ML092440433

Attachment 2 - License Amendment Request 249, Kewaunee Power Station Conversion to Improved Technical Specifications, Background and Technical Analysis for Adoption of WCAP-10271, WCAP-14333 (TSTF-418), and WCAP-15376 (TSTF-411)

ML092440433
Person / Time
Site:	Kewaunee
Issue date:	08/24/2009
From:	Dominion Energy Kewaunee
To:	Office of Nuclear Reactor Regulation
References
09-491
Download: ML092440433 (31)

Text

Serial No.09-491 ATTACHMENT 2 LICENSE AMENDMENT REQUEST 249 KEWAUNEE POWER STATION CONVERSION TO IMPROVED TECHNICAL SPECIFICATIONS BACKGROUND AND TECHNICAL ANALYSIS FOR ADOPTION OF WCAP-10271, WCAP-14333 (TSTF-418), AND WCAP-15376 (TSTF-411)

KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 1 of 30 ATTACHMENT 2 OUTLINE

3.0 TECHNICAL ANALYSIS

3.1 Current Design 3.2 Basis for the Change 3.3 Technical Evaluation for Changes in WCAP-10271-P-A 3.4 Technical Evaluation for Changes in WCAP-14333-P-A 3.5 Technical Analysis for Changes in WCAP-15376-P-A 3.5.1 Tier 1, Core Damage Frequency Assessment 3.5.2 Tier 1, Incremental Conditional Core Damage Probability 3.5.3 Tier 1, Large Early Release Frequency Assessment 3.5.4 Tier 1, Incremental Conditional Large Early Release Probability Assessment 3.5.5 Tier 1, PRA Scope and Quality 3.5.5.1 Scope of the PRA Model 3.5.5.2 Technical Adequacy 3.5.5.3 Internal Events 3.5.5.4 Peer Review 3.5.5.5 Self Assessments 3.5.5.6 External Events 3.5.5.7 Seismic PRA 3.5.5.8 Fire PRA Model 3.5.5.9 PRA Maintenance and Update 3.5.5.10 Conclusions on PRA Technical Adequacy and Scope 3.5.6 Tier 1, Cumulative Impacts 3.5.7 Tier 2, Avoidance of Risk-Significant Plant Configurations 3.5.8 Tier 3, Risk-Informed Plant Configuration Control and Management 3.5.9 WCAP-15376 SER Conditions 3.5.10 Additional Commitment from NRC RAI

4.0 REFERENCES

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 2 of 30 BACKGROUND AND TECHNICAL ANALYSIS FOR ADOPTION OF WCAP-10271, WCAP-14333 (TSTF-418), AND WCAP-15376 (TSTF-411)

1.0 BACKGROUND

In the early 1980s, in response to growing concerns regarding the impact of the current testing and maintenance requirements on plant operation, the Westinghouse Owners Group (WOG) initiated a program to develop a justification to be used to revise generic and plant specific instrumentation TS (part of the Technical Specification Optimization Program (TOPS)). Operating plants experienced many inadvertent reactor trips and safeguards actuations during performance of instrumentation surveillances, causing unnecessary transients and challenges to safety systems. Significant time and effort on the part of the operating staff was devoted to performing, reviewing, documenting, and tracking the various surveillance activities, which in many instances seemed unwarranted based on the high reliability of the equipment. Significant benefits for operating plants appeared to be achievable through revision of instrumentation test and maintenance requirements. The results of the WOG studies, and the recommended changes to the testing of reactor protection and engineered safeguards instrumentation, were documented in WCAP-10271-P-A and WCAP-10271-P-A, Supplement 1, both titled, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System," (references 1 and 2), and in WCAP-10271-P-A, Supplement 2, Revision 1, "Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Features Actuation System," (reference 3).

In February 1985, the Nuclear Regulatory Commission (NRC) issued the safety evaluation report (SER) (reference 4) for WCAP-10271 and WCAP-10271 , Supplement

1. The SER approved quarterly testing, six hours to place a failed channel in a tripped mode, increased completion times (CTs) (also referred to as allowed outage times (AOTs)) for test and maintenance, and testing in bypass for analog channels of the reactor trip system (RTS) (reactor protection system (RPS) at Kewaunee). The quarterly testing had to be conducted on a staggered basis. The SER specifically stated that for analog channels shared by the RTS and the engineered safety feature actuation system (ESFAS), the approved relaxations applied only to the RTS function.

On March 20, 1986, the WOG submitted WCAP-10271, Supplement 2, "Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Systems Actuation System." On May 12, 1987, the WOG submitted WCAP-10271, Supplement 2, Revision 1. Supplement 2 and Supplement 2, Revision 1 specifically demonstrated the applicability of the justification contained in WCAP-10271 to the ESFAS for two, three, and four loop plants with either relay or solid state protection systems. In February 1989, the NRC issued an SER for WCAP-10271, Supplement 2 and WCAP-10271, Supplement 2, Revision 1 (reference 5). The SER approved quarterly testing, six hours to place a failed channel in a tripped mode, increased CTs for test and maintenance and testing in bypass for analog channels of the ESFAS. Staggered

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 3 of 30 testing was not required for ESFAS analog channels and the requirement was removed from the RTS analog channels.

The NRC issued a Supplemental SER (SSER) for WCAP-10271, Supplement 2 and Supplement 2, Revision 1 (reference 6) on April 30, 1990. With the issuance of the SER and SSER, the relaxations for the analog channels of the RTS and ESFAS were the same. Additionally, the CTs for test and maintenance of the RTS and ESFAS actuation logic were also the same.

In 1992, the NRC completed an evaluation of surveillance testing at power, which indicated that testing in many areas could be reduced without any significant decrease in safety. These findings and recommendations are documented in NUREG-1366, "Improvement to Technical Specifications Surveillance Requirements," (reference 7) and Generic Letter 93-05, "Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operation" (reference 8).

Reduced surveillance testing of the RPS and ESFAS analog instrumentation was recommended in both of these documents.

In June 1995, the WOG submitted WCAP-14333, "Probabilistic Risk Analysis of the RTS and ESFAS Test Times and Completion Times," Revision O. The report proposed further relaxation of the WCAP-10271 approved TS requirements by increasing the test bypass times (BTs) and the CTs for both the solid state protection system and relay protection system RTS and ESFAS designs.

In WCAP-14333, the WOG evaluated the impact on core damage frequency (CDF) and public risk of additional time for testing and extended CTs for the RPS and ESFAS. The additional time allowance was an extension from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for the test CT for analog channels, an extension from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for the allowed bypass time for analog channels, a CT change from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for logic cabinet, and a CT change from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the master relays. This WCAP did not propose additional extensions of any surveillance test intervals (STls). On July 15, 1998, the NRC completed a review of WCAP-14333, Revision 1 (reference 9) for reference in license applications contingent on meeting conditions listed in the NRC SER (reference 10). The WOG issued implementation guidance for WCAP-14333 on December 2, 1998 (reference 11).

By letter dated November 8, 2000, the WOG submitted WCAP-15376, Revision 0, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times." Topical Report WCAP-15376 provides the technical justification for increasing the CT and bypass time (BT) for the reactor trip breaker (RTB). It also provides the justification for increasing the surveillance test interval for the RTB, analog channels, and logic cabinets for components of the RTS and ESFAS. The approach used in this topical report is consistent with the NRC approach for using probabilistic risk assessment in risk-

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 4 of 30 informed decisions on plant specific changes to the current licensing basis as presented in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis,"

(reference 12) and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," (reference 13).

The NRC approved WCAP-15376 for referencing in license change submittals on December 20, 2002 (reference 14). The WOG issued implementation guidance for WCAP-15376 on April 3, 2003 (reference 15). The WOG reissued the implementation guidance with slight editorial changes on May 6, 2004 (reference 16).

