damage based on plant operating experience and the simulator. In effect, the model is being corrected and revised outside normal processes, and such manipulation of the results is inappropriate and inconsistent with current industry practices and standards, and should require a focused peer review based on changing success criteria (i.e., now basing the sequences on the simulator and on operating experience), and adding new recovery actions. Also, such changes must be propagated in the baseline model as well, to avoid underestimating the delta risk. The licensee is requested to:

a. Explain exactly how the PRA results were modified,

b. Explain why sequences included in the baseline model as core damage should be eliminated for the configuration-specific risk calculations,

c. Explain how the baseline model was similarly examined and revised,

d. Justify that the manipulation of the results does not undermine the statements of PRA quality based on peer reviews and gap assessments,

e. Justify the revised success criteria based on operating experience and simulations, and

f. Justify that the modifications to the model do not require peer review, or provide the results of the review of these changes.

FPL Enerslv Point Beach Response The PBNP PRA model approved at the time this application was submitted (Revision 3.18) has been modified to include more recent plant data. The updated plant data, which has since been incorporated into the approved model as Revision 4.00, was used to generate cutsets for each of the following six cases:

1. Unit 1 core damage baseline assuming zero test and maintenance

2. Unit 2 core damage baseline assuming zero test and maintenance

3. Unit 1 core damage with P-38A out of service

4. Unit 1 core damage with P-38B out of service

5. Unit 2 core damage with P-38A out of service

6. Unit 2 core damage with P-38B out of service Page 2 of 28

The top 200 combined cutsets for the four cases with a pump out of service were compared to the baseline zero test and maintenance cutsets to determine which cutsets would be in the top 200 as a result of taking a pump out of service. These additional cutsets were then examined to determine if they would cause core damage and if all actions plant operators would take using existing abnormal and emergency procedures were reflected in the cutsets. The proceduralized actions not currently credited in the PRA model were then analyzed using the EPRl Human Reliability Analysis (HRA) Calculator methodology to determine the Human Error Probability (HEP) for those actions. The probability for the additional cutsets with non-modeled actions was adjusted based upon the new HRA findings or set to zero for those cutsets found not to be true core damage sequences. The change in core damage frequency (CDF) above the baseline value was then determined for each of the four MDAFW pump out of service cases. The adjustments made to the model for this application are discussed below:

The PRA model assumes that if a steam generator is faulted that it cannot be fed using AFW, requiring initiation of feed and bleed. PBNP Critical Safety Procedure (CSP)-H.l, Response to Loss of Secondary Heat Sink, Revision 29, dated 04/19/2007, Steps 4 and 5, allow feeding a faulted steam generator when a non-faulted steam generator is not available, ensuring adequate heat removal to prevent core damage and making feed and bleed unnecessary. This action was analyzed using established Human Reliability Analysis techniques and the total probability (both human and equipment) of failing to use the remaining MDAFW pump to restore secondary cooling is evaluated as 5.2E-03. This probability was conservatively increased to 0.1 and applied to account for this non-modeled action in cutsets involving steam line breaks outside containment.

For steam linelfeed line breaks inside containment, half of the breaks were taken on the feed line with the other half on the steam line. No credit for AFW was taken for a feed line break since it was assumed that any feedwater would go out the break into containment rather than into the steam generator. However, if the break was in the steam line, feedwater flow would still be beneficial. Since this strategy would only work for half of the steam linelfeed line breaks inside containment, the conservative reduction factor of 0.1 for breaks outside containment was increased to 0.2 for cutsets involving failures inside containment.

The PRA model assumes that for a loss of AC andlor DC power rendering the operable MDAFW pump out of service, no feedwater flow is available. No credit is taken for restoration of condensate and main feedwater pumps associated with the train of AC and DC power still energized. It is likely that if the event occurred at 100% power with no safety injection required, this train of condensate and feedwater would still be in service from before the loss of power event. In a loss of secondary heat sink event caused by loss of all AFW pumps, CSP-H.l, Response to Loss of Secondary Heat Sink, Revision 29, dated 0411912007, Steps 8 through 14, restore feedwater flow to an available steam generator using a condensate and feedwater Pump.

This action was analyzed using established HRA techniques and the total probability (both human and equipment) of failing to use an available condensate and feedwater train to restore secondary cooling is 5.8E-03. This probability was conservatively increased to 0.1 and applied to account for this non-modeled action in applicable Page 3 of 28

loss of AC and/or DC power cutsets. This credit was not taken for loss of offsite power cutsets, since affected buses would either be deenergized or on the associated emergency diesel generator. In these situations, condensate and feedwater pumps would not be available.

3. The PRA model assumes that a faulted-ruptured steam generator cannot be fed using AFW, nor is it available as a source of steam for the affected unit turbine-driven AFW (TDAFW) pump. Flow from the reactor coolant system (RCS) into the steam generator and out the break provides a mechanism for heat removal from the core and RCS. The boiling action of reactor coolant after it enters the secondary side of the steam generator provides adequate cooling to prevent core damage as long as safety injection flow to the RCS is available. As a result, feedwater flow is not necessary to prevent core damage for faulted-ruptured steam generator events and cutsets involving this event were assigned a core damage frequency of zero.

4. The PRA model assumes that a transient with loss of the Power Conversion System (PCS) results in a loss of condensate and feedwater. Based upon Section 4.8 of the PBNP Initiating Events Notebook, PRA 2.0, Revision 4, dated March 14, 2008, 63% of loss of PCS events do not result in loss of main feedwater. If main feedwater is still available, then using established HRA techniques, it was determined that main feedwater could be restored and aligned to an available steam generator in accordance with CSP-H.l, Response to Loss of Secondary Heat Sink, Revision 29, dated 04/19/2007, Steps 8 through 14, with an HEP of 0.1. It is assumed that the remaining 37% of loss of PCS events involve a non-recoverable loss of main feedwater. Therefore, the fraction of loss of PCS events where main feedwater could not be used for secondary cooling is [(0.1 x 0.63) + 0.371 = 0.43.

Consequently, a reduction factor of 0.43 was applied to the CDF for each cutset involving a loss of PCS event.

None of the adjustments described above constitutes a change in approved PRA model success criteria.

The normal process for PRA model changes and corrections involves documentation of the proposed modification, review of the modification by a technical reviewer and subsequent approval of the change. This process was completed, documented and subjected to the same review and approval process noted above for the adjustments made to the cutsets in support of this application. Consistent with the PRA model update process, the adjustments described above will be incorporated into the approved PRA model currently in daily use. Since the currently approved model does not yet include these recovery actions and operating experience-based adjustments, risk estimates obtained using the current model are inherently conservative. Use of the currently approved model overestimates delta risk until such time as the model revisions and documentation updates are made using the established development, review and approval process.

The use of simulator and operator experience to add or modify recovery actions does not constitute a change in success criteria nor does it change PRA model development methodology. Therefore, the use of this experience does not require a focused peer review. Likewise, identification and removal of invalid cutsets based on simulator operating experience does not change PRA model success criteria and does not need a peer review.

