Text

License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time
	ML092680090
Person / Time
Site:	Byron
Issue date:	09/24/2009
From:	Simpson P; Exelon Generation Co, Exelon Nuclear
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	RS-09-121
	Download: ML092680090 (141)
	v • d • e

Fxelon C'ntArdtlori qjoo Wirlfield Koad www excloncorp corn Nuclear W~rrc~rlvilieIL 60555 10 CFR 50.90 September 24,2009 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455

Subject:

License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC, (EGC) is requesting an amendment to Facility Operating License Nos. NPF-37 and NPF-66 for Byron Station, Units 1 and 2. This amendment request proposes a one-time extension of the Completion Time (CT) to restore a unit-specific SX train to operable status associated with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.7.8, "Essential Service Water (SX) System," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

The current TS LC0 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1,2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 112SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SXOO1A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 112SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage; however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a

September 24,2009 U.S. Nuclear Regulatory Commission Page 2 Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

Having the capability to securely isolate a single SX pump on a single unit will enable necessary system maintenance to be performed, thus restoring the reliability of the SX system and improving overall plant safety. In addition, plant risk is reduced by restoring the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 112SX001A valves will provide isolation defense in depth and improved isolation reliability.

The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," was reviewed for insights. The risk associated with the proposed changes was shown to be acceptable.

The attached request is subdivided as shown below.

Attachment 1 provides an evaluation of the proposed changes.

Attachment 2 includes the marked-up TS pages with the proposed changes indicated.

Attachment 3 includes the marked-up TS Bases pages with the proposed changes indicated.

The TS Bases pages are provided for information only and do not require NRC approval.

The regulatory commitments contained in this letter are summarized in Attachment 4.

Attachment 5 provides the supporting risk-informedevaluation of the requested change.

EGC requests approval of the proposed license amendment by April 10, 2010, to support implementation during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

Once approved, the amendment will be implemented within 30 days.

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004.

The proposed change has been reviewed by the Byron Station Plant Operations Review Committee and approved by the Nuclear Safety Review Board in accordance with the requirements of the EGC Quality Assurance Program.

September 24,2009 U.S. Nuclear Regulatory Commission Page 3 In accordance with 10 CFR 50.91, "Notice for public comment; State consultation," paragraph (b), EGC is notifying the State of Illinois of this application for license amendment by transmitting a copy of this letter and its attachments to the designated State Official.

Should you have any questions concerning this letter, please contact Ms. Lisa Schofield at (630) 657-2815.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 24th day of September 2009.

Patrick R. Simpson U Manager - Licensing Exelon Generation Company, LLC Attachments: : Evaluation of Proposed Changes : Proposed Technical Specifications Pages for Byron Station, Units 1 and 2 : Proposed Technical Specifications Bases Page for Byron Station, Units 1 and 2 : Summary of Regulatory Commitments : Risk-Informed Evaluation : Technical Adequacy : Uncertainty Assessment cc: Regional Administrator - NRC Region Ill NRC Senior Resident Inspector - Byron Station

ATTACHMENT 1 Evaluation of Proposed Changes 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedent 4.3 No Significant Hazards Consideration 4.4 Conclusions

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

Page 1 of 18

ATTACHMENT 1 Evaluation of Proposed Changes 1.0

SUMMARY

DESCRIPTION In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC, (EGC) is requesting an amendment to Facility Operating License Nos. NPF-37 and NPF-66 for Byron Station, Units 1 and 2. This amendment request proposes a one-time extension of the Completion Time (CT) to restore a unit-specific SX train to operable status associated with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.7.8, "Essential Service Water (SX) System," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

2.0 DETAILED DESCRIPTION The current CT for Required Action A.1, associated with LCO 3.7.8, is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The proposed change increases, on a limited basis, the CT to restore an inoperable SX train from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . For Byron Station, the CT extension is planned to be invoked for Unit 1, while Unit 2 is in Mode 5, 6 or defueled, and remain applicable through the completion of the Unit 2 Refueling Outage 15. As such, a note is added to Condition A of TS 3.7.8 stating that the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT does not apply while Unit 2 is in Mode 5, 6, or is defueled, until the end of the stated refueling outage. Condition B is added to specify the limited use of the 144 hour0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months CT for the SX suction valve replacement under those conditions. The former Condition B is changed to Condition C and the former Condition C is renamed as Condition D. The proposed changes are shown on the marked-up Byron Station TS pages included as Attachment 2. In addition, an informational copy of the associated TS Bases page with marked-up changes is provided as . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

The current TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 1/2SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SX001A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 1/2SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage (i.e., B2R15); however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction Page 2 of 18

ATTACHMENT 1 Evaluation of Proposed Changes isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

Having the capability to securely isolate a single SX pump on a single unit will enable necessary system maintenance to be performed, thus restoring the reliability of the SX system and improving overall plant safety. In addition, plant risk is reduced by restoring the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

EGC requests approval of the proposed license amendment by April 10, 2010, to support implementation during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

Once approved, the amendment will be implemented within 30 days.

3.0 TECHNICAL EVALUATION

=

System Description===

The SX system is discussed in the Updated Final Safety Analysis Report (UFSAR), Section 9.2.1.2, "Essential Service Water System," (Reference 1).

The SX system provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation and a normal shutdown, the SX system also provides this function for various safety related and non-safety related components.

The unit-specific SX system consists of two separate, electrically independent, 100% capacity, safety related, cooling water trains. Each train consists of a 100% capacity pump, piping, valving, and instrumentation. Normally, the pumps and valves are remotely and manually aligned. However, the pumps are automatically started upon receipt of a safety injection signal or an undervoltage on the Engineered Safety Features (ESF) bus, and all essential valves are aligned to their post accident positions. The SX system is also the backup water supply to the auxiliary feedwater and fire protection systems.

The SX system includes provisions to crosstie the trains (i.e., train crosstie), as well as provisions to crosstie the units (i.e., unit crosstie). The unit crosstie valves (i.e., 1SX005 and 2SX005) must both be open to accomplish the unit crosstie. The system is normally aligned with the train crosstie valves open and the unit crosstie valves closed.

Each full-capacity SX system loop in each unit is supplied by a single pump rated at 24,000 gpm at 180 feet +/-10% total developed head. Actual system flow varies with system lineup and conditions. UFSAR Tables 9.2-1, "Essential Service Water Heat Loads," and Table 9.2-11, "Essential Service Water Component Nominal Design Flow Rates," list the components served and the nominal rated component flows. The pumps are located on the lowest level of the auxiliary building to ensure the availability of sufficient net positive suction head (NPSH).

Emergency power is available to each pump from its respective ESF bus as shown in UFSAR Table 8.3-5, "Loading on 4160-Volt ESF Buses," and described in UFSAR Section 8.3.1, "Onsite AC Power Systems." The suction supply is by one supply line running from each of the Page 3 of 18

ATTACHMENT 1 Evaluation of Proposed Changes two redundant essential service mechanical draft cooling towers to the auxiliary building. Each supply line supplies one SX pump in each unit; each of the two pumps in a given unit takes its suction from a separate supply line. The system, therefore, meets the single-failure criterion as shown in the analysis in UFSAR Tables 9.2-2 "Single-Failure Analysis of the Essential Service Water System," and 9.2-16, "Single Failure Analysis of the Ultimate Heat Sink." Heat rejection from the SX system is to the SX cooling towers, both on a normal and on an emergency basis.

The discharges from each loop in each unit are separate and fed to two separate and redundant return lines for return to the towers. The two discharges from each unit and the two return lines to the towers are arranged similar to the intakes, i.e., the two discharges from each unit run into separate return lines, and each return line is fed from one discharge from each unit. The single failure criterion is met as shown in UFSAR Tables 9.2-2 and 9.2-16. The SX cooling towers are designed to accommodate the heat load from both units simultaneously under both normal and accident conditions. The SX cooling towers and their auxiliary systems are more fully discussed in UFSAR Section 9.2.5.

On May 5, 2008, a concern was identified by the NRC with respect to the single failure assumptions taken in the Byron ultimate heat sink (UHS) analysis. The specific concern was the Byron UHS analysis only considered single active breaker or switch failures that resulted in the failure of one SX cooling tower (SXCT) fan. Passive failures of the 4160 volt or 480 volt feed breakers which could de-energize the bus and result in the loss of two SXCT fans were not considered. EGC performed a revised analysis of the UHS to evaluate the impact of postulated passive electrical single failures. EGC determined that the results of the revised analysis could not be incorporated into the Byron Station design basis via requirements of 10 CFR 50.59, "Changes, tests, and experiments." Reference 2 is the license amendment request submitted to the NRC to resolve this concern. The proposed TS changes for LCO 3.7.8 being requested in this submittal are not dependent or linked to those requested in Reference 2.

Safety Analysis The design basis of the SX system is for one SX train, in conjunction with the Component Cooling (CC) system and a 100% capacity containment cooling system, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2, "Containment Systems." This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the reactor coolant system by the emergency core cooling system pumps. The SX system is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.

The SX system, in conjunction with the CC system, also cools the unit from Residual Heat Removal (RHR) entry conditions, as discussed in the UFSAR, Section 5.4.7, (i.e., Reference 3) to Mode 5 during normal and post accident operations. The time required for this evolution is a function of the number of CC and RHR System trains that are operating. One SX train is sufficient to remove decay heat during subsequent operations in Modes 5 and 6.

Note that Generic Letter 91-13, "Request For Information Related to the Resolution of Generic Issue 130, 'Essential Service Water System Failures at Multi-Unit Sites,'" included risk-based recommendations for enhancing the availability of SX systems in the case of a loss of all SX to a particular unit. Crediting the opposite-unit SX system with an opposite-unit pump and the opposite-unit crosstie valves was part of the response to this Generic Letter.

Page 4 of 18

ATTACHMENT 1 Evaluation of Proposed Changes The unit-specific SX system satisfies 10 CFR 50.36, "Technical Specifications," paragraph (c)(2)(ii)(C), Criterion 3. The opposite-unit SX system satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii)(D).

System Functions The SX system has three primary functions:

provide cooling water to safety related equipment and equipment essential to the safe shutdown of the reactor during normal or accident conditions;

provide backup source of water to the auxiliary feedwater pumps in the event the condensate storage tank (CST) is not available; and

provide safety-related backup source of water to the fire protection system.

Need for Amendment As noted above, the current TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 1/2SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SX001A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 1/2SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window. The following contribute significantly to the overall duration of the work window associated with the SX valve replacement work activities: draining and refilling approximately one quarter million gallons of water; large bore pipe cutting and welding; and difficulties presented by the location of the valves to be replaced.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage (i.e., B2R15); however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004 (i.e., Reference 4). The license amendment was, in part to support, replacement of the 1A SX pump suction isolation valve (i.e., 1SX001A) which occurred in 2005. As noted above, the 1SX001A valve is degraded such that individual pump isolation for the 1A SX pump is not adequate to perform pump maintenance or downstream system component maintenance. As part of troubleshooting, the torque was measured at the valve shaft. The torque value was found to be excessively high which indicates that the valve has degraded bearings. A review of documents associated with Page 5 of 18

ATTACHMENT 1 Evaluation of Proposed Changes the prior 1SX001A valve replacement, identified that the refurbished valve that replaced 1SX001A was not completely overhauled. The original scope of work was revised to machine the valve and leak test the valve seats. The top and bottom bearings and seal packing were not replaced. This issue has been entered into the EGC corrective action program. Also, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue and should be replaced at the same time. The 1/2SX001B valves which were also replaced at the same time, were refurbished correctly and are operating properly with presently no identified need for replacement.

Risk Evaluation The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," was reviewed for insights.

In implementing risk-informed decisionmaking under RGs 1.174 and 1.177, TS changes are expected to meet a set of five key principles. These principles include consideration of both traditional engineering factors (e.g., defense in depth and safety margins) and risk information. provides the risk-informed evaluation of the proposed change in the SX CT that considers each one of these principles.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

The proposed change is consistent with the defense-in-depth philosophy.

The proposed change maintains sufficient safety margins.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

The impact of the proposed change should be monitored using performance measurement strategies.

The results of the risk evaluation are compared in Table 1 with the risk acceptance guidelines described in Attachment 5. The values for the Incremental Conditional Core Damage Probability (ICCDP) and the Incremental Conditional Large Early Release Probability (ICLERP) demonstrate that the proposed SX train Completion Time change has a small quantitative impact on plant risk. The results in Table 1 differ from those previously used to support the approval documented in Reference 4. The overall level of plant risk at the Byron Station has been substantially reduced since 2004. In 2004, the annual average core damage frequency (CDF) from internal events was 6E-5/yr. Currently, the annual average CDF from internal Page 6 of 18

ATTACHMENT 1 Evaluation of Proposed Changes events is roughly a factor of three lower at 2E-5/yr. This reduction is the byproduct of improved plant performance and proactive implementation of improved procedures for addressing key risk contributors.

Table 1 Overall Results of Risk Evaluation for Byron Station - Unit 1 Risk Risk Metric Results Acceptance Seismic and Risk Metric Internal Internal Guideline 1 2 Other Events Fire External ICCDP < 1E-6 1E-7 9E-7 Negligible ICLERP < 1E-7 3E-9 Negligible Negligible CDFBaseline < 1E-4/yr 2E-5/yr 5E-5/yr ~1E-5/yr CDFSX CT < 1E-3/yr 3E-5/yr 1E-4/yr ~1E-5/yr Configuration Note 1: Internal events include contribution from internal flooding.

Note 2: The internal fire results contain conservatisms that make the fire results incomparable to the internal events results. They are shown here simply to illustrate that even if they are added, the acceptance guidelines are not exceeded.

Table 2 provides a summary of the approach and results of the evaluation of each of the potential risk contributors. These analyses demonstrate that the risk impact of the proposed one-time extension of the SX CT is small and below the acceptance guidelines.

Page 7 of 18

ATTACHMENT 1 Evaluation of Proposed Changes Table 2 Summary of Risk Insights for SX CT Extension RISK APPROACH INSIGHTS CONTRIBUTOR Internal Events Quantify ICCDP & ICLERP for Compensatory Measures Keep Risk Planned Configuration, Including Well Within Acceptance Guidelines Compensatory Measures:

ICCDP < 1E-6 ICLERP < 1E-7 Baseline CDF < 1E-4/yr Configuration specific CDF

< 1E-3/yr Internal Fire Qualitatively and Quantitatively Every Fire Scenario Has At Least Evaluated: One Success Path Identify fire scenarios Internal Events Compensatory impacted by configuration Measures Apply to Fire Scenarios Estimate fire risk impacts New Fire-Related Compensatory due to configuration and Measures Identified quantify delta-CDF Compensatory Measures Keep Confirm Availability of Risk Well Within Acceptance Success Path for Every Guidelines Scenario Identify Compensatory Measures Seismic Qualitatively Identify Key Seismic Risk Impacts Negligible Seismic Risk Impacts for Planned Configuration Evaluate Impact on Seismic-related Key Functions of SX Other External Hazards Qualitatively Evaluate Each Hazard No Unique Challenges Identified to Identify Unique Challenges Overall At-Power Risks No Evidence Quantitative Key Compensatory Measures Guidelines Will Be Challenged Identified to Minimize Risk Risk at Unit in Qualitatively Evaluate Impact of Reduction in SX Redundancy Shutdown SX Configuration on Unit in Leads to Some Increase in Risk Shutdown at Shutdown Unit Since SX Identify Compensatory Transfers Heat to the Ultimate Measures Consistent With Heat Sink Shutdown Safety Program Compensatory Actions At Unit in Shutdown Consistent With Outage Safety Program Page 8 of 18

ATTACHMENT 1 Evaluation of Proposed Changes The risk-informed evaluation identified a number of compensatory measures that will be implemented during the planned SX configuration to assure the risk impacts are acceptably low.

These are discussed in detail in Attachment 5 and summarized in Table 3. Table 3 also provides details on how these compensatory measures are applied during the maintenance evolution. The compensatory measures in Table 3 are considered to be regulatory commitments and are summarized in Attachment 4.

Credit for dedicated operators to maintain and respond to SX-related problems is recognized as a key compensatory measure. Implementation of this measure will consist of the assignment of dedicated operators inside and outside the control room to back up the nominal staff for these actions. These personnel represent additional operators (i.e., one Senior Reactor Operator (SRO) in the control room, one Reactor Operator (RO) and one Equipment Operator) assigned to monitor SX performance and take the identified actions, if required, as a back up to the nominal shift staff. The only duties assigned to these dedicated operators will be those associated with the actions identified in the risk assessment credited to reduce the risk impact.

The dedicated operators will receive training on their assignments as part of the preparations related to this compensatory measure. Also, there is significant margin between the time available and the time required for the operator actions to be completed. Additional details concerning the use of dedicated operators are described in Attachment 5.

Page 9 of 18

ATTACHMENT 1 Evaluation of Proposed Changes Table 3 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Comments Compensatory Measure Internal Fire Shutdown Events Protected Unit 0 CC Heat Exchanger X X Equipment Unit 2 CC Heat Exchanger X X Unit 1 CC Heat Exchanger X X 1SX005 (crosstie MOV) X 2SX005 (crosstie MOV) X 1B SX Pump X X Monitor pump for fire precursor indicators 2B SX Pump X X X Monitor pump for fire precursor indicators 1A AF Pump X 1B AF Pump X 2A AF Pump X Unit 1 SATs X Unit 2 SATs X X 4KV Bus 141 X 4KV Bus 142 X X Minimize or preclude breaker switching operations, especially for offsite power supply breakers 4KV Bus 241 X 4KV Bus 242 X X Switchyard X Minimize or preclude breaker switching operations, especially for offsite power supply breakers 1A EDG X 1B EDG X 2A EDG X 2B EDG X X DC Battery & Charger 111 X DC Battery & Charger 112 X DC Battery & Charger 211 X DC Battery & Charger 212 X X 2A CV or 2A SI pump OR X 2B CV or 2B SI Pump 2A or 2B RH Pump X 2B CC Pump X 1SX033/1SX034 X 2SX033/2SX034 X X VA Supply Plenum X VA Exhaust Plenum X 0A Fire Pump X 0B Fire Pump X 1A CV Pump Alt Cooling X 1B CV Pump Alt Cooling X Unit 1 120 VAC Inst Inverters X Page 10 of 18

ATTACHMENT 1 Evaluation of Proposed Changes Table 3 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Comments Compensatory Measure Internal Fire Shutdown Events Unit 1 SI signals X Prohibit surveillance testing on SSPS/ESFAS SI logic Fuel Pool Cooling - 1 train X available Isolate one train of Unit 2 X Improves effectiveness RCFCs of SX Unit Crosstie Equipment 1SX005 (or 2SX005) Open X Improves effectiveness Alignment of SX Unit Crosstie Changes Unit 1 CST Filled to 350,000 X gallons "Dedicated SX" operators X Improves response to loss of remaining SX Pumps Not performed during reduced inventory or X

high decay heat levels Prior to entrance into the 11.1B-0 X SX completion time Prior to entrance into the 11.3-0 X SX completion time Prior to entrance into the 11.3-1 X SX completion time Prior to entrance into the 11.4-0 X SX completion time Fire Zone walk Prior to entrance into the down for transient 11.6-0 X SX completion time control Prior to entrance into the 11.6-1 X SX completion time Prior to entrance into the 5.1-1 X SX completion time Prior to entrance into the 5.2-1 X SX completion time Prior to entrance into the 5.5-1 X SX completion time Overall Conclusion The proposed changes have been evaluated consistent with the key principles identified in RG 1.174 for risk-informed changes to the licensing basis and demonstrated that the risk from the proposed changes is acceptably small. The evaluation with respect to these principles is summarized below.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

This change is being requested as a change to the operating license for Byron Station.

Page 11 of 18

ATTACHMENT 1 Evaluation of Proposed Changes

The proposed change is consistent with the defense-in-depth philosophy.

The configuration to be entered decreases the redundancy of the SX system due to the removal of two of the four SX pumps from service simultaneously during the CT required to replace the 1/2SX001A valves. The reduced redundancy increases the potential for the plant to lose SX cooling to plant equipment; however, the current plant design and supporting analyses demonstrate that the plant has more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis.

Defense-in-depth is maintained during the configuration. Compensatory measures are identified to strengthen the level of defense-in-depth and reduce overall risk. The functions necessary to maintain fuel, reactor coolant pressure boundary, and containment integrity are provided consistent with the plant's design basis; thus maintaining traditional defense-in-depth barriers.

The proposed change maintains sufficient safety margins.

The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following.

- Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved for use by the NRC). The proposed change is not in conflict with approved codes and standards relevant to the SX system.

- While in the proposed configuration, safety analysis acceptance criteria in the UFSAR are met, assuming there are no additional failures. The plant has more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis. Specifically, two capabilities with respect to the SX system are credited in the risk analysis but are not credited in the licensing basis. The first is the capability of a single SX pump to provide cooling to loads of both units. The second is the capability to provide cooling from the fire protection system to the CV charging pumps.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

A risk evaluation was performed that considers the impact of the proposed change with respect to the risks due to internal events, internal fires, seismic events and other external hazards. The evaluation of the quantitative impacts of internal event risks due to the planned configuration demonstrate that the impact on the likelihood of core damage and large early release is well below the risk acceptance guideline. The fire evaluation determined that the impact on the likelihood of fire-related core damage is also below the risk acceptance guideline. In addition, compensatory measures have been identified that further reduce the risk of the significant fire scenarios. The risk associated with seismic events and other external hazards are either not impacted by the change or are bounded by the risk from internal events. In addition, although not required, the risk implications of the proposed change were qualitatively evaluated for the unit that will be shutdown during the evolution, consistent with EGCs risk management practices.

Page 12 of 18

ATTACHMENT 1 Evaluation of Proposed Changes The performance of the planned maintenance has a long-term safety benefit to the Byron Station due to an improved reliability to isolate large SX floods using the new isolation valve.

This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

The impact of the proposed change should be monitored using performance measurement strategies.

EGCs configuration risk management program will effectively monitor the risk of emergent conditions during the period of time that the proposed change is in effect. This will ensure that any additional risk increase due to emergent conditions is appropriately managed.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria The design of the unit-specific SX system must satisfy the requirements of 10 CFR 50.36, "Technical Specifications," paragraph (c)(2)(ii)(C), Criterion 3; and the design of the opposite-unit SX system must satisfy the requirements of 10 CFR 50.36, paragraph (c)(2)(ii)(D), Criterion 4. These requirements state the following:

(ii) A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria:

(C) Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

(D) Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety.