The NRC required that applicants for TS amendments concerning all of the above WCAPs meet certain plant specific conditions. The plant specific conditions are stipulated in the SERs and SSER for all WCAP and supplements discussed above.

DEK addresses the stipulated conditions of WCAP-10271 and WCAP-14333 SERs and SSER for Kewaunee in the technical analysis below since the stipulated plant specific conditions of the previous reports constitute a basis for the changes evaluated in WCAP-15376. The evaluations are presented in Section 2.0 under the appropriate WCAP heading.

2.0 PROPOSED CHANGE

DEK is proposing to convert the Kewaunee current Technical Speciations (CTS) to a format and content consistent with NUREG 1431, Revision 3.0, Standard Technical Specifications - Westinghouse Plants. The specific proposed changes are identified and explained in Attachment 1.

3.0 TECHNICAL ANALYSIS

3.1 Current Design The Reactor Protection System (RPS) continuously monitors selected process variables associated with fission product design barrier limits that define the boundaries for safe reactor power operation. The RPS trips the reactor and returns the core to a subcritical condition if the value of any single monitored process variable approaches its associated barrier design limits.

The system consists of electronic equipment (circuitry, cables, relays, etc.) necessary to monitor the selected process variables and to generate the reactor trip signals when a design limit is challenged. If a reactor trip is required, two reactor trip breakers are actuated by two separate logic matrices that interrupt power to the control rod drive

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 5 of 30 mechanisms (CRDMs). Opening either reactor trip breaker interrupts power to all CRDMs, allowing them to free fall into the core. The RPS also monitors other plant systems for conditions or events that could cause barrier design limits to be challenged.

The RPS is designed for high functional reliability and in-service testability to avoid undue risk to the health and safety of the public. Tests are made by use of signal substitution techniques during power operation without negating reactor protection.

Removal of one trip channel is accomplished by placing that channel in the tripped mode. Therefore, a two-out-of-three channel becomes a one-out-of-two channel when testing. Redundancy and independence designed into the RPS must be sufficient to ensure that no single failure or removal from service of any component or channel of the system results in a loss of the protection function. The redundancy provided must include, as a minimum, two channels of protection for each protection function to be served.

3.2 Basis for the Change The technical basis for the proposed changes to the completion times, bypass times, STIs, and the RTB CT includes the Westinghouse Owners Group (WOG) studies documented in the originals, supplements, and revisions of WCAP-10271, WCAP-14333, and WCAP-15376 (references 1, 2, 3, 9, and 17), which have all been reviewed and approved by the NRC staff. Additionally, the NRC staff recommended the TS be changed in NUREG-1366, Improvements to Technical Specifications Surveillance Requirements, (reference 7) and GL 93-05, Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing during Power Operation, (reference 8). Standard TS Change Travelers (TSTF-411 and TSTF-418),

which incorporate the changes from WCAP-14333 and WCAP-15376 into Standard Technical Specifications (STS), have been issued by the Nuclear Energy Institute (NEI) and reviewed and approved by the NRC (references 18 and 19).

The STI, CT, and bypass time changes in WCAP-10271 were justified for a large number of RPS and ESFAS signals that are common to most plants. The STIs, CTs, and bypass times for signals not specifically addressed in WCAP-10271 cannot be changed based on WCAP-10271 without a plant specific technical justification. DEK reviewed WCAP-10271 to ensure the signal applicability and found that two logic configurations required plant specific justification to apply WCAP-10271. The following technical justifications allow applying the changes justified in WCAP-10271, and subsequently WCAP-14333 and WCAP-15376, to the two configurations described below:

1. Low Flow Both Loops (Kewaunee Table TS 3.5-2, item number 10)

WCAP-10271, Supplement 1, Table 3.2-3, Results of Fault Tree Analysis for A Relay Logic Reactor Protection System, does not address the loss of flow in both loops trip for a two loop plant. For Kewaunees configuration, the logic is

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 6 of 30 2 of 3 in 2 of 2 loops, a failure in either loop would cause a failure to trip. Thus, the failure to trip probability can be calculated by doubling the value for an individual loop, which is documented in Table 3.2-3 of the WCAP. The following shows the results of this justification:

Table 3.1 Failure to Trip Probability for Comparison Base Case, no CC(1) Case 1, no CC Base Case, CC Case 1, CC 1.5E-4 3.8E-4 3.2E-4 6.4E-4 (1) CC = common cause These values are still within the range of the signals in Table 3.2-3 of the WCAP.

The bases for the conclusions of WCAP-10271, Supplement 1 (less than a factor of six increase with no common cause and less than a factor of four increase with common cause) apply to this signal as well. Therefore, the conclusion of WCAP-10271, Supplement 1, that an increase of surveillance interval is acceptable, applies to the Kewaunee low flow both loops trip as well.

2. Containment Spray (Table TS 3.5-3, item number 3.b)

The containment spray logic in the WCAP-10271, Supplement 2 analysis is two-out-of-four, whereas the logic at Kewaunee is one-out-of-two three times. An increase in the failure probability of the containment spray signal is of very little consequence at Kewaunee due to robust design of Kewaunees large dry containment. In the current Kewaunee PRA model, a complete failure of the containment spray system has no effect on core damage frequency (CDF) or large early release frequency (LERF). As a result, the failure of the initiating signal for containment spray has no effect on CDF or LERF and an increased surveillance interval is of very little consequence at Kewaunee.

Based on the above, the two Kewaunee specific configurations are justified to be of low risk significance. The changes justified in WCAP-10271, and subsequently in WCAP-14333 and WCAP-15376, can be applied to Kewaunee.

Implementation of the proposed changes does not reduce safety. The proposed STI changes will reduce the required testing on the RPS and ESFAS components without significantly impacting their reliability, and reduce the potential for reactor trips and actuation of engineered safety features associated with more frequent testing of these components. The CT extension for the RTBs provides additional time to complete test and maintenance activities while at power, potentially reducing the number of forced outages related to compliance with the RTB TS. Additionally, NUREG-1366 and Generic Letter (GL) 93-05 both support this proposed change by stating that safety can be improved, equipment degradation decreased, and unnecessary burden on personnel

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 7 of 30 and resources eliminated by reducing the amount of testing that the TS require during power operation.

3.3 Technical Evaluation for Changes in WCAP-10271-P-A In February 1985, the NRC issued the SER (reference 4) for WCAP-10271 and WCAP-10271, Supplement 1. In February 1989, the NRC issued the SER for WCAP-10271, Supplement 2 and WCAP-10271, Supplement 2, Revision 1 (reference 5). The following table provides a summary of the changes from WCAP-10271 and its supplements.

Table 3.2 Summary of WCAP-10271 (TOP) RTS and ESFAS Surveillance Test Interval, Completion Time, and Bypass Time Changes - Relay Protection Systems Component STI Completion Time Bypass Time Analog Channel 1 month to 3 months 1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Logic Cabinet No change 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Master Relay No change No change 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Slave Relay No change No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Reactor Trip No change No change No change Breakers In WCAP-10271, and its supplements (references 1, 2, and 3), the WOG evaluated the impact of increased STIs and CTs and their effect on CDF and public risk. The NRC staff concluded in its evaluation that an overall upper bound of CDF increase due to the proposed STI and CT changes is less than six percent for Westinghouse pressurized water reactor (PWR) plants. The NRC also concluded actual CDF increases for individual plants were expected to be substantially less than six percent. The NRC staff considered this CDF increase to be small compared to the range of uncertainty in the CDF analyses and, therefore, was acceptable.