Page 4 of 28

PRA RAI-3 The staff is unable to understand the basis for the risk results presented for the delta core damage frequency (ACDF) for cases with one or both units on-line (section 3.1.I. 7 of Enclosure 2, Table 4). Specifically, the staff assumes that ACDF results presented in Table I (section 3. I. 1.3 of Enclosure 2) and the incremental core damage probability results presented in Table 3 (section 3. I. 1.4 of Enclosure 2), are based on the assumption that the units are on-line. Therefore, it is expected that there would be a relationship between the Table 4 entries for both units on-line and Tables 1 and 3.

However, none of the specific risk values presented in Table 4 appear to be related to the other results presented, and are in fact higher values. The licensee is requested to clarify the basis for Table 4 entries, and their relationship to the other risk results presented in the submiftal.

FPL Ener~vPoint Beach Response Table 1 shows the results of instantaneous ACDF and ALERF calculations. The baseline risk was first determined by running the model for Unit 1 and then for Unit 2 with no equipment out of service and no test and maintenance activities in progress in each case. The results were entered in Table 1 in the "Baseline Risknrow. The LERF values provided were assumed to be 10% of the CDF values.

The model was then run for Unit Iwith only the "A" MDAFW pump (P-38A) out of service, and then with only the " B MDAFW pump (P-38B) out of service (00s). This process was repeated for Unit 2. The cutsets for each of these four runs were examined for realism and consistency with approved plant procedures to eliminate unnecessary conservatism in the model as discussed in the response to PRA RAI-2 above. This examination resulted in generation of a corrected CDF for each of the four cases which is entered in the " A MDAFW pump OOS and "B" MDAFW pump OOS rows in the table.

The LERF values provided were assumed to be 10% of the CDF values.

The applicable baseline CDF and LERF was subtracted from each of the four MDAFW pump out of service CDFs and LERFs to determine the ACDF and ALERF for each case.

The ACDFs were entered in the "A" MDAFW Pump OOS ACDFIALERF and " B MDAFW pump OOS ACDFIALERF rows in the table.

The specific calculations showing how Table 1 ACDF values were obtained are as follows:

ACDF = (CDFMDAFWP - ACDFcorr - CDFbaseline) where:

CDFMD~mp= Uncorrected Core Damage Frequency with a MDAFW pump out of service

= 3.672E-05 Iyr for Unit 1 with P-38A out of service

= 4.528E-05 lyr for Unit 1 with P-38B out of service

= 3.981 E-05 lyr for Unit 2 with P-38A out of service

= 3.615E-05 Iyr for Unit 2 with P-38B out of service Page 5 of 28

ACDFcom = Reduction in CDF due to taking credit for proceduralized actions not in the current PRA model and elimination of non-core damage cutsets

= 1.160E-05 Iyr for Unit 1 with P-38A out of service

= 1.623E-05 Iyr for Unit 1 with P-38B out of service

= 1.365E-05 Iyr for Unit 2 with P-38A out of service

= 1.I61E-05 Iyr for Unit 2 with P-386 out of service CDFb,,i = Core Damage Frequency for the zero test and maintenance baseline

= 1.971E-05 Iyr for Unit 1

= 1.912E-05 Iyr for Unit 2 The change in CDF is calculated for each of these cases below:

ACDF = Change in Core Damage Frequency

= (3.672E-05 Iyr - 1.160E-05 Iyr - 1.971E-05 Iyr) = 5.41E-06 Iyr for Unit 1 with P-38A out of service

= (4.528E-05 Iyr - 1.623E-05 Iyr - 1.971E-05 Iyr) = 9.34E-06 Iyr for Unit 1 with P-38B out of service

= (3.981E-05 Iyr - 1.365E-05 Iyr - 1.912E-05 Iyr) = 7.04E-06 Iyr for Unit 2 with P-38A out of service

= (3.615E-051yr- 1.161E-051yr- 1.912E-05/yr)=5.42E-06/yr for Unit 2 with P-38B out of service Tables 2 and 3 show the results of ICCDP and ICLERP calculations for 9day and 16-day CT extensions, respectively. These values were determined by applying the formulas for ICCDP and ICLERP shown in Section 3.1 . I .4 of the application (ICCDP = ACDF

• At). For example, the Unit 1 ICCDP for " A MDAFW pump OOS for an additional 9 days was determined by taking the Unit 1 " A MDAFW pump OOS ACDF (5.41E-6 Iyr) from Table 1, multiplying it by 9 days and applying a unit conversion of (1 yrl365 days) which results in 1.33E-07, as shown on Table 2. The rest of the values on Tables 2 and 3 were calculated using the same methodology. In both Tables 2 and 3, all ICCDP values are below 5.OE-7 and ICLERP values are below 5.OE-8 and are within the guidelines set forth in Regulatory Guide (RG) 1.I 77 Section 2.4. This comparison was provided in Section 3.1.I .4 of the application for amendment.

Table 4 shows the results of a sensitivity study showing the ACDFs for each MDAFW pump out of service if one of the plant units was in an outage (MODE 5, 6 or defueled).

The values presented in this table did not include the corrections applied in Table 1 to eliminate unnecessary conservatisms in the model. A revised version of Table 4 is provided below showing the values using the corrected CDF and LERF values presented in Table 1 to provide the opportunity for comparison of more realistic values, consistent with approved plant procedures and operating characteristics.

Page 6 of 28

Revised Table 4 Comparison of ACDF with Units On Line and Shut Down ACDF (Unit 1) ACDF (Unit 2)

Both Units on line A MDAFW pump out of service 5.41E-6 /yr 7.04E-6 /yr B MDAFW pump out of service 9.34E-6 /yr 5.42E-6 Iyr Unit 1 in MODE 5, 6 or defueled A MDAFW pump out of service n/a 5.75E-6 /yr B MDAFW pump out of service nla 3.77E-6 /yr Unit 2 in MODE 5, 6, or defueled A MDAFW pump out of service 3.76E-6 Iyr nla B MDAFW pump out of service 7.68E-6 /yr n/a The Unit 1 and Unit 2 in MODE 5, 6 or defueled ACDFs in Revised Table 4 were calculated using the same methodology as for the ACDFs in Table 1, as follows:

CDFMDAwP= Uncorrected CDF with one Unit in an outage and a MDAFW pump out of service

= 3.500E-05 /yr for Unit 1 with Unit 2 outage and P-38A out of service

= 4.356E-05 /yr for Unit 1 with Unit 2 outage and P-38B out of service

= 3.808E-05 /yr for Unit 2 with Unit 1 outage and P-38A out of service

= 3.444E-05 /yr for Unit 2 with Unit 1 outage and P-38B out of service ACDF, = Reduction in CDF due to taking credit for proceduralized actions not in the current PRA model and elimination of non-core damage cutsets

= 1.I 58E-05 Iyr for Unit 1 with Unit 2 outage and P-38A out of service

= 1.622E-05 /yr for Unit 1 with Unit 2 outage and P-38B out of service

= 1.326E-05 /yr for Unit 2 with Unit 1 outage and P-38A out of service

= 1.160E-05 /yr for Unit 2 with Unit 1 outage and P-38B out of service CDFbaseline = CDF for the zero test and maintenance baseline quantification

