Text

License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time
	ML092680090
Person / Time
Site:	Byron
Issue date:	09/24/2009
From:	Simpson P; Exelon Generation Co, Exelon Nuclear
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	RS-09-121
	Download: ML092680090 (141)
	v • d • e

Fxelon C'ntArdtlori www excloncorp corn qjoo Wirlfield Koad Nuclear W~rrc~rlvilie IL 60555 10 CFR 50.90 September 24,2009 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455

Subject:

License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC, (EGC) is requesting an amendment to Facility Operating License Nos. NPF-37 and NPF-66 for Byron Station, Units 1 and 2. This amendment request proposes a one-time extension of the Completion Time (CT) to restore a unit-specific SX train to operable status associated with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.7.8, "Essential Service Water (SX) System," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

The current TS LC0 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1,2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 112SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SXOO1A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1 SX001 A valve, and therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 112SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage; however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a

September 24,2009 U.S. Nuclear Regulatory Commission Page 2 Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

Having the capability to securely isolate a single SX pump on a single unit will enable necessary system maintenance to be performed, thus restoring the reliability of the SX system and improving overall plant safety. In addition, plant risk is reduced by restoring the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 112SX001A valves will provide isolation defense in depth and improved isolation reliability.

The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.1 74, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.1 77, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," was reviewed for insights. The risk associated with the proposed changes was shown to be acceptable.

The attached request is subdivided as shown below. provides an evaluation of the proposed changes. includes the marked-up TS pages with the proposed changes indicated. includes the marked-up TS Bases pages with the proposed changes indicated.

The TS Bases pages are provided for information only and do not require NRC approval.

The regulatory commitments contained in this letter are summarized in Attachment 4. provides the supporting risk-informed evaluation of the requested change.

EGC requests approval of the proposed license amendment by April 10, 2010, to support implementation during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

Once approved, the amendment will be implemented within 30 days.

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004.

The proposed change has been reviewed by the Byron Station Plant Operations Review Committee and approved by the Nuclear Safety Review Board in accordance with the requirements of the EGC Quality Assurance Program.

September 24,2009 U.S. Nuclear Regulatory Commission Page 3 In accordance with 10 CFR 50.91, "Notice for public comment; State consultation," paragraph (b), EGC is notifying the State of Illinois of this application for license amendment by transmitting a copy of this letter and its attachments to the designated State Official.

Should you have any questions concerning this letter, please contact Ms. Lisa Schofield at (630) 657-281 5.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 24th day of September 2009.

Patrick R. Simpson Manager - Licensing U

Exelon Generation Company, LLC Attachments: : Evaluation of Proposed Changes : Proposed Technical Specifications Pages for Byron Station, Units 1 and 2 : Proposed Technical Specifications Bases Page for Byron Station, Units 1 and 2 : Summary of Regulatory Commitments : Risk-Informed Evaluation : Technical Adequacy : Uncertainty Assessment cc:

Regional Administrator - NRC Region Ill NRC Senior Resident Inspector - Byron Station

ATTACHMENT 1 Evaluation of Proposed Changes Page 1 of 18 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 Precedent 4.3 No Significant Hazards Consideration 4.4 Conclusions

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

ATTACHMENT 1 Evaluation of Proposed Changes Page 2 of 18 1.0

SUMMARY

DESCRIPTION In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC, (EGC) is requesting an amendment to Facility Operating License Nos. NPF-37 and NPF-66 for Byron Station, Units 1 and 2. This amendment request proposes a one-time extension of the Completion Time (CT) to restore a unit-specific SX train to operable status associated with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.7.8, "Essential Service Water (SX) System," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

2.0 DETAILED DESCRIPTION The current CT for Required Action A.1, associated with LCO 3.7.8, is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The proposed change increases, on a limited basis, the CT to restore an inoperable SX train from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . For Byron Station, the CT extension is planned to be invoked for Unit 1, while Unit 2 is in Mode 5, 6 or defueled, and remain applicable through the completion of the Unit 2 Refueling Outage 15. As such, a note is added to Condition A of TS 3.7.8 stating that the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT does not apply while Unit 2 is in Mode 5, 6, or is defueled, until the end of the stated refueling outage. Condition B is added to specify the limited use of the 144 hour0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months CT for the SX suction valve replacement under those conditions. The former Condition B is changed to Condition C and the former Condition C is renamed as Condition D. The proposed changes are shown on the marked-up Byron Station TS pages included as Attachment 2. In addition, an informational copy of the associated TS Bases page with marked-up changes is provided as. This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

The current TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 1/2SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SX001A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 1/2SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage (i.e., B2R15); however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction

ATTACHMENT 1 Evaluation of Proposed Changes Page 3 of 18 isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

Having the capability to securely isolate a single SX pump on a single unit will enable necessary system maintenance to be performed, thus restoring the reliability of the SX system and improving overall plant safety. In addition, plant risk is reduced by restoring the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

EGC requests approval of the proposed license amendment by April 10, 2010, to support implementation during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

Once approved, the amendment will be implemented within 30 days.

3.0 TECHNICAL EVALUATION

=

System Description===

The SX system is discussed in the Updated Final Safety Analysis Report (UFSAR), Section 9.2.1.2, "Essential Service Water System," (Reference 1).

The SX system provides a heat sink for the removal of process and operating heat from safety related components during a Design Basis Accident (DBA) or transient. During normal operation and a normal shutdown, the SX system also provides this function for various safety related and non-safety related components.

The unit-specific SX system consists of two separate, electrically independent, 100% capacity, safety related, cooling water trains. Each train consists of a 100% capacity pump, piping, valving, and instrumentation. Normally, the pumps and valves are remotely and manually aligned. However, the pumps are automatically started upon receipt of a safety injection signal or an undervoltage on the Engineered Safety Features (ESF) bus, and all essential valves are aligned to their post accident positions. The SX system is also the backup water supply to the auxiliary feedwater and fire protection systems.

The SX system includes provisions to crosstie the trains (i.e., train crosstie), as well as provisions to crosstie the units (i.e., unit crosstie). The unit crosstie valves (i.e., 1SX005 and 2SX005) must both be open to accomplish the unit crosstie. The system is normally aligned with the train crosstie valves open and the unit crosstie valves closed.

Each full-capacity SX system loop in each unit is supplied by a single pump rated at 24,000 gpm at 180 feet +/-10% total developed head. Actual system flow varies with system lineup and conditions. UFSAR Tables 9.2-1, "Essential Service Water Heat Loads," and Table 9.2-11, "Essential Service Water Component Nominal Design Flow Rates," list the components served and the nominal rated component flows. The pumps are located on the lowest level of the auxiliary building to ensure the availability of sufficient net positive suction head (NPSH).

Emergency power is available to each pump from its respective ESF bus as shown in UFSAR Table 8.3-5, "Loading on 4160-Volt ESF Buses," and described in UFSAR Section 8.3.1, "Onsite AC Power Systems." The suction supply is by one supply line running from each of the

ATTACHMENT 1 Evaluation of Proposed Changes Page 4 of 18 two redundant essential service mechanical draft cooling towers to the auxiliary building. Each supply line supplies one SX pump in each unit; each of the two pumps in a given unit takes its suction from a separate supply line. The system, therefore, meets the single-failure criterion as shown in the analysis in UFSAR Tables 9.2-2 "Single-Failure Analysis of the Essential Service Water System," and 9.2-16, "Single Failure Analysis of the Ultimate Heat Sink." Heat rejection from the SX system is to the SX cooling towers, both on a normal and on an emergency basis.

The discharges from each loop in each unit are separate and fed to two separate and redundant return lines for return to the towers. The two discharges from each unit and the two return lines to the towers are arranged similar to the intakes, i.e., the two discharges from each unit run into separate return lines, and each return line is fed from one discharge from each unit. The single failure criterion is met as shown in UFSAR Tables 9.2-2 and 9.2-16. The SX cooling towers are designed to accommodate the heat load from both units simultaneously under both normal and accident conditions. The SX cooling towers and their auxiliary systems are more fully discussed in UFSAR Section 9.2.5.

On May 5, 2008, a concern was identified by the NRC with respect to the single failure assumptions taken in the Byron ultimate heat sink (UHS) analysis. The specific concern was the Byron UHS analysis only considered single active breaker or switch failures that resulted in the failure of one SX cooling tower (SXCT) fan. Passive failures of the 4160 volt or 480 volt feed breakers which could de-energize the bus and result in the loss of two SXCT fans were not considered. EGC performed a revised analysis of the UHS to evaluate the impact of postulated passive electrical single failures. EGC determined that the results of the revised analysis could not be incorporated into the Byron Station design basis via requirements of 10 CFR 50.59, "Changes, tests, and experiments." Reference 2 is the license amendment request submitted to the NRC to resolve this concern. The proposed TS changes for LCO 3.7.8 being requested in this submittal are not dependent or linked to those requested in Reference 2.

Safety Analysis The design basis of the SX system is for one SX train, in conjunction with the Component Cooling (CC) system and a 100% capacity containment cooling system, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2, "Containment Systems." This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the reactor coolant system by the emergency core cooling system pumps. The SX system is designed to perform its function with a single failure of any active component, assuming the loss of offsite power.

The SX system, in conjunction with the CC system, also cools the unit from Residual Heat Removal (RHR) entry conditions, as discussed in the UFSAR, Section 5.4.7, (i.e., Reference 3) to Mode 5 during normal and post accident operations. The time required for this evolution is a function of the number of CC and RHR System trains that are operating. One SX train is sufficient to remove decay heat during subsequent operations in Modes 5 and 6.

Note that Generic Letter 91-13, "Request For Information Related to the Resolution of Generic Issue 130, 'Essential Service Water System Failures at Multi-Unit Sites,'" included risk-based recommendations for enhancing the availability of SX systems in the case of a loss of all SX to a particular unit. Crediting the opposite-unit SX system with an opposite-unit pump and the opposite-unit crosstie valves was part of the response to this Generic Letter.

ATTACHMENT 1 Evaluation of Proposed Changes Page 5 of 18 The unit-specific SX system satisfies 10 CFR 50.36, "Technical Specifications," paragraph (c)(2)(ii)(C), Criterion 3. The opposite-unit SX system satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii)(D).

System Functions The SX system has three primary functions:

provide cooling water to safety related equipment and equipment essential to the safe shutdown of the reactor during normal or accident conditions; provide backup source of water to the auxiliary feedwater pumps in the event the condensate storage tank (CST) is not available; and provide safety-related backup source of water to the fire protection system.

Need for Amendment As noted above, the current TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 1/2SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SX001A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 1/2SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window. The following contribute significantly to the overall duration of the work window associated with the SX valve replacement work activities: draining and refilling approximately one quarter million gallons of water; large bore pipe cutting and welding; and difficulties presented by the location of the valves to be replaced.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage (i.e., B2R15); however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004 (i.e., Reference 4). The license amendment was, in part to support, replacement of the 1A SX pump suction isolation valve (i.e., 1SX001A) which occurred in 2005. As noted above, the 1SX001A valve is degraded such that individual pump isolation for the 1A SX pump is not adequate to perform pump maintenance or downstream system component maintenance. As part of troubleshooting, the torque was measured at the valve shaft. The torque value was found to be excessively high which indicates that the valve has degraded bearings. A review of documents associated with

ATTACHMENT 1 Evaluation of Proposed Changes Page 6 of 18 the prior 1SX001A valve replacement, identified that the refurbished valve that replaced 1SX001A was not completely overhauled. The original scope of work was revised to machine the valve and leak test the valve seats. The top and bottom bearings and seal packing were not replaced. This issue has been entered into the EGC corrective action program. Also, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and therefore, could develop the same issue and should be replaced at the same time. The 1/2SX001B valves which were also replaced at the same time, were refurbished correctly and are operating properly with presently no identified need for replacement.

Risk Evaluation The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," was reviewed for insights.

In implementing risk-informed decisionmaking under RGs 1.174 and 1.177, TS changes are expected to meet a set of five key principles. These principles include consideration of both traditional engineering factors (e.g., defense in depth and safety margins) and risk information. provides the risk-informed evaluation of the proposed change in the SX CT that considers each one of these principles.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

The proposed change is consistent with the defense-in-depth philosophy.

The proposed change maintains sufficient safety margins.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

The impact of the proposed change should be monitored using performance measurement strategies.

The results of the risk evaluation are compared in Table 1 with the risk acceptance guidelines described in Attachment 5. The values for the Incremental Conditional Core Damage Probability (ICCDP) and the Incremental Conditional Large Early Release Probability (ICLERP) demonstrate that the proposed SX train Completion Time change has a small quantitative impact on plant risk. The results in Table 1 differ from those previously used to support the approval documented in Reference 4. The overall level of plant risk at the Byron Station has been substantially reduced since 2004. In 2004, the annual average core damage frequency (CDF) from internal events was 6E-5/yr. Currently, the annual average CDF from internal

ATTACHMENT 1 Evaluation of Proposed Changes Page 7 of 18 events is roughly a factor of three lower at 2E-5/yr. This reduction is the byproduct of improved plant performance and proactive implementation of improved procedures for addressing key risk contributors.

Table 1 Overall Results of Risk Evaluation for Byron Station - Unit 1 Risk Metric Results Risk Metric Risk Acceptance Guideline Internal Events1 Internal Fire2 Seismic and Other External ICCDP

< 1E-6 1E-7 9E-7 Negligible ICLERP

< 1E-7 3E-9 Negligible Negligible CDFBaseline

< 1E-4/yr 2E-5/yr 5E-5/yr

~1E-5/yr CDFSX CT Configuration

< 1E-3/yr 3E-5/yr 1E-4/yr

~1E-5/yr Note 1: Internal events include contribution from internal flooding.

Note 2: The internal fire results contain conservatisms that make the fire results incomparable to the internal events results. They are shown here simply to illustrate that even if they are added, the acceptance guidelines are not exceeded.

Table 2 provides a summary of the approach and results of the evaluation of each of the potential risk contributors. These analyses demonstrate that the risk impact of the proposed one-time extension of the SX CT is small and below the acceptance guidelines.

ATTACHMENT 1 Evaluation of Proposed Changes Page 8 of 18 Table 2 Summary of Risk Insights for SX CT Extension RISK CONTRIBUTOR APPROACH INSIGHTS Internal Events Quantify ICCDP & ICLERP for Planned Configuration, Including Compensatory Measures:

ICCDP < 1E-6 ICLERP < 1E-7 Baseline CDF < 1E-4/yr Configuration specific CDF

< 1E-3/yr Compensatory Measures Keep Risk Well Within Acceptance Guidelines Internal Fire Qualitatively and Quantitatively Evaluated:

Identify fire scenarios impacted by configuration Estimate fire risk impacts due to configuration and quantify delta-CDF Confirm Availability of Success Path for Every Scenario Identify Compensatory Measures Every Fire Scenario Has At Least One Success Path Internal Events Compensatory Measures Apply to Fire Scenarios New Fire-Related Compensatory Measures Identified Compensatory Measures Keep Risk Well Within Acceptance Guidelines Seismic Qualitatively Identify Key Seismic Risk Impacts for Planned Configuration Evaluate Impact on Seismic-related Key Functions of SX Seismic Risk Impacts Negligible Other External Hazards Qualitatively Evaluate Each Hazard to Identify Unique Challenges No Unique Challenges Identified Overall At-Power Risks No Evidence Quantitative Guidelines Will Be Challenged Key Compensatory Measures Identified to Minimize Risk Risk at Unit in Shutdown Qualitatively Evaluate Impact of SX Configuration on Unit in Shutdown Identify Compensatory Measures Consistent With Shutdown Safety Program Reduction in SX Redundancy Leads to Some Increase in Risk at Shutdown Unit Since SX Transfers Heat to the Ultimate Heat Sink Compensatory Actions At Unit in Shutdown Consistent With Outage Safety Program

ATTACHMENT 1 Evaluation of Proposed Changes Page 9 of 18 The risk-informed evaluation identified a number of compensatory measures that will be implemented during the planned SX configuration to assure the risk impacts are acceptably low.

These are discussed in detail in Attachment 5 and summarized in Table 3. Table 3 also provides details on how these compensatory measures are applied during the maintenance evolution. The compensatory measures in Table 3 are considered to be regulatory commitments and are summarized in Attachment 4.

Credit for dedicated operators to maintain and respond to SX-related problems is recognized as a key compensatory measure. Implementation of this measure will consist of the assignment of dedicated operators inside and outside the control room to back up the nominal staff for these actions. These personnel represent additional operators (i.e., one Senior Reactor Operator (SRO) in the control room, one Reactor Operator (RO) and one Equipment Operator) assigned to monitor SX performance and take the identified actions, if required, as a back up to the nominal shift staff. The only duties assigned to these dedicated operators will be those associated with the actions identified in the risk assessment credited to reduce the risk impact.

The dedicated operators will receive training on their assignments as part of the preparations related to this compensatory measure. Also, there is significant margin between the time available and the time required for the operator actions to be completed. Additional details concerning the use of dedicated operators are described in Attachment 5.

ATTACHMENT 1 Evaluation of Proposed Changes Page 10 of 18 Table 3 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Comments Compensatory Measure Internal Events Fire Shutdown Unit 0 CC Heat Exchanger X

X Unit 2 CC Heat Exchanger X

X Unit 1 CC Heat Exchanger X

X 1SX005 (crosstie MOV)

X 2SX005 (crosstie MOV)

X 1B SX Pump X

X Monitor pump for fire precursor indicators 2B SX Pump X

X X

Monitor pump for fire precursor indicators 1A AF Pump X

1B AF Pump X

2A AF Pump X

Unit 1 SATs X

Unit 2 SATs X

X 4KV Bus 141 X

4KV Bus 142 X

X Minimize or preclude breaker switching operations, especially for offsite power supply breakers 4KV Bus 241 X

4KV Bus 242 X

X Switchyard X

Minimize or preclude breaker switching operations, especially for offsite power supply breakers 1A EDG X

1B EDG X

2A EDG X

2B EDG X

X DC Battery & Charger 111 X

DC Battery & Charger 112 X

DC Battery & Charger 211 X

DC Battery & Charger 212 X

X 2A CV or 2A SI pump OR 2B CV or 2B SI Pump X

2A or 2B RH Pump X

2B CC Pump X

1SX033/1SX034 X

2SX033/2SX034 X

X VA Supply Plenum X

VA Exhaust Plenum X

0A Fire Pump X

0B Fire Pump X

1A CV Pump Alt Cooling X

1B CV Pump Alt Cooling X

Protected Equipment Unit 1 120 VAC Inst Inverters X

ATTACHMENT 1 Evaluation of Proposed Changes Page 11 of 18 Table 3 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Comments Compensatory Measure Internal Events Fire Shutdown Unit 1 SI signals X

Prohibit surveillance testing on SSPS/ESFAS SI logic Fuel Pool Cooling - 1 train available X

Isolate one train of Unit 2 RCFCs X

Improves effectiveness of SX Unit Crosstie 1SX005 (or 2SX005) Open X

Improves effectiveness of SX Unit Crosstie Equipment Alignment Changes Unit 1 CST Filled to 350,000 gallons X

"Dedicated SX" operators X

Improves response to loss of remaining SX Pumps Not performed during reduced inventory or high decay heat levels X

11.1B-0 X

Prior to entrance into the SX completion time 11.3-0 X

Prior to entrance into the SX completion time 11.3-1 X

Prior to entrance into the SX completion time 11.4-0 X

Prior to entrance into the SX completion time 11.6-0 X

Prior to entrance into the SX completion time 11.6-1 X

Prior to entrance into the SX completion time 5.1-1 X

Prior to entrance into the SX completion time 5.2-1 X

Prior to entrance into the SX completion time Fire Zone walk down for transient control 5.5-1 X

Prior to entrance into the SX completion time Overall Conclusion The proposed changes have been evaluated consistent with the key principles identified in RG 1.174 for risk-informed changes to the licensing basis and demonstrated that the risk from the proposed changes is acceptably small. The evaluation with respect to these principles is summarized below.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

This change is being requested as a change to the operating license for Byron Station.

ATTACHMENT 1 Evaluation of Proposed Changes Page 12 of 18 The proposed change is consistent with the defense-in-depth philosophy.

The configuration to be entered decreases the redundancy of the SX system due to the removal of two of the four SX pumps from service simultaneously during the CT required to replace the 1/2SX001A valves. The reduced redundancy increases the potential for the plant to lose SX cooling to plant equipment; however, the current plant design and supporting analyses demonstrate that the plant has more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis.

Defense-in-depth is maintained during the configuration. Compensatory measures are identified to strengthen the level of defense-in-depth and reduce overall risk. The functions necessary to maintain fuel, reactor coolant pressure boundary, and containment integrity are provided consistent with the plant's design basis; thus maintaining traditional defense-in-depth barriers.

The proposed change maintains sufficient safety margins.

The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following.

Codes and standards (e.g., American Society of Mechanical Engineers (ASME), Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved for use by the NRC). The proposed change is not in conflict with approved codes and standards relevant to the SX system.

While in the proposed configuration, safety analysis acceptance criteria in the UFSAR are met, assuming there are no additional failures. The plant has more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis. Specifically, two capabilities with respect to the SX system are credited in the risk analysis but are not credited in the licensing basis. The first is the capability of a single SX pump to provide cooling to loads of both units. The second is the capability to provide cooling from the fire protection system to the CV charging pumps.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

A risk evaluation was performed that considers the impact of the proposed change with respect to the risks due to internal events, internal fires, seismic events and other external hazards. The evaluation of the quantitative impacts of internal event risks due to the planned configuration demonstrate that the impact on the likelihood of core damage and large early release is well below the risk acceptance guideline. The fire evaluation determined that the impact on the likelihood of fire-related core damage is also below the risk acceptance guideline. In addition, compensatory measures have been identified that further reduce the risk of the significant fire scenarios. The risk associated with seismic events and other external hazards are either not impacted by the change or are bounded by the risk from internal events. In addition, although not required, the risk implications of the proposed change were qualitatively evaluated for the unit that will be shutdown during the evolution, consistent with EGCs risk management practices.

ATTACHMENT 1 Evaluation of Proposed Changes Page 13 of 18 The performance of the planned maintenance has a long-term safety benefit to the Byron Station due to an improved reliability to isolate large SX floods using the new isolation valve.

This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

The impact of the proposed change should be monitored using performance measurement strategies.

EGCs configuration risk management program will effectively monitor the risk of emergent conditions during the period of time that the proposed change is in effect. This will ensure that any additional risk increase due to emergent conditions is appropriately managed.

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria The design of the unit-specific SX system must satisfy the requirements of 10 CFR 50.36, "Technical Specifications," paragraph (c)(2)(ii)(C), Criterion 3; and the design of the opposite-unit SX system must satisfy the requirements of 10 CFR 50.36, paragraph (c)(2)(ii)(D), Criterion 4. These requirements state the following:

(ii) A technical specification limiting condition for operation of a nuclear reactor must be established for each item meeting one or more of the following criteria:

(C) Criterion 3. A structure, system, or component that is part of the primary success path and which functions or actuates to mitigate a design basis accident or transient that either assumes the failure of or presents a challenge to the integrity of a fission product barrier.