To incorporate the extended times from WCAP-10271 and its supplements, the NRC required that an applicant for a TS amendment meet certain plant specific conditions stipulated in the SERs and SSER. The five conditions in the NRC SER dated February 21, 1985 (reference 4) were to be applied to RPS instrumentation. The two conditions in the NRC SER and SSER dated February 22, 1989 (reference 5), and April 30, 1990 (reference 6), were to be applied to the ESFAS instrumentation.

The generically approved changes to the analog channel STIs, CTs, and BTs specified in WCAP-10271, including its supplements, have not been amended into the Kewaunee TS. DEK has addressed each SER condition below since these stipulated plant specific conditions constitute part of the basis for the changes evaluated in WCAP-15376 (specifically, the analog channel STI from one month to three months is adopted with Kewaunees proposed change from one month to six months).

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 8 of 30

1. The RPS SER requires the use of a staggered test plan for the RPS channels changed to the quarterly testing frequency.

DEK Response: The NRC staff subsequently concluded that a staggered test strategy need not be implemented for ESFAS analog channel testing and is no longer required for RPS analog channel testing (reference 5). This NRC conclusion was based on the small relative contribution of the analog channels to RPS/ESFAS unavailability, process parameter signal diversity, and normal operational channel testing spacing.

2. The RPS SER requires that plant procedures require a common cause evaluation for failures in the RPS analog channels changed to quarterly testing frequency and additional testing for plausible common cause failures.

DEK Response: In accordance with Kewaunees Corrective Action Program (CAP), and existing plant procedures, all equipment operability concerns (including equipment in the RPS and ESFAS) are immediately reported to the Shift Manager and entered into the corrective action process. Initiation of a condition report (CR) results in entry into the CAP. In the CAP, the request is screened for operability and reportability as well as a determination of the conditions significance. If the significance of the condition reaches a level requiring an apparent cause evaluation (ACE) to be performed, an extent of condition evaluation is also performed.

The extent of condition evaluation describes how the problem (condition) extends to other equipment, procedures, processes or organizations (the condition is the identified problem/event). This review identifies the susceptible population (people, equipment, or processes) that could potentially be affected and then determines if they actually are affected. The intent is to identify additional vulnerabilities and take prompt corrective action prior to the onset of additional consequences.

A review of Kewaunees procedures determined that a failure in the RPS analog channel may not cause an ACE to be performed and that Kewaunee procedures do not contain direction to perform additional testing for plausible common cause failures.

On implementation of a license amendment approving extension of these STIs, DEK will add procedure direction to perform an extent of condition evaluation and perform additional testing for plausible common failure modes (refer to attachment 5, commitment 8).

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 9 of 30

3. The RPS SER requires installed hardware capability for testing in the bypass mode. That approval of routine channel testing in a bypassed condition is contingent on the capability of the RPS design to allow such testing without lifting leads or installing temporary jumpers.

DEK Response: Kewaunees RPS is designed to test analog channels in the trip mode. Testing is performed by placing the channel being tested in the tripped mode rather than bypassing the channel. The result is the logic being reduced to one-out-of-two logic for a two-out-of-three logic channel and one-out-of-three logic for a two-out-of-four logic channel. If a channel failure occurs, and the failed channel is not the one being tested, the logic is reduced to one-out-of-one. This logic results in permitting the remaining operable channel to trip the reactor if necessary. A channel failing to a trip condition during testing of another channel results in a reactor trip.

Testing in bypass is allowed by TS 3.5.b and TS 3.5.d for a short period of time (approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) for on-line testing or in the event of failure of a subsystem instrumentation channel where the failed channel must be blocked to prevent unnecessary reactor trip. The TS would apply during a maintenance activity. Therefore, it is acceptable to use temporary jumpers as required to complete testing. The TS is not routinely entered for surveillance testing.

4. The RPS SER indicated that, for channels that provide input to both the RPS and the ESFAS, the more stringent ESFAS requirements still apply.

DEK Response: The extensions generically approved in the SER and SSER for the ESFAS analog channels (references 5 and 6) were the same as those approved for the RPS analog channels. Therefore, this condition from the RPS SER is no longer applicable.

5. The RPS SER requires confirmation that the instrument setpoint methodology includes sufficient margin to offset the drift anticipated as a result of less frequent surveillance.

DEK Response: This condition of WCAP-10271 is also a stipulated condition of WCAP-15376 and is addressed in the technical analysis of WCAP-15376.

6. The ESFAS SER and SSER required confirmation of the applicability of the generic analyses to the plant.

DEK Response: The generic analyses used in WCAP-10271 and its supplements are applicable to Kewaunee. Kewaunee Power Station uses the Foxboro H-Line Process Control System and the Westinghouse Relay Protection System for both the Engineered Safety Features and Reactor Protection System.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 10 of 30 Both of these systems were modeled in the generic analyses. For logic configurations not modeled in the generic analysis, DEK has provided a technical justification for applying the generic changes to Kewaunee. Additionally, information provided in attachments 3 (proprietary) and 4 (non-proprietary) demonstrates the applicability of the generic WCAP analysis to Kewaunees ESFAS and RPS. These tables are based on implementation guidelines that were issued by the WOG for licensees implementing the TS CT and BT changes that were justified in WCAP-14333 and the STI and CT changes justified in WCAP-15376.

7. The ESFAS SER and SSER required confirmation that any increase in instrument drift due to the extended STIs is properly accounted for in the setpoint calculation methodology.

DEK Response: This condition of WCAP-10271 is also a stipulated condition of WCAP-15376 and is addressed in the technical analysis of WCAP-15376.

3.4 Technical Evaluation for Changes in WCAP-14333-P-A In WCAP-14333, the WOG proposed and justified further extensions of the RPS and ESFAS CTs and BTs. This WCAP did not propose additional extensions of any STIs.

The NRC approved these generic CT and BT extensions in an SER dated July 15, 1998 (reference 10). The table below summarizes the changes evaluated in WCAP-14333.

Table 3.3 Summary of WCAP-14333 RPS and ESFAS Completion Time and Bypass Test Time Changes - Relay Protection Systems Component STI Completion Time Bypass Time Analog Channel No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 4 hours to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Logic Cabinet No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> No change Master Relay No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> No change Slave Relay No change 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> No change Reactor Trip No change No change No change Breakers The SER for WCAP-14333 indicated that the increase in CDF and LERF for those plants that have not implemented the changes evaluated in WCAP-10271, and its supplements, is small. Specifically, for two-out-of-three and two-out-of-four logic, the increases in CDF are approximately 3.1 percent and 2.3 percent, respectively. The LERF would increase by only four percent for both two-out-of-three and two-out-of-four logic schemes. The NRC staff concluded the implementation of the changes specified in WCAP-14333 would result in a very small quantitative impact on plant risk.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 11 of 30 The NRC staff required that an applicant for a proposed amendment incorporating the extended times into their TS must meet certain plant specific conditions stipulated in the SER. DEK has addressed each of the conditions stipulated in the WCAP-14333 SER below.

1. Confirm the applicability of the WCAP-14333 analyses for the plant.

DEK Response: The information provided in attachment 3 (proprietary) and 4 (non-proprietary) demonstrates the applicability of the generic WCAP-14333 and WCAP-15376 analysis to Kewaunee. The tables in the attachments are from the implementation guidelines issued by the WOG for licensees implementing the TS changes supported by the WCAPs.

2. Address the Tier 2 and 3 analyses including the Configuration Risk Management Program (CRMP) insights which confirm that these insights are incorporated into the decision making process before taking equipment out of service.

DEK Response: This stipulated condition is addressed below in the technical analysis section for WCAP-15376.

3.5 Technical Analysis for Changes in WCAP-15376-P-A In WCAP-15376, the WOG provided the technical basis to justify extending the STIs for the analog channels, the logic cabinets, and RTBs, and for extending the CT and BT for the RTBs. The NRC approved WCAP-15376 on December 20, 2002 (reference 14).

