ML082820029

Request for Amendment to Technical Specification 5.5.16, Containment Leakage Rate Testing Program

ML082820029
Person / Time
Site:	Palo Verde
Issue date:	10/01/2008
From:	Hesser J Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-05902-JHH/DFS
Download: ML082820029 (184)

Text

10 CFR 50.90

-40 A subsidiaryof Pinnacle West Capital Corporation John H. Hesser Mail Station 7605 Palo Verde Nuclear Vice President Tel: 623-393-5553 PO Box 52034 Generating Station Nuclear Engineering Fax: 623-393-6077 Phoenix, Arizona 85072-2034 102-05902-JHH/DFS October 01, 2008 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Request for Amendment to Technical Specification 5.5.16, Containment Leakage Rate Testing Program Pursuant to 10 CFR 50.90, Arizona Public Service Company (APS) hereby requests to amend Operating Licenses NPF-41, NPF-51, and NPF-74 for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3, respectively. The proposed amendment would modify technical specification (TS) 5.5.16, Containment Leakage Rate Testing Program, by adding exceptions to Regulatory Guide (RG) 1.163 that would allow the next integrated leak rate test (ILRT) (Type A test) to be performed at a 15 year interval.

The proposed amendment is risk-informed and follows the guidance in RG 1.174. APS has performed an analysis (Enclosure 1) demonstrating that the increase in risk resulting from the proposed amendment is small and within established guidance. APS has also determined that defense-in-depth principles will be maintained based on risk and other considerations.

In developing this license amendment request (LAR), APS has reviewed requests for additional information (RAls) posed by the NRC and responses from Licensees who have proposed similar extensions. APS has provided its responses to these RAls in . Although the intent of the RAls has been maintained, they have been modified to apply to this LAR.

Approval of the proposed amendment is requested by September 30, 2009. Once approved, the amendment shall be implemented within 90 days.

In accordance with the PVNGS Quality Assurance Program, the Plant Review Board and Offsite Safety Review Committee have reviewed and concurred with this proposed A member of the STARS (Strategic Teaming and Resource Sharing) Alliance A0 R Callaway *Comanche Peak 0 Diablo Canyon

• Palo Verde

• San Onofre

• South Texas 0 Wolf Creek u&

'L

NRC Document Control Desk Request for Amendment to Technical Specification 5.5.16, Containment Leakage Rate Testing Program Page 2 amendment. By copy of this letter, this submittal is being forwarded to the Arizona Radiation Regulatory Agency (ARRA) pursuant to 10 CFR 50.91 (b)(1).

No commitments are being made to the NRC by this letter. If there are any questions or if additional information is needed, please contact Russell Stroud, Licensing Section Leader, at (623) 393-5111.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on QOicb6e* 1) 100 Sincerely, JHH/RAS/GAM/DFS/gat

Enclosures:

1: Evaluation of Proposed Amendment 2: Responses to NRC Questions to the Industry cc: E. E. Collins Jr. NRC Region IV Regional Administrator B. K. Singal NRC NRR Project Manager R. I. Treadway NRC Senior Resident Inspector for PVNGS A. V. Godwin Arizona Radiation Regulatory Agency (ARRA) agodwin(-azrra.Qov T. Morales Arizona Radiation Regulatory Agency (ARRA) tmorales(d)azrra..ov Page 2

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 ENCLOSURE 1 Evaluation of Proposed Amendment

Subject:

Request for Amendment to Technical Specification 5.5.16 for a one-time Containment Integrated Leak Rate Testing extension

1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION

3. TECHNICAL EVALUATION

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedent 4.3 No Significant Hazards Consideration 4.4 Conclusions

5. ENVIRONMENTAL CONSIDERATION

6. REFERENCES ATTACHMENTS

1. Technical Specification Page Markups

2. Retyped Technical Specification Pages

3. Risk Assessment for PVNGS Regarding the ILRT (Type A Testing) Extension Request

4. Summary of PVNGS Probabilistic Risk Assessment (PRA) Quality

5. Internal Events Model Self Assessment Evaluation Page 1

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16

SUMMARY

DESCRIPTION This evaluation supports a request to amend Operating Licenses NPF-41, NPF-51, and NPF-74 for Palo Verde Nuclear Generating Station (PVNGS) Units 1, 2, and 3, respectively.

The proposed amendment would modify technical specification (TS) 5.5.16, Containment Leakage Rate Testing Program, to allow the next integrated leak rate test (ILRT) (Type A test) to be performed at a 15-year interval, which is an exception to the Regulatory Guide (RG) 1.163 guideline of a 10-year interval.

The last Type A, ILRT for each of the PVNGS Units 1, 2, and 3, was completed on November 4, 1999, November 2, 2000, and April 27, 2000, respectively. This request would require completion of the next ILRT (Type A test) for Units 1, 2, and 3, by November 4, 2014; November 2, 2015; and April 27, 2015, respectively.

This proposed amendment would save approximately 0.6 person-rem in exposure, and would result in significant monetary savings. These savings are based on the reduction in outage costs associated with the performance of this testing. As a result of this one-time increase in the interval between tests, potentially there will be a reduction of one test over the life of each unit. Arizona Public Service Company (APS) is requesting this license amendment to obtain these reductions in personnel exposure and monetary savings.

This enclosure provides an evaluation of the proposed changes and includes five attachments. Attachment 1 provides the TS page marked up to show the proposed change. Attachment 2 provides the retyped TS page with the proposed change incorporated. In Attachment 3, APS provides the risk assessment for PVNGS regarding the one time ILRT (Type A) extension request from 10 years to 15 years. That analysis shows that the increase in risk resulting from the proposed amendment is small and within established guidance.

The analysis in Attachment 3 has two appendices. Appendix A assesses the effect of age-related degradation of the containment on the risk impact for extending the PVNGS ILRT interval and Appendix B discusses the external events assessment performed in support of the Palo Verde ILRT interval extension from 10 years to 15 years. Both of these appendices directly support the Attachment 3 analysis. of this enclosure provides an assessment of the quality of the current PVNGS PRA. It shows that the current PRA is of high quality and is adequate to support a risk-informed submittal such as this request. In addition, Attachment 5 of this enclosure provides a self-assessment of the current PVNGS internal events PRA associated with this ILRT extension request. This self assessment evaluates the level of compliance with criteria contained in RG 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Page 2

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 Activities," Revision 1, dated January 2007 (Reference 13). This assessment shows that the current PRA evaluation for this submittal is acceptable and is discussed further in Section 3.5 of this enclosure.

1. DETAILED DESCRIPTION The proposed license amendment would revise TS 5.5.16 "Containment Leakage Rate Testing Program" to add the following:

"3. The first Type A test performed after the Unit 1 November 1999 Type A test shall be prior to November 4, 2014."

"4. The first Type A test performed after the Unit 2 November 2000 Type A test shall be prior to November 2, 2015."

"5. The first Type A test performed after the Unit 3 April 2000 Type A test shall be prior to April 27, 2015" This change modifies the current 10 year schedule for the next ILRT Type A testing based on the last tests performed for each unit to allow a one-time interval extension of no more than five years. The current 10 year frequency for Type A tests is in accordance with the guidance of Nuclear Energy Institute (NEI) 94-01, "Industry Guidance for Implementing Performance-Based Option of 10 CFR 50, Appendix J,"

dated July 26, 1995 (Reference 3) and as allowed by 10 CFR 50, Appendix J, Option B. provides the TS page marked to show the proposed change. Attachment 2 provides the retyped TS pages with the proposed change incorporated.

3. TECHNICAL EVALUATION 3.1 Containment Buildinq Description PVNGS Updated Final Safety Analysis Report (UFSAR) Section 1.2.12.1, Containment Building, describes the containment building as follows:

The containment building is a pre-stressed concrete cylinder with a hemispherical dome. The basemat is a flat, circular slab of reinforced concrete. The interior of the structure is lined with a continuous, welded steel plate 1/4 inch thick.

Approximate dimensions of the structure are:

Inside diameter 146 feet Inside height 206.5 feet Vertical wall thickness 4 feet Dome thickness at apex 3.5 feet Page 3

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 Basemat diameter 161 feet Basemat thickness 10.5 feet 3 Net Free Volume 2.62E+06ft The containment building is designed for a maximum internal pressure of 60 psig and a maximum, accident condition inner surface temperature of 300 degrees F. Housed within the containment building and supported by the basemat are the reinforced concrete and structural steel internal structures that support the reactor and reactor coolant system.

Under the most severe of postulated loading conditions including the combined effects of permanent loads, design basis loss of coolant accident (LOCA) loads, and either the safe shutdown earthquake or tornado loads, the containment building is designed to maintain its structural and leak tight integrity. This design permits a predictable response of the containment structure to allow operation of engineered safety features equipment for mitigation of accident consequences. Together with isolation valves, penetration assemblies, and its continuous, welded steel liner, the structure contains the released fission products and maintains a leak rate below the design leak rate levels.

The containment is designed to provide long-term control of fission products following a postulated accident.

Containment penetrations are provided in the lower portion of the structure and consist of a personnel airlock, an equipment hatch, an emergency airlock, a fuel transfer tube, and piping, electrical, instrumentation, and ventilation penetrations.

Per UFSAR Section 3.8.1.1.3.1 Liner Plate and Anchors, a welded steel liner plate covers the entire inside surface of the containment (excluding penetrations) to satisfy the leak tight criteria. The liner is typically 1/4 inch thick and is thickened locally around penetration sleeves, large brackets, and attachments to the basemat and shell wall.

As discussed in UFSAR Section 3.8.1.1.1, the 1/4 inch thick containment liner which runs on top of the basemat is covered by a two foot nine inch thick concrete filler slab that supports the containment internals and forms the floor of the containment. The filler slab is not within the jurisdiction of the ILRT program.

3.2 Current PVNGS ILRT Requirements TS 5.5.16, "Containment Leakage Rate Testing Program," requires a testing program be established as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in RG 1.163, "Performance- Based Containment Leak-Test Program," dated September, 1995, (Reference 2) as modified by the following exceptions:

Page 4

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16

1. The visual examination of containment concrete surfaces intended to fulfill the requirements of 10 CFR 50, Appendix J, Option B testing, will be performed in accordance with the requirements of and frequency specified by American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code,Section XI, Subsection IWL, except where relief has been authorized by the Nuclear Regulatory Commission (NRC). The containment concrete visual examination may be performed during either power operation, e.g., performed concurrently with other containment inspection-related activities such as tendon testing, or during a maintenance/refueling outage.

2. The visual examination of the steel liner plate inside containment intended to fulfill the requirements of 10 CFR 50, Appendix J, Option B testing, will be performed in accordance with the requirements of and frequency specified by ASME Code Section XI, Subsection IWE, except where relief has been authorized by the NRC.

Regulatory Position C.1 of RG 1.163 states that licensees should establish test intervals based upon the criteria in Section 11.0 of NEI 94-01. Section 11.0 of NEI 94-01 references Section 9.0 which allows ILRTs (Type A test) to be performed at a frequency of one per 10 years if the calculated leakage rate for two consecutive previous tests is less than 1.0 La. The PVNGS reactor containment vessels have met this criterion and therefore qualify for the 10-year frequency.

TS 5.5.16.b states: "The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 52.0 psig for Unit 1 through operating cycle 12 and Unit 3 through operating cycle 13, and 58.0 psig for Unit 1 after operating cycle 12, Unit 2, and Unit 3 after operating cycle 13. The containment design pressure is 60 psig."

All three PVNGS units have completed their associated operating cycle 13 which included steam generator replacement and power uprates; therefore, the peak calculated containment pressure is now 58.0 psig for all units.

TS 5.5.16.c states: "The maximum allowable containment leakage rate, La, at Pa, shall be 0.1% of containment air weight per day."

The maximum allowable containment leakage rate, La, specified in TS 5.5.16, ensures that the total containment leakage volume will not exceed the value assumed in the accident analyses at the peak accident pressure. As an added conservatism to account for possible degradation of the containment leakage barriers between leakage tests, TS 5.5.16.d limits the leakage rate acceptance criteria as follows:

"1. Containment leakage rate acceptance criterion is -<1.0 La. During the first unit startup following testing in accordance with this program, the leakage rate acceptance are < 0.60 La for the Type B and C tests and -< 0.75 Lafor Type A tests."

Page 5

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 3.3 Justification For The TS Changes As defined in 10 CFR 50, Appendix J, Type A leakage rate testing measures the overall leakage rate of the containment; Type B leakage rate testing measures the local leakage rate of blind flanges, air locks and other devices which employ resilient seals; and Type C leakage rate testing measures the local leakage rate of valves.

The performance-based ILRT requirements of Option B of 10 CFR 50, Appendix J, provide an alternative to the three tests per 10-year frequency specified by the prescriptive requirements of Option A of 10 CFR 50, Appendix J. As documented in RG 1.163, the NRC has endorsed NEI 94-01 as providing acceptable methods for complying with the requirements of Option B of 10 CFR 50, Appendix J. NEI 94-01 specifies an ILRT frequency of one test per 10 years if certain performance criteria are met. The basis for the one test per 10-year frequency is described in Section 11.0 of NEI 94-01, which references NUREG-1493, "Performance-Based Containment Leak-Test Program," dated September 9, 1995 (Reference 4), as providing the technical basis to support rulemaking that established Option B. That basis consisted of qualitative and quantitative assessments of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals.

The Electric Power Research Institute (EPRI) undertook a similar study, the results of which are documented in EPRI report TR-1 04285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," dated August 1994 (Reference 5). The EPRI study determined a reduction in the frequency of ILRTs from three tests per 10 years to one test per 10 years would result in an incremental risk contribution of 0.035 percent.

This value is comparable to the range of risk increases (0.002 percent to 0.14 percent) presented in NUREG-1 493 for the same frequency reduction. Additionally, NUREG-1493 described the increase in risk resulting from an even lower frequency, one test per 20 years, as "imperceptible."

The proposed amendment would authorize a one-time extension of the ILRT interval from 10 years to 15 years for PVNGS Units 1, 2 and 3. The NRC has approved one-time extensions of the ILRT interval to 15 years based on risk and non-risk based considerations for other licensees including Waterford Steam Electric Station, Unit 3 (ML020460272) (Reference 6), Peach Bottom Atomic Power Station, Unit 3 (ML012210108) (Reference 7), Crystal River Nuclear Plant, Unit 3 (ML012190219)

(Reference 8), Indian Point 3 Nuclear Power Plant (ML011021315) (Reference 9), and D.C. Cook Nuclear Plant, Units 1 and 2 (ML030160330) (Reference 10).

3.4 Risk Based Assessment An assessment was performed of the risk impact of extending the currently allowed containment Type A ILRT frequency from 10 years to 15 years for a one time extension for PVNGS Units 1, 2 and 3 (Attachment 3). As a result, the proposed extension was found to have a very small increase in risk (significantly less that 1 percent of the total Page 6

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 integrated plant risk) and would allow for substantial cost savings. The proposed change would only impact testing associated with the current surveillance test for Type A leakage.

The risk assessment follows the guidelines from NEI 94-01, the methodology used in EPRI TR-1 04285, the guidance provided in J. Haugh, J. Gisclon, W. Parkinson, K.

Canavan, 'Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leak Rate Test Intervals", Rev. 4, EPRI, Nov. 2001, (Reference 11), and the NRC regulatory guidance on the use of PRA findings and risk insights as outlined in RG 1.174. In addition, for comparison purpose, the PVNGS risk assessment was also performed using the methodology presented in EPRI TR-1 009325, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," Revision 1, dated October 2003 (Reference 12) and EPRI TR-1009325 Revision 2, Final Report, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," dated August 2007, which was approved by the NRC on June 25, 2008. (Reference 18). Although this methodology generally produces more conservative results than do the earlier methodologies, they build upon the work of the earlier studies, and much of the analyses developed from application of the EPRI TR-104285 methodology remains applicable for use in these more recent studies.

The risk assessment results for PVNGS are consistent with those of previous studies supporting other plants' ILRT extension requests. The following are the conclusions from the completed risk assessment associated with extending the Type A ILRT test from 10 years to 15 years:

" There is no change in the at-power core damage frequency (CDF) associated with the ILRT test interval extension from 10 to 15 years. Therefore, this is within the RG 1.174 acceptance guidelines.

" RG 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 defines very small changes in risk as resulting in increases of CDF below 10-6/yr and increases in large early release frequency (LERF) below 10-7/yr. Since the ILRT does not impact CDF, the relevant criterion is LERF. The increase in LERF resulting from a change in the Type A ILRT test frequency from once-per-ten-years to once-per-fifteen years is between 2.21 E-10/yr and 2.46E-09/yr. Therefore, increasing the ILRT interval from 10 to 15 years is considered to result in a very small change to the PVNGS risk profile based on the RG 1.174 definition.

" The proposed change in the Type A test frequency (from one per 10 years to one per 15 years) increases the total integrated plant risk by significantly less than one percent for all three PVNGS units. Therefore, the risk impact of this change, when compared to other severe accident risks, is negligible.

Page 7

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 The change in Conditional Containment Failure Probability (CCFP) of less than 1 percent for all three PVNGS units is judged to be insignificant and reflects sufficient defense-in-depth.

The above results demonstrate that the increases in risk and LERF resulting from the proposed amendment are within established RG 1.174 guidelines and that defense-in-depth principle would be maintained. The complete PVNGS risk assessment is provided in Attachment 3.

3.5 Comparison of PVNGS PRA Methodology to Regulatory Guide 1.200 APS has performed a self assessment of the Palo Verde internal events PRA to address this ILRT extension request to evaluate the level of compliance with criteria contained in Regulatory Guide (RG) 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,"

Revision 1, dated January 2007 (Reference 13). This self assessment is provided as to this enclosure. The ILRT application was determined to be a Category II application of the RG 1.200 criteria, Revision 1. This is based on the requirement for numerical results for Core Damage Frequency and Large Early Release Frequency to determine the risk impact of the requested change and the fact that this change is risk-informed, not risk-based. In the self assessment each of the current PRA supporting requirements (SR) that did not comply with RG 1.200 Category II criteria is listed along with the assessment and evaluation of the non-conforming SR that shows that they have no material impact on the ILRT surveillance interval extension request.

3.6 Non-Risk Based Assessment Consistent with the defense-in-depth philosophy provided in RG 1.174, APS has assessed other non-risk based considerations relevant to the proposed amendment.

PVNGS has multiple inspection and testing programs that ensures the containment structure remains capable of meeting its design functions and that are designed to identify any degrading condition that might affect that capability. These programs are discussed below.

3.6.1 ILRT and ILRT History TS 5.5.16 requires a leakage testing program be established as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. That program includes requiring an ILRT be performed periodically.

Based on NEI 94-01, TS 5.5.16.d establishes the limit for the measured overall integrated containment leakage rate as 0.75 of the containment air per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at Pa.

The results of the past Type A tests for each unit at PVNGS are provided below using the 95 percent upper confidence level (UCL) estimate of leak rate which is consistent with American National Standards Institute (ANSI)/American Nuclear Society (ANS)

Page 8

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 56.8-1994. These results demonstrate a history of satisfactory performance for both leak tightness and structural integrity of the containment vessel.

Unit 1 95% UCL wt%/day Test Pressure Date 0.0544 52.7 psig (Pa = 52) November 1999 0.066 50.3 psig (Pa = 49.5) February 1990 0.0664 49.7 psig (Pa = 49.2) May 1986 0.0142 49.7 psig (Pa = 49.2)(1) December 1982 Unit 2 95% UCL wt%/day Test Pressure Date 0.0404 58.9 psig (Pa = 58) November 2000 0.031 50.3 psig (Pa = 49.5) December 1991 0.0599 50.5 psig (Pa = 49.5) June 1988 0.0092 50.0 psig (Pa = 49.2)(1) February 1985 Unit 3 95% UCL wt%/day Test Pressure Date 0.0490 52.8 psig (Pa = 52) April 2000 0.060 50.3 psig (Pa = 49.5) May 1991 0.0521 49.7 psig (Pa = 49.2)(1) September 1986 (1) Preoperational ILRT performed in conjunction with a structural integrity test (SIT) performed at 69 psig, 115% of containment design pressure of 60 psig.

Per TS 5.5.16.b, the current Pa for the design basis loss of coolant accident is 58.0 psig for Units 1, 2, and 3, since all three units are past operating cycle 13. As noted above, Units 1 and 3 were last tested at 52 psig, and Unit 2 was last tested in 2000 at 58.0 psig.

In the Safety Evaluation in the NRC letter titled: Palo Verde Nuclear Generating Station, Units 1, 2, and 3 - Issuance of Amendments re: Replacement of Steam Generators and Uprated Power Operations and Associated Administrative Changes (TAC NOs.

MC3777, MC3778, and MC3779), dated November 16, 2005, (ML053130275)

(Reference 14), the NRC provided the following guidance in page 29, section 4.2.1, concerning the increase in Pa to 58 psig associated with power up-rate and replacement steam generators, and the need to perform ILRT testing at the higher pressure prior to restart:

"An additional consideration is whether the increase in Pa, the calculated peak containment internal pressure related to the design-basis LOCA, from 52 psig to 58 psig would required new containment leakage rate tests at the higher pressure before plant restart. After reviewing the applicable regulations and guidance documents, the staff finds that there is no requirement for new tests at the higher Page 9

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 pressure before the plant can restart. When the tests next come due, or the normal schedule, they will be performed at the new value of Pa. The staff considers the previous tests, performed at the old value of Pa, to remain valid and constitute an adequate indication of the leak-tightness of the containment, until new tests are performed on the normal schedule."

The proposed amendment changes the next due date for the test, but does not change the requirement to perform that test at the higher Pa values as specified in the safety evaluation above. Extending the next normal schedule date is a change to the NRC's stated position on this testing. The justification for deferring performing the Unit 1 and 3 ILRTs at the higher Pa to the next scheduled test interval was provided in APS's letter no. 102-05116 dated July 9, 2004, "Request for a License Amendment to Support Replacement of Steam Generators and Uprated Power Operations in Units 1 and 3, and Associated Administrative Changes for Unit 2" (ML042010289) (Reference 15). The following is a summary of the justification provided in that letter:

Palo Verde Unit 2 has been Type A tested at the increased Pa and its test results at the higher pressure compare favorably with earlier tests conducted at lower pressures. Since the Unit I and 3 containment structures are identical to Unit 2 and have been subjected to similar test and maintenance regimes, similar performance in the increased Pa Type A test is reasonably assured.

The Palo Verde Nuclear Generating Station (PVNGS) consists of three identical pressurized water reactor units with identical reinforced, post tensioned concrete containment structures having a design pressure of 60 psig. All three containments were subjected to a structural integrity test at or above the design pressure (i.e., 60 psig) during pre-operational testing and have been subjected to periodic Type A, B and C leakage testing as required by 10 CFR 50, Appendix J.

Type A tests conducted to date were completed at the calculated design basis accident containment peak pressure (Pa). Calculated Pa was 49.5 psig for Type A tests conducted early in plant life. Pa was later revised to 52.0 psig for all three units and then to 58.0 psig for Unit 2 following RSG and PUR. The most recent Type A tests were conducted at approximately 52.0 psig in Units 1 and 3 and 58.0 psig in Unit 2. The results of the Unit 2 Type A test conducted in November, 2000 at 58.4 psig compared favorably with previous testing conducted at 49.5 psig as shown above.

As a result, there would be at most a negligible increase in risk resulting from deferral of Type A testing at the increased Pa to the next scheduled ILRT. The Type A test history in all PVNGS units, shown above, has been within regulatory requirements. Acceptable Type A tests have been conducted at 52.0 psig (in Units 1 and 3) and 58.0 psig (in Unit 2).

In the time since the July 9, 2004 submittal, additional local leak rate tests (LLRTs) and inspections have been completed with no concerns identified with the containment Page 10

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 condition and leak tight capability. These indicate the containments have not changed significantly and any risk involved with further deferring the higher pressure testing is insignificant.

In this submittal, a risk based assessment has been provided in Attachment 3 which concludes the extension in the testing date from one per 10 years to one in 15 years will have an insignificant affect on the risk of a containment failure. When considered together, the extension in the test schedule and the further deferring the higher pressure tests will not significantly increase the risk the NRC has previously approved as acceptable.

3.6.2 Schedule for Next ILRT Based on Extensions The requested five year extensions will allow the ILRTs for PVNGS Unit 1, 2 and 3 to be performed in the following scheduled refueling outages:

Unit 1 - 1R18 - Scheduled for the fall of 2014 Unit 2 - 2R1 9 - Scheduled for the fall of 2015 Unit 3 - 3R1 8 - Schedule for the spring of 2015 The proposed change to the TS provides the date for each unit by which the ILRT is to be completed.

3.6.3 Local Leakage Rate Testing (LLRT)

As documented in NUREG-1493, industry experience has shown that most ILRT failures result from leakage that is detectable by LLRT (Type B and C testing as defined in 10 CFR 50, Appendix J). The PVNGS LLRT requirements per TS 5.5.16 are unaffected by this proposed amendment. The PVNGS LLRT program will, therefore, provide continuing assurance that the most likely sources of containment leakage will be identified and repaired prior to the development of significant degradation.

3.6.4 Examination Program for Subsection IWE Another element of the PVNGS inspection and testing program that ensures containment integrity is the examination program provided in support of the first interval implementation of the containment inservice examinations required by ASME Section XI, Subsection IWE as modified and supplemented by the requirements in 10 CFR 50.55a(b)(2)(ix).

The 10 CFR 50 Appendix J program, and the Containment Coatings Program, Repair Replacement Program, and Maintenance Rule Program all interface with the IWE Inspection Program.

Page 11

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 The IWE examination program contains a detailed description of the incorporation of Subsection IWE into the Inservice Inspection (ISI) Program for PVNGS. This examination program conforms to the requirements of 10 CFR 50.55a(b)(2), PVNGS Technical Specifications, and the PVNGS UFSAR.

Based on the final rule amending the regulations effective September 9, 1996, (61 FR 41303, dated August 8, 1996), the 1992 Edition with the 1992 Addenda of Subsection IWE was referenced as the Code to utilize for preparation of this program. This PVNGS program is also updated for each inspection interval to conform to the requirements of the latest edition and addenda of the ASME Section XI Code referenced in paragraph (b) of 10 CFR 50.55a.

During the initial preparation of the program, if a code required examination was found to be impractical or could not be performed because of PVNGS plant design or other conditions, a Request for Relief from that requirement was prepared, submitted to the NRC and included in the PVNGS program. As the program is updated for each inspection, if a code required examination is identified to be impractical or non-performable during the course of an examination and the code required percentages are not met, a request for relief will be prepared and submitted to the NRC, no later than 12 months after expiration of the scheduled testing Interval.

The following sections provide the various inspections included in this program that affect the containment structure.

3.6.4.1 Visual Examination of Metal Containment Building Surfaces In support of the IWE examination program accessible containment building metal surfaces (liner plates, etc.) are inspected and all relevant conditions detected are recorded on examination reports in terms of location, size, shape, orientation, and distribution on the surfaces. This examination is designed to detect the following:

" Gross deformation, i.e. damage due to impact by a heavy object where a considerable portion of the liner surface has been deformed

" Corrosion, erosion, rusting, or pitting

" Foreign deposit buildup

" Cracks, scratches, or gouges

" Gaps between the liner plate wall and the basemat

" Evidence of general degradation 3.6.4.2 Visual Examination of Welds Page 12

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 Per the IWE examination program all accessible liner or attachment welds are inspected and all relevant conditions detected during the examinations are recorded on examination reports in terms of location, size, shape, orientation, and distribution along the welds and adjacent surfaces. The examination is designed to detect any abnormal conditions, including the following:

" The presence of water, stains, or deposits that could be caused by leakage.

" Excessive rust, corrosion, or erosion.

" Cracks.

" Excessive gouges, arc strikes, undercut, or weld spatter.

" Cracking of paint or unusual paint flaking shall be closely examined for possible signs of component failure.

The examination areas include the welds and the adjacent base material for a distance of 1/2 the wall thickness plus 1 inch on each side of the weld.

3.6.4.3 Assembled Bolting Examinations Per the IWE examination program all assembled bolts are examined and the examination area includes all accessible surfaces of the bolted connection, including the bolts, studs, nuts, washers and surrounding flange surfaces, as applicable. When possible, the assembled bolting is also manually (by hand) checked for tightness.

3.6.4.4 Disassembled Bolting Examinations Per the IWE examination program all disassembled bolting is to be examined and the examination area includes all accessible surfaces of the bolted connection, including the bolts, studs, nuts, bushings, washers, flange surfaces, and the threads on the flange base material, as applicable.

The examination is designed to detect any relevant conditions, including the following:

" Crack-like flaws.

" Deformed or sheared threads in the zone of thread engagement of bolts, studs, or nuts.

" Localized general corrosion that reduces the bolt or stud cross-sectional area.

Page 13

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16

" Bending, twisting, or deformation of bolts or studs to the extent that assembly or disassembly is impaired.

" Missing or loose bolts, studs, nuts, or washers.

" Fractured bolts, studs, or nuts.

" Degradation of protective coatings on bolting surfaces.

" Evidence of coolant leakage near bolting.

3.6.4.5 Component Examinations Per the IWE examination program all components of the containment structure will be examined and the examination area includes all accessible areas of the parts, components, or surfaces to be examined. The examinations are designed to detect relevant conditions including the following:

" Corrosion, erosion, or pitting.

" The presence of foreign deposit buildup.

" Cracks, scratches, or gouges.

" Evidence of excessive wear, misalignment, or loose or missing parts.

" Any physical damage on the surfaces of the components.

3.6.4.6 Evaluation and Repair In support of the IWE examination program all of the examination results are evaluated in accordance with ASME Section XI Articles IWA-3000 and IWE-3000. In addition, all applicable repairs and replacements are performed in accordance with ASME Section XI Article IWA-4000. Pressure tests are be performed on welded and mechanical joint repairs or replacements, in accordance with IWA-4000 and IWE-5000. Both the evaluations and repair or replacement are performed in accordance with the 1992 Edition through and including the 1992 Addenda of ASME Section XI, or later editions and addenda of ASME Section XI referenced in 10 CFR 50.

3.6.4.7 Acceptability of Inaccessible Areas As required by 10 CFR 50.55a (b)(2)(ix)(A), in support of the IWE examination program, an evaluation of the acceptability of inaccessible areas is completed whenever conditions exist in accessible areas that could indicate the presence of or result in degradation to such inaccessible areas.

Page 14

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 The inaccessible areas of the containment liner that are currently identified and evaluated are:

" The 1/4 inch thick steel liner on top of the basemat is protected by a two foot nine inch thick concrete filler slab that supports the containment internals and forms the floor of the containment. There is a reactor pit cavity in the basemat under the reactor vessel. The containment liner in the reactor pit cavity and the recirculation sumps is covered with six inches of concrete.

• The 1/4 inch thick steel liner located adjacent to the refueling canal is inaccessible.

However, any leakage into the annulus area from the refueling pool or transfer canal will be detected on the 80' elevation. To date there is no detectable leakage in this area.

3.6.4.8 Additional Examinations In the IWE examination program, the methodology provided in 10 CFR 50.55a (b)(2)(ix)(D) is used in lieu of the requirements of IWE-2430, whenever flaws or areas of degradation are found that exceed the acceptance standards of Table IWE-341 0-1.

3.6.4.9 Augmented Examinations The IWE examination program provides for a list of areas/locations that are designated as augmented in accordance with the requirements of IWE-1240 and IWE-2420. None were identified in the initial examination program and there are currently no areas/locations subject to augmented inspection at PVNGS.

The IWE related containment ISI program is unaffected by the proposed amendment, and it will continue to provide a high degree of assurance that any degradation of the containment will be detected and corrected before it can result in a leakage path.

3.6.5 IWE Inspection Schedule IWE-2412, the first 10 Year Interval for the IWE inspections for PVNGS is broken down in to three periods. The periods are 40 months and are scheduled to match the ISI Examination Program for Class 1, 2 and 3 component intervals for PVNGS Units 1, 2 and 3. These 40 month periods are within the tolerances allowed by the ASME Code.

It should be noted that the intervals/periods can change between units to allow for extended outage durations per IWA-2400 of ASME Section XI.

The first 10 Year inspection interval, including each of the three inspection periods, has been completed for PVNGS Units 1, 2, and 3.

Page 15

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 For the second 10 Year Inspection Interval, the PVNGS IWE inspection program is being updated to the latest Code of Record. (ASME Section XI, 2001 Edition through and including the 2003 Addenda as modified by 10 CFR 50.55a).

No Code Cases or Code Interpretations have been identified for use in the update of the Subsection IWE Program and none are currently recommended for use. In addition, no Relief Requests have been identified for this updated of the IWE Program as all that were included in the first Ten Year Interval Program have been incorporated into the later editions of the Code.

The schedule for the included inspections will be based on similar criteria as the previous schedule, except the three periods will be three years/four years/three years instead of the 40 month periods. The second 10 Year Inspection Interval will coincide with the Third Ten Year ISI Interval.

3.6.6 Approved Alternatives to Subsection IWE Requirements For the first 10-Year Inspection Interval there were seven alternatives to Subsection IWE requirements approved for PVNGS inspections. Of those seven relief requests (RR) only RR-E1 and RR-E3 are associated with the Containment Leakage Rate Testing Program. The proposed request for extension of the ILRT interval in this amendment has no affect on the performance of the required alternate testing activities described in these relief requests. As stated in Section 3.6.5, the IWE Inspection Program is being updated and the previous Relief Requests have been incorporated into the later editions of the Code being used to update the program. Type B and Type C testing will continue to be performed as scheduled in accordance with the Containment Leakage Rate Testing Program.