(D) Criterion 4. A structure, system, or component which operating experience or probabilistic risk assessment has shown to be significant to public health and safety.

The design basis of the SX system is described in the UFSAR, Section 9.2.1.2, "Essential Service Water System."

4.2 Precedent The impact on previous risk-informed submittals is summarized below.

Emergency Diesel Generator (EDG) Extended Completion Time The EDG CT was extended from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 14 days. A significant compensatory measure required to enter the extended EDG CT is to verify that all four SX pumps are operable. Although, two of the four SX pumps will be inoperable during the SX valve replacement, all EDGs will be protected equipment and available during the SX one-time CT extension. Therefore, there

ATTACHMENT 1 Evaluation of Proposed Changes Page 14 of 18 is no impact on the risk analysis or the conclusions of the analysis supporting the EDG CT.

Risk-informed Inservice Inspection (ISI)

Byron Station utilizes a Risk-informed ISI program. Operating with an SX train in maintenance for up to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months has no impact on the insights or conclusions from those analyses.

120 VAC Inverter Completion Time As a compensatory measure, no planned maintenance will be allowed on the operating unit 120 VAC inverters (specifically 111 and 114) during the SX extended CT; therefore, there will be no impact on the inverter extended CT.

ILRT Interval Extension Operating with an SX train in maintenance for up to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months has no impact on the insights or conclusions from those analyses that supported the license amendment related to extending the ILRT interval since an ILRT is not scheduled for performance while the unit is at power.

RTS/ESFAS The NRC approved the extensions of the RTS/ESFAS Completion Time, Bypass Test Times, and Surveillance Test Intervals for Byron Station. As a compensatory measure, no planned maintenance will be allowed on the operating unit that would render either the "A" or "B" Train SI signal unavailable during the SX pump extended CT; therefore, there will be little impact on the TS changes related to RTS/ESFAS CT or surveillance frequency extensions.

The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004.

4.3 No Significant Hazards Consideration In accordance with 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit," Exelon Generation Company, LLC, (EGC) is requesting an amendment to Facility Operating License Nos. NPF-37 and NPF-66 for Byron Station, Units 1 and 2. This amendment request proposes a one-time extension of the Completion Time (CT) to restore a unit-specific SX train to operable status associated with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.7.8, "Essential Service Water (SX) System," from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This proposed change will only be used one time during the Byron Station Unit 2 spring 2010 refueling outage (i.e., B2R15).

The current TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the "A" and "B" trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace two of the four SX pump suction isolation valves (i.e., 1/2SX001A) used for pump isolation from the SX water supply. Currently, the refurbished 1SX001A valve has degraded bearings which impacts its isolation function for the 1A SX pump impeding performance of pump or downstream system component maintenance. In addition, the 2SX001A valve was refurbished in the same manner as the 1SX001A valve, and

ATTACHMENT 1 Evaluation of Proposed Changes Page 15 of 18 therefore, could develop the same issue. In order to replace these suction isolation valves, the common upstream suction line for the 1A and 2A SX pumps must be isolated and the suction header drained. After draining the common suction header, both suction isolation valves (i.e., 1/2SX001A) will be replaced. This evolution is time consuming and maintenance history has shown that replacement of the SX pump suction isolation valves cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX pump suction isolation valves will be conducted during a refueling outage; however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps results in putting the operating unit in a Condition with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT. Consequently, not being able to complete the suction isolation valve replacement in the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in the operating unit also being shutdown or not completing the required work to improve the material condition of the plant.

Having the capability to securely isolate a single SX pump on a single unit will enable necessary system maintenance to be performed, thus restoring the reliability of the SX system and improving overall plant safety. In addition, plant risk is reduced by restoring the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum, the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," was reviewed for insights. The risk associated with the proposed changes was shown to be acceptable.

EGC has evaluated for Byron Station whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

Criteria

1.

Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed changes have been evaluated using the risk-informed processes described in Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-

ATTACHMENT 1 Evaluation of Proposed Changes Page 16 of 18 Specific, Risk-Informed Decisionmaking: Technical Specifications," dated August 1998. In addition, proposed revised guidance as described in Draft Regulatory Guide DG-1226, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," and Draft Regulatory Guide DG-1227, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," was reviewed for insights. The risk associated with the proposed changes was shown to be acceptable.

The previously analyzed accidents are initiated by the failure of plant structures, systems, or components. The SX system is not considered an initiator for any of these previously analyzed events. The proposed change does not have a detrimental impact on the integrity of any plant structure, system, or component that initiates an analyzed event. No active or passive failure mechanisms that could lead to an accident are affected. The proposed change will not alter the operation of, or otherwise increase the failure probability of any plant equipment that initiates an analyzed accident. Therefore, the proposed change does not involve a significant increase in the probability of an accident previously evaluated.

The unit-specific SX system consists of two separate, electrically independent, 100% capacity, safety related, cooling water trains. Each train consists of a 100% capacity pump, piping, valving, and instrumentation. Normally, the pumps and valves are remotely and manually aligned. However, the pumps are automatically started upon receipt of a safety injection signal or an undervoltage on the engineered safety features (ESF) bus, and all essential valves are aligned to their post accident positions. The SX system is also the backup water supply to the auxiliary feedwater system and fire protection system.

The design basis of the SX system is for one SX train, in conjunction with the component cooling water (CC) system and a 100% capacity containment cooling system, to remove core decay heat following a design basis LOCA as discussed in the UFSAR, Section 6.2, "Containment Systems." This prevents the containment sump fluid from increasing in temperature during the recirculation phase following a LOCA and provides for a gradual reduction in the temperature of this fluid as it is supplied to the reactor coolant system by the emergency core cooling system pumps. The SX system is designed to perform its function with a single failure of any active component, assuming the loss of offsite power. The proposed one-time increase in the CT is consistent with the philosophy of the current Technical Specification LCO which allows one train of SX to be inoperable for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This change only extends the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months which has been shown to be acceptable from a risk perspective; therefore, the proposed change does not involve a significant increase in the consequences of an accident previously evaluated.

ATTACHMENT 1 Evaluation of Proposed Changes Page 17 of 18

2.

Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed changes do not involve the use or installation of new equipment and the currently installed equipment will not be operated in a new or different manner. No new or different system interactions are created and no new processes are introduced. The proposed changes will not introduce any new failure mechanisms, malfunctions, or accident initiators not already considered in the design and licensing bases. Based on this evaluation, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3.

Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change does not alter any existing setpoints at which protective actions are initiated and no new setpoints or protective actions are introduced.

The design and operation of the SX system remains unchanged. The risk associated with the proposed increase in the time an SX pump is allowed to be inoperable was evaluated using the risk-informed processes described in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," dated July 1998 and RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications," dated August 1998. The risk was shown to be acceptable. Based on this evaluation, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, EGC concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

4.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

EGC has evaluated the proposed amendment for environmental considerations. The review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, and would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant

ATTACHMENT 1 Evaluation of Proposed Changes Page 18 of 18 change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

1. Byron/Braidwood Stations Updated Final Safety Analysis Report, Section 9.2.1.2, "Essential Service Water System"

2. Letter from Patrick R. Simpson (Exelon Generation Company, LLC) to NRC, "License Amendment Regarding Ultimate Heat Sink," dated June 30, 2009

3. Byron/Braidwood Stations Updated Final Safety Analysis Report, Section 5.4.7, "Essential Service Water System"

4. Letter from G. F. Dick (U.S. Nuclear Regulatory Commission) to C. M. Crane (Exelon Generation Company, LLC), "Issuance of Amendments RE: One-Time Change to the Completion Time for Restoration of a Unit Specific Essential Service Water Train (TAC Nos. MB9547, MB9548, MB9545, and MB9546)," dated March 18, 2004

ATTACHMENT 2 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455 Proposed Technical Specifications Pages for Byron Station, Units 1 and 2 3.7.8-1 3.7.8-2

SX System 3.7.8 BYRON UNITS 1 & 2 3.7.8 1 Amendment 165 3.7 PLANT SYSTEMS 3.7.8 Essential Service Water (SX) System LCO 3.7.8 The following SX trains shall be OPERABLE:

a. Two unit-specific SX trains; and

b. One opposite-unit SX train for unit-specific support.

APPLICABILITY:

MODES 1, 2, 3, and 4.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One unit-specific SX train inoperable.

A.1

NOTES--------

1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," for Emergency Diesel Generator made inoperable by SX.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," for Residual Heat Removal loops made inoperable by SX.

Restore unit-specific SX train to OPERABLE status.

72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (continued)

NOTE--------

Not applicable to Unit 1 during replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15 while Unit 2 is in MODE 5, 6, or defueled.

SX System 3.7.8 BYRON UNITS 1 & 2 3.7.8 2 Amendment 165 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. Opposite-unit SX train inoperable.

B.1 Restore opposite-unit SX train to OPERABLE status.

7 days C. Required Action and associated Completion Time of Condition A or B not met.

C.1 Be in MODE 3.

AND C.2 Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours C

C D

,B INSERT C

D

SX System TS 3.7.8 INSERTS INSERT ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B. --------NOTE--------

Only applicable to Unit 1 during replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15 while Unit 2 is in MODE 5, 6, or defueled.

One unit-specific SX train inoperable.

B.1

NOTES--------

1. Enter applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," for Emergency Diesel Generator made inoperable by SX.

2. Enter applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," for Residual Heat Removal loops made inoperable by SX.

Restore unit-specific SX train to OPERABLE status.

144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months

ATTACHMENT 3 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455 Proposed Technical Specifications Bases Page for Byron Station, Units 1 and 2 B 3.7.8-4

SX System B 3.7.8 BYRON UNITS 1 & 2 B 3.7.8 4 Revision 68 BASES ACTIONS A.1 If one unit-specific SX train is inoperable, action must be taken to restore OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE SX train is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE SX train could result in loss of the SX System function in the short term. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant capabilities afforded by the OPERABLE train, and the low probability of a DBA occurring during this time period.

Required Action A.1 is modified by two Notes. The first Note indicates that the applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources-Operating," should be entered if an inoperable SX train results in an inoperable emergency diesel generator. The second Note indicates that the applicable Conditions and Required Actions of LCO 3.4.6, "RCS Loops-MODE 4," should be entered if an inoperable SX train results in an inoperable decay heat removal train.

These are exceptions to LCO 3.0.6 and ensure the proper actions are taken for these components.

B.1 If the opposite-unit SX train is not OPERABLE for unit-specific support, action must be taken to restore OPERABLE status within 7 days. In this Condition, if a complete loss of unit-specific SX were to occur, the SX System function would be lost. The 7 day Completion Time is based on the capabilities of the unit-specific SX System and the low probability of a DBA with a loss of all unit-specific SX occurring during this time period.

C.1 and C.2 If the unit-specific SX train or the opposite-unit SX train cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging plant systems.

INSERT 1 INSERT 2 C.1 D.1 and D.2

SX System B 3.7.8 INSERTS INSERT 1 Condition A is modified by a Note. The Note indicates that this Condition is not applicable to Unit 1 during replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15 while Unit 2 is in MODE 5, 6, or defueled.

INSERT 2 B.1 During replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15, if one unit-specific SX train is inoperable, action must be taken to restore OPERABLE status within 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This Completion Time is based upon a risk-informed assessment that concluded that the associated risk with the units in the specified configuration is acceptable.

Condition B is modified by a Note. The Note indicates that this Condition is only applicable to Unit 1 during replacement of the SX suction isolation valves (i.e., 1SX001A and 2SX001A) during Unit 2 Refueling 15 while Unit 2 is in MODE 5, 6, or defueled.

Required Action B.1 is modified by two Notes as described in Action A.1 above.

ATTACHMENT 4 Summary of Regulatory Commitments The following table identifies commitments made in this document. (Any other actions discussed in the submittal represent intended or planned actions. They are described to the NRC for the NRC's information and are not regulatory commitments.)

COMMITMENT TYPE COMMITMENT COMMITTED DATE OR "OUTAGE" ONE-TIME ACTION (YES/NO)

PROGRAM-MATIC (YES/NO)

Implement the compensatory measures listed in Attachment 1 of RS-09-121, Table 3, "Byron SX A Train Outage Summary of Compensatory Measures" Upon implementation of the one-time extension of the SX train Completion Time.

Yes No

ATTACHMENT 5 Risk-Informed Evaluation

Page 1 of 52

1.0 BACKGROUND

The current Byron TS LCO 3.7.8.a requires that two unit-specific SX trains (i.e., the A and B trains) be operable in Modes 1, 2, 3, and 4. Condition A allows one unit-specific SX train to be inoperable with a Completion Time (CT) of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . An extension of the CT to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months is needed to replace the SX pump suction valves used for pump isolation from the SX water supply. Currently the suction isolation valves for the 1A and 2A SX pumps at Byron Station are degrading such that individual pump isolation on a specific unit may not be adequate to perform pump maintenance or downstream system component maintenance. In order to perform SX pump maintenance or downstream system component maintenance, the common upstream suction isolation valve for the 1A and 2A SX pumps must be closed and the suction header drained. This evolution is time consuming and maintenance history has shown that completion of the needed SX suction isolation valve replacement cannot be assured within the existing 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT window.

Replacement of the SX suction isolation valves will be conducted during a refueling outage; however, due to the system configuration of the SX system, closing the common suction isolation valve for the 1A and 2A SX pumps, results in putting the operating unit in a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO. Consequently, not completing the suction isolation valve replacement in the 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months CT would result in either a dual unit shutdown or not completing the required work to improve the material condition of the plant. As such, the temporary TS change is being requested to improve operational safety by reducing the plant risk by increasing the reliability of the suction isolation valves, which are important for isolation of potential SX flood scenarios.

The performance of the planned maintenance has a long-term safety benefit to the Byron Station due to an improved reliability to isolate large SX floods using the new isolation valve. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

Page 2 of 52 The NRC has previously approved a similar change for the Braidwood and Byron Stations in Amendment Nos. 130 and 136, respectively, issued March 18, 2004. It is worthy of note that the overall level of plant risk at Byron has been substantially reduced since that time. In 2004, the annual average core damage frequency (CDF) from internal events was 6E-5/yr. Today, the Byron annual average core damage frequency (CDF) from internal events is roughly a factor of three lower at 2E-5/yr. This reduction is the byproduct of improved plant performance and proactive implementation of improved procedures for addressing key risk contributors.

The preparation of this analysis is performed in accordance with the requirements of the Exelon Risk Management process as defined in the Technical and Reference Manual (T&RM) guidance documents:

ER-AA-600-1012, Rev. 8, Risk Management Documentation (Reference 1)

ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR (Reference 2)

2.0 TECHNICAL ANALYSIS

The proposed changes have been evaluated using the risk informed processes described in Regulatory Guide (RG) 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, dated July 1998 (Reference 5) and RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, dated August 1998 (Reference 4).

In implementing risk-informed decision-making under the NRCs RGs 1.174 and 1.177, technical specification changes are expected to meet a set of five key principles. These principles include consideration of both traditional engineering factors (e.g., defense in depth and safety margins) and risk information. This section provides a summary of the technical analysis of the proposed change in SX CT that considers each one of these principles:

Page 3 of 52

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

This change is being requested as a change to the operating license for Byron Station.

The proposed change is consistent with the defense-in-depth philosophy.

The defense-in-depth philosophy is maintained, as summarized in Section 2.1.

The proposed change maintains sufficient safety margins.

Safety margin is not impacted by the proposed change as summarized in Section 2.2.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

A risk evaluation is presented in Section 2.3 that considers the impact of the proposed change with respect to the risks due to:

- internal events,

- internal fires,

- seismic events, and

- other external hazards.

The quantitative acceptance guidelines are discussed in Section 2.3.1.1.

In addition, although not required, the risk implications of the proposed SX CT are also qualitatively evaluated for the unit that will be shutdown during the evolution, consistent with Exelons risk management practices.

Page 4 of 52

The impact of the proposed change should be monitored using performance measurement strategies.

The three-tiered implementation approach consistent with RG 1.177 is used, as described in Section 2.3.

2.1 DEFENSE IN DEPTH EVALUATION The configuration to be entered decreases the redundancy of the Essential Service Water (SX) system due to the removal of two of the four SX pumps from service simultaneously. The reduced redundancy increases the potential for the plant to lose SX cooling to plant equipment. However, the current plant design and supporting analyses demonstrate that the plant has much more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis.

There are two capabilities with respect to the essential service water (SX) system that are credited in the risk analysis but are not credited in the licensing basis.

The first is the capability of a single SX pump to provide cooling to loads of both units. A best estimate flow analysis has shown that a single pump can provide cooling to all loads on both units with the exception of the Reactor Containment Fan Coolers (RCFC) and Emergency Diesel Generators (EDGs) on the unit without an SX pump and one train of RCFCs on the unit with an available SX pump. This analysis was performed assuming that the available SX pump is being cross-tied to the other unit to either maintain cooling to that unit while it is shutting down or responding to an accident condition. This crosstie is accomplished by opening the l/2SX005 valves (a remote action from the control room). These valves are Seismic Category I and Safety Related. As described later in this evaluation, one of the actions for a dedicated operator during the proposed SX CT is to validate that one of the SX005 valves is maintained in the open position to support an assumption in the risk assessment.

Page 5 of 52

The second capability credited in the risk analysis is the ability to provide cooling from the Fire Protection (FP) system to the Chemical and Volume Control (CV) centrifugal charging pumps. This capability is used to ensure that Reactor Coolant Pump (RCP) seal injection remains available in the event of an extended loss of SX. With the exception of the valves and fittings on the CV pump oil cooler, this connection is neither Seismic Category I nor Safety Related; however, its use is not credited for either seismic events or to mitigate a Loss of Coolant Accident (LOCA). In order to assure that these capabilities will be available during the planned evolution, the equipment associated with both the SX crosstie and the FP connection to the CV pumps will be considered Protected Equipment while the plant invokes the one-time extension to the CT of TS 3.7.8, Condition A. In addition, while invoking the one-time extension to the CT of Condition A, dedicated control room operators and shiftly briefings will supplement routine training on these actions performed as part of Licensed Operator Requalification Training. This increases the likelihood of performing the necessary actions successfully, if they are required.

The evaluation of defense in depth considerations for this proposed change considered the impact of the proposed configuration on the ability of the SX system to perform its intended functions and addresses the defense in depth considerations identified in RG 1.174.

The conclusion of this evaluation is that the one-time entrance into this configuration maintains the principles of defense-in-depth.

2.1.1 FUNCTIONAL ASSESSMENT Current Licensing Basis The current licensing basis for SX operation relies upon one SX pump providing adequate flow to important loads at that unit. In the event of loss of the operating SX

Page 6 of 52 pump, the second pump could be manually started to restore flow. In the event the second pump is unavailable, the opposite-unit crosstie could be opened to provide flow from the two pumps at the opposite unit. These features are controlled by plant technical specifications.

Best Estimate Analysis A best estimate SX flow analysis was completed which demonstrates that one SX pump from either unit is capable of supporting shutdown loads of both units (with the exception of the reactor containment fan coolers (RCFCs) and emergency diesel generators (EDGs)). Thus, the first line of defense is the second pump at the unit, followed by the inter-unit crosstie; however, only one of the two SX pumps from the opposite unit is required to operate.

In addition, Byron Station has installed a modification to allow fire protection cooling to the CV Pumps in order to provide a continued flow of seal injection to the RCP seals in the event of loss of all SX. This capability, combined with the capability of the diesel-driven auxiliary feedwater pump and the startup and motor driven main feedwater pumps to operate without SX flow, allows the plant to maintain a hot standby condition in the event of loss of all SX.

SX LCO Configuration The proposed configuration considered in the CT extension involves having one of the SX pumps for each unit out of service simultaneously. This configuration eliminates the capability to start the second SX pump, but does not prevent the use of the opposite-unit crosstie or maintaining hot standby in the event all SX is lost.

Thus, while the level of redundancy is somewhat reduced in the proposed configuration, the plant retains a substantial defense-in-depth capability, beyond that considered in the current licensing basis.

Page 7 of 52 Table 1 provides a comparison of the licensing basis related to preventing and mitigating a loss of SX and the best estimate analysis. In addition, these are compared to the plant capability in the proposed configuration.

2.1.2 REGULATORY GUIDE 1.174 CONSIDERATIONS RG 1.174 provides additional guidance on how defense in depth should be evaluated.

These are evaluated in Table 2 for the planned SX configuration.

Page 8 of 52 Table 1 Defense-in-Depth Assessment of Planned SX Configuration Basis of Evaluation Restore Unit SX Opposite-Unit Crosstie Supply SX From Other Unit Maintain Hot Standby With Loss of SX Licensing Basis Start 2nd Unit SX Pump Open X-tie Valves 2 of 2 Pumps Required from Other Unit N/A Best Estimate Analysis Start 2nd Unit SX Pump Open X-tie Valves 1 of 2 Pumps Required from Other Unit

Provide FP Cooling to CV Pump for RCP Seal Cooling

DDAFW Pump or Main Feedwater Provides Heat Removal SX LCO Configuration N/A Open X-tie Valves 1 of 1 Pumps Required from Other Unit

Provide FP Cooling to CV Pump for RCP Seal Cooling

DDAFW Pump or Main Feedwater Provides Heat Removal

Page 9 of 52 Table 2 Consideration of RG 1.174 Defense-in-Depth Guidelines Guideline Evaluation A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

No new challenge to core damage, containment failure, or consequence mitigation is introduced by this one-time change.

Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

The plant design is not being changed. Some compensatory measures have been identified to maintain low risk, but these measures are consistent with normal plant practices.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

The risk analysis addresses this issue directly.

However, Table 1 provides a summary of the redundancy and diversity of success paths. This analysis demonstrates that substantial defense-in-depth is maintained.

Defenses against potential common cause failures are preserved, and the potential for the introduction of new common cause failure mechanisms is assessed.

No new common cause mechanisms are introduced by this change. Where defenses against potential common cause failures were impacted, additional compensatory measures have been identified to mitigate the impact.

Independence of barriers is not degraded.

This change has no impact on the independence of barriers.

Defenses against human errors are preserved.

This change has no impact on the defense against human errors, as there are no new operator actions required when operating with an SX pump on each unit inoperable. The compensatory measures put in place are intended to improve defenses against human errors. The likelihood of requiring operator actions to respond to a loss of SX on a unit is increased. The risk assessment recognizes this and establishes compensatory measures designed to decrease the potential for human error if these actions are required.

The intent of the General Design Criteria in Appendix A to 10 CFR Part 50 is maintained.

This change does not impact the GDC.