The table below summarizes the changes evaluated in WCAP-15376.

Table 3.4 Summary of WCAP-15376 RPS and ESFAS Surveillance Test Frequency, Completion Time, and Bypass Test Time Changes - Relay Protection Systems Component STI Completion Time Bypass Time Analog Channel 3 months to 6 No change No change months Logic Cabinet 1 month to 6 months No change No change Master Relay No change No change No change Slave Relay No change No change No change Reactor Trip 2 months to 4 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Breakers months The Kewaunee STIs or test frequencies are closely aligned with the pre-technical specification optimization program (pre-TOP) values since the extensions generically approved in WCAP-10271, its supplements, and WCAP-14333 have not been

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 12 of 30 incorporated into the Kewaunee TS. The tables below compare the current Kewaunee TS times with the pre-TOP times, and the WCAP-15376 times (i.e., the proposed TS times).

Table 3.5 STI Comparison for KEWAUNEE Component Current STI Pre-TOP STI WCAP-15376 (Proposed TS)

Analog Channels 1 month 1 month 6 months Logic Cabinets 1 month 2 months 6 months Reactor Trip 1 month 2 months 4 months(a)

Breakers Note:

(a) DEK will not include the RTB STI change because the WCAP analysis for this change is not applicable to Kewaunee.

Table 3.6 CT Comparison for KEWAUNEE Component Current TS Pre-TOP WCAP-15376 (Proposed TS)

Reactor Trip Breakers 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />(a) 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Note:

(a) The current Kewaunee TS does not provide for a restoration time.

The risk-informed approach used in WCAP-15376 is consistent with the NRC approach for using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the current licensing basis. The NRCs approach is presented in RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis, (reference 12) and RG 1.177, An Approach for Plant-Specific, Risk-Informed Decision making: Technical Specifications, (reference 13). The risk evaluation considers the three-tiered approach as presented in RG 1.177. Tier 1, PRA Capabilities and Insights, assesses the impact of the proposed CT (AOT) change on CDF, incremental conditional core damage probability (ICCDP), LERF, and incremental conditional large early release probability (ICLERP). Tier 2, Avoidance of Risk-Significant Plant Configurations, considers potential risk-significant plant operating configurations. Tier 3, Risk-Informed Plant Configuration Control and Management, considers risk evaluations of configurations when entered on a plant-specific basis.

3.5.1 Tier 1, Core Damage Frequency Assessment WCAP-15376 compares the cumulative impact of the proposed STI changes and the RTB CT changes on CDF using the pre-TOP values as the basis. This comparison

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 13 of 30 credits the expected reduction in reactor trips due to the reduced analog channel testing resulting from extending the analog channel STIs from monthly to quarterly, as evaluated in WCAP-10271 and its supplements. The comparison indicates that the cumulative impact on CDF when using the pre-TOP values as the base case is 5.7E-7 per year for two-out-of-four logic and 1.1E-6 per year for two-out-of-three logic. These values are for the reference plant. They are applicable to Kewaunee because the Kewaunee parameters are within the limits described in WCAP-15376. They are conservative because they assume an increase in the STI for reactor trip breakers, which is not being implemented at Kewaunee. Since the Kewaunee parameters in attachments 3 (proprietary) and 4 (non-proprietary) are bounding for Kewaunee, the Kewaunee values for the change in core damage frequency (CDF) are less than or equal to the reference plant values. These are small increases to the CDF, per the acceptance criteria of 1.0E-5 per year given in RG 1.174.

The reference plant values are for internal events only. Internal fires and external events have been evaluated on a plant specific basis and the results follow. The frequency of a seismic event is several orders of magnitude below that of a reactor trip.

Furthermore, the RPS is seismically designed so its failure rate would also be very low.

As a result, the seismic initiator is not important to anticipated transient without scram (ATWS). A seismic event that would result in the need for engineered safety feature (ESF) actuation (e.g., a LOCA) would be extremely unlikely. As a result, ESF actuation is also not important to the seismic event. The Kewaunee seismic PRA shows that instrumentation has a very high seismic capacity. As a result, the impact of this change on seismic risk is negligible.

The frequency of an internal fire is also several orders of magnitude below that of a reactor trip. The combined frequency of a fire and an ATWS would be very small compared to the internal events ATWS frequency. If a severe fire occurs, affecting the ability to shut down safely, operators are directed to enter operating procedures OP-KW-AOP-FP-002, Fire in an Alternate Zone or OP-KW-AOP-FP-003, Fire in a Dedicated Zone. These procedures do not rely on ESF actuation, but on manual action to start all necessary equipment.

Other external events, (high winds, flooding, etc.) were evaluated in the Kewaunee individual plant evaluation for external events and determined to be unimportant due to their low initiating event frequency. The frequency of these initiators is not affected by the proposed changes.

The overall CDF for the internal events average maintenance model used in this assessment is 4.2E-05/yr. As stated in Reference 20 the external events CDF is 4.7E-05/yr. Thus, the total CDF is 8.9E-05/yr. Since the CDF is less than 1.0E-05/yr and the total CDF is less than 1.0E-04/yr, the increase is within Region II of Figure 3 of RG 1.174. Therefore, the proposed changes are acceptable.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 14 of 30 3.5.2 Tier 1, Incremental Conditional Core Damage Probability The ICCDP calculations are a direct function of the duration of a CT, and therefore, only apply to the CT change for the reactor trip breakers. Calculations were performed considering two CTs; 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> for maintenance and 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for a test. The resulting calculated values were below 5.0E-07 for both CTs. The WCAP-15376 calculation of the ICCDP increase for the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> CT (i.e., the proposed CT for Kewaunee) was 6.92E-08, which is below the RG 1.174 value of 5.0E-07. They are applicable to Kewaunee because the Kewaunee parameters are within the limits described in WCAP-15376.

Since the Kewaunee parameters in attachments 3 (proprietary) and 4 (non-proprietary) are bounding for Kewaunee, the Kewaunee value for the ICCDP is less than or equal to the reference plant values. This is considered very small for a single TS CT per RG 1.177.

3.5.3 Tier 1, Large Early Release Frequency Assessment The WCAP-15376 base case used LERF values of 2.38E-06 per year for two-out-of-four logic and 2.44E-06 per year for two-out-of-three logic. WCAP-15376 documented the combined impact on LERF due to the changes proposed by the WCAP. The LERF impact was an increase of 3.09E-08 per year for two-out-of-four logic and 5.68E-08 for two-out-of-three logic. They are applicable to Kewaunee because the Kewaunee parameters are within the limits described in WCAP-15376. Since the Kewaunee parameters in attachments 3 (proprietary) and 4 (non-proprietary) are bounding for Kewaunee, the Kewaunee value for the change in large early release frequency (LERF) is less than or equal to the reference plant values. These increases in LERF are very small based on the RG 1.174 guidance of 1.0E-07 per year.

The overall LERF for the internal events average maintenance model used in this assessment is 4.8E-06/yr. As stated in Reference 20 the external events LERF is 5.2E-06/yr. Thus, the total LERF is 1.0E-05/yr. Since the LERF is less than 1.0E-07/yr and the total LERF is not significantly greater than 1.0E-05/yr, the increase is within Region III of Figure 4 of RG 1.174. Therefore, the proposed changes are acceptable.