The design basis of the SX system is described in the UFSAR, Section 9.2.1.2, "Essential Service Water System."

4.2 Precedent The impact on previous risk-informed submittals is summarized below.

Emergency Diesel Generator (EDG) Extended Completion Time The EDG CT was extended from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days. A significant compensatory measure required to enter the extended EDG CT is to verify that all four SX pumps are operable. Although, two of the four SX pumps will be inoperable during the SX valve replacement, all EDGs will be protected equipment and available during the SX one-time CT extension. Therefore, there Page 13 of 18

ATTACHMENT 1 Evaluation of Proposed Changes is no impact on the risk analysis or the conclusions of the analysis supporting the EDG CT.

Risk-informed Inservice Inspection (ISI)

Byron Station utilizes a Risk-informed ISI program. Operating with an SX train in maintenance for up to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months has no impact on the insights or conclusions from those analyses.

120 VAC Inverter Completion Time As a compensatory measure, no planned maintenance will be allowed on the operating unit 120 VAC inverters (specifically 111 and 114) during the SX extended CT; therefore, there will be no impact on the inverter extended CT .

ILRT Interval Extension Operating with an SX train in maintenance for up to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months has no impact on the insights or conclusions from those analyses that supported the license amendment related to extending the ILRT interval since an ILRT is not scheduled for performance while the unit is at power.

RTS/ESFAS The NRC approved the extensions of the RTS/ESFAS Completion Time, Bypass Test Times, and Surveillance Test Intervals for Byron Station. As a compensatory measure, no planned maintenance will be allowed on the operating unit that would render either the "A" or "B" Train SI signal unavailable during the SX pump extended CT; therefore, there will be little impact on the TS changes related to RTS/ESFAS CT or surveillance frequency extensions.

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004.

4.3 No Significant Hazards Consideration In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC, (EGC) is requesting an amendment to Facility Operating License Nos. NPF-37 and NPF-66 for Byron Station, Units 1 and 2. This amendment request proposes a one-time extension of the Completion Time (CT) to restore a unit-specific SX train to operable status associated with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.7.8, "Essential Service Water (SX) System," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

The current TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 1/2SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SX001A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and Page 14 of 18

ATTACHMENT 1 Evaluation of Proposed Changes therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 1/2SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage; however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

Having the capability to securely isolate a single SX pump on a single unit will enable necessary system maintenance to be performed, thus restoring the reliability of the SX system and improving overall plant safety. In addition, plant risk is reduced by restoring the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," was reviewed for insights. The risk associated with the proposed changes was shown to be acceptable.

EGC has evaluated for Byron Station whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

Criteria

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Page 15 of 18

ATTACHMENT 1 Evaluation of Proposed Changes Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," was reviewed for insights. The risk associated with the proposed changes was shown to be acceptable.

The previously analyzed accidents are initiated by the failure of plant structures, systems, or components. The SX system is not considered an initiator for any of these previously analyzed events. The proposed change does not have a detrimental impact on the integrity of any plant structure, system, or component that initiates an analyzed event. No active or passive failure mechanisms that could lead to an accident are affected. The proposed change will not alter the operation of, or otherwise increase the failure probability of any plant equipment that initiates an analyzed accident. Therefore, the proposed change does not involve a significant increase in the probability of an accident previously evaluated.

The unit-specific SX system consists of two separate, electrically independent, 100% capacity, safety related, cooling water trains. Each train consists of a 100% capacity pump, piping, valving, and instrumentation. Normally, the pumps and valves are remotely and manually aligned. However, the pumps are automatically started upon receipt of a safety injection signal or an undervoltage on the engineered safety features (ESF) bus, and all essential valves are aligned to their post accident positions. The SX system is also the backup water supply to the auxiliary feedwater system and fire protection system.

The design basis of the SX system is for one SX train, in conjunction with the component cooling water (CC) system and a 100% capacity containment cooling system, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2, "Containment Systems." This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the reactor coolant system by the emergency core cooling system pumps. The SX system is designed to perform its function with a single failure of any active component, assuming the loss of offsite power. The proposed one-time increase in the CT is consistent with the philosophy of the current Technical Specification LCO which allows one train of SX to be inoperable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This change only extends the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months which has been shown to be acceptable from a risk perspective; therefore, the proposed change does not involve a significant increase in the consequences of an accident previously evaluated.

Page 16 of 18

ATTACHMENT 1 Evaluation of Proposed Changes

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed changes do not involve the use or installation of new equipment and the currently installed equipment will not be operated in a new or different manner. No new or different system interactions are created and no new processes are introduced. The proposed changes will not introduce any new failure mechanisms, malfunctions, or accident initiators not already considered in the design and licensing bases. Based on this evaluation, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change does not alter any existing setpoints at which protective actions are initiated and no new setpoints or protective actions are introduced.

The design and operation of the SX system remains unchanged. The risk associated with the proposed increase in the time an SX pump is allowed to be inoperable was evaluated using the risk-informed processes described in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," dated August 1998. The risk was shown to be acceptable. Based on this evaluation, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, EGC concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

EGC has evaluated the proposed amendment for environmental considerations. The review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, and would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant Page 17 of 18

ATTACHMENT 1 Evaluation of Proposed Changes change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

1. Byron/Braidwood Stations Updated Final Safety Analysis Report, Section 9.2.1.2, "Essential Service Water System"

2. Letter from Patrick R. Simpson (Exelon Generation Company, LLC) to NRC, "License Amendment Regarding Ultimate Heat Sink," dated June 30, 2009

3. Byron/Braidwood Stations Updated Final Safety Analysis Report, Section 5.4.7, "Essential Service Water System"

4. Letter from G. F. Dick (U.S. Nuclear Regulatory Commission) to C. M. Crane (Exelon Generation Company, LLC), "Issuance of Amendments RE: One-Time Change to the Completion Time for Restoration of a Unit Specific Essential Service Water Train (TAC Nos. MB9547, MB9548, MB9545, and MB9546)," dated March 18, 2004 Page 18 of 18

ATTACHMENT 2 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455 Proposed Technical Specifications Pages for Byron Station, Units 1 and 2 3.7.8-1 3.7.8-2

SX System 3.7.8 3.7 PLANT SYSTEMS 3.7.8 Essential Service Water (SX) System LCO 3.7.8 The following SX trains shall be OPERABLE:

a. Two unit-specific SX trains; and

b. One opposite-unit SX train for unit-specific support.

APPLICABILITY: MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One unit-specific SX A.1 --------NOTES--------

train inoperable. 1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-

NOTE-------- Operating," for Not applicable to Emergency Diesel Unit 1 during Generator made replacement of the inoperable by SX.

SX suction isolation valves 2. Enter applicable (i.e., 1SX001A Conditions and and 2SX001A) Required Actions during Unit 2 of LCO 3.4.6, Refueling 15 while "RCS Loops-Unit 2 is in MODE 4," for MODE 5, 6, or Residual Heat defueled. Removal loops

made inoperable by SX.

Restore unit-specific 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months SX train to OPERABLE status.

(continued)

BYRON UNITS 1 & 2 3.7.8 1 Amendment 165

SX System 3.7.8 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Opposite-unit SX train B.1 Restore opposite-unit 7 days inoperable. SX train to OPERABLE C C status.

C. Required Action and C.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition A or AND D B not met.

,B C.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months C

D INSERT BYRON UNITS 1 & 2 3.7.8 2 Amendment 165

SX System TS 3.7.8 INSERTS INSERT ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTE-------- B.1 --------NOTES--------

Only applicable to 1. Enter applicable Unit 1 during Conditions and replacement of the Required Actions SX suction of LCO 3.8.1, isolation valves "AC Sources-(i.e., 1SX001A Operating," for and 2SX001A) Emergency Diesel during Unit 2 Generator made Refueling 15 while inoperable by SX.

Unit 2 is in MODE 5, 6, or 2. Enter applicable defueled. Conditions and

Required Actions of LCO 3.4.6, One unit-specific SX "RCS Loops-train inoperable. MODE 4," for Residual Heat Removal loops made inoperable by SX.

Restore unit-specific 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months SX train to OPERABLE status.

ATTACHMENT 3 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455 Proposed Technical Specifications Bases Page for Byron Station, Units 1 and 2 B 3.7.8-4

SX System B 3.7.8 BASES ACTIONS A.1 If one unit-specific SX train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE SX train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE SX train could result in loss of the SX System function in the short term. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

INSERT 1 Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," should be entered if an inoperable SX train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," should be entered if an inoperable SX train results in an inoperable decay heat removal train.

These are exceptions to LCO 3.0.6 and ensure the proper actions are taken for these components.

INSERT 2 C.1 B.1 If the opposite-unit SX train is not OPERABLE for unit-specific support, action must be taken to restore OPERABLE status within 7 days. In this Condition, if a complete loss of unit-specific SX were to occur, the SX System function would be lost. The 7 day Completion Time is based on the capabilities of the unit-specific SX System and the low probability of a DBA with a loss of all unit-specific SX occurring during this time period.

D.1 and D.2 C.1 and C.2 If the unit-specific SX train or the opposite-unit SX train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.

BYRON UNITS 1 & 2 B 3.7.8 4 Revision 68

SX System B 3.7.8 INSERTS INSERT 1 Condition A is modified by a Note. The Note indicates that this Condition is not applicable to Unit 1 during replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15 while Unit 2 is in MODE 5, 6, or defueled.

INSERT 2 B.1 During replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15, if one unit-specific SX train is inoperable, action must be taken to restore OPERABLE status within 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This Completion Time is based upon a risk-informed assessment that concluded that the associated risk with the units in the specified configuration is acceptable.

Condition B is modified by a Note. The Note indicates that this Condition is only applicable to Unit 1 during replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15 while Unit 2 is in MODE 5, 6, or defueled.

Required Action B.1 is modified by two Notes as described in Action A.1 above.

ATTACHMENT 4 Summary of Regulatory Commitments The following table identifies commitments made in this document. (Any other actions discussed in the submittal represent intended or planned actions. They are described to the NRC for the NRC's information and are not regulatory commitments.)

COMMITMENT TYPE COMMITMENT COMMITTED DATE ONE-TIME PROGRAM-OR "OUTAGE" ACTION MATIC (YES/NO) (YES/NO)

Implement the compensatory Upon implementation Yes No measures listed in Attachment 1 of the one-time of RS-09-121, Table 3, "Byron SX extension of the SX A Train Outage Summary of train Completion Time.

Compensatory Measures"

ATTACHMENT 5 Risk-Informed Evaluation

1.0 BACKGROUND

The current Byron TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the A and B trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a Completion Time (CT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace the SX pump suction valves used for pump isolation from the SX water supply. Currently the suction isolation valves for the 1A and 2A SX pumps at Byron Station are degrading such that individual pump isolation on a specific unit may not be adequate to perform pump maintenance or downstream system component maintenance. In order to perform SX pump maintenance or downstream system component maintenance, the common upstream suction isolation valve for the 1A and 2A SX pumps must be closed and the suction header drained. This evolution is time consuming and maintenance history has shown that completion of the needed SX suction isolation valve replacement cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX suction isolation valves will be conducted during a refueling outage; however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps, results in putting the operating unit in a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO. Consequently, not completing the suction isolation valve replacement in the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in either a dual unit shutdown or not completing the required work to improve the material condition of the plant. As such, the temporary TS change is being requested to improve operational safety by reducing the plant risk by increasing the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios.

The performance of the planned maintenance has a long-term safety benefit to the Byron Station due to an improved reliability to isolate large SX floods using the new isolation valve. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

Page 1 of 52

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004. It is worthy of note that the overall level of plant risk at Byron has been substantially reduced since that time. In 2004, the annual average core damage frequency (CDF) from internal events was 6E-5/yr. Today, the Byron annual average core damage frequency (CDF) from internal events is roughly a factor of three lower at 2E-5/yr. This reduction is the byproduct of improved plant performance and proactive implementation of improved procedures for addressing key risk contributors.

The preparation of this analysis is performed in accordance with the requirements of the Exelon Risk Management process as defined in the Technical and Reference Manual (T&RM) guidance documents:

ER-AA-600-1012, Rev. 8, Risk Management Documentation (Reference 1)

ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR (Reference 2)

2.0 TECHNICAL ANALYSIS

The proposed changes have been evaluated using the risk informed processes described in Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, dated July 1998 (Reference 5) and RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, dated August 1998 (Reference 4).

In implementing risk-informed decision-making under the NRCs RGs 1.174 and 1.177, technical specification changes are expected to meet a set of five key principles. These principles include consideration of both traditional engineering factors (e.g., defense in depth and safety margins) and risk information. This section provides a summary of the technical analysis of the proposed change in SX CT that considers each one of these principles:

Page 2 of 52

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

This change is being requested as a change to the operating license for Byron Station.

The proposed change is consistent with the defense-in-depth philosophy.

The defense-in-depth philosophy is maintained, as summarized in Section 2.1.

The proposed change maintains sufficient safety margins.

Safety margin is not impacted by the proposed change as summarized in Section 2.2.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

A risk evaluation is presented in Section 2.3 that considers the impact of the proposed change with respect to the risks due to:

- internal events,

- internal fires,

- seismic events, and

- other external hazards.

The quantitative acceptance guidelines are discussed in Section 2.3.1.1.

In addition, although not required, the risk implications of the proposed SX CT are also qualitatively evaluated for the unit that will be shutdown during the evolution, consistent with Exelons risk management practices.

Page 3 of 52

The impact of the proposed change should be monitored using performance measurement strategies.

The three-tiered implementation approach consistent with RG 1.177 is used, as described in Section 2.3.

2.1 DEFENSE IN DEPTH EVALUATION The configuration to be entered decreases the redundancy of the Essential Service Water (SX) system due to the removal of two of the four SX pumps from service simultaneously. The reduced redundancy increases the potential for the plant to lose SX cooling to plant equipment. However, the current plant design and supporting analyses demonstrate that the plant has much more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis.

There are two capabilities with respect to the essential service water (SX) system that are credited in the risk analysis but are not credited in the licensing basis.

The first is the capability of a single SX pump to provide cooling to loads of both units. A best estimate flow analysis has shown that a single pump can provide cooling to all loads on both units with the exception of the Reactor Containment Fan Coolers (RCFC) and Emergency Diesel Generators (EDGs) on the unit without an SX pump and one train of RCFCs on the unit with an available SX pump. This analysis was performed assuming that the available SX pump is being cross-tied to the other unit to either maintain cooling to that unit while it is shutting down or responding to an accident condition. This crosstie is accomplished by opening the l/2SX005 valves (a remote action from the control room). These valves are Seismic Category I and Safety Related. As described later in this evaluation, one of the actions for a dedicated operator during the proposed SX CT is to validate that one of the SX005 valves is maintained in the open position to support an assumption in the risk assessment.

Page 4 of 52

The second capability credited in the risk analysis is the ability to provide cooling from the Fire Protection (FP) system to the Chemical and Volume Control (CV) centrifugal charging pumps. This capability is used to ensure that Reactor Coolant Pump (RCP) seal injection remains available in the event of an extended loss of SX. With the exception of the valves and fittings on the CV pump oil cooler, this connection is neither Seismic Category I nor Safety Related; however, its use is not credited for either seismic events or to mitigate a Loss of Coolant Accident (LOCA). In order to assure that these capabilities will be available during the planned evolution, the equipment associated with both the SX crosstie and the FP connection to the CV pumps will be considered Protected Equipment while the plant invokes the one-time extension to the CT of TS 3.7.8, Condition A. In addition, while invoking the one-time extension to the CT of Condition A, dedicated control room operators and shiftly briefings will supplement routine training on these actions performed as part of Licensed Operator Requalification Training. This increases the likelihood of performing the necessary actions successfully, if they are required.

The evaluation of defense in depth considerations for this proposed change considered the impact of the proposed configuration on the ability of the SX system to perform its intended functions and addresses the defense in depth considerations identified in RG 1.174.

The conclusion of this evaluation is that the one-time entrance into this configuration maintains the principles of defense-in-depth.

2.1.1 FUNCTIONAL ASSESSMENT Current Licensing Basis The current licensing basis for SX operation relies upon one SX pump providing adequate flow to important loads at that unit. In the event of loss of the operating SX Page 5 of 52

pump, the second pump could be manually started to restore flow. In the event the second pump is unavailable, the opposite-unit crosstie could be opened to provide flow from the two pumps at the opposite unit. These features are controlled by plant technical specifications.

Best Estimate Analysis A best estimate SX flow analysis was completed which demonstrates that one SX pump from either unit is capable of supporting shutdown loads of both units (with the exception of the reactor containment fan coolers (RCFCs) and emergency diesel generators (EDGs)). Thus, the first line of defense is the second pump at the unit, followed by the inter-unit crosstie; however, only one of the two SX pumps from the opposite unit is required to operate.

In addition, Byron Station has installed a modification to allow fire protection cooling to the CV Pumps in order to provide a continued flow of seal injection to the RCP seals in the event of loss of all SX. This capability, combined with the capability of the diesel-driven auxiliary feedwater pump and the startup and motor driven main feedwater pumps to operate without SX flow, allows the plant to maintain a hot standby condition in the event of loss of all SX.

SX LCO Configuration The proposed configuration considered in the CT extension involves having one of the SX pumps for each unit out of service simultaneously. This configuration eliminates the capability to start the second SX pump, but does not prevent the use of the opposite-unit crosstie or maintaining hot standby in the event all SX is lost.

Thus, while the level of redundancy is somewhat reduced in the proposed configuration, the plant retains a substantial defense-in-depth capability, beyond that considered in the current licensing basis.

Page 6 of 52

Table 1 provides a comparison of the licensing basis related to preventing and mitigating a loss of SX and the best estimate analysis. In addition, these are compared to the plant capability in the proposed configuration.

2.1.2 REGULATORY GUIDE 1.174 CONSIDERATIONS RG 1.174 provides additional guidance on how defense in depth should be evaluated.

These are evaluated in Table 2 for the planned SX configuration.

Page 7 of 52

Table 1 Defense-in-Depth Assessment of Planned SX Configuration Opposite-Unit Supply SX From Maintain Hot Standby Basis of Evaluation Restore Unit SX Crosstie Other Unit With Loss of SX Licensing Basis Start 2nd Unit SX Pump Open X-tie Valves 2 of 2 Pumps N/A Required from Other Unit Best Estimate Analysis Start 2nd Unit SX Pump Open X-tie Valves 1 of 2 Pumps

Provide FP Cooling to CV Required from Other Pump for RCP Seal Cooling Unit

DDAFW Pump or Main Feedwater Provides Heat Removal SX LCO Configuration N/A Open X-tie Valves 1 of 1 Pumps

Provide FP Cooling to CV Required from Other Pump for RCP Seal Cooling Unit

DDAFW Pump or Main Feedwater Provides Heat Removal Page 8 of 52

Table 2 Consideration of RG 1.174 Defense-in-Depth Guidelines Guideline Evaluation A reasonable balance is preserved No new challenge to core damage, containment among prevention of core damage, failure, or consequence mitigation is introduced by prevention of containment failure, and this one-time change.

consequence mitigation.

Over-reliance on programmatic The plant design is not being changed. Some activities to compensate for compensatory measures have been identified to weaknesses in plant design is avoided. maintain low risk, but these measures are consistent with normal plant practices.

System redundancy, independence, The risk analysis addresses this issue directly.

and diversity are preserved However, Table 1 provides a summary of the commensurate with the expected redundancy and diversity of success paths. This frequency, consequences of analysis demonstrates that substantial defense-in-challenges to the system, and depth is maintained.

uncertainties (e.g., no risk outliers).

Defenses against potential common No new common cause mechanisms are introduced cause failures are preserved, and the by this change. Where defenses against potential potential for the introduction of new common cause failures were impacted, additional common cause failure mechanisms is compensatory measures have been identified to assessed. mitigate the impact.

Independence of barriers is not This change has no impact on the independence of degraded. barriers.

Defenses against human errors are This change has no impact on the defense against preserved. human errors, as there are no new operator actions required when operating with an SX pump on each unit inoperable. The compensatory measures put in place are intended to improve defenses against human errors. The likelihood of requiring operator actions to respond to a loss of SX on a unit is increased. The risk assessment recognizes this and establishes compensatory measures designed to decrease the potential for human error if these actions are required.

The intent of the General Design This change does not impact the GDC.

Criteria in Appendix A to 10 CFR Part 50 is maintained.

Page 9 of 52

2.2 SAFETY MARGIN EVALUATION The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following:

Codes and standards (e.g., American Society of Mechanical Engineers (ASME),

Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved for use by the NRC) are met. The proposed change is not in conflict with approved codes and standards relevant to the SX system.

While in the proposed configuration, safety analysis acceptance criteria in the UFSAR are met, assuming there are no additional failures.

This is consistent with the guidelines provided in RG 1.177 for risk-informed changes to technical specifications.

2.3 RISK EVALUATION The risk impact of the proposed changes has been evaluated and found to be acceptable. The effect on risk of the proposed increase in Completion Time for restoring an inoperable SX Train has been evaluated using the NRC three-tier approach suggested in RG 1.177 (Reference 4). Although RG 1.177 is primarily intended for permanent changes to plant technical specifications, the general framework of considerations is considered applicable:

Tier 1 - Probabilistic Risk Assessment (PRA) Capability and Insights Tier 2 - Avoidance of Risk-Significant Plant Configurations Tier 3 - Risk-Informed Configuration Risk Management Page 10 of 52

2.3.1 TIER 1: PRA CAPABILITY AND INSIGHTS Risk-informed support for the proposed change is based on PRA calculations performed to quantify the Incremental Conditional Core Damage Probability (ICCDP) and the Incremental Conditional Large Early Release Probability (ICLERP) resulting from the increased Completion Time for the SX train. These ICCDP and ICLERP values are also equivalent to the increase in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the year as Unit 1 will only enter the extended Completion Time once. However, since this is a one-time change it does not result in a permanent increase in CDF or LERF (i.e., CDF or LERF).