Page 10 of 52 2.2 SAFETY MARGIN EVALUATION The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following:

Codes and standards (e.g., American Society of Mechanical Engineers (ASME),

Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved for use by the NRC) are met. The proposed change is not in conflict with approved codes and standards relevant to the SX system.

While in the proposed configuration, safety analysis acceptance criteria in the UFSAR are met, assuming there are no additional failures.

This is consistent with the guidelines provided in RG 1.177 for risk-informed changes to technical specifications.

2.3 RISK EVALUATION The risk impact of the proposed changes has been evaluated and found to be acceptable. The effect on risk of the proposed increase in Completion Time for restoring an inoperable SX Train has been evaluated using the NRC three-tier approach suggested in RG 1.177 (Reference 4). Although RG 1.177 is primarily intended for permanent changes to plant technical specifications, the general framework of considerations is considered applicable:

Tier 1 - Probabilistic Risk Assessment (PRA) Capability and Insights Tier 2 - Avoidance of Risk-Significant Plant Configurations Tier 3 - Risk-Informed Configuration Risk Management

Page 11 of 52 2.3.1 TIER 1: PRA CAPABILITY AND INSIGHTS Risk-informed support for the proposed change is based on PRA calculations performed to quantify the Incremental Conditional Core Damage Probability (ICCDP) and the Incremental Conditional Large Early Release Probability (ICLERP) resulting from the increased Completion Time for the SX train. These ICCDP and ICLERP values are also equivalent to the increase in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the year as Unit 1 will only enter the extended Completion Time once. However, since this is a one-time change it does not result in a permanent increase in CDF or LERF (i.e., CDF or LERF).

Updating and maintenance of the Byron Station PRA is controlled under Exelon Nuclear Engineering Procedure, ER-AA-600, Risk Management (Reference 16). The Byron Station PRA was recently updated in accordance with this procedure and associated guidance. The PRA addresses internal events at full power, including internal flooding.

Other risk sources and operating modes are discussed qualitatively below, except for the internal fire which is quantitatively evaluated as discussed below. This and prior model updates have incorporated recent advances in PRA technology across elements of the PRA, and have maintained a special effort to ensure that those aspects of the PRA that are potentially sensitive to changes in SX system reliability, including SX pump maintenance unavailability are adequate to evaluate the risk impacts of the increased SX Completion Time. These aspects include:

the impact of maintenance unavailability on the loss of SX initiating event frequencies, including the conditions considered in this analysis;

treatment of the SX unit and train crosstie capability;

use of plant specific data; and

operator interviews to validate appropriate characterization of operator actions available to mitigate a loss of SX initiating event.

The focus on SX modeling in the PRA, as noted above, has been maintained since the PRA was applied in support of a prior temporary SX Completion Time increase in support of SX Pump repair.

Page 12 of 52 The Byron Station LERF model uses a realistic, plant-specific model that is an extension of the methodology described in NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, October 2004 (Reference 18). This model supports a realistic quantification of LERF based on:

plant damage states that reflect the appropriate plant conditions at the time of core damage,

containment isolation failures based on plant-specific system models,

plant-specific analysis of containment bypass sequences (e.g., interfacing system LOCA and steam generator tube rupture (SGTR))

realistic, plant-specific assessment of unit-specific containment ultimate pressure capability,

important severe accident phenomena including high pressure melt ejection and induced steam generator tube rupture, and

plant-specific thermal hydraulic analyses reflecting the severe accident conditions expected to be present.

The scope, level of detail, and technical capability of the Byron Station PRA are sufficient to support a technically defensible and realistic evaluation of the risk change from this proposed Completion Time extension.

An independent assessment of the Byron Stations internal event PRA, using the self-assessment process developed as part of the Westinghouse Owners Group (WOG)

PRA Peer Review Certification Program, was conducted by a recognized industry expert. This independent review was performed from May through July of 1999 to evaluate the quality of the PRAs and completeness of the PRA documentation.

Substantive comments and observations generated by this assessment, including those focused on the risk elements that are needed to evaluate the proposed Completion Time extension, have been addressed. Peer review of the Byron Station PRA was performed in July 2000. A team of independent PRA experts from U.S. nuclear utility PRA groups and PRA consultant organizations carried out these peer reviews. The

Page 13 of 52 intensive peer reviews involved approximately two person-months of engineering effort by the review team and provided a comprehensive assessment of the strengths and limitations of each element of the PRA. All of the findings and observations from these assessments that the review team indicated were important and those that involved risk elements needed to evaluate the proposed Completion Time extension were dispositioned. This resulted in a number of enhancements to the PRA models prior to their use to support the proposed change.

In 2008, a gap assessment was performed to evaluate the Byron PRA model against the ASME PRA Standard (Reference 20) was performed using Regulatory Guide 1.200, Revision 1 (Reference 21).

A summary of the evaluation of the technical adequacy of the Byron PRA for this application is provided in Attachment 6. As a result of the considerable effort to incorporate the latest industry insights into the PRA upgrades, self-assessments, and Owners Group peer reviews, Exelon is confident that the results of the risk evaluation are technically sound and consistent with the expectations for PRA technical capability set forth in RG 1.174 (Reference 5), RG 1.177 (Reference 4), and RG 1.200 (Reference 21).

Byron Station evaluated the risks of external hazards as part of the Individual Plant Examination of External Events (IPEEE) process. Performed in the late 1990s, these evaluations included qualitative and conservative quantitative estimates of the plant capability to mitigate a range of potential external hazards. Since the time of the IPEEEs, the plants have made a number of plant improvements, including the addition of the capability to cool the CV pumps using water from the fire protection system.

While the IPEEE analyses have not been updated to reflect the as-built and as-operated plant, Byron has initiated a project to complete an updated fire PRA with the EPRI/NRC fire PRA methodology, NUREG/CR-6850 (Reference 26), as its foundation. This fire PRA model addresses core damage due to internal fires and contains all the essential elements of a fire PRA required by NUREG/CR-6850 and augmented by recent industry research and insights with respect to fire PRA methods. This model is used to provide risk insights (e.g., risk contributors and potential compensatory measures) and

Page 14 of 52 conservative quantitative risk estimates. The quantitative results are not directly comparable to the internal events PRA due to the strong conservative bias in the development of the current fire PRA model. However, even this conservative fire PRA is sufficient to demonstrate that fire risks are not significant to the decision to grant the one-time CT extension.

For the purposes of this submittal, the risks from external hazards are demonstrated to not be significant to the quantitative risk insights based on insights from the IPEEE or with bounding quantitative methods using the insights from the internal events PRA and the internal fire PRA. This approach is consistent with NRCs recently released guidance on the treatment of completeness uncertainty contained in NUREG-1855 (Reference 27).

2.3.1.1 QUANTITATIVE ACCEPTANCE GUIDELINES No specific quantitative guidelines are provided in RGs 1.174 and 1.177 for one-time risk-informed changes. The quantitative acceptance guidelines in Section 2.2.4 of RG 1.174 are expressed in terms of changes to the annual average impact on core damage frequency (CDF) and large early release frequency (LERF). Since this is a one-time change, the risk impact would not result in an on-going change in CDF and LERF.

Nevertheless, as a point of reference, the quantitative acceptance guidelines in RG 1.174 state that a long-term increase in CDF of less than 1E-6/yr and LERF of less than 1E-7/yr would be considered to be very small.

RG 1.177 was developed specifically for technical specification changes. However, the acceptance guidelines provided in Section 2.4 (ICCDP < 5E-7, ICLERP < 5E-8) are clearly stated to be applicable only to permanent (as opposed to temporary, or "one time") changes to TS requirements. Permanent changes, by their very nature, imply that the condition could be entered into multiple times, whereas a one-time change would only be entered under specific conditions for a specific purpose.

NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (Reference 8) addresses monitoring risk during maintenance

Page 15 of 52 activities and provides quantitative guidelines that indicate that routine activities should generally not involve an increase in incremental conditional core damage probability (ICCDP) of greater than 1E-6 or an incremental conditional large early release probability (ICLERP) of greater than 1E-7. The NRC has endorsed these guidelines in Regulatory Guide 1.182. This planned one-time configuration would not be considered routine maintenance. As such, the routine guideline is judged to be a conservative acceptance guideline. NUMARC 93-01 also recommends that an upper limit configuration-specific CDF of 1E-3/yr be used. Although the NRC has not explicitly endorsed this guideline, it is considered relevant to this one-time change.

Based on the available quantitative guidelines for other risk-informed applications, it is judged that the quantitative criteria shown in Table 3 represent a reasonable set of acceptance guidelines. Less restrictive guidelines could also be justified, but for the purposes of this evaluation, these guidelines demonstrate that the risk impacts are acceptably low.

Table 3 Proposed Risk Acceptance Guidelines RISK ACCEPTANCE GUIDELINE BASIS ICCDP < 1E-6 ICCDP is an appropriate metric for assessing risk impacts of out of service equipment per RG 1.177

& NUMARC 93-01 1E-6 is consistent with NUMARC 93-01 guidance, as endorsed in RG 1.182, for routine maintenance and with RG 1.174 increases assess as very small Greater than RG 1.177 guideline (5E-7) for permanent TS changes, but that criterion is applied to changes which are allowed to be entered repeatedly over the life of the plant, whereas the proposed SX CT is a one time change.

ICLERP < 1E-7 ICLERP is an appropriate metric for assessing risk impacts of out of service equipment per RG 1.177

& NUMARC 93-01 1E-7 is consistent with NUMARC 93-01 guidance, as endorsed in RG 1.182, for routine maintenance and with RG 1.174 requirement that risk increases are very small Greater than RG 1.177 guideline (5E-8) for permanent TS changes, but that criterion is applied to changes which are allowed to be

Page 16 of 52 entered repeatedly over the life of the plant, whereas the proposed SX CT is a one time change.

Configuration-specific CDF

< 1E-3/yr NUMARC 93-01 recommends configurations exceeding this guideline be avoided.

Page 17 of 52 2.3.1.2 RISK FROM INTERNAL EVENTS The Byron Station internal events PRA were used as a tool to evaluate the quantitative risk impacts due to internal events during the planned SX configuration. To determine the effect of the proposed 144-hour Completion Time for restoration of an inoperable SX train, the guidance suggested in RG 1.177 was used. Thus, the following risk metrics were used to evaluate the risk impacts of extending the SX train Completion Time from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months .

ICCDP{xY} = incremental conditional core damage probability with SX train Y on Unit x out-of-service for an interval of time equal to the proposed new Completion Time (i.e.,144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , or 6 days).

ICLERP{xY} = incremental conditional large early release probability with SX train Y on Unit x out-of-service for an interval of time equal to the proposed new Completion Time (i.e., 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months , or 6 days).

The ICCDP and ICLERP are computed using definitions in RG 1.177. In terms of the above defined parameters, the definition of ICCDP is as follows.

(

)

(

)

(

)

2 1

10 64

.1

)

/

365

(

)

6

(

=

x CDF CDF ICCDP year days days CDF CDF ICCDP T

CDF CDF ICCDP xBASE xYOOS xY xBASE xYOOS xY CT xBASE xYOOS xY Where TCT = the requested Completion Time.

Note that in the above formula, 365 days/year is merely a conversion factor to get the Completion Time units consistent with the CDF frequency units. The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Completion Time.

Similarly, ICLERP is defined as follows.

(

)

2 10 64

.1

=

x LERF LERF ICLERP xBASE xYOOS xY

Page 18 of 52 The intermediate results of the risk evaluation are presented in Table 4, Intermediate Results of Risk Evaluation for Byron Station. The base CDF value for Byron Unit 1 due to internal events and internal flooding is 2E-05/year based on the average unavailability of the SX SSCs using plant specific data.

Table 4 Intermediate Results of Internal Events and Internal Flooding Risk Evaluation for Byron Station Unit 1 Risk Metric LAR Parameter 1SX01PA & 2SX01PA CDFBase CDFxBase 2E-5 CDFCT Configuration CDFxYOOS 3E-5 LERFBase LERFxBase 1E-6 LERFCT Configuration LERFxYOOS 1E-6 NOTE: The details of the calculations are provided in Appendix A of BY-LAR-001 (Reference 28).

The risk evaluation of internal events incorporates a number of compensatory measures that the plant will take during the SX CT to assure the risk impacts are acceptably low.

Table 14 provides the details on how these compensatory measures are to be applied during the 1/2SX001A maintenance evolution for Byron station.

Credit for a dedicated operator to maintain and respond to SX-related problems is recognized as a key compensatory measure. Implementation of this measure will consist of the assignment of dedicated operators inside and outside the control room to back up the nominal staff for these actions. These personnel represent additional operators (i.e., one Senior Reactor Operator (SRO) in the control room, one Reactor Operator (RO) and one Equipment Operator) assigned to monitor SX performance and take the identified actions if required as a back up to the nominal shift staff. The only duties assigned to these dedicated operators will be those associated with the actions identified in the risk assessment credited to reduce the risk impact.

Page 19 of 52 The following preparation activities will be performed for the personnel assigned to this dedicated operator positions:

Provide refresher training on establishing the SX unit crosstie, alignment of alternate cooling for the CV pumps, alignment of the CV pump suction from the VCT to the RWST, and other actions directed by station abnormal procedures in response to a loss or degradation of the SX system. This training will also be provided for control room operators and equipment operators assigned to the nominal shift coverage.

Conduct training to walk through the alignment actions with the dedicated operators prior to entering the SX LCO.

Implementation of the dedicated operator positions will include:

Providing briefings on the SX alignment and the conditions that could require performance of these operator actions at each shift change;

Validating the position of the 1(2)SX005 valves to meet the assumptions contained in the risk assessment (either 1SX005 or 2SX005 open)

Validating the isolation of one train of the Unit 2 RCFCs to meet the assumptions contained in the risk assessment

Implementation of the Adverse Condition Monitoring Plan for CV pump bearing temperatures to meet the assumptions contained in the risk assessment

Monitoring SX pump and system performance (including SX pump motor parameters such as volts/amps, temperatures, etc)

Providing copies of the procedures for the actions to establish the SX unit crosstie, aligning fire protection cooling for the CV pumps and alignment of the CV pump suction from the VCT to the RWST to the dedicated Control Room and equipment operators prior to each shift change to minimize the need to locate the procedures during loss of SX conditions

Validating the placement of ladders/stepping stools in locations where the fire protection hose hookup is above the height that an operator can reach without assistance (such as the B charging pump rooms), and

If required, readiness to perform the actions directed by station abnormal procedures in response to a loss or degradation of the SX system

Page 20 of 52 Command and Control Attributes The dedicated SRO, RO and equipment operator will specifically monitor SX performance. These personnel will report directly to the operating unit's Unit Supervisor who reports to the Shift Manager. The dedicated equipment operator will report to the dedicated SRO. Standard three-way communication protocol will be used throughout the evolution.

The dedicated SRO and RO will identify the entry conditions for implementation of the appropriate abnormal operating procedures and direct the activities of the dedicated equipment operator in accordance with the abnormal procedure. They will inform the Unit Supervisor that the entry conditions have been reached and they are implementing the appropriate abnormal operating procedure. They will subsequently report the results of the actions to the Unit Supervisor.

Communications from the control room to the dedicated equipment operator will be accomplished using the normal radio system, telephone or plant page. These systems are verified operational through normal frequent use and have proven to be adequate for all plant evolutions based on years of operating experience.

The actions that the dedicated operators would be expected to perform are listed in Table 5 below.

Table 5 - Operator Action Summary Task Location Complexity/Difficulty Consequences if Not Performed Establish SX unit Crosstie given loss of SX on Unit 1 Main Control Room Isolate flow to one RCFC train, open crosstie valve Loss of SX, requires additional action to establish alternate cooling to CV pumps to maintain RCP seal injection and prevent potential for RCP Seal LOCA Establish alternate cooling (i.e., FP) to CV pump oil cooler given loss of CCW cooling CV Pump Room Locally connect fire hose to CV pump oil cooler connection (pre-staged), isolate normal flow path from SX, open FP valve Loss of CV pumps for RCP seal injection.

Potential for RCP Seal LOCA Establish cool suction source for Main Control Room Align seal return to pressurizer relief tank, Loss of CV pumps for RCP seal injection.

Page 21 of 52 CV pumps given loss of CCW cooling monitor seal water heat exchanger outlet temperature (if greater than 160°F, align CV pumps suction to refueling water storage tank)

Potential for RCP Seal LOCA Table 6 below provides a summary of the time available as well as the time required to take these actions. The Time Required includes travel time associated with the designated operators. This time was obtained from a review of operations simulator training records, including job performance measures. Each of these actions assumes a cue time of 1 minute, although there is substantially more time available than required to perform the actions.

Page 22 of 52 Table 6 - Operator Action Time Summary Task Time Available Time Required Establish SX unit crosstie 90 Minutes 10 Minutes Establish alternate cooling (i.e.,

FP) to CV pump oil cooler 90 Minutes 20 Minutes Establish cool suction source for CV pumps 30 Minutes 10 Minutes Other than the FP connection to the CV pumps, all actions can be taken from the control room. The FP connection to the CV pump is performed in the CV pump rooms in the auxiliary building. The CV pump rooms are not adverse environment areas and there are no special access requirements necessary to perform the prescribed actions other than normal radiation work permit compliance.

Comparison of Internal Events and Internal Flooding Results to Risk Acceptance Guidelines The results of the risk evaluation are compared in Table 7 with the risk acceptance guidelines from Table 3. The values for the ICCDP and the ICLERP demonstrate that the proposed SX train Completion Time change has a very small quantitative impact on plant internal events risk. The results have decreased from the previous SX CT one time submittal (Reference 22) with 3E-7 ICCDP due to incorporation of the WOG 2000 RCP Seal LOCA model (Reference 23) which is an industry consensus model.

Table 7 Results of Internal Events and Internal Flooding Risk Evaluation for Byron Station Risk Metric Risk Acceptance Guideline Internal Events Risk Metric Results ICCDP

< 1E-6 1E-7 ICLERP

< 1E-7 3E-9 CDFSX CT Configuration

< 1E-3/yr 3E-5

Page 23 of 52 Conclusions Related to Internal Event Risks The evaluation of the quantitative impact on internal events risk due to the planned configuration demonstrates that the impact on the likelihood of core damage and large early release is well below the risk acceptance guidelines.

2.3.1.3 RISK FROM INTERNAL FIRES A quantitative analysis of internal fire vulnerabilities was conducted as part of the Byron Station IPEEE (Reference 11). The Byron Station Individual IPEEE was submitted to the NRC on December 23, 1996. Requests for additional information (RAIs) were issued by the NRC on July 23, 1998 for the Byron Station. Responses to most of the station-specific questions in the RAIs were provided on January 29, 1999. Plant-specific responses to the generic fire issues were provided on July 15, 1999, after the Electric Power Research Institute (EPRI) and Nuclear Electric Institute (NEI) final generic responses were issued.

As further described below, a Fire PRA model has been in development for Byron Station over the past 4 years. Although not yet considered capable of providing fully realistic fire risk results, the model is judged to be capable of providing reasonable risk insights and quantitative results when carefully applied. Using this model, a conservative quantitative assessment of fire CDF risk related to the SX CT was performed to gain insights into the risk exposure during time periods when the two train A SX pumps are unavailable due to maintenance on the 1SX001A and 2SX001A valves.

The assessment process involved the comparison of the fire risk characterization for a baseline configuration against that for a configuration in which the two train A SX pumps (1A and 2A) are unavailable due to maintenance on the 1/2SX001A valves. The Fire PRA for Byron (Reference 17) was used in support of this assessment, with the plant configuration setting (i.e., compensatory measures) the same as the internal events risk assessment during this maintenance evolution.

Page 24 of 52 Fire PRA Model Basis The Fire PRA model for the Byron station has been undergoing a continuous development process over the last 4 years with incremental refinement of the model.

The Byron Fire PRA model is completing a significant revision incorporating many of the methods defined in NUREG/CR 6850. Listed below are some of the key features of the current Byron Fire PRA model that has been used to estimate the impact of the Byron SX CT extension on overall plant risk:

1.

A new walkdown has been recently completed to define ignition frequencies in accordance with the counting methodology specified in NUREG/CR 6850

2.

Cable identification and cable routing is taken from the 10 CFR 50 Appendix R analysis, supplemented for Appendix R components with failure modes that do not match PRA failure modes

3.

A recent update of the correlation between Appendix R Safe Shutdown equipment and PRA model basic events has been completed

4.

Fire scenario definition has also been updated based on recent walkdowns using a scoping fire modeling criteria supported by extensive generic fire modeling analyses

5.

Fire ignition frequency data from the updated EPRI report (Reference 25) were used in this analysis (a sensitivity analysis was also performed comparing the results to those associated with the use of the NUREG/CR-6850 (Reference

26) ignition frequency data The framework for the Fire PRA update is based on the NUREG/CR-6850 methodology.

The current model is not considered a realistic fire PRA for the following reasons:

Many scenarios remain based on bounding assumptions of fire damage based on compartment boundaries, i.e., all equipment and cables in the compartment are assumed damaged. As a result, the extent of fire damage is overstated in these scenarios.

Even when more detailed scenarios are defined to assess the consequences of specific ignition sources, only scoping fire modeling criteria are used, i.e., no

Page 25 of 52 detailed fire modeling has been performed. The effects of fires defined in NUREG/CR-6850 are assessed using conservative scoping fire modeling criteria.

As a result, the extent of fire damage is overstated in many fire core damage scenarios.

Potential human actions to mitigate the effects of fire related damage are not considered in many of the fire PRA core damage scenarios. As a result, the likelihood of fire damage is overstated in many fire core damage scenarios.

Exelon plans to continue the development of the Fire PRA based on scenario refinement and application of improved methods and data with the ultimate goal of developing a realistic fire PRA. In its current state, the fire PRA provides a conservative estimate of the fire risks for Byron station.

Areas of uncertainty associated with this model are primarily related to areas of conservatism in the inputs to the model, which include:

1.

Heat release rate data

2.

Fire development timeline

3.

The use of bounding fire scenarios and scoping fire modeling analyses in lieu of a detailed assessment of fire effects through fire modeling The conservatism inherent in the current model does not, however, significantly impact the models ability to evaluate changes in risk. The review of the impact of the SX CT extension is primarily based on a comparison between the risk associated with the base model versus the risk associated with the addition of equipment status associated with the CT window. Since the model conservatism for delta-risk calculations is primarily associated with inputs to the model such as ignition frequency, heat release rate and fire damage, the impact of the conservatism is limited and does not tend to mask the impact of the plant configuration change which is being evaluated.

The quantitative evaluation performed has focused on the impact of the SX CT extension on CDF. The impact on LERF is expected to be less than that on CDF since the SX system maintenance does not alter containment isolation capability functionality

Page 26 of 52 and the only impact on the primary systems credited to mitigate LERF events is quantified in the CDF evaluation. Therefore, the impact on LERF will be a fraction of the percentage impact on CDF.