3.6.6.1 RR-E1, Torque/Tension Testing of Bolted Connections IWE-2500, Table IWE-2500-1 requires bolt torque-tension tests to be performed on 100% of the bolts when the connection has not been disassembled and reassembled during the interval.

As an alternative for PVNGS, the following examinations and tests required by Subsection IWE ensure the structural integrity and leak-tightness of Class MC pressure retaining bolting. Therefore no additional alternative examinations are proposed:

1) Exposed surface of bolted connections shall be visually examined in accordance with the requirements of Table IWE-2500-1, Examination Category E-G, Pressure Retaining Bolting, Item E8.10;

2) Bolted connections shall meet the pressure test requirements of Table IWE-2500-1, Examination Category E-P, All Pressure Retaining Components, Item E9.40; and Page 16

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16

3) A general visual examination of the entire containment once each inspection period shall be conducted in accordance with 10 CFR 50.55a(b)(2)(ix)(E).

RR-E1 notes that determination of the torque or tension value would require that the bolting be untorqued and then re-torqued or re-tensioned. Through performance of the 10 CFR 50, Appendix J, Type B test itself, the bolt torque or tension are shown to remain adequate to provide a leak rate that is within acceptable limits. Once a bolt is torqued or tensioned, it is not subject to dynamic loading that could cause it to experience significant change. Therefore, the torque or tension value of bolting only becomes an issue if the leak rate becomes excessive indicating a degraded condition.

3.6.6.2 RR-E3, Seals and Gaskets IWE-2500, Table IWE-2500-1 requires bolt torque-tension tests to be performed on 100% of the bolts when the connection has not been disassembled and reassembled during the interval.

As an alternative for PVNGS, the leak-tightness of seals and gaskets are verified using 10 CFR 50, Appendix J, Type B testing. No additional alternatives to the visual examination, VT-3, of the seals and gasket will be performed.

RR-E3 notes that that seals and gaskets receive a 10 CFR 50, Appendix J, Type B test.

As noted inl 0 CFR 50, Appendix J, the purpose of that testing is to measure leakage of the containment or penetrations whose design incorporates resilient seals, gaskets, sealant compounds, and electrical penetrations fitted with flexible metal seal assemblies. Physical examination of the seals and gaskets requires disassembling joints that are proven adequate through Appendix J testing. Only with excessive leakage indicating degradation would further physical examination be necessary.

3.7 Containment IWE Inspection History For the ISI program examinations performed since the last ILRT for each unit that included visual examinations of the containment vessel pursuant to Subsection IWE, all results were within the established acceptance criteria and in accordance with the code considering the applicable relief requests discussed in Section 3.6.6, above.

3.8 Examination Program for Subsection IWL Another element of the inspection and testing program at PVNGS that ensures containment integrity is the examination program that implements the requirements of Subsection IWL. This program is a part of the Containment Inservice Inspection Examination Program at PVNGS and it addresses the requirements for the first and second five-year Containment ISI Intervals for the concrete and the post-tensioning system. This program is not affected by the proposed amendment.

Page 17

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 The selection and inspection requirements for this program are specified as defined in 10 CFR 50.55a, and the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code,Section XI, Subsection IWL. Subsection IWL, defines the rules and requirements for IS[ and repair of reinforced concrete and the ISI and repair/replacement of post-tensioning systems of Class CC concrete components.

Based on the final rule amending the regulations effective September 9, 1996, (61 FR 41303, dated August 8, 1996), the 1992 Edition with the 1992 Addenda of Subsection IWL was referenced as the Code to utilize for preparation of this program. This PVNGS program is also updated for each inspection interval to conform to the requirements of the latest edition and addenda of the ASME Section XI Code referenced in paragraph (b) of 10 CFR 50.55a. This rulemaking included several requirements in addition to those required in ASME Section XI and further required that a Containment Inspection Program be developed and implemented by September 9, 2001, five years following the effective date of the amendment.

Revised rulemaking for 10 CFR 50.55a was published in the Federal Register (64 FR 51370 dated September 22, 1999.) This revised rulemaking approved the use of the 1995 Edition with the 1996 Addenda of the ASME Section XI Code with certain limitations and modifications. However, this rulemaking also explicitly allows licensees to continue to use the 1992 Edition including the 1992 Addenda of Subsection IWL, with the limitations and modifications in the original (August, 1996) rulemaking, in lieu of updating to the 1995 Edition with the 1996 Addenda.

Since the rules in the 1992 Edition with the 1992 Addenda of Subsection IWL of Section XI are essentially the same as the rules in the 1995 Edition with the 1996 Addenda, APS based the PVNGS Containment Inservice Inspection Program on the 1992 Edition with the 1992 Addenda of Subsection IWL.

3.8.1 Visual Examination of Concrete Containment Exterior Surfaces The PVNGS Subsection IWL examinations are conducted to identify any condition that could reasonably be expected to affect the structural integrity or leak tightness of the containment building. All relevant conditions detected during the examinations are recorded on the Visual Examination Report.

The relevant conditions examined include (but are not limited to) the following:

" Evidence of leeching or chemical attack

" Areas of corrosion, erosion or abrasion

" Evidence of scaling or disintegration Page 18

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16

" Cracks or deep gouges

" Popouts or voids

" Spalls

" Evidence of efflorescence, exudation or incrustation

" Blistering or peeling of coatings

" Exposed reinforcing steel

" Tendon grease leakage at concrete surfaces or grease caps

" Corrosion on exposed grease caps and bearing plates Any relevant conditions that do not meet the tier acceptance criteria and/or could affect either the structural integrity or leak lightness of the containment are rejected, evaluated under the PVNGS corrective action program, and required corrective action is taken.

The inspection period for Subsection IWL is a five-year period in which the examinations can be performed during plant normal operating conditions. The first examination (Baseline Examination) of concrete containment exterior surfaces was performed prior to September 9, 2001, and the date of the examination was not required to comply with the requirements of IWL-241 0(a) or IWL-241 0(b). The date of the first examination of concrete is to be used to determine the schedule date of all subsequent examinations within the first five-year and second five-year periods of the 10 year interval.

Relief from the ISI schedule described in IWL-2410(a) has been authorized via Relief Request RR-L3. Examinations of the concrete containment exterior surfaces required by IWL-251 0 and by 10 CFR 50.55a have been and continue to be performed per the following schedule and requirements of IWL-2410(c):

Baseline examinations during the expedited implementation period (were completed by September 9, 2001)

Complete examinations of Units 1, 2, and 3 were performed in accordance with Subsection IWL (1992 Edition with 1992 Addenda) and additional requirements identified in the November 22, 1999 (effective date) amendments to 10 CER 50.55a.

All noted requirements were applied to these examinations except:

(a) The IWL-2410 requirements relating to examination schedule and performance time window.

Page 19

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 (b) Requirements revised by approved relief requests.

Each of these examinations served the same purpose as the pre-service examination identified in IWL-2220.

Subsequent examinations are to be performed in accordance with Subsection IWL (1992 Edition with 1992 Addenda) and additional requirements identified in the November 22, 1999 (effective date) amendments to 10 CFR 50.55a per the following schedule:

For Unit 1:

Five years following the completion of the baseline examination.

15 years following the completion of the baseline examination.

As required following evaluation of observed degradation on any unit.

For Units 2 and 3:

10 years following the completion of the baseline examination.

20 years following the completion of the baseline examination.

As required following evaluation of observed degradation on any unit.

Per the requirements of IWL-241 0(c), examinations subsequent to the baseline examination are to be started no sooner than one year prior to the next scheduled interval after and will be finished no later than one year after that date. All noted requirements apply to these examinations except those revised by approved relief requests.

In between these examinations, the concrete condition of the containment is to be inspected by the general visual examinations under the Appendix J (leakage testing) program. This inspection is performed as scheduled in accordance with the Containment Leakage Rate Testing Program.

The baseline inspections of the Units 1, 2 and 3 concrete containments were completed by September 2001. There were no reportable indications documented in the ISI summary report. The next inspection was completed for Unit 1 in September 2007.

There were no relevant conditions found that would impact structural integrity.

3.9 Other Inspection Programs Other PVNGS programs that provide additional affective detection and mitigation of potentially degraded conditions which ensure that the containment vessel maintains its capability to meet its design functions are provided below. The proposed amendment does not affect these programs.

Page 20

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 3.9.1 Boric Acid Corrosion Program The Boric Acid Corrosion Program establishes methods and processes to detect, monitor and control boric acid leakage from reactor pressure boundary components.

Under this program, PVNGS utilizes a multi-pronged approach of leakage detection through periodic walkdowns, RCS water inventory monitoring, containment airborne activity trending, containment sump level monitoring, and ASME Section XI, periodic and interval pressure tests of the RCS pressure boundary.

As a part of this program, thorough periodic inspections of all identified leak sites are conducted. For any identified leaks, the runoff path and surrounding area are searched and nearby components are thoroughly inspected for boric acid attack. This includes inspection of components of the containment pressure barrier which may have been damaged. Any identified degradation is processed through the PVNGS corrective action program and repairs are undertaken as required.

Boric Acid Inspections are typically performed prior to a refueling outage.

3.9.2 Coatings Program The coatings on the interior surface of the containment vessel are considered safety-related and are classified as Quality Class Q. UFSAR Chapter 1, Section 1.8, Conformance to NRC Regulatory Guides, endorses RG 1.54, Quality Assurance Requirements for Protective Coatings Applied to Water-Cooled Nuclear Power Plants (Revision 0, June 1973) and referenced standard ANSI N-101.4-1972, Quality Assurance for Protective Coatings Applied to Nuclear Facilities.

PVNGS has implemented controls for the procurement, application, and maintenance of Service Level 1 protective coatings used inside the containment in a manner that is consistent with the licensing basis and regulatory requirements applicable to PVNGS.

The requirements of 10 CFR Part 50, Appendix B are implemented through specification of appropriate technical and quality requirements for the Service Level 1 coatings program which includes ongoing maintenance activities.

PVNGS periodically conducts condition assessments of Service Level 1 coatings inside containment as part of the PVNGS Component Monitoring Program. Inspections of coatings systems are scheduled every outage on a pre-established basis to verify containment liner coating thickness and condition.

Industry experience has shown that properly coated surfaces do not propagate corrosion; and that previously damaged or uncoated surfaces do not continue to propagate material loss once the coatings have been repaired or replaced properly.

Page 21

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 3.9.3 Maintenance Rule The containment Isolation function of limiting the release of radioactive fission products following an accident has been classified as high risk significant and its condition is monitored pursuant to 10 CFR 50.65 in accordance with the PVNGS Maintenance Rule program. Operability of the containment isolation equipment is ensured by compliance with TS Sections 3.3, 3.6, 3.8, and 5.5.16. The proposed amendment affects only the ILRT requirements and does not affect the implementation of the maintenance rule.

3.10 NRC Industry Concerns 3.10.1 Hot Containment Penetration Bellows The industry has noted that stainless steel containment penetration bellows have been found to be susceptible to trans-granular stress corrosion cracking. As documented in NRC Information Notice 92-20, "Inadequate Local Leak Rate Testing," dated March 3, 1992, (Reference 16) leakage through such bellows may not be readily detectable by LLRTs.

Expansion bellows are not utilized in the design of the mechanical penetrations at PVNGS. There are bellows used on the fuel transfer tube penetration to accommodate relative movement between the refueling canal liner and the containment building penetration. However, those bellows do not form part of the containment building vessel or pressure boundary. They are unaffected by this proposed amendment.

3.10.2 Moisture Barriers Industry experience with corrosion in the inaccessible areas indicates that if the moisture barrier were degraded, the inaccessible area should be identified as a "suspect area," per IWE-1241(a).

A moisture barrier is not utilized in the design of the interface between the containment liner and the concrete basemat at PVNGS. One hundred percent (100%) of the accessible areas of the containment basemat, including areas that might allow water to penetrate to the liner plate below are inspected each inspection period by the IWE program.

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria 4.1.1 10 CFR 50, Appendix J, Option B The testing requirements of 10 CFR 50, Appendix J, provide assurance that the leakage from the primary containment, including systems and components that penetrate the Page 22

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 containment, does not exceed the allowable leakage values specified in the TS. This limitation on containment leakage provides assurance that the primary containment will continue to perform its design function following any plant design basis accidents. This appendix provides requirements for Type A, B and C testing. Type A leakage rate testing measures the overall leakage rate of the containment. Type B leakage rate testing measures the local leakage rate of blind flanges, air locks and other devices which employ resilient seals. Type C leakage rate testing measures the local leakage rate of valves.

10 CFR 50, Appendix J was revised, effective October 26, 1995, to allow licensees to perform containment leakage testing in accordance with the requirements of Option A, "Prescriptive Requirements," or Option B, "Performance-Based Requirements." TS 5.6.16 implements Option B of 10 CFR 50, Appendix J as modified by NRC-approved exemptions. The performance-based ILRT requirements of Option B of 10 CFR 50, Appendix J, provide an alternative to the three tests per 10-year frequency specified by the prescriptive requirements of Option A of 10 CFR 50, Appendix J.

4.1.2 RG 1.163, "Performance-Based Containment Leak-Testing Program" RG 1.163 specifies an acceptable method for complying with the inspection and testing requirements of 10 CFR 50, Appendix J, Option B. Regulatory Position C.1 of RG 1.163 states that licensees should establish test intervals based upon the criteria in Section 11.0 of NEI 94-01. The PVNGS testing program in TS 5.6.16 is in accordance with RG 1.163.

Deviations to RG 1.163 are permitted by 10 CFR 50, Appendix J, Option B, as discussed in Section V.B, "Implementation." Therefore this change does not require an exemption from 10 CFR 50, Appendix J, Option B.

4.1.3 NEI 94-01, "Industry Guideline For Implementing Performance-Based Option of 10 CFR Part 50, Appendix J" This guideline provides direction for implementing the Option B testing and scheduling those tests to ensure compliance to the regulations. As documented in RG 1.163, the NRC has endorsed NEI 94-01 as providing acceptable methods for complying with the requirements of Option B of 10 CFR 50, Appendix J. NEI 94-01 specifies an ILRT frequency of 1 test per 10 years if certain performance criteria are met. The basis for the 1 test per 10-year frequency is described in Section 11.0 of NEI 94-01, which states that NUREG-1493 provides the technical basis to support rulemaking that established Option B. That basis consisted of qualitative and quantitative assessments of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals.

Page 23

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 Section 11.0 of NEI 94-01 provides criteria on establishing test intervals and references Section 9.0 which would normally require ILRT performance for PVNGS within 10 years plus 15 months from the date of their last performance.

On June 25, the NRC approved NEI 94-01, Revision 2 (Reference 17) and EPRI report TR-1 009325 Revision 2, Final Report, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," (Reference 18) which both support a permanent 15 year ILRT frequency. As the path to implementation of the permanent 15 year frequency the revision to NEI 94-01 and the EPRI report is still being defined by the Industry and to support PVNGS planned future refueling outages, APS is making this one time extension request submittal based on the previous versions of NEI 94-01 as discussed above and in this enclosure. Once the clear path to implementation has been determined, APS may submit an additional request to implement the guidance in Revision 2.

4.1.4 NUREG-1493 The allowed frequency for Type A testing, as discussed in NEI 94-01, is based, in part, on a generic evaluation documented in NUREG-1493. That evaluation included a study of the dependence of reactor accident consequences on containment leak-tightness for five reactor/containment types including Zion, Unit 1, a large, dry containment building.

The PVNGS containments are similar in design to the Zion unit. NUREG-1493 provided the following observations with regard to decreasing the test frequency:

• Reducing the Type A Integrated Leak Rate Test (ILRT) testing frequency to one in twenty (20) years was found to lead to imperceptible increase in risk. The estimated increase in risk is small because ILRTs identify only a few potential leakage paths that cannot be identified by Type B and C testing, and the leaks that have been found by Type A tests have been only marginally above the existing guidelines.

Given the insensitivity of risk to containment leakage rate, and the small fraction of leakage detected solely by Type A testing, increasing the interval between ILRT testing has a minimal impact on public risk.

• While Type B and C tests identify the vast majority (greater than 95%) of all potential leakage paths, performance-based alternatives are feasible without significant risk impacts. Since leakage contributes less than 0.1 percent of overall risk under existing guidelines, the overall effect is very small.

The PVNGS amendment request is supported by the observations of NUREG-1 493.

4.1.5 RG 1.174, "An Approach for Using Probabilistic Risk assessment In Risk-Informed Decisions On Plant-Specific Changes To The Licensing Basis".

RG 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. RG 1.174 defines very small changes in risk as resulting in Page 24

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 increases of CDF below 10-6/yr and increases in large early release frequency (LERF) below 10-7/yr. Since the ILRT does not impact CDF, the relevant criterion is LERF. The increase in LERF resulting from a change in the Type A ILRT test frequency from one-per-1 0- years to one-per-1 5 years is between 2.21 E-1 0/yr and 2.46E-09/yr. Therefore, increasing the ILRT interval from 10 to 15 years is considered to result in a very small change to the PVNGS risk profile and is acceptable based on the RG 1.174 definition.

4.2 Precedent The NRC has approved one-time extensions of the ILRT interval to 15 years based on risk and non-risk based considerations for other licensees including Waterford Steam Electric Station, Unit 3 (ML020460272), Peach Bottom Atomic Power Station, Unit 3 (ML012210108), Crystal River Nuclear Plant, Unit 3 (ML012190219), Indian Point 3 Nuclear Power Plant (ML011021315), and D.C. Cook Nuclear Plant, Units 1 and 2 (ML030160330).

4.3 No Siqnificant Hazards Consideration The proposed amendment would modify technical specification (TS) 5.5.16, Containment Leakage Rate Testing Program, by adding exceptions to Regulatory Guide (RG) 1.163 that would allow the next integrated leak rate test (ILRT) Type A testing to be performed at a 15-year interval. This would allow a one time extension of the current ILRT schedule by 5 years.

APS has evaluated whether or not a significant hazards consideration is involved with the proposed change by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed change to extend the next ILRT interval from 10 to 15 years one time does not involve a physical change to PVNGS Units 1, 2 and 3, or a change in the manner in which the plant is operated or controlled. The containment vessel is designed to provide an essentially leak-tight barrier against the uncontrolled release of radioactivity to the environment for any postulated accidents. As such, the reactor containment itself and the testing guidelines invoked to periodically demonstrate the integrity of the containment exist to ensure the containment can mitigate the consequences of any accident and do not involve the prevention or identification of any precursors of any accidents.

There is no design basis accident that is initiated by a failure of the containment leakage mitigation function. The extension of the ILRT will not create any adverse interactions with other systems that could result in initiation of a design Page 25

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 basis accident. Therefore, the probability of occurrence of an accident previously evaluated is not significantly increased.

Based on a completed probability risk assessment of the affects of this change to the ILRT interval there is a slight increase in risk dose. This increase in risk in terms of person-rem year within 50 miles of the plant resulting from design basis accidents is significantly less than one percent and of a magnitude that NUREG-1493 indicates is imperceptible. The risk assessment also analyzed the increase in risk in terms of the frequency of large early releases from accidents.

The increase in the large early release frequency resulting from the proposed extension was determined to be within the guidelines published in Regulatory Guide 1.174. Additionally, the proposed change maintains defense-in-depth by preserving a reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation. The increase in the conditional containment failure probability from reducing the ILRT frequency from one test per 10 years to one test per 15 years is less than one percent and considered insignificant. Continued containment integrity is assured by the history of successful ILRTs, and the established programs for local leakage rate testing and in-service inspections which are not affected by the proposed change. Therefore, the consequences of an accident previously analyzed are not significantly increased.

In summary, the probability of occurrence and the consequences of an accident previously evaluated are not significantly increased.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change to extend the ILRT interval from 10 to 15 years does not create any new or different accident initiators or precursors. The length of the ILRT interval does not affect the manner in which any accident begins. The proposed change does not physically change the plant, does not create any new failure modes for the containment and does not affect the interaction between the containment and any other system. Thus, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Page 26

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 Response: No The risk-based margins of safety associated with the containment ILRT are those associated with the estimated person-rem per year, the large early release frequency, and the conditional containment failure probability. The potential effect of the proposed change on the parameters have been quantified and it has been determined that the effect is considered insignificant. The non-risk-based margins of safety associated with the containment ILRT are those involved with its structural integrity and leak tightness. The proposed change to extend the ILRT interval from 10 to 15 years does not adversely affect either of these attributes. The proposed change only affects the frequency at which these attributes are verified. Therefore, the proposed change does not involve a significant reduction in margin of safety.

Based on the above evaluation, APS concludes that the proposed amendment does not involves a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusion In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5. ENVIRONMENTAL CONSIDERATIONS A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment needs to be prepared in connection with the proposed amendment.

Page 27

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16

6. REFERENCES

1. Regulatory Guide 1.174, "An Approach for, Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," dated July 1998.

2. Regulatory Guide 1.163, "Performance-Based Containment Leak Test Program, "dated September 1995.

3. Nuclear Energy Institute document NEI 94-01 ,"Industry Guideline for Implementing Performance-Based Option of 10CFR Part 50, Appendix J," dated July 26, 1995.

4. NUREG-1493, "Performance-Based Containment Leak-Test Program," dated September 1995.

5. Electric Power Research Institute report TR-1 04285, "Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals," dated August 1994.

6 Letter from N. Kalyanam, NRC, to J.E. Venable, Entergy Operations Incorporated, "Waterford Steam Electric Station, Unit 3 - Issuance of Amendment RE: Integrated Leakage Rate Testing Interval Extension (TAC No. MB2461),"

dated February 14, 2002. (ML020460272)

7. Letter from J.P. Boska, NRC, to O.D. Kingsley, Exelon Generation Company, "Peach Bottom Atomic Power Station, Unit 3 - Issuance of Amendment Re:

Extension of the Containment Integrated Leak Rate Testing Program (TAC No.

MB 0178)," dated October 4, 2001. (ML012210108)

8. Letter from J.M. Goshen, NRC, to D.E. Young, Florida Power Corporation, "Crystal River Unit 3 - Issuance of Amendment regarding Containment Leakage Rate Testing Program (TAC No. MB 1349)," dated August 30, 2001.

(ML012190219)

9. Letter from G.F. Wunder, NRC, to M. Kansler, Entergy Nuclear Operations incorporated, "Indian Point Nuclear Generating Unit 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB 0178)," dated April 17, 2001. (ML011021315)

10. Letter from J.F. Stang, NRC, to A.C. Bakken Ill, Indiana Michigan Power Company, "Donald C. Cook Nuclear Plant, Units 1 and 2 - Issuance of Amendments (TAC Nos. MB4837 and MB4838)," dated February 25, 2003.

(ML030160330)

Page 28

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16

11. J. Haugh, J. Gisclon, W. Parkinson, K. Canavan, "Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leak Rate Test Intervals", Rev. 4, EPRI, Nov. 2001

12. Electric Power Research Institute report TR-1009325 Revision 1, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," dated October 2005.

13. Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1, dated January 2007

14. NRC letter titled: Palo Verde Nuclear Generating Station, Units 1, 2, and 3 -

Issuance of Amendments re: Replacement of Steam Generators and Uprated Power Operations and Associated Administrative Changes (TAC NOs. MC3777, MC3778, and MC3779), dated November 16, 2005, (ML053130275)

15. APS's letter no. 102- 05116 dated July 9, 2004, "Request for a License Amendment to Support Replacement of Steam Generators and Uprated Power Operations in Units I and 3, and Associated Administrative Changes for Unit 2."

(ML042010289)

16. NRC Information Notice 92-20, "Inadequate Local Leak Rate Testing," dated March 3, 1992.

17. NEI 94-01 ,"Industry Guideline for Implementing Performance-Based Option of 10CFR Part 50, Appendix J," Revision 2, NRC approved June 25, 2008

18. EPRI TR-1 009325 Revision 2, Final Report, "Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals," dated August 2007, which was approved by the NRC on June 25, 2008.

Page 29

Enclosure I Evaluation of Proposed Amendment to TS 5.5.16 ENCLOSURE 1, ATTACHMENT I Technical Specification Page Markups Pages:

5.5.15 (for information - no changes) 5.5.16

Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.15 Safety Function Determination Program (continued)

b. A required system redundant to system(s) in turn supported by the inoperable supported system is also inoperable; or

c. A required system redundant to support system(s) for the supported systems (a) and (b) above is also inoperable.

The SFDP identifies where a loss of safety function exists. If a loss of safety function is determined to exist by this program, the appropriate Conditions and Required Actions of the LCO in which the loss of safety function exists are required to be entered.

When a loss of safety function is caused by the inoperability of a single Technical Specification support system, the appropriate Conditions and Required Actions to enter are those of the support system.

5.5.16 Containment Leakage Rate Testing Program

a. A program shall be established to implement the leakage rate testing of the containment as required by 10 CFR 50.54(o) and 10 CFR 50, Appendix J, Option B, as modified by approved exemptions. This program shall be in accordance with the guidelines contained in Regulatory Guide 1.163, "Performance-Based Containment Leak-Test Program," dated September, 1995, as modified by the following exceptions:

1. The visual examination of containment concrete surfaces intended to fulfill the requirements of 10 CFR 50, Appendix J, Option B testing, will be performed in accordance with the requirements of and frequency specified by ASME Code Section XI, Subsection IWL, except where relief has been authorized by the NRC. The containment concrete visual examination may be performed during either power operation, e.g., performed concurrently with other containment inspection-related activities such as tendon testing, or during a maintenance/refueling outage.

2. The visual examination of the steel liner plate inside containment intended to fulfill the requirements of 10 CFR 50, Appendix J, Option B testing, will be performed in accordance with the requirements of and frequency specified by ASME Code Section XI, Subsection IWE, except where relief has been authorized by the NRC.

(continued)

PALO VERDE UNITS 1, 2 AND 3 5.5-15 AMENDMENT NO. 4-1-:4, 161

Programs and Manuals 5.5 5.5 Programs and Manuals (continued) 5.5.16 Containment Leakage Rate Testing Program (continued)

3. The first Type A test performed after the Unit 1 November 1999 Type A test shall be prior to November 4, 2014.

4. The first Type A test performed after the Unit 2 November 2000 Type A test shall be prior to November 2, 2015.

5. The first Type A test performed after the Unit 3 April 2000 Type A test shall be prior to April 27, 2015.

a. The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 52.0 psig for Unit 1 through operating cycle 12 and Unit 3 through operating cycle 13, and 58.0 psig for Unit 1 after operating cycle 12, Unit 2, and Unit 3 after operating cycle 13. The containment design pressure is 60 psig.

b. The maximum allowable containment leakage rate, La, at Pa, shall be 0.1 % of containment air weight per day.

c. Leakage Rate acceptance criteria are:

1. Containment leakage rate acceptance criterion is _<1.0 La.

During the first unit startup following testing in accordance with this program, the leakage rate acceptance are < 0.60 L, for the Type B and C tests and *0.75 La for Type A tests.

2. Air lock testing acceptance criteria are:

a) Overall air lock leakage rate is _<0.05 La when tested at _>Pa.

b) For each door, leakage rate is _<0.01 La when pressurized to _>14.5 psig.

d. The provisions of SR 3.0.2 do not apply to the test frequencies in the Containment Leakage Rate Testing Program.

e. The provisions of SR 3.0.3 are applicable to the Containment Leakage Rate Testing Program.

PALO VERDE UNITS 1,2,3 5.5-16 AMENDMENT NO. 415-ý, 161

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 ENCLOSURE 1, ATTACHMENT 2 Retyped Technical Specification Page Page:

5.5.16

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.16 Containment Leakage Rate Testing Program (continued)

3. The first Type A test performed after the Unit 1 November 1999 Type A test shall be prior to November 4, 2014.

4. The first Type A test performed after the Unit 2 November 2000 Type A test shall be prior to November 2, 2015.

5. The first Type A test performed after the Unit 3 April 2000 Type A test shall be prior to April 27, 2015.

b. The peak calculated containment internal pressure for the design basis loss of coolant accident, Pa, is 52.0 psig for Unit 1 through operating cycle 12 and Unit 3 through operating cycle 13, and 58.0 psig for Unit 1 after operating cycle 12, Unit 2, and Unit 3 after operating cycle 13. The containment design pressure is 60 psig.

c. The maximum allowable containment leakage rate, La, at Pa, shall be 0.1 % of containment air weight per day.

d. Leakage Rate acceptance criteria are:

1. Containment leakage rate acceptance criterion is

• 1.0 La.

During the first unit startup following testing in accordance with this program, the leakage rate acceptance are < 0.60 La for the Type B and C tests and

• 0.75 L, for Type A tests.

2. Air lock testing acceptance criteria are:

a) Overall air lock leakage rate is

• 0.05 La when tested at Ž Pa.

b) For each door, leakage rate is

• 0.01 La when pressurized to Ž 14.5 psig.

e. The provisions of SR 3.0.2 do not apply to the test frequencies in the Containment Leakage Rate Testing Program.

f. The provisions of SR 3.0.3 are applicable to the Containment Leakage Rate Testing Program.

PALO VERDE UNITS 1,2,3 5.5-16 AMENDMENT NO. 4-61,

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 ENCLOSURE 1, ATTACHMENT 3 Risk Assessment for Palo Verde Nuclear Generating Station Regarding ILRT (Type A Testing) Extension Request

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table of Contents EXECUTIVE SUM MARY ...................................................................................................... 2 PURPOSE O F ANALYSIS .................................................................................................... 4

1.1 BACKGROUND

4 1.2CRITERIA 6' MET H O D O LO G Y .................................................................................................................. 8 G R O U N D R U LES ................................................................................................................. 10 3.1GROUND RULES 10 3.2PRA MODEL CAPABILITIES AND APPROPRIATENESS FOR APPLICATION " 11 INP UT S ............................................................................................................................. 13 4.1 GENERAL RESOURCES AVAILABLE 13 4.2CALCULATION OF SPECIFIC INPUTS 18 4.3CONDITIONAL PROBABILITY OF ILRT FAILURE (SMALL AND LARGE) 23 4.4IMPACT OF EXTENSION ON LEAK DETECTION PROBABILITY 24 R ES ULTS ........................................................................................................................ 28 5.1STEP 1 - QUANTIFY THE BASE-LINE RISK IN TERMS OF FREQUENCY PER REACTOR YEAR 30 5.2STEP 2 - DEVELOP CLASS 3 POPULATION DOSE PER REACTOR YEAR 35 5.3STEP 3 - EVALUATE RISK IMPACT OF EXTENDING TYPE A TEST INTERVAL FROM 10-TO-15 YEARS 38 5.4STEP 4 - DETERMINE THE CHANGE IN RISK IN TERMS OF LARGE EARLY RELEASE FREQUENCY (LERF) 45 5.5IMPACT ON THE CONDITIONAL CONTAINMENT FAILURE PROBABILITY (CCFP) 48 5.6RESULTS

SUMMARY

49 APPLICATION OF NEI INTERIM GUIDANCE METHODOLOGY ................................................... 52 6.1

SUMMARY

OF METHODOLOGY 52 6.2ANALYSIS APPROACH 53 6.3RESULTS

SUMMARY

69 APPLICATION OF EPRI TR-1009325 METHODOLOGY .......................................................... 72 7.1

SUMMARY

OF METHODOLOGY 72 7.2ANALYSIS APPROACH 73 7.3RESULTS

SUMMARY

80 C O NC LU S IONS .................................................................................................................. 83 8.1 PREVIOUS ASSESSMENTS 83 8.2PALO VERDE SPECIFIC RISK RESULTS 84 8.3SENSITIVITY ANALYSIS FOR USE OF EPRI REPRESENTATIVE PLANT CONSEQUENCE MEASURES 85 8.4RISK TRADE-OFF 87 REFERENCES ............... . ................................................................................ 88 Effect of Age-Related Degradation on Risk Impact Assessment for Extending Containment Type A Test In terv al.................................................................................................................................. A -i Effect of External Events on Risk Informed/Risk Impact Assessment for Extending Containment T ype A Test Inte rva l................................................................................................................ B -1 Page 1

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension EXECUTIVE

SUMMARY

An evaluation was performed to assess the risk impact of extending the currently allowed containment Type A integrated leak rate test (ILRT) frequency from ten years to fifteen years for a one-time extension for the Palo Verde Nuclear Generating Station (PVNGS).

This would allow for substantial cost savings as the ILRT could be deferred for additional scheduled refueling outages. The proposed change would impact testing associated with the current surveillance test for Type A leakage. The risk assessment follows the guidelines from NEI 94-01 [1], the methodology used in EPRI TR-104285 [2], and the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) findings and risk insights in support of a request to change a plant's licensing basis as outlined in Regulatory Guide 1.174 [3]. In addition, for comparison purposes, the risk assessment was also performed using two more recent studies. These methodologies are presented in the NEI Interim Guidance [23], and in EPRI TR-1009325 [5]. Although these methodologies generally produce more conservative results than do the earlier methodologies, they build upon the work of the earlier studies, and much of the analyses developed from application of the EPRI TR-1 04285 methodology remains applicable for use in these more recent studies.

The findings for Palo Verde confirm the general findings of previous studies on a plant specific basis, including severe accident category frequencies, the containment failure modes, the Technical Specification allowed leakage, and the local population surrounding the Palo Verde station. This risk assessment will apply to all three units at PVNGS. Based on the results from Sections 5 through 7, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test from ten years to fifteen years:

Page 2

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension There is no change in the at-power core damage frequency (CDF) associated with the ILRT test interval extension. Therefore, this is within the Reg. Guide 1.174 acceptance guidelines.