= 1.966E-05 /yr for Unit 1 with Unit 2 outage

= 1.907E-05 /yr for Unit 2 with Unit 1 outage The change in CDF is calculated for each of these cases below:

ACDF = Change in CDF

= (3.500E-05 /yr - 1.158E-05 /yr - 1.966E-05 /yr) = 3.76E-06 /yr for Unit 1 with Unit 2 outage and P-38A out of service

= (4.356E-05 Iyr - 1.622E-05 /yr - 1.966E-05 /yr) = 7.68E-06 /yr for Unit 1 with Unit 2 outage and P-38B out of service

= (3.808E-05 /yr - 1.326E-05 /yr - 1.907E-05 /yr) = 5.75E-06 /yr for Unit 2 with Unit 1 outage and P-38A out of service

= (3.444E-05 /yr - 1.160E-05 /yr - 1.907E-05 /yr) = 3.77E-06 /yr for Unit 2 with Unit 1 outage and P-38B out of service The conclusion from the data in the revised Table 4 is that if a unit is in an outage at the time this one-time CT extension is invoked, there is an 18 to 30% reduction in ACDF results from what it would be with both units in service.

Page 7 of 28

Performing the MDAFW pump replacement activities with both units at power ensures stable plant conditions with the largest contingent of plant personnel, material and management oversight resources available to focus on the modifications without the demands of a concurrent unit outage. These intangible effects have not been included in the calculation of ACDF, but are considered by FPL Energy Point Beach to be significant. The requested extension of the Completion Time could prevent a dual unit shutdown, with its accompanying increase in risk, when restoration to full capability can completed within a reasonable amount of time.

PRA RAI-4 Because the motor-driven auxiliary feed water (AFW) pumps are shared between units, the staff is concerned that there may be dual unit initiators (such as loss of offsite power, for example) which would cause a demand for the remaining operable motor-driven AFW pump for both units simultaneously. In such a case, the sum of the single unit risk metrics would be nonconservative to the total risk impact due to the common initiator.

The licensee is requested to discuss and quantify the risk impact of any such dual unit initiators to demonstrate that these are not significant contributors.

FPLE Point Beach Response There are six dual-unit initiating events quantified in the PBNP PRA. They are:

Loss of Off Site Power (INIT-TI),

Station Blackout (INIT-SBO),

Loss of 125 VDC bus DO1 (INIT-TD1),

Loss of 125 VDC bus DO2 (INIT-TD2),

Loss of Instrument Air (INIT-TIA), and Loss of Service Water (INIT-TSW).

As the nature of these initiators results in the loss of the secondary heat sink, the AFW system is important to the six dual-unit events. The potential for both units' risk models to credit the same MDAFW pump for dual-unit initiators is prevented directly within the AFW system fault tree logic. The AFW fault tree model in the PBNP PRA is a dual-unit model. Both units' PRA models use this same AFW system fault tree by linking to different top gates of the tree. All four AFW pumps, both shared motor-driven pumps and the two unit-specific turbine-driven pumps are included in this logic tree. This allows the AFW fault tree logic to keep track of failures of the opposite unit's turbine-driven pump. For all dual-unit initiators, except loss of DC cutsets where the opposite unit's turbine-driven pump has failed, each of the MDAFW pumps is assigned a 50%

probability of being dedicated to the opposite unit by means of a split-fraction flag. For the two loss of DC initiators, one motor-driven and one turbine-driven AFW (TDAFW) pump will be lost, and one unit will also lose main feedwater capability. For the loss of DC initiators, the one remaining motor-driven pump is assigned to the unit where main feedwater and the turbine-driven AFW pump are not available.

For the condition where one MDAFW pump is failed or taken out of service, the split fraction flag results in the remaining MDAFW pump having a 50% probability of being Page 8 of 28

assigned to the opposite unit. This means that 50% of the time, the remaining MDAFW pump is not available to the unit of interest. For loss of DC initiators, one unit will be left with no AFW capability. The unit that has no AFW capability is dependent upon which MDAFW pump is out of service and which loss of DC initiator is being discussed.

Therefore, for the six dual-unit initiating events in the PBNP PRA model, a single MDAFVV pump is not credited to both units simultaneously because of the intrinsic logic structure of the AFW system fault tree.

PRA RAI-5 The large early release frequency (LERF), ALERF, and incremental large early release probability (ICLERP) results are all exactly 0.1 times the corresponding core damage metrics. The licensee is requested to discuss how it models and calculates large early release metrics.

FPL Energv Point Beach Response The LERF estimates were based on insights gained from the response to a request for additional information in support of License Amendment Request 256 (Reference (4)),

which extended the containment integrated leak rate test interval. The current PBNP PRA LERF model includes limited modeling of induced steam generator tube rupture (ISGTR). To improve the Level 2 model, a detailed ISGTR model was developed.

Source Term Categories (STCs) 5,6,7, and 8, as developed in the Level 2 PRA represent the Large Early Release categories. The sum of the frequencies of these STCs represents the Large Early Release Frequency (LERF).

Estimates of the ACDF and ALERF were performed for a representative configuration in which one MDAFW pump was out of service. The ratio of the ALERF to ACDF increase was less than 0.1. To simplify the LVERF and ICLERP calculations, 0.1 was used to bound the estimates.

PRA RAI-6 The submittal did not identify and justify the truncation limits applied to the baseline model and to the specific application calculations, per RG 1.177, section 2.3.3.4. The licensee is requested to provide this information.

FPL Energv Point Beach Response The truncation limit used in all of the CDF runs was 1.OE-1llyr. For all of the Large Early Release Frequency runs, the truncation limit used was 1.OE-12 lyr. These are the base truncation limits typically used when quantifying the PRA model at PBNP. The cutset manipulation method discussed in RG 1.177, Section 2.3.3.4 was not used for this application. Because new quantifications were explicitly performed with each MDAFW pump failed, one at a time, all important cutsets were retained and the truncation of important cutsets did not occur.

A convergence study was performed to determine the adequacy of these truncation levels for the Unit 1 model while the P-38A MDAFW pump is 0 0 s . Comparable results are expected for the case when the P-38B MDAFW pump is OOS on Unit 1. The Unit 2 Page 9 of 28

model was shown to converge at least as quickly as the Unit 1 model in a study performed for the model quantification summary notebook. As shown in Figure P M MI-6.1, approximately 1% of the CDF cutsets are not accounted for when using a 1.OE-11 Iyr truncation limit for CDF. Approximately 0.1% of the LERF cutsets are not accounted for when using a 1.OE-12 Iyr truncation limit for LERF.

Based on guidance in NEI 99-02 Revision 5, CDF is considered to be converged when decreasing the truncation level by a decade results in a change in CDF of less than 5%.

With the truncation levels used in this application, this criterion is satisfied and the use of the base truncation limits is justified.