Fire Risk Evaluation Results The intermediate results of the conservative fire risk evaluation are presented in Table 8, Intermediate Results of Internal Fire Risk Evaluation for Byron Station. The base fire CDF value for Byron Unit 1 is 5E-05/year based on the average unavailability of the SX pumps using plant specific data.

Table 8 Intermediate Results of Internal Fire Risk Evaluation for Byron Station Unit 1 Risk Metric 1SX01PA & 2SX01PA Fire CDFBase 5E-5/yr Fire CDFSX CT Configuration 1E-4/yr NOTE: The details of the calculations are provided in Appendix B of BY-LAR-001 (Reference 28).

Comparison of Internal Fire Results to Risk Acceptance Guidelines The results of the risk evaluation are compared in Table 9 with the risk acceptance guidelines from Table 3. The values for the ICCDP demonstrate that the proposed SX train Completion Time change has a very small quantitative impact on plant risk.

Table 9 Results of Internal Fire Risk Evaluation for Byron Station Risk Metric Risk Acceptance Guideline Internal Fire Risk Metric Results Fire ICCDP

< 1E-6 9E-7 Fire CDFSX CT configuration

< 1E-3/yr 1E-4/yr

Page 27 of 52 A sensitivity analysis was done to compare the results using the updated EPRI ignition frequency data (Reference 25) with the fire ignition frequencies found in NUREG/CR-6850 (Reference 26). The ICCDP for the case when the NUREG/CR-6850 fire frequencies were used was 9.6E-7.

The compensatory measures identified through the assessment of internal events included establishing restrictions on concurrent maintenance activities on several plant components and trains. These compensatory actions are summarized in Table 14.

These compensatory actions were incorporated in the delta CDF Fire analysis.

Fire specific recommendations for actions which can be taken to provide additional defense in depth and safety margin are summarized below.

1. Implement monitoring of the Train B SX pumps and motors focusing on precursor indicators of a fire event (e.g., motor volts, amps, temperatures).

2. Manage plant operations to minimize, or preclude, breaker switching operations on Switchgear Bus 142.

3. Perform a walkdown to identify and ensure transients are within administrative limits prior to the start of the SX CT. Also identify any transient ignition sources (energized temporary cables) and remove or ensure that measures are taken to limit their potential contribution to a transient fire. These actions are to be addressed in the areas identified in Table 10.

Table 10 lists the fire areas that comprise the majority of the risk due to fire while the SX pumps are unavailable in support of the 1(2)SX001A valve maintenance. The table is sorted from most risk significant to least. The risk ranking does not include credit for the above recommended actions for further reduction of fire risk.

Page 28 of 52 Table 10 List of Important Fire Areas for Unit 1 with SX 1A/2A in Maintenance No.

Fire Zone Scenario ID - Description 1

5.1-1 Division 12 ESF switchgear room (focus on switchgear 142) 2 11.3-0 Auxiliary building general area, Elev. 364 (focus on MCC 132X1) 3 11.1B-0 Unit 2 auxiliary building basement (SX B Train Pump Room) 4 11.6-1 Division 12 containment electrical penetration area 5

11.6-0 Aux building general area, Elev. 426 (focus on SWGR 134X) 6 11.3-1 Unit 1 containment pipe penetration area (focus on MCC 131X1) 7 11.4-0 Aux building general area, Elev. 383 (focus on 1AF01PA, 2AF01PA and MCC 132X3) 8 5.5-1 Unit 1 auxiliary electrical equipment room (focus on 1PA23J) 9 5.2-1 Division 11 ESF switchgear room (focus on switchgear 141)

Conclusions Related to Fire Risk A conservative evaluation of the quantitative impacts of internal fire risks due to the planned configuration demonstrates that the impact on the likelihood of core damage is below the risk acceptance guidelines, even if it is considered in combination with the more realistic internal events results.

On a strictly qualitative basis, based on a review of the scenarios addressed in the fire PRA, a success path to prevent core damage has been identified for every fire scenario that has a significant increase in risk due to the planned SX system configuration. In addition, compensatory measures have been identified that further reduce the risk of these fire scenarios.

2.3.1.4.

RISK FROM SEISMIC EVENTS The seismic analyses in the Byron Station IPEEEs were based on the seismic margin assessment. No significant seismic concerns were identified and it was concluded that the plants possess significant seismic margin. The IPEEEs did identify some seismic outliers (i.e., control room lighting diffuser panels and electrical cabinet interactions).

Page 29 of 52 These seismic outliers have been resolved either by additional analysis or completion of design modifications.

The impact of removing two same train SX pumps from service has been evaluated to ensure that the seismic risk impact is not significantly increased (e.g., the results of the Seismic IPEEE are essentially unchanged). The interaction between seismic events and the SX systems are dominated by seismically-induced loss of offsite power and station blackout events, as well as the function of the SX system to provide a suction source to the auxiliary feedwater (AF) pumps following a seismic event.

The configuration during the extended Completion Time will involve both units same train SX pumps unavailable concurrently (i.e., 1A and 2A). Since the configuration of the SX system does not change the seismic capacity of the system, and two available SX pumps are sufficient to support the SX success criteria required by the Success Path Equipment List (SPEL), then the results of the Seismic Margins Analysis (SMA) are unchanged.

No other issues unique to the configurations required during the SX out of service were identified during a review of the IPEEE information that would result in the plant High Confidence of Low Probability of Failure (HCLPF) dropping below 0.3g.

Therefore, Byron Station will continue to possess a HCLPF of 0.3g, and the risk from seismic initiators is considered small.

Recent Plant Modification Review Since the completion of the IPEEE, modifications have been made to the plant to include the erection of a security tower at Byron Station. This security tower is attached to the SX towers. These towers are designed to all design basis seismic, high wind and tornado loads. However, the IPEEE seismic event is a 0.3g earthquake compared to the 0.2g design basis earthquake. The seismic loading from a 0.3g earthquake has been analyzed and determined to be enveloped by the tornado loading for the structure; therefore, this HCLPF of 0.3g is maintained (Reference 13).

Page 30 of 52 Seismic Screening Analysis The SX system performs several functions that might have an increased significance following a seismic event. These functions include:

provide cooling to emergency diesel generators following a seismically induced loss of offsite power (LOOP);

provide a backup supply of water to the auxiliary feedwater pumps in the event of seismically induced failure of the CST; and

provide a backup supply of water to the fire protection system in the event of seismically-induced failure of the fire protection pumps.

The deterministic evaluation presented in Section 2.1 describes the basis for SX system defense in depth. The following evaluation demonstrates that likelihood of these functions being demanded are very low and, therefore, any risk impacts to the configuration would be expected to be very small.

Seismic-Induced LOOP Past seismic PRAs have shown that seismic-induced loss of offsite power can be an important contributor to seismic risk due to the unrecoverable loss of offsite power. SX performs an important function following a LOOP. Thus, a screening analysis was performed to evaluate the potential risk impacts of the planned configuration on seismic induced LOOP.

The non-recovered internal events dual-unit LOOP (i.e., DLOOP) frequency for Byron Station is ~2E-3/yr. Seismically induced LOOP (assumed non-recoverable) is estimated to be on the order of 5E-05/yr for Byron Station based on seismic hazard curves from NUREG-1488 (Reference 9) and the generic offsite power fragilities from the supporting analyses to NUREG/CR-4550 (Reference 10).

Page 31 of 52 There are no issues regarding this configuration that negatively impact the seismically induced LOOP frequency. Hence, since the seismically induced LOOP frequency is small compared to the internal events DLOOP frequency, and the LAR will not increase the seismically induced LOOP frequency, seismically induced LOOP represents a negligible risk source for this configuration.

Seismically induced Station Blackout (SBO) is estimated to be on the order of 1E-06/yr for Byron Station based on seismic hazard curves from NUREG/CR-1488 and generic EDG fragilities from NUREG-1150. Seismically induced LOOP with random SX pump failure would result in an SBO on the unit with the failed SX pump.

Note that SX crosstie is not credited in this case as it is assumed that the diesel fails due to lack of cooling before the SX crosstie is made. Furthermore, the 4kV bus crosstie is not credited when only 1 EDG is available on both units. Thus, the planned configuration causes some increase in the potential for seismic-induced station blackout due to the reduced redundancy of the SX system.

Based on the internal events PRA, the probability of SX pump failure to start and run after a demand is about 1E-03. Given a seismic-induced LOOP frequency of roughly 5E-5/yr, the probability of seismically induced LOOP with the random failure of an SX pump is less than 1E-07/yr. Since this is about an order of magnitude less than seismically induced SBO, and there are known conservatisms regarding this scenario, the configuration specific SBO is not a significant contributor to seismic risk. Further more, this risk contribution would only last for a maximum of 144 hours0.00167 days 0.04 hours 2.380952e-4 weeks 5.4792e-5 months . This would translate to an ICCDP of less than 1E-9.

SX as Backup for CST The CST is not considered in the SPEL in the Byron Station IPEEE SMA. The CST is not seismically qualified in the station design basis, and SX is used to supply secondary heat removal via the steam generators. SX is supplied at the suction of the AF pumps via the 1(2)AF006A(B) and 1(2)AF017A(B) motor operated valves (MOVs). These MOVs open automatically on low suction pressure, or can be remote manually operated

Page 32 of 52 from the control room, or locally manually opened. The MOVs were determined to have a HCLPF of at least 0.3g, and no interaction issues were identified.

In the SX maintenance configuration, a flow path will remain from the available SX pump to the suction of the AF pumps. This flow path could be lost following a seismically induced SX pipe break that would require isolation of the SX033/SX034 MOVs on the operating unit. However, this would not only effectively isolate suction to one of the two AF pumps, it would also result in loss of cooling to the respective AF pump. The AF pump would be lost regardless of the suction source, and therefore, relying on the SX as the AF pump suction source does not result in an increase in risk.

Finally, since the SX piping has a HCLPF of at least 0.3g, it is unlikely that a seismic event less than the plant HCLPF would result in an SX pipe break.

SX as Backup to Fire Protection The SX system can provide a backup supply of water to the fire protection system in the event of seismically-induced failure of the fire protection pumps. This function would only be necessary if the seismic event caused a fire and failure of the fire protection pumps. The Byron Station IPEEEs specifically investigated the potential for seismic-induced fires. The conclusion of the IPEEE analysis was that there was no significant risk from seismic-induced fires at Byron Station. Given this finding, it is concluded that the impact of the planned configuration on this function of SX is not risk significant.

2.3.1.5 RISK FROM OTHER EXTERNAL EVENTS Evaluation of high winds, external floods, and other external events in the Byron Stations IPEEEs, which are in accordance with NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, June 1991, indicated that the sites conform to NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, June 1987, criteria and revealed no potential vulnerabilities.

Page 33 of 52 The impact of the extended SX train Completion Time on the risk profile associated with these external events is discussed below.

The potential impact of other external events occurring during the SX extended Completion Time (CT) was considered based on the results of the Byron Station IPEEE (Reference 11). The IPEEE considered a broad spectrum of other potential external event hazards including:

Rail Transportation Accidents

Barge Transportation Accidents

Pipeline Transportation Accidents

Military Facilities

On-site Hazardous Material Accidents

Severe Temperature Transients

Severe Weather Storms

Lightning Strikes

External Fires

Extraterrestrial Activity

Volcanic Activity

Abrasive Windstorms All of these hazards were evaluated in the IPEEE against the criteria provided in NUREG-1407 (Reference 12) and found to pose no risk significance.

Many of these hazards are totally unrelated to risk associated with the SX extended CT.

Table 11 summarizes the relationship of these hazards to the SX extended CT configuration. Only three of the IPEEE hazards were identified as having any potential to impact risk during the SX extended CT. The three hazards identified are:

Severe Temperature Transients - Severe temperature transients could challenge SX makeup (i.e., during very low temperatures) or heat removal capability (i.e., during very high temperatures). However, the one-time CT extensions will be entered during a scheduled refueling outage. Refueling outages are scheduled at times in

Page 34 of 52 the year (i.e., Fall and Spring) when severe temperature transients would be extremely unlikely. The IPEEE states that the impact of Severe Temperature Transients is to cause a loss of offsite power. These events are considered in the loss of offsite power and recovery analysis in the Internal Events PRA and are, therefore, included in the computed ICCDP/ICLERP.

Severe Weather Storms - Severe weather storms include high winds and tornadoes.

The SX pumps and all associated support and mitigation systems are located in buildings that are designed for tornadoes and high winds. Thus, they are protected from the effects of these events. High winds and tornadoes can cause loss of offsite power. These events are considered in the loss of offsite power and recovery analysis in the Internal Events PRA and are, therefore, included in the computed ICCDP/ICLERP. As identified in Table 14 below, planned maintenance on all four EDGs and associated electrical buses will not be allowed while the CT is in effect.

This assures that the electrical power will be available should a LOOP occur.

Lightning Strikes - Lightning strikes can cause loss of offsite power or reactor trips.

These events are considered in the Internal Events PRA and are, therefore, included in the computed ICCDP/ICLERP.

Based on this evaluation, it is concluded that other external events have a negligible impact on the risk associated with the SX CT extension.

Page 35 of 52 Table 11 Summary of Impact of Other External Hazards on SX Extended CT Risks Other External Event Hazard Impact on SX Extended CT Basis Rail Transportation Accidents None The threat to SX and associated mitigation is unchanged by the SX configuration.

Barge Transportation Accidents None The threat to SX and associated mitigation is unchanged by the SX configuration.

Pipeline Transportation Accidents None The threat to SX and associated mitigation is unchanged by the SX configuration.

Military Facilities None The threat to SX and associated mitigation is unchanged by the SX configuration.

On-site Hazardous Material Accidents None The threat to SX and associated mitigation is unchanged by the SX configuration.

External Floods None The threat to SX and associated mitigation is unchanged by the SX configuration.

Severe Temperature Transients Negligible/Already Addressed One-time outages scheduled during Spring and Fall Severe Weather Storms Negligible/Already Addressed Likelihood of damage to operating SX intake is negligible.

Lightning Strikes Already Addressed Already considered in the Internal Events PRA External Fires None The threat to SX and associated mitigation is unchanged by the SX configuration.

Extraterrestrial Activity None The threat to SX and associated mitigation is unchanged by the SX configuration.

Volcanic Activity None The threat to SX and associated mitigation is unchanged by the SX configuration.

Abrasive Windstorms None The threat to SX and associated mitigation is unchanged by the SX configuration.

Page 36 of 52 2.3.1.6

SUMMARY

OF RISK INSIGHTS The above evaluation assesses the risk from the following sources:

Internal Events (including Internal Flooding)

Internal Fire

Seismic Events

Other External Hazards The results of the risk evaluations are compared in Table 12 with the risk acceptance guidelines from Table 3. The values for the ICCDP and the ICLERP demonstrate that the proposed SX train Completion Time change has a very small quantitative impact on plant risk.

Table 12 Overall Results of Risk Evaluation for Byron Station - Unit 1 Risk Metric Results Risk Metric Risk Acceptance Guideline Internal Events1 Internal Fire2 Seismic and Other External ICCDP

< 1E-6 1E-7 9E-7 Negligible ICLERP

< 1E-7 3E-9 Negligible Negligible CDFBase

< 1E-4/yr 2E-5/yr 5E-5/yr

~1E-5/yr CDFSX CT configuration

< 1E-3/yr 3E-5/yr 1E-4/yr

~1E-5/yr Note 1: Internal events include contribution from internal flooding.

Note 2: The internal fire results contain conservatisms that make the fire results incomparable to the internal events results. They are shown here simply to illustrate that even if they are added, the acceptance guidelines are not exceeded.

Table 13 provides a summary of the approach and results of the evaluation of each of these potential risk contributors. These analyses demonstrate that the risk impact of the proposed one-time extension of the SX Completion Time is very small and below the acceptance guidelines.

Page 37 of 52 This risk-informed evaluation identified a number of compensatory measures that will be implemented during the planned SX configuration. These are discussed in more detail in Section 2.3.2.

Table 13 Summary of Risk Insights for SX CT Extension RISK CONTRIBUTOR APPROACH INSIGHTS Internal Events

Quantify ICCDP & ICLERP for Planned Configuration, Including Compensatory Measures:

ICCDP < 1E-6 ICLERP < 1E-7 Baseline CDF < 1E-4/yr Configuration Specific CDF <

1E-3/yr

Compensatory Measures Keep Risk Well Within Acceptance Guidelines Internal Fire

Qualitatively and Quantitatively Evaluated:

Identify Fire Scenarios Impacted by Configuration Estimate fire risk impacts due to configuration and quantify delta-CDF Confirm Availability of Success Path for Every Scenario Identify actions recommended for increasing defense in depth and safety margin

Every Fire Scenario Has At Least One Success Path

Internal Events Compensatory Measures Apply to Fire Scenarios

New Fire-Related recommended actions Identified

Compensatory Measures Keep Risk Well Within Acceptance Guidelines Seismic

Qualitatively Identify Key Seismic Risk Impacts for Planned Configuration

Evaluate Impact on Seismic-related Key Functions of SX

Seismic Risk Impacts Negligible Other External Hazards

Qualitatively Evaluate Each Hazard to Identify Unique Challenges

No Unique Challenges Identified Overall At-Power Risks

No Evidence Quantitative Guidelines Will Be Challenged

Key Compensatory Measures Identified to Minimize Risk Risk at Unit in Shutdown

Qualitatively Evaluate Impact of SX Configuration on Unit in Shutdown

Identify Compensatory Measures Consistent With Shutdown Safety Program

Reduction SX Redundancy Leads to Some Increase in Risk at Shutdown Unit Since SX Transfers Heat to the Ultimate Heat Sink

Compensatory Actions At Unit in Shutdown Consistent With Outage Safety Program

Page 38 of 52 2.3.2 TIER 2: AVOIDANCE OF RISK-SIGNIFICANT PLANT CONFIGURATIONS The evaluation of the risk significance of plant configurations considers the impact on both the at-power unit for which the license amendment is being requested and on the opposite unit which will be shutdown during the planned configuration. While evaluation of the shutdown unit is not required, it is included here as part of Exelons overall configuration risk management program.

2.3.2.1 At-Power Unit In order to avoid risk-significant plant equipment outage configurations during the extended Completion Time, the impact of having other equipment unavailable was evaluated. This resulted in a list of protected equipment that will not be allowed to be unavailable for maintenance during the extended Completion Time. Table 14 provides the results of this evaluation as well as additional compensatory measures that will be established to reduce the risk associated with the configuration.

2.3.2.2 Opposite (Shutdown) Unit Having a train of SX unavailable will have an impact on the shutdown unit as well as the on-line unit for which the license condition is being requested. As such, a qualitative evaluation of the impact on the shutdown unit was performed.

The key safety functions that are included and evaluated for Byron Station outage risk evaluations include the following:

Reactivity Control

Shutdown Cooling

Inventory Control

Fuel Pool Cooling

Electric Power Control

Containment

Vital Support Systems

Page 39 of 52 The impact of the SX outage on each of the key shutdown safety functions is summarized below.

Reactivity Control The equipment that is potentially impacted from the SX outage that supports reactivity control includes the safety injection system (SI) and chemical and volume control system (CV) pumps. Each provides a potential pathway for boron addition to the RCS.

In general, requirements include 1 SI and 1 CV pump during Mode 4 and 1 SI or 1 CV pump at all other times. Given the planned evolution with both B train SX pumps available, the SX outage should not hinder the capability to meet these requirements.

Shutdown Cooling The shutdown cooling requirements consist of optimizing the RH train availability along with feed and bleed capabilities from at least 1 SI or CV pump, and/or with two or more steam generators available with AF or MFW as appropriate depending on the outage configuration. Although both of the SX trains would be supplied by the available SX pump for the planned evolution (and the train and unit SX cross-ties would be available to allow for the opposite unit SX pump to supply cooling), it would prudent to protect the SX-supported train RH, SI, and CV components at any point during the SX outage to minimize the failure set that could render the safety function unsatisfied. That is, if only one train of the RH, SI, or CV systems are to be maintained available during the outage, then best efforts will be made to maintain the B train available during the A SX outage and the A train available during the B SX outage. However, it should be understood that the protected equipment compensatory measures for the shutdown unit includes the train and unit SX cross-tie capability (i.e. 2SX033 / 2SX034 / 1(2)SX005 valves).

These measures are intended to insure the opposite unit SX pump can be used to provide a source of heat removal capability for either train of RH that is maintained available. This is illustrated in the simple example below.

Page 40 of 52 In summary, when the A SX outage occurs and the B SX pump is running, at least one train of RH and one train of either CV or SI will be maintained available (preferably the "B" train).

Inventory Control The inventory control requirements consist of optimizing the RH, SI, and CV train availability at all times during the outage except when the core is completely offloaded.

At reduced inventory and high decay heat levels, more than one train of each system may be required to be maintained. As such, the impact from the SX outage is similar to the impact on the shutdown cooling safety function.

Fuel Pool Cooling The fuel pool cooling safety function is only impacted by the need to maintain the spent fuel pool heat exchangers available with CC cooling which in turn requires SX cooling.

As such, the shutdown cooling requirements and limitations are considered to dominate the potential impacts from the SX outage as long as CC cooling and sufficient fuel pool cooling trains are maintained. However, to accommodate conditions where a full core offload may overlap the planned maintenance activities on the 1(2)SX001A valves, one train of fuel pool cooling will be maintained available during the SX extended AOT condition.

1 Failure of this trains power supplies would result in loss of SX cooling, thus disabling the train.

SX Configuration A Train Failure Set B Train Failure Set A Out of Service B Running A Power Supplies B Power Supplies1 A Train Component Failures B Power Supplies B Train Component Failures 1 Failure of this train power supplies would result in loss of SX cooling, thus disabling the SX train.

Page 41 of 52 Electric Power Control The electric power safety function examines the availability of offsite sources, emergency diesel generators, AC divisions, and instrument buses. Only the diesel generators are of direct concern (as long as minimum requirements are met for the other components) since SX cooling is required to support the diesel generators. Given the proposed outage evolution with the available SX pump supplying both SX trains, both diesel generators could be maintained available. However, to ensure that power would be available in a LOOP event to the operable SX pump, the opposite train diesel generator should be maintained available during the SX outage. That is, the B diesel generator should be available during the A SX outage.

Containment Generally, containment cooling consists of maintaining two or more (out of four total) containment fan coolers when the reactor cavity is not flooded. Lesser requirements exist when the cavity is flooded or when the core is offloaded. SX cooling is utilized to support the containment fan coolers, but given the planned evolution with the available SX pump supplying both SX trains, the SX outage should not hinder the capability to provide cooling.

Vital Support Systems The vital support system safety function includes the availability of the SX and CC trains. The planned evolution restricts the availability of SX during the SX. To improve the reliability of the CC system, the CC train associated with the available SX pump will be maintained available to the extent possible.