Reg. Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.174 defines very small changes in risk as resulting in increases of CDF below 10-6/yr and increases in large early release frequency (LERF) below 10-7/yr. Since the ILRT does not impact CDF, the relevant criterion is LERF. The increase in LERF resulting from a change in the Type A ILRT test frequency from once-per-ten-years to once-per-fifteen years is between 2.21 E-1 0/yr and 2.46E-09/yr. Therefore, increasing the ILRT interval from 10 to 15 years is considered to result in a very small change to the Palo Verde risk profile.

• The proposed change in the Type A test frequency (from once-per-ten-years to once-per-fifteen-years) increases the total integrated plant risk by significantly less than 1%. Therefore, the risk impact of this change, when compared to other severe accident risks, is negligible.

The change in Conditional Containment Failure Probability (CCFP) of less than 1% is judged to be insignificant and reflects sufficient defense-in-depth.

Incorporating external event impacts into this analysis does not change the

• onclusion of this risk assessment (i.e., increasing the Palo Verde ILRT interval from 10 to 15 years is an acceptable plant change from a risk perspective).

Page 3

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 1 PURPOSE OF ANALYSIS The purpose of this analysis is to provide a risk assessment of extending the currently allowed containment Type A integrated leak rate test (ILRT) frequency extension from ten years to fifteen years for Palo Verde. The extension would allow for substantial cost savings as the ILRT could be deferred for additional scheduled refueling outages for Palo Verde.

The risk assessment follows the guidelines from NEI 94-01 [1], the methodology used in EPRI TR-1 04285 [2], and the NRC regulatory guidance on the use of Probabilistic Risk Assessment (PRA) findings and risk insights in support of a request to change a plant's licensing basis as outlined in Regulatory Guide 1.174

[3]. In addition, for comparison purposes, the risk assessment was also performed using two more recent studies. These methodologies are presented in the NEI Interim Guidance [23], and in EPRI TR-1009325 [5]. Although these methodologies generally produce more conservative results than do the earlier methodologies, they build upon the work of the earlier studies, and much of the analyses developed from application of the EPRI TR-104285 methodology remains applicable for use in these more recent studies. Therefore, the calculations and results from these analyses are presented at the end of this report (Sections 6 and 7), with references to the previous EPRI TR-1 04285 results provided as necessary for efficient reporting of the study results.

1.1 BACKGROUND

10CFR50, Appendix J, Option B, allows individual plants to extend the Type A Integrated Leak Rate Test (ILRT) surveillance test interval from three-in-ten years Page 4

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension to at least once per ten years. The revised Type A frequency is based on an acceptable performance history defined as two consecutive periodic Type A tests at least 24 months apart in which the calculated leakage performance was less than 1.0La. Palo Verde meets these requirements.

The basis for the current 10-year test interval is provided in Section 11.0 of NEI 94-01, Revision 0, and was established in 1995 during development of the performance-based Option B to Appendix J. Section 11.0 of NEI 94-01 states that NUREG-1493, 'Performance-Based Containment Leak Test Program',

September 1995, provides the technical basis to support rule making to revise leakage rate testing requirements contained in Option B to Appendix J. The basis consisted of qualitative and quantitative assessments of the risk impact (in terms of increased public dose) associated with a range of extended leakage rate test intervals. To supplement the NRC's rule making basis, NEI undertook a similar study. The results of that study are documented in Electric Power Research Institute (EPRI) Research Project Report TR-104285 [2].

The NRC report, Performance Based Leak Test Program, NUREG-1493 [4],

which analyzed the effects of containment leakage on the health and safety of the public and the benefits realized from the containment leak rate testing determined that increasing the containment leak rate from the nominal 1.0 percent per day to 10 percent per day leads to a small increase in total population exposure. In addition, increasing the leak rate to 100 percent per day increases the total population risk by less than 1 percent. Consequently, extending the ILRT interval should not lead to any substantial increase in risk. The current analysis is being performed to confirm these conclusions based on Palo Verde specific models and available data.

Page 5

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension EPRI TR-1 04285 (Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals) is a follow-on report to NUREG-1493 that provides a methodology for use in preparing PRA analysis to support a submittal. This methodology is followed to determine the appropriate risk information for use in evaluating the impact of the proposed ILRT changes.

It should be noted that containment leak-tight integrity is also verified through periodic in-service inspections conducted in accordance with the requirements of the American Society of Mechanical Engineers Boiler and Pressure Vessel Code (ASME Code), Section Xl. More specifically, Subsection IWE provides the rules and requirements for in-service inspection of Class MC pressure-retaining components and their integral attachments, and of metallic shell and penetration liners of Class CC pressure-retaining components and their integral attachments in light-water cooled plants. Furthermore, NRC regulations 10 CFR 50.55a(b)(2)(ix)(E), require licensees to conduct a general visual inspection of the accessible areas of the interior of the containment in accordance with Subsection IWE once each period. These requirements will not be changed as a result of the extended ILRT interval. In addition, Appendix J, Type B and Type C local leak tests performed to verify the leak-tight integrity of containment penetration valves, air locks, seals, and gaskets are also not affected by the change to the Type A test frequency.

1.2 CRITERIA The acceptance guidelines in RG 1.174 are used to access the acceptability of this one-time extension of the Type A test interval beyond that established during the Option B rulemaking of Appendix J. RG 1.174 defines very small changes in the risk-acceptance guidelines as increases in core damage frequency (CDF) less than 10-6 per reactor year and increases in large early release frequency (LERF)

Page 6

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension less than 10-7 per reactor year. Since the Type A test does not impact CDF, the relevant criterion is the change in LERF. RG 1.174 also discusses defense-in-depth and encourages the use of risk analysis techniques to help ensure and show that key principles, such as the defense-in-depth philosophy, are met.

Therefore, the increase in the conditional containment failure probability which helps to ensure that the defense-in-depth philosophy is maintained will also be calculated.

In addition, the total risk (person rem/yr population dose) is examined to demonstrate the relative change in this parameter.

Page 7

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 2 METHODOLOGY A simplified bounding analysis approach consistent with the EPRI approach is used for evaluating the change in risk associated with increasing the test interval to fifteen years.

The approach is consistent with that presented in EPRI TR-104285 [2] and NUREG-1493 [4]. The analysis uses the Palo Verde Probabilistic Risk Assessment (PRA) model (Revision 14) that includes the results from the Palo Verde Level 2 analysis of core damage scenarios and subsequent containment response resulting in various fission product release categories (including no release).

The four general steps of this risk assessment are as follows:

1) Quantify the baseline risk in terms of frequency events (per reactor year) for each of the eight containment release scenario types identified in the EPRI report.

2) Apply NUREG-1 150 offsite consequence measures based on population dose (person-rem) per reactor year for each of the eight containment release scenario types from consequence analyses (i.e., previously performed calculations using MACCS for the "reference plant" PWR, as documented in EPRI TR-1 04285).

3) Evaluate the risk impact (i.e., the change in containment release scenario type frequency and population dose) of extending the ILRT interval to fifteen years.

4) Determine the change in risk in terms of Large Early Release Frequency.

(LERF) in accordance with Regulatory Guide 1.174 [3] and compare with the acceptance guidelines of RG 1.174.

This approach is based on the information and methodology contained in the previously mentioned studies and further is consistent with the following:

• Other industry risk assessments for ILRT test interval extensions. The Palo Verde assessment uses population dose as one of the risk Page 8

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension measures. The other risk measures used in the Palo Verde assessment are Large Early Release Frequency (LERF), and Conditional Containment Failure Probability (CCFP) to demonstrate that the acceptance guidelines from RG 1.174 are met.

EPRI TR-104285 and NUREG-1493. The Palo Verde assessment uses information from NUREG-1273 [6] regarding the low percentage of containment leakage events that would only be detected by an ILRT as inputs to calculate the increase in the pre-existing containment leakage probability due to the testing interval extension.

• The approach used in the Indian Point 3 risk-informed submittal for a one-time extension of the Type A test interval. The Palo Verde evaluation uses similar ground rules and methods to calculate changes in risk metrics [14].

NRC approval was granted to Indian Point 3 on April 17, 2001 (TAC No.

MB30178) [21].

Page 9

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 3 GROUND RULES This section summarizes the general rules used in the ILRT interval extension risk analysis (Section 3.1) and provides details regarding the capabilities of the PRA model that was used in the analysis (Section 3.2).

3.1 GROUND RULES The following ground rules are used in the analysis:

" The Palo Verde Level 1 and Level 2 internal events PRA model provides representative results for the analysis. The Palo Verde Level 1 models include internal fire events. Section 3.2 below provides details regarding the scope and capabilities of the Palo Verde PRA model.

• It is appropriate to use the Palo Verde internal events PRA model as a gauge to effectively describe the risk changes attributable to the ILRT extension. It is reasonable to assume that the impact from the ILRT extension (with respect to percent increases in population dose) will not substantially differ if fire and shutdown events were to be included in the calculations. Section 3.2 below provides additional details relative to the appropriateness of the application of Palo Verde internal events models to the ILRT extension risk analysis.

• An evaluation of the risk trade-off impact of performing the ILRT during shutdown is addressed using the generic results from EPRI TR 105189 [10].

• Palo Verde population doses for the containment failures modeled in the PRA can be characterized by the NUREG-1 150 (PWR "reference plant") population dose results from MACCS calculations presented in EPRI TR-104285 [2].

• Accident classes describing radionuclide release end states are defined Page 10

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension consistent with EPRI methodology [2] and are summarized in Section 4.2.

0 The maximum containment leakage for Class 1 sequences is 1.0 La. Class 3 accounts for increased leakage due to Type A inspection failures.

• The maximum containment leakage for Class 3a sequences is 10 La. based on the previously approved methodology [14, 21].

0 The maximum containment leakage for Class 3b sequences is 35 La. based on the previously approved methodology [14, 21].

• The impact on population doses from Interfacing System LOCAs is not altered by the proposed ILRT extension, but is accounted for in the EPRI methodology as a separate entry for comparison purposes. Since the ISLOCA contribution to population dose is fixed, no changes on the conclusions from this analysis will result from this assumption.

The reduction in ILRT frequency does not impact the reliability of containment isolation valves to close in response to a containment isolation signal.

Containment isolation valves that fail to close during an accident and in response to a containment isolation signal are calculated on a Palo Verde specific basis and made part of the overall population dose and LERF calculations.

3.2 PRA MODEL CAPABILITIES AND APPROPRIATENESS FOR APPLICATION Risk-informed support for the proposed ILRT interval changes is based in part upon analyses that include results from the Palo Verde Level 1 and Level 2 Probabilistic Risk Assessment (PRA) models. The scope, level of detail, and quality of the Palo Verde PRA is sufficient to support a technically defensible and realistic evaluation of the risk change for the proposed ILRT interval extension.

Page 11

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The Palo Verde PRA is an upgrade to the Individual Plant Examination (IPE) submitted to the NRC. The NRC accepted the IPE. The NRC letters noted that the IPE submittals met the intent of Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10CFR 50.54(f)".

A portion of the risk analysis involves comparison of the plant Large, Early Release Frequency (LERF) from the baseline case (ILRTs assumed to be performed on the existing intervals) with various cases in which the ILRT intervals have been extended.

For the baseline analysis, LERF was estimated using the methodologies in NUREG/CR-6595, January 1999, "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events." This approach to LERF evaluation, while somewhat simplified, supports realistic quantification of systematic contributions to containment isolation failures, bypass sequences that are actually derived from the Level 1 sequences model, and conservative evaluation of severe accident challenges which are less important for PWRs with large, dry containments. This methodology was also used for the ILRT interval extension cases, except that the portion of the LERF attributable to the extension was also added to the results, according to the various methodologies used (as outlined in Sections 4 - 7 in this report).

A peer review for PVNGS has been done and all category A and category B findings were resolved. This resulted in a number of enhancements to the PRA model.

Documentation that describes the past model revisions and any major changes that took place is shown in reference 25.

Page 12

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 4 INPUTS This section summarizes the general resources available as input (Section 4.1) and the plant specific resources required (Section 4.2).

4.1 GENERAL RESOURCES AVAILABLE Various industry studies on containment leakage risk assessment are briefly summarized here:

1) NUREG/CR-3539 [7]

2) NUREG/CR-4220 [8]

3) NUREG-1273 [6]

4) NUREG/CR-4330 [9]

5) EPRI TR-105189 [10]

6) NUREG-1493 [4]

7) EPRI TR-1 04285 [2]

The first study is applicable because it provides one basis for the threshold that could be used in the Level 2 PSA for the size of containment leakage that is considered significant and to be included in the model. The second study is applicable because it provides a basis of the probability for significant pre-existing containment leakage at the time of a core damage accident. The third study is applicable because it is a subsequent study to NUREG/CR-4220 which undertook a more extensive evaluation of the same database. The fourth study provides an assessment of the impact of different containment leakage rates on plant risk.

The fifth study provides an assessment of the impact on shutdown risk from ILRT test interval extension. The sixth study is the NRC's cost-benefit analysis of various alternative approaches regarding extending the test intervals and Page 13

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension increasing the allowable leakage rates for containment integrated and local leak rate tests. The last study is an EPRI study of the impact of extending ILRT and LLRT test intervals on at-power public risk.

NUREG/CR-3539 [71 Oak Ridge National Laboratory documented a study of the impact of containment leak rates on public risk in NUREG/CR-3539. This study uses information from WASH-1400 as the basis for its risk sensitivity calculations. ORNL concluded that the impact of leakage rates on LWR accident risks is relatively small.

NUREG/CR-4220 [81 NUREG/CR-4220 is a study performed by Pacific Northwest Laboratories for the NRC in 1985. The study reviewed over two thousand LERs, ILRT reports and other related records to calculate the unavailability of containment due to leakage.

The study calculated unavailability's for Technical Specification leakages and "large" leakages. It is the latter category that is applicable to containment isolation modeling that is the focus of this risk assessment.

NUREG/CR-4220 assessed the "large" containment leak probability to be in the range of 1E-3 to 1E-2, with 5E-3 identified as the point estimate based on 4 events in 740 reactor years and conservatively assuming a one-year duration for each event. It should be noted that all of the 4 identified large leakage events were PWR events.

Page 14

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension NUREG-1273 [61 A subsequent NRC study, NUREG-1273, performed a more extensive evaluation of the NUREG/CR-4220 database. This assessment noted that about one-third of the reported events were leakages that were immediately detected and corrected.

In addition, this study noted that local leak rate tests can detect "essentially all potential degradations" of the containment isolation system.

NUREG/CR4330 [91 NUREG/CR-4330 is a study that examined the risk impacts associated with increasing the allowable containment leakage rates. The details of this report have no direct impact on the modeling approach of the ILRT test interval extension, as NUREG/CR-4330 focuses on leakage rate and the ILRT test interval extension study focuses on the frequency of testing intervals. However, the general conclusions of NUREG/CR-4330 are consistent with NUREG/CR-3539 and other similar containment leakage risk studies:

"the effect of containment leakage on overall accident risk is small since risk is dominated by accident sequences that result in failure or bypass of containment."

EPRI TR-105189 [101 The EPRI study TR-105189 is useful to the ILRT test interval extension risk assessment because this EPRI study provides insight regarding the impact of containment testing on shutdown risk. This study performed a quantitative evaluation (using the EPRI ORAM software) for two reference plants (a BWR-4 and a PWR) of the impact of extending ILRT and LLRT test intervals on shutdown risk.

The result of the study concluded that a small but measurable safety benefit is realized from extending the test intervals. For the benefit from extending the ILRT frequency from 3 per 10 years was calculated to be a reduction of approximately Page 15

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension 1E-7/yr in the shutdown core damage frequency. This risk reduction is due to the following issues:

- Reduced opportunity for drain down events

- Reduced time spent in configurations with impaired mitigating systems The study identified 7 shutdown incidents (out of 463 reviewed) that were caused by ILRT or LLRT activities. Two of the 7 incidents were RCS-draindown events caused by ILRT/LLRT activities, and the other 5 were events involving loss of RHR and/or SDC due to ILRT/LLRT activities. This information was used in the EPRI study to estimate the safety benefit from reductions in testing frequencies.

This represents a valuable insight into the improvement in safety due to extending the ILRT test interval.

NUREG-1493 [41 NUREG-1493 is the NRC's cost-benefit analysis for proposed alternatives to reduce containment leakage testing intervals and/or relax allowable leakage rates.

The NRC conclusions are consistent with other similar containment leakage risk studies:

- Reduction in ILRT frequency from 3 per 10 years to 1 per 20 years results in an "imperceptible" increase in risk.

- Increasing containment leak rates several orders of magnitude over the design basis would minimally impact (0.2-1.0%) population risk.

NUREG-1493 used information from NUREG-1273 regarding the low percentage of containment leakage events that would only be detected by an ILRT in the calculation of the increase in the pre-existing containment leakage probability due to the testing interval extension. NUREG-1493 makes the following assumptions in this probability calculation:

Page 16

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

- The average time that a pre-existing leakage may go undetected increases with the length of the testing interval.

- Only 3% of all pre-existing leaks can be detected only by an ILRT (i.e.,

and not by LLRTs).

This same approach that was used in a previously approved ILRT test interval extension submittal [14, 21] is also proposed here for the Palo Verde ILRT test interval extension risk assessment.

EPRI TR-104285 [21 Extending the risk assessment impact beyond shutdown (the earlier EPRI TR-105189 study), the EPRI TR-104285 study is a quantitative evaluation of the impact of extending ILRT and LLRT test intervals on at-power public risk. This study combined IPE Level 2 models with NUREG-1 150 Level 3 population dose models to perform the analysis. The study also used the approach of NUREG-1493 in calculating the increase in pre-existing leakage probability due to extending the ILRT and LLRT test intervals.

EPRI TR-1 04285 used a simplified Containment Event Tree to subdivide representative core damage frequencies into eight (8) classes of containment response to a core damage accident:

1. Containment intact and isolated

2. Containment isolation failures dependent upon the core damage accident

3. Type A (ILRT) related containment isolation failures

4. Type B (LLRT) related containment isolation failures

5. Type C (LLRT) related containment isolation failures

6. Containment isolation failures not identified by LLRT (e.g., isolation failures due to testing or maintenance)

Page 17

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

7. Containment failure due to core damage accident phenomena

8. Containment bypass Consistent with the other containment leakage risk assessment studies, this study concluded:

"These study results show that the proposed CLRT [containment leak rate tests] frequency changes would have a minimal safety impact. The change in risk determined by the analyses is small in both absolute and relative terms. For example, for the PWR analyzed, the change is about 0.02 person-rem per year."

4.2 CALCULATION OF SPECIFIC INPUTS The information used to perform the Palo Verde ILRT Extension Risk Assessment includes the following:

Population dose calculations by release category (e.g., based on MACCS code calculation results for NUREG-1 150 plants as documented in EPRI TR-104285).

- Palo Verde PRA Model

- ILRT results to demonstrate adequacy of the administrative and hardware issues. The current Type A test interval is 10 years.

Release Category Definition Table 4.2-1 defines the accident classes used in the ILRT extension evaluation consistent with the EPRI methodology [2].

Page 18

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 4.2-1 EPRI CONTAINMENT FAILURE CLASSIFICATIONS Class Description Includes accident sequences that do not lead to containment failure in the long term (containment remains intact). The release of fission products (and attendant consequences) is determined by the maximum allowable leakage rate values La, under Appendix J for that plant.

Includes those accidents in which there is a failure to isolate the containment (containment isolation failures).

Includes those accidents in which the pre-existing isolation failure to seal 3 (i.e., provide a leak-tight containment) is not dependent on the sequence in progress (independent, or random, isolation failures).

Includes those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in progress (independent, or random, 4 isolation failures). This class is similar to Class 3 isolation failures, but is applicable to sequences involving Type B tests. These are the Type B-tested components that have isolated but exhibit excessive leakage.

Includes those accidents in which the pre-existing isolation failure to seal is not dependent on the sequence in progress (independent, or random, isolation failures). This class is similar to Class 4 isolation failures, but is applicable to sequences involving Type C tests and their potential failures.

Includes those leak paths (containment isolation failures) covered in the 6 plant test and Maintenance requirements or verified per in service inspection and testing (ISI/IST).

Accidents involving containment failure induced by severe accident 7 phenomena. Changes in Appendix J testing requirements do not impact these accidents.

Accidents in which the containment is bypassed (either as an initial condition 8 or induced by phenomena) are included in Class 8. Changes in Appendix J testing requirements do not impact these accidents.

Population Dose Calculations As consequence measures (population doses) from Level 3 PRA analysis are not available for Palo Verde, the population doses applied to the various release categories identified in Section 4.1 are taken from data presented for a PWR "representative plant" in EPRI TR-104285, Table 4. The representative plant data Page 19

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension used estimated release fractions of fission product species reported in IPE analyses for the various release categories, and applied population doses to these categories based on MACCS calculations performed for Surry in NUREG-1150 [22]. Table 4.2-2 summarizes the calculated population doses for each release category defined in the EPRI report.

As stated in EPRI TR-1 04285, there are a number of parameters that determine the offsite calculations for similar source term release magnitudes, including the power rating and demographics of the Surry plant as compared to the representative plants (and to Palo Verde). However, the EPRI TR-1 04285 "representative plant" methodology is acceptable for use for plants without plant-specific Level 3 consequence measures, including Palo Verde, since the comparison is made to a baseline. Therefore, the differences in the above parameters not considered in this analysis would not impact the conclusions drawn. This is demonstrated for the Palo Verde results in Section 8.3 below.

A summary of the population dose measures applied to all accident classes except Class 3 is provided in Table 4.2-2 below. The population dose for Class 3 is developed in Section 5.2 of this report.

Page 20

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 4.2-2

SUMMARY

OF ACCIDENT CLASS CONSEQUENCE MEASURES (POPULATION DOSE) BASED ON EPRI TR-104285 [2], TABLE 4 Release Population Dose for Category Description 'Entire Region1 (person-rem) 1 Intact Containment 8.97E+01 2 Loss of Containment Isolation 4.07E+06 3 Type A (ILRT) related containment isolation [Calculated based on failures EPRI Methodology -

see Section 5.2]

4 Type B (LLRT) related containment isolation n/a to ILRT extension failures 5 Type C (LLRT) related containment isolation n/a to ILRT extension failures 6 Containment isolation failures not identified n/a to ILRT extension by LLRT 7 Containment failure due to core damage 2.16E+06 accident phenomena 8 Containment bypass 1.24E+07 Note 1: EPRI TR-104285, Table 4 provides frequencies (per Rx-yr) and consequence measures (person-rem/yr) by accident class. Dose (person-rem) is determined from the table by dividing the consequence measure by the accident class frequency.

Palo Verde PRA Model The Palo Verde internal events PRA Model (Revision 14) was used to quantify the baseline CDF and LERF. The percent contribution for each of the accident classes (release categories) from the updated PVNGS Level 2 (Reference 24) was calculated. The baseline CDF and the percent contribution numbers were used to calculate the new accident class frequencies used in the EPRI TR-104285 methodology. A summary of these calculation results is provided in Table 4.2-3.

For Revision 14 of the Palo Verde PRA model, the Core Damage Frequency Page 21

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension (CDF) is 1.39E-05 per-yr and the Large Early Release Frequency (LERF) is 8.65E-07 per-yr.

Table 4.2-3

SUMMARY

OF EPRI TR-104285 ACCIDENT CLASS FREQUENCIES BASED ON TABLE 12 OF UPDATED LEVEL 2 ANALYSIS EPRI Accident Frequency Class Rev. 14 PRA (per rx-year)

Description Category1 1 Intact Containment INTACT 5.32E-07 2 Containment Isolation LERF-ISO 3.47E-08 Failure Type A (ILRT) related [calculated based on EPRI 3 containment isolation failuresMehdlg Methodology -

failures see Sec. 5.1]

Type B (LLRT) related [n/a for ILRT 4 containment isolation interval N/A failures extensions]

Type C (LLRT) related [n/a for ILRT 5 containment isolation interval N/A failures extensions]

Containment isolation [n/a for ILRT 6 failures not identified interval N/A by LLRT extensions]

Containment failure [Overall CDF -

all other 7 due to core damage Release 1.25E-05 accident phenomena Categories]

8 Containment bypass LERF-BYPASS 7.86E-07

_______________________ LERF-SGTR _________

Total 1.39E-05 1

PRA "Categories" are made up of Level 2 release categories, Level 1 accident classes, and other metrics quantified to determine the total frequency of each EPRI accident class.

Page 22

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension 4.3 CONDITIONAL PROBABILITY OF ILRT FAILURE (SMALL AND LARGE)

The ILRT can detect a number of failures such as liner breach, failure of certain bellows arrangements, and failure of some sealing surfaces. The proposed ILRT test interval extension may influence the conditional probability associated with the ILRT failure. To ensure that this effect is properly accounted for, the Class 3 accident class is divided into two sub-classes, Class 3a and Class 3b, representing small and large leakage failures, respectively.

To calculate the probability that a liner leak will be large (event Class 3b), use was made of the data presented in NUREG-1493 [4]. The data found in NUREG-1493 states that 144 ILRTs were conducted. The largest reported leak rate from those 144 tests was 21 times the allowable leakage rate (La). Because 21La does not constitute a large release, no releases have occurred based on the 144 ILRTs reported in NUREG-1493 [4].

To estimate the failure probability given that no failures have occurred, a conservative estimate is obtained from the 95th percentile of the X2 distribution. In statistical theory, the X2 distribution can be used for statistical testing, goodness-of-fit tests, and evaluating s-confidence [13]. The X2 distribution is really a family of distributions, which range in shape from that of the exponential to that of the normal distribution. Each distribution is identified by the degrees of freedom, v.

For time-truncated tests (versus failure-truncated tests), an estimate of the probability of a large leak using the X2 distribution can be calculated as X295 (v =

2n + 2) / 2N, where n represents the number of large leaks and N represents the number of ILRTs performed to date. With no large leaks (n = 0) in 144 events (N Page 23

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

= 144) and X295 (2) = 5.991, the 9 5 th percentile estimate of the probability of a large leak is calculated as 5.99 / (2

• 144) = 0.021.

To calculate the probability that a liner leak will be small (event Class 3a), use was made of the data presented in NUREG-1493 [4]. The data found in NUREG-1493 states that 144 ILRTs were conducted. The data reported that 23 of 144 tests had allowable leak rates in excess of 1.OLa. However, of these "failures" only 4 were found by an ILRT; the others were found by Type B and C testing on errors in test alignments. Therefore, the number of failures considered for "small releases" are 4-of-144. Similar to the event Class 3b probability, the estimated 2 2 failure probability for small release is found by using the X distribution. The X distribution is calculated by n = 4 (number of small leaks) and N = 144 (number of events) which yields a X295 (10) = 18.30701. Therefore, the 9 5 th percentile estimate of the probability of a small leak is calculated as 18.3070 / (2

• 144) =

0.064.

Using the methodology discussed above is conservative compared to the typical mean estimates used for PRA analysis. For example, the mean probability of a Class 3a failure would be the (number of failures) / (number of tests) or 4/144 =

0.03 compared with 0.064 used here.

4.4 IMPACT OF EXTENSION ON LEAK DETECTION PROBABILITY The NRC in NUREG-1493 [4] has determined from a review of operating experience data that only 3% of the ILRT failures were found which local leakage-rate testing could not and did not detect. In NUREG-1493 [4], it is noted that based on a review of leak rate testing experience, a small percentage (3% of leakages that exceed current requirements are detectable only by Type A testing).

Note 1: To obtain X295 (2) = 5.99 and X295 (10) = 18.3070 the excel functions CHIINV(0.05,2)=5.99 and CHIINV(0.05,1 0)=18.3070 were used.

Page 24

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Further, in NUREG-1493 it is noted that the leakage rates observed in these few Type A test failures were only marginally above currently prescribed limits and could be characterized by a leakage rate of about two times the allowable.

Also in NUREG-1 493 [4], it was assumed that the characteristic magnitude of leakages detectable only by ILRTs would not change, but the probability of leakage would change due to the longer intervals between tests. The change in probability was estimated by comparing the average time that a leak could exist without detection. For example, the average time that a leak could go undetected with a three-year test interval is 3yrs/2 = 1.5 years, and the average time that a leak could exist without detection for a ten-year interval is 1Oyrs/2 = 5 years. This change would lead to a non-detection probability that is a factor of 5.0/1.5 = 3.33 higher for the probability of a leak that is detectable only by ILRT testing, However, since ILRTs have been demonstrated to improve the residual leak detection by only 3%, the interval change noted above would only lead to about a 3.33*3% = 10% non-detection leak probability. It is assumed that Local Leak Rate Test (LLRT) will continue to provide leak detection for the 97% of leakages.

Correspondingly, an extension of the ILRT interval to fifteen years can be estimated to lead to about a 7.5/1.5x3% = 15% non-detection probability of a leak.

These are obviously approximations assumed by the NRC and EPRI because the current 3 ILRTs in 10 years would have a T/2 = 1.67 years instead of 1.5 years.

Therefore, the failure rate of ILRTs for which the LLRTs do not provide adequate backup is 0.03/1.5 year average detection time. Applying a constant failure rate model, the failure probability of ILRTs, Pf, can be estimated as follows:

Page 25

Enclosure 1, Attachment 3

.Risk Assessment for ILRT (Type A) Extension For 3 Year Interval Pfo= 10 YeT ar I(ntr 0.03 For 10 Year Interval 2 = ( .r)I03 Yi = 0.10 For 15 Year Interval Pf = IAT1 2 = ( .03 1u 5yr) =0..15 EPRI has previously interpreted this to mean that the failure to detect probability values are tabulated as follows:

Table 4.2-4 ILRT FAILURE TO DETECT PROBABILITY ILRT EPRI IP3 [14] Constant Interval Assessment Failure Rate

[2] Model 3 yr 0.03 0.03 0.03 10 yr 0.13 0.13 0.10 15 yr NA 0.18 0.15 Page 26

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension In addition, IP3 [14] has used this same estimate of changes in detection probability in a submittal to extend the ILRT interval on a one-time basis. The IP3 request for a one-time ILRT extension was approved by the NRC on April 17, 2000 (TAC No.*MB0178) [21]).

The analysis included in this report follows the precedence set by the EPRI report and the IP3 analysis. The use of the constant failure rate model is conservatively represented by the assumed "failure to detect" probabilities used by EPRI and in the IP3 submittal.

Page 27

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 5 RESULTS The application of the approach based on EPRI-TR-105189 [10] and previous risk assessment submittals on this subject [14] has established a clear process for the calculation and presentation of results.

The method chosen to display the results is according to the eight (8) accident classes consistent with these two reports. Table 5-1 lists these accident classes.

The analysis performed examined Palo Verde specific accident sequences in which the containment remains intact or the containment is impaired. Specifically, the break down of the severe accident contribution to risk was considered in the following manner:

Core damage sequences in which the containment remains intact initially and in the long!term (EPRI TR-104285 Class 1 sequences).

- Core damage sequences in which containment integrity is impaired due to random isolation failures of plant components other than those associated with Type B or Type C test components. For example, liner breach or bellows leakage. (EPRI TR-104285 Class 3 sequences).

Core damage sequences in which containment integrity is impaired due to containment isolation failures of pathways left "opened' following a plant post-maintenance test. (For example, a valve failing to close following a valve stroke test - EPRI TR-104285 Class 6 sequences).

Page 28

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Accident sequences involving containment bypass (EPRI TR-104285 Class 8 sequences), large containment isolation failures (EPRI TR-104285 Class 2 sequences), and small containment isolation "failure-to-seal" events (EPRI TR-1 04285 Class 4 and 5 sequences) are accounted for in this evaluation as part of the baseline risk profile. However, they are not affected by the ILRT frequency change.

Class 4 and 5 sequences are impacted by changes in Type B and C test intervals; therefore, changes in the Type A test interval do not impact these sequences.

Table 5-1 ACCIDENT CLASSES Accident Classes (Containment Release Type) Description 1 No Containment Failure 2 Large Isolation Failures (Failure to Close) 3a Small Isolation Failures (liner breach) 3b Large Isolation Failures (liner breach) 4 Small Isolation Failures (Failure to seal-Type B) 5 Small Isolation Failures (Failure to seal-Type C) 6 Other Isolation Failures (e.g., dependent failures) 7 Failures Induced by Phenomena (Early and Late) 8 Bypass (Interfacing System LOCA)

CDF All CET End states (including very low and no release)

Page 29

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The steps taken to perform this risk assessment evaluation are as follows:

Step 1 - Quantify the base-line risk in terms of frequency per reactor year for each of the applicable eight accident classes presented in Table 5-1.

Step 2 - Develop plant specific person-rem dose (population dose) per reactor year for each of the eight accident classes evaluated in EPRI TR-104285.

Step 3 - Evaluate the risk impact of extending Type A test interval from 10 to 15 years.

Step 4 - Determine the change in risk in terms of Large Early Release Frequency (LERF) in accordance with RG 1.174.

5.1 STEP 1 - QUANTIFY THE BASE-LINE RISK IN TERMS OF FREQUENCY PER REACTOR YEAR The severe accident sequence frequencies that can result in offsite consequences were evaluated. Revision 14 of the Palo Verde PRA model was used in the ILRT evaluation. In a separate PRA study [24], containment non-leakage release categories (identified in Table 4.2-3) were quantified.

The mapping of EPRI accident classes to population dose for the region around the Palo Verde plant was discussed in Section 4.2 above. The results of this mapping are provided on Table 4.2-3.