3.5.4 Tier 1, Incremental Conditional Large Early Release Probability Assessment Detailed calculations to determine the impact on ICLERP for the proposed changes are not required. For the proposed changes, ICLERP calculations only apply to the RTBs because they are the only components for which the CT is being extended. Reactor trip breakers are used to mitigate core damage, not containment failure. Reactor trip breakers success or failure has no direct impact on the functioning of containment systems. Large releases are related to containment bypass events, containment isolation failures, and containment failures. Reactor trip breaker success or failure has no direct effect on these functions. The extended RTB CT will result in a slight increase

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 15 of 30 in frequency of some core damage sequences. The LERF will increase only in direct proportion to the increased frequency of core damage sequences involving RTB failures because the success or failure of the containment systems is independent of the reactor trip breakers. Therefore, because the impact of the reactor trip breaker CT increase on CDF and LERF is small and the ICCDP is acceptable, the ICLERP will also be acceptable.

WCAP-15376, Revision 1, does contain calculated values for ICLERP for an RTB out of service. The calculation was used to answer an NRC request for additional information (RAI) (reference 6) during the review of the WCAP. The ICLERP assuming an RTB out of service for the full duration of a completion time was incorporated into the WCAP report.

3.5.5 Tier 1, PRA Scope and Quality 3.5.5.1 Scope of the PRA Model The Kewaunee PRA model used in this evaluation is a Level 1 and Level 2 PRA model that addresses internal events at full power. The LERF figure of merit is calculated using the full Level 2 PRA model.

The Kewaunee PRA model was developed to support the Individual Plant Examination in 1992 and the Individual Plant Examination for External Events (IPEEE) in 1994.

3.5.5.2 Technical Adequacy RG 1.177 (reference 13) provides a framework for the risk evaluation of proposed changes to surveillance intervals. RG 1.177 requires identification of the risk contribution from the impacted surveillances, determination of the risk impact due to the proposed change to the surveillance interval, and performance of sensitivity and uncertainty evaluations. Regulatory Position 2.3.1 of RG 1.177 states that PRA quality must be compatible with the safety implications of the TS change being requested. The use of the Kewaunee model for this submittal is limited to the following:

1. The total CDF and LERF are used to determine acceptability under RG 1.174 (reference 21)

2. The Level 2 model is used to show that containment spray is not important.

3. The ATWS model is used to compare with the reference model in Attachment 3.

4. The transient frequency is used to compare with the reference model in Enclosure 2.

5. The ATWS and ESF models are used to calculate the plant specific risk of concurrent testing of a logic cabinet and the associated reactor trip breaker.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 16 of 30 This assessment was done to ensure that those portions of the model used for the calculations listed above meet the requirements of RG 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.

3.5.5.3 Internal Events Since 1994, updates have been made to incorporate plant and procedure changes, update plant-specific reliability and unavailability data, improve the fidelity of the model, incorporate Westinghouse Owners Group (WOG) Peer Review comments, and support other applications, such as On-line Maintenance, Risk-Informed In-Service Inspection (RI-ISI), Maintenance Rule Risk Significance, and Mitigating System Performance Index (MSPI).

The enhancements to the Kewaunee PRA model include a major internal flooding update and a number of updates to the Level 2 PRA model to allow a more realistic assessment of the LERF figure of merit.

3.5.5.4 Peer Review Peer Review (Certification) of the Kewaunee PRA model, using the WOG Peer Review Certification Guidelines, was performed in June 2002 (reference 22). The Peer Review found 54 significant issues (A and B Facts and Observations (F&Os)). On the basis of its evaluation, the Certification Team determined that, with A and B F&Os addressed, the technical adequacy of all elements of the PRA would be sufficient to support risk significant evaluations with defense-in-depth input. All of the F&Os except two B level F&Os have been addressed. The following is a summary of the open F&Os and their potential impact on the risk insights provided in support of this application.

• IE Loss of ventilation initiating event is not well discussed. This F&O is a documentation issue, does not impact the model logic, and does not have an impact on the proposed amendment.

• TH HVAC calculations need to be revised. The peer review identified that the HVAC calculation for AFW room was overly conservative in nature. This conservatism may result in an early failure assumption of components and result in a higher CDF. The overall effect is added conservatism to the calculations that support the proposed amendment.

3.5.5.5 Self Assessments In addition to the Peer Review, Kewaunee performed an assessment of PRA quality in support of the MSPI implementation. The following is a summary of section 3.2, Technical Adequacy of the Kewaunee PRA, from the MSPI basis document (reference 23).

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 17 of 30

• The Kewaunee PRA results for the Emergency Diesel Generator, Auxiliary Feedwater, High Pressure Safety Injection, and Service Water systems were identified as having appropriate component importance with respect to similar plants, as assessed by Westinghouse in the MSPI Cross Comparison in WCAP-16464-NP.

• The Low Pressure Safety Injection (Residual Heat Removal) MSPI system was identified as an outlier in the MSPI cross-comparison because the Birnbaum importance is lower than that of similar plants. The reason for the lower Birnbaum importance is because initiation of containment sump recirculation requires manual alignment of valves by operators. Human error probabilities dominate over equipment failures. Additionally, containment sump strainer plugging, although a low probability, also has an impact on CDF. Thus, the probability of operators failing to align for containment sump recirculation or containment sump strainers plugging is higher than the probability of the monitored components failing. Since the human error and containment sump strainers plugging probabilities dominate, the monitored component Birnbaum values are appropriate for Kewaunee.

Additionally, in January 2008, an independent assessment of Kewaunee PRA K107A, released in August of 2007, against RG 1.200, Revision 1 (Reference 24) was performed. The assessment was conducted by a team of experts with experience in performing NEI PRA Certifications and ASME PRA Standard Reviews. The assessment included a review of the DEK PRA procedures, current documentation notebooks, and other associated documentation.

The scope of this assessment was to compare the current PRA against the ASME standard (ASME RA-Sa-2003) to determine if each of the requirements of Capability Category II had been met and sufficiently documented. The assessment identified a number of Supporting Requirements (SRs) that did not meet Capability Category II requirements. The NOT MET characterization was conservatively assigned to an SR if one or more apparent documentation or modeling issue(s) could not be readily disposed of, even if the overall analysis had been found to be appropriate. Due to the scope of (i.e., focus on Capability Category II) and conservative nature of the initial assessment, the NOT MET SRs were reviewed to:

1. Determine if "NOT-MET" Category II SRs would meet Capability Category I requirements and would therefore affect the CDF or LERF determination.

2. Determine if "NOT-MET" Category II SRs would affect model portions 2 through 5 from section 3.5.5.2 above.

3. Identify those NOT-MET SRs that do not have an impact on the risk insights provided in support of this proposed amendment (e.g., documentation only issues).

4. Identify potential sensitivity studies that can be performed to ensure that the risk insights are not significantly affected by the NOT MET findings.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 18 of 30 Based on this review, it was determined that:

1. A number of SRs that did not meet Capability Category II requirements may not meet Capability Category I requirements, since the applicable requirement applied to both capability categories.

2. Of those SRs that meet No.1 above, none were determined to have an impact on CDF and LERF based on one or more of the following:

a. The potential issue was documentation only.

b. The potential issue was assessed to have no impact on the CDF/LERF estimate. For example, AS-A6 SR is characterized as NOT-MET because reviewers found that, although the sequence of top events shown on the Kewaunee event trees appears to follow the expected accident sequence, the High Pressure Injection (HPI) node in the Station Blackout (SBO) event trees is placed immediately after the initiating event (prior to the secondary decay heat removal node).