Configuration Considerations No specific quantitative evaluation has been performed at this time. However, it is well known that pressurized water reactor (PWR) outage risk is dominated during time

Page 42 of 52 frames at RCS midloop and at other configurations at low RCS level. This is generally reflected with more stringent requirements during these time frames. As such, the SX outage that renders a vital support system unavailable for up to six days should be scheduled so as to not to coincide with these known higher risk time frames.

Based on a preliminary assessment of the risk impact of the planned SX outages for Byron Station, the following will be established to avoid unnecessary risk levels associated with the SX outage on the shutdown unit.

During the SX outage, the opposite train EDG components will be protected. This is a necessity since the available SX pump will require the same train EDG to be available to maintain SX cooling given a LOOP event.

Opposite train RH, SI or CV, and CC components will also be protected during the SX outage. That is, the B trains should remain available during the A SX outage.

Protecting the opposite train equipment reduces the number of failures that could render safety function requirements unsatisfied.

The SX outage will be planned so as not to coincide with the known time frames of higher outage risk (such as RCS midloop and other low level conditions) when two RH trains and a full complement of support systems are desired to be maintained available.

2.3.2.3 Compensatory Actions Table 14 provides a listing of compensatory actions that were incorporated into the risk assessment that supports this license amendment request. This table provides the entire list of actions and identifies the area of the risk assessment to which the actions apply.

Based on insights from the Fire PRA analysis, the compensatory measures found in Table 14 are recommended to reduce fire risk. These actions have not been credited in the quantification.

Page 43 of 52 TABLE 14 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Compensatory Measure Internal Events Fire Shutdown Comments Unit 0 CC Heat Exchanger X

X Unit 2 CC Heat Exchanger X

X Unit 1 CC Heat Exchanger X

X 1SX005 (crosstie MOV)

X 2SX005 (crosstie MOV)

X 1B SX Pump X

X Monitor pump for fire precursor indicators 2B SX Pump X

X X

Monitor pump for fire precursor indicators 1A AF Pump X

1B AF Pump X

2A AF Pump X

Unit 1 SATs X

Unit 2 SATs X

X 4KV Bus 141 X

4KV Bus 142 X

X Minimize or preclude breaker switching operations, especially for offsite power supply breakers 4KV Bus 241 X

4KV Bus 242 X

X Switchyard X

Minimize or preclude breaker switching operations, especially for offsite power supply breakers 1A EDG X

1B EDG X

2A EDG X

2B EDG X

X DC Battery & Charger 111 X

DC Battery & Charger 112 X

DC Battery & Charger 211 X

DC Battery & Charger 212 X

X 2A CV or 2A SI pump OR 2B CV or 2B SI Pump X

2A or 2B RH Pump X

2B CC Pump X

1SX033/1SX034 X

2SX033/2SX034 X

X VA Supply Plenum X

VA Exhaust Plenum X

0A Fire Pump X

0B Fire Pump X

1A CV Pump Alt Cooling X

1B CV Pump Alt Cooling X

Unit 1 120 VAC Inst Inverters X

Unit 1 SI signals X

Prohibit surveillance testing on SSPS / ESFAS SI logic Protected Equipment Fuel Pool Cooling - 1 train available X

2 of 4 Unit 2 RCFC Flow Paths X

Improves effectiveness of SX Unit Crosstie Equipment Alignment Changes 1SX005 (or 2SX005) Open X

Improves effectiveness of SX Unit Crosstie

Page 44 of 52 TABLE 14 Byron SX A Train Outage Summary of Compensatory Measures Risk Source Compensatory Measure Internal Events Fire Shutdown Comments Unit 1 CST Filled to 350,000 gallons X

Dedicated SX Operator X

X Improve response to loss of remaining SX Pumps Not performed during reduced inventory or high decay heat levels X

5.1.1 X

Prior to entrance into the SX completion time 11.3-0 X

Prior to entrance into the SX completion time 11.1B-0 X

Prior to entrance into the SX completion time 11.6-1 X

Prior to entrance into the SX completion time 11.6-0 X

Prior to entrance into the SX completion time 11.3-1 X

Prior to entrance into the SX completion time 11.4-0 X

Prior to entrance into the SX completion time 5.5-1 X

Prior to entrance into the SX completion time Fire Zone walk down for transient control 5.2-1 X

Prior to entrance into the SX completion time

Page 45 of 52 2.3.3 TIER 3: RISK-INFORMED CONFIGURATION RISK MANAGEMENT PROGRAM Byron Station has developed a Configuration Risk Management Program (CRMP) governed by station procedures that ensures the risk impact of equipment out of service is appropriately evaluated prior to performing any maintenance activity. This program requires an integrated review to uncover risk-significant plant equipment outage configurations in a timely manner both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities like testing or load dispatching, and weather conditions. Byron Station currently has the capability to perform a configuration dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. Risk is re-assessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed.

For planned maintenance activities, an assessment of the overall risk of the activity on plant safety, including benefits to system reliability and performance, is currently performed prior to scheduled work. The on-line assessment is controlled by Exelon procedure WC-AA-101 (Reference 24) and includes the following considerations.

Maintenance activities that affect redundant and diverse structures, systems, and components (SSCs) that provide backup for the same function are minimized.

The potential for planned activities to cause a plant transient are reviewed and work on SSCs that would be required to mitigate the transient are avoided.

Work is not scheduled that is highly likely to exceed a TS or Technical Requirements Manual (TRM) Completion Time requiring a plant shutdown. For activities that are expected to exceed 50% of a TS Completion Time, compensatory measures and contingency plans are considered to minimize SSC unavailability and maximize SSC reliability.

Page 46 of 52

For Maintenance Rule (MR) high risk significant SSCs, the impact of the planned activity on the unavailability performance criteria is evaluated.

As a final check, a quantitative risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the impact on both CDF and LERF. The results of the risk assessment are classified by a color code based on the increased risk of the activity as shown below.

Color Meaning Plant Impact and Required Action Green Non-risk significant Small impact on plant risk.

Requires no specific actions.

Yellow Non-risk significant with non-quantitative factors applied Impact on plant risk.

Limit unavailability time or take compensatory actions to reduce plant risk.

Orange Potentially risk-significant Significant impact on plant risk.

Requires senior management review and approval prior to entering this condition.

Requires compensatory measures to reduce risk including contingency plans.

All entries will be of short duration.

Red Risk-significant Not entered voluntarily.

If this condition occurs, immediate and significant actions taken to alleviate the problem.

Emergent work is reviewed by shift operations to ensure that the work does not invalidate the assumptions made during the work management process. Exelons risk management procedure has been implemented at Byron Station. This procedure defines the requirements for ensuring that the PRA model used to evaluate on-line maintenance activities is an accurate model of the current plant design and operational characteristics. Plant modifications and procedure changes are monitored, assessed, and dispositioned. Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the change on the PRA assessment tool. Changes that have potential risk impact are recorded in an update requirements evaluations (URE) log for consideration in the next periodic PRA model update.

Page 47 of 52 Maintenance Rule Program The reliability and availability of the SX pumps are monitored under the MR Program. If the pre-established reliability or availability performance criteria are exceeded for the SX pumps, they are considered for 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," paragraph (a)(1) actions, requiring increased management attention and goal setting in order to restore their performance (i.e., reliability and availability) to an acceptable level. The performance criteria are risk-based and, therefore, are a means to manage the overall risk profile of the plant. An accumulation of large core damage probabilities over time is precluded by the performance criteria.

The SX pumps are all currently in the 10 CFR 50.65 a(2) MR category (i.e., the SX pumps are meeting established performance goals). Performance of the SX pump maintenance is not anticipated to result in exceeding the current established MR criteria for SX pumps.

Plant modifications and procedure changes are monitored, assessed and dispositioned.

Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by qualitatively assessing the impact of the changes on the CRMP assessment tool. Procedures exist for the control and application of CRMP assessment tools, and include a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.

Change Control The CRMP is referenced and maintained as an administrative program in the Byron Station TRM. Changes to the TRM are subject to the requirements of 10 CFR 50.59, Changes, Tests, and Experiments. The goals of a CRMP are to ensure that risk-significant plant configurations will not be inadvertently entered for planned maintenance activities, and appropriate actions will be taken should unforeseen events place the plant in a risk-significant configuration during the proposed extended SX train Completion Time.

Page 48 of 52

3.0 CONCLUSION

This request has been evaluated consistent with the key principles identified in RG 1.174 for risk informed changes to the licensing basis and demonstrates that the risk from the proposed change is acceptable small. The evaluation with respect to these principles is summarized below.

The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

This change is being requested as a change to the operating licenses for Byron Station.

The proposed change is consistent with the defense-in-depth philosophy.

The configuration to be entered decreases the redundancy of the SX system due to the removal of two of the four SX pumps from service simultaneously during the CT required to replace the 1/2SX001A valves. The reduced redundancy increases the potential for the plant to lose SX cooling to plant equipment; however, the current plant design and supporting analyses demonstrate that the plant has much more capability to prevent and mitigate a loss of SX to a unit than credited in the original plant licensing basis.

Defense-in-depth is maintained during the configuration. Compensatory measures are identified to strengthen the level of defense-in-depth and reduce overall risk.

The proposed change maintains sufficient safety margins.

The proposed TS change is consistent with the principle that sufficient safety margins are maintained based on the following:

Codes and standards (e.g., American Society of Mechanical Engineers (ASME),

Institute of Electrical and Electronic Engineers (IEEE) or alternatives approved

Page 49 of 52 for use by the NRC). The proposed change is not in conflict with approved codes and standards relevant to the SX system.

While in the proposed configuration, safety analysis acceptance criteria in the UFSAR are met, assuming there are no additional failures.

When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

A risk evaluation was performed that considers the impact of the proposed change with respect to the risks due to internal events, internal fires, seismic events and other external hazards. The evaluation of the quantitative impacts of internal event risks due to the planned configuration demonstrate that the impact on the likelihood of core damage and large early release is well below the risk acceptance guideline.

The fire evaluation determined that the impact on the likelihood of fire-related core damage is also below the risk acceptance guideline. In addition, recommended actions have been identified that further reduce the risk of the significant fire scenarios. The risk associated with seismic events and other external hazards are either not impacted by the change or are bounded by the risk from internal events.

In addition, although not required, the risk implications of the proposed change were qualitatively evaluated for the unit that will be shutdown during the evolution, consistent with Exelons risk management practices.

The performance of the planned maintenance has a long-term safety benefit to the Byron Station due to an improved reliability to isolate large SX floods using the new isolation valve. This risk reduction is not quantified, as other means of isolation currently exist, but at a minimum the replacement of the 1/2SX001A valves will provide isolation defense in depth and improved isolation reliability.

Page 50 of 52

The impact of the proposed change should be monitored using performance measurement strategies.

Exelons configuration risk management program will effectively monitor the risk of emergent conditions during the period of time that the proposed change is in effect.

This will ensure that any additional risk increase due to emergent conditions is appropriately managed.

Page 51 of 52

4.0 REFERENCES

1. Exelon Nuclear T&RM ER-AA-600-1012, Rev. 8, Risk Management Documentation

2. Exelon Nuclear T&RM ER-AA-600-1046, Rev. 4, Risk Metrics - NOED and LAR

3. Byron/Braidwood PRA Notebook, BB PRA-014, Quantification Notebook, Revision 6E1, July 2009.

4. Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, August 1998.

5. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July 1998.

6. Exelon T&RM: ER-AA-600-1031 (Revision 0), Risk Management Tools:

6.1. CAFTA, Version 5.4, Application ID EX0007798, SQA Level BB.

6.2. PRAQUANT, Version 5.1, Application ID EX0007796, SQA Level BB.

6.3. QRECOVER32, Version 2.5, Application ID EX0007806, SQA Level BB.

6.4. FORTE, Version 3.0c, Application ID EX0007326, SQA Level BB.

6.5. FORTE Users Manual, Version 3.0c, Korea Power Engineering Company, Inc. KOPEC, February 15, 2007.

6.6. HRA Calculator, Version 4.0, Application ID EX0007797, SQA Level BB.

6.7. UNCERT, Version 2.3a, Application ID EX0000208, SQA Level CC.

7. EPRI TR-105396, PSA Applications Guide, EPRI, August 1995.

8. NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants

9. NUREG-1488, Revised Livermore Seismic Hazard Estimates for Sixty-Nine Nuclear Power Plants

10. NUREG/CR-4550, Vol. 3, Revision 1, Part 3, Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events, December 1990

11. Byron Station IPEEE Report, December 1996.

12. NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities.

13. EC 341986, IPEEE Review Of Ultimate Heat Sink Security Tower Design, 5/15/03.

Page 52 of 52

14. Not used.

15. Not used.

16. Exelon Nuclear T&RM ER-AA-600-1015, Rev 009, FPIE PRA MODEL UPDATE.

17. BB-PSA-21.06, Byron/Braidwood Fire Probabilistic Risk Assessment - FPRA Summary Report, Revision 2.

18. NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, Revision 1, October 2004.

19. Exelon Nuclear T&RM ER-AA-600, Rev 005, RISK MANAGEMENT.

20. American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, Addenda RA-Sa-2003, and Addenda RA-Sb-2005, New York, December 2005.

21. Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 1, January 2007.

22. Letter from Keith R. Jury (Exelon Generation Company, LLC) to U.S. NRC, Request for a License Amendment for a One-Time Extension of the Essential Service Water Train Completion Time, dated June 11, 2003.

23. WCAP-15603, WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, Rev. 1-A, June 2003.

24. Exelon Nuclear T&RM WC-AA-101, Rev 016, ON-LINE WORK CONTROL PROCESS.

25. EPRI Fire PRA Methods Enhancements, Additions, Clarifications, and Refinements to EPRI 1019189, December 2008.

26. NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, September 2005.

27. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, March 2009.

28. BY-LAR-001, SX CT One-time Extension Application Notebook, Rev. 0, September 2009.

ATTACHMENT 6 Technical Adequacy

Page 1 of 24 1

Overview A technical Probabilistic Risk Assessment (PRA) analysis has been performed in support of the technical basis for a one-time extension of the Byron Generating Station Unit 1 SX completion time for the replacement of the 1SX001A and 2SX001A valves, as discussed in the main body of this report. This documentation provides the basis for the technical adequacy of the Byron Generating Station Units 1 and 2 PRA in support of this analysis.

This discussion follows the guidance provided in Regulatory Guide 1.200 Revision 1 [1],

An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities. The guidance in RG-1.200 indicates that the following steps should be followed to perform this study:

1.

Identify the parts of the PRA used to support the application.

o SSCs, operational characteristics affected by the application and how these are implemented in the PRA model o A definition of the acceptance criteria used for the application

2.

Identify the scope of risk contributors addressed by the PRA model.

o If not full scope (i.e. internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3.

Summarize the risk assessment methodology used to assess the risk of the application.

o Include how the PRA model was modified to appropriately model the risk impact of the change request.

4.

Demonstrate the Technical Adequacy of the PRA o Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

o Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet

Page 2 of 24 been addressed justify why the significant contributors would not be impacted.

o Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide (currently, in RG-1.200 Revision 1 this is just the internal events PRA standard). Provide justification to show that where specific requirements in the standard are not adequately met, it will not unduly impact the results.

o Identify key assumptions and approximations relevant to the results used in the decision-making process.

Items 1 through 3 are covered in the main body of the risk evaluation for this submittal.

The purpose of this documentation is to address the requirements identified in item 4 above.

2 General Discussion of Technical Adequacy of the PRA Model The Byron Generating Station, Units 1 and 2 PRA model Revision 6E is the most recent evaluation of the risk profile at Byron Generating Station Units 1 and 2 for internal event challenges. The Byron PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Byron Generating Station Units 1 and 2 PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

Exelon Generation Company (EGC) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating EGC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to Byron Generating Station Units 1 and 2 PRA.

Page 3 of 24 2.1 PRA Maintenance and Update The EGC risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the EGC Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. EGC procedure ER-AA-600-1015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating EGC nuclear generation sites. The overall EGC Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed:

Design changes and revisions to design changes are reviewed for their impact on the PRA model.

New procedures and procedure changes are reviewed for their impact on the PRA model.

New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

Equipment unavailabilities are captured, and their impact on CDF and LERF is trended.

Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities for equipment that can have a significant impact on the PRA model are updated approximately every four years.

In addition to these activities, EGC risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes:

Page 4 of 24

Documentation of the PRA model, PRA products, and bases documents.

The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

Guidelines for updating the full power, internal events PRA models for EGC nuclear generation sites.

Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)).

In accordance with this guidance, regularly scheduled PRA model updates nominally occur on an approximately 4-year cycle; longer intervals may be justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant.

The most recent update of the Byron PRA model (designated the Revision 6E model) was completed in June 2009.

2.2 PRA Self Assessment and Peer Review Several assessments of technical capability have been made, and continue to be planned, for the Byron, Units 1 and 2 PRA models. These assessments are as follows and further discussed in the paragraphs below.

Scientech conducted an independent self-assessment of the Byron PRA model in 1999, prior to the Byron PRA peer review. All significant comments from this review have been addressed.

Page 5 of 24

An independent PRA peer review of the Braidwood Station PRA model1 was conducted under the auspices of the PWR Owners Group in 1999, following the Industry PRA Peer Review process [2]. This peer review included an assessment of the PRA model maintenance and update process.

An independent PRA peer review of the Byron PRA model1 was conducted under the auspices of the PWR Owners Group in 2000, following the Industry PRA Peer Review process [2]. This peer review included an assessment of the PRA model maintenance and update process.

During 2005 and 2006 the Byron, Units 1 and 2 PRA model results were evaluated in the PWR Owners Group PRA cross-comparisons study performed in support of implementation of the mitigating systems performance indicator (MSPI) process [3]. Byron did not have any identified outliers as a result of this review.

Following the Byron PRA model update in 2007-2008, a self-assessment of the Byron PRA model against the ASME PRA Standard was performed using Regulatory Guide 1.200, Revision 1[1].

The Byron PRA model is scheduled to be peer reviewed under the auspices of the PWR Owners Group in late 2010. As part of the preparation for that review, the gap analysis is planned to be updated to reflect pertinent changes to both the PRA Standard and Regulatory Guide 1.200.

A summary of the disposition of 1999 and 2000 Industry PRA Peer Review facts and observations (F&Os) for the Byron and Braidwood, Units 1 and 2 PRA models was documented as part of the statement of PRA capability for MSPI in the Byron MSPI Basis Document [4]. As noted in that document, all significance level A & B F&Os from the 2000 PWROG peer review have been addressed. Also noted in that submittal was the fact that, after allowing for plant-specific features, there are no MSPI cross-comparison outliers for Byron (refer to the fourth bulleted item above).

1 Byron and Braidwood use a combined model, with appropriate flags to differentiate between sites/units.

Therefore, the Peer review findings for Braidwood are also applicable to Byron, and vice-versa.

Page 6 of 24 In updating the PRA to Revision 6E, changes have been made to the PRA to address several Peer Review F&Os, as well as to make other modeling improvements. Prior to the Revision 6E update, a capability assessment was performed. This was a self-assessment of the PRA capability of the model relative to the updated requirements in Addendum B of the ASME PRA Standard [5] and criteria in RG 1.200, Revision 1 [1],

including the NRC positions stated in Appendix A of Reference 1 and the clarifications in Reference 6.

A summary of the current open items including the partially resolved items is provided in attached Table 2, and further discussed in Section 3. These items will be reviewed for consideration during future model updates but are judged to have low impact on the PRA model or its ability to support a full range of PRA applications. These items are also documented in the PRA Update Requirements Evaluation (URE) database so that they can be tracked and their potential impacts accounted for in applications where appropriate.

2.3 General Conclusion Regarding PRA Capability The Byron Units 1 and 2 PRA maintenance and update process and technical capability evaluations described above provide a robust basis for concluding that the PRA is suitable for use in risk-informed licensing actions. As specific risk-informed PRA applications are performed, remaining gaps to specific requirements in the PRA standard are reviewed to determine which, if any, would merit application-specific sensitivity studies in the presentation of the application results.

Page 7 of 24 3

PRA Technical Adequacy Considerations Specific to the One-Time SX Completion Time Extension Application for Replacement of the 1SX001A and 2SX001A Valves As indicated previously, RG-1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated into the PRA model, relevant peer review findings, consistency with applicable PRA Standards, and the identification of key assumptions) will be discussed in turn.

3.1 Plant Changes Not Yet Incorporated into the PRA Model A PRA updating requirements evaluation (URE-EGC PRA model update tracking database) is created for all issues that are identified that could impact the PRA model.

The URE database includes the identification of those plant changes that could impact the PRA model. As part of the 6E model update, plant modifications since the last update were reviewed to determine need for incorporation into the model. A review of the current open items in the URE database indicated that there are only a few items that have not been dispositioned as not having PRA impact. A summary of plant changes that have not yet been addressed relative to the PRA (i.e., either incorporated into the model or determined to require no change to the model) is listed below, along with an assessment of the impact on this LAR.

Page 8 of 24 TABLE 1 IMPACT OF PLANT CHANGES SINCE THE LAST UPDATE ON THE BYRON PRA MODEL URE NUMBER PLANT CHANGE IMPACT ON THE BYRON PRA BB-0742 Addition of alternate cooling water line for 2A SX cubicle cooler - EC 361665 This plant change has not been addressed in the PRA model. A review of this modification will be incorporated with the internal flooding analysis revision to be completed in 2009. This PRA model addition will add flexibility in the ability to provide cooling to the SX pumps. The addition to the PRA model would be expected to reduce the base CDF. No significant impact to the results or conclusions for this LAR are expected.

BB-0682 EC 368859 (368861) - Modify U1 (U2) RWST Level Xmtr Drain line 1(2)SI99F-1/2 -

Replaces Check Vlv with Manual Vlvs This plant change has not been addressed in the PRA model. The impact of this would be to the pre-initiator portion of the HRA, and is expected to be small, as this would be a local failure mode and does not introduce new CCF failure potential.

No significant impact to the results or conclusions for this LAR are expected.

BB-0680 Byron EC 371347 / Braidwood EC 375726 -

VA Bypass Damper Closure Circuit and Fan SI/EDG Trip Modification This plant change has not been addressed in the PRA model. The addition of this logic to the Charcoal Bypass damper logic is expected to have only a small impact on the base model results. No significant impact to the results or conclusions for this LAR are expected.

BB-0629 EC 366121 & 366122 Installation of Additional Check Valve in SX makeup lines This plant change has not been addressed in the PRA model. As it adds additional failure protection (resulting in 2 check valves in series), the impact on the PRA model would be a reduction in base CDF.

No significant impact to the results or conclusions for this LAR are expected.

Page 9 of 24 3.2 Applicability of Peer Review Findings and Observations Several assessments of technical capability of the Byron Generating Station Units 1 and 2 PRA have been made, as summarized in Section 2.2. In addition, such assessments continue to be planned. Pertinent results of these assessments are discussed in the paragraphs below.