The extension of the Type A test interval does not influence those accident progressions that involve containment isolation failures, Type B or Type C testing, or containment failure induced by severe accident phenomena.

Page 30

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension For the assessment of ILRT impacts on the risk profile, the potential for pre-existing leaks are included in the model. Specifically, a simplified model based on NUREG-1493 results is used to predict the likelihood of having a small/large breach in the containment liner that is undetected by the Type A ILRT test.

These events are represented by the "Class 3" sequence depicted in EPRI TR-104285 [2]. The Class 3 leakage includes the probability of a liner breach or bellows failure (due to excessive leakage) at the time of core damage. Two failure modes, event Class 3a (small breach) and event Class 3b (large breach) were considered to ensure proper representation of available data.

After including the respective "large" and "small" liner breach leak rate probabilities (Classes 3a and 3b), the eight severe accidents class frequencies were developed consistent with the definitions in Table 5-1 and described below.

Class 1 Sequences This group consists of all core damage accident progression bins for which the containment remains intact. The frequency per year for these sequences is 5.32E-7/year from the quantification using the Rev. 14 model described above.

However, note that Class 3, described-below, is not calculated from the PRA model but is considered to apply only to Class 1-type sequences. Therefore, a portion of the Class 1 sequence total were applied to Class 3 below - as such, the final Class 1 frequency to which Class 1 consequence measures will be applied is determined by subtracting all other containment failure end states from the total CDF, effectively the Class 1 calculated value less the Class 3 sequence total.

After all containment failure accident class frequencies (Classes 2 through 8) were developed, frequencies for Classes 2 through 8 were summed (result =

1.3393E-5/yr). This was then subtracted from the total CDF (1.388E-5/yr) to Page 31

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension obtain the Class 1 frequency of "No Containment Failure" of 4.867E-7/yr. For this analysis, the associated maximum containment leakage for this group is 1.OLa, consistent with an intact containment evaluation.

Class 2 Sequences This group consists of all core damage accident progression bins for which a failure to isolate the containment occurs. These sequences are dominated by failure-to-close of large containment isolation valves. The frequency per year for these sequences is 3.465E-8/year and is determined by the frequency of Release Category 2 on Table 4.2-3.

Class 3 Sequences This group consists of all core damage accident progression bins for which a pre-existing leakage in the containment structure (e'g.,

containment liner) exists. The containment leakage for these sequences can be either small (2.OLa to 35La) or large (>35La). For 10-yr and 15-yr test intervals, there is a likelihood that corrosion related containment leakage may not be detected. Therefore, the baseline frequency for Class 3B sequences is increased by a factor of 1.011063 to account for undetected corrosion related containment leakage. See Appendix A for basis and supporting calculations. Note that this factor is based on a test interval increase from 3 years to 15 years, but was conservatively applied to both the 10-year and 15-year cases.

Page 32

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The respective frequencies per year (excluding corrosion related leakage) are determined as follows:

PROBciass_3a = probability of small pre-existing containment liner leakage

= 0.064 [see Section 4.3]

PROBciass_3b = probability of large pre-existing containment liner leakage

= 0.021 [see Section 4.3]

CLASS_3aFREQUENCY = 0.064

• 5.32E-7/year = 3.404E-8/year CLASS_3bFREQUENCY = 0.021

• 5.32E-7/year = 1.117E-8/year Class 4 Sequences This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type B test components occurs. However, as these failures are detected by Type B tests which are unaffected by changes in the Type A ILRT frequency, this group is not evaluated any further in the analysis.

Class 5 Sequences This group consists of all core damage accident progression bins for which a containment isolation failure-to-seal of Type C test components. However, as these failures are detected by Type C tests which are unaffected by changes in the Type A ILRT frequency, this group is not evaluated any further in this analysis.

Class 6 Sequences This group is similar to Class 2. These are sequences that involve core damage accident progression bins for which a failure-to-seal Page 33

Enclosure 1, Attachment 3 Risk Assessment-for ILRT (Type A) Extension containment leakage due to failure to isolate the containment occurs.

However, as these failures are unaffected by changes in the Type A ILRT frequency, this group is not evaluated any further in this analysis.

Class 7 Sequences This group consists of all core damage accident progression bins in which containment failure is induced by severe accident phenomena (e.g., direct containment heating, melt-through, overpressure). The baseline frequency per year for these sequences is 1.253E-5/year and is determined by the difference between the total core damage frequency and the sum of the other accident class frequencies on Table 4.2-3.

Class 8 Sequences This group consists of all core damage accident progression bins in which containment bypass occurs. The frequency per year for these sequences is 7.861 E-7/year and is determined by the sum of the frequencies for Steam Generator Tube Rupture and Intersystem LOCA accident classes as shown on Table 4.2-3.

Summary of Accident Class Frequencies In summary, the accident sequence frequencies that can lead to radionuclide release to the public have been derived consistent with the definition of Accident Classes defined in EPRI-TR-104285. Table 5-2 summarizes these accident frequencies by Accident Class.

Page 34

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 5-2 EPRI ACCIDENT CLASS FREQUENCIES EPRI EPRI Accident Class Accident Frequency Contribution Class Description (per year) to CDF (%)

1 No Containment Failure 4.867E-07 3.51%

Large Isolation Failures (Fail to Close) 3.465E-08 0.25%

3A Small Isolation Failures (Liner Breach) 3.404E-08 0.25%

3B Large Isolation Failures (Liner Breach) 1.117E-08 0.08%

Small Isolation Failures (Fail to Seal - Type B) 0.OOE+00 0.00%

Small Isolation Failures (Fail to Seal - Type C) 0.00E+00 0.00%

Other Isolation Failures (e.g., dependent failures) 0.OOE+00 0.00%

Failures induced by Phenomena (early and late) 1.253E-05 90.25%

8 Bypass (Interfacing Systems LOCA) 7.861 E-07 5.66%

Total 1.388E-05 100.00%

5.2 STEP 2 - DEVELOP CLASS 3 POPULATION DOSE PER REACTOR YEAR The development of consequence measures (population doses) for all EPRI accident classes except Class 3 was presented in Section 4.2 above.

As described in Section 5.1 above, Class 3 is further divided for this analysis into Class 3a and Class 3b due to their different consequences in terms of containment leakage. For this analysis, the associated containment leakage for Class 3a is 10La and for Class 3b Page 35

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension is 35La. These assignments are consistent with the Indian Point 3 ILRT submittal [14] which was approved by the NRC [21].

Class 1 is considered to cover only containment leakage for the assumed intact containment at the leakage limit of 1La. Therefore, the population doses applied to the Class 3a and Class 3b sequences is determined as follows:

Class 3a = 8.97E+01 person-rem x 10La = 8.97E+02 person-rem Class 3b = 8.97E+01 person-rem x 35La = 3.14E+03 person-rem The population dose estimates derived for use in the risk evaluation for all EPRI accident classes are summarized in Table 5-3.

Table 5-3 POPULATION DOSE ESTIMATES FOR ENTIRE REGION SURROUNDING. PALO VERDE Accident Classes (Containment Person-Rem Release Type) Description (Entire Region) 1 No Containment Failure 8.97E+01 2 Large Isolation Failures (Failure to Close) 4.07E+06 3a Small Isolation Failures (liner breach) 8.97E+02 3b Large Isolation Failures (liner breach) 3.14E+03 Small Isolation Failures (Failure to seal-Type 4 B) 0 Small Isolation Failures (Failure to seal-Type 5 C) 0 Other Isolation Failures (e.g., dependent 6 failures) 0 7 Failures Induced by Phenomena 2.16E+06 8 Bypass (SGTR, Interfacing System LOCA) 1.24E+07 Page 36

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The above results, when combined with the results presented in Table 5-2, yield the baseline mean consequence measures for each accident class. These results are presented in Table 5-4.

Table 5-4 ANNUAL DOSE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED 3/10 YEARS (I.E., REPRESENTATIVE OF ILRT DATA)

EPRI Accident Population Dose EPRI Class Population Dose Rate for Entire Accident Frequency for Entire Region Region (person-Class Description (per year) (person-rem) rem/yr) 1 No Containment Failure 4.867E-07 8.97E+01 4.368E-05 2 Large Isolation Failures 4.07E+06 (Fail to Close) 3.465E-08 1.412E-01 3a Small (Liner Isolation Breach) Failures 3.404E-08 3.055E-05 3b Large Isolation Failures 3.14E+03 (Liner Breach) 1.117E-08 3.509E-05 Small Isolation Failures (Fail to Seal - Type B) O.OOE+00 O.OOE+00 Small Isolation Failures (Fail to Seal - Type C) 0.OOE+00 O.OOOE+00 Other Isolation Failures 6 (e.g., dependent 0 failures) 0.OOE+00 0.OOOE+00 Failures induced by 7 Phenomena (early and 2.16E+06 late) 1.253E-05 2.709E+01 8 Bypass Systems(Interfacing LOCA) 7.861 E-07 1.24E+07 9.733E+00 Total 1.388E-05 36.9683 Page 37

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The total dose per year is compared with the other sites as shown below:

Annual Dose Plant (Person-Rem/yr) Reference Indian Point 3 14.515 14 Peach Bottom 6.2 15 Crystal River 1.4 16 Palo Verde 1 36.9683 Table 5-4 Note that the above calculated annual dose values per year for Palo Verde are the baseline values for this risk assessment (ILRTs performed at current frequency).

Based on the risk values from Table 5-4, the percent risk contribution (%RiskBASE) for Class 3 (i.e., the Class affected by the ILRT interval change) is as follows:

%RiskBASE = [(CLASS3aBASE + CLASS 3 bBASE)/ TotalBASE] X 100 CLASS3aBASE= Class 3a person-rem/year =3.055E-05 person-rem/year

[Table 5-4]

CLASS3bBASE= Class 3b person-rem/year =3.509E-05 person-rem/year

[Table 5-4]

TOTALBASE = Total person-rem/yr for baseline interval

= 36.9683 person-rem/yr [Table 5-4]

%RiskBASE = [(3.055-05 + 3.509E-5)/36.9683] x 100

%RiSkBASE = 0.0002%

5.3 STEP 3 -EVALUATE RISK IMPACT OF EXTENDING TYPE A TEST INTERVAL FROM 10-TO-15 YEARS According to NUREG-1 493 [4], relaxing the Type A ILRT interval from 3-in-10 years to 1-in-1 0-years will increase the average time that a leak (detectable only by an ILRT) goes undetected from 1.5 years to 5 years. The average time for failure to detect is calculated using the approximation 1/2 AT where T is the Test Page 38

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension interval and A,the leakage failure rate, is (3%)/1.5 year. If the test interval is extended to 1 in 15 years, the average time that a leak detectable only by an ILRT test goes undetected increases to 7.5 years (1/2

• 15 years.). Because ILRTs only detect about 3% of leaks (the rest are identified during LLRTs), the result for a 10-yr ILRT interval is a 10% undetectable rate in the overall probability of leakage 2 *

(3% /1.5 years)

• 10 years.

This value is determined by multiplying 3% and the ratio of the average time for non-detection for the increased ILRT test interval to the-baseline average time for non-detection. For a 15-yr-test interval, the result is a 15% overall probability of leakage (i.e., Y2 * (3% /1.5 yrs)

• 15 years). Thus, increasing the ILRT test interval from 10 years to 15 years translates into a 5% increase in the overall leakage probability.

Risk Impact due to 10-year Test Interval As previously stated, Type A tests impact only Class 3 sequences. For Class 3 sequences, the release magnitude is not impacted by the change in test interval, (a small or large breach remains the same, even though the probability of not detecting the breach increases). Thus, only the frequency of Class 3 sequences is impacted. Therefore, for Class 3 sequences, the risk contribution is determined by multiplying the Class 3 accident frequency by the increase in probability of leakage of 1.1 (7% which is approximated here as a factor of 1.1 consistent with the approach used by Indian Point 3 [14] ). Specifically, there is a factor of 1.1 increase in the Class 3a and 3b frequencies relative to the baseline associated with increasing the ILRT test interval from 3 yrs to 10 yrs. (See Section 4.4)

Risk Impact of Corrosion-Related Leakage On Increase to 15-year Test Interval Increasing the test interval from 3 to 15 years may reduce the chance of detecting corrosion related leakage. The likelihood of not detecting corrosion related leakage Page 39

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension due to increased test interval from 3 to 15 years is calculated to be 1.1063%.

Details of this calculation are provided in Appendix A. Consistent with the Kewaunee ILRT Extension submittal, the calculation assumes factors determining increased undetected containment leakage from areas both potentially in contact with foreign materials (in contact with concrete) and areas not potentially in contact with foreign materials are exposed to corrosion. The increased likelihood of corrosion related leakage is assumed to increase LERF frequency contributions from phenomena-related accident sequences (EPRI Class 7) by a factor of 1.011063. This factor is conservatively applied to both the 10-year and 15-year test interval calculations.

The results of the 10 year test interval calculation are presented in Table 5-5.

Based on the Table 5-5 values, the Type A 10-year test frequency percent risk contribution (%Riskio) for Class 3 is as follows:

(%Riskio)= [(CLASS3aiO + CLASS3bjO) / Total1o] x 100 Where:

CLASS 3a 10 = Class 3a person-rem/year = 3.36E-5 person-rem/yr [Table 5-5]

CLASS 3b 10 = Class 3b person-rem/year = 3.90E-5 person-rem/yr [Table 5-5]

TOTAL1 0 = Total person-rem/yr for 10-year interval = 36.9683 person-rem/yr

[Table 5-5]

%Risk 10 = [(3.36E-5+ 3.90E-5) / 36.9683] x 100

% Risk1o = 0.0002%

Therefore, the Total Type A 10-year ILRT interval risk contribution of leakage, represented by Class 3 accident scenarios is 0.0002%.

Page 40

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The percent risk increase (A%Risklo) due to a ten-year ILRT over the baseline case is as follows:

A%Riskjo = [(Total1o - TotalBAsE) / TotalBASE] X 100.0 TOTALBASE = Total person-rem/yr for baseline interval = 36.968264 person-rem/yr [Table 5-4]

TOTAL 10 = Total person-rem/yr for 10 yr ILRT interval = 36.968270 person-rem/yr [Table 5-5]

A%Risklo = [(36.968270 - 36.968264) / 36.968264] x 100.0 A%Risk1o = 0.00002%

Therefore, the increase in risk contribution because of the change to the already approved ten-year ILRT test frequency from three-in-ten years to 1-in-ten-years is 0.00002%.

Page 41

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 5-5 ANNUAL DOSE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED EVERY 10 YEARS EPRI Accident Population Population EPRI Class Dose for Dose Rate for Acciden Frequency Entire Region Entire Region t Class (per year) (person-rem) (person-rem/yr)

Description 1 No Containment Failure 4.82E-07 8.97E+01 4.326E-05 2 Large Isolation Failures 4.07E+06 (Fail to Close) 3.47E-08 1.412E-01 3a Small Isolation Failures 8.97E+02 (Liner Breach) 3.74E-08 3.361 E-05 3b Large Isolation Failures 3.14E+03 (Liner Breach) 1.24E-08 3.902E-05 Small Isolation Failures (Fail to Seal - Type B) O.OOE+00 O.OOOE+00 Small Isolation Failures (Fail to Seal - Type C) 0.OOE+00 O.OOOE+00 6 Other Isolation Failures (e.g., dependent failures) O.OOE+00 O.OOOE+00 Failures induced by 7 Phenomena (early and 2.16E+06 late) 1.25E-05 2.709E+01 8 Bypass (Interfacing 1.24E+07 Systems LOCA) 7.86E-07 9.733E+00 Total I1.39E-05 36.9683 Risk Impact Due to 15-Year Test Interval The risk contribution for a 15-year interval is calculated in a manner similar to the 10-year interval. The difference is in the increase in probability of leakage in Classes 3a and 3b. For this case, the value used in the analysis is 15 percent or 1.15 consistent with previously approved method [14, 21]. Specifically, there is an increase in Class 3a and 3b frequencies by a factor of 1.15 relative to the Page 42

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension baseline associated with increasing the ILRT test interval from 3 yrs to 15 yrs.

(See Section 4.4) The results for this calculation are presented in Table 5-6.

Based on the values from Table 5-6, the Type A 15-year test frequency percent risk contribution (%Risk 1 5) for Class 3 is as follows:

(%Risk 1 5)= [(CLASS3a 15 + CLASS3b 15) / Total1 5] x 100 Where:

CLASS 3a 1 5 = Class 3a person-rem/year = 3.51 E-5 person-rem/yr [Table 5-6]

CLASS 3b 15 = Class 3b person-rem/year = 4.08E-5 person-rem/yr [Table 5-6]

TOTAL1 5 = Total person-rem/yr for 10-year interval = 36.9685 person-rem/yr

[Table 5-6]

%Risk 15 = [(3.51E-5 +4.08E-5) / 36.9683] x 100

% Risk1 5 = 0.0002%

Therefore, the Total Type A 15-year ILRT interval risk contribution of leakage, represented by Class 3 accident scenarios is 0.0002%.

The percent risk increase (A%Riskl5) due to a 15-year ILRT over the baseline case is as follows:

A%Risk15 = [(Total1 5 - TotalBASE) / TotalBASE] X 100.0 TOTALBASE = Total person-rem/yr for baseline interval = 36.968264 person-rem/yr [Table 5-4]

TOTAL15 = Total person-rem/yr for 10 yr ILRT interval = 36.968273 person-rem/yr [Table 5-6]

A%Riskl 5 = [(36.968273 - 36.968264) / 36.968264] x 100.0 A%Risk1 5 = 0.00003%

Page 43

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Therefore, the total increase in risk contribution associated with relaxing the ILRT test frequency from three-in-ten-years to one-per-fifteen years is 0.00003%.

The percent increase on the total integrated plant risk when the ILRT is extended from 10 years to 15 years is computed as follows:

%TOTAL 10 _15 = [(TOTAL 15 - TOTAL 1o)/TOTAL 1o] x 100 TOTAL10 = Total person-rem/year for 10-year interval

- 36.968270 person-rem/year [Table 5-5]

TOTAL 15 = Total person-rem/year for 15-year interval

- 36.968273 person-rem/year [Table 5-6]

%TOTAL 10_15 = [(36.968273 - 36.968270) / 36.968270] x 100

%TOTAL1 0 _15 = 0.00001%

Therefore, the impact on the total plant risk for these accident sequences, as influenced by Type A testing, is 0.00001% when going from a 10-year ILRT interval to a 15-year interval.

Page 44

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 5-6 ANNUAL DOSE RATE (PERSON-REM/YR) AS.A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED EVERY 15 YEARS Population Population EPRI Dose for Dose Rate Accident Entire for Entire EPRI Class Region Region Acciden Frequency (person- (person-t Class (per year) rem) rem/yr)

Description 1 No Containment Failure 4.80E-07 8.97E+01 4.306E-05 2 Large Isolation Failures 4.07E+06 (Fail to Close) 3.47E-08 1.412E-01 3a Small Isolation Failures 897E+02 (Liner Breach) 3.91 E-08 3.513E-05 3b Large Isolation Failures 3.14E+03 (Liner Breach) i .30E-08 3.14E+03 4.079E-05 Small Isolation Failures (Fail to Seal - Type B) O.OOE+00 O.OOOE+00 Small Isolation Failures (Fail to Seal - Type C) O.OOE+00 O.OOOE+00 6 Other Isolation Failures (e.g., dependent failures) O.OOE+00 O.000E+00 Failures induced by 7 Phenomena (early and 2.16E+06 late) 1.25E-05 2.709E+01 8 Bypass (Interfacing 1.24E+07 Systems LOCA) 7.86E-07 9.733E+00 Total 1.39E-05 1 36.9683 5.4 STEP 4 - DETERMINE THE CHANGE IN RISK IN TERMS OF LARGE EARLY RELEASE FREQUENCY (LERF)

The risk increase associated with extending the ILRT interval involves the potential that a core damage event that normally would result in only a small radioactive release from an intact containment could in fact result in a larger release due to the increase in probability of failure to detect a pre-existing leak.

Page 45

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Class 3b is treated in this analysis as a potential LERF contributor. Class 3a is not treated as a "large" release. Therefore, for this evaluation, only Class 3b sequences have the potential to result in large releases if a pre-existing leak were present. Class 1 sequences are not considered as potential large release pathways because the containment remains intact. Therefore, the containment leak rate is expected to be small. Other accident classes such as 2, 6, 7, and 8 could result in large releases, but these are not affected by the change in ILRT interval. Late releases are excluded regardless of the size of the leak because late releases are, by definition, not part of LERF.

Reg. Guide 1.174[3] provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.174 defines very small changes in risk as resulting in increases of core damage frequency (CDF) below 10-6/yr and increases in LERF below 10-7/yr. Because the ILRT does not impact CDF, the relevant metric is LERF. Calculating the increase in LERF requires determining the impact of the ILRT interval on the leakage probability.

Baseline (3 Yr Test Interval) LERF From the Rev. 14 PRA results, the baseline LERF frequency is:

LERFPRA = 8.65E-07/year LERFBASE = 8.65E-07/year Page 46

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension LERF for 10-Yr Test Interval The LERF increase (ALERF1O.BASE) due to a 10-year ILRT over the baseline is as follows:

ALERF1o-BASE = CLASS3bjo - CLASS3bBASE The LERF (LERFlo) due to a 10-year ILRT is calculated as follows LERF1o = LERFBASE + ALERFIo-BASE CLASS3b1 o = 1.24E-08/year [Table 5-5]

CLASS3bBASE = 1.12E-08/year [Table 5-4]

ALERFlo.BASE = 1.24E-08/year - 1 .12E-08/year = 1.20E-09/yr LERF1 o = 8.65E-07/year + 1.20E-08/year = 8.66E-07/year LERF for 15-Yr Test Interval The LERF increase (ALERF15-BASE) due to a 15-year ILRT over the baseline is as follows:

ALERF15-BASE = CLASS3b 15 - CLASS3bBASE The LERF (LERF 15 ) due to a 15-year ILRT is calculated as follows LERF 15 = LERFBASE + ALERF15-BASE CLASS3b 15 = 1.30E-08/year [Table 5-6]

CLASS3bBASE = 1.12E-08/year [Table 5-4]

ALERF15-BASE = 1.30E-08/year - 1 .12E-08/year = 1.82E-09/year LERF 15 = 8.65E-07/year + 1.82E-09/yr = 8.67E-07/year Page 47

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The LERF increase (ALERF 15 .10) due to a 15-year ILRT over the 10-yr ILRT is as follows:

ALERF 15 10 = CLASS3b 15 - CLASS3b1 0 CLASS3b1 5 = 1.30E-08/year [Table 5-6]

CLASS3b1 0 = 1.24E-08/year [Table 5-5]

ALERF 151 0 = 1.30E-08/year - 1.24E-08/year = 5.65E-1 0/year It should be noted that the calculated changes in LERF for all cases are well below the 1.OE-7/yr screening criterion in Reg. Guide 1.174 and represent a very small change in risk.

5.5 IMPACT ON THE CONDITIONAL CONTAINMENT FAILURE PROBABILITY (CCFP)

Another parameter that the NRC Guidance Reg. Guide 1.174 states can provide input into the decision-making process is the consideration of change in the conditional containment failure probability (CCFP). The change in CCFP is indicative of the effect of the ILRT on all radionuclide releases, not just LERF.

The conditional containment failure probability (CCFP) is calculated from the risk calculations performed in this analysis. The CCFP is "conditional" in that it identifies the probability of containment failure given that a severe accident (i.e.,

core damage) has occurred. Containment failure in this context includes all radionuclide release end states other than the intact state that do not involve containment bypass. Generally, this means non-bypass, non-Class 1 sequences.

Since the only classes that are increasing are Classes 3a and 3b, the change in CCFP can be calculated by the difference in these classes.

The percent increase in CCFP (A%CCFPBASE-1o) due to a 10-year ILRT over the baseline is as follows:

Page 48

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension A%CCFPBASE-10 =

[((FCLASS 3a_,0 + FCLASS 3b-0) - (FcLASS 3aBASE +FCLASS3b_BASE)) /CDF] x 100

= [((3.74E-08 + 1.24E-08)- (3.40E-08 + 1.12E-08))/ 1.39E-05] x 100

= 0.034%

The percent increase in CCFP increase (A%CCFPBASE-15) due to a 15-year ILRT over the baseline is as follows:

A%CCFPBASE-15 =

[((FcLASS 3a_15 + FCLASS 3b_15) - (FCLASS 3aBASE +FcLASS3bBASE)) /CDF] x 100

= [((3.91E-08 + 1.30E-08)- (3.40E-08 + 1.12E-08))/ 1.39E-05] x 100

= 0.050%

The percent increase in CCFP increase (A%CCFP 15-10) due to a 15-year ILRT over the 10-year ILRT is as follows:

A%CCFP 15 .10 =

[((FCLASS 3a_15 + FCLASS 3b_15) - (FCLASS 3a_10 + FCLASS 3blo)) /CDF] x 100

= [((3.91 E-08 + 1.30E-08) - (3.74E-08 + 1.24E-08))/ 1.39E-05] x 100

= 0.016%

This change in CCFP of less than 1% is judged to be insignificant and reflects sufficient defense-in-depth.

5.6 RESULTS

SUMMARY

The following is a brief summary of some of the key aspects of the ILRT test interval extension risk analysis (using EPRI TR-1 04285 methodology):

1. The baseline risk contribution (person-rem/yr) associated with containment leakage affected by the ILRT and represented by Class 3 accident scenarios is 0.0002% of the total risk.

Page 49

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

2. When the ILRT interval is 10 years, the risk contribution of leakage (person-rem/yr) represented by Class 3 accident scenarios is increased insignificantly (contribution is 0.0002%0of the total risk).

3. The total integrated increase in risk contribution from reducing the ILRT test frequency from 3-per-1 0-year (baseline) frequency to once-per-1 0 years is near zero (0.00002%).

4. When the ILRT interval is 15 years, the risk contribution of leakage (person-rem/yr) represented by Class 3 accident scenarios is increased insignificantly (contribution is 0.0002% of the total risk).

5. The total integrated increase in risk contribution from reducing the ILRT test frequency from 3-per-1 0-year (baseline) frequency to once-per-15 years is near zero (0.00003%).

6. The total integrated increase in risk contribution from reducing the ILRT test frequency from the once-per-1 0-year frequency to once-per-1 5 years is near zero (0.00001 %).

7. There is no change in the at-power CDF associated with the ILRT extension. Therefore, this is within the Reg. Guide 1.174 acceptance guidelines.

8. The risk increase in LERF from the original 3-in-1 0 years test frequency to once-per-1 0 years is 1.25E-09/yr. This is considered to be "very small" using the acceptance guidelines in Reg. Guide 1.174.

9. The risk increase in LERF from the original 3-in-1 0 years test frequency to once-per-1 5 years is 1.82E-09/yr. This is also considered to be "very small" using the acceptance guidelines in Reg. Guide 1.174.

Page 50

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

10. The risk increase in LERF from reducing the ILRT test frequency from once-per-10 years to one-per-15 years is 5.65E-10/yr. This is determined to be a very small increase using the acceptance guidelines of Reg. Guide 1.174.

11. The change in CCFP of less than 1% (when reducing test frequency to either once-per-1 0 or to once-per-1 5 years) is judged to be insignificant and reflects sufficient defense-in-depth.

Other significant results are summarized in Table 5-7.

ble 5-7

SUMMARY

OF RISK IMPACT OF TYPE A ILRT TEST FREQUENCIES Risk Risk Impact Impact Risk Impact Risk Metric (Baseline) (10-years) (15-years) 0.0002% of 0.0002% of total tota 1 0.0002% of total Class 3a and 3b integrated integrated Cas value value integrated value Risk Contribution 6.56E-5 7.26E-5 7.59E-5 person-person- person- rem/yr rem/yr rem/yr Total Integrated 36.968264 36.968270 36.968273 Risk person- person-rem/year rem/year person-rem/year Percent Increase Intreate inis N/A 0.00002% 0.00003%

Integrated Risk over Baseline Increase in LERF over N/A 1.25E-09/yr 1.82E-09/yr Baseline Percent Increase in N/A 0.034% 0.050%

CCFP over Baseline Page 51

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 6 APPLICATION OF NEI INTERIM GUIDANCE METHODOLOGY 6.1

SUMMARY

OF METHODOLOGY The results of the risk assessment performed using the methodology of EPRI TR-104285 [2] was provided in Section 5 of this document. In 2001, NEI recognized a need to update this methodology to support future risk-informed ILRT interval extension submittals. The methodology update was focused in three particular areas:

1. The methodology for determining the overall probability of leakage resulting from extending surveillance intervals was revised. For an ILRT interval extension from 3 in 10 years to 1 in 10 years for example, the overall 10-year dose should have been calculated using an increased probability of an undetected leak (a leak detectable only by an ILRT that goes undetected due to the increased test interval) of 333.3% (increased by a factor of 3.33), as opposed to the 10% value used in the EPRI TR-104285 methodology.

However, NEI also showed this methodology change to have only a very small incremental risk contribution, since ILRTs only address a very small portion of the severe accident risk.

2. The methodology used to determine the frequencies of leakages detectable only by ILRTs (EPRI Classes 3a and 3b) was revised. Updated ILRT failure data was incorporated into the calculation of these containment failure classes.

The Guidance recommended use of a mean frequency calculation for the Class 3a distribution, and recommended the use of a Jeffery's non-informative prior distribution for the Class 3b distribution. The impact of this methodology change was to increase the probability of Class 3b releases. However, it was Page 52

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension noted that no observed failure to date was even close in size to that necessary to cause a large release.

3. The updated guidance included provisions for utilizing NUREG-1 150 dose calculations, a necessary improvement to make the methodology usable for plants that do not have a Level-3 PRA.

Other improvements in the methodology include use of a simplified risk model (as opposed to the Containment Event Tree model used in EPRI TR-1 04285) to distinguish between those accident sequences that are affected by the status of the containment isolation system versus those that are a direct function of severe accident phenomena, and evaluation of the change in large early release frequency (LERF) by manipulating the probability of a pre-existing leak (for either Class 3a and 3b end states) of sufficient leak size to produce a large, early release.

6.2 ANALYSIS APPROACH This section presents the steps involved in performing the ILRT extension risk assessment based on the methodology of the 2001 NEI Interim Guidance.

The nine analysis steps identified in the NEI Interim Guidance are:

1. Quantify the base line (nominal three year ILRT interval) risk in terms of frequency per reactor year for the EPRI accident classes of interest. Note that Classes 4, 5, and 6 are not affected by changes in ILRT test frequency. Therefore, these classes are not considered in this assessment methodology.

2. Determine the containment leakage rates for applicable cases, 3a and 3b.

3. Develop the baseline population dose (person-rem, from the plant IPE, or calculated based on leakage) for the applicable accident classes.

Page 53

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

4. Determine the population dose rate (person-rem/year) by multiplying the dose calculated in step (3) by the associated frequency calculated in step (1).

5. Determine the change in probability of leakage detectable only by ILRT, and associated frequency for the new surveillance intervals of interest.

Note that with increases in the ILRT surveillance interval, the size of the postulated leak path and the associated leakage rate are assumed not to change, however the probability of leakage detectable only by ILRT does increase.

6. Determine the population dose rate for the new surveillance intervals of interest.

7. Evaluate the risk impact (in terms of population dose rate and percentile change in population dose rate) for the interval extension cases.

8. Evaluate the risk impact in terms of LERF.

9. Evaluate the change in conditional containment failure probability.

Each of these steps is described in detail below. Note that this methodology builds upon the methodology of EPRI TR-1 04285. Therefore, most of the plant specific information necessary to perform the assessment using this methodology was presented in Sections 4 and 5 above (reference is made as necessary to the appropriate section in Section 4 or 5 for the development of the common information).

Step 1) Quantify the base-line (nominal three year ILRT interval) risk in terms of frequency per reactor year for the EPRI accident classes of interest.

The baseline EPRI accident class frequencies used in the NEI methodology case are unchanged from those calculated in Sections 4 and 5 above, with the exceptions of the frequencies for EPRI categories 1 (No Page 54

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Containment Failure) and 3a (Small Containment Isolation Failures due to Liner Breach) and 3b (Large Containment Isolation Failures dueto Liner Breach). As described above, the frequencies of leakages detectable only by ILRTs (EPRI Classes 3a and 3b) was revised. The NEI Interim Guidance included the results of additional, updated ILRT failure data (38 more industry tests conducted since 1/1/1995). Adding these to the NUREG-1493 data (144 ILRTs) resulted in a total population of 182 tests.

One more failure was added (due to construction debris from a penetration modification), resulting in a total of 5 failures over these 182 tests. The Guidance recommended use of a mean frequency (5/182 = 0.027) for the Class 3a distribution, and recommended the use of a Jeffery's non-informative prior distribution for the Class 3b distribution:

Failure Probability 3b= (Number of Failures + 1/2) / (Number of Tests +1)

= (0 + 1/2)/(182 +-1)

= 0.0027 Using these values, the calculation of the baseline Class 3a and 3b distributions was performed as follows:

CLASS_3aFREQUENCY = 0.027

• 5.32E-7/year = 1.44E-8/year CLASS_3bFREQUENCY = 0.0027

• 5.32E-7/year = 1.46E-9/year In order to maintain the sum of the frequencies of the accident classes equal to the CDF, the NEI Interim Guidance specifies that the Class 1 frequency be adjusted for the Class 3 sequences. The baseline Class 1 frequency was determined as follows:

CLASSIFREQUENCY

= (PRA-quantified Class 1) - (Class 3a + Class 3b)

Page 55

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

= 5.32E-7/yr - (1.44E-8+ 1.46E-9)/yr

= 5.16E-7/year Table 6-1 below provides the Palo Verde accident class frequencies that were used in the application of the NEI Interim Guidance methodology.

