RBG-47009, Supplement to Request for Alternative - Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013)

Supplement to Request for Alternative - Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013)

ML100740395
Person / Time
Site:	River Bend
Issue date:	03/12/2010
From:	Lorfing D Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RBG-47009
Download: ML100740395 (19)

Text

SEntergy River Bend Station 5485 U.S. Highway 61N St. Francisville, LA 70775 Tel 225-381-4157 David N. Lorfing Manager, Licensing RBG-47009 March 12, 2010 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

Reference Supplement to Request for Alternative - Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013)

River Bend Station, Unit 1 Docket No. 50-458 License No. NPF-47

1. Entergy Letter to NRC dated June 16, 2009, Request for Alternative -

Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013 / RBG 46922)

2. NRC letter to Entergy July 29, 2009, River Bend Station, Unit 1 -

Supplemental Information Needed For Acceptance Of Requested Licensing Action Re: Risk-informed Relief Request Based On ASME Code Case N-716 (TAC ME1507)

3. Entergy Letter to NRC dated August 11, 2009, Supplement to Request for Alternative - Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013/RBG-46944)

Dear Sir or Madam:

On June 16, 2009, Entergy Operations, Inc. (Entergy) submitted a request to implement a risk-informed Inservice Inspection (RI ISI) program based on the methodology of American Society of Mechanical Engineers (ASME) Code Case N-716, as documented in the attachment to Request for Alternative RBS-ISI-01 3, Reference 1. On July 29, 2009, the NRC Staff identified the additional information needed as indicated in Reference 2. This request was supplemented on August 11, 2009, via Reference 3.

An audit of Entergy risk information supporting this request was conducted during December 2009 and was documented in an Audit Report dated January 14, 2010. The NRC requested additional information on January 22, 2010. Entergy's response to this request is provided in.

This information contains one new commitment identified in Attachment 2.

RBG-47009 Page 2 of 2 If you have any questions or, require additional information, please contact me at (225) 381-4157.

Sincerely, Manager, Lic sif§ River Bend Station - Unit 1 DNL/bmb Attachments:

1.

Supplement to Request for Alternative RBS-ISI-01 3, Response to Questions

2.

List of Regulatory Commitments cc:

Regional Administrator U. S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX 76011-4125 NRC Senior Resident Inspector P. 0. Box 1050 St. Francisville, LA 70775 U. S. Nuclear Regulatory Commission Attn: Mr. Alan B. Wang MS 0-7 D1 Washington, DC 20555-0001 Mr. Jeffrey P. Meyers Louisiana Department of Environmental Quality Office of Environmental Compliance Attn. OEC - ERSD P. O. Box 4312 Baton Rouge, LA 70821-4312

ATTACHMENT 1 TO RBG-47009 SUPPLEMENT TO REQUEST FOR ALTERNATIVE RBS-ISI-013 to RBG-47009 Page 1 of 14 SUPPLEMENT TO REQUEST FOR ALTERNATIVE ENTERGY OPERATIONS, INC.

RIVER BEND STATION - UNIT 1 RBS-ISI-013

Background

By letter dated June 16, 2009, Entergy Operations Inc. (Entergy) submitted a risk-informed in-service inspection (RI-ISI) relief request based on ASME Code Case N-716 for River Bend Station. The relief request included the results of the Self-Assessment of the RBS PRA against the ASME PRA Standard, ASME-RA-Sb-2005. The Self-Assessment, also referred to as a "gap analysis," was conducted against Revision 4a of the RBS PRA. This minor revision was approved in March 2008 and implemented a model for cooling of the Control Building switchgear rooms. Core damage frequency is predicted to be 3.55E-06 per year using a truncation limit of 1E-11.

Entergy is in the process of revising the PRA model. Revision 5 is currently scheduled for completion by December 2010. Subsequently, a Peer Review per NEI 05-04 will be conducted against Revision 5 during 2011.

It~is Entergy's intent to meet all Supporting Requirements of the ASME Standard for this model revision.

Other than the Large Early Release Frequency (LERF) model, it is intended for the revised PRA model to meet Capability Category II for the Supporting Requirements of the ASME Standard. The model revision plans have been discussed with the NRC as part of the July 28, 2009, meeting at NRC headquarters and as part of the NRC audit of the technical adequacy of the RBS PRA conducted at Entergy offices on December 8, 2009. The NRC has requested the additional information provided below as a result of that audit.

Based on its review of the application (Reference 1) and additional information supplied in Reference 3, the NRC has requested further information as identified below.