Figure PRA RAI-6.1 CDF and LERF Convergence Study for Unit 1 with P-038A MDAFW Pump OOS CDF Convergence Study (Unit 1)

Page 10 of 28

Figure PRA RAI-6.1 CDF and LERF Convergence Study for Unit Iwith P-038A MDAFW Pump OOS (continued)

LERF Convergence Study (Unit 1) 1 -

0.5 - ---

Truncation Level is m -------- - - -

E -0.5 n

-1.5 - p p

- 2 1 . . . ., . . ,

1.OE-10 1.OE-11 1.OE-12 1.OE-13 1.OE-14 Truncation Level (lyr)

PRA RAI-7 The submittal did not identify the important accident sequences which contribute to the risk increase, and therefore did not identify the assumptions and sources of uncertainty which may be important to these sequences such that they could be investigated with sensitivity analyses. This is a necessary step to assure that the risk results are robust, and not driven by particular modeling choices or assumptions made in developing the PRA models. The licensee is requested to characterize the risk increase in these terms, and if there are any assumptions or sources of uncertainty that are important for the sources of the risk increase, to investigate and disposition these using sensitivity analyses or other methods.

Page 11 of 28

FPL Energy Point Beach Response A review of the results for four configurations of interest, including the adjustments described in the response to PRA RAI-2, shows the following dominant accident sequences listed by initiating event in order of the number of occurrences:

1. Unit 1 with " A MDAFWP (P-38A) 0 0 s :

Steam break outside containment - These accident sequences involve a loss of Unit 1 TDAFW pump (due to a variety of causes), combined with failure to establish either feed and bleed or high-head recirculation.

Steamlfeedwater break inside containment - The accident sequences contain events similar to those associated with steam breaks outside containment.

Transient with loss of Power Conversion System (PCS) - The accident sequences involve failures of both the Unit 1 TDAFWP and the shared " B MDAFW pump, along with a failure to establish feed and bleed.

Loss of DC bus D The accident sequences involve failures of all battery chargers associated with affected unit along with a loss of the Unit 1 TDAFWP.

Loss of offsite power - The accident sequences are of three different varieties:

1) Battery chargers not repowered, loss of Unit 1 TDAFW pump and " B MDAFW pump required for the other unit, 2) Both TDAFW pumps fail to start, fail to feed and bleed and "B" MDAFW pump required for the other unit, or 3) Loss of Unit 1 TDAFW pump, fail to feed and bleed and a failure of the 16 steam generator safety valve to reclose.

Loss of all service water - The accident sequences involve failures of both discharge valves in the closed position (either left that way following maintenance or transferring closed on their own) and "B" MDAFW pump aligned to feed the other unit.

2. Unit 1 with "B" MDAFWP (P-38B) 00s:

Loss of DC bus D The majority of the loss of DC bus D-01 accident sequences contain failure of Unit 1 TDAFW pump, loss of the power supply to bus 1B03 (causing a loss of two service water (SW) pumps and loss of the motor-operated valve (MOV) supplying SW to the Unit 1 TDAFW pump suction),

failure of the diesel fire pump (so the condensate storage tank cannot be refilled) and failure to establish feed and bleed or high head recirculation. The remaining accident sequences contain failures of all battery chargers associated with affected unit and of the Unit 1 TDAFW pump.

Steam break outside containment - Similar to the case for "A" MDAFW pump being OOS, the accident sequences involve a loss of Unit 1 TDAFW pump (due to a variety of causes) combined with failure to establish either feed and bleed or high-head recirculation.

Page 12 of 28

Steamlfeedwater break inside containment - The accident sequences contain events similar to those associated with steam breaks outside containment.

Transient with loss of Power Conversion System (PCS) - The accident sequences contain events that fail both the Unit 1 TDAFW pump and the shared " A MDAFW pump along with a failure to establish feed and bleed.

Loss of offsite power - The accident sequences are of three different varieties: 1) battery chargers not repowered, loss of Unit 1 TDAFW pump and " A MDAFW pump required for the other unit, 2) Battery chargers not repowered, gas turbine G-05 failure to start and fail to re-power 1B04 from 1803, 3) Loss of Unit 1 TDAFW pump and instrument airlAFW (IAIAFW) HEP dependency, or 4) Loss of both Unit 1 and Unit 2 TDAFW pumps, " A MDAFW pump required for the other unit and fail to feed and bleed.

Loss of all service water - The accident sequences involve failures of both discharge valves in the closed position (either left that way following maintenance or transferring closed on their own) and "A" MDAFW pump aligned to feed the other unit.

3. Unit 2 with "A" MDAFWP (P-38A) 0 0 s :

Steam break outside containment - The accident sequences involve a loss of Unit 2 TDAFW pump (due to a variety of causes) combined with failure to establish either feed and bleed or high-head recirculation.

Loss of DC bus D The majority of accident sequences contain events failing all battery chargers associated with the affected unit along with a loss of the Unit 2 TDAFW pump. The remaining accident sequences contain failures of Unit 2 TDAFW pump and feed and bleed or high head recirculation.

Steamlfeedwater break inside containment - The accident sequences contain events similar to those associated with steam breaks outside containment.

Transient with loss of Power Conversion System (PCS) - The accident sequences contain events that fail both the Unit 2 TDAFW pump and the shared "B" MDAFW pump, along with a failure to establish feed and bleed.

Loss of offsite power - The accident sequences are of three different varieties:

1) battery chargers not re-powered, loss of Unit 2 TDAFW pump and " B MDAFW pump required for the other unit, 2) Both TDAFW pumps fail to start, fail to feed and bleed and " B MDAFW pump required for the other unit, or 3) Loss of Unit 2 TDAFW pump, fail to feed and bleed and failure of the 28 steam generator safety valve to reclose.

Loss of all service water - The accident sequences involve failures of both discharge valves in the closed position (either left that way following maintenance or transferring closed on their own) and "B" MDAFW pump aligned to feed the other unit.

Page 13 of 28

4. Unit 2 with "B" MDAFP (P-38B) 00s:

Steam break outside containment - The accident sequences involve a loss of Unit 2 TDAFW pump (due to a variety of causes) combined with failure to establish either feed and bleed or high-head recirculation.

Steamlfeedwater break inside containment - The accident sequences contain events similar to those associated with steam breaks outside containment.

Transient with loss of Power Conversion System - The accident sequences contain events that fail both the Unit 2 TDAFW pump and the shared " A MDAFW pump, along with a failure to establish feed and bleed.

Loss of DC bus - The accident sequences contain events failing all battery chargers associated with affected unit along with a loss of the Unit 2 TDAFW Pump.

Loss of offsite power - The accident sequences are of three different varieties:

1) battery chargers not repowered, loss of Unit 2 TDAFW pump and "A" MDAFW pump required for the other unit, 2) Both TDAFW pumps fail to start, fail to feed and bleed and " A MDAFW pump required for the other unit, or 3) Loss of Unit 2 TDAFW pump, fail to feed and bleed and failure of the 2A steam generator safety valve to reclose.

Loss of all service water - The accident sequences involve failures of both discharge valves in the closed position (either left that way following maintenance or transferring closed on their own) and " A MDAFW pump aligned to feed the other unit.