Table 6-1 EPRI ACCIDENT CLASS FREQUENCIES (Calculations Based on NEI Interim Guidance)

EPRI Accident EPRI -Class Accident Frequency Contribution Class Description (per year) to CDF (%)

1 No Containment Failure 5.16E-07 3.72%

2 Large Isolation Failures (Fail to Close) 3.47E-08 0.25%

3A Small Isolation Failures (Liner 3A Breach) 1.44E-08 0.10%

Large Isolation Failures (Liner 3B Breach) 1.46E-09 0.01%

4 Small Isolation Failures (Fail to Seal - Type B) 0.OOE+00 0.00%

Small Isolation Failures (Fail to Seal - Type C) 0.00E+00 0.00%

Other Isolation Failures (e.g.,

6 dependent failures) 0.OOE+00 0.00%

Failures. induced by Phenomena (early and late) 1.25E-05 90.25%

8 Bypass (Interfacing Systems LOCA) 7.86E-07 5.67%

Total 1.39E-05 100.0 Step 2) Determine the containment leakage rates for applicable cases, 3a and 3b.

Step 3) Develop the baseline population dose (person-rem, from the plant IPE, or calculated based on leakage) for the applicable accident classes.

Page 56

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Step 4): Determine the population dose rate (person-rem/year) by multiplying the dose calculated in step (3) by the associated frequency calculated in step (1).

Each of the calculations necessary for these steps were performed exactly as presented in Section 5.2 above. The resulting population dose rates for all accident classes are identical to that presented in Section 5.2, with the exception of Classes 1, 3a and 3b (the accident sequence frequencies of which were modified per the NEI guidance as described in Step 1 above).

Table 6-2 provides the baseline results for the population dose rates by accident class.

Page 57

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 6-2 ANNUAL DOSE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED 3/10 YEARS (Calculations Based on NEI Interim Guidance Methodology)

Population Dose Rate EPRI Accident Population for Entire EPRI Class Dose for Region Accident Frequency Entire Region (person-Class Description (per year) (person-rem) rem/yr) 1 No Containment Failure 5.16E-07 8.97E+01 4.632E-05 2 Large Isolation Failures (Fail to Close) 4.07E+06 3.47E-08 1.412E-01 3a Small Isolation Failures 8.97E+02 (Liner Breach) 1.44E-08 1.289E-05 3b Large Isolation Failures 3.14E+03 (Liner Breach) 1.46E-09 4.590E-06 4 Small Isolation Failures (Fail 0 to Seal - Type B) O.OOE+00 O.OOOE+00 5 Small Isolation Failures (Fail 0 to Seal - Type C) O.OOE+00 O.OOOE+00 6 Other Isolation failures)

(e.g., dependentFailures O.OOE+00 O.OOOE+00 7 Failures induced by 2.16E+06 Phenomena (early and late) 1.25E-05 2.709E+01 8 Bypass Systems(Interfacing LOCA) 7.86E-07 1.24E+07 9.733E+00 Total 17.39E-05 36.9682 The calculation of the baseline risk contribution from Class 3 (i.e., the Class affected by the ILRT interval change) was also done consistent with the method presented in Section 5.2. Based on the risk values from Table 6-2, the percent risk contribution (%RiskBASE) for Class 3 is as follows:

3

%RiskBASE = [(CLASS3aBASE + CLASS bBASE)/ TotalBASE] X 100 Page 58

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension CLASS3aBASE= Class 3a person-rem/year = 1.29E-05 person-rem/year

[Table 6-2]

CLASS3bBASE= Class 3b person-rem/year = 4.59E-06 person-rem/year

[Table 6-2]

TOTALBASE = Total person-rem/yr for baseline interval

= 36.9682 person-rem/yr [Table 6-2]

%RiskBASE = [(1.29E-05 + 4.59E-06)/36.9682] x 100

%RiskBASE = 0.000047%

Step 5) Determine the change in probability of leakage detectable only by ILRT, and associated frequency for the new surveillance intervals of interest.

Note that with increases in the ILRT surveillance interval, the size of the postulated leak path and the associated leakage rate are assumed not to change, however the probability of leakage detectable only by ILRT does increase.

Step 6) Determine the population dose rate for the new surveillance intervals of interest.

Step 7) Evaluate the risk impact (in terms of population dose rate and percentile change in population dose rate) for the interval extension cases.

The increase in the Class 3 leakage frequencies for the surveillance intervals of interest (10 years and 15 years) were computed using the same methodology used in Section 5.3 above, except that the overall 10-year dose was calculated using an increased probability of an undetected leak of 333.3% (increased by a factor of 3.33), as opposed to the 10%

value (factor of 1.1) used in the EPRI TR-105189 methodology. Likewise, the overall 15-year dose was calculated using an increased probability of an undetected leak of 500% (increased by a factor of 5.0). As described in Page 59

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension the NEI Interim Guidance, increasing the test interval from 3 in 10 years to 1 in 10 years increases the average time that a leak (detectable only by an ILRT) goes undetected from 18 (3yrs/2) to 60 (10 yrs/2) months. This is a factor of 60/18=3.333. By the same logic, increasing the test interval from 3 in 10 years to 1 in 15 years increases the average time that a leak goes undetected from 18 (3yrs/2) to 90 (15 yrs/2) months, a factor of 90/18 =

5.0.

The increase in Class 7 frequency due to undetected corrosion-related leakage, calculated in Attachment A, was included in the calculation as described in Section 5.3 above.

Tables 6-3 and 6-4 provide the results of the population dose rate calculations for the cases where the ILRT interval is extended to 10 years and 15 years, respectively.

Based on the risk values from Tables 6-3 and 6-4, the percent risk contribution for Class 3 over the two proposed ILRT extension intervals

(%Riskjo and %Risk 15 ) was calculated as follows:

CLASS3ajO = Class 3a person-rem/year = 4.30E-5 person-rem/year

[Table 6-3]

CLASS 3b 10 = Class 3b person-rem/year = 1.55E-5 person-rem/year

[Table 6-3]

CLASS3a1 5 = Class 3a person-rem/year = 6.44E-5 person-rem/year

[Table 6-4]

CLASS 3b 1 5 = Class 3b person-rem/year = 2.32E-5 person-rem/year

[Table 6-4]

Page 60

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension TOTAL 10 = Total person-rem/yr for 10-year interval = 36.9683 person-rem/yr [Table 6-3]

TOTAL15 = Total person-rem/yr for 15-year interval = 36.9683 person-rem/yr [Table 6-4]

%Risk 1 o = [(4.30E-5 + 1.55E-5)/36.9683] x 100

%Risk 1o = 0.0002%

%Risk 1 5 = [(6.44E-5 + 2.32E-5) / 36.9683] x 100

%Risk 15 = 0.0002%

Therefore, the Total Type A 10-year ILRT interval risk contribution of leakage, represented by Class 3 accident scenarios is 0.0002% for the ILRT interval extension to 1 in 10 years, and 0.0002% for the ILRT interval extension to 1 in 15 years.

The percent risk increase (A%Risk) for each ILRT extension case over the baseline case is as follows:

A%Risk 1o = [(Total 1o - TotalBASE) / TotalBASE] X 100.0 A%Risk 1 5 = [(Total 15 - TotalBASE) / TotalBASE] X 100.0 TOTALBASE = Total person-rem/yr for baseline interval = 36.9682 person-rem/yr [Table 6-2]

TOTAL1 0 = Total person-rem/yr for 10 yr ILRT interval = 36.9683 person-rem/yr [Table 6-3]

TOTAL1 5 = Total person-rem/yr for 15 yr ILRT interval = 36.9683 person-rem/yr [Table 6-4]

A%Risk 1o = [(36.9683 - 36.9682) 36.9682] x 100.0 A%Risk1o = 0.0001%

Page 61

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension A%Risk 1 5 = [(36.9683 - 36.9682) / 36.9682] x 100.0 A%Risk 15 = 0.0002%

Therefore, the increase in risk contribution from the change to the already approved ten-year ILRT test interval from three-in-ten years to 1-in-ten-years is 0.0001%, while the increase in risk from the change to a 1-in-15 year test interval is 0.0002%.

Page 62

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 6-3 ANNUAL DOSE RATE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED EVERY 10 YEARS (Calculations Based on NEI Interim Guidance)

Population Dose for Population EPRI Accident Entire Dose Rate for EPRI Class Region Entire Region Acciden Frequency (person- (person-t Class Description (per year) rem) rem/yr)

No Containment Failure 4.79E-07 4.300E-05 2 Large Isolation Failures (Fail to Close) 3.47E-08 4.07E+06 1.412E-01 Small Isolation 3a Failures (Liner 8.97E+02 Breach) 4.79E-08 4.296E-05 Large Isolation 3b Failures (Liner 3.14E+03 Breach) 4.92E-09 1.547E-05 Small Isolation 4 Failures (Fail to Seal - 0 Type B) 0.OOE+00 0.OOOE+00 Small Isolation 5 Failures (Fail to Seal - 0 Type C) 0.OOE+00 0.OOOE+00 Other Isolation 6 Failures (e.g., 0 dependent failures) 0.OOE+00 0.000E+00 Failures induced by 7 Phenomena (early and 2.16E+06 late) 1.25E-05 2.709E+01 8 Bypass Systems(Interfacing LOCA) 7.86E-07 1.24E+07 9.733E+00 Total 1.39E-05 36.9683 Page 63

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 6-4 ANNUAL DOSE RATE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED EVERY 15 YEARS (Calculations Based on NEI Interim Guidance)

EPRI Accident Population Population Dose EPRI Class Dose for Rate for Entire Acciden Frequency (per Entire Region Region (person-t Class Description year) (person-rem) rem/yr) 1 No Containment Failure 4.53E-07 8.97E+01 4.063E-05 2 Large Isolation Failures (Fail to Close) 3.47E-08 4.07E+06 1.412E-01 Small Isolation Failures (Liner Breach) 7.18E-08 8.97E+02 6.444E-05 3b Large Isolation Failures (Liner Breach) 7.39E-09 3.14E+03 2.320E-05 Small Isolation Failures (Fail to Seal - Type B) 0.00E+00 0 0.000E+00 Small Isolation Failures (Fail to Seal - Type C) 0.00E+00 0 0.000E+00 6 Other Isolation Failures (e.g., dependent failures) 0.OOE+00 0 0.OOOE+00 Failures induced by Phenomena (early and late) 1.25E-05 2.16E+06 2.709E+01 8 Bypass (Interfacing Systems LOCA) 7.86E-07 1.24E+07 9.733E+00 Total 1.39E-05 36.9683 Step 8) Evaluate the risk impact in terms of LERF.

Baseline (3 Yr Test Interval) LERF From the Rev. 14 PRA results, the baseline LERF frequency is:

LERFPRA = 8.65E-07/year LERFBASE = 8.65E-07/year Page 64

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension LERF for 10-Yr Test Interval The LERF increase (ALERF1O-BASE) due to a 10-year ILRT over the baseline is as follows:

ALERF1o-BASE = CLASS3blo - CLASS3bBASE The LERF (LERF 1o) due to a 10-year ILRT is calculated as follows LERF1o = LERFBASE + ALERF1l-BASE CLASS3bjo = 4.92E-091year [Table 6-5]

CLASS3bBASE = 1.46E-09/year [Table 6-4]

ALERFlo-BASE = 4.92E-09/year - 1.46E-09/year = 3.46E-09/yr LERF 1 0 = 8.65E-07/year + 3.46E-09/year = 8.68E-07/year LERF for 15-Yr Test Interval The LERF increase (ALERF15.BASE) due to a 15-year ILRT over the baseline is as follows:

ALERF15-BASE = CLASS3b 15 - CLASS3bBASE The LERF (LERF 15 ) due to a 15-year ILRT is calculated as follows LERF 15 = LERFBASE + ALERF15-BASE CLASS3b 15 = 7.39E-09/year [Table 6-6]

CLASS3bBASE = 1.46E-09/year [Table 6-4]

ALERF15-BASE = 7.39E-09/year - 1.46E-09/year = 5.93E-09/year LERF 15 = 8.65E-07/year + 5.93E-09/yr = 8.71 E-07/year Page 65

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The LERF increase (ALERF 15 _10) due to a 15-year ILRT over the 10-yr ILRT is as follows:

ALERF 15. 10 = CLASS3b 15 - CLASS3b1 0 CLASS3b 15 = 7.39E-09/year [Table 6-6]

CLASS3b1 0 = 4.9ýE-09/year [Table 6-5]

ALERF 15 10 = 7.39E-09/year - 4.92E-09/year = 2.46E-09/year The calculated changes in LERF for these cases are below the 1.OE-7/yr screening criterion in Reg. Guide 1.174. Also the calculated absolute LERF values for both units are well below 1.OE-5/yr (in fact, all are below 1.OE-6/yr, even for the 15-year test interval case), the above condition has been clearly demonstrated to be met.

Step 9) Evaluate the change in conditional containment failure probability The assessment of conditional containment failure probability (CCFP) for each of the cases (base, 10-year ILRT interval extension, 15-year ILRT interval extension) is performed in a similar manner to that shown in Section 5.5 above, except that the Class 3a contribution was subtracted (Class 1 had already been reduced by the Class 3 sequences). Consistent with NEI Interim Guidance methodology, Class 3b is the only end state in which containment failure is assumed.

Page 66

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension The CCFP calculation for the base case (CCFPBASE) is shown below [23]:

CCFPBASE = 1 - (Intact Containment FrequencyBAsE/Total CDF)

= {1 - (Class 1BASE + Class 3aBASE)/CDF}*100 CCFPBASE = {1 - (5.16E-07 + 1.44E-08)/ 1.39E-5}'100

= 96.18%

The CCFP calculation for the ILRT extension cases (CCFPjo and CCFP 15 )

is performed in a similar manner:

CCFPlo = 1 - (Intact Containment Frequencyo/Total CDF)

= {1 - (Class 110 + Class 3alo)/CDF}*1 00 CCFP 15 = 1 - (Intact Containment Frequency1 5/Total CDF)

= {1 - (Class 115 + Class 3al5)/CDF}*100 CCFPjO = {1 - (4.79E-07 + 4.79E-08)/ 1.39E-5}*100

= 96.20%

CCFP 15 = {1 - (4.53E-07 + 7.18E-08)/ 1.39E-5}*100

= 96.22%

The percent increase in CCFP (A%CCFPBASE-lO) due to a 10-year ILRT over the baseline is as follows:

Page 67

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension A%CCFP1O-BASE = CCFP1 o - CCFPBASE A%CCFP1O-BASE = 96.20% - 96.18%

= 0.02%

The percent increase in CCFP increase (A%CCFPBASE-15) due to a 15-year ILRT over the baseline is as follows:

A%CCFP15-BASE = CCFP 15 - CCFPBASE A%CCFP 15-BASE 96.22% - 96.18%

= 0.04%

The percent increase in CCFP increase (A%CCFP 15 .10 ) due to a 15-year ILRT over the 10-year ILRT is as follows:

A%CCFP 15 10 = CCFP 15 - CCFP 1 o A%CCFP 15-10 = 96.22% - 96.20%

= 0.02%

This change in CCFP of less than 1 % is judged to be insignificant and reflects sufficient defense-in-depth.

Page 68

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension 6.3 RESULTS

SUMMARY

The following is a brief summary of some of the key aspects of the ILRT test interval extension risk analysis (as calculated in Section 6 - NEI Interim Guidance Methodology):

1. The baseline risk contribution (person-rem/yr) associated with containment leakage affected by the ILRT and represented by Class 3 accident scenarios is 0.000047% of the total risk.

2. When the ILRT interval is 10 years, the risk contribution of leakage (person-rem/yr) represented by Class 3 accident scenarios is increased insignificantly (contribution is increased to 0.0002% of the total risk).

3. The total integrated increase in risk contribution from reducing the ILRT test frequency from 3-per-10-year (baseline) frequency to once-per-10 years is near zero (0.0001% to the nearest 1 /1 0 0 th of 1 percent).

4. When the ILRT interval is 15 years, the risk contribution of leakage (person-rem/yr) represented by Class 3 accident scenarios is increased insignificantly (contribution is 0.0002% of the total risk).

5. The total integrated increase in risk contribution from reducing the ILRT test frequency from 3-per-1 0-year (baseline) frequency to once-per-15 years is insignificant (0.0002%).

Page 69

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

6. There is no change in the at-power CDF associated with the ILRT extension. Therefore, this is within the Reg. Guide 1.174 acceptance guidelines.

7. The risk increase in LERF from, the original 3-in-10 years test frequency to once-per-10 years is 3.46E-09/yr. This is within the acceptance guidelines in Reg. Guide 1.174.

8. The risk increase in LERF from the original 3-in-10 years test frequency to once-per-1 5 years is 5.93E-09/yr. This is within the acceptance guidelines in Reg. Guide 1.174.

9. The risk increase in LERF from reducing the ILRT test frequency from once-per-10 years to one-per-15 years is 2.46E-09/yr. This is within the acceptance guidelines in Reg. Guide 1.174.

10. The change in CCFP of less than 1% for both cases, reducing test frequency to either once-per-10 or once-per-15 years, is judged to be insignificant and reflects sufficient defense-in-depth.

Other significant results are summarized in Table 6-5 below.

Page 70

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 6-5

SUMMARY

OF RISK IMPACT ON TYPE A ILRT TEST FREQUENCY (Calculations Based on NEI Interim Guidance)

Risk Impact Risk Impact Risk Impact Risk Metric (Baseline) (10-years) (15-years) 0.000047% of total 0.0002% of total 0.0002% of total integrated value integrated value integrated value Class 3a and 3b Risk Contribution 1.75E-05 person- 5.84E-5 person- 8.76E-5 person-rem/yr rem/yr rem/yr 36.9682 person- 36.9683 person- 36.9683 person-rem/year rem/year rem/year Percent Increase in Integrated Risk over N/A 0.0001% 0.0002%

Baseline Increase in LERF N/A 3.46E-09/yr 5.93E-09/yr over Baseline Percent Increase in CCFPN/A 0.0250% 0.0427%

Page 71

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 7 APPLICATION OF EPRI TR-1009325 METHODOLOGY 7.1

SUMMARY

OF METHODOLOGY EPRI TR-1 009325 [5] is an update to EPRI TR-1 04285 [2] (which, in turn, was built upon the guidance of NUREG-1493 [4]) that includes the changes to the methodology included in the NEI Interim Guidance [23], plus additional enhancements that were obtained through an expert elicitation process. In addition, the methodology incorporates the results of NRC comments on various industry ILRT interval extension submittals. The expert elicitation was aimed at reducing the conservatisms associated with the various containment leakage methodologies available that were found to provide widely differing risk results when applied to the same problem.

The enhancements in TR-1009325 are generally in two areas:

1. Definition (in terms of the required resulting La leakage term) of the assumed containment leakage size that could lead to a large, early release (LERF), i.e.,

EPRI accident Class 3b. Whereas previous submittals assumed a very conservative leakage term (35 La) would have the potential to result in a LERF event, the methodology provides a basis for using a (still conservative) value of 100 La instead. For the smaller pre-existing leak (accident Class 3a) size, the previously used conservative value of 10 La was retained by the methodology.

2. Development of specific probabilities for pre-existing containment leakage sizes. This was done through the expert elicitation process. EPRI TR-1009325 states that this method provides a considerable improvement over Page 72

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension the use of non-informative priors (as has been done in previous licensee submittals based on application of the previous EPRI TR-104285 methodology).

3. Consideration of the potential risk benefits associated with other containment inspections (non-ILRT) and potential indirect containment monitoring techniques that would provide indications of a containment leak (determination of the probability of leakage detection over an increased ILRT interval, again through use of the expert elicitation process).

Application of the EPRI TR-1009325 methodology generally produces results that indicate lower population dose risk than previous methodologies due to the reduction in the conservatisms noted above.

7.2 ANALYSIS APPROACH Implementation of the methodology of EPRI TR-1 009325 is very similar to the implementation of the NEI Interim Guidance discussed in Section 6.2 (the steps required for the analysis identified in TR-1 009325 are identical with those presented in the NEI Interim Guidance). The practical differences between the two analyses lies in the inputs used for determining the leak size requirements for LERF categorization (EPRI Class 3b), and in the probability values applied to the assumed undetected leakage categories. Therefore, in this section, the calculation discussion focuses on the changes in these inputs only. The calculation details followed are identical to those shown for the NEI Interim Guidance (Section 6.2). The presentation of results in Section 7.3 mirrors that provided for the other two methodologies.

Page 73

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Step 1) Quantify the base line (nominal three year ILRT interval) risk in terms of frequency per reactor year for the EPRI accident classes of interest.

Step 1 was quantified as described in Section 6.3 above, except in the leakage size and probabilities determined for Class 3a and Class 3b accident sequences.

Utility ILRT extension submittals based on previous methodologies (EPRI TR-104285, 2001 NEI Interim Guidance) relied upon statistical failure data updates using non-informative priors in order to determine the probability values for containment leakage identifiable only through ILRTs (particularly Class 3b). As the risk results are sensitive to the 3b values, the choice of statistical methodology applied was seen to produce a somewhat wide range of risk results. EPRI TR-1009325 used expert elicitation to develop a relationship between the size of potential containment leakage pathways, expressed as La, and the probability of occurrence. This methodology was seen as a considerable improvement over the use of non-informative priors.

A summary of the final results of the statistical analysis of the expert elicitation (leak size vs. probability) are given in Table 6-1 of EPRI TR-1009325. As stated in Section 7.1 above, for Class 3 leakage scenarios, the EPRI TR-1 009325 methodology specifies the use of 10 La as a conservative upper bound leakage size for Class 3a sequences, and 100 La as a conservative upper bound leakage size for Class 3b sequences.

From Table 6-1, the mean probability of occurrence for a 10 La (Class 3a) leak is 3.88E-03, and the mean probability of occurrence for a 100 La Page 74

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension (Class 3b) leak is 2.46E-04. Using these values, the calculation of the baseline Class 3a and 3b distributions was performed as follows:

CLASS_3aFREQUENCY = 3.88E-03

• 5.32E-7/year = 2.06E-9/year CLASS_3bFREQUENCY = 2.46E-04

• 5.32E-7/year = 1.31 E-1 0/year These values are about an order of magnitude lower than the values calculated in Sections 5.1 (TR-104285 methodology) and 6.2 (NEI Interim Guidance methodology) above.

The remainder of the Step 1 calculation follows the same process as that

.presented in Section 6.2 above. Table 7-1 below provides the Palo Verde accident class frequencies that were used in the application of the EPRI TR-1 009325 methodology.

Steps 2 - 9)

The process followed to complete Steps 2 - 9 for the EPRI TR-1 009325 methodology was the same as that presented in Section 6.2 above. Tables 7-1 through 7-4 below provide the interim results of the EPRI TR-1009325 methodology.

Page 75

Enclosure 1, Attachment 3 1 Risk Assessment for ILRT (Type A) Extension Table 7-1 EPRI ACCIDENT CLASS FREQUENCIES (based on EPRI TR-1009325 Methodology)

EPRI EPRI Accident Accident Class Frequency Contribution Class Description (per year) to CDF (%)

1 No Containment Failure 5.30E-07 3.82%

2 Large Isolation Failures (Fail to Close) 3.47E-08 0.25%

Small Isolation Failures (Liner Breach) 2.06E-09 0.01%

3B Large Isolation Failures (Liner Breach) 1.31 E-10 0.01%

Small Isolation Failures (Fail to Seal - Type B) 0.OOE+00 0.00%

Small Isolation Failures (Fail to Seal - Type C) 0.00E+00 0.00%

6 Other Isolation Failures (e.g., dependent failures) 0.00E+00 0.00%

Failures induced by 7 Phenomena (early and late) 1.25E-05 90.25%

8 Bypass (Interfacing Systems LOCA) 7.86E-07 5.66%

Total 1.39E-05 100.0 Page 76

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 7-2 ANNUAL DOSE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED 3/10 YEARS (Calculations Based on EPRI TR-1009325 Methodology)

Populatio EPRI n Dose Accident for Entire Population EPRI Class Region Dose Rate for Accident Frequency (person- Entire Region Class Description (per year) rem) (person-rem/yr)

No Containment Failure 5.30E-07 8.97E+,01 4.754E-05 Large Isolation 2 Failures (Fail to Close) 3.47 E-08 4.07E+06 1.412E-01 Small Isolation 3a Failures (Liner Breach) 2.06E-09 8.97E+02 1.852E-06 Large Isolation 3b Failures (Liner Breach) 1.31 E-10 8.97E+03 1.179E-06 Small Isolation 4 Failures (Fail to Seal - Type B) O.OOE+00 0 0.OOOE+00 Small Isolation 5 Failures (Fail to Seal - Type C) 0.OOE+00 0 0.OOOE+00 Other Isolation Failures (e.g.,

dependent failures) 0.O0E+00 0 0.000E+00 Failures induced 7 by Phenomena (early and late) 1.25E-05 2.16E+06 2.709E+01 Bypass 8 (Interfacing Systems LOCA) 7.86E-07 1.24E+07 9.733E+00 Total 1.39E-05 36.9682 Page 77

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 7-3 ANNUAL DOSE RATE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED EVERY 10 YEARS (Calculations Based on EPRI TR-1009325 Methodology)

Population EPRI Dose for Accident Entire Population Dose EPRI Class Region Rate for Entire Accident Frequency (person- Region (person-Class Description (per year) rem) rem/yr)

No Containment Failure 5.25E-07 8.97E+01 4.708E-05 Large Isolation 2 Failures (Fail to Close) 3.47E-08 4.07E+06 1.412E-01 Small Isolation 3a Failures (Liner Breach) 6.88E-09 8.97E+02 6.174E-06 Large Isolation 3b Failures (Liner Breach) 4.43E-10 8.97E+03 3.974E-06 Small Isolation 4 Failures (Fail to Seal - Type B) O.OE+00 O.OOE+00 O.OOOE+00 Small Isolation 5 Failures (Fail to Seal - Type C) O.0OE+00 O.OOE+00 O.OOOE+00 Other Isolation Failures (e.g.,

dependent failures) O.OOE+00 O.OOE+00 0.OOOE+00 Failures induced 7 by Phenomena (early and late) 1.25E-05 2.16E+06 2.709E+01 Bypass 8 (Interfacing Systems LOCA) 7.86E-07 1.24E+07 9.733E+00 Total 1.39E-05 36.9682 Page 78

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 7-4 ANNUAL DOSE RATE (PERSON-REM/YR) AS A FUNCTION OF ACCIDENT CLASS CHARACTERISTIC OF CONDITIONS FOR ILRT REQUIRED EVERY 15 YEARS (Calculations Based on EPRI TR-1009325 Methodology)

EPRI Accident Population Dose Class Population Dose Rate for Entire EPRI Frequency for Entire Region Region (person-Accident (per year) (person-rem) rem/yr)

Class Description 1 No Containment Failure 5.21 E-07 8.97E+01 4.675E-05 2 Large Isolation Failures (Fail to Close) 3.47E-08 4.07E+06 1.412E-01 3a Small Isolation Failures (Liner Breach) 1.03E-08 8.97E+02 9.261E-06 3b Large Isolation Failures (Liner Breach) 6.64E-10 8.97E+03 5.961E-06 Small Isolation Failures (Fail to Seal - Type B) O.0OE+00 O.OOE+00 O.OOOE+00 Small Isolation Failures (Fail to Seal - Type C) O.OOE+00 O.OOE+00 O.OOOE+00 6 Other Isolation Failures (e.g., dependent failures) O.OOE+00 O.OOE+00 O.OOOE+00 Failures induced by 7 Phenomena (early and late) 1.25E-05 2.16E+06 2.709E+01 8 Bypass (Interfacing Systems LOCA) 7.86E-07 1.24E+07 9.733E+00 Total 1.39E-05 36.9682 Page 79

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension 7.3 RESULTS

SUMMARY

The following is a brief summary of some of the key aspects of the ILRT test interval extension risk analysis (as calculated in Section 7 - EPRI TR-1009325 Methodology):

1. The baseline risk contribution (person-rem/yr) associated with containment leakage affected by the ILRT and represented by Class 3 accident scenarios is 0.000008% of the total risk.

2. When the ILRT interval is 10 years, the risk contribution of leakage (person-rem/yr) represented by Class 3 accident scenarios is increased insignificantly (contribution is increased to 0.00003% of the total risk).

3. The total integrated increase in risk contribution from reducing the ILRT test frequency from 3-per-I 0-year (baseline) frequency to once-per-1 0 years is near zero (0.00002%).

4. When the ILRT interval is 15 years, the risk contribution of leakage (person-rem/yr) represented by Class 3 accident scenarios is increased insignificantly (contribution remains 0.00004% of the total risk).

5. The total integrated increase in risk contribution from reducing the ILRT test frequency from 3-per-1 0-year (baseline) frequency to once-per-1 5 years is insignificant (0.00003%).

Page 80

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

6. There is no change in the at-power CDF associated with the ILRT extension. Therefore, this is within the Reg. Guide 1.174 acceptance guidelines.

7. The risk increase in LERF from the original 3-in-10 years test frequency to once-per-10 years is 3.11 E-10/yr. This is within the acceptance guidelines in Reg. Guide 1.174.

8. The risk increase in LERF from the original 3-in-10Qyears test frequency to once-per-1 5 years is 5.33E-1 0/yr. This is within the acceptance guidelines in Reg. Guide 1.174.

9. The risk increase in LERF from reducing the ILRT test frequency from once-per-10 years to one-per-15 years is 2.21E-10/yr. This is within the acceptance guidelines in Reg. Guide 1.174.

10. The change in CCFP of less than 1% for both cases, reducing test frequency to either once-per-1 0 or once-per-1 5 years, is judged to be insignificant and reflects sufficient defense-in-depth.

Other significant results are summarized in Table 7-5 below.

Page 81

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 7-5

SUMMARY

OF RISK IMPACT OF TYPE A ILRT TEST FREQUENCIES (Calculations Based on EPRI TR-1009325 Methodology)

Risk Impact Risk Impact Risk Impact Risk Metric (Baseline) (10-years) (15-years) 0.000008% of total 0.00003% of total 0.00004% of total integrated Class 3a and integrated value integrated value value 3b Risk Contribution 3.03E-06 person- 1.01 E-05 person-rem/yr 1.52E-05 person-rem/yr rem/yr Totae ota l3 6 9 8 person-36.9682 pe s n 36.9682 person-rem/year 36.9682 person-rem/year Integrated rem/year Risk Percent Increase in Integrated N/A 0.00002% 0.00003%

Risk over Baseline Increase in LERF over N/A 3.11E-10/yr 5.33E-10/yr Baseline Percent Increase in N/A 0.0022% 0.0038%

CCFP over Baseline Page 82

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 8 CONCLUSIONS This section provides the principal conclusions of the ILRT test interval extension risk assessments as reported for the following:

• Previous generic risk assessment by the NRC

• Plant Specific Palo Verde risk assessment for the at-power case, performed using three available methodologies (EPRI TR-104285, NEI Interim Guidance, and EPRI TR-1009325)

• General conclusions regarding the beneficial effects on shutdown risk 8.1 PREVIOUS ASSESSMENTS The NRC in NUREG-1493 has previously concluded that:

" Reducing the frequency of Type A tests (ILRTs) from the current three per 10 years to one per 20 years was found to lead to an imperceptible increase in risk. The estimated increase in risk is very small because ILRTs identify only a few potential containment leakage paths that cannot be identified by Type B and C testing, and the leaks that have been found by Type A tests have been only marginally above existing requirements.

" Given the insensitivity of risk to containment leakage rate and the small fraction of leakage paths detected solely by Type A testing, increasing the interval between integrated leakage-rate tests is possible with minimal impact on public risk. The impact of relaxing the ILRT frequency beyond one in 20 years has not been evaluated. Beyond testing the performance Page 83

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension of containment penetrations, ILRTs also test the integrity of the containment liner.

8.2 PALO VERDE SPECIFIC RISK RESULTS The findings for Palo Verde confirm the general findings of previous studies on a plant specific basis, including severe accident category frequencies, the containment failure modes, the Technical Specification allowed leakage, and the local population surrounding the Palo Verde station. Based on the results from Sections 5 through 7, the following conclusions regarding the assessment of the plant risk are associated with extending the Type A ILRT test from ten years to fifteen years:

• There is no change in the at-power CDF associated with the ILRT test interval extension. Therefore, this is within the Reg. Guide 1.174 acceptance guidelines.

0 Reg. Guide 1.174 provides guidance for determining the risk impact of plant-specific changes to the licensing basis. Reg. Guide 1.174 defines very small changes in risk as resulting in increases of CDF below 1006/yr and increases in LERF below 10-7/yr. Since the ILRT does not impact CDF, the relevant criterion is LERF. The increase in LERF resulting from a change in the Type A ILRT test frequency from once-per-ten-years to once-per-fifteen years is between 2.21 E-1 0/yr and 2.46E-09/yr. Therefore, increasing the ILRT interval from 10 to 15 years is considered to result in a very small change to the Palo Verde risk profile.

Page 84

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

• The proposed change in the Type A test frequency (from once-per-ten-years to once-per-fifteen-years) increases the total integrated plant risk by significantly less than 1%. Therefore, the risk impact of this change, when compared to other severe accident risks, is negligible.