Updating and maintenance of the Byron Station PRA is controlled under Exelon Nuclear Engineering Procedure, ER-AA-600, Risk Management (Reference 16). The Byron Station PRA was recently updated in accordance with this procedure and associated guidance. The PRA addresses internal events at full power, including internal flooding.

Other risk sources and operating modes are discussed qualitatively below, except for the internal fire which is quantitatively evaluated as discussed below. This and prior model updates have incorporated recent advances in PRA technology across elements of the PRA, and have maintained a special effort to ensure that those aspects of the PRA that are potentially sensitive to changes in SX system reliability, including SX pump maintenance unavailability are adequate to evaluate the risk impacts of the increased SX Completion Time. These aspects include:

the impact of maintenance unavailability on the loss of SX initiating event frequencies, including the conditions considered in this analysis;

treatment of the SX unit and train crosstie capability;

use of plant specific data; and

operator interviews to validate appropriate characterization of operator actions available to mitigate a loss of SX initiating event.

The focus on SX modeling in the PRA, as noted above, has been maintained since the PRA was applied in support of a prior temporary SX Completion Time increase in support of SX Pump repair.

Page 11 of 52

The Byron Station LERF model uses a realistic, plant-specific model that is an extension of the methodology described in NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, October 2004 (Reference 18). This model supports a realistic quantification of LERF based on:

plant damage states that reflect the appropriate plant conditions at the time of core damage,

containment isolation failures based on plant-specific system models,

plant-specific analysis of containment bypass sequences (e.g., interfacing system LOCA and steam generator tube rupture (SGTR))

realistic, plant-specific assessment of unit-specific containment ultimate pressure capability,

important severe accident phenomena including high pressure melt ejection and induced steam generator tube rupture, and

plant-specific thermal hydraulic analyses reflecting the severe accident conditions expected to be present.

The scope, level of detail, and technical capability of the Byron Station PRA are sufficient to support a technically defensible and realistic evaluation of the risk change from this proposed Completion Time extension.

An independent assessment of the Byron Stations internal event PRA, using the self-assessment process developed as part of the Westinghouse Owners Group (WOG)

PRA Peer Review Certification Program, was conducted by a recognized industry expert. This independent review was performed from May through July of 1999 to evaluate the quality of the PRAs and completeness of the PRA documentation.

Substantive comments and observations generated by this assessment, including those focused on the risk elements that are needed to evaluate the proposed Completion Time extension, have been addressed. Peer review of the Byron Station PRA was performed in July 2000. A team of independent PRA experts from U.S. nuclear utility PRA groups and PRA consultant organizations carried out these peer reviews. The Page 12 of 52

intensive peer reviews involved approximately two person-months of engineering effort by the review team and provided a comprehensive assessment of the strengths and limitations of each element of the PRA. All of the findings and observations from these assessments that the review team indicated were important and those that involved risk elements needed to evaluate the proposed Completion Time extension were dispositioned. This resulted in a number of enhancements to the PRA models prior to their use to support the proposed change.

In 2008, a gap assessment was performed to evaluate the Byron PRA model against the ASME PRA Standard (Reference 20) was performed using Regulatory Guide 1.200, Revision 1 (Reference 21).

A summary of the evaluation of the technical adequacy of the Byron PRA for this application is provided in Attachment 6. As a result of the considerable effort to incorporate the latest industry insights into the PRA upgrades, self-assessments, and Owners Group peer reviews, Exelon is confident that the results of the risk evaluation are technically sound and consistent with the expectations for PRA technical capability set forth in RG 1.174 (Reference 5), RG 1.177 (Reference 4), and RG 1.200 (Reference 21).

Byron Station evaluated the risks of external hazards as part of the Individual Plant Examination of External Events (IPEEE) process. Performed in the late 1990s, these evaluations included qualitative and conservative quantitative estimates of the plant capability to mitigate a range of potential external hazards. Since the time of the IPEEEs, the plants have made a number of plant improvements, including the addition of the capability to cool the CV pumps using water from the fire protection system.

While the IPEEE analyses have not been updated to reflect the as-built and as-operated plant, Byron has initiated a project to complete an updated fire PRA with the EPRI/NRC fire PRA methodology, NUREG/CR-6850 (Reference 26), as its foundation. This fire PRA model addresses core damage due to internal fires and contains all the essential elements of a fire PRA required by NUREG/CR-6850 and augmented by recent industry research and insights with respect to fire PRA methods. This model is used to provide risk insights (e.g., risk contributors and potential compensatory measures) and Page 13 of 52

conservative quantitative risk estimates. The quantitative results are not directly comparable to the internal events PRA due to the strong conservative bias in the development of the current fire PRA model. However, even this conservative fire PRA is sufficient to demonstrate that fire risks are not significant to the decision to grant the one-time CT extension.

For the purposes of this submittal, the risks from external hazards are demonstrated to not be significant to the quantitative risk insights based on insights from the IPEEE or with bounding quantitative methods using the insights from the internal events PRA and the internal fire PRA. This approach is consistent with NRCs recently released guidance on the treatment of completeness uncertainty contained in NUREG-1855 (Reference 27).

2.3.1.1 QUANTITATIVE ACCEPTANCE GUIDELINES No specific quantitative guidelines are provided in RGs 1.174 and 1.177 for one-time risk-informed changes. The quantitative acceptance guidelines in Section 2.2.4 of RG 1.174 are expressed in terms of changes to the annual average impact on core damage frequency (CDF) and large early release frequency (LERF). Since this is a one-time change, the risk impact would not result in an on-going change in CDF and LERF.

Nevertheless, as a point of reference, the quantitative acceptance guidelines in RG 1.174 state that a long-term increase in CDF of less than 1E-6/yr and LERF of less than 1E-7/yr would be considered to be very small.

RG 1.177 was developed specifically for technical specification changes. However, the acceptance guidelines provided in Section 2.4 (ICCDP < 5E-7, ICLERP < 5E-8) are clearly stated to be applicable only to permanent (as opposed to temporary, or "one time") changes to TS requirements. Permanent changes, by their very nature, imply that the condition could be entered into multiple times, whereas a one-time change would only be entered under specific conditions for a specific purpose.

NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (Reference 8) addresses monitoring risk during maintenance Page 14 of 52

activities and provides quantitative guidelines that indicate that routine activities should generally not involve an increase in incremental conditional core damage probability (ICCDP) of greater than 1E-6 or an incremental conditional large early release probability (ICLERP) of greater than 1E-7. The NRC has endorsed these guidelines in Regulatory Guide 1.182. This planned one-time configuration would not be considered routine maintenance. As such, the routine guideline is judged to be a conservative acceptance guideline. NUMARC 93-01 also recommends that an upper limit configuration-specific CDF of 1E-3/yr be used. Although the NRC has not explicitly endorsed this guideline, it is considered relevant to this one-time change.

Based on the available quantitative guidelines for other risk-informed applications, it is judged that the quantitative criteria shown in Table 3 represent a reasonable set of acceptance guidelines. Less restrictive guidelines could also be justified, but for the purposes of this evaluation, these guidelines demonstrate that the risk impacts are acceptably low.

Table 3 Proposed Risk Acceptance Guidelines RISK ACCEPTANCE GUIDELINE BASIS ICCDP < 1E-6

ICCDP is an appropriate metric for assessing risk impacts of out of service equipment per RG 1.177

& NUMARC 93-01

1E-6 is consistent with NUMARC 93-01 guidance, as endorsed in RG 1.182, for routine maintenance and with RG 1.174 increases assess as very small

Greater than RG 1.177 guideline (5E-7) for permanent TS changes, but that criterion is applied to changes which are allowed to be entered repeatedly over the life of the plant, whereas the proposed SX CT is a one time change.

ICLERP < 1E-7

ICLERP is an appropriate metric for assessing risk impacts of out of service equipment per RG 1.177

& NUMARC 93-01

1E-7 is consistent with NUMARC 93-01 guidance, as endorsed in RG 1.182, for routine maintenance and with RG 1.174 requirement that risk increases are very small

Greater than RG 1.177 guideline (5E-8) for permanent TS changes, but that criterion is applied to changes which are allowed to be Page 15 of 52

entered repeatedly over the life of the plant, whereas the proposed SX CT is a one time change.

Configuration-specific CDF

NUMARC 93-01 recommends configurations

< 1E-3/yr exceeding this guideline be avoided.

Page 16 of 52

2.3.1.2 RISK FROM INTERNAL EVENTS The Byron Station internal events PRA were used as a tool to evaluate the quantitative risk impacts due to internal events during the planned SX configuration. To determine the effect of the proposed 144-hour Completion Time for restoration of an inoperable SX train, the guidance suggested in RG 1.177 was used. Thus, the following risk metrics were used to evaluate the risk impacts of extending the SX train Completion Time from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months .

ICCDP{xY} = incremental conditional core damage probability with SX train Y on Unit x out-of-service for an interval of time equal to the proposed new Completion Time (i.e.,144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , or 6 days).

ICLERP{xY} = incremental conditional large early release probability with SX train Y on Unit x out-of-service for an interval of time equal to the proposed new Completion Time (i.e., 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , or 6 days).

The ICCDP and ICLERP are computed using definitions in RG 1.177. In terms of the above defined parameters, the definition of ICCDP is as follows.

ICCDPxY = (CDFxYOOS CDFxBASE )

TCT ICCDPxY = (CDFxYOOS CDFxBASE ) (6days) (365days / year ) 1 ICCDPxY = (CDFxYOOS CDFxBASE ) 1.64 x10 2 Where TCT = the requested Completion Time.

Note that in the above formula, 365 days/year is merely a conversion factor to get the Completion Time units consistent with the CDF frequency units. The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Completion Time.

Similarly, ICLERP is defined as follows.

ICLERPxY = (LERFxYOOS LERFxBASE ) 1.64 x10 2 Page 17 of 52

The intermediate results of the risk evaluation are presented in Table 4, Intermediate Results of Risk Evaluation for Byron Station. The base CDF value for Byron Unit 1 due to internal events and internal flooding is 2E-05/year based on the average unavailability of the SX SSCs using plant specific data.

Table 4 Intermediate Results of Internal Events and Internal Flooding Risk Evaluation for Byron Station Unit 1 Risk Metric LAR Parameter 1SX01PA & 2SX01PA CDFBase CDFxBase 2E-5 CDFCT Configuration CDFxYOOS 3E-5 LERFBase LERFxBase 1E-6 LERFCT Configuration LERFxYOOS 1E-6 NOTE: The details of the calculations are provided in Appendix A of BY-LAR-001 (Reference 28).

The risk evaluation of internal events incorporates a number of compensatory measures that the plant will take during the SX CT to assure the risk impacts are acceptably low.

Table 14 provides the details on how these compensatory measures are to be applied during the 1/2SX001A maintenance evolution for Byron station.

Credit for a dedicated operator to maintain and respond to SX-related problems is recognized as a key compensatory measure. Implementation of this measure will consist of the assignment of dedicated operators inside and outside the control room to back up the nominal staff for these actions. These personnel represent additional operators (i.e., one Senior Reactor Operator (SRO) in the control room, one Reactor Operator (RO) and one Equipment Operator) assigned to monitor SX performance and take the identified actions if required as a back up to the nominal shift staff. The only duties assigned to these dedicated operators will be those associated with the actions identified in the risk assessment credited to reduce the risk impact.

Page 18 of 52

The following preparation activities will be performed for the personnel assigned to this dedicated operator positions:

Provide refresher training on establishing the SX unit crosstie, alignment of alternate cooling for the CV pumps, alignment of the CV pump suction from the VCT to the RWST, and other actions directed by station abnormal procedures in response to a loss or degradation of the SX system. This training will also be provided for control room operators and equipment operators assigned to the nominal shift coverage.

Conduct training to walk through the alignment actions with the dedicated operators prior to entering the SX LCO.

Implementation of the dedicated operator positions will include:

Providing briefings on the SX alignment and the conditions that could require performance of these operator actions at each shift change;

Validating the position of the 1(2)SX005 valves to meet the assumptions contained in the risk assessment (either 1SX005 or 2SX005 open)

Validating the isolation of one train of the Unit 2 RCFCs to meet the assumptions contained in the risk assessment

Implementation of the Adverse Condition Monitoring Plan for CV pump bearing temperatures to meet the assumptions contained in the risk assessment

Monitoring SX pump and system performance (including SX pump motor parameters such as volts/amps, temperatures, etc)

Providing copies of the procedures for the actions to establish the SX unit crosstie, aligning fire protection cooling for the CV pumps and alignment of the CV pump suction from the VCT to the RWST to the dedicated Control Room and equipment operators prior to each shift change to minimize the need to locate the procedures during loss of SX conditions

Validating the placement of ladders/stepping stools in locations where the fire protection hose hookup is above the height that an operator can reach without assistance (such as the B charging pump rooms), and

If required, readiness to perform the actions directed by station abnormal procedures in response to a loss or degradation of the SX system Page 19 of 52

Command and Control Attributes The dedicated SRO, RO and equipment operator will specifically monitor SX performance. These personnel will report directly to the operating unit's Unit Supervisor who reports to the Shift Manager. The dedicated equipment operator will report to the dedicated SRO. Standard three-way communication protocol will be used throughout the evolution.

The dedicated SRO and RO will identify the entry conditions for implementation of the appropriate abnormal operating procedures and direct the activities of the dedicated equipment operator in accordance with the abnormal procedure. They will inform the Unit Supervisor that the entry conditions have been reached and they are implementing the appropriate abnormal operating procedure. They will subsequently report the results of the actions to the Unit Supervisor.

Communications from the control room to the dedicated equipment operator will be accomplished using the normal radio system, telephone or plant page. These systems are verified operational through normal frequent use and have proven to be adequate for all plant evolutions based on years of operating experience.

The actions that the dedicated operators would be expected to perform are listed in Table 5 below.

Table 5 - Operator Action Summary Consequences if Not Task Location Complexity/Difficulty Performed Establish SX unit Main Control Room Isolate flow to one Loss of SX, requires Crosstie given loss RCFC train, open additional action to of SX on Unit 1 crosstie valve establish alternate cooling to CV pumps to maintain RCP seal injection and prevent potential for RCP Seal LOCA Establish alternate CV Pump Room Locally connect fire Loss of CV pumps for cooling (i.e., FP) to hose to CV pump oil RCP seal injection.

CV pump oil cooler cooler connection (pre- Potential for RCP Seal given loss of CCW staged), isolate normal LOCA cooling flow path from SX, open FP valve Establish cool Main Control Room Align seal return to Loss of CV pumps for suction source for pressurizer relief tank, RCP seal injection.

Page 20 of 52

CV pumps given monitor seal water heat Potential for RCP Seal loss of CCW exchanger outlet LOCA cooling temperature (if greater than 160°F, align CV pumps suction to refueling water storage tank)

Table 6 below provides a summary of the time available as well as the time required to take these actions. The Time Required includes travel time associated with the designated operators. This time was obtained from a review of operations simulator training records, including job performance measures. Each of these actions assumes a cue time of 1 minute, although there is substantially more time available than required to perform the actions.

Page 21 of 52

Table 6 - Operator Action Time Summary Task Time Available Time Required Establish SX unit crosstie 90 Minutes 10 Minutes Establish alternate cooling (i.e., 90 Minutes 20 Minutes FP) to CV pump oil cooler Establish cool suction source for 30 Minutes 10 Minutes CV pumps Other than the FP connection to the CV pumps, all actions can be taken from the control room. The FP connection to the CV pump is performed in the CV pump rooms in the auxiliary building. The CV pump rooms are not adverse environment areas and there are no special access requirements necessary to perform the prescribed actions other than normal radiation work permit compliance.

Comparison of Internal Events and Internal Flooding Results to Risk Acceptance Guidelines The results of the risk evaluation are compared in Table 7 with the risk acceptance guidelines from Table 3. The values for the ICCDP and the ICLERP demonstrate that the proposed SX train Completion Time change has a very small quantitative impact on plant internal events risk. The results have decreased from the previous SX CT one time submittal (Reference 22) with 3E-7 ICCDP due to incorporation of the WOG 2000 RCP Seal LOCA model (Reference 23) which is an industry consensus model.

Table 7 Results of Internal Events and Internal Flooding Risk Evaluation for Byron Station Risk Metric Risk Acceptance Internal Events Guideline Risk Metric Results ICCDP < 1E-6 1E-7 ICLERP < 1E-7 3E-9 CDFSX CT Configuration < 1E-3/yr 3E-5 Page 22 of 52

Conclusions Related to Internal Event Risks The evaluation of the quantitative impact on internal events risk due to the planned configuration demonstrates that the impact on the likelihood of core damage and large early release is well below the risk acceptance guidelines.

2.3.1.3 RISK FROM INTERNAL FIRES A quantitative analysis of internal fire vulnerabilities was conducted as part of the Byron Station IPEEE (Reference 11). The Byron Station Individual IPEEE was submitted to the NRC on December 23, 1996. Requests for additional information (RAIs) were issued by the NRC on July 23, 1998 for the Byron Station. Responses to most of the station-specific questions in the RAIs were provided on January 29, 1999. Plant-specific responses to the generic fire issues were provided on July 15, 1999, after the Electric Power Research Institute (EPRI) and Nuclear Electric Institute (NEI) final generic responses were issued.

As further described below, a Fire PRA model has been in development for Byron Station over the past 4 years. Although not yet considered capable of providing fully realistic fire risk results, the model is judged to be capable of providing reasonable risk insights and quantitative results when carefully applied. Using this model, a conservative quantitative assessment of fire CDF risk related to the SX CT was performed to gain insights into the risk exposure during time periods when the two train A SX pumps are unavailable due to maintenance on the 1SX001A and 2SX001A valves.

The assessment process involved the comparison of the fire risk characterization for a baseline configuration against that for a configuration in which the two train A SX pumps (1A and 2A) are unavailable due to maintenance on the 1/2SX001A valves. The Fire PRA for Byron (Reference 17) was used in support of this assessment, with the plant configuration setting (i.e., compensatory measures) the same as the internal events risk assessment during this maintenance evolution.

Page 23 of 52

Fire PRA Model Basis The Fire PRA model for the Byron station has been undergoing a continuous development process over the last 4 years with incremental refinement of the model.

The Byron Fire PRA model is completing a significant revision incorporating many of the methods defined in NUREG/CR 6850. Listed below are some of the key features of the current Byron Fire PRA model that has been used to estimate the impact of the Byron SX CT extension on overall plant risk:

1. A new walkdown has been recently completed to define ignition frequencies in accordance with the counting methodology specified in NUREG/CR 6850

2. Cable identification and cable routing is taken from the 10 CFR 50 Appendix R analysis, supplemented for Appendix R components with failure modes that do not match PRA failure modes

3. A recent update of the correlation between Appendix R Safe Shutdown equipment and PRA model basic events has been completed

4. Fire scenario definition has also been updated based on recent walkdowns using a scoping fire modeling criteria supported by extensive generic fire modeling analyses

5. Fire ignition frequency data from the updated EPRI report (Reference 25) were used in this analysis (a sensitivity analysis was also performed comparing the results to those associated with the use of the NUREG/CR-6850 (Reference

26) ignition frequency data The framework for the Fire PRA update is based on the NUREG/CR-6850 methodology.

The current model is not considered a realistic fire PRA for the following reasons:

Many scenarios remain based on bounding assumptions of fire damage based on compartment boundaries, i.e., all equipment and cables in the compartment are assumed damaged. As a result, the extent of fire damage is overstated in these scenarios.

Even when more detailed scenarios are defined to assess the consequences of specific ignition sources, only scoping fire modeling criteria are used, i.e., no Page 24 of 52

detailed fire modeling has been performed. The effects of fires defined in NUREG/CR-6850 are assessed using conservative scoping fire modeling criteria.

As a result, the extent of fire damage is overstated in many fire core damage scenarios.

Potential human actions to mitigate the effects of fire related damage are not considered in many of the fire PRA core damage scenarios. As a result, the likelihood of fire damage is overstated in many fire core damage scenarios.

Exelon plans to continue the development of the Fire PRA based on scenario refinement and application of improved methods and data with the ultimate goal of developing a realistic fire PRA. In its current state, the fire PRA provides a conservative estimate of the fire risks for Byron station.

Areas of uncertainty associated with this model are primarily related to areas of conservatism in the inputs to the model, which include:

1. Heat release rate data

2. Fire development timeline

3. The use of bounding fire scenarios and scoping fire modeling analyses in lieu of a detailed assessment of fire effects through fire modeling The conservatism inherent in the current model does not, however, significantly impact the models ability to evaluate changes in risk. The review of the impact of the SX CT extension is primarily based on a comparison between the risk associated with the base model versus the risk associated with the addition of equipment status associated with the CT window. Since the model conservatism for delta-risk calculations is primarily associated with inputs to the model such as ignition frequency, heat release rate and fire damage, the impact of the conservatism is limited and does not tend to mask the impact of the plant configuration change which is being evaluated.

The quantitative evaluation performed has focused on the impact of the SX CT extension on CDF. The impact on LERF is expected to be less than that on CDF since the SX system maintenance does not alter containment isolation capability functionality Page 25 of 52

and the only impact on the primary systems credited to mitigate LERF events is quantified in the CDF evaluation. Therefore, the impact on LERF will be a fraction of the percentage impact on CDF.

Fire Risk Evaluation Results The intermediate results of the conservative fire risk evaluation are presented in Table 8, Intermediate Results of Internal Fire Risk Evaluation for Byron Station. The base fire CDF value for Byron Unit 1 is 5E-05/year based on the average unavailability of the SX pumps using plant specific data.

Table 8 Intermediate Results of Internal Fire Risk Evaluation for Byron Station Unit 1 Risk Metric 1SX01PA & 2SX01PA Fire CDFBase 5E-5/yr Fire CDFSX CT Configuration 1E-4/yr NOTE: The details of the calculations are provided in Appendix B of BY-LAR-001 (Reference 28).

Comparison of Internal Fire Results to Risk Acceptance Guidelines The results of the risk evaluation are compared in Table 9 with the risk acceptance guidelines from Table 3. The values for the ICCDP demonstrate that the proposed SX train Completion Time change has a very small quantitative impact on plant risk.