This issue was assessed to have a minimal impact on the CDF/LERF results on the basis that the ordering of the top events; 1) was determined by the original reviewers to be adequate in almost all cases, and; 2) in one instance the reviewers indicated that the order may not be justified. However, based on discussion with the plant PRA Engineer and a sensitivity run, the order does not change the CDF/LERF results.

c. The potential issue impacts very low frequency events, such as a LOCA with sequence with loss of containment sump recirculation. As a result, the impact on the overall CDF/LERF estimate is assessed to be negligible.

d. The potential issue could be eliminated based on formal inquiries to the ASME requirements. For example, AS-A6 SR is characterized as NOT-MET partially because reviewers found that the initiating event screening discounts initiators based on whether a plant trip occurs. The reviewers believe that the Failure Modes and Effects Analysis (FMEA) should instead use the screening criteria stated by AS-A6 SR, and a system or train loss that requires shutdown within a relatively short time-frame due to TS requirements (e.g., within six and potentially up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), should be modeled as an IE. However, based on inquiry Record Number 07-213, the risk from such an event needs to be captured in a transition risk or low power risk.

3. The assessment of model portions 2 through 6 resulted in the following findings:

a. The NOT MET Category II SRs pertaining to the Level 2 model do not affect the determination that containment spray does not contribute to CDF or LERF.

b. The NOT MET Category II SRs pertaining to initiating events do not affect the calculation of the transient frequency.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 19 of 30

c. The NOT MET Category II SRs pertaining to initiating events do not affect the modeling of ESF signals.

d. There is one NOT-MET Category II SR pertaining to the ATWS model that has a potential to affect this analysis and required a model change to be made. This change is discussed below.

Two major changes to the internal events portion of the Kewaunee PRA model occurred between the January 2008 independent assessment and this assessment (re-evaluation of the contribution of internal flooding hazard and recalculation of the HEPs). Both of these major changes occurred after the January 2008 independent assessment was performed. These were the same changes included in the model used for the 2008 integrated leak rate testing interval extension submittal (Reference 25).

Neither of the above changes was made to address a specific finding/issue raised as a result of the aforementioned independent assessment. The changes were made to address the independent assessment in areas of PRA model fidelity with respect to the as built/as operated plant and realistic estimation of human error failure probabilities.

In addition to the changes discussed above, an additional change was made to address a NOT-MET Category II SR. Supporting requirement AS-A11 from ASME RA-Sa-2003 states in part, USE a method for implementing an event tree transfer that preserves the dependencies that are part of the transferred sequence. Contrary to this, the model had transferred all initiators except large LOCA and flooding directly to the ATWS event tree upon failure of a reactor trip. The self-assessment pointed out that the ATWS analysis assumes a transient and no LOCA ATWS or steam line break ATWS has been analyzed. To conservatively address this issue in this analysis, failure of the reactor to trip is assumed to result in core damage for the following initiating events: medium break LOCA, small break LOCA, steam generator tube rupture, interfacing systems LOCA, and steam line break. Flooding events with a failure to trip the reactor had previously been modeled as resulting in core damage. Large LOCAs, due to the large negative reactivity due to voiding in the core, had been modeled as not requiring a reactor trip. Therefore, no change was made to the flooding or large LOCA model.

The model is current as of September of 2008. An assessment was made of design and procedure changes since then and none have an impact on the model.

3.5.5.6 External Events The Kewaunee PRA model used in this evaluation is a full scope Level 1 and Level 2 PRA model that addresses internal, seismic, and fire events at full power except where otherwise stated.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 20 of 30 3.5.5.7 Seismic PRA The main elements of a seismic PRA are the seismic hazard evaluation, structure and component fragility analysis, plant logic analysis, and event tree quantification. A summary of each of these risk assessment elements is provided below.

1. The seismic hazard evaluation provides Kewaunee-specific seismic hazard levels and the probable frequency of occurrence.

2. The structure and component fragility analysis provides unique fragility curves for the components and structures assessed in the PRA model.

3. The seismic plant logic analysis determines the consequence of various structural and component failures. This logic is added to the general transient event trees developed for the internal events PRA, as used in the Individual Plant Examination (IPE) report.

4. The seismic event tree quantification determines the CDF and LERF by quantifying the frequencies of various sequences, combinations of system failures, that result in core damage.

Note that, compared with the internal events analysis, the seismic PRA is very conservative on the basis that:

1. Almost all non-safety related components and systems (e.g., Main Feedwater System) were assumed to fail during a seismic event with probability of 1.0.

2. Almost all elements of the internal events analysis have been updated several times whereas only some elements of the seismic PRA have been updated (e.g.,

fragility or hazard curves have not been updated). More recent hazard curves indicate significantly lower frequencies.

3. Recovery of damaged components is not considered in the Kewaunee seismic PRA.

4. The correlation of damage between systems is not evaluated. The current model conservatively assumes multiple concurrent component failures given a specific seismic event.

Therefore, the estimate of the seismic hazard to the CDF and LERF figure of merit is considered conservative. However, the CDF and LERF estimates are also judged to be acceptable for the proposed amendment on the basis that a conservative estimate of CDF and LERF would result in a more restrictive region in RG 1.174.

3.5.5.8 Fire PRA Model The fire PRA model was developed to support the IPEEE study. The fire analysis was based on a combination of a PRA and an EPRl fire-induced vulnerability evaluation (FIVE) approach. A screening study, based on plant walkdowns and the FIVE approach

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 21 of 30 was used, and for the areas that passed screening a full PRA was used. Based on a review of the Kewaunee IPEEE submittal, the NRC staff concluded that Kewaunees IPEEE process was capable of identifying the most likely severe accidents and severe accident vulnerabilities, and that the IPEEE study met the intent of Supplement 4 to GL 88-20 (reference 26).

3.5.5.9 PRA Maintenance and Update The Kewaunee PRA configuration management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plant. This process is defined in the configuration control program, which consists of a governing procedure and subordinate implementation procedures. The governing procedure delineates the responsibilities and guidelines for updating the PRA models. The overall objective is to define a process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, and industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plant, the following activities are routinely performed:

1. Design changes and procedure changes are reviewed for their impact on the PRA model.

2. New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

3. Maintenance unavailability is captured, and its impact on CDF is trended.

4. Plant-specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated on a regular basis.

In addition to these activities, Kewaunee PRA configuration management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes:

1. Documentation of the PRA model, PRA products, and bases documents.

2. The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

3.5.5.10 Conclusions on PRA Technical Adequacy and Scope As a result of the conservative IPE and IPEEE PRA models, as well as the considerable effort to incorporate the latest industry insights into the PRA, self-assessments, and Peer Reviews, DEK concludes that the current Kewaunee PRA model meets the PRA technical adequacy requirements.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 22 of 30 3.5.6 Tier 1, Cumulative Impacts RG 1.174 requires that for changes in Region II of RG 1.174 Figures 3 and 4, the cumulative effects of all risk informed changes are evaluated. The following table shows the cumulative risk impact of risk informed Technical Specification changes on the core damage and large early release risk:

Table 3.7 Subject Amend. No. CDF LERF Containment Isolation 155 0 5.4E-08 Integrated Leak Rate Testing 173 0 4.0E-09 Accumulators 176 5.2E-09 0 Second ILRT extension 204 0 8.3E-07 ESFAS/RPS 1.1E-06 5.7E-08 Cumulative 1.1E-06 9.5E-07 Amendment 155 allowed a train of containment isolation to be removed from service (i.e., one of two isolation valves open without the ability to close) for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This change resulted in a negligible risk increase, since containment isolation valves are rarely removed from service. The increased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

Amendment 173 instituted a one-time change of the containment integrated leak rate testing interval from 10 years to 15 years. This change resulted in a negligible risk increase, and no model changes were required. The increased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

Amendment 176 allowed a safety injection accumulator to be removed from service for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This change resulted in no actual risk increase, since accumulators have not been removed from service since the change. The increased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

Amendment 204 instituted an additional one-time change of the containment integrated leak rate testing interval from 15 years to 15 years, 9 months. This change resulted in a negligible risk increase, and no model changes were required. The increased risk due to this change is examined each major PRA update to ensure that the change remains acceptable.