RESPONSE TO NRC Request for Additional Information Regarding Relief Request RBS-ISI-013 (ME1507)

NRC Email dated January 22, 2010:

Question 1.

You have evaluated many of the SRs that were assigned less than a Category II and have concluded that resolving the difference between the assigned category and category II would not substantively affect the RI-ISI results.

These SRs were discussed during the audit and the staff concurs that, individually, the proposed modification would not be expected to affect the RI-ISI program. The cumulative impact of all these changes is not expected to affect the RI-ISI program but this conclusion can not be confirmed until after the PRA has been updated. You have stated that you intend to update your PRA to meet the Category II requirements for these SRs while completing its to RBG-47009 Page 2 of 14 next PRA update. The next update is scheduled to be concluded in December of 2010. However, you have requested that the RI-ISI program be authorized by December 2010 in order to be properly integrated into your outage schedules. Please provide a commitment summarizing your schedule to re-evaluate your RI-ISI program after the PRA update.

Response to Question 1:

As discussed during the December 2009 NRC audit of the RBS PRA Self-Assessment against the ASME PRA Standard, ASME/ANS RA-Sa-2009, Entergy commits to review the impact of the ongoing PRA Revision 5 on the RI-ISI program by December 15, 2011.

Question 2.

Changes to the PRA that might be required to meet Category II for a few SRs could, individually, be important (i.e., affect RI-ISI results), and therefore the staff requests the following additional information before the staff completes its review of the proposed RI-ISI program.

2a.

AS-A9 (Gap to capability category II). Please review the TH analyses relied upon in scenarios relevant to RI-ISI and summarize how the plant-specific applicability of these success criteria is demonstrated.

Response to Question 2.a:

Capability Category II for supporting requirement AS-A9 of the ASME PRA standard, states:

"USE realistic, applicable (i.e., from similar plants) thermal hydraulic analyses to determine the accident progression parameters (e.g., timing, temperature, pressure, steam) that could potentially affect the operability of the mitigating systems."

The self-assessment performed by Entergy against the ASME standard judged River Bend as Capability Category I for this SR, with the following comment:

"Plant specific calculations are not used, in general for the PRA update to meet the ASME PRA Standard.

Reliance on NEDO-24708A is included for success criteria.

No ATWS specific success criteria are provided.

No plant specific MAAP or alternative deterministic calculations are provided to support the success criteria.

Generic calculations from NEDO-24708A are not sufficient for most of the success criteria SSW injection FPS injection Containment coolers for heat removal LOCA's to RBG-47009 Page 3 of 14

> Transients CRD injection for adequacy RCIC for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> There is an extensive set of calculations available at River Bend to support some of the decisions. These calculations are not summarized in the Accident Sequence Calculation and their full implications regarding success criteria cannot be ascertained. This is judged to be a documentation enhancement that would be beneficial in allowing a Peer Review team to understand and agree with the approach taken.

Conclusions appear to be drawn from calculations with no apparent rationale, e.g., HPCS is assumed to be unavailable due to the NPSH concerns for large or intermediate LOCA conditions."

A review of the calculations referenced as bases for success criteria for accident sequences in the River Bend PRA shows that generic vice plant specific calculations are used in support of ATWS power profile assumptions and in LOCA sequences. These sequences only contribute 4.3% of the RBS PRA current Revision 4a Core Damage Frequency (CDF). Use of generic calculations falls under Capability Category 1.

Plant specific calculations and information is relied upon to support success criteria for injection to the vessel using Service Water, Fire Protection Water, and the Control Rod Drive hydraulic system. A detailed evaluation to provide additional support for service water injection was performed in conjunction with the recent Internal Flooding PRA. The ability of the containment unit coolers to remove heat from containment has been calculated using a RBS plant specific model with the GOTHIC containment thermal-hydraulic analysis code. Plant specific suppression pool heatup evaluations and pump Net Positive Suction Head (NPSH) calculations have been used to assess scenario-dependent acceptance limits on suppression pool heatup for Emergency Core Cooling System (ECCS) pumps. Reactor Core Isolation Cooling (RCIC) is credited for long-term injection only when sufficient suppression pool cooling (and hence containment heat removal) is present. ATWS sequence success criteria are separately documented in the ATWS PRA documentation.

Revision 4 of the River Bend PRA which was subjected to the Self-Assessment with respect to the ASME Standard did not include a specific document addressing Success Criteria. The lack of such a consolidated source of information increased the difficulty of the self-assessment team in locating and reviewing the documentation of supporting assumptions and references within the time allotted for the self-assessment. A specific Success Criteria document is being compiled in the development of Revision 5 to the RBS PRA. This will centralize and improve the accessibility and traceability of the technical bases of the PRA.