The most recent gap analysis defined a list of supporting requirements from the Standard for which potential gaps to Capability Category II of the Standard were identified. For each such potential gap, a PRA updating requirements evaluation (URE) was documented for resolution.

In updating the PRA since the gap analysis, changes were made to the PRA to address some of the identified gaps, as well as to address other open UREs. Currently, there are 9 identified gaps2, which affect a larger number of Supporting Requirements (SR) in the PRA Standard [5], as noted in Table 2. However, the number of gaps and number of affected SR are not by themselves indicators of PRA capability. For Gap #4, for example, while there are 19 associated SR, the impact for most applications is not significant, as the approach used for the LERF analysis is based on a conservative approach recognized by NRC. The remaining gaps will be reviewed for consideration in future model updates but are judged to have low impact on the PRA model or its ability to support a full range of PRA applications. For example, four of the gaps (1, 3, 6, 8) are documentation issues rather than PRA model capability issues which are being addressed as resources permit. These remaining gaps are documented in the URE database so that they can be tracked and their potential impacts accounted for in applications where appropriate. The gaps related to consideration of model uncertainties are addressed for the PRA in Attachment 7, and explicitly for this LAR in Section 3.4 through 3.6.

2 Several of the identified gaps are similar and could be combined.

Page 10 of 24 3.3 Consistency with Applicable PRA Standards As noted above, the PRA has been reviewed against the requirements in Addendum B of the PRA Standard [5], the criteria in RG 1.200, Revision 1 including the NRC positions stated in Appendix A of RG 1.200, Revision 1 [1] and further issued clarifications [6]. The results of the most recent review lead to the identified gaps, and associated supporting requirements, listed in Table 2 as not meeting Category II in the PRA model used for this assessment. An assessment of the impact for this application of not meeting Capability Category II for these SRs is summarized in Table 2.

Page 11 of 24 TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD DESCRIPTION OF GAP APPLICABLE SRS CURRENT STATUS /

COMMENT IMPORTANCE TO APPLICATION 1

DOCUMENT the significant contributors (such as initiating events, accident sequences, basic events) to CDF in the PRA results summary. PROVIDE a detailed description of significant accident sequences or functional failure groups.

QU-F3 The PRA Summary notebook and related documentation will provide the types of information required, but the update to the documentation has not been finalized.

None. This is a documentation issue. The PRA models, on which the LAR assessment is based, capture all significant contributors.

2 Include an assessment of the significance of assumptions on the quantitative results.

QU-F4 Identification of key assumptions is application specific. An assessment of important PRA modeling assumptions has been performed for the base internal events at power model, and is discussed in Attachment 7, based on application of the approach specified in NUREG-1855 [7] and EPRI TR-1016737 [8]. discusses potential key assumptions and sources of model uncertainty relevant to this application.

3 DOCUMENT the quantitative definition used for significant basic event, significant cutset, and significant accident sequence.

QU-F6 Open - Definition of significant needs to be added to the quantification documentation.

Exception to the RA-S-2002 definition is not taken, but not all significant contributors are explicitly addressed in the documentation.

None. This is a documentation issue. The PRA models, on which the LAR assessment is based, capture all significant contributors.

Page 12 of 24 TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD DESCRIPTION OF GAP APPLICABLE SRS CURRENT STATUS /

COMMENT IMPORTANCE TO APPLICATION 4

The LERF analysis is based on the NUREG/CR-6595 methodology. As such, it represents a generally conservative, simplified approach. The noted SRs meet the Capability Category I criteria.

LE-B1 LE-B2 LE-C1 LE-C2a LE-C2b LE-C3 LE-C4 LE-C8a LE-C9a LE-C10 LE-D1a LE-D1b LE-D2 LE-D4 LE-D5 LE-E2 LE-E3 LE-F1a LE-G3 Open - There are no current plans to upgrade the LERF model.

Not significant. Given the conservative nature of the NUREG/CR-6595 approach used, the LERF results are believed to also be conservative relative to this application. Further, there are no Level 2 phenomenological issues introduced by the configuration required for the SX Completion Time extension that would require additional LERF model capability.

5 characterize LERF uncertainties consistent with the applicable requirements of Tables 4.5.8-2(d) and 4.5.8-2(e).

LE-F3 Open - A formal evaluation of uncertainties in the LERF model has not been performed.

However, since the NUREG/CR-6595 consensus modeling approach has been used, the results are understood to be conservative.

Not significant. Given the conservative nature of the approach used, formal consideration of uncertainties in the LERF modeling has no significant impact on this application. Further, there are no Level 2 phenomenological issues introduced by the configuration required for the SX Completion Time extension that would introduce significant uncertainties into the results.

Page 13 of 24 TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD DESCRIPTION OF GAP APPLICABLE SRS CURRENT STATUS /

COMMENT IMPORTANCE TO APPLICATION 6

Addendum B of the ASME PRA Standard [5]

added SRs to document the quantitative definition used for significant basic event, significant cutset, significant accident sequence, and significant accident progression sequence in the CDF and LERF analysis.

QU-F6 LE-G6 Open - These new SRs will be addressed during the next full PRA model update, but providing these definitions should not have an impact on the quantitative results from the PRA model.

None. This is a documentation issue. Changes to the model are not required to address this item.

The PRA models, on which the LAR assessment is based, capture all significant contributors.

7 Several SRs associated with treatment of model uncertainty and related model assumptions have been recently redefined.

NRC has issued [6] a clarification to its endorsement of the PRA Standard. NRC and EPRI have prepared guidance on an approach to meet these new requirements.

QU-E1 QU-E2 QU-E3 QU-E4 QU-F4 IE-C13 IE-D3 AS-C3 SC-C3 SY-C3 HR-G9 HR-I3 DA-D3 DA-E2 DA-E3 IF-F3 LE-E4 LE-F2 LE-F3 LE-G4 Identification of key assumptions is application specific. An assessment of important PRA modeling assumptions has been performed for the base internal events at power model, and is discussed in Attachment 7, based on application of the approach specified in NUREG-1855 [7] and EPRI TR-1016737 [8]. discusses uncertainties, including parameter uncertainty, completeness uncertainty, and potential key assumptions and sources of model uncertainty. Section 3.4 discusses parameter uncertainty relative to this application; Section 3.5 discusses model uncertainty relative to this application; and Section 3.6 discusses completeness uncertainty relative to this application.

Page 14 of 24 TABLE 2 STATUS OF IDENTIFIED BYRON PRA GAPS TO CAPABILITY CATEGORY II OF THE ASME PRA STANDARD DESCRIPTION OF GAP APPLICABLE SRS CURRENT STATUS /

COMMENT IMPORTANCE TO APPLICATION 8

Model documentation needs to be revised to reflect the current model (6E)

AS-C2 DA-C6 DA-C10 DA-D4 IE-C10 IF-C2 IF-C2c IF-D7 IF-E3a IF-F1 IF-F2 QU-F6 SC-A1 SC-B5 SC-C2 SY-A4 SY-C1 SY-C2 Open - Appropriate documentation is being revised to reflect Rev 6E None. This is a documentation issue. The PRA model, on which the LAR assessment is based, has been approved.

9 Plant Specific MOV (or AOV) failure data was not collected for further analysis.

DA-C3 Open - There are no current plans to develop plant specific data for MOVs and AOVs The Byron Risk profile is generally driven by common cause, human error and pump related basic events. Inclusion of plant specific MOV/AOV data is expected to have a negligible impact on the results. For the SX CT extension application, which is focused on delta-CDF and does not affect MOV or AOV reliability, this gap is not important.

Page 15 of 24 3.4 Discussion of Parameter Uncertainty for the SX Completion Time Extension LAR The Byron PRA Uncertainty Assessment, Attachment 7, Section 1.1, discusses the approach used to evaluate the potential impact of parameter uncertainty on the Byron PRA results. As there is not currently capability to quantitatively characterize the parameter uncertainty for the PRA results, the approach taken in the Uncertainty Assessment for the baseline PRA is to examine the CDF and LERF cutsets in detail to identify cutsets with basic events whose failure probabilities are derived from the same parameters (e.g., same failure rate/demand probability), thereby subject to the effect of epistemic correlation. If not, then the point estimate of the risk metric provides a reasonable representation of the mean value, suitable for use in risk-informed decision-making. As noted in the Uncertainty Assessment, for the baseline PRA, it is concluded that the effects of epistemic correlation are small and it is reasonable to use the point estimate of the CDF risk metric as representative of the mean value.

For the SX Completion Time Extension application, the same exercise described in the Uncertainty Assessment has been performed on the results of the application. For this application, 2.4% of the application specific CDF is from cutsets subject to the epistemic correlation. Additionally, a similar examination identified that application-specific LERF cutsets subject to the epistemic correlation contribute about 1.3% to the application specific LERF.

The epistemic correlation contributions to the delta-CDF and delta-LERF were also examined by reviewing the cutsets that represent delta-CDF and delta-LERF between the baseline cutsets and the application specific cutsets. This examination showed that the epistemic correlation contributes 2.7% in the delta CDF, and 1.9% in the delta LERF. The highest frequency cutset subject to

Page 16 of 24 impact of epistemic correlation occurs at the 50th CDF cutset (139th LERF cutset) in the application specific results.

The above results support a conclusion that the impact of epistemic correlation is sufficiently small for the application specific CDF (and LERF) and delta-CDF (and delta-LERF). Therefore, for this application, it is reasonable to use the point estimate of the CDF risk metric as representative of the mean value, as stated in Section 4.1.2, Step 4 (CC II) of NUREG 1855 [7].

3.5 Identification of Key Assumptions and Key Sources of Model Uncertainty discusses the consideration of sources of uncertainty in the base model PRA. These sources are summarized in section 4 of Attachment 7 and are repeated in Table 3 for consideration in this application.

Following the guidance in EPRI TR-1016737 [8], a further review of those portions of the PRA relevant to this application has been performed to identify additional candidate sources of model uncertainty and related assumptions.

Several additional potential key assumptions / potential key sources of model uncertainty for this application were identified, as listed below and further discussed in the following paragraphs. This discussion is followed by the assessment of base PRA sources of model uncertainty relative to this application.

Potentially Key Assumption 1: Operator action dependence between SX crosstie action and operator action to align alternate cooling to CV pumps using FP system Potentially Key Assumption 2: Operator action dependence between SX crosstie action and operator action to align cool suction source to CV pumps from RWST

Page 17 of 24 Potentially Key Assumption 3: SX pump failure to run data impact on LAR sensitivity Potentially Key Assumption 4: Success criteria assumed to require only one pressurizer PORV when CV pump(s) are available for bleed and feed operation Discussion of Potentially Key Assumption 1 The Byron PRA model assumes high dependency between the SX crosstie action (basic event 0SX-XTIE---HMVOA) and FP-PRI-7 operator actions (basic event PRI-7X-HMVCA); basic event 1FP-PRI-7X-HMVCA is set to 0.51 in the base PRA model to reflect this high dependency. With the proposed compensatory measure to have a dedicated SX operator familiar with the associated procedures for the duration of 1/2SX001A valve replacements, the dependency between these two operator actions can be reduced and a low dependence used in the LAR calculation. This is modeled by setting basic event 1FP-PRI-7X-HMVCA to 0.051. This change is reflected in the base case analysis results for the LAR. Although this is potentially a key assumption for the LAR, it is judged to not be a key model uncertainty, as the modeling reflects the condition that will exist during the extended SX completion time and has been performed using HRA methods consistent with those used in the PRA.

Discussion of Potentially Key Assumption 2 The Byron PRA model does not consider the dependency between the SX crosstie action (0SX-XTIE---HMVOA) and the operator action to align the CV pump to a cool suction source from the RWST (basic event 1CV-ALL----HPMOA) given a loss of CCW cooling to the CV pump (this is documented in URE-783).

The SX crosstie action is based on 1BOA PRI-7 and takes its initial cue from LOSX indications. The operator action to align a cool suction source from RWST is based on 1BOA PRI-6, Step 1a RNO where the initial cue is provided by CC

Page 18 of 24 surge tank level < 13%. There is no direct procedural dependence between these two actions, but the time windows may be overlapping since LOSX will lead to loss of CCW. Therefore, upon reviewing the dependence between these two actions, it was determined that a medium dependence should be (but is not currently) assigned between the two actions in the base PRA model. However, for the duration of the 1/2SX001A valve replacements, the proposed compensatory measure to have a dedicated SX operator familiar with the associated procedures substantially eliminates this analytical dependence.

Thus, the model appropriately reflects the plant configuration planned for the extended SX completion time. Although this is potentially a key assumption for the LAR, it is judged to not be a key model uncertainty.

Discussion of Potentially Key Assumption 3 The Byron PRA model uses support system initiating fault trees to estimate both dual unit loss of SX (DLSX) and single unit loss of SX (LOSX) frequencies. One of the key contributors to these initiators is SX pump failure to run (SX PM FR) data and its associated common cause failure terms. Therefore, the upper bound (95th percentile) of SX PM FR data was estimated (i.e., 1.01E-05/hr) and used to recalculate both the DLSX and LOSX initiators using the support system initiating event fault trees. The upper bound frequency for DLSX was determined to be 1.9E-03 and the upper bound frequency for LOSX was determined to be 9.9E-02. A sensitivity case on the base average CDF using these values resulted in a CDF increase of 7%. Although this increases the SX LAR internal events results by a factor of 3.7 (i.e., ICCDP of 4.8E-7 as compared to the base LAR case ICCDP of 1.3E-7), the internal events risk remains small and the ICCDP remains within the regulatory limits. Since there is nothing associated with the 1/2SX001A repairs that would affect SX pump reliability, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

Page 19 of 24 Discussion of Potentially Key Assumption 4 The success criteria for the Byron PRA model provide the bases for requiring one pressurizer PORV to open during bleed and feed operation if CV pump(s) are available for the feed operation, whereas both PORVs are required if only SI pump(s) are available. A sensitivity analysis was performed in which both PORVs are assumed to be required even for the case with CV pump(s) operating. The sensitivity results show that the base average CDF would increase by 73% with this requirement, but the SX LAR results would increase by only 23%, i.e.,

sensitivity ICCDP of 2.2E-7 as compared to LAR ICCDP of 1.3E-7. Thus, the internal events risk would remain small and the ICCDP remains well within the regulatory limits even with the alternative PORV assumption for bleed and feed.

Since there is nothing associated with the 1/2SX001A repairs that would affect PORV reliability or CV or SI pump reliability, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

In support of the PRA analyses for Byron Units 1 and 2 for this application using the Revision 6E PRA model, the remaining gaps to the PRA standard and open UREs have been reviewed to determine which, if any, would merit application-specific sensitivity studies in the presentation of the application results. The result of this assessment concluded that the following additional sensitivity studies are merited.

Timing of Operator Action to Trip RCPs on Loss of Seal Cooling The Byron PRA model implemented the consensus WOG 2000 RCP Seal LOCA model. The WOG 2000 model assumes the RCPs must be stopped in a timely fashion to avoid catastrophic seal damage. In the Byron PRA, the action to trip the RCPs (i.e., basic event 1RC-PMTRIP-HSYOA - OPERATOR FAILS TO TRIP RCP ON LOSS OF SEAL INJECTION) is assumed to have a maximum

Page 20 of 24 time of 30 minutes available to trip the RCPs in order to prevent a consequential RCP seal LOCA greater than 21gpm/pump. The 30 minute time window is inconsistent with the NRC SER on the WOG2000 model in which NRC claims a 13 minute available time (see URE-723). Therefore, as a sensitivity, the HEP for 1RC-PMTRIP-HSYOA was re-estimated using a 13 minutes time window. The revised HEP for the sensitivity is 2.7E-02 whereas the base PRA value is 1.4E-

03. The sensitivity analysis show that there is no measurable change to the base PRA results. As such it is judged that this assumption would not change the conclusions from this risk assessment.

Evaluation of Base Model Sources of Uncertainty provides a list of eight sources of uncertainty for the Byron Base PRA model in Section 4, Summary. The evaluation of the impact of these uncertainty sources on the risk assessment results being used to support the LAR is provided in Table 3 below.

Table 3 LAR Impact Evaluation of Base Model Uncertainty Sources Source of Uncertainty Impact Evaluation Timing of action to trip Reactor Coolant Pumps given a loss of RCP seal cooling/injection The impact of this source of uncertainty is described in the discussion above on "Timing of Operator Action to Trip RCPs on Loss of Seal Cooling. The sensitivity performed to evaluate the impact from this source showed a negligible impact on the base CDF results. As such it is judged that this assumption would not change the conclusions from this risk assessment.

PORV success criteria for bleed and feed operation The impact from this source is evaluated under the "Discussion of Potentially Key Assumption 4. As stated above, the sensitivity ICCDP results remain well below the regulatory thresholds. Since there is nothing associated with the 1/2SX001A repairs that would affect PORV reliability or CV or SI pump reliability, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

Page 21 of 24 Table 3 LAR Impact Evaluation of Base Model Uncertainty Sources Source of Uncertainty Impact Evaluation Internal flood initiating event frequencies and failure modes The impact of the uncertainty associated with the Internal Flooding frequencies is applied to the base PRA model and LAR configurations in the same manner. Since there is nothing associated with the 1/2SX001A repairs that would affect the Internal Flooding frequencies or failure modes, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

ISLOCA frequencies The impact of the uncertainty associated with the ISLOCA frequencies is applied to the base PRA model and LAR configurations in the same manner.

Since there is nothing associated with the 1/2SX001A repairs that would affect the ISLOCA frequencies, it is judged that this source of uncertainty does not change the conclusions from this risk assessment.

Human error probability values As discussed in Attachment 7, section 3, a sensitivity study was performed by setting the Human Error Probabilities at their 5th and 95th percentile values.

The 95th percentile values show an increase factor of 1.3 for base CDF and 1.5 for base LERF values. As similar results would be seen in the LAR specific configuration, the net impact of this uncertainty is negligible.

Common cause failure values As discussed in Attachment 7, section 3, a sensitivity study was performed by setting the Common Cause Failure probabilities at their 5th and 95th percentile values. The 95th percentile values show an increase factor of 1.3 for base CDF and 1.2 for base LERF values. As similar results would be seen in the LAR specific configuration, the net impact of this uncertainty is negligible.

Page 22 of 24 Table 3 LAR Impact Evaluation of Base Model Uncertainty Sources Source of Uncertainty Impact Evaluation The modeling of CC, CV and SX pump alignments, of which only one train is assumed to be running While identified as a source of uncertainty, the impact of this source is mitigated for the CC and CV pumps by the identification of specific components as being considered Protected Equipment for the duration of the SX valve repair activities. For the SX pumps, the remaining pumps will be in-service providing heat removal capability to the on-line and shutdown units. Additional compensatory actions, specified in the LAR, are provided to address reducing the likelihood of induced SX failure from internal and external (i.e. Fire) events and in providing enhanced likelihood of success in the performance of operator actions intended to mitigate a loss of SX.

Based on the implementation of these compensatory actions, the impact of this source is expected to be negligible.

The modeling of SX Cooling Tower Fans and the associated riser valves configurations Operations personnel routinely shift the configuration of the running SX Cooling Tower Fans and associated riser valves. This action is performed to maintain SX water temperature within prescribed operational bands for optimal equipment performance. Any unavailability of a Fan or riser valve is addressed through the station Configuration Risk Management Program. The PRA model provides basic events (including common cause failure) for the failure modes of the Fans and riser valves.

The impact from this source is expected to be negligible based on the planned station configuration of having Unit 2 in a cold shutdown condition and the implementation of compensatory actions (Protected Equipment) as identified in Table 3 of the LAR.

3.6 Discussion of Completeness Uncertainty for the SX Completion Time Extension For the SX LAR completion time extension application, consideration has been given to both internal and external hazards. Risks from internal events at power,

Page 23 of 24 internal flooding, internal fire, and seismic and other external events have been considered. Model completeness is not a significant source of uncertainty for this application.

4 Conclusion Regarding PRA Capability for SX Completion Time Extension Application The Byron Units 1 and 2 PRA models are suitable for use in this application. This conclusion is based on:

The PRA maintenance and update processes in place,

The PRA technical capability evaluations that have been performed and are being planned, and

The application-specific considerations, as noted above, that demonstrate the relatively limited sensitivity of the application results and conclusions to those PRA attributes that do not meet ASME PRA Standard Capability Category II.

Page 24 of 24 5

References

[1]

Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 1, January 2007.

[2]

Nuclear Energy Institute, Industry PRA Peer Review Process, NEI-00-02, January 2000.

[3]

Westinghouse Owners Group, Mitigating Systems Performance Index Cross Comparison (PA-RMSC-0209), WCAP-16464-NP, Revision 0, August 2005.

[4]

Byron MSPI Basis Document, BY-MSPI-001, Revision 3, June 2009.

[5]

American Society of Mechanical Engineers, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, Addenda RA-Sa-2003, and Addenda RA-Sb-2005, New York, December 2005.

[6]

U.S. Nuclear Regulatory Commission Memorandum to Michael T. Lesar from Farouk Eltawila, Notice of Clarification to Revision 1 of Regulatory Guide 1.200, for publication as a Federal Register Notice, July 27, 2007.

[7]

NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, USNRC, March 2009.

[8]

Electric Power Research Institute, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI TR-1016737, Palo Alto, CA, November 2008

ATTACHMENT 7 Uncertainty Assessment

Page 1 of 33 Characterizing the Sources of Model Uncertainty for the Byron and Braidwood PRAs

1. Overview The intent of this attachment is to show a complete model uncertainty issue characterization assessment for the Byron/Braidwood internal events at power PRAs.

The incorporation of this information into the PRA model documentation is intended to be sufficient to meet the ASME/ANS PRA Standard Supporting Requirements listed below as defined in the ASME/ANS PRA Standard [1].

QU-E1: IDENTIFY sources of model uncertainty.

QU-E2: IDENTIFY assumptions made in the development of the PRA model.

QU-E4: For each source of model uncertainty and related assumption identified in QU-E1 and QU-E2, respectively, IDENTIFY how the PRA model is affected (e.g.,

introduction of a new basic event, changes to basic event probabilities, change in success criterion, introduction of a new initiating event)

QU-F4: DOCUMENT the characterization of the sources of model uncertainty and related assumptions (as identified in QU-E4).

LE-F3: IDENTIFY and CHARACTERIZE the LERF sources of model uncertainty and related assumptions, consistent with the requirements of Tables 2.2.7-2(d) and 2.2.7-2(e).

IE-D3, AS-C3, SC-C3, SY-C3, HR-I3, DA-E3, LE-G4, and IF*-B3: DOCUMENT the sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2 [or LE-F3]) associated with [each element].