3.5.7 Tier 2, Avoidance of Risk-Significant Plant Configurations The Tier 2 requirements of RG 1.177 state that the licensee should provide reasonable assurance that a risk-significant plant equipment outage configuration will not occur

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 23 of 30 when specific plant equipment is out of service. Tier 2 requires an examination of the need to impose additional restrictions when operating under the proposed RTB CT such that risk-significant equipment outage configurations are avoided.

The Tier 2 requirements of RG 1.177 have been addressed at Kewaunee. Kewaunee currently has a risk-informed on-line risk management process in place, which supports implementation of the requirements of 10 CFR 50.65(a)(4). This risk-informed assessment process is governed and implemented by plant procedures. These procedures assure that the risk associated with the various plant configurations planned during power conditions are assessed and appropriately managed. Additionally, Kewaunee performs a shutdown safety assessment during scheduled and unscheduled outages that includes an independent review of the plant outage schedule and performance of a safety assessment checklist.

The WCAP-15376 identified the following restrictions on concurrent removal of certain equipment when an RTB is out of service. The recommended Tier 2 restrictions are provided in Section 8.5 of WCAP-15376.

• Activities that could degrade the availability of the auxiliary feedwater system, reactor coolant system pressure relief (pressurizer PORVs and safety valves),

AMSAC (ATWS Mitigating System Actuation Circuitry), or turbine trip should not be scheduled when a RTB is out of service.

• Activities that could degrade other components of the RPS, including master relays or slave relays and activities that cause analog channels to be unavailable should not be scheduled when a logic cabinet is unavailable.

• Activities on electrical systems that support the systems or functions listed in the first two bullets should not be scheduled when a RTB is unavailable.

Kewaunee will implement administrative controls to include the above restrictions (refer to attachment 5, commitment 9). Like the reference plant, Kewaunees RPS consists of slave relays, master relays and analog channels and is supported by electrical power.

No other components have been identified that would degrade the RPS system.

Therefore, this restriction is bounding for Kewaunee.

3.5.8 Tier 3, Risk-Informed Plant Configuration Control and Management The objective of the third-tier requirements is to ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity. The third-tier requirement is an extension of the second-tier requirement, but addresses the limitation of being able to identify all possible risk-significant plant configurations in the second-tier evaluation. As with Tier 2, Tier 3 requirements of RG 1.177 have been addressed at Kewaunee through administrative controls (procedures and guidelines)

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 24 of 30 used to support the Maintenance Rule requirements specified by the NRC in 10 CFR 50.65(a)(4). The Kewaunee Maintenance Rule (a)(4) program meets all of the Key Components in Section 2.3.7.2 of Regulatory Guide 1.177 as follows:

Key Component 1: Implementation of Configuration Risk Management Program (CRMP)

The scope of the CRMP (all SSCs in the probabilistic risk assessment (PRA) model and all high safety significant SSCs within the scope of the Maintenance Rule) is identical to the scope of the Kewaunee Maintenance Rule (a)(4) program. All SSCs in the PRA model are included in the quantitative risk assessment and a qualitative evaluation exists for other high safety significant SSCs. This program is implemented via fleet procedure WM-AA-100, Work Management, which calls for a direct PRA, supplemented by qualitative assessments for components not modeled in the PRA.

This procedure provides for risk assessments to be performed on both planned maintenance and emergent maintenance.

Key Component 2: Control and Use of the CRMP Assessment Tool Kewaunees Plant Modification Procedure requires that the PRA group be notified for all pending plant modifications that affect PRA systems. The changes are required to be made to the PRA within 60 days of the modification closeout.

Limitations of the CRMP assessment tool are accounted for in plant procedures, which calls for qualitative assessments for components not modeled in the PRA.

Key Component 3: Level 1 Risk-Informed Assessment The current PRA model used for the Kewaunee Maintenance Rule (a)(4) program is a Level 1 and 2, internal events model. Qualitative assessments are made for components that are not explicitly modeled in the PRA, but may contribute to risk (e.g.,

indication, steam exclusion barriers).

Key Component 4: Level 2 Issues and External Events Level 2 is addressed by explicitly including LERF in the quantification tool and limiting the allowable increase in LERF. Risk Ranking in support of the Maintenance Rule has revealed that there are no non-High Safety Significant components that would become High Safety Significant components by adding external events. Barriers affecting the external events model only (e.g., fire doors, external flood barriers) are qualitatively analyzed for risk significance.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 25 of 30 3.5.9 WCAP-15376 SER Conditions Kewaunee is implementing the changes in the analog channel and logic cabinet CTs, BTs, STIs and the CT for the RTBs. Kewaunee is not implementing the changes to the RTB test frequency (STI). The NRC SER approving WCAP-15376 contains several plant specific conditions that require evaluation prior to implementation. The conditions of the WCAP-15376 SER are evaluated by DEK for Kewaunee below.

1. Confirm the applicability of the topical report to the plant and perform a plant-specific assessment of containment failures and address any design or performance differences that may affect the proposed changes.

DEK Response: In order to address condition 1 for WCAP-14333 and WCAP-15376, the WOG issued implementation guidelines to help licensees confirm the WCAP analyses were applicable to their plants. Tables 1 through 5 in attachment 3 list the important parameters and assumptions made in the generic analyses that are relevant to the requested changes. The information presented in Tables 1 through 5 confirms the applicability of both WCAP-14333 and WCAP-15376 analyses to Kewaunee.

Component Failure Probability Component failure probability data used in the WCAP-15376 report was reviewed against Kewaunee specific data. The Kewaunee specific component failure probability was 7.33E-06 for input logic relays. This calculated probability is less than that calculated and reported in Section 8.2, Table 8.6, of the WCAP.

Therefore, it was determined that the WCAP data is representative of Kewaunee.

Containment Failure Assessment The LERF analysis completed to support WCAP-15376 was based on a large dry containment with LERF contributions from containment isolation failure and containment bypasses from an Interfacing Systems LOCA (ISLOCA) and steam generator tube rupture (SGTR) events, excluding steam generator (SG) tube creep rupture. Kewaunees large dry containment is similar to that of the reference plant, and therefore, the WCAP results are applicable. Additionally, in the June 2002 Kewaunee PRA Peer Review, the Kewaunee Level 2 PRA model was evaluated against NEIs Peer Review Guidance (NEI-00-02). Two category B facts and observations were generated. These facts and observations have been resolved and, with these enhancements to the Kewaunee LERF model, the Kewaunee Level 2 analysis supports risk significance evaluations with deterministic inputs.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 26 of 30

2. Address the Tier 2 and Tier 3 analyses including risk significant configuration insights and confirm that these insights are incorporated into the plant-specific configuration risk management program.

DEK Response: See the discussion regarding Tier 2 and Tier 3 requirements in sections 3.5.7 and 3.5.8 above in this attachment. DEK commits to incorporating the recommended restrictions from WCAP-15376 into the appropriate administrative controls (refer to attachment 5, commitment 9).

3. The risk impact of concurrent testing of one logic cabinet and associated reactor trip breaker needs to be evaluated on a plant-specific basis to ensure conformance with the WCAP-15376-P, Rev. 0 evaluation, and RGs 1.174 and 1.177.