The following conservative assumptions are made in the baseline PRA model:

1. If a steam generator is faulted, then it cannot be fed using AFW, requiring initiation of feed and bleed. This does not take into account procedural guidance to feed a faulted steam generator for the situation where AFW cannot be used to feed an intact steam generator. Use of approved plant procedural guidance for this situation is accounted for using an adjustment described in the response to PRA RAI-2.

2. For a loss of AC and/or DC power that would render the operable MDAFW pump out of service, no feedwater flow is available. No credit is taken for the condensate and main feedwater pumps associated with the train of AC and DC power still energized.

If the event occurred at 100% power and there is no safety injection required, this train of condensate and feedwater would still be in service from before the loss of power event. This aspect of actual plant behavior is accounted for using an adjustment described in the response to PRA RAI-2.

3. A faulted-ruptured steam generator cannot be fed using AFW, nor is it available as a source of steam for the affected unit's TDAFW pump. Flow from the reactor coolant system (RCS) into the steam generator and out the break provides a mechanism for heat removal from the core and RCS. The boiling action of reactor coolant after it enters the secondary side of the steam generator provides adequate cooling to prevent core damage as long as safety injection flow to the RCS is available. As a Page 14 of 28

result, feedwater flow is not necessary to prevent core damage for faulted-ruptured steam generator events. This aspect of observed plant behavior is accounted for using an adjustment described in the response to PRA RAI-2.

4. For a transient with loss of the Power Conversion System (PCS), no credit is given for using condensate and feedwater following the initiating event. A review of PBNP operating history shows that condensate and feedwater are non-recoverable 37% of the time. Inclusion of this aspect of plant operating history is accounted for using an adjustment described in the response to PRA RAI-2.

5. No adjustment is made to equipment failure probabilities, even though the failure probability of applicable equipment is lower due to verification of equipment function prior to entering the Limiting Condition for Operation (LCO) and limiting access to the equipment to increase the probability of having the equipment function if needed.

6. No credit was taken for compensatory measures that may be taken to decrease operator or equipment failure rates.

7. There is some amount of non-negligible risk associated with the transition and shutdown periods with a MDAFW pump unavailable. This risk has not been quantified but as a conservative measure, no credit is given for offsetting the online risk with the transition and shutdown risk that would be incurred by unit shutdown.

8. No credit is taken for restoration of offsite power following a loss of offsite power (TI) event.

9. For dual unit initiators, e.g., loss of offsite power and loss of service water, one MDAFW pump is assumed to provide sufficient flow to only one unit.

10. Time-dependent plant response to random failures (e.g., plausible manual actions to avert a plant trip, repair or restoration of service water components) are not credited.

Most of the PRA model assumptions and the sources of uncertainty are approximations based on bounding assumptions and will reduce the risk impact if a more realistic or detailed approach is taken. For the first four assumptions described above, the more realistic approach is dictated by approved plant procedures and actual plant design. The remaining six assumptions provide conservatisms leading to an overstatement of the quantified risk for the cases analyzed above.

Page 15 of 28

PRA RAI-8 The fire risk is qualitatively evaluated and dispositioned only by compensatory measures (section 3.1.1.5 of Enclosure 2). The licensee assumed that the only significant sources of fire risk would be due to plant locations for which a fire could fail all remaining AFW pumps for a unit when one of the two motor-driven AFW pumps is out of service. The staff is concerned that other fire damage scenarios could also be significant during the extended outage of the motor-driven AFW pump. For example, a fire which could fail the turbine-driven AFW pump and also impact plant equipment required for feed-and-bleed cooling (the backup cooling method if AFW is unavailable) could also be significant if the remaining operable motor-driven AFW pump were to randomly fail.

Since AFW is expected to be important for mitigation of fires, the licensee is requested to provide a more rigorous quantitative evaluation to assure that all significant sources of fire risk are identified and properly characterized and that compensatory measures are applied which will be effective in reducing this risk.

FPL Enerslv Point Beach Response PBNP is currently in the process of transitioning to NFPA 805. As part of this transition, a fire PRA is being developed to quantitatively determine the risk to the plant from fires.

At this time, PBNP does not have an updated fire PRA; however, the safe shutdown analysis identifies strategies to achieve safe shutdown for the plant's fire areas and the equipment losses postulated to occur resulting from the fire. This analysis is based upon having a limited set of equipment available, or made available, to achieve safe shutdown. Cooling the core through a feed and bleed strategy is not credited in the safe shutdown analysis to achieve safe shutdown. As such, cable routings for safety injection (SI) pumps and cables/systems needed to operate the power-operated relief valves (PORVs) are not part of the analysis, but may be available in certain fire scenarios. The work being done for the fire PRA would require this type of analysis and must be completed prior to taking credit for feed and bleed to prevent core damage.

The fire compensatory measures previously identified in Reference (I), Reference (3) and in response to AFPB RAI-1 will reduce the risk significant sources of fire risk during the MDAFW pump replacements. These fire compensatory measures will ensure there are adequate risk mitigation actions in place during the time of the MDAFW pump replacements.

PRA RAI-9 Seismic risk is dispositioned based on being "expected to be low: and no other disposition of external event risk sources is providedbased on a lack of updated PRA models (section 3.1.1.6 of Enclosure 2). The licensee is requestedto provide an appropriate technicaljustification that external events risk is not significant, and not simply state its "expectations." The scope of this justification should include all external events not in the PRA model (i.e., seismic, internal or external floods, external fires, weather, transportation and industrial events, etc.).

FPL Enerslv Point Beach Response Based on a review of the PBNP Individual Plant Examination of External Events (IPEEE), the primary contributions to CDF from external events are fire, seismic, Page 16 of 28

external flooding, and high winds. Other external events such as transportation and accidents at nearby industrial facilities, were considered not to be risk significant, based on their low hazard frequencies.

As discussed in PRA RAI-8, as part of the transition to NFPA 805, a fire PRA is being developed for to quantitatively determine the risk to the plant from fires. Since the fire PRA is not yet complete, a deterministic, defense-in-depth approach to managing fire risk is being implemented for the MDAFW pump replacements. The fire compensatory measures previously identified in Reference (l), Reference (3), and in response to AFPB RAI 1 will reduce the risk significant sources of fire risk during the MDAFW pump replacements. These fire compensatory measures will ensure there are adequate risk mitigation actions in place during the time of the MDAFW pump replacements.

Based on the IPEEE, the dominant seismic contributors to the estimated CDF are operator actions, seismic faults that lead directly to core damage and failures of critical equipment. The review of the seismic dominant contributors indicated that the AFW system contributes approximately 3% of the seismic risk. The conditional fraction of failure of the AFW system from a seismic event is lower than most other components.

The most vulnerable AFW components from a seismic standpoint are the condensate storage tank level transmitters, which would not be affected by the MDAFW pump replacements.

Based on the IPEEE, the external flood CDF is dominated by flooding as a result of the rising water level of Lake Michigan, combined with wind-wave effects and water run-up, which would result in flooding of the turbine building and leads to loss of the ability to remove decay heat. Since that scenario does not credit any AFW pumps, the external flooding evaluation is not affected by the MDAFW pump replacements.