Table 9 Results of Internal Fire Risk Evaluation for Byron Station Risk Metric Risk Acceptance Internal Fire Guideline Risk Metric Results Fire ICCDP < 1E-6 9E-7 Fire CDFSX CT configuration < 1E-3/yr 1E-4/yr Page 26 of 52

A sensitivity analysis was done to compare the results using the updated EPRI ignition frequency data (Reference 25) with the fire ignition frequencies found in NUREG/CR-6850 (Reference 26). The ICCDP for the case when the NUREG/CR-6850 fire frequencies were used was 9.6E-7.

The compensatory measures identified through the assessment of internal events included establishing restrictions on concurrent maintenance activities on several plant components and trains. These compensatory actions are summarized in Table 14.

These compensatory actions were incorporated in the delta CDF Fire analysis.

Fire specific recommendations for actions which can be taken to provide additional defense in depth and safety margin are summarized below.

1. Implement monitoring of the Train B SX pumps and motors focusing on precursor indicators of a fire event (e.g., motor volts, amps, temperatures).

2. Manage plant operations to minimize, or preclude, breaker switching operations on Switchgear Bus 142.

3. Perform a walkdown to identify and ensure transients are within administrative limits prior to the start of the SX CT. Also identify any transient ignition sources (energized temporary cables) and remove or ensure that measures are taken to limit their potential contribution to a transient fire. These actions are to be addressed in the areas identified in Table 10.

Table 10 lists the fire areas that comprise the majority of the risk due to fire while the SX pumps are unavailable in support of the 1(2)SX001A valve maintenance. The table is sorted from most risk significant to least. The risk ranking does not include credit for the above recommended actions for further reduction of fire risk.

Page 27 of 52

Table 10 List of Important Fire Areas for Unit 1 with SX 1A/2A in Maintenance No. Fire Zone Scenario ID - Description 1 5.1-1 Division 12 ESF switchgear room (focus on switchgear 142) 2 11.3-0 Auxiliary building general area, Elev. 364 (focus on MCC 132X1) 3 11.1B-0 Unit 2 auxiliary building basement (SX B Train Pump Room) 4 11.6-1 Division 12 containment electrical penetration area 5 11.6-0 Aux building general area, Elev. 426 (focus on SWGR 134X) 6 11.3-1 Unit 1 containment pipe penetration area (focus on MCC 131X1) 7 11.4-0 Aux building general area, Elev. 383 (focus on 1AF01PA, 2AF01PA and MCC 132X3) 8 5.5-1 Unit 1 auxiliary electrical equipment room (focus on 1PA23J) 9 5.2-1 Division 11 ESF switchgear room (focus on switchgear 141)

Conclusions Related to Fire Risk A conservative evaluation of the quantitative impacts of internal fire risks due to the planned configuration demonstrates that the impact on the likelihood of core damage is below the risk acceptance guidelines, even if it is considered in combination with the more realistic internal events results.

On a strictly qualitative basis, based on a review of the scenarios addressed in the fire PRA, a success path to prevent core damage has been identified for every fire scenario that has a significant increase in risk due to the planned SX system configuration. In addition, compensatory measures have been identified that further reduce the risk of these fire scenarios.

2.3.1.4. RISK FROM SEISMIC EVENTS The seismic analyses in the Byron Station IPEEEs were based on the seismic margin assessment. No significant seismic concerns were identified and it was concluded that the plants possess significant seismic margin. The IPEEEs did identify some seismic outliers (i.e., control room lighting diffuser panels and electrical cabinet interactions).

Page 28 of 52

These seismic outliers have been resolved either by additional analysis or completion of design modifications.

The impact of removing two same train SX pumps from service has been evaluated to ensure that the seismic risk impact is not significantly increased (e.g., the results of the Seismic IPEEE are essentially unchanged). The interaction between seismic events and the SX systems are dominated by seismically-induced loss of offsite power and station blackout events, as well as the function of the SX system to provide a suction source to the auxiliary feedwater (AF) pumps following a seismic event.

The configuration during the extended Completion Time will involve both units same train SX pumps unavailable concurrently (i.e., 1A and 2A). Since the configuration of the SX system does not change the seismic capacity of the system, and two available SX pumps are sufficient to support the SX success criteria required by the Success Path Equipment List (SPEL), then the results of the Seismic Margins Analysis (SMA) are unchanged.

No other issues unique to the configurations required during the SX out of service were identified during a review of the IPEEE information that would result in the plant High Confidence of Low Probability of Failure (HCLPF) dropping below 0.3g.

Therefore, Byron Station will continue to possess a HCLPF of 0.3g, and the risk from seismic initiators is considered small.

Recent Plant Modification Review Since the completion of the IPEEE, modifications have been made to the plant to include the erection of a security tower at Byron Station. This security tower is attached to the SX towers. These towers are designed to all design basis seismic, high wind and tornado loads. However, the IPEEE seismic event is a 0.3g earthquake compared to the 0.2g design basis earthquake. The seismic loading from a 0.3g earthquake has been analyzed and determined to be enveloped by the tornado loading for the structure; therefore, this HCLPF of 0.3g is maintained (Reference 13).

Page 29 of 52

Seismic Screening Analysis The SX system performs several functions that might have an increased significance following a seismic event. These functions include:

provide cooling to emergency diesel generators following a seismically induced loss of offsite power (LOOP);

provide a backup supply of water to the auxiliary feedwater pumps in the event of seismically induced failure of the CST; and

provide a backup supply of water to the fire protection system in the event of seismically-induced failure of the fire protection pumps.

The deterministic evaluation presented in Section 2.1 describes the basis for SX system defense in depth. The following evaluation demonstrates that likelihood of these functions being demanded are very low and, therefore, any risk impacts to the configuration would be expected to be very small.

Seismic-Induced LOOP Past seismic PRAs have shown that seismic-induced loss of offsite power can be an important contributor to seismic risk due to the unrecoverable loss of offsite power. SX performs an important function following a LOOP. Thus, a screening analysis was performed to evaluate the potential risk impacts of the planned configuration on seismic induced LOOP.

The non-recovered internal events dual-unit LOOP (i.e., DLOOP) frequency for Byron Station is ~2E-3/yr. Seismically induced LOOP (assumed non-recoverable) is estimated to be on the order of 5E-05/yr for Byron Station based on seismic hazard curves from NUREG-1488 (Reference 9) and the generic offsite power fragilities from the supporting analyses to NUREG/CR-4550 (Reference 10).

Page 30 of 52

There are no issues regarding this configuration that negatively impact the seismically induced LOOP frequency. Hence, since the seismically induced LOOP frequency is small compared to the internal events DLOOP frequency, and the LAR will not increase the seismically induced LOOP frequency, seismically induced LOOP represents a negligible risk source for this configuration.

Seismically induced Station Blackout (SBO) is estimated to be on the order of 1E-06/yr for Byron Station based on seismic hazard curves from NUREG/CR-1488 and generic EDG fragilities from NUREG-1150. Seismically induced LOOP with random SX pump failure would result in an SBO on the unit with the failed SX pump.

Note that SX crosstie is not credited in this case as it is assumed that the diesel fails due to lack of cooling before the SX crosstie is made. Furthermore, the 4kV bus crosstie is not credited when only 1 EDG is available on both units. Thus, the planned configuration causes some increase in the potential for seismic-induced station blackout due to the reduced redundancy of the SX system.

Based on the internal events PRA, the probability of SX pump failure to start and run after a demand is about 1E-03. Given a seismic-induced LOOP frequency of roughly 5E-5/yr, the probability of seismically induced LOOP with the random failure of an SX pump is less than 1E-07/yr. Since this is about an order of magnitude less than seismically induced SBO, and there are known conservatisms regarding this scenario, the configuration specific SBO is not a significant contributor to seismic risk. Further more, this risk contribution would only last for a maximum of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This would translate to an ICCDP of less than 1E-9.

SX as Backup for CST The CST is not considered in the SPEL in the Byron Station IPEEE SMA. The CST is not seismically qualified in the station design basis, and SX is used to supply secondary heat removal via the steam generators. SX is supplied at the suction of the AF pumps via the 1(2)AF006A(B) and 1(2)AF017A(B) motor operated valves (MOVs). These MOVs open automatically on low suction pressure, or can be remote manually operated Page 31 of 52

from the control room, or locally manually opened. The MOVs were determined to have a HCLPF of at least 0.3g, and no interaction issues were identified.

In the SX maintenance configuration, a flow path will remain from the available SX pump to the suction of the AF pumps. This flow path could be lost following a seismically induced SX pipe break that would require isolation of the SX033/SX034 MOVs on the operating unit. However, this would not only effectively isolate suction to one of the two AF pumps, it would also result in loss of cooling to the respective AF pump. The AF pump would be lost regardless of the suction source, and therefore, relying on the SX as the AF pump suction source does not result in an increase in risk.

Finally, since the SX piping has a HCLPF of at least 0.3g, it is unlikely that a seismic event less than the plant HCLPF would result in an SX pipe break.

SX as Backup to Fire Protection The SX system can provide a backup supply of water to the fire protection system in the event of seismically-induced failure of the fire protection pumps. This function would only be necessary if the seismic event caused a fire and failure of the fire protection pumps. The Byron Station IPEEEs specifically investigated the potential for seismic-induced fires. The conclusion of the IPEEE analysis was that there was no significant risk from seismic-induced fires at Byron Station. Given this finding, it is concluded that the impact of the planned configuration on this function of SX is not risk significant.

2.3.1.5 RISK FROM OTHER EXTERNAL EVENTS Evaluation of high winds, external floods, and other external events in the Byron Stations IPEEEs, which are in accordance with NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991, indicated that the sites conform to NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, June 1987, criteria and revealed no potential vulnerabilities.

Page 32 of 52

The impact of the extended SX train Completion Time on the risk profile associated with these external events is discussed below.

The potential impact of other external events occurring during the SX extended Completion Time (CT) was considered based on the results of the Byron Station IPEEE (Reference 11). The IPEEE considered a broad spectrum of other potential external event hazards including:

Rail Transportation Accidents

Barge Transportation Accidents

Pipeline Transportation Accidents

Military Facilities

On-site Hazardous Material Accidents

Severe Temperature Transients

Severe Weather Storms

Lightning Strikes

External Fires

Extraterrestrial Activity

Volcanic Activity

Abrasive Windstorms All of these hazards were evaluated in the IPEEE against the criteria provided in NUREG-1407 (Reference 12) and found to pose no risk significance.

Many of these hazards are totally unrelated to risk associated with the SX extended CT.

Table 11 summarizes the relationship of these hazards to the SX extended CT configuration. Only three of the IPEEE hazards were identified as having any potential to impact risk during the SX extended CT. The three hazards identified are:

Severe Temperature Transients - Severe temperature transients could challenge SX makeup (i.e., during very low temperatures) or heat removal capability (i.e., during very high temperatures). However, the one-time CT extensions will be entered during a scheduled refueling outage. Refueling outages are scheduled at times in Page 33 of 52

the year (i.e., Fall and Spring) when severe temperature transients would be extremely unlikely. The IPEEE states that the impact of Severe Temperature Transients is to cause a loss of offsite power. These events are considered in the loss of offsite power and recovery analysis in the Internal Events PRA and are, therefore, included in the computed ICCDP/ICLERP.

Severe Weather Storms - Severe weather storms include high winds and tornadoes.

The SX pumps and all associated support and mitigation systems are located in buildings that are designed for tornadoes and high winds. Thus, they are protected from the effects of these events. High winds and tornadoes can cause loss of offsite power. These events are considered in the loss of offsite power and recovery analysis in the Internal Events PRA and are, therefore, included in the computed ICCDP/ICLERP. As identified in Table 14 below, planned maintenance on all four EDGs and associated electrical buses will not be allowed while the CT is in effect.

This assures that the electrical power will be available should a LOOP occur.

Lightning Strikes - Lightning strikes can cause loss of offsite power or reactor trips.

These events are considered in the Internal Events PRA and are, therefore, included in the computed ICCDP/ICLERP.

Based on this evaluation, it is concluded that other external events have a negligible impact on the risk associated with the SX CT extension.

Page 34 of 52

Table 11 Summary of Impact of Other External Hazards on SX Extended CT Risks Impact on Other External Event Hazard SX Extended CT Basis Rail Transportation Accidents None The threat to SX and associated mitigation is unchanged by the SX configuration.

Barge Transportation Accidents None The threat to SX and associated mitigation is unchanged by the SX configuration.

Pipeline Transportation None The threat to SX and associated Accidents mitigation is unchanged by the SX configuration.

Military Facilities None The threat to SX and associated mitigation is unchanged by the SX configuration.

On-site Hazardous Material None The threat to SX and associated Accidents mitigation is unchanged by the SX configuration.

External Floods None The threat to SX and associated mitigation is unchanged by the SX configuration.

Severe Temperature Negligible/Already One-time outages scheduled during Transients Addressed Spring and Fall Severe Weather Storms Negligible/Already Likelihood of damage to operating SX Addressed intake is negligible.

Lightning Strikes Already Already considered in the Internal Addressed Events PRA External Fires None The threat to SX and associated mitigation is unchanged by the SX configuration.

Extraterrestrial Activity None The threat to SX and associated mitigation is unchanged by the SX configuration.

Volcanic Activity None The threat to SX and associated mitigation is unchanged by the SX configuration.

Abrasive Windstorms None The threat to SX and associated mitigation is unchanged by the SX configuration.

Page 35 of 52

2.3.1.6

SUMMARY

OF RISK INSIGHTS The above evaluation assesses the risk from the following sources:

Internal Events (including Internal Flooding)

Internal Fire

Seismic Events

Other External Hazards The results of the risk evaluations are compared in Table 12 with the risk acceptance guidelines from Table 3. The values for the ICCDP and the ICLERP demonstrate that the proposed SX train Completion Time change has a very small quantitative impact on plant risk.

Table 12 Overall Results of Risk Evaluation for Byron Station - Unit 1 Risk Risk Metric Results Risk Metric Acceptance Internal Internal Seismic and Guideline Events1 Fire2 Other External ICCDP < 1E-6 1E-7 9E-7 Negligible ICLERP < 1E-7 3E-9 Negligible Negligible CDFBase < 1E-4/yr 2E-5/yr 5E-5/yr ~1E-5/yr CDFSX CT configuration < 1E-3/yr 3E-5/yr 1E-4/yr ~1E-5/yr Note 1: Internal events include contribution from internal flooding.

Note 2: The internal fire results contain conservatisms that make the fire results incomparable to the internal events results. They are shown here simply to illustrate that even if they are added, the acceptance guidelines are not exceeded.

Table 13 provides a summary of the approach and results of the evaluation of each of these potential risk contributors. These analyses demonstrate that the risk impact of the proposed one-time extension of the SX Completion Time is very small and below the acceptance guidelines.

Page 36 of 52

This risk-informed evaluation identified a number of compensatory measures that will be implemented during the planned SX configuration. These are discussed in more detail in Section 2.3.2.

Table 13 Summary of Risk Insights for SX CT Extension RISK APPROACH INSIGHTS CONTRIBUTOR Internal Events

Quantify ICCDP & ICLERP for

Compensatory Measures Keep Risk Planned Configuration, Including Well Within Acceptance Guidelines Compensatory Measures:

ICCDP < 1E-6 ICLERP < 1E-7 Baseline CDF < 1E-4/yr Configuration Specific CDF <

1E-3/yr Internal Fire

Qualitatively and Quantitatively

Every Fire Scenario Has At Least Evaluated: One Success Path Identify Fire Scenarios

Internal Events Compensatory Impacted by Configuration Measures Apply to Fire Scenarios Estimate fire risk impacts due to

New Fire-Related recommended configuration and quantify delta- actions Identified CDF

Compensatory Measures Keep Risk Confirm Availability of Success Well Within Acceptance Guidelines Path for Every Scenario Identify actions recommended for increasing defense in depth and safety margin Seismic

Qualitatively Identify Key Seismic

Seismic Risk Impacts Negligible Risk Impacts for Planned Configuration

Evaluate Impact on Seismic-related Key Functions of SX Other External Hazards

Qualitatively Evaluate Each

No Unique Challenges Identified Hazard to Identify Unique Challenges Overall At-Power Risks

No Evidence Quantitative

Key Compensatory Measures Guidelines Will Be Challenged Identified to Minimize Risk Risk at Unit in

Qualitatively Evaluate Impact of

Reduction SX Redundancy Leads Shutdown SX Configuration on Unit in to Some Increase in Risk at Shutdown Shutdown Unit Since SX Transfers

Identify Compensatory Measures Heat to the Ultimate Heat Sink Consistent With Shutdown Safety

Compensatory Actions At Unit in Program Shutdown Consistent With Outage Safety Program Page 37 of 52

2.3.2 TIER 2: AVOIDANCE OF RISK-SIGNIFICANT PLANT CONFIGURATIONS The evaluation of the risk significance of plant configurations considers the impact on both the at-power unit for which the license amendment is being requested and on the opposite unit which will be shutdown during the planned configuration. While evaluation of the shutdown unit is not required, it is included here as part of Exelons overall configuration risk management program.

2.3.2.1 At-Power Unit In order to avoid risk-significant plant equipment outage configurations during the extended Completion Time, the impact of having other equipment unavailable was evaluated. This resulted in a list of protected equipment that will not be allowed to be unavailable for maintenance during the extended Completion Time. Table 14 provides the results of this evaluation as well as additional compensatory measures that will be established to reduce the risk associated with the configuration.

2.3.2.2 Opposite (Shutdown) Unit Having a train of SX unavailable will have an impact on the shutdown unit as well as the on-line unit for which the license condition is being requested. As such, a qualitative evaluation of the impact on the shutdown unit was performed.

The key safety functions that are included and evaluated for Byron Station outage risk evaluations include the following:

Reactivity Control

Shutdown Cooling

Inventory Control

Fuel Pool Cooling

Electric Power Control

Containment

Vital Support Systems Page 38 of 52

The impact of the SX outage on each of the key shutdown safety functions is summarized below.

Reactivity Control The equipment that is potentially impacted from the SX outage that supports reactivity control includes the safety injection system (SI) and chemical and volume control system (CV) pumps. Each provides a potential pathway for boron addition to the RCS.

In general, requirements include 1 SI and 1 CV pump during Mode 4 and 1 SI or 1 CV pump at all other times. Given the planned evolution with both B train SX pumps available, the SX outage should not hinder the capability to meet these requirements.

Shutdown Cooling The shutdown cooling requirements consist of optimizing the RH train availability along with feed and bleed capabilities from at least 1 SI or CV pump, and/or with two or more steam generators available with AF or MFW as appropriate depending on the outage configuration. Although both of the SX trains would be supplied by the available SX pump for the planned evolution (and the train and unit SX cross-ties would be available to allow for the opposite unit SX pump to supply cooling), it would prudent to protect the SX-supported train RH, SI, and CV components at any point during the SX outage to minimize the failure set that could render the safety function unsatisfied. That is, if only one train of the RH, SI, or CV systems are to be maintained available during the outage, then best efforts will be made to maintain the B train available during the A SX outage and the A train available during the B SX outage. However, it should be understood that the protected equipment compensatory measures for the shutdown unit includes the train and unit SX cross-tie capability (i.e. 2SX033 / 2SX034 / 1(2)SX005 valves).

These measures are intended to insure the opposite unit SX pump can be used to provide a source of heat removal capability for either train of RH that is maintained available. This is illustrated in the simple example below.

Page 39 of 52

SX Configuration A Train Failure Set B Train Failure Set A Out of Service A Power Supplies B Power Supplies 1

B Running B Power Supplies B Train Component Failures A Train Component Failures 1

Failure of this train power supplies would result in loss of SX cooling, thus disabling the SX train.

In summary, when the A SX outage occurs and the B SX pump is running, at least one train of RH and one train of either CV or SI will be maintained available (preferably the "B" train).

Inventory Control The inventory control requirements consist of optimizing the RH, SI, and CV train availability at all times during the outage except when the core is completely offloaded.

At reduced inventory and high decay heat levels, more than one train of each system may be required to be maintained. As such, the impact from the SX outage is similar to the impact on the shutdown cooling safety function.

Fuel Pool Cooling The fuel pool cooling safety function is only impacted by the need to maintain the spent fuel pool heat exchangers available with CC cooling which in turn requires SX cooling.

As such, the shutdown cooling requirements and limitations are considered to dominate the potential impacts from the SX outage as long as CC cooling and sufficient fuel pool cooling trains are maintained. However, to accommodate conditions where a full core offload may overlap the planned maintenance activities on the 1(2)SX001A valves, one train of fuel pool cooling will be maintained available during the SX extended AOT condition.

1 Failure of this trains power supplies would result in loss of SX cooling, thus disabling the train.

Page 40 of 52

Electric Power Control The electric power safety function examines the availability of offsite sources, emergency diesel generators, AC divisions, and instrument buses. Only the diesel generators are of direct concern (as long as minimum requirements are met for the other components) since SX cooling is required to support the diesel generators. Given the proposed outage evolution with the available SX pump supplying both SX trains, both diesel generators could be maintained available. However, to ensure that power would be available in a LOOP event to the operable SX pump, the opposite train diesel generator should be maintained available during the SX outage. That is, the B diesel generator should be available during the A SX outage.

Containment Generally, containment cooling consists of maintaining two or more (out of four total) containment fan coolers when the reactor cavity is not flooded. Lesser requirements exist when the cavity is flooded or when the core is offloaded. SX cooling is utilized to support the containment fan coolers, but given the planned evolution with the available SX pump supplying both SX trains, the SX outage should not hinder the capability to provide cooling.

Vital Support Systems The vital support system safety function includes the availability of the SX and CC trains. The planned evolution restricts the availability of SX during the SX. To improve the reliability of the CC system, the CC train associated with the available SX pump will be maintained available to the extent possible.

Configuration Considerations No specific quantitative evaluation has been performed at this time. However, it is well known that pressurized water reactor (PWR) outage risk is dominated during time Page 41 of 52

frames at RCS midloop and at other configurations at low RCS level. This is generally reflected with more stringent requirements during these time frames. As such, the SX outage that renders a vital support system unavailable for up to six days should be scheduled so as to not to coincide with these known higher risk time frames.

Based on a preliminary assessment of the risk impact of the planned SX outages for Byron Station, the following will be established to avoid unnecessary risk levels associated with the SX outage on the shutdown unit.