" The change in Conditional Containment Failure Probability (CCFP) of less than 1% is judged to be insignificant and reflects sufficient defense-in-depth.

8.3 SENSITIVITY ANALYSIS FOR USE OF EPRI REPRESENTATIVE PLANT CONSEQUENCE MEASURES As stated in Section 4.2 above, the EPRI "representative plant" dose results from Table 4 of EPRI TR-1 04285 [2] were used for this analysis in lieu of plant-specific Level 3 consequence measures, which are not currently available for Palo Verde. From Section 4.2, footnote 4 of EPRI TR-104285, factors such as plant power rating and demographics can impact the results of the offsite dose calculations for a particular site relative to the results for the NUREG-1 150 plants. The footnote concludes with "However, in as much as the comparison is made relative to a baseline, the differences not considered in this analysis, would not impact the conclusions drawn."

Table 8-1 below summarizes the Palo Verde results of this risk evaluation, respectively.

Page 85

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Table 8-1

SUMMARY

OF RISK IMPACT OF VARIOUS TYPE A ILRT TEST FREQUENCIES (Summary by Methodology)

Risk Metric Risk Impact (Baseline) Risk Impact Risk Impact (10-years) (15-years)

Calculation EPRI TR- NEI Interim EPRI TR- EPRI TR- NEI Interim EPRI TR- EPRI TR- NEI Interim EPRI TR-Methodology 104285 Guidance 1009325 104285 Guidance 1009325 104285 Guidance 1009325 0.0002% of 0.000047% 0.000008% 0.0002% of 0.00003% 0.0002% of 0.0002% of 0.00004%

total of total of total 0.0002% of total of total total total of total integrated integrated integrated total integrated integrated integrated integrated integrated integrated Class 3a and 3b value value value value value value value value value Risk Contribution 6.56E-5 1.75E-05 3.03E-06 7.26E-5 5.84E-5 1.01 E-05, 7.59E-5 8.76E-5 1.52E-05 person- person- person- person-rem/yr person- person- person- person- person-rem/yr rem/yr rem/yr rem/yr rem/yr rem/yr rem/yr rem/yr 36.9683 36.9682 36.9682 36.9683person- 36.9683 36.9682 36.9683 36.9683 36.9682 Total Integrated person- person- person- rem/year person- person- person- person- person-Risk rem/year rem/year rem/year rem/year rem/year rem/year rem/year rem/year Percent Increase in Integrated N/A N/A N/A 0.00002% 0.0001% 0.00002% 0.00003% 0.0002% 0.00003%

Risk over Baseline Increase in 5.33E-LERF over N/A N/A N/A 1.25E-09/yr 3.46E-09/yr 3.11 E-1 0/yr 1.82E-09/yr 5.93E-09/yr 10/yr Baseline Percent Increase in CCFP over N/A N/A N/A 0.034% 0.0250% 0.0022% 0.050% 0.0427% 0.0038%

Baseline Page 86

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension 8.4 RISK TRADE-OFF The performance of an ILRT occurs during plant shutdown and introduces some small residual risk. An EPRI study of operating experience events associated with the performance of ILRTs has indicated that there is real shutdown risk impacts associated with the setup and performance of the ILRT during shutdown operation

[10]. While these risks have not been quantified for Palo Verde, it is judged that there is a positive (yet un-quantified) safety benefit associated with the avoidance of frequent ILRTs.

The safety benefits relate to the avoidance of plant conditions and alignments associated with the ILRT which place the plant in a less safe condition leading to events related to drain down or loss of shutdown cooling. Therefore, while the focus of this evaluation has been on the negative aspects, or increased risk, associated with the ILRT test interval extension, there are, in fact, positive safety benefits that reduce the already small risk associated with the extension of the ILRT test interval.

Page 87

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension Section 9 REFERENCES

1) NEI 94-01, Industry Guideline for Implementing Performance-BasedOption of 10 CFR Part50, Appendix J, July 1995.

2) EPRI TR-1 04285, Risk Impact Assessment of Revised Containment Leak Rate Testing Intervals, EPRI, Palo Alto, CA, August 1994.

3) Regulatory Guide 1.174, An Approach for Using ProbabilisticRisk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July 1998.

4) NUREG-1493, Performance-BasedContainmentLeak-Test Program, September 1995.

5) EPRI TR-1 009325 R2, Final Report, Risk Impact Assessment of Extended Integrated Leak Rate Testing Intervals, August 2007.

6) NUREG-1 273, Technical Findingsand Regulatory Analysis for Genetic Study Issue II.e.43 Containment Integrity Check, April 1988.

7) NUREG/CR-3539, Impact of ContainmentBuilding Leakage on LWR Accident Risk, Oak Ridge National Laboratory, ORNL/TM-8964, April 1984.

8) NUREG/CR-4220, ReliabilityAnalysis of Containment Isolation Systems, Pacific Northwest Laboratory, PNL-5432, June 1985.

9) NUREG/CR-4330, Review of Light Water Reactor Regulatory Requirements, Pacific Northwest Laboratory, PNL-5809, Vol. 2, June 1986.

10) EPRI TR-1 05189, Final Report, Shutdown Risk Impact Assessment for Extended Containment Leakage Testing Intervals Utilizing ORAMTM,EPRI, Palo Alto, CA, May 1995.

Page 88

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

11) Individual Plant Examination Peach Bottom Atomic Power Station Units 2 and 3, Volumes 1 and 2 Philadelphia Electric Company, 1992.

12) DE-ACOG-87RL1 1313, ALWR Severe Accident Dose Analysis, March 1989.

13) Patrick D. T. O'Connor, PracticalReliabilityEngineering, John Wiley & Sons, 2 nd Edition, 1985.

14) Letter from R. J. Barrett (Entergy) to U.S. Nuclear Regulatory Commission, IPN-01-007, dated January 16, 2001.

15) Letter from J. A. Hutton (Exelon, Peach Bottom) to U.S. Nuclear Regulatory Commission, Docket No. 50-278, License No. DDPR-56, LAR 01-00430, dated May 30, 2001.

16) Letter from D. E. Young (Florida Power) to U.S. Nuclear Regulatory Commission, 3F0401-11, dated April 25, 2001.

19) WASH-1400, United States Nuclear Regulatory Commission, Reactor Safety Study, October 1975.

20) Letter from SNC (H. L. Summer, Jr.) to USNRC dated July 26, 2000.

21) United States Nuclear Regulatory Commission, Indian Point Nuclear Generating Unit No. 3 - Issuance of Amendment Re: Frequency of Performance-Based Leakage Rate Testing (TAC No. MB01 78), April 17, 2001.

22) NUREG-1 150, "Severe Accident Risks: An Assessment for Five Nuclear Power Plants", Vol. 1, Final Report, December, 1990.

23) J. Haugh, J. Gisclon, W. Parkinson, K. Canavan, "Interim Guidance for Performing Risk Impact Assessments in Support of One-Time Extensions for Containment Integrated Leak Rate Test Intervals", Rev. 4, EPRI, Nov. 2001.

Page 89

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension

24) ERIN P0381060002-2750, Development of a Level 2 Model for Palo Verde Nuclear Generating Station (PVNGS), February 2007.

25) Interim PRA Change Documentation, 13-NS-C029 R14, Jan. 2006.

Page 90

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A Effect of Age-Related Degradation on Risk Impact Assessment for Extending Containment Type A Test Interval A.1.0 PURPOSE The purpose of this calculation is to assess the effect of age-related degradation of the containment on the risk impact for extending the Palo Verde Integrated Leak Rate Test (ILRT or Containment Type A test) interval from ten to fifteen years.

A.2.0 INTENDED USE OF ANALYSIS RESULTS The results of this calculation will be used to indicate the sensitivity of the risk associated with the extension in the ILRT interval to potential age-related degradation of the containment shell to support obtaining NRC approval to extend the Integrated Leak Rate Test (ILRT) interval at Palo Verde from 10 years to 15 years. This calculation actually evaluates the impact of extending the interval from 3years to 15 years.

A.3.0 TECHNICAL APPROACH The present analysis shows the sensitivity of the results of the assessment of the risk impact of extending the Type A test interval for the Palo Verde to age-related liner corrosion.

The prior assessment included the increase in containment leakage for EPRI Containment Failure Class 3 leakage pathways that are not included in the Type B or Type C tests. These classes (3a and 3b) include the potential for leakage due to flaws in the containment shell. The impact of increasing the ILRT Interval for these classes included the probability that a flaw would occur and be detected by A-1

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type'A) Extension APPENDIX A the Type A test that was based on historical data. Since the historical data includes all known failure events, the resulting risk impact inherently includes that due to age-related degradation.

The present analysis is intended to provide additional assurance that age-related liner corrosion will not change the conclusions of the prior assessment. The methodology used for this analysis is similar to the assessments performed for Calvert Cliffs Nuclear Power Plant (CCNPP - Reference All), Comanche Peak Steam Electric Station (CPSES - Reference A2), D. C. Cook (CNP - Reference A3) and St. Lucie (SL - Reference A4) in responses to requests for additional information from the NRC staff. The CCNPP, CPSES and CNP extension request submittals have been approved by the NRC.

There is a significantly lower potential for corrosion of freestanding steel shell containments which Palo Verde does not have. This is due to the significantly smaller surface area susceptible to corrosion resulting from foreign material imbedded in concrete contacting the steel containment. Because of this, the analysis is carried out separately for those portions of the containment not in potential contact with foreign material and those portions in potential contact with the foreign material. (This is considered more appropriate than the cylinder and dome portions and the basement portions utilized in prior analyses.)

As in Reference Al, this calculation uses the following steps with Palo Verde values utilized where appropriate:

Stepi - Determine corrosion-related flaw likelihood A-2

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A Historical data will be used to determine the annual rate of corrosion flaws for the containment.

Step 2 - Determine age-adjusted flaw likelihood The historical flaw likelihood will be assumed to double every 5 years. The cumulative likelihood of a flaw is then determined as a function of ILRT interval.

Step 3 - Determine the change in flaw likelihood for an increase in inspection interval The increase in the likelihood of a flaw due to age-related corrosion over the increase in time interval between tests is then determined from the results of Step 2.

Step 4 - Determine the likelihood of a breach in containment given a flaw For there to be a significant leak from the containment, the flaw must lead to a gross breach of the containment. The likelihood of this occurring is determined as a function of pressure and evaluated at the Palo Verde ILRT pressure.

Step 5 - Determine the likelihood of failure to detect a flaw by visual inspection.

A-3

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A The likelihood that the visual inspection will fail to detect a flaw will be determined considering the portion of the containment that is uninspectable at Palo Verde as well as an inspection failure probability.

Step 6 - Determine the likelihood of non-detected containment leakage due to the increase in test interval.

The likelihood that the increase in test interval will lead to a containment leak not detected by visual examination is then determined as the product of the increase in flaw likelihood due to the increased test interval (Step 3), the likelihood of a breach in containment (Step 4) and the visual inspection non-detection likelihood. (Step 5). The results of the above for the two regions of the containment are then added to get the total increased likelihood of non-detected containment leakage due to age-related corrosion resulting from the increase in ILRT interval.

The result of Step 6 is then used, along with the results of the prior risk analysis in the body of this analysis to determine the increase in LERF as well as the increase in person-rem/year and conditional containment failure probability due to age-related liner corrosion.

A.4.0 INPUT INFORMATION

1. General methodology from the Calvert Cliffs assessment of age-related liner degradation (Reference Al).

A-4

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A

2. The Palo Verde ILRT test pressure of 60.0 psig (Reference A5).

3. Palo Verde containment failure pressure of 120 psia based on (Reference All).

4. The surface area of the containment potentially in contact with foreign material either imbedded in the adjacent concrete or trapped in the areas of limited access is 133,000 ft2 . This is based on calculations of the total interior and exterior surface area of the containment both accessible and inaccessible for inspection [A6] and application of a factor to represent the assumed surface area in contact with concrete [All].

5. The number of containments, either free-standing steel shell or concrete with steel liners is 104 and the average area of steel potentially in contact with foreign material either imbedded in'the adjacent concrete or trapped in the areas of limited access is 61,900 ft2 [Al 0].

A.

5.0 REFERENCES

Al. "Calvert Cliffs Nuclear Power Plant Unit No. 1; Docket No. 50-317, Response to Request for Additional Information Concerning the License Amendment Request for a One-Time Integrated Leakage Rate Test Extension, "Constellation Nuclear letter to USNRC, March 27, 2002.

A2. "Comanche Peak Steam Electric Station (CPSES), Docket Nos. 50-445 and 50-446, Respond to Request for Additional Information Regarding License A-5

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A Amendment Request (LAR) 01-14 Revision to Technical Specification (TS) 5.5.16 Containment Leakage Rate Testing Program," TXU Energy letter to USNRC, June 12, 2002.

A3. "Donald C. Cook Nuclear Plants Units 1 and 2, Response to Nuclear Regulatory Commission Request for Additional Information Regarding the License Amendment Request for a One-time Extension of Integrated Leakage Rate Test Interval," Indiana Michigan Power Company, November 11. 2002.

A4. "St. Lucie Units 1 and 2, Docket Nos. 50-335 and 50-389, Proposed License Amendments, Request for Additional Information Response on Risk-Informed One Time Increases in Integrated Leak Rate Test Surveillance Interval," Florida Power

& Light Company letter to USNRC, December 13, 2003.

A5. Palo Verde Surveillance 73ST-9CL02, "Integrated Leakage Rate Test".

A6. Palo Verde ILRT Extension study inputs, 476-00489-FP-WJA.

A7. "Containment Liner Through Wall Defect due to Corrosion," Licensing Event Report, Ler-NA2-99-02, North Anna Nuclear Power Plant Station Unit 2.

A8. "Brunswick Steam Electric Plant, Units 1 and 2, Dockets 50-325 and 50-324/License Nos. DPR=71 and DPR-62, Response to Request for Additional Information Regarding Request for License Amendments - Frequency of Performance Based Leakage Rate Testing," CP&L letter to USNRC, February 5, 2002.

Az6

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A A9. "IE Information Notice No. 86-99; Degradation of Steel Containments." USNRC, December 8. 1986.

Al 0. E. R. Schmidt, "Calculation of Industry Average Containment Surface Area Subject to Age-Related Corrosion Due to Foreign Material," Analysis File 17547-0001-A4, Rev. 0, November 14, 2003.

Al 1. "Kewaunee Nuclear Power Plant, Docket 50-305, License No. DPR-43, License Amendment Request 198 to the Kewaunee Nuclear Power Plant Technical Specifications for One-Time Extension of Containment Integrated Leak Rate Test Interval", June 20, 2003.

A.6.0 MAJOR ASSUMPTIONS A.6.1 As indicated in references A3, A7 and A9, for example, there have been 4 instances of age-related corrosion leading to holes in steel containment liners or shells. Three of these instances (Cook - Reference A3, North Anna - Reference A7 and Brunswick - Reference A8) were in concrete containments with steel liners and due to foreign material imbedded in the concrete in contact with the steel liner.

The fourth instance (Oyster Creek - Reference A9) was in a freestanding steel containment and occurred in an area where sand fills the gap between the steel shell and the surrounding concrete and was attributed to water accumulating in this sand. This data is therefore considered to represent a corrosion induced failure rate only for the area of the Palo Verde containment shell in contact with concrete or other areas where foreign material may be trapped. For the other areas where the containment shell is not likely to be in contact with foreign material, the A-7

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A corrosion induced failure rate should be substantially lower and taken to be that based on no observations of corrosion induced failure of the containment shell in these regions.

A.6.2 The historical data of age-related corrosion leading to holes in the steel-containment has occurred primarily (3 out of 4 instances) for steel lined concrete containments. For these containments the surface area in contact with the concrete comprises essentially the entire surface area of the containment. For Palo Verde, the surface area calculation is taken from calculations of the total inside and outside surface area of the containment both accessible and inaccessible for inspection from [A6]. From these records, the surface area inside and outside the containment that is accessible for inspection is 198,333 square feet, and the surface area that is not accessible for inspection is 35,000 square feet. Since the greater the surface area in contact with the concrete, the greater the chance of foreign material being in contact with steel containment and therefore the greater the chance of corrosion induced flaws, the containment failure rate due to corrosion will be taken to be proportional to the surface area in contact with the concrete. The total surface area in contact with the concrete is calculated by multiplying the total (accessible and inaccessible) inside containment surface area divided by 2 (to represent inside and outside surface area) by a factor of 14% and 100%. Then those numbers are added together to give you the total surface area in contact with concrete [Al 1]. This results in a calculated total surface area in contact with the concrete of

((198,333+35,000)/2)'0.14+(198,333+35,000)/2)*1 = 133,000 square feet. The containment failure rate due to corrosion will be taken to be that for the industry times the'ratio of the surface area at risk for Palo Verde to the average area at risk A-8

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A for the industry.

A.6.3 The visual inspection data is conservatively limited to 5.5 years reflecting the time from September 1996, when 10 CFR 50.55a started requiring visual inspection, through March 2002, the cutoff date for this analysis. Additional success data were not used to limit the aging impact of this corrosion issue, even though inspections were being performed prior to September 1996 (and after March 2002). While some liner corrosion has been evident in these inspections, when it is identified it is corrected (when possible) and the area is placed under an augmented inspection program to monitor for further degradation. There has been no evidence that any of the corrosion issues identified have led to holes in the containment liner. (Step 1).

A.6.4 As in Reference Al, the containment flaw likelihood is assumed to double every 5 years. This is included to address the increased likelihood of corrosion due to aging. (Step 2)

A.6.5 The likelihood of a significant breach in the containment due to a corrosion induced localized flaw is a function of containment pressure. At low pressures, a breach is very unlikely. Near the nominal failure point, a breach is expected. As in Reference Al, anchor points of 0.1 % chance of cracking near the flaw at 20 psia and 100% chance at the failure pressure 160 psia. The failure pressure of 160 psia was based on the value used for the Kewaunee ILRT Extension Submittal [Al 1].

A.6.6 In general, the likelihood of a breach in the lower head region of the containment occurring, and this breach leading to a large release to the atmosphere, is less than that for the cylindrical portion of the containment. The assumption discussed A-9

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A in item 5 above is, however, conservatively applied to the lower head region of the containment, as well as to the cylindrical portions.

A.6.7 All non-detected containment overpressure leakage events are assumed to be large early releases.

A.6.8 The interval between ILRTs at the original frequency of 3 tests in 10 years is taken to be 3 years.

A.7.0 IDENTIFICATION OF COMPUTER CODES:

None used.

A.8.0 DETAILED ANALYSIS:

A.8.1 Step 1 - Determine a corrosion-related flaw likelihood As discussed in Assumptions 1, 2 and 3, the likelihood of through wall defects due to corrosion for the areas of the containment potentially contacted by foreign materials is based on 4 data points in 5.5 years.

[4 failures*(1 33,000 ft2 / 61 ,900ft2 )/ (104 plants*5.5 years/plant) = 1.50E-02 per year]

For the areas of the containment where foreign material is not likely to contact the containment the defect likelihood is taken to be that for no observed failures using a non-informative prior distribution.

A-10

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A Failure Frequency = [# of failures (0) + 1/2] / (Number of unit years (104*5.5))]

= 8.74E-04 per year.

A similar area-at-risk correction as above for the area in contact with concrete is not appropriate for the area where foreign material is not likely to contact the containment since the majority of the steel liner or shell for all plants has at least one side of the surface subject to this reduced corrosion (and none has been observed).

A.8.2 Step 2 - Determine age-adjusted liner flaw likelihood Reference Al provides the impact of the assumption that the historical flaw likelihood will double every 5 years on the yearly, cumulative and average likelihood that an age-related flaw will occur. For a flaw likelihood of 5.2E-03 per year, the 15 year average flaw likelihood is 6.27E-03 per year for the cylinder/dome region. This result of Reference Al is generic in nature, as it does not depend on any plant specific inputs except the assumed historical flaw likelihood.

For the present assumption of 4 historical failures in 104 plants, the 15 year average flaw likelihood is 26.3% (1.50E-02/5.2E-03 = 2.885 or 288.5%) of the above value (6.27E-03) or 1.81 E-02 per year, and in accordance with Assumption 1, is applicable to the region of the containment potentially in contact with foreign material.

A-11

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A Similarly, for the region of the containment not potentially in contact with foreign material, the 15 year average flaw likelihood is 16.8% (8.74E-04/5.2E-03 = 0.168) of the above value (6.27E-03) or 1.05E-03 per year.

A.8.3 Step 3 - Determine the change in flaw likelihood for an increase in inspection interval The increase in the likelihood of a flaw due to age-related corrosion over the increase in time interval between tests from 3 to 15 years is determined from the result of Step 2 in Reference Al to be 8.7% for the cylinder/dome region based on assumed historical flaw likelihood and the resulting 6.27E-03 per year 15 year average flaw likelihood. This result of Reference Al is generic in nature, as it does not depend on any plant specific inputs, except the assumed historical flaw likelihood.

For the present assumption of 4 historical failures in 104 plants, the increase in the likelihood of a flaw due to age-related corrosion over the increase in time interval between tests from 3 to 15 years is 288.5% (as in Step 2) of that given in Reference Al (2.885*8.7%) or 25.14% and in accordance with Assumption 1 is applicable to only the region of the containment potentially in contact with foreign material.

Similarly, for the region of the containment not potentially in contact with foreign material, the increase in the likelihood of a flaw due to age-related corrosion over the increase in time interval between tests from 3 to 15 years is 16.8% (as in Step 2)-of that given in Reference Al or 1.46%.

A-12

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A A.8.4 Step 4 - Determine the likelihood of a breach in containment given a liner flaw The likelihood of a breach in containment occurring is determined as a function of pressure as follows:

For a logarithmic interpolation on likelihood of breach LOG (likelihood of breach) = m (pressure) + a Where m = slope a = intercept The values of m and a are determined from solution of the two equations for the values of 0.1% at 20 psia and 100% of containment failure pressure of 120 psia (Reference A12).

Log 0.1 = m*20 + a Log 100 = m*120+a or m = (Log 100- Log 0.1)/(120-20) = 0.030 and a = Log 0.1 - 0.030*20 = -1.60 A-13

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A The upper end of the range of Palo Verde ILRT pressure of 60.0 psig (Reference A5) gives the highest likelihood of breach.

At 74.7 psia (60.0 + 14.7), the above equation gives Log (likelihood of breach) = 0.030*74.7 - 1.60 = 0.641 Likelihood of breach = 100.0435 = 4.38%

In accordance with Reference Al, the above value is for the cylinder/dome portions of the containment. For this analysis, this value is also assumed to be applicable to the region of the containment potentially in contact with foreign material.

A.8.5 Step 5 - Determine the likelihood of failure to detect a flaw by visual inspection A review of the geometry of the containment shell and the relative areas that are not inspectable and those in potential contact with foreign material, indicates that these two areas are essentially the same. Consequently, the portion of the containment not likely to be in contact with potential foreign material is 100%

visually inspectable, while the portion that may be in contact with potential foreign material is not visually inspectable. A 10% failure rate for that portion of the containment that is visually inspectable is assumed.

A.8.6 Step 6 - Determine the likelihood of non-detected containment leakage due to the increase in test interval A-14

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX A The likelihood of non-detected containment leakage in each region due to age-related corrosion of the liner considering the increase in ILRT interval is then given by:

The increased likelihood of

• The likelihood of a

• The likelihood that an undetected flaw containment breach visual inspection will because of the increased given a liner flaw not detect the flaw ILRT interval (Step3) (Step 4) (Step 5)

= 1.46%

• 0.0438*0.10 = 0.0064% for the regions not potentially contacted by foreign material.

= 25.14%

• 0.0438*1.0 = 1.100% for the regions potentially contacted by foreign material.

The total is then the sum of the values for the two regions or Total Likelihood of Non-Detected Containment Leakage = 0.0064% + 1.100%

=1.1064% for the ILRT interval increase from 3 years to 15 years.

A-15

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B Effect of External Events on Risk Informed/Risk Impact Assessment for Extending Containment Type A Test Interval This appendix discusses the external events assessment performed in support of the Palo Verde ILRT interval extension risk assessment.

External hazards were evaluated in the Palo Verde Individual Plant Examination of External Events (IPEEE) Submittal [B-2] in response to the NRC IPEEE Program (Generic Letter 88-20 Supplement 4). The IPEEE Program was a one-time review of external hazard risk to identify potential plant vulnerabilities and to understand severe accident risks. Although the external event hazards in the Palo Verde IPEEE were evaluated to varying levels of conservatism, the results of the Palo Verde IPEEE are nonetheless used in this risk assessment as a sensitivity study to provide a conservative comparison of the impact of external hazards on the conclusions of this ILRT interval extension risk assessment.

The proposed ILRT interval extension impacts plant risk in a limited way. Specifically, the probability of a pre-existing containment leak being the initial containment failure mode given a core damage accident is potentially higher when the ILRT interval is extended. This impact is manifested in the plant risk profile in a similar manner for both internal events and external events.

The spectrum of external hazards has been evaluated in the Palo Verde IPEEE by screening methods with varying levels of conservatism. Therefore, it is not possible at this time to incorporate a realistic quantitative risk assessment of all external event hazards into the ILRT extension assessment. As a result, external events have been evaluated as a sensitivity case to show that the conclusions of this analysis wouldnot be altered if external events were explicitly considered.

B.1. SEISMIC EVENTS The Palo Verde IPEEE assessment [B-2] documented the performance and results of a focused scope Seismic Margins Assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic process which does not calculate risk on a probabilistic basis.

Although probabilistic risk information is not directly available from the Palo Verde SMA IPEEE analysis, Reference [B-i] provides a method (called the Simplified Hybrid Method) for obtaining a seismically-induced hazard estimate (in terms of CDF) based on the results of a SMA analysis. Reference [B-I] has shown that only the plant HCLPF (High Confidence Low Probability of Failure) seismic capacity is required in order to estimate the seismic CDF within a precision of approximately a factor of two. This approach, which has been used in previous NRC submittals, is as follows:

B-1

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B Step 1: Determine the Palo Verde HCLPF seismic capacity (CHCLPF) from the SMA analysis Step 2: Estimate the 10% conditional probability of failure capacity (C10%) from C10% = Fp3

• CHCLPF Fp3 = e 1.04413 where 1.044 is the difference between the 10% NEP standard normal variable (-1.282) and the 1% NEP standard normal variable (-2.326).

Experience gained from previous high quality seismic PRA studies indicates the plant damage state fragility determined by rigorous convolution will tend to have 1P values in the range of 0.30 to 0.35 (the plant damage state P3c value is equal to or less than the P3c values for the fragilities of the individual components that dominate the seismic risk).

Therefore, the Simplified Hybrid Model recommends:

C10% = 1.4

• CHCLPF Step 3: Determine the hazard exceedance frequency (H-10o%) that corresponds to CO% from the hazard curves.

Step 4: Determine the seismic risk CDFsEISMIC (i.e., seismic related CDF) from:

CDFSEISMIC = 0.5

• H10o Using the above steps the Simplified Hybrid Model can be applied to Palo Verde to estimate seismic risk in terms of CDF, as shown below:

Step 1: If the SMA analysis screens out every component on the seismic Safe Shutdown Equipment List (SSEL) defining the seismic event safe shutdown paths at the Review Level Earthquake (RLE), the plant HCLPF is equal to the RLE.

Otherwise, the plant HCLPF is determined by the lowest seismic capacity component in the seismic SSEL. The results of the Palo Verde SMA at the 0.30g RLE concluded that all important safety functions could be accomplished following a seismic event.

Step 2: Using the relationship described above:

CIo% = 1.4

• 0.30g PGA = 0.42g PGA B-2

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B Step 3: Determine the hazard exceedance frequency (Hlo%) that corresponds to C10%

from the hazard curves.

The seismic hazard curve for Palo Verde was obtained from Reference B-3. It is replicated below with the Palo Verde HCLPF of 0.30g PGA estimated from the available data points and added to Table B-I.

Table B-1 PALO VERDE SEISMIC HAZARD CURVE Acceleration Mean Annual (g) Exceedance Probability 0.01 3.60E-02 0.02 7.30E-03 0.05 1.OOE-03 0.07 5.50E-04 0.10 2.90E-04 0.15 1.40E-04 0.20 7.80E-05 0.31 2.80E-05 0.421 1.50E-05 0.51 4.70E-06 1.02 2.80E-07 NOTE (1): The value of 1.50E-5/yr for 0.42g was obtained from interpolation of values Step 4: Using the recommended relationship described above:

CDFsEISMIC = 0.5

• H1 o%= 0.5

• 1.50E-5/yr = 7.49E-6/yr This information is used in Section B.4 of this enclosure to provide quantitative insights into the impact of external hazard risk on the conclusions of this ILRT risk assessment.

B.2. FIRE The results of the PVNGS fire PRA model showed that postulated fire events at PVNGS contribute approximately 3.856E-6/yr to overall core damage risk. Fire-induced Large Early Release Frequency (LERF) was calculated as part of the fire PRA model and contributes approximately 1.807E-7/yr.

This information is used in Section B.4 of this enclosure to provide insight into the impact of external hazard risk on the conclusions of this ILRT risk assessment.

B.3. OTHER EXTERNAL HAZARDS B-3

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B In addition to internal fires and seismic events, the Palo Verde IPEEE assessment [B-2]

analyzed a variety of other external hazards:

" High Winds/Tornadoes

" External Flooding

" Transportation and Nearby Industrial Facility Accidents

" Other External Hazards The Palo Verde IPEEE analysis of these hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. Based upon this review, it was concluded that Palo Verde meets the applicable Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards. As such, these hazards were determined in the Palo Verde IPEEE to be negligible contributors to overall plant risk.

Accordingly, these other external event hazards are not included explicitly in this enclosure and are reasonably assumed not to impact the results or conclusions of the ILRT interval extension risk assessment.

B.4. IMPACT OF EXTERNAL EVENTS ON LERF AND COMPARISON TO RG 1.174 ACCEPTANCE GUIDELINES Based on the previous discussion in Sections B.1 through B.3, the total Palo Verde external event initiated CDF is approximately:

External Events CDF = 3.86E-06/yr (internal fires) + 7.49E-06/yr (seismic)

= 1.13E-5/yr.

For seismic risk, the Simplified Hybrid Model provides an overall estimate of seismic risk, but does not provide information as to the specific accident sequences. Classification of the results according to the EPRI accident classes cannot readily be performed. As a conservative first approximation, the estimated values for seismic and fire-induced CDF from Sections B.1 and B.2 above were used to calculate the Class 3b frequency. These values were not adjusted for sequences that will independently cause LERF, or will not cause LERF (factors used in other submittals to more accurately characterize the expected LERF from external events associated with the requested ILRT extension).

In order to determine the impact of external events on the proposed ILRT extension request, the impact on LERF was assessed in accordance with the NEI Interim Guidance. The NEI Interim Guidance was used because it yields the most conservative results relative to the other two approaches used in the Attachment 1 calculation.

B-4

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B The impact on the Class 3b frequency due to increases in the ILRT surveillance interval was calculated for external events, using the relationships described in Attachment 1, Section 6.0. The EPRI Category 3b frequencies for the 3 per 10-year, 10-year and 15-year ILRT intervals were quantified using the total external events CDF. The change in the LERF risk measure due to extending the ILRT interval from 3 in 10 years to 1 in 10 years, or to 1 in 15 years, including both internal and external hazard risk, is provided on Table B-3.

TABLE B-3 CALCULATION OF LERF IMPACT INCLUDING EXTERNAL EVENTS USING NEI INTERIM GUIDANCE 3b Frequency LERF Increase 3-per-10 3-per-10 1-per-10 3-per-1 0 1-per-1 0 1-per-1 5 to to to year ILRT year ILRT year ILRT 1-per-10 1-per-15 1-per-15 (Bounding)

External Event Contribution 3.12E-08 1.05E-07 1.57E-07 7.38E-08 1.26E-07 5.25E-08 Internal Event Contribution 1.46E-09 4.92E-09 7.39E-09 3.46E-09 5.93E-09 2.46E-09 Combined (Internal+External) 3.26E-08 1.10 E-07 1.65E-07 7.73E-08 1.32E-07 5.50E-08 Table B-3 shows that, under the bounding assumption that the entire external events CDF is applied to the Class 3b frequency, the total estimated increase in LERF is within the range of 1E-07/yr to 1E-06/yr for all three cases considered (Region II of the RG 1.174 LERF acceptability curve). However, this study counted the full estimated seismic CDF and full estimated fire CDF against the 3b frequency. Based on the conservative nature of this sensitivity study, it is expected that a more detailed external event study would provide a significant reduction in these results. Note that Attachment 1,Table 6-4 shows that the Class 3b frequency calculated for the internal events case (using the NEI Interim Guidance) represents only 0.05% of the total Internal Events CDF for the 15-year ILRT test interval.

As discussed above, significant conservatisms exist in the risk values used in the external events calculations (for example, application of the seismic fragility for the most limiting SSC to the overall plant fragility, etc.). It is expected that a more detailed external event study would significantly reduce the estimated increase in LERF from external events. However, per [B-4], when the calculated increase in LERF due to the proposed plant change is in the range of 1E-7 to 1E-6 per reactor year (Region II, "Small Change" in risk), the risk assessment must also reasonably show that the total LERF B-5

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B from all hazards is less than 1E-5/yr. As described above, the available external events assessments for Palo Verde do not include calculations of LERF (CDF only). Therefore, two methods for developing a conservative estimate of the baseline LERF metric for external events were employed for this assessment.