Based on the Individual Plant Examination (IPE), the internal flood CDF is dominated by flooding in the primary auxiliary building, cable spreading room 1 non-vital switchgear area, and the circulating water pumphouse. These core damage sequences would not be affected by the MDAFW pump replacements.

Based on the IPEEE, the dominant tornadolwind-induced core damage sequences were determined to involve failures of the diesel generator exhaust stacks, which could lead to failure of two diesel generators. Since that scenario does not credit the AFW system, the tornadolwind-induced core damage sequences would not be affected by the MDAFW pump replacements.

Since the risk analyses for these events do not indicate that the loss of AFW systems contributes proportionally more than it does for internal events, the risk impact from these external events due to taking one MDAFW pump out of service for its replacement is not significant.

PRA RAI-10 The tier 2 analysis does not explicitly identify any specific risk-significant plant equipment outages which would be permitted under the technical specifications (TS). Instead, the licensee has committed that no other risk-impacting work will be planned, and emergent equipment outages will be managedper the tier 3 requirements to manage risk. The staff is concerned that 1) the specific scope of this commitment is not clearly defined, Page 17 of 28

and 2) the licensee's program which addresses tier 3 may not include provisions for plant shutdown in the event of an emergent, high risk condition. The licensee is requested to evaluate concurrent equipment unavailabilitypermitted by the TS for potential high risk configurations to determine if there are configurations which should not be permitted even if they occur on an emergent basis.

FPL Enerslv Point Beach Response Reference(1) states in part, "During the MDAFW pump replacement activity with no other risk affecting equipment being unavailable concurrently as is now planned, Safety Monitor shows that both units will be low in the YELLOW risk level."

An updated Safety Monitor model incorporating a more recent plant data analysis is now in use at the plant. As a result of this more recent risk model, the previous representation of risk associated with the planned MDAFW pump replacement has changed to, "During the MDAFW pump replacement activity, with no other risk affecting equipment being unavailable concurrently, the Safety Monitor shows that both units will be in the middle of the GREEN risk level."

A risk significant impact associated with the performance of surveillances and maintenance is defined as a condition that, if it persisted for 7 days, would result in an increase in core damage probability (CDP) of 1.OE-6, or would result in an increase in large early release probability (LERP) of 1.OE-7. Exceeding these thresholds results in a YELLOW risk condition per approved plant procedures and is consistent with accepted industry practices for managing on line risk.

FPL Energy Point Beach confirms that the units can be operated for both 16-day periods without planned entries into a YELLOW risk condition as a result of required surveillances or maintenance.

The scope of work activities covered by the commitment is all systems, structures, and components (SSCs) within the scope of the Maintenance Rule (a)(4) program at PBNP or work that affects those SSCs. No other work will be planned during the MDAFW pump replacements that produces a YELLOW risk level, as defined above, for the resulting plant configuration.

In the event of an emergent risk significant condition, actions would be taken based on Technical Specifications and plant procedure NP 10.3.7, "On-Line Safety Assessment."

NP 10.3.7 requires the Shift Manager's permission to remain in a YELLOW risk configuration and the Plant Manager's permission to remain in an ORANGE or RED risk configuration.

Industry guidance for managing risk due to on-line maintenance is provided in Section 11 of NUMARC 93-01. PBNP used this guidance in developing and refining its on-line maintenance risk management process. There is no description contained in this guidance of conditions or risk based criteria which, if exceeded, would predicate a plant shutdown. Operators must evaluate what equipment is available not only to respond to plant events but also to safely shut down the plant before making a decision to begin a plant shutdown. This is especially true at a time when one MDAFW pump is out of Page 18 of 28

service. Ultimately, the responsibility to shut the plant down rests with the licensed operators based upon the plant configuration at the time.

An assessment was performed to evaluate risk-significant plant equipment that would result in a CDF risk level greater than GREEN if an emergent condition arose during each of the MDAFW pump replacements. This assessment focused on those plant components that would not result in a CDF risk level greater than GREEN, if unavailable by themselves, but do result in a CDF risk level greater than GREEN when one MDAFW pump is concurrently out of service. This assessment shows that the plant components resulting in the highest CDF risk increase concurrent with one MDAFW pump out of service involve the unit-specific TDAFW pump and the other shared MDAFW pump.

This set of equipment includes the AFW pumps themselves as well as other AFW-supporting components from systems, such as, service water, main steam, instrument air, 480 V AC, 125 V DC, and fire water. In addition to these AFW-related systems, additional components from systems supporting primary side feed and bleed, such as safety injection, residual heat removal, component cooling water, and reactor coolant system, also result in a CDF risk level greater than GREEN.

As an example configuration, with P-38A MDAFW pump OOS, the Unit 1 CDF risk level is GREEN. While in this configuration, if the 1P-29 TDAFW pump is also taken OOS, the Unit 1 CDF risk level is elevated to ORANGE. Actions resulting from this configuration will be taken in accordance with Technical Specifications and plant procedures to determine the safest course of action.

To better assure the other AFW pumps remain available during the MDAFW pump replacements, routine surveillance testing will be performed on the AFW pumps before the MDAFW pump replacements, as described in Enclosure 1 of Reference (1).

Fire Protection Branch (AFPB)

A well balanced fire protection program addresses all the elements of fire protection defense-in-depth:

To prevent fires from starting To detect rapidly, control, and extinguish promptly those fires that do occur To provide protection for structures, systems, and components important to safety so that a fire that is not promptly extinguished by the fire suppression activities will not prevent the safe shutdown of the plant.

In order to meet the "defense-in-depth" concept for fire protection issues, consistency with the defense-in-depth philosophy is maintained if a reasonable balance is preserved among the three fire protection defense-in-depth elements (preventing fires from starting, rapidly detecting, controlling and extinguishing those fires that do occur, and providing protection for structures, systems, and components (SSCs) to assure safe shutdown of the plant). The defense-in-depth philosophy is not maintained when there is "over-reliance on programmatic activities to compensate for weaknesses in plant design."

The compensatory measures proposed in the license amendment request address the first two elements of fire protection (FP) defense-in-depth, preventing fires from starting and detecting rapidly, controlling and extinguishing promptly those fires that do occur.

Page 19 of 28

AFPB RAI 1 In developing the list of compensatory measures, discuss how actions to address the third element of FP defense-in-depth (to provide protection for SSCs important to safety so that a fire that is not promptly extinguished by the fire suppression activities will not prevent the safe shutdown of the plant) will be considered. RIS 200507 notified licensees that operator manual actions are often more effective compensatory measures than fire watch patrols.

FPL Energy Point Beach Response Fire Organization Plan (FOP) 1.2, Potential Fire Affected Safe Shutdown Components, is a compilation of compensatory manual actions that can be performed for fires in various areas of the plant. The manual actions were developed under an assumed plant configuration of all equipment in service as specified in Fire Protection Evaluation Report (FPER) Section 5.2.1.2. Therefore, the existing station safe shutdown analyses and required manual actions do not necessarily address a condition where an AFW pump is inoperable prior to a fire.