Generic calculations from NEDO-24708A, Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors, December 1980, are used as system success criteria for injection systems for LOCA's (including stuck open safety/relief valve scenarios), and those calculations are also used for assessment of time to core damage for LOCA scenarios. The calculations used are for the BWR/6 design, i.e., for a plant grouping that pertains to River Bend Station and to RBG-47009 Page 4 of 14 which Entergy considers to meet Capability Category II. River Bend plant specific analyses exist which evidence consistency with the generic calculations for time to core damage. Time to core damage assumptions for transient scenarios are based on River Bend plant specific analyses performed using the BWRSAR code.

NEDO-24222, Assessment of BWR Mitigation of ATWS, Volume II (NUREG-0460 Alternate No. 3), February 1981, NUREG/CR-3470, ATWS at Browns Ferry Unit One - Accident Sequence Analysis, July 1984, and NSAC-70, Reducing BWR Power by Water Level Control During an ATWS - A Transient Analysis, are referenced as the basis for the assumption of a 40% power following a Recirculation Pump Trip with failure to insert any control rods and the reduction to 18% power for successful vessel level-pressure control post-ATWS.

Thus, it is concluded that, except for ATWS, the River Bend PRA meets Capability Category II since it is supported by plant specific thermal hydraulic analyses and, for LOCA, analyses for BWR/6 designs. ATWS is a small contributor to River Bend plant risk; ATWS sequences contribute 9.69E-09/year to the Rev.4A RBS PRA Core Damage Frequency, or 0.27%. Similarly, LOCA and stuck open safety/relief valve sequences contribute 1.42E-07/year to the Rev.4A RBS CDF, or 4.01%.

Thus, there is contribution of less than 5% to the RBS CDF from sequences that depend on non-plant specific analyses. These sequences do not have any increased importance or relevance in the Risk-Informed In-Service Inspection (RI-ISI) application. Flooding scenarios do not decrease the effectiveness of the Reactor Protection System. The dominant sequences for the Internal Flooding PRA are transient initiators, vice LOCA (Interfacing Systems LOCA (ISLOCA) is evaluated as part of the base Internal Events PRA). Further, piping where the failure could result in a LOCA is already classified as of High Safety Significance under code case N-716, thus its treatment is unaffected by plant PRA results.

It should also be noted that significant margins are present in the analyses performed in support of the RBS N-716 relief request. As documented in Entergy letter RBG-46922 dated June 16, 2009, the risk impacts associated with the adoption of the N-716 code case are a ARCDF of 4.42E-09/year and a ARLERF of 2.86E-10/year, both of which are well within the RG 1.174 criteria of 1E-07/year and 1 E-08/year. This provides further support for the robustness of the RBS PRA support for the subject request.

Because of this small contribution, the impact of reliance on generic calculations vice plant specific thermal-hydraulic evaluations would have negligible impact on the ability of the RBS PRA to support the implementation of the code case N-716 RI-ISI application.

to RBG-47009 Page 5 of 14 2b.

SC-A5 (not met): Please review the scenarios relevant to RI-ISI and summarize how an appropriate mission time was developed and used.

Response to Question 2.b:

Capability Category II for supporting requirement SC-A5 states:

"SPECIFY an appropriate mission time for the modeled accident sequences.

For sequences in which stable plant conditions have been achieved, USE a minimum mission time of 24 hr. Mission times for individual SSCs that function during the accident sequence may be less than 24 hr, as long as an appropriate set of SSCs and operator actions are modeled to support the full sequence mission time.

For example, if following a LOCA, low pressure injection is available for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, after which recirculation is required, the mission time for LPSI may be 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and the mission time for recirculation may be 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />.

For sequences in which stable plant conditions would not be achieved by 24 hr using the modeled plant equipment and human actions, PERFORM additional evaluation or modeling by using an appropriate technique.

Examples of appropriate techniques include:

(a) assigning an appropriate plant damage state for the sequence; (b) extending the mission time, and adjusting the affected analyses, to the point at which conditions can be shown to reach acceptable values; or (c) modeling additional system recovery or operator actions for the sequence, in accordance with requirements stated in the Systems Analysis and Human Reliability sections of this Standard, to demonstrate that a successful outcome is achieved."