The first method (Case 1, see Table B-4 below) estimates the external events LERF from the calculated internal events LERF-to-CDF ratio. The internal events CDF and LERF metrics for the ILRT extension submittal were 1.39E-5/yr and 8.65E-7/yr respectively, resulting in a LERF-to-CDF ratio of 6.22%. Use of this ratio provides a baseline external events LERF of 6.47E-7/yr. For the most limiting case (in which the ILRT interval is extended from 3 in 10 years to 1 in 15 years), the combined delta-LERF result for the ILRT extension (from internal and external events) is calculated to be 1.25-7/yr. The overall combined LERF result (from internal events, external events, and the delta-LERF for the ILRT extension) is calculated to be 1.64E-6/yr. These results meet the total LERF criterion of RG 1.174.

TABLE B-4 CALCULATION OF LERF IMPACT INCLUDING EXTERNAL EVENTS (Case 1) 3b Frequenc LERF Increase 3-per-1 0 3-per-1 0 1-per-1 0 3-per-10 1-per-10 1-per-15 to to ' to year ILRT year ILRT year ILRT 1-per-10 1-per-15 1-per-15 External Event Contribution 2.94E-08 9.90E-08 1.49E-07 6.96E-08 1.19E-07 4.95E-08 Internal Event Contribution 1.46E-09 4.92E-09 7.39E-09 3.46E-09 5.93E-09 2.46E-09 Combined (Internal+External) 3.08E-08 1.04E-07 1.56E-07 7.31 E-08 1.25E-07 5.20E-08 Case 1: External Events LERF contribution based on External Events CDF

• Internal Events LERF/CDF ratio (6.22%).

The second method (Case 2, see Table B-5 below) estimates the external events LERF based on the assumption of a conservative LERF-to-CDF ratio of 10%. Use of this ratio provides a baseline external events LERF of 9.29E-7/yr. For the most limiting case (in which the ILRT interval is extended from 3 in 10 years to 1 in 15 years), the combined delta-LERF result for the ILRT extension (from internal and external events) is calculated to be 1.22-7/yr. The overall combined LERF result (from internal events, external events, and the delta-LERF for the ILRT extension) is calculated to be 1.92E-6/yr.

These results also meet the total LERF criterion of RG 1.174.

B-6

Enclosure 1, Attachment 3 Risk Assessment for ILRT (Type A) Extension APPENDIX B TABLE B-5 CALCULATION OF LERF IMPACT INCLUDING EXTERNAL EVENTS. (Case 2) 3b Frequency LERF Increase 3-per-1 0 3-per-1 0 1-per-1 0 3-per-10 1-per-10 1-per-15 to to to year ILRT year ILRT year ILRT 1-per-10 1-per-1 5 1-per-15 External Event Contribution 2.86E-08 9.64E-08 1.45E-07 6.78E-08 1.16E-07 4.82E-08 Internal Event Contribution 1.46E-09 4.92E-09 7.39E-09 3.46E-09 5.93E-09 2.46E-09 Combined (Internal+External) 3.01 E-08 1.01 E-07 1.52E-07 7.13E-08 1.22E-07 5.07E-08 Case 2: External Events LERF contribution based on External Events CDF

• assumed External Events LERF/CDF ratio of 10%.

Therefore, incorporating external event hazard risk results into this analysis does not change the conclusion of the ILRT Extension LAR risk assessment (i.e., increasing the Palo Verde ILRT interval from 3 in 10 years to either 1 in 10 years or 1 in 15 years is an acceptable plant change from a risk perspective).

B.5. REFERENCES B-I.

Reference:

R. P. Kennedy, "Overview of Methods for Seismic PRA and Margin Analysis Including Recent Innovations", Proceedings of the OECD-NEA Workshop on Seismic Risk, Tokyo, Japan, August, 1999.

B-2. Palo Verde Nuclear Generating Plant Individual Plant Examination of External Events (IPEEE), 102-03407-WLS/AKK/GAM, June 30, 1995.

B-3. Seismic Hazard Evaluation for PVNGS, Final Report Rev 2. Prepared by Risk Engineering Inc. April 5, 1993.

B-4. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis".

B-7

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 ENCLOSURE 1, ATTACHMENT 4 Summary of PVNGS Probabilistic Risk Assessment (PRA) Quality

Enclosure 1, Attachment 4 Summary of PRA Quality Table of Contents 1.0 Palo Verde PRA Quality Overview: 2 1.1 Qualification of PRA Staff 2 1.2 PRA Procedures 2 1.3 Independent Reviews 2 1.4 PRA Configuration Control Program 3 1.5 PRA Open Items (Impacts) 4 1.6 Monitoring Plant Changes 4 1.7 PRA Updates 4 1.8 Software Quality Control 4 1.9 Peer Reviews 4 1.10 CEOG Cross-Comparison Process 5 1.11 CEOG PSA Technical Positions 5 1.12 ,Continuous Quality Improvement Process 5 2.0 PVNGS PRA Model Overview 6 3.0 Palo Verde PRA Development History 7 3.1 Significant Open Items 10 4.0 Combustion Engineering Owners Group Technical Positions 10 5.0 Independent External Reviews 11 6.0 Internal Events CDF Distribution by Initiator 12 7.0 PRA Level 2 Summary 12 8.0 Conclusion 13 9.0 References, 13 1

Enclosure 1, Attachment 4 Summary of PRA Quality 1.0 Palo Verde PRA Quality Overview:

These elements listed below are used to achieve a quality PRA and are described in the remainder of Section 1.

" Formal qualification program for the PRA staff

" Use of procedures to control PRA processes

• Independent reviews (checks) of PRA documents

" Comprehensive PRA Configuration Control Program

- Quarterly plant change monitoring program

- Process to control PRA quantification software

- Active open items list (Impact Review database)

- Interface with the site's corrective action program

- Process to maintain configuration of previous risk-informed decisions

" Peer reviews

• Participation in the Combustion Engineering Owners Group (CEOG) cross comparison process

" Incorporation, where applicable, of CEOG PRA Technical Positions

" Commitment of continuous quality improvement Section 2 provides an overview of the PRA model. Section 3 describes the development history of the PRA since the Individual Plant Examination (IPE) submittal in April of 1992 and describes the significant PRA open items. Section 4 lists the CEOG Technical Positions and describes the Palo Verde Nuclear Generating Station (PVNGS) position on each of these documents. Section 5-discusses the independent (external) reviews that have been performed on PRA. A summary of the significant issues and their status is provided.

1.1 Qualification of PRA Staff Risk Analysts are qualified in accordance with the PVNGS Engineering Training Program, which meets the INPO requirements for a Systematic Approach to Training and 10 CFR 50.120.

1.2 PRA Procedures The PRA model is controlled by PVNGS procedure 70DP-ORA03, PRA Model Control, Ref. 1. The PRA model is documented through Engineering Studies, which are controlled by PVNGS procedure 81 DP-4CC03, EngineeringStudies, Ref. 2. The PRA model documentation is maintained by the Nuclear Information Records Management Department in accordance with administrative controls meeting the requirements of Reg. Guide 1.33, Ref. 3.

1.3 Independent Reviews The Engineering Studies, which document the PRA, receive independent technical review, as required by PVNGS procedure 81 DP-OCCO5, Design and Technical Document Control, Ref. 4.

2

Enclosure 1, Attachment 4 Summary of PRA Quality 1.4 PRA Configuration Control Program The three Palo Verde units are nearly identical. Differences among the units are primarily due to plant modifications that cannot be introduced simultaneously in all three units; typically they are introduced in succeeding outages. Any one of the units could be the lead unit for a modification installation. However, the PRA model is intended to represent Unit 1 as Unit 1 drawings, calculations and procedures where unitized within the model. The one exception to this is the static transfer switches for the Vital AC. In this case Unit 1 was originally scheduled to receive this change, but has not; where as Units 2 and 3 have. In these situations the associated drawing changes are reviewed by PRA Group personnel and any differences in unit applicability are ascertained in the review and captured in the PRA model.

The following are noteworthy connections between the 3 units:

1. In a normal operating line-up, the three Startup-up Transformers each supply one source of off-site power to two units through separate secondary windings. Thus, loss of one Start-up Transformer would cause a single train of ESF equipment on two units to lose off-site power. Although loss of off-site power to one ESF bus is not by itself an initiating event, it can be a precursor and is captured by initiating events IELOP-TRAIN-A and IELOP-TRAIN-B.

2. The three units are connected through the Auxiliary Steam System, which supplies process steam for water processing and turbine gland seals during start-up. The normal line-up of this system is one unit supplying auxiliary steam for all three units.

This sharing is done primarily to keep the lines warm and the water within them in good condition. Malfunctions of the system are not significant enough perturbators to cause a trip or shutdown; nor is the system credited in the PRA for mitigating any transients or accidents. Procedures do exist, however, to transfer condensate from one unit to another, if needed.

3. The Station Blackout Gas Turbine Generators (GTGs) are capable of supplying and can be lined-up to more than one unit at a time. However, it is not expected that more than one unit would ever be lined up to receive power concurrently from the GTGs, although procedures exist to provide limited power to two units (not modeled in the PRA). The likelihood of two units experiencing a simultaneous station blackout is remote.

4. The Cooling Tower Make-up and Blowdown system supplies condenser cooling water to all three units to make up for evaporation and blowdown. Its failure would lead to shutdown of all three units. It has redundant pumps powered from redundant power supplies, making it highly reliable. Should it everfail, it would most likely be manifest as a normal shutdown for all three units. At worst, it could lead to loss of condenser vacuum and loss of Plant Cooling Water. It is not required for safe shutdown.

3

Enclosure 1, Attachment 4 Summary of PRA Quality 1.5 PRA Open Items (Impacts)

To evaluate and track items that may lead to a change to the model or its documentation, an "impact review database" is maintained. Dispositions and change records are sent to Nuclear Information Records Management and maintained per the above-mentioned requirements.

1.6 Monitoring Plant Changes Documents used in the development of the PRA are periodically compared to the station document database to identify revisions to referenced documents. Documents that have been revised are then reviewed to determine if there is any impact to the model. When changes are identified they are evaluated using the impact database and process described above.

1.7 PRA Updates Updates to the PRA model to incorporate changes required due to plant changes are typically made every 2 years.

1.8 Software Quality Control PRA software, which include Risk SpectrumTM and MAAP, is verified and controlled in accordance with the PVNGS Non-process Software QA Program, station procedure 80DP-OCC01; along with implementing procedures 80DP-OCCO2, Non-process Qualified Software Development, Process and Upgrades, Ref. 6; and 80DP-OCCO6, Control and Use of Qualified Non-process Software and Data, Ref. 7.

Electronic data and databases are controlled in accordance with station procedure 80DP-OCCO6, Controland Use of Qualified Non-process Software and Data. The databases are stored in a controlled, limited access location. Copies for use are required to be verified against the controlled version.

1.9 Peer Reviews Section 5 describes the external independent reviews and their findings.

The nuclear industry has adopted a PRA Peer Review Process originally developed by the Boiling Water Reactor Owners Group (BWROG). This original BWROG Process was provided to the other owners groups. In a cooperative undertaking, this process was modified by the Westinghouse Owners Group (WOG), the B&WOG and the CEOG to be applicable to both boiling water reactors (BWRs) and pressurized water reactors (PWRs). The result is a common, consistent PRA peer review process that is applicable to any commercial nuclear power plant in the U.S. At the same time, it is flexible enough to incorporate individual owners' group programs to enhance the technical quality and adequacy of the plant PRAs.

Combustion Engineering Owners Group performed a review of the Palo Verde PRA as part of the industry-wide PRA quality initiative in November 1999.

4

Enclosure 1, Attachment 4 Summary of PRA Quality 1.10 CEOG Cross-Comparison Process In 1995, the CEOG Probability Safety Assessment (PSA) Working Group funded the first in a series of five cross-comparison review tasks to identify similarities and differences among CEOG member PRAs and where the results are perceived to be different, to investigate the potential causes for differences. In general, differences in PRA results were attributed to one of the following:

a) Plant specific design or operational differences.

b) Data selection.

c) Selection of success criteria.

d) PRA modeling assumptions and modeling philosophy.

The primary interest of this effort was to highlight areas where additional attention may be desirable as the PRA evolves. Besides the knowledge and insights gained through participation in this activity, the primary product was the identification of areas where additional guidance is required and the development of this guidance is discussed in Section 4.0.

Since that time, the PWR Owners Group has expanded the original Westinghouse database to provide model information on all PWRs to facilitate members' ability to query other facilities' results and modeling methods.

1.11 CEOG PSA Technical Positions CEOG PSA Technical Positions (Standards) and Guidelines were developed to either address a specific application need or were an outgrowth of the results of quality-related tasks, such as the CEOG plant cross-comparison, CEOG risk-informed joint applications, and resolution of PRA issues raised by individual member utilities. Section 4 lists the CEOG Technical Positions and describes the Palo Verde position on each of these documents. The PWR Owners Group is continually addressing model quality issues.

1.12 Continuous Quality Improvement Process The Palo Verde PRA has undergone considerable evolution since the original IPE submittal. The history of the PRA model updates is described in Section 2. A strong level of commitment is demonstrated by this development history.

The Palo Verde PRA staff has been maintained at a level such that nearly all technical work is performed in-house by qualified staff with strong plant-specific knowledge. The PRA Group consists of a supervisor, or Group Leader, one consulting engineer and six senior engineers. Five of these engineers held Senior Reactor Operator (SRO)

Licenses or SRO certification on Palo Verde or other stations. The PVNGS Engineering Support Group collects failure, success, unavailability and plant operating data in support of various plant needs, including the Maintenance Rule and the PRA.

The Palo Verde PRA Group has also actively participated in the industry peer review process. One engineer has participated in every CEOG peer review. This participation 5

Enclosure 1, Attachment 4 Summary of PRA Quality is an effective means of understanding the plant design differences, and an excellent means of seeing the different modeling techniques.

2.0 PVNGS PRA Model Overview Palo Verde uses the large fault tree/small event tree, also known as the linked fault tree, methodology. Basic failure events are modeled down to the component level. Level 1 Core Damage Frequency (CDF) and Level 2 Large Early Release Frequency only (LERF) are fully developed. A Level 3 (Dose Consequence) analysis was done to support the IPE, but has not been maintained.

The Internal Events model consists of twenty-eight (28)-initiating events, which proceed through their respective event trees. Failure branches are assigned a plant damage state (PDS) Core Melt (CM) or Anticipated Transient Without Scram (ATWS) and an appropriate Level 2 damage state. ATWS is modeled in separate event trees. Failure branches in that model are also assigned CM and the appropriate Level 2 PDS. Core Melt is defined as initiation of sustained uncovery of the top of the active fuel.

Internal flooding was analyzed using a screening process for the IPE. That analysis is still considered to be valid. Internal flooding is not currently modeled using event and fault trees. A task is currently underway through EPRI to update the flooding analysis.

External Events were examined as required by Generic Letter (GL) 88-20 Supplement 4, the IPE for External Events (IPEEE). None was analyzed by a fully developed PRA. A full fire PRA has since been developed and incorporated into the PVNGS PRA model.

Only buildings and external areas where a fire could not credibly interfere with normal plant operations were screened from consideration. No compartments within buildings housing plant equipment used for normal power production or emergency operations were screened. There are approximately 135 fire initiating events. These proceed first through fire event trees, which determine potential fire damage states (FDS). Each FDS is then carried through an event tree mimicking the internal events event trees.

CM, ATWS and Level 2 plant damage states are assigned as in the internal events event trees.

The existing PVNGS Level 2 analysis was recently revised (with expert help provided by ERIN engineering) in accordance with the guidelines provided by Westinghouse report WCAP-16341-P, Ref. 10. Westinghouse completed a utility-sponsored project to develop a simplified Level 2 modeling approach that improved the robustness of the level 2 analysis. The method is consistent with NUREG/CR-6595, but with further emphasis on generating the models and data necessary for more realistic treatment of thermal and pressure induced steam generator tube ruptures. Also, more emphasis was placed on operator actions in severe accident management guidance. When combined with plant-specific assessments, the Westinghouse approach is expected to meet theASME PRA Standard capability category I1. Models meeting this level of technical adequacy qualify them for use in risk-informed applications that can support power uprate and license renewal.

6

Enclosure 1, Attachment 4 Summary of PRA Quality 3.0 Palo Verde PRA Development History Numerous revisions to the PVNGS PRA model have been implemented since the Individual Plant Examination was performed. These revisions include thousands of changes to event sequence and fault tree modeling, as well as data changes. Changes to the model and data are made in response to:

• Physical changes to the facility

• Changes to operating and maintenance procedures, as well as administrative controls

" Errors found in reviews of the model, or during its use

• Enhancements where experience has indicated that greater accuracy is needed to remove unnecessarily conservative assumptions Coincident with conversion of the PRA model from Unix-based software and platform to a Windows-based platform using Relcon's Risk Spectrum TM software in 1996, the model was completely rebuilt to enhance documentation and control of the model and associated software. This effort led to the following improvements:

" Equipment failure rates were updated with referenceable sources;

" Control circuit failure analyses were completely re-performed and documented;

" Initiating Event methodology was documented and the initiating events were recalculated and Bayesian-updated;

" Common-cause failure methodology was re-performed and documented;

" Human Recovery Analysis was completely re-performed and documented based on current operating, maintenance, emergency and administrative control procedures;

• System modeling was reviewed and numerous updates made to such systems as Engineered Safety System Actuation, Auxiliary Feedwater, Low and High Pressure Safety Injection, Essential Spray Ponds (ultimate heat sink) and Chemical Volume and Control. Modeling of the non-class 1E electrical distribution systems was expanded to better capture power loss impact on non-class equipment credited in the model.

" Changed the focus of Level 2 modeling to Large Early Release Frequency.

" Since Risk SpectrumTM has extensive documentation capability, all references to station and external documents are included within the PRA database. This allows periodic comparison to the station's document database to identify revision changes.

The following changes represent corrections and enhancements to the model that improve its fidelity and accuracy, but did not necessarily have a significant impact on CDF or LERF:'

Refined modeling of power distribution failures as initiating events to ensure completeness. Definite system boundaries were defined. The two initiators, Loss of Channel A Vital AC and Loss of Channel B Vital AC, were changed to capture all losses of power due to station equipment failure from the Start-up 7

Enclosure 1, Attachment 4 Summary of PRA Quality Transformers, the 13.8KV, 4.16KV and 480VAC distribution systems to the battery chargers and the back-up voltage regulators for the Vital AC system. A more recent change split this initiator into several pieces to better capture where in the distribution systems problems originate that lead to plant trips or shutdowns.

• Updated Human Recovery Analysis (HRA), both to capture procedure changes and to ensure consistent and defensible modeling methodology. The EPRI HRA Calculator is used for new and updated Human Error Probabilities (HEPs).

" Added Reactor Coolant Pump High Pressure Seal Cooler Rupture as an initiating event. This was identified as a potential containment bypass event.

• Improved Steam Generator Tube Rupture modeling as the industry and NRC have addressed this issue. The model now includes multiple tube rupture sequences and pressure-induced tube rupture.

• Data update was performed in 1998 and again in 2006. As more plant-specific data has become available through failure data trending and Maintenance Rule requirements', failure rates for risk-important equipment have been Bayesian-updated. For most equipment included in the scope of the Maintenance Rule, plant-specific unavailability values are used.

• Added more detail to the switchyard modeling to better assess maintenance activities.

• Removed Reactor Coolant Pump seal leakage modeling following Westinghouse evaluation of CE seal designs and acknowledgement of Palo Verde's unique design.

• Added thermally-induced SG tube rupture following steam line break. This had no impact on results, but conforms to the industry standard.

Changes that had a' significant impact on the Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) are summarized below:

" Added modeling of the Station Blackout Gas Turbine Generators (GTGs), which were installed to address the Blackout Rule, 10 CFR 50.46. While the modeling of the GTGs was not credited in the IPE directly, it was used to address and close out USI A-45, which was included as part of the GL 88-20 submittal.

• Refined the GTG modeling to allow success with one GTG rather than requiring both for certain sequences. The'GTGs have an output less than that of the Emergency Diesel Generators. One GTG is not capable of powering both an electric Auxiliary Feedwater Pump and a HPSI pump, along with support equipment. Since most sequences only require AF, and not HPSI, one GTG is adequate for those sequences.

" Change of the test interval for ESFAS relay testing from 62-day to 9-month staggered as a result of a Tech Spec change; resulting common-cause failure value changes were also incorporated. This resulted in a significant increase in both CDF and LERF. At the urging of the PRA group, these test intervals were later shortened to quarterly for the relays associated with Auxiliary Feedwater injection valves. This reduced CDF and LERF by about 10%.

8

Enclosure 1, Attachment 4 Summary of PRA Quality

• Credited an additional check valve in the charging line to remove conservatism in the containment penetration model. This change significantly reduced LERF.

" Removed Loss of Control Room HVAC as an initiating event. This event had been modeled in a highly conservative and unrealistic manner. Since the Control Room is continuously manned, and since at least twelve hours are available before equipment failure temperatures would be reached, it would be virtually certain that either equipment could be repaired or temporary cooling could be established.

• Updated Initiating Event Frequencies in 2001 resulting in significant decreases to Uncomplicated Reactor Trip and Turbine Trip frequencies. The definition of Uncomplicated Reactor Trip (called Miscellaneous Trip in the model) was narrowed to be consistent with the rest of the industry. Previously, all manual shutdowns, including for planned outages, were counted as initiators. This in turn resulted in much lower CDF and LERF, and significantly affected importance measures.

" Addition of the alternate off-site power supply to each ESF bus. This plant feature had not been procedurally allowed due to Technical Specification interpretation.

• Physical plant change adding a redundant power supply to the BOP ESFAS cabinet cooling fans. This change makes spurious load shed actuation much less likely.

• Added alignment of the Gas Turbine Generators to the initiating event trees for loss of off-site power to Train A or B ESF Bus. This provides a more realistic treatment of these initiators.

" Changed the treatment of the Loss of Instrument Air initiating event to allow use of low-pressure condensate (Alternate Feedwater) in its mitigation. This was possible due to removal of an incorrect dependence of the Condensate system on Instrument Air.

" Corrected modeling of spurious load shed. Certain failures had been incorrectly modeled as preventing closure of the Emergency Diesel Generator output breaker.

" Adopted "Alpha factor" common-cause methodology and used NRC Common-Cause database to update common-cause failure probabilities in 2006.

" Updated failure data in 2006.

" Westinghouse guideline (WCAP 16341-P, Ref. 10) developed an approach to bin all level 1 core damage sequences in several plant damage states (PDS). The PDSs are classified in terms of: SBO, non-SBO, Containment bypasss, RCS at High pressure during vessel breach, and RCS at low pressure during vessel breach. Each of the 155 level 1 sequences was binned into the appropriate PDS.

" Similarly, Westinghouse guideline (WCAP 16341-P) developed a containment event tree structure used in developing the level 2 fault tree-structures for SBO and non-SBO cases. Each plant damage state sequence through the containment event tree results in a unique endstate: LERF, small early release (SERF), or LATE release.

9

Enclosure 1, Attachment 4 Summary of PRA Quality Internal Events CDF and LERF have varied significantly as the above changes were implemented. Compared to the IPE, CDF has decreased significantly. Similarly, LERF cannot be compared to the overall Level 2 value presented in the IPE, but compared to when it was first determined in 1998, it has decreased significantly. The LERF results are dominated by Steam Generator Tube Rupture events. When internal events and fire are quantified to the same truncation level, fire contributes about 35% to total CDF and 30% to total LERF.

3.1 Significant Open Items There are no Category A and only one Category B peer review items open following issue of 13-NS-C029 Rev 14. The only remaining one is lack of an internal flooding analysis. No other significant open items exist.

4.0 Combustion Engineering Owners Group Technical Positions 4.1 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for the Loss of Coolant Accident This CEOG PSA Standard is no longer used; LOCA frequencies are based on NUREG/CR-5750, Ref. 8. The NUREG values were used in lieu of the CEOG standard because the NUREG is a more recent document and more publicly available.

4.2 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for Main Steam Line Break Events The CEOG standard is used as the basis for developing large steam and feedwater line break IE frequencies.

4.3 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for Steam Generator Tube Rupture The CEOG standard is used as the basis for calculating the PVNGS SGTR frequency.

4.4 CEOG PSA Standard: Success Criteria for the Minimum Number of Safety Injection Pathways Following Large and Small Break LOCAs for CE PWRs The CEOG standard is used.

4.5 CEOG PSA Standard: Best Estimate ATWS Scenarios and Success Criteria The CEOG standard is used.

4.6 CEOG PSA Standard: Evaluation of the Mechanical Scram Failure for ATWS Occurrence Frequency The CEOG standard is used.

4.7 CEOG PSA Standard: Reactor Coolant Pump Seal Failure Probability Given a Loss of Seal Injection The CEOG standard was used in the development of RCP seal failure probability.

Modeling showed that RCP seal failure is not a significant contributor to CDF or LERF under any circumstances. It was subsequently removed from the model.

10

Enclosure 1, Attachment 4 Summary of PRA Quality 4.8 CEOG PSA Standard: Evaluation of the Initiating Event Frequency for Reactor Vessel Rupture Reactor vessel rupture is not explicitly modeled in the PVNGS PRA. Its frequency is less that 1 E-7/yr allowing it to be screened. It is not possible to mitigate the event, so modeling it provides no insight. Palo Verde's reactor vessel is less susceptible to brittle fracture due to a lower than typical copper content in the steel alloy used for the vessel.

5.0 Independent External Reviews

" As of November 2007, there was no external review of the PRA model to assess the extent it meets the ASME standard and/or Regulatory Guide 1.200. However, as the various PRA Sections and documents are revised, the new revisions have been compared with the reg guide and ASME requirements. For example, revised HRAs are based on the latest revision of the EPRI HRA-Calculator. The anticipated changes to the PRA model from full compliance with 1.200 are not likely to impact the PVNGS containment performance.

" Combustion Engineering Owners Group performed a review of the overall PRA modeling as part of the industry-wide PRA quality initiative in November 1999. All F&Os are addressed in PRA's Impact Database, as well as by the station's Corrective Action Program (CRDR 113787).

• Erin Engineering performed a review of Large Early Release Frequency methodology and results in December 2000.

In early 2001 Erin Engineering reviewed all Category A and B Facts and Observations (F&Os) from the CEOG peer review. The results are as follows:

• Category A - Of the 8 F&Os, 4 were closed based on their responses being deemed satisfactory, and the remaining 4 were later closed by Erin Engineering review.

Category B - Of the 26 F&Os, 25 were closed based on their responses being deemed satisfactory, and one remains an open item as it lacks of flooding analysis results. This one is scheduled to be closed later this year.

11

Enclosure 1, Attachment 4 Summary of PRA Quality 6.0 Internal Events CDF Distribution by Initiator Figure J Internal Events CDF Distribution by Initiator Other (CIg. Wtr., IA, Sec. Line Brk, HVAC, MSIV) Loss of Vital 120VAC 1-9%

Steam Generator Tube Interfacing Sys Rupture tems L 21% 0.0~

Loss of Off-Site Power to Train A or B /

2.8% N ATWS 3.4% .

Loss of ESF Train A or B Bus 20.4%

Loss of Off-Site Power_ -

35% A Uncomplicated Reactor Trips Other LOCAS (Medium and Large) 4.8%  !! x//_1W9%

Loss of Condensate, Feedwater or Vacuum, /

4,9%/

Turbine Trip_

9.1% Station Black out 13-8%

Small Break LOCA 12.3%

7.0 PRA Level 2 Summary The quantification results for the Level 2 analysis using a truncation frequency of 9.OE-13, is 1.49E-05 for all endstates. The slight increase in the Level 2 model total compared to the Level I CDF total is due lower truncation values utilized and to the generation of additional cutsets that are valid on a sequence and release category basis, but are non-minimal in the combined Level 2 results. The following table lists the total for each endstate. Most of the frequency comes from the damage class LATE, which is 90.2% of the total Level 2 frequency. LERF is a distant second with about 6%.

12

Enclosure 1, Attachment 4 Summary of PRA Quality Endstate Frequency Totals Endstate Frequency Percent

_Total INTACT 5.71 E-07 3.8%

LATE 1.34E-05 90.2%

LERF 8.81E-07 5.9%

SERF 0.00E+00 0.0%

TOTAL 1.49E-05 100.0%

8.0 Conclusion The PVNGS PRA model (Revision 14) is suitable for risk-informed applications that can support power uprate, license renewal, on-line risk assessments, and other regulatory risk-informed applications.

9.0 References

1. Station Procedure 70DP-ORA03, PRA Model Control

2. Station Procedure 81 DP-4CC03, EngineeringStudies

3. Reg. Guide 1.33, Quality Assurance Program Requirements

4. Station Procedure 81 DP-OCCO5, Design and Technical Document Control

5. Station Procedure 80DP-OCCO1, PVNGS Non-process Software QA Program

6. Station Procedure 80DP-OCCO2, Non-process Qualified Software Development, Process and Upgrades

7. Station Procedure 80DP-OCCO6, Control and Use of Qualified Non-process Software and Data

8. NUREG/CR-5750, Rates of Initiating Events at'U.S. Nuclear Power Plants: 1987-1995

9. Engineering Study 13-NS-C029, Interim PRA Change Documentation, Rev 14.

10.Westinghouse WCAP 16341-P, Simplified Level 2 modeling guidelines, November 2005.

13

Enclosure 1 Evaluation of Proposed Amendment to TS 5.5.16 ENCLOSURE 1, ATTACHMENT 5 Internal Events Model Self Assessment Evaluation 1

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation 1 Introduction A self assessment was performed on the Palo Verde internal events Probabilistic Risk Assessment (PRA) to evaluate the level of compliance with Reg. Guide 1.200 "An Approach for Determining theTechnical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities". This application is determined to be a Category II application, because numerical results for Core Damage Frequency and Large Early Release Frequency are necessary to determine the risk impact of the requested change and the change is risk-informed, not risk-based. Each of the current PRA supporting requirements (SR) that did not comply with RG 1.200 Category II criteria is listed along with the assessment and evaluation of the non-conforming SR that shows it has no material impact on the ILRT surveillance interval extension request.

2. Initiating Events (IEs) 2.1 Completeness (IE-A)

SR IE-A2: INCLUDE in the spectrum of internal-event challenges considered at least the following general categories:

(a) Transients - INCLUDE among the transients both equipment and human-induced events that disrupt the plant and leave the primary system pressure boundary intact.

(b) LOCAs - INCLUDE in the LOCA category both equipment and human-induced events that disrupt the plant by causing a breach in the core coolant system with a resulting loss of core coolant inventory.

DIFFERENTIATE the LOCA initiators, using a defined rationale for the differentiation. Examples of LOCA types include:

(1) Small LOCAs. Examples: reactor coolant pump seal LOCAs, small pipe breaks.

(2) Medium LOCAs. Examples: stuck open safety or relief valves.

(3) Large LOCAs. Examples: inadvertent ADS, component ruptures.

(4) Excessive LOCAs. (LOCAs that cannot be mitigated by any combination of engineered systems). Example: reactor pressure vessel rupture.

(5) LOCAs Outside Containment. Example: primary system pipe breaks outside containment (BWRs).

(c) SGTRs. INCLUDE spontaneous rupture of a steam generator tube (PWRs).

(d) ISLOCAs. INCLUDE postulated events in systems interfacing with the reactor coolant system that could fail or be operated in such a manner as to result in an uncontrolled loss of core coolant outside the containment [e.g., interfacing systems LOCAs (ISLOCAs)].

(e) Special initiators (e.g., support systems failures, instrument line breaks).

1

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation (f) Internal flooding initiators.

Assessment: There is no internal flood model. All compartments screened out in the Individual Plant Evaluation (IPE).

Evaluation: See Section 6 of this evaluation on Internal Floods.

SR IE-A3a: REVIEW generic analyses of similar plants to assess whether the list of challenges included in the model accounts for industry experience.

Assessment: There is no evidence that similar plants were examined in a search for applicable initiators.

Evaluation: The CE System 80 design is unique; only Waterford-3 and SONGS-2 and -

3 could be considered similar. System 80-specific initiating events were identified in 13-NS-B060 "At-power PRA System Study for Initiators". No open items remain from the peer review Facts & Observations (F&Os). Any missed IEs are extremely unlikely to have a significant impact on the results. Core Damage Frequency (CDF) would have to increase about two orders of magnitude to impact ILRT period extension submittal.

SR IE-A5: In the identification of the initiating events, INCORPORATE:

(a) Events that have occurred at conditions other than at-power operation (i.e.,

during low-power or shutdown conditions), and for which it is determined that the event could also occur during at-power operation.

(b) Events resulting in a controlled shutdown that includes a scram prior to reaching low-power conditions, unless it is determined that an event is not applicable to at-power operation.

Assessment: Only at-power conditions were considered for initiators.

Evaluation: PRA model cross-comparisons were, performed by the Combustion Engineering Owners Group (CEOG). No shutdown lEs were identified as lacking in the PVNGS model. Also, there were no peer review F&Os on this issue. Any missed lEs are extremely unlikely to have a significant impact on the results. CDF would have to increase about two orders of magnitude to impact ILRT period extension submittal.

SR IE-A6: INTERVIEW plant personnel (e.g., operations, maintenance, engineering, safety analysis) to determine if potential initiating events have been overlooked.

Assessment: There is no evidence that interviews were conducted in searching for initiators.

Evaluation: CE System-80 specific initiating events were identified in 13-NS-B060.

These PVNGS-specific initiators were identified through extensive input from System Engineering and Operations personnel. The documentation of that input may be insufficient. As noted in IE-A3 above, this issue was not identified in the peer review, nor would missing lEs be of such magnitude as to affect ILRT interval extension.