The safe shutdown analysis database (SSAMS) for the seven fire areas of concern described in Reference (1) was reviewed. It was determined that in five of the seven fire areas, the Appendix R functional goal of decay heat removal could be met, given compensatory manual actions are taken outside of the associated fire area. The five fire areas were walked down by Engineering and Operations personnel to determine the feasibility and prioritization of augmented compensatory actions. The five fire areas for which feasible and reasonable compensatory manual actions can be implemented are A01-Bl46, A02, A15, A25 and A26. A temporary change to FOP 1.2 will be made to provide augmented manual compensatory actions for these five areas prior to entry into TSAC 3.7.5.C. OM 3.1, Operations Shift Staffing Requirements, will be temporarily revised prior to entry into TSAC 3.7.5.C to ensure personnel availability of two Operations personnel to implement augmented manual actions for the duration of the TSAC. Operations personnel designated as performing the augmented compensatory actions will receive a pre-job brief on required actions.

With an AFW pump out of service for replacement, manual actions for fires in the adjacent AFW room (A23S or A23N depending on the pump being replaced) are not feasible if an all consuming fire is assumed (see response to AFPB RAI-3 below). To minimize risk, the monitoring of potential ignition sources is being implemented to detect incipient hot spots and consequently take action to mitigate initiation of a fire in those areas. This, along with roving fire watches, administrative controls to eliminate transient combustibles and planned hot work, will reduce the likelihood of a fire event. Because of the low combustible loading, zero transient combustibles, therrnography, fire detection, fire suppression, and a roving fire watch, the risk of fire initiation and spread is reduced, while prompt detection and suppression are increased. These features maximize the likelihood that manual recovery actions within the affected areas will be feasible.

Page 20 of 28

PBNP #1 licensee event report (LER) 2001-006 makes several statements regarding availability of the turbine driven AF Wpump for fire areas A02 (FZ151) and A0 1-B (FZ237). Please provide information related to the feasibility of restoringmaintaining availability of the turbine-driven auxiliary feedwater (TDAFW pump as described in this LER.

FPL Energy Point Beach Response Licensee Event Report (LER) 266-301-2001-006 identified a concern with the functionality of the MDAFW pumps following an Appendix R design basis fire with a consequential loss of instrument air. Four specific fire areas were addressed. These fire areas were the central area of the primary auxiliary building (FA AOl-B), the safety injection and containment spray pump room (FA A02), the north AFW pump area (FA A23N), and the south AFW pump area (FA A23S).

Since 2001, modifications have been installed that altered fire areas AOl-B, A23N and A23S. Specifically, a modification installed a robust steel barrier wall that effectively separates El. 46' of FA A01-B from the lower elevation of the same fire area. While this barrier was designed as a barrier against steam intrusion in the event of a high energy line break, it also segregates the two elevations of the fire area into two separate fire zones; 187 and 237. In addition, a 3-hour rated fire wall has been installed in the AFW pump room; effectively separating fire zones 304s from 304N as a corrective action from the referenced licensee event report.

As discussed in the LER, both TDAFW pumps can be recovered by use of manual actions in the event of a fire in fire area FA A02. The Safe Shutdown Analysis Report (SSAR) credits 2P-29 TDAFW pump for being available for a fire in this area. Based upon the SSAR, compensatory manual actions have been developed to restore 1P-29 and in conjunction with additional Operations staffing, will be implemented during the MDAFW pump replacement Completion Times as described in the response to AFPB RAI-1 above.

The LER also discussed the ability to recover one of the TDAFW pumps for a fire in the upper level of FA AOI-B (termed "FZ 237" in the LER, and now designated as FA A014/46). Restoration of the pump can be accomplished by opening a steam supply inlet valve for the respective TDAFW pump in this area. A walk down and circuit review of 1MS-2019, HX-1B steam generator header P-29 auxiliary feedwater pump steam supply motor-operated valve, demonstrates that control circuits for this valve are fully enclosed in conduit with no additional 125 V DC power circuitry that could spuriously open this valve once it is de-energized. Therefore, compensatory manual actions from the control room to open this valve, accompanied with the removal of power will allow adequate steam supply to 1P-29 for the pump's operation. Combined with the MDAFW pump that is not being affected by the replacement work in progress, AFW flow will be available to both units in the event of a fire in this location.

Page 21 of 28

Section 3.2.2.4 states: "This review identified seven fire areas where a fire concurrent with a motor-driven AFW pump being unavailable because of extended replacement activities could result in no AFW pump being available to provide decay heat removal. "

For each of these fire areas, please provide the following:

A description (type of circuit, location of cables, location of nearby ignition sources, etc.) of those safe shutdown circuits and/or components that could potentially receive fire-induced damage that provide the same functionality as the motor-driven auxiliary feedwater (MDAFWJpumps being removed from service (redundant MDAFW pump, turbine driven AFW pump, etc.)

An evaluation of each of these circuits~componentsto determine the feasibility of an operator action to address potential fire damage (for motor operated valves and air operated valves, investigate the possibility of local, manual operation) to restore/maintain availability of the redundant system FPLE-Point Beach Response The PBNP Appendix R Safe Shutdown (SSD) analysis only evaluated and credited the AFW system for providing feedwater to the steam generators. As such, no other circuit analysis proving the viability of redundant systems, such as condensate or main feedwater has been incorporated into the Appendix R SSD analysis.

As discussed in response to AFPB RAI-1 and AFPB RAI-2 above, augmented manual compensatory actions have been identified for five of the seven fire areas in order to regain the functionality of a TDAFW pump. This response will address the two remaining fire areas, A23N and A23S, and why manual actions are not available given the safe shutdown assumption that all electrical equipment is lost in a fire area.

A23N: A23N is the north half of the AFW pump room, and is separated by a 3-hour fire barrier from the south half (see Figure RAI-3.1). The Unit 2 TDAFW pump (2P-29) and the "B" MDAFW pump (P-38B) are both located in this room, as are several supporting valves (mini-recirc flow isolation air-operated valves (AOVs), discharge flow control AOV, discharge isolation motor-operated valves (MOVs), and discharge flow control MOVs). Preliminary information from the NFPA 805 transition project has identified safe shutdown off-site power cables in this area. As such, maintaining or recovering offsite power for a fire in this area, or equipment powered from it, is not considered credible.

Guidance provided in the plant fire attack plans (FAPs), fire emergency plans (FEPs) and fire organization plans (FOPS)were developed to limit potential fire damage and to enable restoration of the equipment following a fire. As such, restoration of the AFW pumps in the area may be possible.

The A23N area would be a concern when the "An MDAFW pump (P-38A) is being replaced because the only remaining AFW pump would be the Unit 1 TDAFWP (1P-29).

This situation is the same situation that occurs when the "A" MDAFW pump is removed from service for any reason.

Page 22 of 28

When P-38B is being replaced, implementation of the station's ignition control procedure will limit fire initiators to minimize fire potential. These measures include covering or relocating combustibles, adding fire extinguishers to the area, etc.