The self-assessment performed against the ASME standard judged that River Bend did not meet this SR, with the following comment:

"Mission times are discussed in Accident Sequence Calculation PRA-RB 002S01.

The mission times for failure to run calculations are assessed at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or less if specifically justified.

Extending the Fail To Run (FTR) mission time beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for loss of DHR sequences is considered to be an unnecessary complication and does not affect PRA insights nor does it significantly affect its quantitative evaluation.

The evaluation of safe stable states in a PSA has generally involved the assessment of equipment operation and operator actions over an extended period of time. This extended period of time is nominally taken to be sufficiently long such that offsite resources can be brought to bear to mitigate or further prevent accident progression. The considerations that have dominated the choice of the mission time are as follows:

/

Equipment failure rates (failures/hour) are judged to be too conservative for times greater than a few hours of operation.

For times greater than a few hours, the ability to repair and recover equipment can compete with the failure rate such that there can be considered to be a steady state equilibrium.condition reached.

to RBG-47009 Page 6 of 14 For times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the TSC and EOF would be manned, and additional expertise could be available by phone or transported to these facilities.

For times greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, it is considered highly likely that offsite resources (e.g., equipment, power, vehicles) would be available as back-ups to primary methods of prevention and mitigation.

From a risk perspective, actual data from natural and man-caused disasters have indicated that public evacuations can be effectively carried out in time frames of less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Therefore, prevention of accidents through 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of mission time have the largest potential for early health effects risk reduction.

Finally, beyond time frames of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, "ad hoc" procedures can be written and reviewed to perform alignments and equipment usage that are not part of current plant practices or training. Such ad hoc procedures and equipment usage can cover such a wide spectrum of possibilities that it is judged not useful to develop all possible contingencies at this time.

Based on the above considerations, it has been considered in past PSA's that it is to appropriate to use an equipment mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This consideration dictates the use of equipment "run" failure rates (per hour) coupled with a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time to calculate the "run" failure probability of equipment. This calculated "run" failure probability is then treated conservatively by applying this "run" failure probability as a failure that is postulated at time zero."

Review of the RBS PRA shows that mission times are appropriately developed for all aspects of the PRA, including those relevant to RI-ISI. The ASME/ANS PRA Standard, defines mission time as:

"the time period that a system or component is required to operate in order to successfully perform its function."

The self-assessment finding under SC-A5 criticized use of a greater than 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> time to address equipment failure to run. The River Bend PRA assumes a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time for components but will consider the state of the reactor plant at that time. If the reactor is not in a safe and stable configuration at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, accident sequences will consider core damage that could occur several hours later in specific scenarios. Specifically, containment pressurization sequences occur due to a partial failure of containment heat removal mechanisms, where the containment has not failed at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> but continuing slow pressurization would result in failure in several additional hours. Containment failure contributes to core damage at River Bend since the failure mode involves releases to the secondary containment and thence to the auxiliary building through Heating Ventilation and Air Conditioning (HVAC) ductwork. The subsequent heatup and pressurization of the auxiliary building results in failure of room cooling for ECCS and RCIC pumps, as well as failing the electrical components required to open the relief valves to support low pressure injection from external sources. Core damage results due to this loss of vessel injection sources.

to RBG-47009 Page 7 of 14 If a mission time of greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> had been used in assessing component failure rates, this would only have resulted in slight increases in CDF and/or LERF for the associated scenarios. Since component failures also account for failures to start as well as maintenance unavailability, the impact of several extra hours of mission time would be small.

Mission'times of less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are used for equipment which is explicitly modeled to have a shorter period of performance (e.g., RCIC under Station Blackout (SBO) conditions).

Thus, Entergy considers that the River Bend PRA meets Capability Category II for SR SC-A5 since Entergy's subsequent review has determined that the self-assessment finding was based on a misunderstanding of the details of mission time modeling. Further, the understanding of the self-assessment would only have resulted in a small increase in CDF and/or LERF, which would be a conservatism when considering the application of the RBS PRA to support' RI-ISI. Entergy concludes the RBS PRA mission time modeling is appropriate to support RI-ISI applications.

2c.

SY-A17 (not met): Please review the scenarios relevant to RI-ISI and confirm that potential system interactions that could cause a mitigative function to be tripped off or isolated have been modeled.

Response to Question 2.c:

For all capability categories, Supporting Requirement SY-A17 states:

"INCLUDE in either the system model or accident sequence modeling those conditions that cause the system to isolate or trip, or those conditions that once exceeded cause the system to fail, or SHOW that their exclusion does not impact the results.