There are two main purposes of the characterization of uncertainty for a PRA. One is to determine that, where point estimates of CDF and LERF are used in lieu of calculation of the true mean, as is typically done to optimize the quantification process, the point

Page 2 of 33 estimate provides a reasonable representation of the true mean such that it is reasonable to make decisions based on the point estimate. The other purpose is to characterize the sources of model uncertainty and associated assumptions which may have the potential to affect the results, to determine that reasonable alternative assumptions, if available do not affect the decision.

1.1 Parametric Uncertainty NUREG-1855 [12] provides the following guidance on parametric (parameter) uncertainty.

Parameter uncertainty relates to the uncertainty in the computation of the input parameter values used to quantify the probabilities of the events in the PRA logic model. Examples of such parameters are initiating event frequencies, component failure rates and probabilities, and human error probabilities. These uncertainties can be characterized by probability distributions that relate to the analysts degree of belief in the values of these parameters (which could be derived from simple statistical models or from more sophisticated models). As part of the risk-informed decisionmaking process, the numerical results (e.g.,

CDF) of the PRA, including their associated parameter uncertainty, are compared with the appropriate decision criteria or guidelines. The uncertainties on the input parameters need to be combined in an appropriate manner to provide an assessment of this type of uncertainty on the PRA results. An important aspect of this propagation is the need to account for what has been called the state-of-knowledge correlation (SOKC) or epistemic correlation. This concern arises when the same parameter (including its uncertainty) is used to quantify the probabilities of two or more basic events. Most of the PRA software in current use has the capability to propagate parameter uncertainty through the analysis, taking into account the SOKC to calculate the probability distribution for

Page 3 of 33 the results of the PRA. In some cases, however, it may not be necessary to consider the SOKC.

It is also stated in NUREG-1855 that the primary issue with parameter uncertainty is its effect on the calculation of the mean, and specifically, on the relevance and significance of the state-of-knowledge correlation. The NUREG also notes that the state of knowledge correlation (SOKC), also referred to as the epistemic correlation, is the correlation between the estimates of the parameters of some basic events of the model. When evaluating the PRA model to assess a risk metric or an intermediate value, such as the frequency of an accident sequence, this occurs because, for basic-event models employing the same parameters, the state of knowledge about these parameters is the same. In other words, the events are not independent but are related to each other. If the epistemic correlation is ignored, the metrics mean value and uncertainty may be underestimated.

One of the current Byron PRA gaps to the ASME/ANS PRA Standard [1] is the treatment of uncertainty. In part due to the complexity of the model and associated quantification process, a complete capability to address parameter uncertainty quantitatively has not been maintained. This is planned to be addressed in future model updates.

An assessment of the potential for impact of the SOKC on the baseline PRA results has been made, consistent with available guidance in NUREG-1855 [12] and the EPRI report [2], for the baseline PRA. This same approach can be used with regard to application-specific results.

Section 2.4 of the EPRI report provides an approach for examining the impact of SOKC on parameter uncertainty. In that approach, the cutsets of the PRA model of the application can be reviewed to establish whether the risk metric used for the application is determined by cutsets that involve basic events with epistemic correlations. If not, then the point estimate of the risk metric can be used instead of the mean value.

Page 4 of 33 Section 2.4 of the EPRI report also presents two guidelines if the parameter uncertainty of a risk metric of a PRA application has to be provided for decisionmaking. The first guideline requires demonstrating that the probability distribution is not expected to significantly change (e.g., because the significant contributors for the application do not involve correlated basic events) from the base-model probability distribution. If this condition is satisfied, the base-model probability distribution is used for the application.

The following review was performed. The cutsets for baseline CDF were examined in detail to identify cutsets with basic events whose failure probabilities are derived from the same parameters (e.g., same failure rate/demand probability). This examination identified that cutsets subject to the epistemic correlation contribute about 1.1% in the baseline CDF. Additionally, a similar examination identified that cutsets subject to the epistemic correlation contribute about 0.9% in the baseline LERF. These contributions do not represent the potential to have a significant impact on the mean. The highest frequency cutset subject to impact of epistemic correlation occurs at the 43rd CDF cutset (128th LERF cutset) in the baseline results. These results support a conclusion that the epistemic correlation has low significance in both the baseline CDF and LERF.

Therefore, it is reasonable to use the point estimate of the CDF risk metric as representative of the mean value, as stated in Section 4.1.2, Step 4 (CC II) of NUREG-1855 [12]. For applications of the PRA, these results should be confirmed to be applicable to the particular decision metrics and results.

1.2 Completeness Uncertainty The PRA used to support risk-informed decisions should be of sufficient scope and level of detail to support the decision under consideration. For each application, it is necessary to determine the appropriate scope of the model (e.g., internal events at power, internal flooding, internal fires, seismic risk, and other external events) that needs to be applied. Given that appropriate risk contributors are addressed in the risk impact determination, completeness uncertainty can be assumed to be small.

Page 5 of 33 1.3 Model Uncertainty In this attachment, for each applicable model uncertainty item that was shown in Appendix A of the EPRI report [2] (i.e. in Table A-1 of [2]), a plant-specific issue characterization and assessment is provided to fully satisfy the related supporting requirements. Table 1 in this attachment illustrates the implementation of this process where the specific supporting requirements that are being treated are clearly identified.

This includes the supporting requirements listed above as well as those supporting requirements for documenting the sources of model uncertainty and related assumptions associated with each element (IE-D3, AS-C3, SC-C3, SY-C3, HR-I3, DA-E3, LE-G4, and IF*-B3).

In addition to the assessment for the generic list of candidate model uncertainties, an assessment of plant-specific features and modeling approaches is performed to determine if additional sources of model uncertainty and related assumptions should be incorporated into the list. This assessment is summarized in Section 2 with the results of the plant-specific identified items incorporated into Table 2 with the same structure as the generic list of items shown in Table 1.

The discussion of the standard sensitivity cases recommended in Section 3 and Appendix A of the EPRI report [2] for HEPs and CCF values is provided in Section 3. In accordance with the methodology in the EPRI report [2], these issues were identified as generic high level sources of modeling uncertainty rather than trying to identify all potential sources of model uncertainty associated with these issues since they are generally understood and accepted as areas of uncertainty that can be significant contributors to CDF and LERF.

Finally, Section 4 summarizes the findings from the implementation of the process for characterizing the sources of model uncertainty for the Byron/Braidwood PRA.

Page 6 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment Initiating Event Analysis (to support meeting IE-D3)

EPRI data thru the end of 2001 is utilized for the prior LOOP initiating event frequency. A Bayesian update of this value with industry data from 2002-2003 is utilized to obtain a total LOOP frequency.

1) The generic industry data is applicable to both sites and appropriate to use as a prior distribution. The more recent (2002-2003) data is sufficient to perform the Bayesian update process.

1) The LOOP initiator frequency is apportioned into the four causal factors in the model with a percentage assigned to each category.

The industry wide data in the EPRI reports covering 1980-2003 is utilized to develop the failure to recovery probabilities for four LOOP categories.

However, the weighted average failure to recovery probability (from all causes) is utilized for the applicable time frames in the model.

2) The industry wide recovery data is applicable to both sites and the weighted average from the four causal factors is acceptable for the base case analysis.

2) LOOP recovery failures are included for 4.0 and 24.0 hours0 days 0 hours 0 weeks 0 months from sequence initiation depending on the accident sequence progression.

The total LOOP frequency utilized in the model of 2.9E-2/yr is same as the Byron/Braidwood-specific value of 2.9E-2/yr reported in NUREG/CR-6890 [3].

This should not be a source of model uncertainty in most applications.

1. Grid stability Recently the stability of at least some local areas of the electric power grid has been questioned. The potential duration and complexities of recovery from such events are hard to dismiss. Three different aspects relate to this issue:

1a. LOOP Initiating Event Frequency 1b. Conditional LOOP Frequency 1c. Availability of dc power to perform restoration actions LOOP sequences including consequential LOOP sequences The consequential LOOP failure probabilities are derived consistent with the NRC recommended generic values [3] of ~2E-3 and ~2E-2 given a reactor trip or LOCA, respectively.

3) The use of generic data for consequential LOOP events is assumed to be applicable for both sites and the consequential LOOP events are assumed to be similar to other loss of grid events.

3) The loss of grid LOOP recovery failure data is utilized for the consequential LOOP event sequences.

The consequential LOOP probabilities utilized provide a reasonably realistic modeling with slight conservative bias. As such, this should not be a source of model uncertainty in most applications.

Page 7 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment Offsite power restoration is dictated by procedure.

Restoration is possible as the switchyard has its own 125V dc distribution system to provide breaker and transformer control power.

4) When offsite power is available at the switchyard, then power is available to charge the batteries needed for breaker control to align power to the site. The specific failure modes of the offsite restoration are implicitly included via the use of the generic LOOP recovery probabilities.

4) No additional adjustments or system model changes are incorporated when using the different LOOP recovery probabilities.

Available recovery times are conservatively chosen to account for restoration time uncertainty.

Realistic with slight conservative bias on the recovery times utilized. This should not be a source of model uncertainty in most applications.

Support System Initiating Event fault trees are developed for loss of CC, loss of SX, and loss of WS.

1) The loss of support system success criteria are developed consistent with the post-trip configuration requirements (e.g. 1 of 2 SX pumps) and mission time requirements (i.e. 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months MTTR assumed consistent with the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mitigation mission time).

1) For the standby contributors in the support system initiating event, the same basic events are utilized in the SSIE fault tree and in the mitigation fault tree.

Realistic with slight conservative bias because MTTR is typically less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . This should not be a source of model uncertainty in most applications.

2. Support System Initiating Events (SSIEs)

Increasing use of plant-specific models for support system initiators (e.g. loss of SW, CCW, or IA, and loss of ac or dc buses) have led to inconsistencies in approaches across the industry. A number of challenges exist in modeling of support system initiating events:

2a. Treatment of common cause failures 2b. Potential for recovery Support system event sequences 2a) The CCF for the fail-to-run terms is based on annualized mission times using generic alpha factors, but with plant-specific information for the independent failure rate.

2a) The use of the generic alpha factors based on industry wide experience is applicable for the site.

2a) The fail-to-run CCF terms dominate the overall contribution to the SSIE frequency evaluation.

Slight conservative bias treatment since alpha factors are known to be high when utilized in an annualized fashion and compared to plant-specific experience.

This should not be a source of model uncertainty in most applications.

Page 8 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment 2b) Modeling of recovery to prevent support system initiating events is limited to procedurally-directed alignments of standby equipment given failure of running equipment, if such alignments can be accomplished prior to loss of the support system. No additional credit for recovery beyond system failure is modeled.

2b) The lack of credit for recovery from the support system initiating events will not significantly impact the CDF and LERF distribution.

2b) There are no basic events included in model for recovery from the loss of support system initiators.

Slight conservative treatment since credit for recovery could reduce the baseline CDF and LERF risk metrics. This should not be a source of model uncertainty in most applications.

3. LOCA initiating event frequencies It is difficult to establish values for events that have never occurred or have rarely occurred with a high level of confidence. The choice of available data sets or use of specific methodologies in the determination of LOCA frequencies could impact base model results and some applications.

LOCA sequences The pipe break portion of the LOCA initiating event frequencies are based on a pipe segment count and per segment failure probabilities from NUREG/CR-1829 [4] and NUREG/CR-5750 [5]. The component rupture portion of the LOCA initiating event frequencies are based on the component rupture data and methodology utilized in the NUREG/CR-5750.

1) The use of generic data from the NUREG studies is generally applicable to both sites.

1) In general, the LOCA frequencies are higher than those reported in more recent studies (e.g.

NUREG-6928 [6]).

Therefore, a slight conservative bias in the LOCA initiating event frequencies might be present.

The LOCA frequency values represent a slight conservative treatment. This should not be a source of model uncertainty in most applications.

Accident Sequence Analysis (to support meeting AS-C3)

Page 9 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

4. Operation of equipment after battery depletion Station Blackout events are important contributors to baseline CDF at nearly every US NPP. In many cases, battery depletion may be assumed to lead to loss of all system capability. Some PRAs have credited manual operation of systems that normally require dc for successful operation (e.g. turbine driven systems such as RCIC and AFW).

Credit for continued operation of these systems in sequences with batteries depleted (e.g. long term SBO sequences)

No credit is taken for continued operation of any systems without dc power that normally require dc power for operation. This includes SG level control.

1) Operation of systems without dc that normally require dc for operation is not readily viable.

1) Systems that normally require dc for operation are not credited for continued operation upon battery depletion in the event sequence modeling.

No credit for equipment operation after battery depletion may represent a slight conservative bias. This should not be a source of model uncertainty in most applications.

5. RCP seal LOCA treatment - PWRs The assumed timing and magnitude of RCP seal LOCAs given a loss of seal cooling can have a substantial influence on the risk profile.

Accident sequences involving loss of seal cooling The WOG 2000 consensus model [11] has been implemented.

The WOG 2000 RCP seal LOCA model is applicable to both sites. Tripping of the RCPs following a loss of all seal cooling and injection is assumed to result in a large seal leak per the WOG 2000 model.

For non-LOOP events, a simplified implementation of the WOG 2000 model is used, in which the possibility of smaller leaks is not modeled in detail.

The timing for the operator action to trip the RCPs is somewhat longer in the HEP calculation than in the NRC SER on the WOG 2000 model (30 minutes vs. 13 minutes).

The assumption of additional time for tripping of the RCPs for non-LOOP scenarios may introduce a slight non-conservative bias.

The lack of explicit modeling of smaller leaks is adjusted for by increasing the probability that a large seal leak occurs (from 0.21 to 0.32).

The operator action timing assumption may represent a source of model uncertainty for some applications.

The lack of explicit modeling of smaller leaks is accounted for by increasing the large leak probability, and is therefore believed not to be a significant source of model uncertainty.

Page 10 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

6. Recirculation pump seal leakage treatment - BWRs w/ Isolation Condensers This issue is not applicable to PWRs.

N/A N/A N/A N/A N/A Success Criteria (to support meeting SC-C3)

7. Impact of containment venting on core cooling system NPSH This issue is not applicable to PWRs.

N/A N/A N/A N/A N/A

Page 11 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

8. Core cooling success following containment failure or venting through non hard pipe vent paths Loss of containment heat removal leading to long-term containment over-pressurization and failure can be a significant contributor in some PRAs.

Consideration of the containment failure mode might result in additional mechanical failures of credited systems. Containment venting through soft ducts or containment failure can result in loss of core cooling due to environmental impacts on equipment in the reactor building, loss of NPSH on ECCS pumps, steam binding of ECCS pumps, or damage to injection piping or valves. There is no definitive reference on the proper treatment of these issues.

Long term loss of decay heat removal scenarios Containment over-pressurization and failure is not modeled as a core damage contributor due to the robust design of the Byron and Braidwood containments. The Level 2 analyses performed for the IPEs demonstrated that containment failure prior to core damage would not adversely affect ECCS pump NPSH and not be a significant core damage contributor.

Following containment failure, ECCS injection from the RWST could still be maintained. Further, there would be sufficient NPSH for the RH pumps to support ECCS recirculation cooling.

The likelihood of containment failure affecting core cooling capability is sufficiently small to not be a significant core damage contributor.

Containment failure is not modeled in the Level 1 model.

The likelihood of containment failure affecting core cooling capability is sufficiently small to not be a potential source of model uncertainty for applications.

Page 12 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

1) Design basis calculations showing that HVAC is not required in the switchgear and battery rooms are sufficiently applicable to the anticipated transients in the PRA model.

1) An HVAC dependency is not included for the switchgear and battery rooms.

This should not be a candidate source of model uncertainty.

2) Equipment survivability calculations for ECCS show room cooling is required for CV and RH.

2) An HVAC dependency for CV and RH is included in the system models.

The equipment survivability calculations are judged to be reasonably realistic.

This should not be a candidate source of model uncertainty unless reference to the existing calculations is deemed insufficient.

3) CC pump room cooling assumed not be required based on location in open area in the Aux Building.

3) An HVAC dependency for CC is not included in the system models.

This should not be a candidate source of model uncertainty unless reference to the existing calculations is deemed insufficient.

4) Equipment survivability calculations for ECCS show room cooling or lube oil cooling is required for SX.

4) An HVAC dependency for SX is included in the system models.

This should not be a candidate source of model uncertainty.

9. Room heatup calculations Loss of HVAC can result in room temperatures exceeding equipment qualification limits.

Treatment of HVAC requirements varies across the industry and often varies within a PRA. There are two aspects to this issue.

One involves whether the SSCs affected by loss of HVAC are assumed to fail (i.e.

there is uncertainty in the fragility of the components). The other involves how the rate of room heatup is calculated and the assumed timing of the failure.

Dependency on HVAC for system modeling and timing of accident progressions and associated success criteria.

A combination of design basis calculations for technical specifications, Appendix R supporting calculations, and plant-specific equipment survivability calculations are referenced to determine the HVAC requirements in the model.

5) Refer to Topic 14 Item 4 for discussion.

5) DG ventilation requirements are explicitly modeled as a DG dependency.

Refer to Topic 14 Item 4 for discussion and conclusion.

Page 13 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

10. Battery life calculations Station Blackout events are important contributors to baseline CDF at nearly every US NPP. Battery life is an important factor in assessing a plants ability to cope with an SBO. Many plants only have design basis calculations for battery life. Other plants have very plant/condition-specific calculations of battery life. Failing to fully credit battery capability can overstate risks, and mask other potentially contributors

& insights. Realistically assessing battery life can be complex.

Determination of battery depletion time(s) and the associated accident sequence timing and related success criteria.

Design basis calculations indicate that ~8 hours of battery life is available depending on scenario specifics. Credit for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is utilized in the model for scenarios without chargers available.

Given the typical conservatisms associated with the design-basis battery calculations, explicit representation of load shedding is not assumed to be required to obtain the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months battery life times.

1) Short term SBO scenarios require that offsite ac power be restored within the battery life to avoid core damage.

Realistic given the relatively long battery life without recharge.

This should not be a source of model uncertainty in most applications.

Page 14 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

11. Number of PORVs required for bleed and feed -

PWRs PWR EOPs direct opening of all PORVs to reduce RCS pressure for initiation of bleed and feed cooling.

Some plants have performed plant-specific analysis that demonstrate that less than all PORVs may be sufficient, depending on ECCS characteristics and initiation timing.

System logic modeling representing success criterion and accident sequence timing for performance of bleed and feed and sequences involving success or failure of feed and bleed.

Plant-specific success criteria calculations have been performed using MAAP to determine the number of PORVs required to open (and timing of opening) for successful bleed and feed cooling. This has been done as a function of the ECCS pumps available.

Results show that a single PORV opening represents bleed and feed success for the condition where a CV is running. Success is also credited where two PORVs and a single SI pump is running.

The appropriate success criteria (i.e., 2 PORVs open or 1 PORV opens) are applied depending on the available ECCS pumps for the scenario being modeled.

For scenarios in which a single CV pump is available, bleed and feed success requires 1 PORV opening. For other scenarios with SI pump only, success requires both PORVs opening.

The modeling is believed to be realistic.

This should not be a source of model uncertainty in most applications. However, for some applications affecting PORV availability, there may be merit to evaluating the impact of this issue.

12. Containment sump / strainer performance All PWRs are improving ECCS sump management practices, including installation of new sump strainers at most plants. There is not a consistent method for the treatment of ECCS sump performance.

Recirculation from sump system modeling and sequences involving injection from these sources (Note that the modeling should be relatively straightforward, the uncertainty is related to the methods or references used to determine the likelihood of sump strainer and common cause failure of the strainers.)

The failure cause and likelihood of containment sump suction strainers are expected to be somewhat different, depending on what type of transient is being analyzed. Byron and Braidwood have installed larger capacity strainers in response to GSI-191 to minimize the likelihood of strainer plugging sufficient to affect ECCS pump NPSH.

A random plugging of the sump strainers sufficient to result in inadequate NPSH for the ECCS pumps during recirculation is not currently modeled. It is assumed that the plugging of the sump strainers, given that the new larger strainers have been installed, is low probability.

The probability of an unrecoverable global CCF plugging of the new strainers is assumed to be small, and not explicitly included in the model.

The non-incorporation of unrecoverable global CCF term for plugging of the sump strainers is judged to not be a source of significant model uncertainty given the large capacity of the new strainers..

However, this should not be considered as a potential source of model uncertainty.

Page 15 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

13. Impact of failure of pressure relief Certain scenarios can lead to RCS/RPV pressure transients requiring pressure relief. Usually, there is sufficient capacity to accommodate the pressure transient.

However, in some scenarios, failure of adequate pressure relief can be a consideration. Various assumptions can be taken on the impact of inadequate pressure relief.

Success criterion for prevention of RPV overpressure (Note that uncertainty exists in both the determination of the global CCF values that may lead to RPV overpressure and what is done with the subsequent RPV overpressure sequence modeling.)

Failure of a sufficient number of safety relief valves to open when required may lead to excessive reactor vessel pressure and a potential LOCA condition. The most significant overpressure challenge transient results from ATWS. For general transients with reactor trip, the PORVs provide pressure relief if needed, and the likelihood of a safety relief valve challenge is sufficiently small that explicit

1) For general transients (non-ATWS), it is assumed that opening of any 1 of the 2 PORVs and 3 SRVs is sufficient to preserve RPV integrity below Service Level C.

1) From the perspective of RPV overpressure given a reactor trip, since only a single PORV or SRV is required to open, the probability of overpressure is sufficiently small (i.e.,

common cause failure of the PORVs and common cause failure of the SRVs) that it is not explicitly modeled. Note that failure of a challenged PORV to reclose is modeled for sequences in which a PORV might be challenged.

The approach taken is consistent with that used in other PWR PRAs. The potential impact on CDF due to not explicitly modeling the possibility of overpressure for non-ATWS events is not believed to be significant. This should not be a source of model uncertainty in most applications.

Page 16 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment modeling is not required.

2) For ATWS scenarios, the number of PORVs and/or SRVs is a function of core reactivity, available AFW capacity, and other parameters as specified in the WOG ATWS model (WCAP-11992 [10]). Per the WOG model, there may be brief periods of time in which all available pressure relief is not adequate to maintain RCS pressure below the ASME Service Level C pressure. Failure to maintain RCS pressure below the ASME Service Level C pressure is modeled (non-mechanistically) in the PRA as leading to vessel failure and core damage.

2) For transients without reactor trip, the PRA includes logic to model the appropriate number of PORVs and SRVs required to open to maintain RCS pressure below the ASME Service Level C pressure in accordance with the success criteria specified in WCAP-11992 [10].

Failure of the requisite number of valves to open is modeled as resulting in core damage. For small LOCAs and the steam line breaks without reactor trip, the PRA assumes that the sequences directly lead to core damage.

Slight conservative bias treatment in assumption that overpressure failure in ATWS cases goes directly to core damage, since RCS piping failures in most locations would not result in LOCAs in excess of ECCS capability. However, the modeling is in accordance with an industry recognized model. This is not a source of model uncertainty for most applications.