During the SX outage, the opposite train EDG components will be protected. This is a necessity since the available SX pump will require the same train EDG to be available to maintain SX cooling given a LOOP event.

Opposite train RH, SI or CV, and CC components will also be protected during the SX outage. That is, the B trains should remain available during the A SX outage.

Protecting the opposite train equipment reduces the number of failures that could render safety function requirements unsatisfied.

The SX outage will be planned so as not to coincide with the known time frames of higher outage risk (such as RCS midloop and other low level conditions) when two RH trains and a full complement of support systems are desired to be maintained available.

2.3.2.3 Compensatory Actions Table 14 provides a listing of compensatory actions that were incorporated into the risk assessment that supports this license amendment request. This table provides the entire list of actions and identifies the area of the risk assessment to which the actions apply.

Based on insights from the Fire PRA analysis, the compensatory measures found in Table 14 are recommended to reduce fire risk. These actions have not been credited in the quantification.

Page 42 of 52

TABLE 14 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Compensatory Measure Internal Comments Fire Shutdown Events Unit 0 CC Heat Exchanger X X Unit 2 CC Heat Exchanger X X Unit 1 CC Heat Exchanger X X 1SX005 (crosstie MOV) X 2SX005 (crosstie MOV) X 1B SX Pump X X Monitor pump for fire precursor indicators 2B SX Pump X X X Monitor pump for fire precursor indicators 1A AF Pump X 1B AF Pump X 2A AF Pump X Unit 1 SATs X Unit 2 SATs X X 4KV Bus 141 X 4KV Bus 142 X X Minimize or preclude breaker switching operations, especially for offsite power supply breakers 4KV Bus 241 X 4KV Bus 242 X X Minimize or preclude breaker switching operations, Switchyard X especially for offsite power Protected supply breakers Equipment 1A EDG X 1B EDG X 2A EDG X 2B EDG X X DC Battery & Charger 111 X DC Battery & Charger 112 X DC Battery & Charger 211 X DC Battery & Charger 212 X X 2A CV or 2A SI pump OR X 2B CV or 2B SI Pump 2A or 2B RH Pump X 2B CC Pump X 1SX033/1SX034 X 2SX033/2SX034 X X VA Supply Plenum X VA Exhaust Plenum X 0A Fire Pump X 0B Fire Pump X 1A CV Pump Alt Cooling X 1B CV Pump Alt Cooling X Unit 1 120 VAC Inst Inverters X Prohibit surveillance testing Unit 1 SI signals X on SSPS / ESFAS SI logic Fuel Pool Cooling - 1 train X

available Equipment 2 of 4 Unit 2 RCFC Flow X Improves effectiveness of SX Alignment Paths Unit Crosstie Changes 1SX005 (or 2SX005) Open X Improves effectiveness of SX Unit Crosstie Page 43 of 52

TABLE 14 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Compensatory Measure Internal Comments Fire Shutdown Events Unit 1 CST Filled to 350,000 X gallons Improve response to loss of Dedicated SX Operator X X remaining SX Pumps Not performed during reduced inventory or X

high decay heat levels Prior to entrance into the SX 5.1.1 X completion time Prior to entrance into the SX 11.3-0 X completion time Prior to entrance into the SX 11.1B-0 X completion time Prior to entrance into the SX 11.6-1 X completion time Fire Zone walk Prior to entrance into the SX down for transient 11.6-0 X completion time control Prior to entrance into the SX 11.3-1 X completion time Prior to entrance into the SX 11.4-0 X completion time Prior to entrance into the SX 5.5-1 X completion time Prior to entrance into the SX 5.2-1 X completion time Page 44 of 52

2.3.3 TIER 3: RISK-INFORMED CONFIGURATION RISK MANAGEMENT PROGRAM Byron Station has developed a Configuration Risk Management Program (CRMP) governed by station procedures that ensures the risk impact of equipment out of service is appropriately evaluated prior to performing any maintenance activity. This program requires an integrated review to uncover risk-significant plant equipment outage configurations in a timely manner both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities like testing or load dispatching, and weather conditions. Byron Station currently has the capability to perform a configuration dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. Risk is re-assessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed.

For planned maintenance activities, an assessment of the overall risk of the activity on plant safety, including benefits to system reliability and performance, is currently performed prior to scheduled work. The on-line assessment is controlled by Exelon procedure WC-AA-101 (Reference 24) and includes the following considerations.

Maintenance activities that affect redundant and diverse structures, systems, and components (SSCs) that provide backup for the same function are minimized.

The potential for planned activities to cause a plant transient are reviewed and work on SSCs that would be required to mitigate the transient are avoided.

Work is not scheduled that is highly likely to exceed a TS or Technical Requirements Manual (TRM) Completion Time requiring a plant shutdown. For activities that are expected to exceed 50% of a TS Completion Time, compensatory measures and contingency plans are considered to minimize SSC unavailability and maximize SSC reliability.

Page 45 of 52

For Maintenance Rule (MR) high risk significant SSCs, the impact of the planned activity on the unavailability performance criteria is evaluated.

As a final check, a quantitative risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the impact on both CDF and LERF. The results of the risk assessment are classified by a color code based on the increased risk of the activity as shown below.

Color Meaning Plant Impact and Required Action Green Non-risk significant Small impact on plant risk.

Requires no specific actions.

Yellow Non-risk significant with Impact on plant risk.

non-quantitative factors Limit unavailability time or take compensatory applied actions to reduce plant risk.

Orange Potentially risk-significant Significant impact on plant risk.

Requires senior management review and approval prior to entering this condition.

Requires compensatory measures to reduce risk including contingency plans.

All entries will be of short duration.

Red Risk-significant Not entered voluntarily.

If this condition occurs, immediate and significant actions taken to alleviate the problem.

Emergent work is reviewed by shift operations to ensure that the work does not invalidate the assumptions made during the work management process. Exelons risk management procedure has been implemented at Byron Station. This procedure defines the requirements for ensuring that the PRA model used to evaluate on-line maintenance activities is an accurate model of the current plant design and operational characteristics. Plant modifications and procedure changes are monitored, assessed, and dispositioned. Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the change on the PRA assessment tool. Changes that have potential risk impact are recorded in an update requirements evaluations (URE) log for consideration in the next periodic PRA model update.

Page 46 of 52

Maintenance Rule Program The reliability and availability of the SX pumps are monitored under the MR Program. If the pre-established reliability or availability performance criteria are exceeded for the SX pumps, they are considered for 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," paragraph (a)(1) actions, requiring increased management attention and goal setting in order to restore their performance (i.e., reliability and availability) to an acceptable level. The performance criteria are risk-based and, therefore, are a means to manage the overall risk profile of the plant. An accumulation of large core damage probabilities over time is precluded by the performance criteria.

The SX pumps are all currently in the 10 CFR 50.65 a(2) MR category (i.e., the SX pumps are meeting established performance goals). Performance of the SX pump maintenance is not anticipated to result in exceeding the current established MR criteria for SX pumps.

Plant modifications and procedure changes are monitored, assessed and dispositioned.

Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by qualitatively assessing the impact of the changes on the CRMP assessment tool. Procedures exist for the control and application of CRMP assessment tools, and include a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.

Change Control The CRMP is referenced and maintained as an administrative program in the Byron Station TRM. Changes to the TRM are subject to the requirements of 10 CFR 50.59, Changes, Tests, and Experiments. The goals of a CRMP are to ensure that risk-significant plant configurations will not be inadvertently entered for planned maintenance activities, and appropriate actions will be taken should unforeseen events place the plant in a risk-significant configuration during the proposed extended SX train Completion Time.

Page 47 of 52

3.0 CONCLUSION

This request has been evaluated consistent with the key principles identified in RG 1.174 for risk informed changes to the licensing basis and demonstrates that the risk from the proposed change is acceptable small. The evaluation with respect to these principles is summarized below.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

This change is being requested as a change to the operating licenses for Byron Station.

The proposed change is consistent with the defense-in-depth philosophy.

The configuration to be entered decreases the redundancy of the SX system due to the removal of two of the four SX pumps from service simultaneously during the CT required to replace the 1/2SX001A valves. The reduced redundancy increases the potential for the plant to lose SX cooling to plant equipment; however, the current plant design and supporting analyses demonstrate that the plant has much more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis.

Defense-in-depth is maintained during the configuration. Compensatory measures are identified to strengthen the level of defense-in-depth and reduce overall risk.

The proposed change maintains sufficient safety margins.

The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following:

- Codes and standards (e.g., American Society of Mechanical Engineers (ASME),

Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved Page 48 of 52

for use by the NRC). The proposed change is not in conflict with approved codes and standards relevant to the SX system.

- While in the proposed configuration, safety analysis acceptance criteria in the UFSAR are met, assuming there are no additional failures.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

A risk evaluation was performed that considers the impact of the proposed change with respect to the risks due to internal events, internal fires, seismic events and other external hazards. The evaluation of the quantitative impacts of internal event risks due to the planned configuration demonstrate that the impact on the likelihood of core damage and large early release is well below the risk acceptance guideline.

The fire evaluation determined that the impact on the likelihood of fire-related core damage is also below the risk acceptance guideline. In addition, recommended actions have been identified that further reduce the risk of the significant fire scenarios. The risk associated with seismic events and other external hazards are either not impacted by the change or are bounded by the risk from internal events.

In addition, although not required, the risk implications of the proposed change were qualitatively evaluated for the unit that will be shutdown during the evolution, consistent with Exelons risk management practices.

The performance of the planned maintenance has a long-term safety benefit to the Byron Station due to an improved reliability to isolate large SX floods using the new isolation valve. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

Page 49 of 52

The impact of the proposed change should be monitored using performance measurement strategies.

Exelons configuration risk management program will effectively monitor the risk of emergent conditions during the period of time that the proposed change is in effect.

This will ensure that any additional risk increase due to emergent conditions is appropriately managed.

Page 50 of 52

4.0 REFERENCES

1. Exelon Nuclear T&RM ER-AA-600-1012, Rev. 8, Risk Management Documentation

2. Exelon Nuclear T&RM ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR

3. Byron/Braidwood PRA Notebook, BB PRA-014, Quantification Notebook, Revision 6E1, July 2009.

4. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, August 1998.

5. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July 1998.

6. Exelon T&RM: ER-AA-600-1031 (Revision 0), Risk Management Tools:

6.1. CAFTA, Version 5.4, Application ID EX0007798, SQA Level BB.

6.2. PRAQUANT, Version 5.1, Application ID EX0007796, SQA Level BB.

6.3. QRECOVER32, Version 2.5, Application ID EX0007806, SQA Level BB.

6.4. FORTE, Version 3.0c, Application ID EX0007326, SQA Level BB.

6.5. FORTE Users Manual, Version 3.0c, Korea Power Engineering Company, Inc. KOPEC, February 15, 2007.

6.6. HRA Calculator, Version 4.0, Application ID EX0007797, SQA Level BB.

6.7. UNCERT, Version 2.3a, Application ID EX0000208, SQA Level CC.

7. EPRI TR-105396, PSA Applications Guide, EPRI, August 1995.

8. NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants

9. NUREG-1488, Revised Livermore Seismic Hazard Estimates for Sixty-Nine Nuclear Power Plants

10. NUREG/CR-4550, Vol. 3, Revision 1, Part 3, Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events, December 1990

11. Byron Station IPEEE Report, December 1996.

12. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities.

13. EC 341986, IPEEE Review Of Ultimate Heat Sink Security Tower Design, 5/15/03.

Page 51 of 52

14. Not used.

15. Not used.

16. Exelon Nuclear T&RM ER-AA-600-1015, Rev 009, FPIE PRA MODEL UPDATE.

17. BB-PSA-21.06, Byron/Braidwood Fire Probabilistic Risk Assessment - FPRA Summary Report, Revision 2.

18. NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, Revision 1, October 2004.

19. Exelon Nuclear T&RM ER-AA-600, Rev 005, RISK MANAGEMENT.

20. American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, Addenda RA-Sa-2003, and Addenda RA-Sb-2005, New York, December 2005.

21. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 1, January 2007.

22. Letter from Keith R. Jury (Exelon Generation Company, LLC) to U.S. NRC, Request for a License Amendment for a One-Time Extension of the Essential Service Water Train Completion Time, dated June 11, 2003.

23. WCAP-15603, WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, Rev. 1-A, June 2003.

24. Exelon Nuclear T&RM WC-AA-101, Rev 016, ON-LINE WORK CONTROL PROCESS.

25. EPRI Fire PRA Methods Enhancements, Additions, Clarifications, and Refinements to EPRI 1019189, December 2008.

26. NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, September 2005.

27. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009.

28. BY-LAR-001, SX CT One-time Extension Application Notebook, Rev. 0, September 2009.

Page 52 of 52

ATTACHMENT 6 Technical Adequacy

1 Overview A technical Probabilistic Risk Assessment (PRA) analysis has been performed in support of the technical basis for a one-time extension of the Byron Generating Station Unit 1 SX completion time for the replacement of the 1SX001A and 2SX001A valves, as discussed in the main body of this report. This documentation provides the basis for the technical adequacy of the Byron Generating Station Units 1 and 2 PRA in support of this analysis.

This discussion follows the guidance provided in Regulatory Guide 1.200 Revision 1 [1],

An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities. The guidance in RG-1.200 indicates that the following steps should be followed to perform this study:

1. Identify the parts of the PRA used to support the application.

o SSCs, operational characteristics affected by the application and how these are implemented in the PRA model o A definition of the acceptance criteria used for the application

2. Identify the scope of risk contributors addressed by the PRA model.

o If not full scope (i.e. internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Summarize the risk assessment methodology used to assess the risk of the application.

o Include how the PRA model was modified to appropriately model the risk impact of the change request.

4. Demonstrate the Technical Adequacy of the PRA o Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

o Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet Page 1 of 24

been addressed justify why the significant contributors would not be impacted.

o Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide (currently, in RG-1.200 Revision 1 this is just the internal events PRA standard). Provide justification to show that where specific requirements in the standard are not adequately met, it will not unduly impact the results.

o Identify key assumptions and approximations relevant to the results used in the decision-making process.

Items 1 through 3 are covered in the main body of the risk evaluation for this submittal.

The purpose of this documentation is to address the requirements identified in item 4 above.

2 General Discussion of Technical Adequacy of the PRA Model The Byron Generating Station, Units 1 and 2 PRA model Revision 6E is the most recent evaluation of the risk profile at Byron Generating Station Units 1 and 2 for internal event challenges. The Byron PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Byron Generating Station Units 1 and 2 PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

Exelon Generation Company (EGC) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating EGC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to Byron Generating Station Units 1 and 2 PRA.

Page 2 of 24

2.1 PRA Maintenance and Update The EGC risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the EGC Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. EGC procedure ER-AA-600-1015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating EGC nuclear generation sites. The overall EGC Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed:

Design changes and revisions to design changes are reviewed for their impact on the PRA model.

New procedures and procedure changes are reviewed for their impact on the PRA model.

New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

Equipment unavailabilities are captured, and their impact on CDF and LERF is trended.

Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities for equipment that can have a significant impact on the PRA model are updated approximately every four years.

In addition to these activities, EGC risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes:

Page 3 of 24

Documentation of the PRA model, PRA products, and bases documents.

The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

Guidelines for updating the full power, internal events PRA models for EGC nuclear generation sites.

Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)).

In accordance with this guidance, regularly scheduled PRA model updates nominally occur on an approximately 4-year cycle; longer intervals may be justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant.

The most recent update of the Byron PRA model (designated the Revision 6E model) was completed in June 2009.

2.2 PRA Self Assessment and Peer Review Several assessments of technical capability have been made, and continue to be planned, for the Byron, Units 1 and 2 PRA models. These assessments are as follows and further discussed in the paragraphs below.

Scientech conducted an independent self-assessment of the Byron PRA model in 1999, prior to the Byron PRA peer review. All significant comments from this review have been addressed.

Page 4 of 24

An independent PRA peer review of the Braidwood Station PRA model1 was conducted under the auspices of the PWR Owners Group in 1999, following the Industry PRA Peer Review process [2]. This peer review included an assessment of the PRA model maintenance and update process.

An independent PRA peer review of the Byron PRA model1 was conducted under the auspices of the PWR Owners Group in 2000, following the Industry PRA Peer Review process [2]. This peer review included an assessment of the PRA model maintenance and update process.

During 2005 and 2006 the Byron, Units 1 and 2 PRA model results were evaluated in the PWR Owners Group PRA cross-comparisons study performed in support of implementation of the mitigating systems performance indicator (MSPI) process [3]. Byron did not have any identified outliers as a result of this review.

Following the Byron PRA model update in 2007-2008, a self-assessment of the Byron PRA model against the ASME PRA Standard was performed using Regulatory Guide 1.200, Revision 1[1].

The Byron PRA model is scheduled to be peer reviewed under the auspices of the PWR Owners Group in late 2010. As part of the preparation for that review, the gap analysis is planned to be updated to reflect pertinent changes to both the PRA Standard and Regulatory Guide 1.200.

A summary of the disposition of 1999 and 2000 Industry PRA Peer Review facts and observations (F&Os) for the Byron and Braidwood, Units 1 and 2 PRA models was documented as part of the statement of PRA capability for MSPI in the Byron MSPI Basis Document [4]. As noted in that document, all significance level A & B F&Os from the 2000 PWROG peer review have been addressed. Also noted in that submittal was the fact that, after allowing for plant-specific features, there are no MSPI cross-comparison outliers for Byron (refer to the fourth bulleted item above).

1 Byron and Braidwood use a combined model, with appropriate flags to differentiate between sites/units.

Therefore, the Peer review findings for Braidwood are also applicable to Byron, and vice-versa.

Page 5 of 24

In updating the PRA to Revision 6E, changes have been made to the PRA to address several Peer Review F&Os, as well as to make other modeling improvements. Prior to the Revision 6E update, a capability assessment was performed. This was a self-assessment of the PRA capability of the model relative to the updated requirements in Addendum B of the ASME PRA Standard [5] and criteria in RG 1.200, Revision 1 [1],

including the NRC positions stated in Appendix A of Reference 1 and the clarifications in Reference 6.

A summary of the current open items including the partially resolved items is provided in attached Table 2, and further discussed in Section 3. These items will be reviewed for consideration during future model updates but are judged to have low impact on the PRA model or its ability to support a full range of PRA applications. These items are also documented in the PRA Update Requirements Evaluation (URE) database so that they can be tracked and their potential impacts accounted for in applications where appropriate.

2.3 General Conclusion Regarding PRA Capability The Byron Units 1 and 2 PRA maintenance and update process and technical capability evaluations described above provide a robust basis for concluding that the PRA is suitable for use in risk-informed licensing actions. As specific risk-informed PRA applications are performed, remaining gaps to specific requirements in the PRA standard are reviewed to determine which, if any, would merit application-specific sensitivity studies in the presentation of the application results.

Page 6 of 24

3 PRA Technical Adequacy Considerations Specific to the One-Time SX Completion Time Extension Application for Replacement of the 1SX001A and 2SX001A Valves As indicated previously, RG-1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated into the PRA model, relevant peer review findings, consistency with applicable PRA Standards, and the identification of key assumptions) will be discussed in turn.

3.1 Plant Changes Not Yet Incorporated into the PRA Model A PRA updating requirements evaluation (URE- EGC PRA model update tracking database) is created for all issues that are identified that could impact the PRA model.

The URE database includes the identification of those plant changes that could impact the PRA model. As part of the 6E model update, plant modifications since the last update were reviewed to determine need for incorporation into the model. A review of the current open items in the URE database indicated that there are only a few items that have not been dispositioned as not having PRA impact. A summary of plant changes that have not yet been addressed relative to the PRA (i.e., either incorporated into the model or determined to require no change to the model) is listed below, along with an assessment of the impact on this LAR.

Page 7 of 24

TABLE 1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE BYRON PRA MODEL URE NUMBER PLANT CHANGE IMPACT ON THE BYRON PRA BB-0742 Addition of alternate cooling water line for 2A This plant change has not been addressed SX cubicle cooler - EC 361665 in the PRA model. A review of this modification will be incorporated with the internal flooding analysis revision to be completed in 2009. This PRA model addition will add flexibility in the ability to provide cooling to the SX pumps. The addition to the PRA model would be expected to reduce the base CDF. No significant impact to the results or conclusions for this LAR are expected.

BB-0682 EC 368859 (368861) - Modify U1 (U2) RWST This plant change has not been addressed Level Xmtr Drain line 1(2)SI99F-1/2 - in the PRA model. The impact of this Replaces Check Vlv with Manual Vlvs would be to the pre-initiator portion of the HRA, and is expected to be small, as this would be a local failure mode and does not introduce new CCF failure potential.

No significant impact to the results or conclusions for this LAR are expected.

BB-0680 Byron EC 371347 / Braidwood EC 375726 - This plant change has not been addressed VA Bypass Damper Closure Circuit and Fan in the PRA model. The addition of this SI/EDG Trip Modification logic to the Charcoal Bypass damper logic is expected to have only a small impact on the base model results. No significant impact to the results or conclusions for this LAR are expected.

BB-0629 EC 366121 & 366122 Installation of Additional This plant change has not been addressed Check Valve in SX makeup lines in the PRA model. As it adds additional failure protection (resulting in 2 check valves in series), the impact on the PRA model would be a reduction in base CDF.

No significant impact to the results or conclusions for this LAR are expected.

Page 8 of 24

3.2 Applicability of Peer Review Findings and Observations Several assessments of technical capability of the Byron Generating Station Units 1 and 2 PRA have been made, as summarized in Section 2.2. In addition, such assessments continue to be planned. Pertinent results of these assessments are discussed in the paragraphs below.

The most recent gap analysis defined a list of supporting requirements from the Standard for which potential gaps to Capability Category II of the Standard were identified. For each such potential gap, a PRA updating requirements evaluation (URE) was documented for resolution.