As planned, the estimate for completion of restoration to service of P-38A MDAFW pump is between 6 and 7 days, assuming no unforeseen contingencies. The remainder of the extended CT is requested to accommodate contingencies for unexpected as-found conditions, fit-up difficulties, or other problems that may reasonably arise during the replacement work, including planning for the potential that the entire configuration may have to be restored to original conditions. It is expected that the risk exposure to Unit 2 for a fire in this area will be limited to approximately the same time as the existing approved CT period.

A23S: A23S is the south half of the AFW pump room, and is separated by a 3-hour fire barrier from the north half (see Figure RAI-3.1). This case is largely symmetric with the one for a fire in A23N. Preliminary information from the NFPA 805 transition project has identified safe shutdown off-site power cables in this area. As such, maintaining or recovering offsite power for a fire in this area, or equipment powered from it, is not considered credible. Guidance provided in the plant fire attack plans (FAPs), fire emergency plans (FEPs) and fire organization plans (FOPS)were developed to limit potential fire damage and to enable restoration of the equipment following a fire. As such, restoration of the AFW pumps in the area may be possible.

The A23S area would be a concern when the "BnMDAFW pump (P-38B) is being replaced because the only remaining AFW pump would be the Unit 2 TDAFW pump (2P-29). This situation is the same situation that occurs when the " B MDAFW pump is removed from service for any reason.

When P-38A is being replaced, implementation of the station's ignition control procedure will limit fire initiators to minimize fire potential. These measures include covering or relocating combustibles, adding fire extinguishers to the area, etc.

As planned, the estimate for completion of restoration to service of P-38B MDAFW pump is between 6 and 7 days, assuming no unforeseen contingencies. The remainder of the extended CT is requested to accommodate contingencies for unexpected as-found conditions, fit-up difficulties, or other problems that may reasonably arise during the replacement work, including planning for the potential that the entire configuration may have to be restored to original conditions. It is expected that the risk exposure to Unit 1 for a fire in this area will be limited to approximately the same time as the existing approved CT period.

A23N and A23S Consistent with the assumptions of the SSAR, an all-consuming fire is one which causes 100% functional failure of all electrical equipment in the fire area. A severe exposure fire in either room could directly damage both pumps, their prime movers, and/or the associated supporting valves and controls to the extent that local manual actions are not feasible or are too complicated to be relied upon for near-term recovery of function.

While it is possible that such a widespread and complete failure could occur in areas where prevention, detection and suppression are present, this conservative assumption Page 23 of 28

is made when assessing mitigation capabilities. Due to the inherent magnitude of such a fire, extreme temperatures and proximity of equipment, recovery of AFW in these fire areas under these circumstances is not considered viable through local manual action.

Therefore, in addition to the present detection, and suppression available; thermography and administrative controls will be in place to identify any incipient fire sources, thus allowing them to be acted upon prior to reaching an uncontrollable state and to allow restoration of AFW, if needed.

Page 24 of 28

Figure AFPB RAI-3.1 AFW Pump Room (not to scale)

Page 25 of 28

AFPB RAI 4 The stated purpose of the roving fire watch touring the seven areas of concern "...is to monitor and ensure that combustible loading, work activities, and other activities that could increase the likelihood of a fire are minimized. " Although a roving fire watch tour as described may be an effective verification that administrative controls are being followed, the primary control mechanism to address fire risks of this nature is usually administrative. One effective approach for this is to make the seven fire areas of concern both a i'combustible free zone" and a "no hot work zone" either through the permitting process or the work control process. These administrative controls can be very effective in preventing fires from starting and ensuring that any fires that do start are caught in the incipient stage before equipment can be impacted. Were these administrative controls considered, and if not, why not?

FPL Enernv Point Beach Response As discussed in AFPB RAI-1, additional compensatory measures are being implemented. The matrix below details these compensatory measures including "transient combustible free zone" and "no planned hot work zone."

Table AFPB RAI-4 Matrix of Fire-Related Compensatory Measures Fire Area Compensatory Measures A01-B146 A02 A15 A25 A26 ~ 2 3 ~ A23s2 Roving fire watch X X X X X X X Thermography X X X X X X X Fire detection unimpaired X X X X X X X Fire suppression unimpaired n/a X X X X X X Manual recovery actions3 X X X X X n/a n/a No planned hot work X X X X X X X No transient combustibles X X X X X X X

'~om~ensatory measures required only when P-38A is in an extended TS Completion Time 2~ompensatorymeasures required only when P-38B is in an extended TS Completion Time 3

Requires two additional operators per OM 3.1 to implement actions during either TS Completion Time The cumulative effect of the above compensatory actions provide reasonable assurance that a fire will not be initiated and the consequences of a postulated fire in an area will be minimized.

Page 26 of 28

Section 9. I (page 171) of the Point Beach Nuclear Plant Fire Protection Evaluation Report contains a list of compensatory measures that should be considered any time there is a safe shutdown component removed from service:

Temporary repair procedures Temporary fire barriers, fire detection or suppression Temporary restrictions on activities which could increase the risk of an Appendix R event Alternate means to ensure the safe shutdown function is accomplished This list appears to adequately cover several of the items discussed in the previous four RAI questions. Please describe how you followed your fire protectionprogram as stated in the Fire Protection Evaluation Report, and if not, why not?

FPL Enernv Point Beach Response To determine the fire risk associated with having an AFW pump out of service for an extended period of time, the Fire Protection plan was reviewed. The Fire Protection program at PBNP was developed to provide assurance, through a defense-in-depth approach, that a single fire does not impair the safe operation or the safe shutdown capability of the plant. This defense-in-depth program consists of prevention, detection, suppression, and mitigation elements that form a comprehensive approach to fire protection. The program has both programmatic and plant fire protection equipment and systems. It also includes the Safe Shutdown Analysis to demonstrate the plant's SSD capability in the event of a fire. For this specific activity, compensatory measures from the four elements identified above were considered that would reduce the potential risk associated with a fire.

Temporary repairs were considered, but found to not be viable due to the relatively short period of time in which AFW or other feedwater sources would need to be re-established (approximately 30-60 minutes).

It was concluded that the existing fire barriers, detection, and suppression would not be significantly enhanced by temporary augmentation due to the complexity of room electrical and piping equipment geometry.

Roving fire watches were being implemented to restrict activities which could increase the risk of a fire event and enhance detection in the various fire areas.

Additional administrative restrictions will be placed on hot work activities and transient combustible control as described in AFPB RAI-1.

Alternate means to ensure safe shutdown functions were considered using the existing fire hazards analyses. As a result, alternate means were identified and determined to be sufficient for all but the seven areas previously discussed in Reference (1). With further study, alternate means have since been identified that would be available and reasonable for all but two fire areas. Those alternate means are discussed in the response to AFPB RAI-1. The inability to prescribe viable Page 27 of 28

compensatory measures for the two remaining areas is discussed in the response to AFPB RAI-3.

The combination of compensatory manual actions, additional Operations personnel, temporarily revised plans and instructions, thermography, administrative controls relating to fire risk activities, and roving fire watch provides timely, viable measures that will be taken to minimize fire risk.

Page 28 of 28