2

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation 2.2 Frequency Estimation (IE-C)

SR IE-C4: USE as screening criteria no higher than the following characteristics (or more stringent characteristics as devised by the analyst) to eliminate initiating events or groups from further evaluation:

(a) The frequency of the event is less than 1E-7 per reactor-year (/ry) and the event does not involve an ISLOCA, containment bypass, or reactor pressure vessel rupture.

(b) The frequency of the event is less than 1 E-6/ry and core damage could not occur unless at least two trains of mitigating systems are failed independent of the initiator.

(c) The resulting reactor shutdown is not an immediate occurrence. That is, the event does not require the plant to go to shutdown conditions until sufficient time has expired during which the initiating event conditions, with a high degree of certainty (based on supporting calculations), are detected and corrected before normal plant operation is curtailed (either administratively or automatically).

If either criterion (a) or (b) above is used, then CONFIRM that the value specified in the criterion meets the applicable requirements of the Data Analysis section (para. 4.5.6) and the Level 1 Quantification section (para. 4.5.8) [of ASME PRA Standard RA-Sb-2005, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications"].

Assessment: Reactor vessel rupture is not modeled and some Interfacing System Loss of Coolant Accidents (ISLOCAs) are not screened using the proper criterion (although they would screen out).

Evaluation: Reactor vessel rupture was analyzed. It was concluded that it contributes less than 1E-7/yr to CDF, representing less than 1% of total CDF. Modeling it does not provide any risk insights, since this event cannot be mitigated. For Large Early Release Frequency (LERF) determination, reactor vessel rupture would be binned in PDS3 "NON-SBO, RCS @ HIGH PRESSURE". Per NUREG/CR-6595 "An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events",

the conditional LERF would be 0.1 or less, thus reducing the LERF contribution to less than 1E-8/yr. CDF would have to increase about two orders of magnitude to impact ILRT interval extension submittal. Therefore, there is no impact on ILRT interval extension submittal.

2.3 Documentation (IE-D)

SR IE-D2: DOCUMENT the processes used to select, group, and screen the initiating events and to model and quantify the initiating event frequencies, including the inputs, methods, and results. For example, this documentation typically includes:

(a) The functional categories considered and the specific initiating events included in each.

3

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation (b) The systematic search for plant-unique and plant-specific support system initiators.

(c) The systematic search for RCS pressure boundary failures and interfacing system LOCAs.

(d) The approach for assessing completeness and consistency of initiating events with plant-specific experience, industry experience, other comparable PRAs and FSAR initiating events.

(e) The basis for screening out initiating events.

(f) The basis for grouping and subsuming initiating events.

(g) The dismissal of any observed initiating events, including any credit for recovery.

(h) The derivation of the initiating event frequencies and the recoveries used.

(i) The approach to quantification of each initiating event frequency.

(j) The justification for exclusion of any data.

Assessment: Documentation of a process for systematic searches of interfacing system LOCAs and assessing the completeness and consistency of IEs is not complete.

Evaluation: Interfacing system LOCAs were evaluated, however the process used was not specifically documented. Internal reviews, peer reviews and other PRA applications have not identified any oversights in consideration of interfacing system LOCAs.

SR IE-D3: DOCUMENT the key assumptions and key sources uncertainty with the initiating event analysis.

NRC Issue: All the sources of uncertainty and assumptions that can impact the risk profile of the base PRA need to be documented; see definition of key source of uncertainty for definition of source of uncertainty. Resolution: DOCUMENT the assumptions and sources of uncertainty associated with the initiating event analysis.

Assessment: Documentation of assumptions and uncertainties is not complete.

Evaluation: Many assumptions are documented in the Risk Spectrum database [the PVNGS PRA Model software], as well as the individual system studies, although their completeness is not assured. Assumptions and uncertainties not documented would have to have a very large impact to significantly affect this application. Regarding uncertainties, each initiator was reported as Mean Value and Error Factor (consistent with NUREG/CR-5750 "Rates of Initiating Events at U.S. Nuclear Power Plants"). The Error Factor value for some initiators was used to support PVNGS applications to the NRC. Relevant sensitivity studies are done within the methodology used for this application as discussed in Section 8.0 of Enclosure 1, Attachment 3 of this submittal.

4

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation

3. Accident Sequences 3.1 Documentation (AS-C)

SR AS-Cl: DOCUMENT the accident sequence analysis in a manner that facilitates PRA applications, upgrades, and peer review.

Assessment: There is no current engineering study that provides the information in a format that facilitates easy review. The information in memos inside the Risk Spectrum database contains the necessary information.

Evaluation: The existing memos in the database provide the needed information for an analyst familiar with it to judge its acceptability. No impact on ILRT extension.

SR AS-C2: DOCUMENT the processes used to develop accident sequences and treat dependencies in accident sequences, including the inputs, methods, and results. For example, this documentation typically includes:

(a) The linkage between the modeled initiating event in the Initiating Event Analysis section and the accident sequence model.

(b) The success criteria established for each modeled initiating event including the bases for the criteria (i.e., the system capacities required to mitigate the accident and the necessary components required to achieve these capacities).

(c) A description of the accident progression for each sequence or group of similar sequences (i.e., descriptions of the sequence timing, applicable procedural guidance, expected environmental or phenomenological impacts, dependencies between systems and operator actions, end states, and other pertinent information required to fully establish the sequence of events).

(d) The operator actions reflected in the event trees, and the sequence-specific timing and dependencies that are traceable to the Human Recovery Analysis (HRA) for these actions.

(e) The interface of the accident sequence models with plant damage states.

(f) [When sequences are modeled using a single top event fault tree] the manner in which the requirements for accident sequence analysis have been satisfied.

Assessment: No process is documented for linking initiating events with the accident sequence development, or for ascribing success criteria.

Evaluation: Development of the accident sequences along with success criteria application indicates that a process was followed; however, it was not well documented.

No inappropriate sequence development or success criteria have been identified in internal reviews, peer reviews or in the course of pursuing other PRA applications.

SR AS-C3: DOCUMENT the key assumptions and key sources of uncertainty associated with the accident sequence analysis.

5

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation NRC Issue: "All the sources of uncertainty and assumptions that can impact the risk profile of the base PRA need to be documented; see definition of key source of uncertainty for definition of source of uncertainty.". Position: Clarification. Resolution:

DOCUMENT the {key text deleted} assumptions and {key text deleted} sources of uncertainty associated ....."

Assessment: Same deficiency noted in AS-Cl for assumptions. Sources of uncertainty are not documented.

Evaluation: Many assumptions, which may lead to sources of uncertainty, are documented in the Risk Spectrum database, as well as the individual system studies, although their completeness is not assured. Assumptions and uncertainties not documented would have to have a very large impact to significantly affect this application. None has been identified internally, by peer reviews, or in the course of pursuing other PRA applications.

4. Success Criteria 4.1 Documentation (SC-C)

SR SC-C2: DOCUMENT the processes used to develop overall PRA success criteria and the supporting engineering bases, including the inputs, methods, and results. For example, this documentation typically includes:

(a) The definition of core damage used in the PRA including the bases for any selected parameter value used in the definition (e.g., peak cladding temperature or reactor vessel level).

(b) Calculations (generic and plant-specific) or other references used to establish success criteria, and identification of cases for which they are used.

(c) Identification of computer codes or other methods used to establish plant-specific success criteria.

(d) A description of the limitations (e.g., potential conservatisms or limitations that could challenge the applicability of computer models in certain cases) of the calculations or codes.

(e) The uses of expert judgment within the PRA, and rationale for such uses.

(f) A summary of success criteria for the available mitigating systems and human actions for each accident initiating group modeled in the PRA (g) the basis for establishing the time available for human actions.

(h) Descriptions of processes used to define success criteria for grouped initiating events or accident sequences.

Assessment: No basis for the definition of core damage used is provided. Also, no process is defined for success criteria applied to grouped initiators.

6

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation Evaluation: Although PVNGS uses the generalized definition of Core Damage as "Sustained uncovery of any portion of the active fuel", onset of core damage is specifically defined in 13-NS-B065 "At-Power PRA MAAP 4.0.4 Analysis" as Modular Accident Analysis Program (MAAP) variable TCRHOT "Hottest Core Node Temperature" greater than 2200F, when the cladding begins to relocate. Success criteria are seldom linked to actual core damage (which begins about 0.5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after beginning of core uncovery). This provides a conservative time estimate to support mitigating system recovery or HRA timing analyses. MAAP simulations have consistently indicated core damage initiating after TCRHOT > 2200F.

Regarding a process not defined for success criteria applied to grouped initiators, it is clear a process was used, but not well documented. The major basis for grouping lEs is that plant behavior is similar, which directly implies similar success criteria.

SR SC-C3: DOCUMENT the key assumptions and key sources of uncertainty associated with the development of success criteria.

NRC Issue: DOCUMENT the assumptions and sources of uncertainty associated...

(deleted the works "key")

Assessment: Sources of uncertainty are not addressed.

Evaluation: Many assumptions, which may lead to sources of uncertainty, are documented in the Risk Spectrum database, as well as the individual system studies, although their completeness is not assured. Assumptions and uncertainties not documented would have to have a very large impact to significantly affect this application. None has been identified internally, by peer reviews, or in the course of pursuing other PRA applications.

5. Systems Analysis 5.1 Completeness (SY-A)

SR SY-A4: PERFORM plant walkdowns and interviews with system engineers and plant operators to confirm that the systems analysis correctly reflects the as-built, as-operated plant.

Assessment: Walkdowns and interviews either were not conducted or not documented.

Evaluation: Although not documented, system engineers reviewed the fault tree modeling for their systems and provided comments and input to the PRA analysts. The PRA analysts were also knowledgeable in plant layout and operations, both normal and emergency. There is no impact on ILRT extension.

5.2 Documentation (SY-C)

SR SY-CI: DOCUMENT the systems analysis in a manner that facilitates PRA applications, upgrades, and peer review.

7

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation Assessment: System studies have not been updated for several revisions of the model.

Although the memos in Risk Spectrum are maintained current and are linked to the appropriate parameter, this cannot be said to facilitate applications, upgrades and reviews Evaluation: Changes are captured in impacts contained in 13-NS-C029. While this makes review difficult, it is still possible. Furthermore, system boundaries, functions and success criteria have been further defined for Maintenance Rule documentation and compliance. No actual shortcomings that would impact this application have been discovered internally or through peer reviews.

SR SY-C2: DOCUMENT the system functions and boundary, the associated success criteria, the modeled components and failure modes including human actions, and a description of modeled dependencies including support system and common cause failures, including the inputs, methods, and results. For example, this documentation

-typically includes:

(a) System function and operation under normal and emergency operations.

(b) System model boundary.

(c) System schematic illustrating all equipment and components necessary for system operation.

(d) Information and calculations to support equipment operability considerations and assumptions.

(e) Actual operational history indicating any past problems in the system operation.

(f) System success criteria and relationship to accident sequence models.

(g) Human actions necessary for operation of system.

(h) Reference to system-related test and maintenance procedures.

(i) System dependencies and shared component interface.

(j) Component spatial information.

(k) Assumptions or simplifications made in development of the system models.

(I) The components and failure modes included in the model and justification for any exclusion of components and failure modes.

(m) A description of the modularization process (if used).

(n) Records of resolution of logic loops developed during fault tree linking (if used).

(o) Results of the system model evaluations.

(p) Results of sensitivity studies (if used).

(q) The sources of the above information (e.g., completed checklist from walkdowns, notes from discussions with plant personnel):

8

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation (r) Basic events in the system fault trees so that they are traceable to modules and to cutsets.

(s) The nomenclature used in the system models.

Assessment: Several of the required elements of this SR are missing or incomplete, even in the memos in the Risk Spectrum database.

Evaluation: Elements of this SR are addressed in various locations. What is missing is a single concise document that captures all of the elements.

SR SY-C3: DOCUMENT the key assumptions and key sources uncertainty associated with the systems analysis.

NRC Issue: DOCUMENT the assumptions and sources of uncertainty associated....

(deleted the works "key")

Assessment: Documentation of assumptions is in the form of memos within Risk Spectrum, which does not afford ease of review. Assumptions are incomplete. Sources of uncertainty are not addressed.

Evaluation: Many assumptions, which may lead to sources of uncertainty, are documented in the Risk Spectrum database, as well as the individual system studies, although their completeness is not assured. Assumptions and uncertainties not documented would have to have a very large impact to significantly affect this application. None has been identified internally, by peer reviews, or in the course of pursuing other PRA applications.

6. Internal Flooding All IF SRs: There is no internal flood model; no supporting requirements are met.

Evaluation: A screening process was used to comply with GL88-20, "Individual Plant Examination of External Events for Severe Accident Vulnerabilities". All compartments screened out. The highly compartmentalized design of the plant reduces the likelihood of flooding affecting more than one train of mitigating equipment. Work is currently underway to perform a flood PRA. To date, no information that contradicts the IPE has been identified. PVNGS design is post-1975 when flooding issues were generically identified and incorporated into design. CDF contribution of internal flooding is expected to be minimal. CDF would have to increase about two orders of magnitude to impact ILRT period extension application.

7. Quantification 7.1 Core Damage Frequency Quantification (QU-A)

SR QU-A2b: ESTIMATE the mean CDF from internal events, accounting for the "state-of- knowledge" correlation between event probabilities when significant.

NRC Issue: Category I1: ESTIMATE the mean CDF from internal events, accounting for the "state-of knowledge" correlation between event probabilities [phrase "when significant" deleted]. (RG 1.200 Rev 1) 9

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation Assessment: State of knowledge correlation is neither discussed nor addressed.

Evaluation: The theory behind State of knowledge correlation was established in a research paper in 1981. The main principle is that the product of two failure probabilities for some basic events in the same cutset may be smaller than the combined probability that would be estimated by means of Monte Carlo Trials. The component and human error failure data reported in the early 1980s were characterized as "best estimates" such as NUREG/CR 1278 "Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications" human failure data. The PVNGS PRA model treated the older failure data as median values from a Log-Normal distribution, converted the data into mean values for CDF and LERF quantifications.

The conversion into mean values adequately compensates for any short-coming in the state of knowledge correlation.

7.2 Results Analyses (QU-D)

SR QU-D3: COMPARE results to those from similar plants and IDENTIFY causes for significant differences. For example: Why is LOCA a large contributor for one plant and not another?

Assessment: No recent comparison to similar plants' results is documented, although the owners group did perform this comparison several years ago. Resources to compare current plants' results are not available.

Evaluation: Significant changes to the PRA model that impacted CDF and LERF have been introduced by means of common industry initiatives (such as Westinghouse's LERF guidance, and EPRI Human Recovery Analysis (HRA) Calculator applications) with input from a variety of plants. Other changes (such as Common Cause Failures) were introduced as a result of NRC and/or EPRI initiatives. This type of PRA model evolution improves and preserves consistency between PRA models.

7.3 Uncertainty Characterization (QU-E)

SR QU-Ei: IDENTIFY key sources of model uncertainty.

NRC Issue: IDENTIFY [deleted word "key"] sources of uncertainty. (RG 1.200 Rev 1)

Assessment: Sources of uncertainty are not provided.

Evaluation: All failure data used in the PRA model includes the upper bound values (9 5 th percentiles). Applications to the NRC that contain risk support usually include risk assessments with the most relevant failure data used at their upper bound values.

Section 8.3 of Enclosure 1, Attachment 3 of this submittal contains sensitivity analysis for use of EPRI representative plant consequence measures.

SR QU-E2: IDENTIFY key assumptions made in the development of the PRA model.

NRC Issue: IDENTIFY [deleted word "key"] assumptions made in the development of the PRA model. (RG 1.200 Rev 1)

Assessment: There is no systematic approach to ensure completeness of the assumptions used in development of the model.

10

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation Evaluation: The model assumptions were peer reviewed and validated internally. The documentation of completeness may be improved. No impact on ILRT period extension application.

SR QU-E3: ESTIMATE the uncertainty interval of the overall CDF results. ESTIMATE the uncertainty intervals associated with parameter uncertainties (DA-D3, HR-D6, HR-G9, IE-C13), taking into account the "state-of-knowledge" correlation Assessment: Uncertainty is not quantified.

Evaluation: The latest EPRI and NEI methodologies were used in the risk analysis supporting the ILRT submittal. Table 8-1 of Enclosure I, Attachment 3 of this submittal shows risk impact results with substantial margins below a 1% increase in integrated risk. More than three orders of magnitude increase in PRA model CDF and LERF risk measures are required to push the tabled results above the significance level of 1%.

Section 8.3 of Enclosure I, Attachment 3 of this submittal contains sensitivity analysis for use of EPRI representative plant consequence measures. Therefore, there is no impact on ILRT period extension application.

SR QU-E4: EVALUATE the sensitivity of the results to key model uncertainties and key assumptions using sensitivity analyses [Note (1)].

NRC Issue: Category I1: EVALUATE the sensitivity of the results to [delete word "key"]

model uncertainties.... (RG 1.200 Rev 1)

Assessment: No sensitivity on assumptions and uncertainties has been done.

Evaluation: The latest EPRI and NEI methodologies were used in the risk analysis supporting the ILRT submittal. In Enclosure 1, Attachment 3 of this submittal Table 8-1 shows risk impact results with substantial margins below a 1 % increase in integrated risk. More than three orders of magnitude increase in PRA model CDF and LERF risk measures are required for the results to exceed a significance level of 1%. Section 8.3 of Enclosure 1, Attachment 3 of this submittal contains sensitivity analysis for use of EPRI representative plant consequence measures.

7.4 Documentation (QU-F)

SR QU-FI: DOCUMENT the model quantification in a manner that facilitates PRA applications, upgrades, and peer review.

Assessment: Shortcomings identified in assumptions and uncertainties do not allow proper documentation of them.

Evaluation: Many assumptions, which may lead to sources of uncertainty, are documented in the Risk Spectrum database, as well as the individual system studies, although their completeness is not assured. Assumptions and uncertainties not documented would have to have a very large impact to significantly affect this application. None has been identified internally, by peer reviews, or in the course of pursuing other PRA applications.

11

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation SR QU-F2: DOCUMENT the model integration process, including any recovery analysis, and the results of the quantification including uncertainty and sensitivity analyses. For example, documentation typically includes:

(a) Records of the process/results when adding non-recovery terms as part of the final quantification.

(b) Records of the cutset review process.

(c) A general description of the quantification process including accounting for systems successes; the truncation values used; how recovery and post-initiator Human Failure Events (HFE)s are applied.

(d) The process and results for establishing the truncation screening values for final quantification demonstrating that convergence towards a stable result was achieved.

(e) The total plant CDF and contributions from the different initiating events and accident classes.

(f) The accident sequences and their contributing cutsets.

(g) Equipment or human actions that are the key factors in causing the accidents to be non-dominant.

(h) The results of all sensitivity studies.

(i) The uncertainty distribution for the total CDF.

(j) Importance measure results.

(k) A list of mutually exclusive events eliminated from the resulting cutsets and their bases for elimination.

(I) Asymmetries in quantitative modeling to provide application users the necessary understanding regarding why such asymmetries are present in the model (m) The process used to illustrate the computer code(s) used to perform the quantification will yield correct results process.

NRC Issue: (g) Equipment or human actions that are the key factors in causing the accidents sequences to be [replaced term "non-dominant" with "non-significant"] non-significant. (RG 1.200 Rev 1)

Assessment: The review process is not documented; factors in causing accidents to be non-dominant is not discussed; sensitivity and uncertainty analyses are not performed; a list of mutually exclusive events eliminated from the resulting cutsets and their bases for elimination is not provided.

Evaluation: While there is no procedural guidance regarding review, reviews are conducted for each model update. Several of these requirements are discussed in other areas, such as sequence analysis and initiating events. Lack of sensitivity and uncertainty analyses are addressed elsewhere in this document. Lack of this 12

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation documentation is not expected to have any significant impact on the results of the PRA in general, nor specifically to the ILRT interval extension application.

SR QU-F4: DOCUMENT key assumptions and key sources of uncertainty, such as:

possible optimistic or conservative success criteria, suitability of the reliability data, possible modeling uncertainties (modeling limitations due to the method selected),

degree of completeness in the selection of initiating events, possible spatial dependencies, etc.

NRC Issue: DOCUMENT the [deleted word "key"] assumptions and [deleted word "key"] sources of uncertainty associated with the quantification analysis. [delete phrase

", such as: possible optimistic or conservative success criteria, suitability of the reliability data, possible modeling uncertainties (modeling limitations due to the method selected),

degree of completeness in the selection of initiating events, possible spatial dependencies, etc."] (RG 1.200 Rev 1)

Assessment: Assumptions and uncertainties impact to the results are not documented.

Evaluation: See QU-F2 above.

SR QU-F5: DOCUMENT limitations in the quantification process that would impact applications.

Assessment: Limitations in the quantification process are not discussed.

Evaluation: No limitations in the quantification process are known.

SR QU-F6: DOCUMENT the quantitative definition used for significant basic event, significant cutset, significant accident sequence. If other than the definition used in Section 2 [of ASME PRA Standard RA-Sb-2005, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications,"] JUSTIFY the alternative.

Assessment: No quantitative definition of "significant" is provided.

Evaluation: Importance analysis is performed on basic events, where the typical Risk Achievement Worth (RAW) and Fussell-Vesely cut-off values of 2.0 and 5E-3, respectively, are applied. Those results, along with top cutsets, are provided and discussed in the quantification results study, 13-NS-C029. The fact that "significant" is not given a value does not affect the results as applied to the ILRT interval extension.

8. LERF Analysis 8.1 Accident Progression Analysis Sequence Delineation (LE-C)

SR LE-C2b: REVIEW significant accident progression sequences resulting in a large early release to determine if repair of equipment can be credited. JUSTIFY credit given for repair [i.e., ensure that plant conditions do not preclude repair and actuarial data exists from which to estimate the repair failure probability (see SY-A22, DA-C14, and DA-D8)]. AC power recovery based on generic data applicable to the plant is acceptable.

13

.Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation Assessment: This Category II SR was not part of PVNGS LERF described in EN002-A00060 "Development of a Level 2 Model for Palo Verde Nuclear Generating Station" and associated WCAP-16241-P "Simplified Level 2 Modeling Guidelines".

Evaluation: Only Loss of Offsite Power (LOOP) recoveries are credited with failure probabilities supported by biennial EPRI publications. A fresh review of accident sequences is not likely to lead to any other repair credit that can be supported by industry and/or NRC initiatives. The relatively low LERF results do not warrant pursuing equipment recovery analysis. No negative impact on CDF or LERF. There is no negative impact on containment performance regarding the ILRT extension submittal.

SR LE-C8b: REVIEW significant accident progression sequences resulting in a large early release to determine if engineering analyses can support continued equipment operation or operator actions during accident progression that could reduce LERF. USE conservative or a combination of conservative and realistic treatment for non-significant accident progression sequences.

Assessment: No equipment review was done.

Evaluation: Severe Accident Management Guidance (SAMG) actions were reviewed in the guidance WCAP-16341-P, but none were implemented in the updated LERF analysis. The support received from ERIN Engineering personnel indicated that other credits from SAMG guidance include a higher degree of uncertainty. The relatively low LERF results do not warrant pursuing equipment recovery analysis. There is no negative impact on CDF or LERF. There is no negative impact on containment performance regarding the ILRT extension submittal.

SR LE-C9b: REVIEW significant accident progression sequences resulting in a large early release to determine if engineering analyses can support continued equipment operation or operator actions after containment failure that could reduce LERF. USE conservative or a combination of conservative and realistic treatment for non-significant accident progression sequences.

Assessment: No'such LERF review was done.

Evaluation: Post containment failure actions include a high degree on uncertainty, however none were credited. There is no negative impact on CDF or LERF. There may be a small positive impact on late releases.

8.2 Results Review And Characterization (LE-F)

SR LE-F2: PROVIDE uncertainty analysis that identifies the key sources of uncertainty and includes sensitivity studies for the significant contributors to LERF.

Assessment: Guidance for uncertainty analyses was provided in WCAP-16341-P. The Erin Engineering Report, EN002-A00060, provided sensitivity analyses of LERF contributors in Table 13. EN002-A00060 did not provide sufficient evidence to indicate that sources of LERF contributor uncertainties were identified.

Evaluation: Application-specific uncertainty analyses are provided with each licensing application submittal, as appropriate (Section 8.3 of Enclosure 1, Attachment 3 of this 14

Enclosure 1, Attachment 5 Internal Events Model Self Assessment Evaluation risk support submittal). There is no negative impact on containment performance regarding the ILRT extension submittal.

SR LE-F3: IDENTIFY contributors to LERF and characterize LERF uncertainties consistent with the applicable requirements of Tables 4.5.8-2(d) and 4.5.8-2(e).[in ASME PRA Standard RA-Sb-2005, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications."] NOTE: The supporting requirements in these tables are written in CDF language. Under this requirement, the applicable requirements of Table 4.5.8 should be interpreted based on LERF, including characterizing key modeling uncertainties associated with the applicable contributors from Table 4.5.9-3 [in ASME PRA Standard RA-Sb-2005, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications."] For example, supporting requirement QU-D5 addresses the significant contributors to CDF. Under this requirement, the contributors would be identified based on their contribution to LERF.

Assessment: The sensitivity to early containment failure probability is provided in Table 13 of EN002-A00060. No other uncertainties were developed in the updated LERF.

Evaluation: Application-specific uncertainty analyses are provided with each licensing application submittal, as appropriate (Section 8.3 of the ILRT risk support submittal).

There is no negative impact on containment performance regarding the ILRT extension submittal.

8.3 Documentation (LE-G)

SR LE-G4: DOCUMENT key assumptions and key sources of uncertainty associated with the LERF analysis, including results and important insights from sensitivity studies.

NRC Issue: ISSUE: All the sources of uncertainty and assumptions that can impact the risk profile of the base PRA need to be documented; see definition of key source of uncertainty for definition of source of uncertainty. RESOLUTION: DOCUMENT the assumptions and sources of uncertainty associated Assessment: Sensitivity study was presented for early containment failure probability.

No other uncertainty or sensitivity was documented.

Evaluation: Many assumptions, which may lead to sources of uncertainty, are documented in the Risk Spectrum database, as well as the individual system studies, although their completeness is not assured. Assumptions and uncertainties not documented would have to have a very large impact to significantly affect this application. None has been identified internally, by peer 'reviews, or in the course of pursuing other PRA applications.

15

Enclosure 2 Responses to NRC Questions to the Industry ENCLOSURE 2 Responses to NRC Questions to the Industry

Enclosure 2 Responses to NRC Questions to the Industry

1. NRC Request:

Does the approach used to assess the risk impact of the integrated leakage rate test interval extension follow Section 2.2.4, Acceptance Guidelines, of RG 1.174?

That document provides the risk acceptance guidelines are intended for comparison with a full scope risk assessment including internal and external events. If not, consistent with this guidance, and to the extent supportable by available risk models for PVNGS, provide an assessment of the impact of the requested change on delta LERF and total LERF when external events are included in the assessment.

APS Comment:

External hazards were evaluated in the Palo Verde Individual Plant Examination of External Events (IPEEE) Submittal [B-2] in response to the NRC IPEEE Program (Generic Letter 88-20 Supplement 4). The IPEEE Program was a one-time review of external hazard risk to identify potential plant vulnerabilities and to understand severe accident risks. Although the external event hazards in the Palo Verde IPEEE were evaluated to varying levels of conservatism, the results of the Palo Verde IPEEE are nonetheless used in this risk assessment as a sensitivity study to provide a conservative comparison of the impact of external hazards on the conclusions of this ILRT interval extension risk assessment.

The proposed ILRT interval extension impacts plant risk in a limited way.

Specifically, the probability of a pre-existing containment leak being the initial containment failure mode given a core damage accident is potentially higher when the ILRT interval is extended. This impact is manifested in the plant risk profile in a similar manner for both internal events and external events.

The spectrum of external hazards has been evaluated in the Palo Verde IPEEE by screening methods with varying levels of conservatism. Therefore, it is not possible at this time to incorporate a realistic quantitative risk assessment of all external event hazards into the ILRT extension assessment. As a result, external events have been evaluated as a sensitivity case to show that the conclusions of this analysis would not be altered if external events were explicitly considered.

Reference Enclosure 1, Attachment 3, Appendix B.

2. NRC Request:

What areas of the containment vessel surfaces have been identified as having measurable degradation (other than coating irregularities), and characterize the findings of evaluations of those areas.

APS Comment:

There are no areas identified at PVNGS as having measurable degradation. The IWE program provides a list of areas/locations that are designated as augmented in accordance with the requirements of IWE-1240 and IWE-2420. None were 1

Enclosure 2 Responses to NRC Questions to the Industry identified in the initial program and there are currently no areas/locations subject to augmented inspection at PVNGS.

Reference Enclosure 1, Page 14.

3. NRC Request:

Describe the un-inspectable areas of PVNGS containments and the programs used to monitor their conditions. Provide a quantitative assessment of the impact on the LERF due to age-related degradation in these areas APS Comment:

The inaccessible areas of the containment liner are as follows:

The 1/4 inch thick steel liner on top of the basemat is protected by a 2 foot 9 inch thick concrete filler slab that supports the containment internals and forms the floor of the containment. There is a reactor pit cavity in the basemat under the reactor vessel. The containment liner in the reactor pit cavity and the recirculation sumps is covered with 6" of concrete.

The 1/4 inch thick steel liner located adjacent to the refueling canal is inaccessible.

However, any leakage into the annulus area from the refueling pool or transfer canal will be detected on the 80' elevation.

As required by 10 CFR 50.55a (b)(2)(ix)(A) an evaluation of the acceptability of inaccessible areas will be completed whenever conditions exist in accessible areas that could indicate the presence of or result in degradation to such inaccessible areas.

The impact on LERF due to age-related degradation is addressed in Attachment 3, Appendix A, Effect of Age-Related Degradation on Risk Impact Assessment for Extending Containment Type A Test Interval.

Reference Enclosure 1, Pages 13 and 14.

4. NRC Request:

Is there a seismic contribution input evaluated in the risk assessment for this extension? If not justify why it is not included.

APS Comment:

The Palo Verde IPEEE assessment [B-2] documented the performance and results of a focused scope Seismic Margins Assessment (SMA) following the guidance of NUREG-1407 and EPRI NP-6041. The SMA is a deterministic process which does not-calculate risk on a probabilistic basis.

Although probabilistic risk information is not directly available from the Palo Verde SMA IPEEE analysis, Reference [B-i] provides a method (called the 2

Enclosure 2 Responses to NRC Questions to the Industry Simplified Hybrid Method) for obtaining a seismically-induced hazard estimate (in terms of CDF) based on the results of a SMA analysis. Reference [B-I] has shown that only the plant HCLPF (High Confidence Low Probability of Failure) seismic capacity is required in order to estimate the seismic CDF within a precision of approximately a factor of two. This approach, which has been used in previous NRC submittals, is described in Enclosure 1, Attachment 3, Appendix B.

5. NRC Request:

Please provide an assessment of the impact of observed liner corrosion/thinning at the moisture barrier on the containment vessel (i.e., the probability of containment over-pressure failure as a function of containment pressure).

Discuss any relationship between those portions of the vessel affected by observed corrosion.

APS Comment:

A moisture barrier is not utilized in the design of the interface between the containment liner and the concrete basemat at PVNGS.

One hundred percent (100%) of the accessible areas of the containment basemat, including areas that might allow water to penetrate to the liner plate below are inspected each inspection period by the IWE program.

There are no areas identified as having measurable degradation. The IWE program provides a list of areas/locations that are designated as augmented in accordance with the requirements of IWE-1240 and IWE-2420. None were identified in the initial program and there are currently no areas/locations subject to augmented inspection at PVNGS.

Reference Enclosure 1, Page 21.

6. NRC Request:

The submittal provides that the increase in LERF associated with a change in test frequency from 1 test in 10 years to 1 test in 15 years is 2.6E-7/year when both internal and external events are considered. Provide the corresponding risk result assuming a change in test frequency from 3 tests in 10 years to 1 test in 15 years.

APS Comment:

The Palo Verde submittal includes increase in risk contribution from reducing the ILRT test frequency from 3-per-10-year (baseline) frequency to once-per-10 years and once-per-15 years.

Reference Enclosure 1, Attachment 3.

3

Enclosure 2 Responses to NRC Questions to the Industry

7. NRC Request:

For the examination of penetration seals and gaskets, and examination and testing of bolted connections associated with the primary containment pressure boundary, the licensee requested relief from the requirements of the code. As an alternative, the licensee proposed to examine the above items during the leak-rate testing of the primary containment. Option B of Appendix J for Type B and Type C testing (peo" Nuclear Energy Institute ('NEI) 94-01 and Regulatory Guide (RG) 1.163), and the integrated leakage rate test extension requested in this amendment for Type A testing, provide flexibility, in the scheduling of these inspections. Discuss your schedule for examination and testing of seals, gaskets, and bolted connections that provide assurance regarding the integrity of the containment pressure boundary.

APS Comment:

There are seven (7) NRC approved alternatives to Subsection IWE requirements approved for PVNGS. Relief Requests RR-E1 and RR-E3 are the only relief requests that are associated with the Containment Leakage Rate Testing Program. Relief Request RR-E1, Torque/Tension Testing of Bolted Connections and Relief Request RR-E3, Seals and Gaskets as discussed in Enclosure 1, Pages 13, 14 and 15 The schedule for this testing is discussed in Enclosure 1, Pages 14 and 15 4