In updating the PRA since the gap analysis, changes were made to the PRA to address some of the identified gaps, as well as to address other open UREs. Currently, there are 9 identified gaps2, which affect a larger number of Supporting Requirements (SR) in the PRA Standard [5], as noted in Table 2. However, the number of gaps and number of affected SR are not by themselves indicators of PRA capability. For Gap #4, for example, while there are 19 associated SR, the impact for most applications is not significant, as the approach used for the LERF analysis is based on a conservative approach recognized by NRC. The remaining gaps will be reviewed for consideration in future model updates but are judged to have low impact on the PRA model or its ability to support a full range of PRA applications. For example, four of the gaps (1, 3, 6, 8) are documentation issues rather than PRA model capability issues which are being addressed as resources permit. These remaining gaps are documented in the URE database so that they can be tracked and their potential impacts accounted for in applications where appropriate. The gaps related to consideration of model uncertainties are addressed for the PRA in Attachment 7, and explicitly for this LAR in Section 3.4 through 3.6.

2 Several of the identified gaps are similar and could be combined.

Page 9 of 24

3.3 Consistency with Applicable PRA Standards As noted above, the PRA has been reviewed against the requirements in Addendum B of the PRA Standard [5], the criteria in RG 1.200, Revision 1 including the NRC positions stated in Appendix A of RG 1.200, Revision 1 [1] and further issued clarifications [6]. The results of the most recent review lead to the identified gaps, and associated supporting requirements, listed in Table 2 as not meeting Category II in the PRA model used for this assessment. An assessment of the impact for this application of not meeting Capability Category II for these SRs is summarized in Table 2.

Page 10 of 24

TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD

DESCRIPTION OF GAP APPLICABLE CURRENT STATUS / IMPORTANCE TO SRS COMMENT APPLICATION 1 DOCUMENT the significant contributors (such QU-F3 The PRA Summary notebook and None. This is a documentation as initiating events, accident sequences, related documentation will issue. The PRA models, on which basic events) to CDF in the PRA results provide the types of information the LAR assessment is based, summary. PROVIDE a detailed description of required, but the update to the capture all significant contributors.

significant accident sequences or functional documentation has not been failure groups. finalized.

2 Include an assessment of the significance of QU-F4 Identification of key assumptions Attachment 7 discusses potential assumptions on the quantitative results. is application specific. An key assumptions and sources of assessment of important PRA model uncertainty relevant to this modeling assumptions has been application.

performed for the base internal events at power model, and is discussed in Attachment 7, based on application of the approach specified in NUREG-1855 [7] and EPRI TR-1016737 [8].

3 DOCUMENT the quantitative definition used QU-F6 Open - Definition of significant None. This is a documentation for significant basic event, significant cutset, needs to be added to the issue. The PRA models, on which and significant accident sequence. quantification documentation. the LAR assessment is based, Exception to the RA-S-2002 capture all significant contributors.

definition is not taken, but not all significant contributors are explicitly addressed in the documentation.

Page 11 of 24

TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD

DESCRIPTION OF GAP APPLICABLE CURRENT STATUS / IMPORTANCE TO SRS COMMENT APPLICATION 4 The LERF analysis is based on the LE-B1 Open - There are no current Not significant. Given the NUREG/CR-6595 methodology. As such, it LE-B2 plans to upgrade the LERF conservative nature of the represents a generally conservative, LE-C1 model. NUREG/CR-6595 approach used, simplified approach. The noted SRs meet the LE-C2a the LERF results are believed to Capability Category I criteria. LE-C2b also be conservative relative to LE-C3 this application. Further, there are LE-C4 no Level 2 phenomenological LE-C8a issues introduced by the LE-C9a configuration required for the SX LE-C10 Completion Time extension that LE-D1a would require additional LERF LE-D1b model capability.

LE-D2 LE-D4 LE-D5 LE-E2 LE-E3 LE-F1a LE-G3 5 characterize LERF uncertainties consistent LE-F3 Open - A formal evaluation of Not significant. Given the with the applicable requirements of Tables uncertainties in the LERF model conservative nature of the 4.5.8-2(d) and 4.5.8-2(e). has not been performed. approach used, formal However, since the NUREG/CR- consideration of uncertainties in 6595 consensus modeling the LERF modeling has no approach has been used, the significant impact on this results are understood to be application. Further, there are no conservative. Level 2 phenomenological issues introduced by the configuration required for the SX Completion Time extension that would introduce significant uncertainties into the results.

Page 12 of 24

TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD

DESCRIPTION OF GAP APPLICABLE CURRENT STATUS / IMPORTANCE TO SRS COMMENT APPLICATION 6 Addendum B of the ASME PRA Standard [5] QU-F6 Open - These new SRs will be None. This is a documentation added SRs to document the quantitative LE-G6 addressed during the next full issue. Changes to the model are definition used for significant basic event, PRA model update, but providing not required to address this item.

significant cutset, significant accident these definitions should not have The PRA models, on which the sequence, and significant accident an impact on the quantitative LAR assessment is based, capture progression sequence in the CDF and LERF results from the PRA model. all significant contributors.

analysis.

7 Several SRs associated with treatment of QU-E1 Identification of key assumptions Attachment 7 discusses model uncertainty and related model QU-E2 is application specific. An uncertainties, including parameter assumptions have been recently redefined. QU-E3 assessment of important PRA uncertainty, completeness NRC has issued [6] a clarification to its QU-E4 modeling assumptions has been uncertainty, and potential key endorsement of the PRA Standard. NRC and QU-F4 performed for the base internal assumptions and sources of model EPRI have prepared guidance on an IE-C13 events at power model, and is uncertainty. Section 3.4 discusses approach to meet these new requirements. IE-D3 discussed in Attachment 7, based parameter uncertainty relative to AS-C3 on application of the approach this application; Section 3.5 SC-C3 specified in NUREG-1855 [7] and discusses model uncertainty SY-C3 EPRI TR-1016737 [8]. relative to this application; and HR-G9 Section 3.6 discusses HR-I3 completeness uncertainty relative DA-D3 to this application.

DA-E2 DA-E3 IF-F3 LE-E4 LE-F2 LE-F3 LE-G4 Page 13 of 24

TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD

DESCRIPTION OF GAP APPLICABLE CURRENT STATUS / IMPORTANCE TO SRS COMMENT APPLICATION 8 Model documentation needs to be revised to AS-C2 Open - Appropriate None. This is a documentation reflect the current model (6E) DA-C6 documentation is being revised to issue. The PRA model, on which DA-C10 reflect Rev 6E the LAR assessment is based, has DA-D4 been approved.

IE-C10 IF-C2 IF-C2c IF-D7 IF-E3a IF-F1 IF-F2 QU-F6 SC-A1 SC-B5 SC-C2 SY-A4 SY-C1 SY-C2 9 Plant Specific MOV (or AOV) failure data was DA-C3 Open - There are no current The Byron Risk profile is generally not collected for further analysis. plans to develop plant specific driven by common cause, human data for MOVs and AOVs error and pump related basic events. Inclusion of plant specific MOV/AOV data is expected to have a negligible impact on the results. For the SX CT extension application, which is focused on delta-CDF and does not affect MOV or AOV reliability, this gap is not important.

Page 14 of 24

3.4 Discussion of Parameter Uncertainty for the SX Completion Time Extension LAR The Byron PRA Uncertainty Assessment, Attachment 7, Section 1.1, discusses the approach used to evaluate the potential impact of parameter uncertainty on the Byron PRA results. As there is not currently capability to quantitatively characterize the parameter uncertainty for the PRA results, the approach taken in the Uncertainty Assessment for the baseline PRA is to examine the CDF and LERF cutsets in detail to identify cutsets with basic events whose failure probabilities are derived from the same parameters (e.g., same failure rate/demand probability), thereby subject to the effect of epistemic correlation. If not, then the point estimate of the risk metric provides a reasonable representation of the mean value, suitable for use in risk-informed decision-making. As noted in the Uncertainty Assessment, for the baseline PRA, it is concluded that the effects of epistemic correlation are small and it is reasonable to use the point estimate of the CDF risk metric as representative of the mean value.

For the SX Completion Time Extension application, the same exercise described in the Uncertainty Assessment has been performed on the results of the application. For this application, 2.4% of the application specific CDF is from cutsets subject to the epistemic correlation. Additionally, a similar examination identified that application-specific LERF cutsets subject to the epistemic correlation contribute about 1.3% to the application specific LERF.

The epistemic correlation contributions to the delta-CDF and delta-LERF were also examined by reviewing the cutsets that represent delta-CDF and delta-LERF between the baseline cutsets and the application specific cutsets. This examination showed that the epistemic correlation contributes 2.7% in the delta CDF, and 1.9% in the delta LERF. The highest frequency cutset subject to Page 15 of 24

impact of epistemic correlation occurs at the 50th CDF cutset (139th LERF cutset) in the application specific results.

The above results support a conclusion that the impact of epistemic correlation is sufficiently small for the application specific CDF (and LERF) and delta-CDF (and delta-LERF). Therefore, for this application, it is reasonable to use the point estimate of the CDF risk metric as representative of the mean value, as stated in Section 4.1.2, Step 4 (CC II) of NUREG 1855 [7].

3.5 Identification of Key Assumptions and Key Sources of Model Uncertainty discusses the consideration of sources of uncertainty in the base model PRA. These sources are summarized in section 4 of Attachment 7 and are repeated in Table 3 for consideration in this application.

Following the guidance in EPRI TR-1016737 [8], a further review of those portions of the PRA relevant to this application has been performed to identify additional candidate sources of model uncertainty and related assumptions.

Several additional potential key assumptions / potential key sources of model uncertainty for this application were identified, as listed below and further discussed in the following paragraphs. This discussion is followed by the assessment of base PRA sources of model uncertainty relative to this application.

Potentially Key Assumption 1: Operator action dependence between SX crosstie action and operator action to align alternate cooling to CV pumps using FP system Potentially Key Assumption 2: Operator action dependence between SX crosstie action and operator action to align cool suction source to CV pumps from RWST Page 16 of 24

Potentially Key Assumption 3: SX pump failure to run data impact on LAR sensitivity Potentially Key Assumption 4: Success criteria assumed to require only one pressurizer PORV when CV pump(s) are available for bleed and feed operation Discussion of Potentially Key Assumption 1 The Byron PRA model assumes high dependency between the SX crosstie action (basic event 0SX-XTIE---HMVOA) and FP-PRI-7 operator actions (basic event PRI-7X-HMVCA); basic event 1FP-PRI-7X-HMVCA is set to 0.51 in the base PRA model to reflect this high dependency. With the proposed compensatory measure to have a dedicated SX operator familiar with the associated procedures for the duration of 1/2SX001A valve replacements, the dependency between these two operator actions can be reduced and a low dependence used in the LAR calculation. This is modeled by setting basic event 1FP-PRI-7X-HMVCA to 0.051. This change is reflected in the base case analysis results for the LAR. Although this is potentially a key assumption for the LAR, it is judged to not be a key model uncertainty, as the modeling reflects the condition that will exist during the extended SX completion time and has been performed using HRA methods consistent with those used in the PRA.

Discussion of Potentially Key Assumption 2 The Byron PRA model does not consider the dependency between the SX crosstie action (0SX-XTIE---HMVOA) and the operator action to align the CV pump to a cool suction source from the RWST (basic event 1CV-ALL----HPMOA) given a loss of CCW cooling to the CV pump (this is documented in URE-783).

The SX crosstie action is based on 1BOA PRI-7 and takes its initial cue from LOSX indications. The operator action to align a cool suction source from RWST is based on 1BOA PRI-6, Step 1a RNO where the initial cue is provided by CC Page 17 of 24

surge tank level < 13%. There is no direct procedural dependence between these two actions, but the time windows may be overlapping since LOSX will lead to loss of CCW. Therefore, upon reviewing the dependence between these two actions, it was determined that a medium dependence should be (but is not currently) assigned between the two actions in the base PRA model. However, for the duration of the 1/2SX001A valve replacements, the proposed compensatory measure to have a dedicated SX operator familiar with the associated procedures substantially eliminates this analytical dependence.

Thus, the model appropriately reflects the plant configuration planned for the extended SX completion time. Although this is potentially a key assumption for the LAR, it is judged to not be a key model uncertainty.

Discussion of Potentially Key Assumption 3 The Byron PRA model uses support system initiating fault trees to estimate both dual unit loss of SX (DLSX) and single unit loss of SX (LOSX) frequencies. One of the key contributors to these initiators is SX pump failure to run (SX PM FR) data and its associated common cause failure terms. Therefore, the upper bound (95th percentile) of SX PM FR data was estimated (i.e., 1.01E-05/hr) and used to recalculate both the DLSX and LOSX initiators using the support system initiating event fault trees. The upper bound frequency for DLSX was determined to be 1.9E-03 and the upper bound frequency for LOSX was determined to be 9.9E-02. A sensitivity case on the base average CDF using these values resulted in a CDF increase of 7%. Although this increases the SX LAR internal events results by a factor of 3.7 (i.e., ICCDP of 4.8E-7 as compared to the base LAR case ICCDP of 1.3E-7), the internal events risk remains small and the ICCDP remains within the regulatory limits. Since there is nothing associated with the 1/2SX001A repairs that would affect SX pump reliability, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

Page 18 of 24

Discussion of Potentially Key Assumption 4 The success criteria for the Byron PRA model provide the bases for requiring one pressurizer PORV to open during bleed and feed operation if CV pump(s) are available for the feed operation, whereas both PORVs are required if only SI pump(s) are available. A sensitivity analysis was performed in which both PORVs are assumed to be required even for the case with CV pump(s) operating. The sensitivity results show that the base average CDF would increase by 73% with this requirement, but the SX LAR results would increase by only 23%, i.e.,

sensitivity ICCDP of 2.2E-7 as compared to LAR ICCDP of 1.3E-7. Thus, the internal events risk would remain small and the ICCDP remains well within the regulatory limits even with the alternative PORV assumption for bleed and feed.

Since there is nothing associated with the 1/2SX001A repairs that would affect PORV reliability or CV or SI pump reliability, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

In support of the PRA analyses for Byron Units 1 and 2 for this application using the Revision 6E PRA model, the remaining gaps to the PRA standard and open UREs have been reviewed to determine which, if any, would merit application-specific sensitivity studies in the presentation of the application results. The result of this assessment concluded that the following additional sensitivity studies are merited.

Timing of Operator Action to Trip RCPs on Loss of Seal Cooling The Byron PRA model implemented the consensus WOG 2000 RCP Seal LOCA model. The WOG 2000 model assumes the RCPs must be stopped in a timely fashion to avoid catastrophic seal damage. In the Byron PRA, the action to trip the RCPs (i.e., basic event 1RC-PMTRIP-HSYOA - OPERATOR FAILS TO TRIP RCP ON LOSS OF SEAL INJECTION) is assumed to have a maximum Page 19 of 24

time of 30 minutes available to trip the RCPs in order to prevent a consequential RCP seal LOCA greater than 21gpm/pump. The 30 minute time window is inconsistent with the NRC SER on the WOG2000 model in which NRC claims a 13 minute available time (see URE-723). Therefore, as a sensitivity, the HEP for 1RC-PMTRIP-HSYOA was re-estimated using a 13 minutes time window. The revised HEP for the sensitivity is 2.7E-02 whereas the base PRA value is 1.4E-

03. The sensitivity analysis show that there is no measurable change to the base PRA results. As such it is judged that this assumption would not change the conclusions from this risk assessment.

Evaluation of Base Model Sources of Uncertainty provides a list of eight sources of uncertainty for the Byron Base PRA model in Section 4, Summary. The evaluation of the impact of these uncertainty sources on the risk assessment results being used to support the LAR is provided in Table 3 below.

Table 3 LAR Impact Evaluation of Base Model Uncertainty Sources Source of Uncertainty Impact Evaluation The impact of this source of uncertainty is described in the discussion above on "Timing of Operator Timing of action to trip Action to Trip RCPs on Loss of Seal Cooling. The Reactor Coolant Pumps sensitivity performed to evaluate the impact from this given a loss of RCP seal source showed a negligible impact on the base CDF cooling/injection results. As such it is judged that this assumption would not change the conclusions from this risk assessment.

The impact from this source is evaluated under the "Discussion of Potentially Key Assumption 4. As stated above, the sensitivity ICCDP results remain PORV success criteria well below the regulatory thresholds. Since there is for bleed and feed nothing associated with the 1/2SX001A repairs that operation would affect PORV reliability or CV or SI pump reliability, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

Page 20 of 24

Table 3 LAR Impact Evaluation of Base Model Uncertainty Sources Source of Uncertainty Impact Evaluation The impact of the uncertainty associated with the Internal Flooding frequencies is applied to the base PRA model and LAR configurations in the same Internal flood initiating manner. Since there is nothing associated with the event frequencies and 1/2SX001A repairs that would affect the Internal failure modes Flooding frequencies or failure modes, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

The impact of the uncertainty associated with the ISLOCA frequencies is applied to the base PRA model and LAR configurations in the same manner.

ISLOCA frequencies Since there is nothing associated with the 1/2SX001A repairs that would affect the ISLOCA frequencies, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

As discussed in Attachment 7, section 3, a sensitivity study was performed by setting the Human Error Probabilities at their 5th and 95th percentile values.

Human error probability The 95th percentile values show an increase factor of values 1.3 for base CDF and 1.5 for base LERF values. As similar results would be seen in the LAR specific configuration, the net impact of this uncertainty is negligible.

As discussed in Attachment 7, section 3, a sensitivity study was performed by setting the Common Cause Failure probabilities at their 5th and 95th percentile Common cause failure values. The 95th percentile values show an increase values factor of 1.3 for base CDF and 1.2 for base LERF values. As similar results would be seen in the LAR specific configuration, the net impact of this uncertainty is negligible.

Page 21 of 24

Table 3 LAR Impact Evaluation of Base Model Uncertainty Sources Source of Uncertainty Impact Evaluation While identified as a source of uncertainty, the impact of this source is mitigated for the CC and CV pumps by the identification of specific components as being considered Protected Equipment for the duration of the SX valve repair activities. For the SX pumps, the remaining pumps will be in-service providing The modeling of CC, CV heat removal capability to the on-line and and SX pump shutdown units. Additional compensatory alignments, of which only actions, specified in the LAR, are provided to one train is assumed to address reducing the likelihood of induced SX be running failure from internal and external (i.e. Fire) events and in providing enhanced likelihood of success in the performance of operator actions intended to mitigate a loss of SX.

Based on the implementation of these compensatory actions, the impact of this source is expected to be negligible.

Operations personnel routinely shift the configuration of the running SX Cooling Tower Fans and associated riser valves. This action is performed to maintain SX water temperature within prescribed operational bands for optimal equipment performance. Any unavailability of The modeling of SX a Fan or riser valve is addressed through the Cooling Tower Fans and station Configuration Risk Management the associated riser Program. The PRA model provides basic valves configurations events (including common cause failure) for the failure modes of the Fans and riser valves.

The impact from this source is expected to be negligible based on the planned station configuration of having Unit 2 in a cold shutdown condition and the implementation of compensatory actions (Protected Equipment) as identified in Table 3 of the LAR.

3.6 Discussion of Completeness Uncertainty for the SX Completion Time Extension For the SX LAR completion time extension application, consideration has been given to both internal and external hazards. Risks from internal events at power, Page 22 of 24

internal flooding, internal fire, and seismic and other external events have been considered. Model completeness is not a significant source of uncertainty for this application.

4 Conclusion Regarding PRA Capability for SX Completion Time Extension Application The Byron Units 1 and 2 PRA models are suitable for use in this application. This conclusion is based on:

The PRA maintenance and update processes in place,

The PRA technical capability evaluations that have been performed and are being planned, and

The application-specific considerations, as noted above, that demonstrate the relatively limited sensitivity of the application results and conclusions to those PRA attributes that do not meet ASME PRA Standard Capability Category II.

Page 23 of 24

5 References

[1] Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 1, January 2007.

[2] Nuclear Energy Institute, Industry PRA Peer Review Process, NEI-00-02, January 2000.

[3] Westinghouse Owners Group, Mitigating Systems Performance Index Cross Comparison (PA-RMSC-0209), WCAP-16464-NP, Revision 0, August 2005.

[4] Byron MSPI Basis Document, BY-MSPI-001, Revision 3, June 2009.

[5] American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, Addenda RA-Sa-2003, and Addenda RA-Sb-2005, New York, December 2005.

[6] U.S. Nuclear Regulatory Commission Memorandum to Michael T. Lesar from Farouk Eltawila, Notice of Clarification to Revision 1 of Regulatory Guide 1.200, for publication as a Federal Register Notice, July 27, 2007.

[7] NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, USNRC, March 2009.

[8] Electric Power Research Institute, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI TR-1016737, Palo Alto, CA, November 2008 Page 24 of 24

ATTACHMENT 7 Uncertainty Assessment

Characterizing the Sources of Model Uncertainty for the Byron and Braidwood PRAs

1. Overview The intent of this attachment is to show a complete model uncertainty issue characterization assessment for the Byron/Braidwood internal events at power PRAs.

The incorporation of this information into the PRA model documentation is intended to be sufficient to meet the ASME/ANS PRA Standard Supporting Requirements listed below as defined in the ASME/ANS PRA Standard [1].

QU-E1: IDENTIFY sources of model uncertainty.

QU-E2: IDENTIFY assumptions made in the development of the PRA model.

QU-E4: For each source of model uncertainty and related assumption identified in QU-E1 and QU-E2, respectively, IDENTIFY how the PRA model is affected (e.g.,

introduction of a new basic event, changes to basic event probabilities, change in success criterion, introduction of a new initiating event)

QU-F4: DOCUMENT the characterization of the sources of model uncertainty and related assumptions (as identified in QU-E4).

LE-F3: IDENTIFY and CHARACTERIZE the LERF sources of model uncertainty and related assumptions, consistent with the requirements of Tables 2.2.7-2(d) and 2.2.7-2(e).

IE-D3, AS-C3, SC-C3, SY-C3, HR-I3, DA-E3, LE-G4, and IF*-B3: DOCUMENT the sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2 [or LE-F3]) associated with [each element].

There are two main purposes of the characterization of uncertainty for a PRA. One is to determine that, where point estimates of CDF and LERF are used in lieu of calculation of the true mean, as is typically done to optimize the quantification process, the point Page 1 of 33

estimate provides a reasonable representation of the true mean such that it is reasonable to make decisions based on the point estimate. The other purpose is to characterize the sources of model uncertainty and associated assumptions which may have the potential to affect the results, to determine that reasonable alternative assumptions, if available do not affect the decision.