DEK Response: The Kewaunee base case internal events CDF, using the zero test and maintenance model, is 3.80E-05/year. With reactor trip breaker A and reactor trip logic train A out of service, the CDF becomes 4.71E-05/year. On average, this condition lasts 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> and will be entered 4 times per year (twice for each train). This increase in CDF while in this configuration is 4.71E-05/year -

3.80E-05/year = 9.1E-06/year. The CDF is then ((2.7 x 4) hours/year)/8760 hours/year x 9.1E-06/year = 1.1E-08/year. The ICCDP is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> /8760 hours/year x 9.1E-6/year = 2.5E-08. The base case internal events LERF is 4.42E-06/year. With reactor trip breaker A and reactor trip logic train A out of service, the LERF becomes 5.60E-06/year. The increase in LERF while in this configuration is 5.60E-06/year - 4.42E-06/year = 1.18E-06/year. The LERF is then ((2.7 x 4) hours/year)/8760 hours/year x 1.18E-06/year = 1.5E-09/year. The ICLERP is 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> /8760 hours/year x 1.18E-06/year = 3.2E-09.

The CDF and LERF are in Region III (very small changes) of figures 3 and 4 of RG 1.174, indicating that the change is acceptable. The ICCDP and ICLERP are below the acceptance guidelines in RG 1.177 for allowed outage times.

Therefore, the risk due to concurrent testing of one logic cabinet and associated reactor trip breaker is acceptable.

4. To ensure consistency with the reference plant, the model assumptions for human reliability in WCAP-15376-P, Rev. 0 should be confirmed to be applicable to the plant-specific configuration.

DEK Response: See Attachment 3 (proprietary) and 4 (non-proprietary),

Table 5.

5. For future digital upgrades with increased scope, integration and architectural differences beyond that of Eagle 21, the staff finds the generic

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 27 of 30 applicability of WCAP-15376-P, Rev. 0 to future digital systems not clear and should be considered on a plant-specific basis.

DEK Response: The applicability of the changes justified in WCAP-15376 to future digital systems is not addressed in the WCAP and will need to be addressed separately for new designs. Condition 5 does not apply to the Kewaunee at this time.

3.5.10 Additional Commitment from NRC RAI:

WOG guidelines (reference 15) for implementation of WCAP-15376 impose an additional commitment from the response to NRC RAI Question 18 (reference 27) which requires that each plant will review their setpoint calculation methodology to ascertain the impact of extending the COT Surveillance Interval from 92 days to 184 days.

DEK Response: The WOG response to this NRC RAI (reference 28) noted that plant-specific RPS and ESFAS setpoint uncertainty calculations and assumptions, including instrument drift, will be reviewed to determine the impact of extending the surveillance interval of the channel functional test from 92 days to 184 days.

DEK has reviewed the Kewaunee setpoint methodology and determined that the impact of extending the surveillance test intervals to 184 days would have no effect on the allowed acceptance criteria for the associated instruments. Kewaunee setpoint methodology includes drift values that are either the manufacturers values or plant specific values. The calibration acceptance values Kewaunee uses for the instruments are instrument accuracy values which are more restrictive than that which would be allowed using the setpoint methodology determined value.

An evaluation of the drift characteristics of the Kewaunee instruments using plant data indicated that extending the testing from one month to the requested interval of six months would remain acceptable.

4.0 REFERENCES

, ATTACHMENT 2:

1. WCAP-10271-P-A, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System, dated May 1985.

2. WCAP-10271-P-A, Supplement 1, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System, dated July 1985.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 28 of 30

3. WCAP-10271-P-A, Supplement 2, Revision 1, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation System," dated June 1990.

4. Letter from C. O. Thomas (NRC) to J. J. Sheppard (WOG), "Acceptance for Referencing of Licensing Topical Report WCAP-10271, 'Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection Instrumentation Systems,'" dated February 21, 1985.

5. Letter from Charles E. Rossi (NRC) to Roger A. Newton (WOG), "Safety Evaluation by the Office of Nuclear Reactor Regulation Review of Westinghouse Report WCAP-10271 Supplement 2 and WCAP-10271 Supplement 2, Revision 1,

'Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Features Actuation Systems, '" dated February 22, 1989.

6. Letter from Charles E. Rossi (NRC) to Gerard T. Goering (WOG), "Westinghouse Topical Report WCAP-10271 Supplement 2, Revision 1, 'Evaluation of Surveillance Frequencies and Out of Service Times for the Engineered Safety Features Actuation System,'" (NRC Supplemental Safety Evaluation), dated April 30, 1990.

7. NUREG-1366 "Improvement to Technical Specifications Surveillance Requirements," NRC Division of Operational Events Assessment, Office of Nuclear Reactor Regulation, December 1992.

8. NRC Generic Letter 93-05 "Line-Item Technical Specifications Improvements to Reduce Surveillance Requirements for Testing During Power Operation,"

September 27, 1993.

9. WCAP-14333-P-A, Revision 1, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times," October 1998.

10. Letter from T.H. Essig (NRC) to L.F. Liberatori Jr. (WOG), "Review of Westinghouse Owners Group Topical Reports WCAP-14333P and WCAP-14334NP, Dated May 1995, 'Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times,' (TAC No. M92782)," dated July 15, 1998.

11. WOG-98-245, Letter to WOG Primary Representatives and Licensing Subcommittee Representatives, "Implementation Guideline for WCAP-14333-P-A, Rev. 1 (Proprietary), 'Probabilistic Risk Analysis of the RPS and ESFAS Tests Times and Completion Times,' (MUHP-03054)," dated December 2, 1998.

12. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998.

13. NRC Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998.

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 29 of 30

14. Letter from W.H. Ruland (NRC) to RH. Byran (WOG), "Acceptance for Referencing of Topical Report WCAP-15376-P, Revision 0, 'Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times,' (TAC. No. MB0983)," dated December 20, 2002.

15. WOG-03-202, letter to WOG Management Committee and Licensing Subcommittee, "Transmittal of Approved Topical Report: WCAP-15376-P-A, Rev.

1, (Proprietary) Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, and Implementation Guidelines (MUHP-3046)," dated April 3, 2003.

16. WOG-04-233, letter to WOG Management Committee and Licensing Subcommittee, "Transmittal of Revised Implementation Guidelines for WCAP-15376-P-A, Rev. 1, 'Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times'(MUHP-3046)," dated May 6, 2004.

17. WCAP 15376-P-A, Revision 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, March 2003.

18. Industry/Technical Specification Task Force (TSTF) Standard TS (STS) Change Traveler 411, Revision 1, Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-15376), dated August 7, 2002.

19. Industry/Technical Specification Task Force (TSTF) Standard TS (STS) Change Traveler 418, Revision 2, Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-15376), dated February 21, 2003.

20. Letter from D. A. Christian (DEK) to Document Control Desk (NRC), Dominion Energy Kewaunee, Inc., (DEK) Kewaunee Power Station Application for Renewed Operating License, dated August 12, 2008. (ADAMS Accession Number ML082341038)

21. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," Revision 1, dated November 2002.

22. Kewaunee Nuclear Power Plant Probabilistic Risk Assessment Peer Review Report, December 2002.

23. NRC Mitigating System Performance Index (MSPI) Basis Document, Kewaunee Power Station, Revision F, June 2008.

24. Regulatory Guide 1.200, Revision 1, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, dated January 2007. [ADAMS Accession No. ML070240001]

25. Letter from Leslie N. Hartz (DEK) to Document Control Desk (NRC), License Amendment Request 242: Extension of One-Time Fifteen Year Containment

Serial No.09-491 Docket No. 50-305 Attachment 2 Page 30 of 30 Integrated Leak Rate Test Interval. dated September 11, 2008. [ADAMS Accession No. ML082550700]

26. Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10CFR 50.54(f), Generic Letter No. 88-20, Supplement 4, dated June 28, 1991.

27. WOG letter OG-01-058, from R.H. Bryan (WOG) to Document Control Desk (NRC), Transmittal of Response to Request for Additional Information (RAI)

Regarding WCAP-15376-P, Rev. 0, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, (MUHP-3046), September 28, 2001.