Page 17 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment Systems Analysis (to support meeting SY-C3)

1) Design basis calculations showing that HVAC is not required in the switchgear and battery rooms are sufficiently applicable to the anticipated transients in the PRA model.

1) An HVAC dependency is not included for the switchgear and battery rooms.

Potentially slightly non-conservative, as the room Heatup calculations are based on 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months mission time, with assumption that within that period operators would take action to restore cooling to the rooms. However, design basis room heatup calculations generally over-estimate room heatup rates, and more realistic calculations would likely reduce any non-conservatism. This should not be a candidate source of model uncertainty unless reference to the existing calculations is deemed insufficient.

2) Equipment survivability calculations for ECCS show room cooling is required for CV and RH.

2) An HVAC dependency for CV and RH is included in the system models.

The equipment survivability calculations are judged to be reasonably realistic.

This should not be a candidate source of model uncertainty.

14. Operability of equipment in beyond design basis environments Due to the scope of PRAs, scenarios may arise where equipment is exposed to beyond design basis environments (w/o room cooling, w/o component cooling, w/

deadheading, in the presence of an un-isolated LOCA in the area, etc.).

System and accident sequence modeling of available systems and required support systems Generally, credit for operation of systems beyond there design-basis environment is not taken.

Exceptions are listed in the next column.

3) CC pump room cooling assumed not be required based on location in open area in the Aux Building.

3) An HVAC dependency for CC is not included in the system models.

This should not be a candidate source of model uncertainty.

Page 18 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

4) Each DG requires ventilation to operate successfully. This dependency is modeled to include suction and exhaust dampers (including CCF terms as applicable) and fan fail-to-start and fail-to-run terms. There may be limited times when 2 DG HVAC fans are required to provide cooling, but this is assumed not to be a significant dependency and is not modeled. Station procedures provide guidance for the emergency restoration of the DG ventilation and for the use of portable ventilation to maintain DG temperatures acceptable, but this option is not credited in the PRA model.

4) DG ventilation requirements are explicitly modeled as a DG dependency.

Not explicitly accounting for the limited time frames when two DG HVAC fans may be required to provide DG cooling is a potential slight non-conservatism. Not modeling the proceduralized restoration of DG ventilation is a potential conservatism. Given that a ventilation dependency is modeled, the above factors should not be a significant source of model uncertainty.

5) Given the typical conservatisms associated with the design-basis battery calculations, and the relatively long battery life, explicit representation of load shedding is not assumed to be required to obtain the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months battery life times.

5) Short term SBO scenarios require that offsite ac power be restored or alternate ac power from the EDGs be aligned within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to avoid core damage.

Realistic with slight conservative bias on assumed battery life time. This should not be a source of model uncertainty in most applications.

Page 19 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment Human Reliability Analysis (to support meeting HR-I3)

15. Credit For ERO Most PRAs do not give much, if any credit, for initiation of the Emergency Response Organization (ERO),

including actions included in plant-specific SAMGs and the new B5b mitigation strategies. The additional resources and capabilities brought to bear via the ERO can be substantial, especially for long-term events.

System or accident sequence modeling with incorporation of HFEs and HEP value determination in both the Level 1 and Level 2 models Generally, credit for initiation of actions from the ERO is not taken in the Level 1 core damage sequence analysis.

Credit for ERO is not taken in the PRA.

ERO support is not modeled.

Credit for some direction from the ERO for longer-term actions would be a realistic assumption. Slight conservative treatment in not modeling. This should not be a source of model uncertainty in most applications.

Page 20 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment Internal Flooding (to support meeting IF*-B3)

1) The use of generic flood frequencies with plant-specific estimates of pipe lengths is suitable for representation of the flood frequencies at the site.

1) Flood initiator frequencies are based on plant-specific estimates of pipe lengths and generic flood frequencies (per foot) for different categories of piping from the EPRI methodology [7].

Considered an industry good practice approach, but is not yet a consensus model approach. This should not be a source of significant model uncertainty given that a recognized methodology has been applied using plant-specific piping data.

However, it is retained as a potential model uncertainty.

2) Spray flood scenarios with less than 100 GPM flow do not totally disable the system they arise from.

2) Spray initiator scenario impacts are limited to the local affects of the spray.

Realistic with a slight conservative bias employed in the undeveloped spray scenarios that are subsumed in with the other flood scenarios in the same region. This should not be a source of model uncertainty in most applications.

16. Piping failure mode One of the most important, and uncertain, inputs to an internal flooding analysis is the frequency of floods of various magnitudes (e.g., small, large, catastrophic) from various sources (e.g.,

clean water, untreated water, salt water, etc.).

EPRI has developed some data, but the NRC has not formally endorsed its use.

Likelihood and characterization of internal flooding sources and internal flood event sequences The Internal flood analysis and initiating event frequencies for spray, flood, and major flood scenarios are developed consistent with the EPRI methodology [7]. In the current internal flooding model, some simplifying assumptions have been made, since the results are dominated by SX flooding scenarios. The flooding analysis is integrated into the internal events at power model A more detailed update to the internal flooding analysis is currently being performed, and will be integrated into the model when completed.

3) Flood and major flood sources are assumed to totally disable the system they arise from.

3) Flood and major flood initiator scenarios include failure of the source system as well as the components that are failed due to the flood event.

Conservative bias treatment in that the system may not be totally disable in all cases. This should not be a source of model uncertainty in most applications.

Page 21 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment LERF Analysis (to support meeting LE-G4)

17. Core melt arrest in-vessel Typically, the treatment of core melt arrest in-vessel has been limited.

However, recent NRC work has indicated that there may be more potential than previously credited.

Level 2 containment event tree sequences Approach is based on the simplified LERF methodology from NUREG/CR-6595 [8] for PWRs with large volume containment.

Consistent with NUREG/CR-6595 No credit for in-vessel core melt arrest.

Conservative bias treatment in that in-vessel core melt arrest might be feasible in some scenarios. This should not be a source of model uncertainty in most applications.

18. Thermally induced failure of hot leg/SG tubes -

PWRs NRC analytical models and research findings continue to show that TI-SGTR is more probable than predicted by the industry. There is a need to come to agreement with NRC on the thermal hydraulics modeling of TI SGTR.

Level 2 containment event tree sequences Approach is based on the simplified LERF methodology from NUREG/CR-6595 [8] for PWRs with large volume containment.

Consistent with NUREG/CR-6595 Induced SGTR probability is assumed to be 1.8E-2, consistent with NUREG-4551 and subsequent guidance.

Approach is consistent with NRC model. This should not be a source of model uncertainty in most applications unless new research determines a basis for alternative assumptions.

Page 22 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

1) RPV catastrophic failure leading to early containment failure via missiles is extremely unlikely based on reference to generic studies.

No explicit impact on model, since failure mode is assumed to be a small contributor to the overall likelihood of containment failure.

Approach is adequate for determination of LERF. This should not be a source of model uncertainty in most applications.

2) Per NUREG/CR-6595, direct containment heating is only possible for high pressure melt scenarios, but even there is noted as very unlikely.

2) DCH failure mode is considered in model for sequences that proceed to vessel failure at high pressure.

Approach is adequate for determination of LERF. This should not be a source of model uncertainty in most applications.

19. Vessel failure mode The progression of core melt to the point of vessel failure remains uncertain. Some codes (MELCOR) predict that even vessels with lower head penetrations will remain intact until the water has evaporated from above the relocated core debris.

Other codes (MAAP),

predict that lower head penetrations might fail early. The failure mode of the vessel and associate timing can impact LERF binning, and may influence HPME characteristics (especially for some BWRs and PWR ice condenser plants).

Level 2 containment event tree sequences The following phenomenological conditions that could lead to early containment failure (and LERF) are dependent upon the vessel failure mode considered in the Level 2 analysis and potentially applicable to Byron and Braidwood. These are: 1)

RPV catastrophic failure,

2) direct containment heating, and 3) ex-vessel steam explosion.

3) Ex-vessel steam explosions noted as very unlikely based on reference to generic studies.

3) Ex-vessel steam explosion failure mode is addressed within the simplified NUREG/CR-6595 modeling as part of early containment failure possibility..

Approach is adequate for determination of LERF. This should not be a source of model uncertainty in most applications.

20. Ex-vessel cooling of lower head The lower vessel head of some plants may be submerged in water prior to the relocation of core debris to the lower head. This presents the potential for the core debris to be retained in-vessel by ex-vessel cooling. This is a complex analysis impacted by insulation, vessel design and degree of submergence.

Level 2 containment event tree sequences This is not considered in the PRA due to uncertainties in the behavior of the lower head penetrations and the presence of insulation surrounding the lower head.

No credit for ex-vessel cooling.

Ex-vessel cooling of the lower head is not included in the model.

No credit for ex-vessel cooling of the lower head represents a realistic treatment with a slight conservative bias slant. This should not be a source of model uncertainty in most applications.

Page 23 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

21. Core debris contact with containment In some plants, core debris can come in contact with the containment shell (e.g.,

some BWR Mark Is, some PWRs including free-standing steel containments). Molten core debris can challenge the integrity of the containment boundary. Some analyses have demonstrated that core debris can be cooled by overlying water pools.

Level 2 containment event tree sequences This is not considered as an early failure mechanism because there is no direct path for core debris to contact the containment shell.

This is not considered as an early failure mechanism because there is no direct path for core debris to contact the containment shell.

N/A This should not be a source of model uncertainty in most applications.

Page 24 of 33 Table 1 Issue Characterization for Sources of Model Uncertainty for Byron/Braidwood PRAs (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment

1) Original ISLOCA analysis provides reasonable estimates for the ISLOCA initiating event frequencies.

1) The current ISLOCA values are believed to be reasonable

22. ISLOCA IE Frequency Determination ISLOCA is often a significant contributor to LERF. One key input to the ISLOCA analysis are the assumptions related to common cause rupture of isolation valves between the RCS/RPV and low pressure piping. There is no consensus approach to the data or treatment of this issue. Additionally, given an overpressure condition in low pressure piping, there is uncertainty surrounding the failure mode of the piping.

ISLOCA initiating event sequences ISLOCA analysis follows the methodology in NSAC-154 [9] and accounts for common cause failures and captures likelihood of different piping failure modes. However, the ISLOCA analysis has not been updated since the IPE and has not evolved to be consistent with more recent detailed methodologies.

2) The failure probability for each flow path given exposure to high pressure RPV conditions is appropriately represented by the IPE analysis.

2) Unique contributions from each flow path included in the model to delineate that fraction of system unavailability from the initiating event.

The approach for the ISLOCA frequency determination is considered acceptable given that the current approach is reasonably conservative, but because of the vintage of the analysis, the ISLOCA initiating event frequencies are identified as candidate sources of model uncertainty.

23. Treatment of Hydrogen combustion in BWR Mark III and PWR ice condenser plants This issue is not applicable to Byron and Braidwood.

N/A N/A N/A N/A N/A

Page 25 of 33

2. Consideration of Plant-Specific Features / Modeling Approaches This portion of the assessment allows for the identification of plant-specific features that require unique features, modeling approaches, or phenomenological assessments not considered in the generic list.

For Byron/Braidwood, a review of unique issues was performed to identify the following items as plant-specific candidate sources of model uncertainty:

Probability of containment integrity challenge following vessel rupture event Modeling of CC with respect to the alignment of the CC HX 0, which is a shared system across the units The modeling of CC, CV and SX pump alignments, of which only one train is assumed to be running The modeling of SX Cooling Tower Fans and the associated riser valves configurations (Byron only)

Condensate Storage Tank depletion time Each of these items is discussed in Table 2 in the same format as that utilized in Table 1 to provide an issue characterization for the plant-specific sources of model uncertainty.

Page 26 of 33 Table 2 Issue Characterization for Additional Plant-Specific Sources of Model Uncertainty for Byron/Braidwood (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment Consideration of Plant-Specific Features / Modeling Approaches Containment integrity following vessel rupture event There is model uncertainty regarding the subsequent treatment that increases the likelihood of LERF for this extremely rare event.

Vessel rupture sequences Vessel rupture sequences are modeled as lead directly to core damage but not directly to LERF.

Vessel rupture sequence is not assumed to result in concurrent containment failure coincident with the vessel rupture.

Vessel rupture sequence potential for LERF.

Vessel rupture frequency is on the order of E-7, i.e., very small, such that potential impact on LERF is also small.

Containment integrity following vessel rupture is therefore not identified as a candidate source of model uncertainty.

The modeling of CC with respect to the alignment of the CC HX 0, which is a shared system across the units The alignment of CC HX 0 is not always known for some application.

CC system fault trees The alignment of CC HX 0 is explicitly modeled for both units, and the results are quantified specific to the CC HX 0 alignment.

Base model quantification assumes that the CC HX 0 is aligned to its own unit being analyzed.

A basic event representing an average fraction of the CC HX 0 alignment during the plant operation may impact the importance of some SSCs.

The CC HX 0 alignment modeling is used to achieve capability to realistically model the various plant configurations. This is not a source of model uncertainty for applications.

The modeling of CC, CV and SX pump alignments, of which only one train is assumed to be running.

The pump alignments are not always known for some application.

CC, ECCS and SX system fault trees The alignments of CC, CV and SX pumps are explicitly modeled for both units and the results are quantified specific to the pump alignments.

Base model quantification assumes that Train A pumps are normally running and Train B pumps are in standby.

Basic events representing the average fractions of the running pumps during the plant operation may impact the importance of some sequences.

The pump alignments are used to achieve capability to realistically model the various plant configurations.

However, this is identified as a potential source of uncertainty for some applications.

Page 27 of 33 Table 2 Issue Characterization for Additional Plant-Specific Sources of Model Uncertainty for Byron/Braidwood (QU-F4 and LE-F3)

Topic (to meet QU-E1)

Discussion of Issue Part of Model Affected Plant-Specific Approach Taken Assumptions Made (to meet QU-E2)

Impact on Model (to meet QU-E4)

Characterization Assessment The modeling of SX Cooling Tower Fans and the associated riser valves configurations (Byron only)

The fan/riser valve configurations are not always known for some application.

SX Tower system fault tree 4 SX Cooling Tower Fans and the associated riser valves are needed for the LOCA loads and 2 SX fans/riser valves are required for non-LOCA loads.

Base model quantification assumes that SX fan/riser valve Trains A, B, G, and H are normally running and Trains C, D, E, and F are in standby.

Basic events representing the average fractions of the running SX fan/riser valve trains during the plant operation may impact the importance of some sequences.

The SX fan/riser train alignments are used to achieve capability to realistically model the various plant configurations.

However, this is identified as a potential source of uncertainty for some applications.

Condensate Storage Tank depletion time The inventory in the CST is normally not sufficient for the full 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time modeled in the PRA.

AF fault tree success criteria for decay heat removal.

CST inventory is adequate for approximately 16 hrs; assumption is made that the likelihood of failing to either refill the CST or align to shutdown cooling within this extended time frame is very small.

Probability of failing to continue decay heat removal is very small given depletion of CST inventory.

Minimal impact.

Probability of failing to continue decay heat removal is very small given depletion of CST inventory.

Lack of explicit modeling of the various sources of decay heat removal should not have a significant impact on CDF or LERF. This is not identified as a source of model uncertainty for applications.

Page 28 of 33

3. HEP and CCF Sensitivity Case Results The process outlined in Section 3 and Appendix A of the EPRI report [2] also included the recommendation to perform a standard set of four sensitivity cases:

The 5th and 95th percentile values were calculated based on the HEP uncertainty parameter propagation All CCF probabilities set to their 5th percentile value (the use of zero value CCF probabilities is also deemed acceptable)

All CCF probabilities set the their 95th percentile value The results of these sensitivity cases are also discussed here and compared to the RG 1.174 [14] CDF and LERF limits of 1x10-4/yr for CDF and 1x10-5/yr for LERF to obtain insights into the sensitivity of the base PRA model results to these generic high level sources of modeling uncertainty rather than trying to identify all potential sources of model uncertainty associated with these issues since they are generally understood and accepted as areas of uncertainty that can be significant contributors to CDF and LERF.

The results of these sensitivity studies are presented in Table 3. Only adjustments to the basic events in the base cutset equation were made to determine these results.

This is judged to be acceptable for the initial base sensitivity cases.

Page 29 of 33 Table 3 Formulation of Standard Sensitivity Studies for Byron Unit 1 Sensitivity Study Item Base Value Lower Bound or 5th %-tile Value Upper Bound or 95th %-

tile Value CDF/LERF when at Lower Bound Value CDF/LERF when at Upper Bound Value Generic Sensitivity Study Issues (Base CDF = 1.8E-5/yr, Base LERF = 1.1E-6/yr)

All Human Error Probability Values Various Zero Various CDF: 9.9E-6 (0.55x Base CDF)

LERF: 7.4E-7 (0.67x Base LERF)

CDF: 2.3E-5 (1.3x Base CDF)

LERF: 1.6E-6 (1.5x Base LERF)

All Common Cause Failure Probability Values Various Zero Various CDF: 1.6E-5 (0.89x Base CDF)

LERF: 9.8E-7 (0.89x Base LERF)

CDF: 2.4E-5 (1.3x Base CDF)

LERF: 1.3E-6 (1.2x Base LERF)1 The results of the special sensitivity studies lead to the following conclusions for Byron:

Human Error Probability Values

More than 80% of the base case CDF and more than 60% of the base case LERF involve human error terms as contributors.

Correspondingly, the 95th percentile value based on the HEP uncertainty propagation increases the CDF by a factor of 1.3 and LERF by a factor of 1.5.

However, both CDF and LERF are below the RG 1.174 CDF and LERF limits of 1x10-4/yr for CDF and 1x10-5/yr for LERF for the 95th percentile value based on the HEP uncertainty propagation.

1 Quantified with the 1E-11 truncation limit, since the model would not quantify at 1E-12.

Page 30 of 33 Common Cause Failure Probability Values

More than 12% of the base case CDF and more than 11% of the base case LERF involve CCF terms as contributors.

Correspondingly, setting all of the CCF values to their 95th percentile values increases the CDF by a factor of 1.3 and LERF by a factor of 1.2.

However, both CDF and LERF are still well below the RG 1.174 CDF and LERF limits of 1x10-4/yr for CDF and 1x10-5/yr for LERF when all of the CCF values are set to their 95th percentile values.

The results of these sensitivity cases indicate that human errors (or the potential for human errors) will be potential candidate sources of model uncertainty for some applications of the model. The specific HEPs that contribute may need to be examined on a case by case basis for a given application. Similarly, common cause failures (or the potential for common cause failures) will also be potential candidate sources of model uncertainty for some applications of the model and the specific CCF values that contribute may need to be examined on a case by case basis. Given the relative magnitude of the contributions from the sensitivity cases presented here, it is likely that specific HEP values will be more important than specific CCF values for any given application.

Page 31 of 33

4. Summary The results of the evaluation of the impact of model uncertainty through implementing the process as shown in Tables 1 and 2 and discussed in Section 3 identified the following issues as the most likely candidate sources of model uncertainty from the base PRA model assessment.

Timing of action to trip Reactor Coolant Pumps given a loss of RCP seal cooling/injection

PORV success criteria for bleed and feed operation

Internal flood initiating event frequencies and failure modes

ISLOCA frequencies

Human error probability values

Common cause failure values

The modeling of CC, CV and SX pump alignments, of which only one train is assumed to be running

The modeling of SX Cooling Tower Fans and the associated riser valves configurations (Byron only)

For the most part, the issues listed above plus the topics identified in Table A-3 of the EPRI report [2] would need to be considered when trying to identify potential sources of model uncertainty relevant to the application being investigated per the guidance provided in Section 4 (see Figure 4-1) in the EPRI report [2]. Several other issues were also identified as being treated with conservative bias slants. These items are indicated in Table 1, but due to the conservative treatment, they should not become potential candidates as key sources of uncertainty for most applications of the model.

Page 32 of 33

5. REFERENCES

1. ASME Committee on Nuclear Risk Management in collaboration with ANS Risk Informed Standards Committee, Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-S-2008a, For Recirculation Ballot, October 2008.

2. EPRI TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI, Palo Alto, CA: November 2008.

3. NUREG/CR-6890, Reevaluation of Station Blackout Risk at Nuclear Power Plants, Analysis of Loss of Offsite Power Events: 1986-2004, INL/EXT-05-00501, Idaho National Laboratory, November 2005.

4. NUREG-1829, Estimating Loss-of-Coolant Accident (LOCA) Frequencies Through the Elicitation Process, USNRC, April 2008.

5. NUREG/CR-5750, INEEL/EXT-98-00401, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, INEEL, February 1999.

6. NUREG/CR-6928, INL/EXT-06-11119, Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants, INL, February 2007.

7. EPRI TR-1013141, Pipe Rupture Frequencies for Internal Flooding PRAs, Revision

1. EPRI, Palo Alto, CA, 2006.

8. NUREG/CR-6595, An Approach for Estimating the Frequencies of Various Containment Failure Modes and Bypass Events, Rev. 1, Brookhaven National Laboratory, October 2004.

9. NSAC-154, ISLOCA Evaluation Guideline, EPRI, September 1991.

10. WCAP-11992, Joint Westinghouse Owners Group/Westinghouse Program: ATWS Rule Administration Process, December 1988.

11. WCAP-15603, WOG 2000 Reactor Coolant Pump Seal Leakage Model for Westinghouse PWRs, Rev. 1-A, June 2003.

Page 33 of 33

12. NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, USNRC, March 2009.

13. NUREG-4551, Vol. 7, Rev.1, Part 2A, Evaluation of Severe Accident Risks: Zion Unit 1, Brookhaven National Laboratory, March 1993.

14. Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July 1998.

v t e Letter Sequence Request
TAC:ME2293, (Approved, Closed)
Initiation Request, Request, Request, Request, Request Acceptance... Supplement Administration Questions 18 December 2009 19 February 2010 26 February 2010 3 March 2010 Answers 9 March 2010 Results Approval, Approval Other:
MONTHYEAR2010-02-19 [Table View]

RS-09-121, License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time

Text

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

3.0 TECHNICAL EVALUATION

=

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

1.0 BACKGROUND

2.0 TECHNICAL ANALYSIS

SUMMARY

3.0 CONCLUSION

4.0 REFERENCES

Navigation menu

RS-09-121, License Amendment Request for a One-Time Extension of the Essential Service Water Train Completion Time

Text

Subject:

SUMMARY

3.0 TECHNICAL EVALUATION

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

SUMMARY

3.0 TECHNICAL EVALUATION

=

4.0 REGULATORY EVALUATION

5.0 ENVIRONMENTAL CONSIDERATION

6.0 REFERENCES

1.0 BACKGROUND

2.0 TECHNICAL ANALYSIS

SUMMARY

3.0 CONCLUSION

4.0 REFERENCES

Navigation menu

Search