1.1 Parametric Uncertainty NUREG-1855 [12] provides the following guidance on parametric (parameter) uncertainty.

Parameter uncertainty relates to the uncertainty in the computation of the input parameter values used to quantify the probabilities of the events in the PRA logic model. Examples of such parameters are initiating event frequencies, component failure rates and probabilities, and human error probabilities. These uncertainties can be characterized by probability distributions that relate to the analysts degree of belief in the values of these parameters (which could be derived from simple statistical models or from more sophisticated models). As part of the risk-informed decisionmaking process, the numerical results (e.g.,

CDF) of the PRA, including their associated parameter uncertainty, are compared with the appropriate decision criteria or guidelines. The uncertainties on the input parameters need to be combined in an appropriate manner to provide an assessment of this type of uncertainty on the PRA results. An important aspect of this propagation is the need to account for what has been called the state-of-knowledge correlation (SOKC) or epistemic correlation. This concern arises when the same parameter (including its uncertainty) is used to quantify the probabilities of two or more basic events. Most of the PRA software in current use has the capability to propagate parameter uncertainty through the analysis, taking into account the SOKC to calculate the probability distribution for Page 2 of 33

the results of the PRA. In some cases, however, it may not be necessary to consider the SOKC.

It is also stated in NUREG-1855 that the primary issue with parameter uncertainty is its effect on the calculation of the mean, and specifically, on the relevance and significance of the state-of-knowledge correlation. The NUREG also notes that the state of knowledge correlation (SOKC), also referred to as the epistemic correlation, is the correlation between the estimates of the parameters of some basic events of the model. When evaluating the PRA model to assess a risk metric or an intermediate value, such as the frequency of an accident sequence, this occurs because, for basic-event models employing the same parameters, the state of knowledge about these parameters is the same. In other words, the events are not independent but are related to each other. If the epistemic correlation is ignored, the metrics mean value and uncertainty may be underestimated.

One of the current Byron PRA gaps to the ASME/ANS PRA Standard [1] is the treatment of uncertainty. In part due to the complexity of the model and associated quantification process, a complete capability to address parameter uncertainty quantitatively has not been maintained. This is planned to be addressed in future model updates.

An assessment of the potential for impact of the SOKC on the baseline PRA results has been made, consistent with available guidance in NUREG-1855 [12] and the EPRI report [2], for the baseline PRA. This same approach can be used with regard to application-specific results.

Section 2.4 of the EPRI report provides an approach for examining the impact of SOKC on parameter uncertainty. In that approach, the cutsets of the PRA model of the application can be reviewed to establish whether the risk metric used for the application is determined by cutsets that involve basic events with epistemic correlations. If not, then the point estimate of the risk metric can be used instead of the mean value.

Page 3 of 33

Section 2.4 of the EPRI report also presents two guidelines if the parameter uncertainty of a risk metric of a PRA application has to be provided for decisionmaking. The first guideline requires demonstrating that the probability distribution is not expected to significantly change (e.g., because the significant contributors for the application do not involve correlated basic events) from the base-model probability distribution. If this condition is satisfied, the base-model probability distribution is used for the application.

The following review was performed. The cutsets for baseline CDF were examined in detail to identify cutsets with basic events whose failure probabilities are derived from the same parameters (e.g., same failure rate/demand probability). This examination identified that cutsets subject to the epistemic correlation contribute about 1.1% in the baseline CDF. Additionally, a similar examination identified that cutsets subject to the epistemic correlation contribute about 0.9% in the baseline LERF. These contributions do not represent the potential to have a significant impact on the mean. The highest frequency cutset subject to impact of epistemic correlation occurs at the 43rd CDF cutset (128th LERF cutset) in the baseline results. These results support a conclusion that the epistemic correlation has low significance in both the baseline CDF and LERF.

Therefore, it is reasonable to use the point estimate of the CDF risk metric as representative of the mean value, as stated in Section 4.1.2, Step 4 (CC II) of NUREG-1855 [12]. For applications of the PRA, these results should be confirmed to be applicable to the particular decision metrics and results.

1.2 Completeness Uncertainty The PRA used to support risk-informed decisions should be of sufficient scope and level of detail to support the decision under consideration. For each application, it is necessary to determine the appropriate scope of the model (e.g., internal events at power, internal flooding, internal fires, seismic risk, and other external events) that needs to be applied. Given that appropriate risk contributors are addressed in the risk impact determination, completeness uncertainty can be assumed to be small.

Page 4 of 33

1.3 Model Uncertainty In this attachment, for each applicable model uncertainty item that was shown in Appendix A of the EPRI report [2] (i.e. in Table A-1 of [2]), a plant-specific issue characterization and assessment is provided to fully satisfy the related supporting requirements. Table 1 in this attachment illustrates the implementation of this process where the specific supporting requirements that are being treated are clearly identified.

This includes the supporting requirements listed above as well as those supporting requirements for documenting the sources of model uncertainty and related assumptions associated with each element (IE-D3, AS-C3, SC-C3, SY-C3, HR-I3, DA-E3, LE-G4, and IF*-B3).

In addition to the assessment for the generic list of candidate model uncertainties, an assessment of plant-specific features and modeling approaches is performed to determine if additional sources of model uncertainty and related assumptions should be incorporated into the list. This assessment is summarized in Section 2 with the results of the plant-specific identified items incorporated into Table 2 with the same structure as the generic list of items shown in Table 1.

The discussion of the standard sensitivity cases recommended in Section 3 and Appendix A of the EPRI report [2] for HEPs and CCF values is provided in Section 3. In accordance with the methodology in the EPRI report [2], these issues were identified as generic high level sources of modeling uncertainty rather than trying to identify all potential sources of model uncertainty associated with these issues since they are generally understood and accepted as areas of uncertainty that can be significant contributors to CDF and LERF.

Finally, Section 4 summarizes the findings from the implementation of the process for characterizing the sources of model uncertainty for the Byron/Braidwood PRA.

Page 5 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment Initiating Event Analysis (to support meeting IE-D3)

1. Grid stability Recently the stability of LOOP sequences EPRI data thru the end of 1) The generic industry data 1) The LOOP initiator The total LOOP at least some local including 2001 is utilized for the is applicable to both sites frequency is apportioned frequency utilized in the areas of the electric consequential LOOP prior LOOP initiating event and appropriate to use as a into the four causal factors model of 2.9E-2/yr is power grid has been sequences frequency. A Bayesian prior distribution. The more in the model with a same as the questioned. The update of this value with recent (2002-2003) data is percentage assigned to Byron/Braidwood-potential duration and industry data from 2002- sufficient to perform the each category. specific value of 2.9E-complexities of 2003 is utilized to obtain a Bayesian update process. 2/yr reported in recovery from such total LOOP frequency. NUREG/CR-6890 [3].

events are hard to This should not be a dismiss. Three different The industry wide data in 2) The industry wide 2) LOOP recovery failures source of model aspects relate to this the EPRI reports covering recovery data is applicable are included for 4.0 and uncertainty in most issue: 1980-2003 is utilized to to both sites and the 24.0 hours0 days 0 hours 0 weeks 0 months from sequence applications.

develop the failure to weighted average from the initiation depending on the 1a. LOOP Initiating recovery probabilities for four causal factors is accident sequence Event Frequency four LOOP categories. acceptable for the base case progression.

1b. Conditional However, the weighted analysis.

LOOP Frequency average failure to 1c. Availability of dc recovery probability (from power to perform all causes) is utilized for restoration the applicable time frames actions in the model.

The consequential LOOP 3) The use of generic data 3) The loss of grid LOOP The consequential failure probabilities are for consequential LOOP recovery failure data is LOOP probabilities derived consistent with the events is assumed to be utilized for the utilized provide a NRC recommended applicable for both sites and consequential LOOP reasonably realistic generic values [3] of ~2E- the consequential LOOP event sequences. modeling with slight 3 and ~2E-2 given a events are assumed to be conservative bias. As reactor trip or LOCA, similar to other loss of grid such, this should not be respectively. events. a source of model uncertainty in most applications.

Page 6 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment Offsite power restoration 4) When offsite power is 4) No additional Realistic with slight is dictated by procedure. available at the switchyard, adjustments or system conservative bias on Restoration is possible as then power is available to model changes are the recovery times the switchyard has its own charge the batteries needed incorporated when using utilized. This should not 125V dc distribution for breaker control to align the different LOOP be a source of model system to provide breaker power to the site. The recovery probabilities. uncertainty in most and transformer control specific failure modes of the Available recovery times applications.

power. offsite restoration are are conservatively chosen implicitly included via the to account for restoration use of the generic LOOP time uncertainty.

recovery probabilities.

2. Support System Increasing use of plant- Support system event Support System Initiating 1) The loss of support 1) For the standby Realistic with slight Initiating Events specific models for sequences Event fault trees are system success criteria are contributors in the support conservative bias (SSIEs) support system developed for loss of CC, developed consistent with system initiating event, the because MTTR is initiators (e.g. loss of loss of SX, and loss of the post-trip configuration same basic events are typically less than 24 SW, CCW, or IA, and WS. requirements (e.g. 1 of 2 SX utilized in the SSIE fault hours. This should not loss of ac or dc buses) pumps) and mission time tree and in the mitigation be a source of model have led to requirements (i.e. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months fault tree. uncertainty in most inconsistencies in MTTR assumed consistent applications.

approaches across the with the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mitigation industry. A number of mission time).

challenges exist in modeling of support 2a) The CCF for the fail- 2a) The use of the generic 2a) The fail-to-run CCF Slight conservative bias system initiating events: to-run terms is based on alpha factors based on terms dominate the overall treatment since alpha annualized mission times industry wide experience is contribution to the SSIE factors are known to be 2a. Treatment of using generic alpha applicable for the site. frequency evaluation. high when utilized in an common cause factors, but with plant- annualized fashion and failures specific information for the compared to plant-2b. Potential for independent failure rate. specific experience.

recovery This should not be a source of model uncertainty in most applications.

Page 7 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment 2b) Modeling of recovery 2b) The lack of credit for 2b) There are no basic Slight conservative to prevent support system recovery from the support events included in model treatment since credit initiating events is limited system initiating events will for recovery from the loss for recovery could to procedurally-directed not significantly impact the of support system reduce the baseline alignments of standby CDF and LERF distribution. initiators. CDF and LERF risk equipment given failure of metrics. This should not running equipment, if such be a source of model alignments can be uncertainty in most accomplished prior to loss applications.

of the support system. No additional credit for recovery beyond system failure is modeled.

3. LOCA initiating It is difficult to establish LOCA sequences The pipe break portion of 1) The use of generic data 1) In general, the LOCA The LOCA frequency event frequencies values for events that the LOCA initiating event from the NUREG studies is frequencies are higher values represent a have never occurred or frequencies are based on generally applicable to both than those reported in slight conservative have rarely occurred a pipe segment count and sites. more recent studies (e.g. treatment. This should with a high level of per segment failure NUREG-6928 [6]). not be a source of confidence. The choice probabilities from Therefore, a slight model uncertainty in of available data sets or NUREG/CR-1829 [4] and conservative bias in the most applications.

use of specific NUREG/CR-5750 [5]. The LOCA initiating event methodologies in the component rupture portion frequencies might be determination of LOCA of the LOCA initiating present.

frequencies could event frequencies are impact base model based on the component results and some rupture data and applications. methodology utilized in the NUREG/CR-5750.

Accident Sequence Analysis (to support meeting AS-C3)

Page 8 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

4. Operation of Station Blackout events Credit for continued No credit is taken for 1) Operation of systems 1) Systems that normally No credit for equipment equipment after are important operation of these continued operation of any without dc that normally require dc for operation operation after battery battery depletion contributors to baseline systems in sequences systems without dc power require dc for operation is are not credited for depletion may CDF at nearly every US with batteries depleted that normally require dc not readily viable. continued operation upon represent a slight NPP. In many cases, (e.g. long term SBO power for operation. This battery depletion in the conservative bias. This battery depletion may sequences) includes SG level control. event sequence modeling. should not be a source be assumed to lead to of model uncertainty in loss of all system most applications.

capability. Some PRAs have credited manual operation of systems that normally require dc for successful operation (e.g. turbine driven systems such as RCIC and AFW).

5. RCP seal LOCA The assumed timing Accident sequences The WOG 2000 The WOG 2000 RCP seal The assumption of The operator action treatment - PWRs and magnitude of RCP involving loss of seal consensus model [11] has LOCA model is applicable to additional time for tripping timing assumption may seal LOCAs given a cooling been implemented. both sites. Tripping of the of the RCPs for non-LOOP represent a source of loss of seal cooling can RCPs following a loss of all scenarios may introduce a model uncertainty for have a substantial seal cooling and injection is slight non-conservative some applications.

influence on the risk assumed to result in a large bias. The lack of explicit profile. seal leak per the WOG 2000 The lack of explicit modeling of smaller model. modeling of smaller leaks leaks is accounted for For non-LOOP events, a is adjusted for by by increasing the large simplified implementation of increasing the probability leak probability, and is the WOG 2000 model is that a large seal leak therefore believed not used, in which the possibility occurs (from 0.21 to 0.32). to be a significant of smaller leaks is not source of model modeled in detail. uncertainty.

The timing for the operator action to trip the RCPs is somewhat longer in the HEP calculation than in the NRC SER on the WOG 2000 model (30 minutes vs. 13 minutes).

Page 9 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

6. Recirculation This issue is not N/A N/A N/A N/A N/A pump seal leakage applicable to PWRs.

treatment - BWRs w/ Isolation Condensers Success Criteria (to support meeting SC-C3)

7. Impact of This issue is not N/A N/A N/A N/A N/A containment venting applicable to PWRs.

on core cooling system NPSH Page 10 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

8. Core cooling Loss of containment Long term loss of Containment over- Following containment Containment failure is not The likelihood of success following heat removal leading to decay heat removal pressurization and failure failure, ECCS injection from modeled in the Level 1 containment failure containment failure long-term containment scenarios is not modeled as a core the RWST could still be model. affecting core cooling or venting through over-pressurization and damage contributor due to maintained. Further, there capability is sufficiently non hard pipe vent failure can be a the robust design of the would be sufficient NPSH for small to not be a paths significant contributor in Byron and Braidwood the RH pumps to support potential source of some PRAs. containments. The Level 2 ECCS recirculation cooling. model uncertainty for Consideration of the analyses performed for The likelihood of applications.

containment failure the IPEs demonstrated containment failure affecting mode might result in that containment failure core cooling capability is additional mechanical prior to core damage sufficiently small to not be a failures of credited would not adversely affect significant core damage systems. Containment ECCS pump NPSH and contributor.

venting through soft not be a significant core ducts or containment damage contributor.

failure can result in loss of core cooling due to environmental impacts on equipment in the reactor building, loss of NPSH on ECCS pumps, steam binding of ECCS pumps, or damage to injection piping or valves. There is no definitive reference on the proper treatment of these issues.

Page 11 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

9. Room heatup Loss of HVAC can Dependency on HVAC A combination of design 1) Design basis calculations 1) An HVAC dependency This should not be a calculations result in room for system modeling basis calculations for showing that HVAC is not is not included for the candidate source of temperatures and timing of accident technical specifications, required in the switchgear switchgear and battery model uncertainty.

exceeding equipment progressions and Appendix R supporting and battery rooms are rooms.

qualification limits. associated success calculations, and plant- sufficiently applicable to the Treatment of HVAC criteria. specific equipment anticipated transients in the requirements varies survivability calculations PRA model.

across the industry and are referenced to often varies within a determine the HVAC 2) Equipment survivability 2) An HVAC dependency The equipment PRA. There are two requirements in the calculations for ECCS show for CV and RH is included survivability calculations aspects to this issue. model. room cooling is required for in the system models. are judged to be One involves whether CV and RH. reasonably realistic.

the SSCs affected by This should not be a loss of HVAC are candidate source of assumed to fail (i.e. model uncertainty there is uncertainty in unless reference to the the fragility of the existing calculations is components). The deemed insufficient.

other involves how the 3) CC pump room cooling 3) An HVAC dependency This should not be a rate of room heatup is assumed not be required for CC is not included in candidate source of calculated and the based on location in open the system models. model uncertainty assumed timing of the area in the Aux Building. unless reference to the failure. existing calculations is deemed insufficient.

4) Equipment survivability 4) An HVAC dependency This should not be a calculations for ECCS show for SX is included in the candidate source of room cooling or lube oil system models. model uncertainty.

cooling is required for SX.

5) Refer to Topic 14 Item 4 5) DG ventilation Refer to Topic 14 Item for discussion. requirements are explicitly 4 for discussion and modeled as a DG conclusion.

dependency.

Page 12 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

10. Battery life Station Blackout events Determination of Design basis calculations Given the typical 1) Short term SBO Realistic given the calculations are important battery depletion indicate that ~8 hours of conservatisms associated scenarios require that relatively long battery contributors to baseline time(s) and the battery life is available with the design-basis battery offsite ac power be life without recharge.

CDF at nearly every US associated accident depending on scenario calculations, explicit restored within the battery This should not be a NPP. Battery life is an sequence timing and specifics. Credit for 8 representation of load life to avoid core damage. source of model important factor in related success hours is utilized in the shedding is not assumed to uncertainty in most assessing a plants criteria. model for scenarios be required to obtain the 8 applications.

ability to cope with an without chargers hour battery life times.

SBO. Many plants only available.

have design basis calculations for battery life. Other plants have very plant/condition-specific calculations of battery life. Failing to fully credit battery capability can overstate risks, and mask other potentially contributors

& insights. Realistically assessing battery life can be complex.

Page 13 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

11. Number of PWR EOPs direct System logic modeling Plant-specific success The appropriate success For scenarios in which a The modeling is PORVs required for opening of all PORVs to representing success criteria calculations have criteria (i.e., 2 PORVs open single CV pump is believed to be realistic.

bleed and feed - reduce RCS pressure criterion and accident been performed using or 1 PORV opens) are available, bleed and feed This should not be a PWRs for initiation of bleed sequence timing for MAAP to determine the applied depending on the success requires 1 PORV source of model and feed cooling. performance of bleed number of PORVs available ECCS pumps for opening. For other uncertainty in most Some plants have and feed and required to open (and the scenario being modeled. scenarios with SI pump applications. However, performed plant-specific sequences involving timing of opening) for only, success requires for some applications analysis that success or failure of successful bleed and feed both PORVs opening. affecting PORV demonstrate that less feed and bleed. cooling. This has been availability, there may than all PORVs may be done as a function of the be merit to evaluating sufficient, depending on ECCS pumps available. the impact of this issue.

ECCS characteristics Results show that a single and initiation timing. PORV opening represents bleed and feed success for the condition where a CV is running. Success is also credited where two PORVs and a single SI pump is running.

12. Containment All PWRs are improving Recirculation from The failure cause and A random plugging of the The probability of an The non-incorporation sump / strainer ECCS sump sump system likelihood of containment sump strainers sufficient to unrecoverable global CCF of unrecoverable global performance management practices, modeling and sump suction strainers are result in inadequate NPSH plugging of the new CCF term for plugging including installation of sequences involving expected to be somewhat for the ECCS pumps during strainers is assumed to be of the sump strainers is new sump strainers at injection from these different, depending on recirculation is not currently small, and not explicitly judged to not be a most plants. There is sources what type of transient is modeled. It is assumed that included in the model. source of significant not a consistent method (Note that the being analyzed. Byron the plugging of the sump model uncertainty given for the treatment of modeling should be and Braidwood have strainers, given that the new the large capacity of the ECCS sump relatively installed larger capacity larger strainers have been new strainers. .

performance. straightforward, the strainers in response to installed, is low probability. However, this should uncertainty is related GSI-191 to minimize the not be considered as a to the methods or likelihood of strainer potential source of references used to plugging sufficient to model uncertainty.

determine the affect ECCS pump NPSH.

likelihood of sump strainer and common cause failure of the strainers.)

Page 14 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

13. Impact of failure Certain scenarios can Success criterion for Failure of a sufficient 1) For general transients 1) From the perspective of The approach taken is of pressure relief lead to RCS/RPV prevention of RPV number of safety relief (non-ATWS), it is assumed RPV overpressure given a consistent with that pressure transients overpressure valves to open when that opening of any 1 of the reactor trip, since only a used in other PWR requiring pressure (Note that uncertainty required may lead to 2 PORVs and 3 SRVs is single PORV or SRV is PRAs. The potential relief. Usually, there is exists in both the excessive reactor vessel sufficient to preserve RPV required to open, the impact on CDF due to sufficient capacity to determination of the pressure and a potential integrity below Service Level probability of overpressure not explicitly modeling accommodate the global CCF values that LOCA condition. The C. is sufficiently small (i.e., the possibility of pressure transient. may lead to RPV most significant common cause failure of overpressure for non-However, in some overpressure and overpressure challenge the PORVs and common ATWS events is not scenarios, failure of what is done with the transient results from cause failure of the SRVs) believed to be adequate pressure subsequent RPV ATWS. For general that it is not explicitly significant. This should relief can be a overpressure transients with reactor trip, modeled. Note that failure not be a source of consideration. Various sequence modeling.) the PORVs provide of a challenged PORV to model uncertainty in assumptions can be pressure relief if needed, reclose is modeled for most applications.

taken on the impact of and the likelihood of a sequences in which a inadequate pressure safety relief valve PORV might be relief. challenge is sufficiently challenged.

small that explicit Page 15 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment modeling is not required. 2) For ATWS scenarios, the 2) For transients without Slight conservative bias number of PORVs and/or reactor trip, the PRA treatment in assumption SRVs is a function of core includes logic to model the that overpressure reactivity, available AFW appropriate number of failure in ATWS cases capacity, and other PORVs and SRVs goes directly to core parameters as specified in required to open to damage, since RCS the WOG ATWS model maintain RCS pressure piping failures in most (WCAP-11992 [10]). Per the below the ASME Service locations would not WOG model, there may be Level C pressure in result in LOCAs in brief periods of time in which accordance with the excess of ECCS all available pressure relief is success criteria specified capability. However, the not adequate to maintain in WCAP-11992 [10]. modeling is in RCS pressure below the Failure of the requisite accordance with an ASME Service Level C number of valves to open industry recognized pressure. Failure to is modeled as resulting in model. This is not a maintain RCS pressure core damage. For small source of model below the ASME Service LOCAs and the steam line uncertainty for most Level C pressure is modeled breaks without reactor trip, applications.

(non-mechanistically) in the the PRA assumes that the PRA as leading to vessel sequences directly lead to failure and core damage. core damage.

Page 16 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment Systems Analysis (to support meeting SY-C3)

14. Operability of Due to the scope of System and accident Generally, credit for 1) Design basis calculations 1) An HVAC dependency Potentially slightly non-equipment in beyond PRAs, scenarios may sequence modeling of operation of systems showing that HVAC is not is not included for the conservative, as the design basis arise where equipment available systems and beyond there design-basis required in the switchgear switchgear and battery room Heatup environments is exposed to beyond required support environment is not taken. and battery rooms are rooms. calculations are based design basis systems Exceptions are listed in sufficiently applicable to the on 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months mission time, environments (w/o the next column. anticipated transients in the with assumption that room cooling, w/o PRA model. within that period component cooling, w/ operators would take deadheading, in the action to restore cooling presence of an un- to the rooms. However, isolated LOCA in the design basis room area, etc.). heatup calculations generally over-estimate room heatup rates, and more realistic calculations would likely reduce any non-conservatism. This should not be a candidate source of model uncertainty unless reference to the existing calculations is deemed insufficient.

2) Equipment survivability 2) An HVAC dependency The equipment calculations for ECCS show for CV and RH is included survivability calculations room cooling is required for in the system models. are judged to be CV and RH. reasonably realistic.

This should not be a candidate source of model uncertainty.

3) CC pump room cooling 3) An HVAC dependency This should not be a assumed not be required for CC is not included in candidate source of based on location in open the system models. model uncertainty.

area in the Aux Building.

Page 17 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

4) Each DG requires 4) DG ventilation Not explicitly ventilation to operate requirements are explicitly accounting for the successfully. This modeled as a DG limited time frames dependency is modeled to dependency. when two DG HVAC include suction and exhaust fans may be required to dampers (including CCF provide DG cooling is a terms as applicable) and fan potential slight non-fail-to-start and fail-to-run conservatism. Not terms. There may be limited modeling the times when 2 DG HVAC proceduralized fans are required to provide restoration of DG cooling, but this is assumed ventilation is a potential not to be a significant conservatism. Given dependency and is not that a ventilation modeled. Station procedures dependency is provide guidance for the modeled, the above emergency restoration of the factors should not be a DG ventilation and for the significant source of use of portable ventilation to model uncertainty.

maintain DG temperatures acceptable, but this option is not credited in the PRA model.

5) Given the typical 5) Short term SBO Realistic with slight conservatisms associated scenarios require that conservative bias on with the design-basis battery offsite ac power be assumed battery life calculations, and the restored or alternate ac time. This should not relatively long battery life, power from the EDGs be be a source of model explicit representation of aligned within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to uncertainty in most load shedding is not avoid core damage. applications.

assumed to be required to obtain the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months battery life times.

Page 18 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment Human Reliability Analysis (to support meeting HR-I3)

15. Credit For ERO Most PRAs do not give System or accident Generally, credit for Credit for ERO is not taken ERO support is not Credit for some much, if any credit, for sequence modeling initiation of actions from in the PRA. modeled. direction from the ERO initiation of the with incorporation of the ERO is not taken in for longer-term actions Emergency Response HFEs and HEP value the Level 1 core damage would be a realistic Organization (ERO), determination in both sequence analysis. assumption. Slight including actions the Level 1 and Level conservative treatment included in plant- 2 models in not modeling. This specific SAMGs and the should not be a source new B5b mitigation of model uncertainty in strategies. The most applications.

additional resources and capabilities brought to bear via the ERO can be substantial, especially for long-term events.

Page 19 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment Internal Flooding (to support meeting IF*-B3)

16. Piping failure One of the most Likelihood and The Internal flood analysis 1) The use of generic flood 1) Flood initiator Considered an industry mode important, and characterization of and initiating event frequencies with plant- frequencies are based on good practice uncertain, inputs to an internal flooding frequencies for spray, specific estimates of pipe plant-specific estimates of approach, but is not yet internal flooding sources and internal flood, and major flood lengths is suitable for pipe lengths and generic a consensus model analysis is the flood event sequences scenarios are developed representation of the flood flood frequencies (per approach. This should frequency of floods of consistent with the EPRI frequencies at the site. foot) for different not be a source of various magnitudes methodology [7]. In the categories of piping from significant model (e.g., small, large, current internal flooding the EPRI methodology [7]. uncertainty given that a catastrophic) from model, some simplifying recognized various sources (e.g., assumptions have been methodology has been clean water, untreated made, since the results applied using plant-water, salt water, etc.). are dominated by SX specific piping data.

EPRI has developed flooding scenarios. The However, it is retained some data, but the flooding analysis is as a potential model NRC has not formally integrated into the internal uncertainty.

endorsed its use. events at power model A more detailed update to 2) Spray flood scenarios with 2) Spray initiator scenario Realistic with a slight the internal flooding less than 100 GPM flow do impacts are limited to the conservative bias analysis is currently being not totally disable the system local affects of the spray. employed in the performed, and will be they arise from. undeveloped spray integrated into the model scenarios that are when completed. subsumed in with the other flood scenarios in the same region. This should not be a source of model uncertainty in most applications.

3) Flood and major flood 3) Flood and major flood Conservative bias sources are assumed to initiator scenarios include treatment in that the totally disable the system failure of the source system may not be they arise from. system as well as the totally disable in all components that are failed cases. This should not due to the flood event. be a source of model uncertainty in most applications.

Page 20 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment LERF Analysis (to support meeting LE-G4)

17. Core melt arrest Typically, the treatment Level 2 containment Approach is based on the Consistent with NUREG/CR- No credit for in-vessel core Conservative bias in-vessel of core melt arrest in- event tree sequences simplified LERF 6595 melt arrest. treatment in that in-vessel has been limited. methodology from vessel core melt arrest However, recent NRC NUREG/CR-6595 [8] for might be feasible in work has indicated that PWRs with large volume some scenarios. This there may be more containment. should not be a source potential than of model uncertainty in previously credited. most applications.

18. Thermally NRC analytical models Level 2 containment Approach is based on the Consistent with NUREG/CR- Induced SGTR probability Approach is consistent induced failure of hot and research findings event tree sequences simplified LERF 6595 is assumed to be 1.8E-2, with NRC model. This leg/SG tubes - continue to show that methodology from consistent with NUREG- should not be a source PWRs TI-SGTR is more NUREG/CR-6595 [8] for 4551 and subsequent of model uncertainty in probable than predicted PWRs with large volume guidance. most applications by the industry. There containment. unless new research is a need to come to determines a basis for agreement with NRC on alternative the thermal hydraulics assumptions.

modeling of TI SGTR.

Page 21 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

19. Vessel failure The progression of core Level 2 containment The following 1) RPV catastrophic failure No explicit impact on Approach is adequate mode melt to the point of event tree sequences phenomenological leading to early containment model, since failure mode for determination of vessel failure remains conditions that could lead failure via missiles is is assumed to be a small LERF. This should not uncertain. Some codes to early containment extremely unlikely based on contributor to the overall be a source of model (MELCOR) predict that failure (and LERF) are reference to generic studies. likelihood of containment uncertainty in most even vessels with lower dependent upon the failure. applications.

head penetrations will vessel failure mode remain intact until the considered in the Level 2 2) Per NUREG/CR-6595, 2) DCH failure mode is Approach is adequate water has evaporated analysis and potentially direct containment heating is considered in model for for determination of from above the applicable to Byron and only possible for high sequences that proceed to LERF. This should not relocated core debris. Braidwood. These are: 1) pressure melt scenarios, but vessel failure at high be a source of model Other codes (MAAP), RPV catastrophic failure, even there is noted as very pressure. uncertainty in most predict that lower head 2) direct containment unlikely. applications.

penetrations might fail heating, and 3) ex-vessel 3) Ex-vessel steam 3) Ex-vessel steam Approach is adequate early. The failure mode steam explosion. explosions noted as very explosion failure mode is for determination of of the vessel and unlikely based on reference addressed within the LERF. This should not associate timing can to generic studies. simplified NUREG/CR- be a source of model impact LERF binning, 6595 modeling as part of uncertainty in most and may influence early containment failure applications.

HPME characteristics possibility..

(especially for some BWRs and PWR ice condenser plants).

20. Ex-vessel The lower vessel head Level 2 containment This is not considered in No credit for ex-vessel Ex-vessel cooling of the No credit for ex-vessel cooling of lower of some plants may be event tree sequences the PRA due to cooling. lower head is not included cooling of the lower head submerged in water uncertainties in the in the model. head represents a prior to the relocation of behavior of the lower head realistic treatment with core debris to the lower penetrations and the a slight conservative head. This presents presence of insulation bias slant. This should the potential for the surrounding the lower not be a source of core debris to be head. model uncertainty in retained in-vessel by most applications.

ex-vessel cooling. This is a complex analysis impacted by insulation, vessel design and degree of submergence.

Page 22 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

21. Core debris In some plants, core Level 2 containment This is not considered as This is not considered as an N/A This should not be a contact with debris can come in event tree sequences an early failure early failure mechanism source of model containment contact with the mechanism because there because there is no direct uncertainty in most containment shell (e.g., is no direct path for core path for core debris to applications.

some BWR Mark Is, debris to contact the contact the containment some PWRs including containment shell. shell.

free-standing steel containments). Molten core debris can challenge the integrity of the containment boundary. Some analyses have demonstrated that core debris can be cooled by overlying water pools.

Page 23 of 33

Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model (to Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) meet QU-E4) Assessment

22. ISLOCA IE ISLOCA is often a ISLOCA initiating ISLOCA analysis follows 1) Original ISLOCA analysis 1) The current ISLOCA The approach for the Frequency significant contributor to event sequences the methodology in provides reasonable values are believed to be ISLOCA frequency Determination LERF. One key input to NSAC-154 [9] and estimates for the ISLOCA reasonable determination is the ISLOCA analysis accounts for common initiating event frequencies. considered acceptable are the assumptions cause failures and given that the current related to common captures likelihood of 2) The failure probability for 2) Unique contributions approach is reasonably cause rupture of different piping failure each flow path given from each flow path conservative, but isolation valves modes. However, the exposure to high pressure included in the model to because of the vintage between the RCS/RPV ISLOCA analysis has not RPV conditions is delineate that fraction of of the analysis, the and low pressure been updated since the appropriately represented by system unavailability from ISLOCA initiating event piping. There is no IPE and has not evolved the IPE analysis. the initiating event. frequencies are consensus approach to to be consistent with more identified as candidate the data or treatment of recent detailed sources of model this issue. Additionally, methodologies. uncertainty.

given an overpressure condition in low pressure piping, there is uncertainty surrounding the failure mode of the piping.

23. Treatment of This issue is not N/A N/A N/A N/A N/A Hydrogen applicable to Byron and combustion in BWR Braidwood.

Mark III and PWR ice condenser plants Page 24 of 33

2. Consideration of Plant-Specific Features / Modeling Approaches This portion of the assessment allows for the identification of plant-specific features that require unique features, modeling approaches, or phenomenological assessments not considered in the generic list.

For Byron/Braidwood, a review of unique issues was performed to identify the following items as plant-specific candidate sources of model uncertainty:

Probability of containment integrity challenge following vessel rupture event

Modeling of CC with respect to the alignment of the CC HX 0, which is a shared system across the units

The modeling of CC, CV and SX pump alignments, of which only one train is assumed to be running

The modeling of SX Cooling Tower Fans and the associated riser valves configurations (Byron only)

Condensate Storage Tank depletion time Each of these items is discussed in Table 2 in the same format as that utilized in Table 1 to provide an issue characterization for the plant-specific sources of model uncertainty.

Page 25 of 33

Table 2 Issue Characterization for Additional Plant-Specific Sources of Model Uncertainty for Byron/Braidwood (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) (to meet QU-E4) Assessment Consideration of Plant-Specific Features / Modeling Approaches Containment There is model Vessel rupture Vessel rupture sequences Vessel rupture sequence is not Vessel rupture Vessel rupture integrity following uncertainty regarding sequences are modeled as lead assumed to result in concurrent sequence potential for frequency is on the vessel rupture event the subsequent directly to core damage containment failure coincident LERF. order of E-7, i.e., very treatment that but not directly to LERF. with the vessel rupture. small, such that increases the likelihood potential impact on of LERF for this LERF is also small.

extremely rare event. Containment integrity following vessel rupture is therefore not identified as a candidate source of model uncertainty.

The modeling of CC The alignment of CC CC system fault trees The alignment of CC HX 0 Base model quantification A basic event The CC HX 0 alignment with respect to the HX 0 is not always is explicitly modeled for assumes that the CC HX 0 is representing an modeling is used to alignment of the CC known for some both units, and the results aligned to its own unit being average fraction of the achieve capability to HX 0, which is a application. are quantified specific to analyzed. CC HX 0 alignment realistically model the shared system the CC HX 0 alignment. during the plant various plant across the units operation may impact configurations. This is the importance of some not a source of model SSCs. uncertainty for applications.

The modeling of CC, The pump alignments CC, ECCS and SX The alignments of CC, CV Base model quantification Basic events The pump alignments CV and SX pump are not always known system fault trees and SX pumps are assumes that Train A pumps representing the are used to achieve alignments, of which for some application. explicitly modeled for both are normally running and Train average fractions of the capability to realistically only one train is units and the results are B pumps are in standby. running pumps during model the various plant assumed to be quantified specific to the the plant operation may configurations.

running. pump alignments. impact the importance However, this is of some sequences. identified as a potential source of uncertainty for some applications.

Page 26 of 33

Table 2 Issue Characterization for Additional Plant-Specific Sources of Model Uncertainty for Byron/Braidwood (QU-F4 and LE-F3)

Topic Discussion of Issue Part of Model Plant-Specific Assumptions Made Impact on Model Characterization (to meet QU-E1) Affected Approach Taken (to meet QU-E2) (to meet QU-E4) Assessment The modeling of SX The fan/riser valve SX Tower system fault 4 SX Cooling Tower Fans Base model quantification Basic events The SX fan/riser train Cooling Tower Fans configurations are not tree and the associated riser assumes that SX fan/riser valve representing the alignments are used to and the associated always known for some valves are needed for the Trains A, B, G, and H are average fractions of the achieve capability to riser valves application. LOCA loads and 2 SX normally running and Trains C, running SX fan/riser realistically model the configurations fans/riser valves are D, E, and F are in standby. valve trains during the various plant (Byron only) required for non-LOCA plant operation may configurations.

loads. impact the importance However, this is of some sequences. identified as a potential source of uncertainty for some applications.

Condensate Storage The inventory in the AF fault tree success CST inventory is adequate Probability of failing to continue Minimal impact. Lack of explicit Tank depletion time CST is normally not criteria for decay heat for approximately 16 hrs; decay heat removal is very Probability of failing to modeling of the various sufficient for the full 24 removal. assumption is made that small given depletion of CST continue decay heat sources of decay heat hour mission time the likelihood of failing to inventory. removal is very small removal should not modeled in the PRA. either refill the CST or given depletion of CST have a significant align to shutdown cooling inventory. impact on CDF or within this extended time LERF. This is not frame is very small. identified as a source of model uncertainty for applications.

Page 27 of 33

3. HEP and CCF Sensitivity Case Results The process outlined in Section 3 and Appendix A of the EPRI report [2] also included the recommendation to perform a standard set of four sensitivity cases:

The 5th and 95th percentile values were calculated based on the HEP uncertainty parameter propagation

All CCF probabilities set to their 5th percentile value (the use of zero value CCF probabilities is also deemed acceptable)

All CCF probabilities set the their 95th percentile value The results of these sensitivity cases are also discussed here and compared to the RG 1.174 [14] CDF and LERF limits of 1x10-4/yr for CDF and 1x10-5/yr for LERF to obtain insights into the sensitivity of the base PRA model results to these generic high level sources of modeling uncertainty rather than trying to identify all potential sources of model uncertainty associated with these issues since they are generally understood and accepted as areas of uncertainty that can be significant contributors to CDF and LERF.

The results of these sensitivity studies are presented in Table 3. Only adjustments to the basic events in the base cutset equation were made to determine these results.

This is judged to be acceptable for the initial base sensitivity cases.

Page 28 of 33

Table 3 Formulation of Standard Sensitivity Studies for Byron Unit 1 Lower Upper CDF/LERF when at CDF/LERF when Sensitivity Study Base Bound or Bound or th th Lower Bound at Upper Bound Item Value 5 %-tile 95 %-

Value Value Value tile Value Generic Sensitivity Study Issues (Base CDF = 1.8E-5/yr, Base LERF = 1.1E-6/yr)

All Human Error Various Zero Various CDF: 9.9E-6 CDF: 2.3E-5 Probability Values (0.55x Base CDF) (1.3x Base CDF)

LERF: 7.4E-7 LERF: 1.6E-6 (0.67x Base LERF) (1.5x Base LERF)

All Common Cause Various Zero Various CDF: 1.6E-5 CDF: 2.4E-5 Failure Probability (0.89x Base CDF) (1.3x Base CDF)

Values LERF: 9.8E-7 LERF: 1.3E-6 (0.89x Base LERF) (1.2x Base LERF)1 The results of the special sensitivity studies lead to the following conclusions for Byron:

Human Error Probability Values

More than 80% of the base case CDF and more than 60% of the base case LERF involve human error terms as contributors.

Correspondingly, the 95th percentile value based on the HEP uncertainty propagation increases the CDF by a factor of 1.3 and LERF by a factor of 1.5.

However, both CDF and LERF are below the RG 1.174 CDF and LERF limits of 1x10-4/yr for CDF and 1x10-5/yr for LERF for the 95th percentile value based on the HEP uncertainty propagation.

1 Quantified with the 1E-11 truncation limit, since the model would not quantify at 1E-12.

Page 29 of 33

Common Cause Failure Probability Values

More than 12% of the base case CDF and more than 11% of the base case LERF involve CCF terms as contributors.

Correspondingly, setting all of the CCF values to their 95th percentile values increases the CDF by a factor of 1.3 and LERF by a factor of 1.2.

However, both CDF and LERF are still well below the RG 1.174 CDF and LERF limits of 1x10-4/yr for CDF and 1x10-5/yr for LERF when all of the CCF values are set to their 95th percentile values.

The results of these sensitivity cases indicate that human errors (or the potential for human errors) will be potential candidate sources of model uncertainty for some applications of the model. The specific HEPs that contribute may need to be examined on a case by case basis for a given application. Similarly, common cause failures (or the potential for common cause failures) will also be potential candidate sources of model uncertainty for some applications of the model and the specific CCF values that contribute may need to be examined on a case by case basis. Given the relative magnitude of the contributions from the sensitivity cases presented here, it is likely that specific HEP values will be more important than specific CCF values for any given application.

Page 30 of 33

4. Summary The results of the evaluation of the impact of model uncertainty through implementing the process as shown in Tables 1 and 2 and discussed in Section 3 identified the following issues as the most likely candidate sources of model uncertainty from the base PRA model assessment.

Timing of action to trip Reactor Coolant Pumps given a loss of RCP seal cooling/injection

PORV success criteria for bleed and feed operation

Internal flood initiating event frequencies and failure modes

ISLOCA frequencies

Human error probability values

Common cause failure values

The modeling of CC, CV and SX pump alignments, of which only one train is assumed to be running

The modeling of SX Cooling Tower Fans and the associated riser valves configurations (Byron only)

For the most part, the issues listed above plus the topics identified in Table A-3 of the EPRI report [2] would need to be considered when trying to identify potential sources of model uncertainty relevant to the application being investigated per the guidance provided in Section 4 (see Figure 4-1) in the EPRI report [2]. Several other issues were also identified as being treated with conservative bias slants. These items are indicated in Table 1, but due to the conservative treatment, they should not become potential candidates as key sources of uncertainty for most applications of the model.

Page 31 of 33

5. REFERENCES

1. ASME Committee on Nuclear Risk Management in collaboration with ANS Risk Informed Standards Committee, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-S-2008a, For Recirculation Ballot, October 2008.

2. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI, Palo Alto, CA: November 2008.

3. NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-2004, INL/EXT-05-00501, Idaho National Laboratory, November 2005.

4. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process, USNRC, April 2008.

5. NUREG/CR-5750, INEEL/EXT-98-00401, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, INEEL, February 1999.

6. NUREG/CR-6928, INL/EXT-06-11119, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, INL, February 2007.

7. EPRI TR-1013141, Pipe Rupture Frequencies for Internal Flooding PRAs, Revision

1. EPRI, Palo Alto, CA, 2006.

8. NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, Rev. 1, Brookhaven National Laboratory, October 2004.

9. NSAC-154, ISLOCA Evaluation Guideline, EPRI, September 1991.

10. WCAP-11992, Joint Westinghouse Owners Group/Westinghouse Program: ATWS Rule Administration Process, December 1988.

11. WCAP-15603, WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, Rev. 1-A, June 2003.

Page 32 of 33

12. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, USNRC, March 2009.

13. NUREG-4551, Vol. 7, Rev.1, Part 2A, Evaluation of Severe Accident Risks: Zion Unit 1, Brookhaven National Laboratory, March 1993.

14. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July 1998.

Page 33 of 33

v t e Letter Sequence Request
TAC:ME2293, (Approved, Closed)
Initiation Request, Request, Request, Request, Request Acceptance... Supplement Administration Questions 18 December 2009 19 February 2010 26 February 2010 3 March 2010 Answers 9 March 2010 Results Approval Other: ML092990546
MONTHYEAR2010-02-19 [Table View]

RS-09-121, License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time

Text

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

3.0 TECHNICAL EVALUATION

=

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

1.0 BACKGROUND

2.0 TECHNICAL ANALYSIS

SUMMARY

3.0 CONCLUSION

4.0 REFERENCES

Navigation menu

RS-09-121, License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time

Text

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

3.0 TECHNICAL EVALUATION

=

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

1.0 BACKGROUND

2.0 TECHNICAL ANALYSIS

SUMMARY

3.0 CONCLUSION

4.0 REFERENCES

Navigation menu

Search