For example, conditions that isolate or trip a system include:

(a) system-related parameters such as a high temperature within the system (b) external parameters used to protect the system from other failures

[e.g., the high reactor pressure vessel (RPV) water level isolation signal used to prevent water intrusion into the turbines of the RCIC and HPCS pumps of a BWR]

(c) adverse environmental conditions (see SY-A20)"

The self-assessment performed against the ASME standard judged that River Bend did not meet this SR, with the following comment:

"The River Bend model does not include system dependencies on accident progression including isolations and trips under severe accident conditions; e.g., RCIC back pressure trip; L8 trip on ref. leg leakdown; MSIV closure interlock on low level and the bypass interface."

Subsequent review of the RBS PRA model supports a conclusion that dependencies on support systems such as-electrical power, cooling water, and to RBG-47009 Page 8 of 14 room cooling have been built into the RBS PRA. Documentation of this modeling will be improved as part of PRA Revision 5 with the appropriate information captured in System Notebook and Success Criteria documents. Review supports the conclusion that the RBS PRA has appropriately modeled conditions, such as trips and isolations, which could prevent the performance of mitigative functions.

Discussion of specific items follow.

The RCIC turbine exhaust back pressure trip is accounted for via the modeling of containment suppression pool cooling, per the following discussion. Plant-specific calculations are used to determine the timing of suppression pool heatup for scenarios that credit RCIC for high pressure injection. Event trees require suppression pool cooling for RCIC, even though RCIC has an alternate source of suction in the Condensate Storage Tank (CST); this accounts for the eventual need to realign RCIC to the suppression pool upon depletion of CST inventory. Heatup of the suppression pool would result in a failure of the RCIC pump, when aligned to the suppression pool, on low NPSH at an assumed temperature of 173°F. RBS Event Trees specifically require success of suppression pool cooling (e.g., Residual Heat Removal (RHR) system in pool cooling mode) in order to credit RCIC as a long-term injection source. Scenarios where suppression pool cooling fails will credit RCIC only as a short-term means of injection to the vessel, and another system would then be required to be placed in service to meet the remainder of the general 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission-time of the RBS PRA. The PRA also models RCIC failure on loss of room heatup and on battery depletion under SBO conditions.

Because of the modeling of RCIC dependence on suppression pool temperature, there is no need to explicitly model RCIC dependence on containment backpressure. However, this had not been explicitly discussed in RBS PRA documentation such as the RCIC system notebook or the accident sequence supplement. RCIC isolation will occur on high turbine exhaust pressure, e.g., on high containment pressure, with a nominal setpoint of 10 psig per Technical Requirements Manual (TRM) Table 3.3.6.1-1. However, River Bend containment analyses demonstrate that the limit on suppression pool temperature would occur before the RCIC back pressure trip. For example, the' containment pressure at the time of losing NPSH (173F) for SBO scenarios would be 3.0 psig, and it would take roughly an additional 3.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> before RCIC would trip on high exhaust pressure.

Detailed modeling of this time difference would introduce considerable complexity to the model for the little reduction in risk metrics that could occur because of slightly longer allowed response times, dependent on CST inventory considerations.

Documentation with respect to the modeling of the RCIC back pressure trip is being improved as part of PRA Revision 5; however, no changes to the event tree or fault tree models are required.

Regarding Level 8 trips and isolations, the River Bend PRA explicitly models the failure to prevent a Level 8 trip of the RCIC. RCIC is assumed unavailable if it trips on Level 8 due to vessel level swell during a transient. The model also assumes that reactor feed pumps trip following transients due to a Level 8 trip signal, with an event added to represent the restart of feed pumps after Level 8 occurs. While the River Bend model does not account for MSIV isolation and recovery for Transients where credit is given for the Power Conversion System, this has a negligible impact on risk. If it were also assumed that a Level 8 high level MSIV isolation occurred on to RBG-47009 Page 9 of 14 all transients and disabled Power Conversion System (PCS) without any possibility of operator recovery, this would increase the baseline CDF by only 0.1OE-06, i.e.,

the Risk Achievement Worth for PCS is only 1.03. Consideration of realistic probabilities of operator actions would reduce this already small impact on CDF.

Note RBS has motor-driven pumps for HPCS and for Feedwater, thus those systems are not susceptible to damage due to a failure to secure injection upon Level 8. The modeling of these Level 8 dependencies is documented in the Human Reliability Analysis (HRA) supplements; documentation will be improved as part of the ongoing PRA revision to document these assumptions in the appropriate system notebooks.

The River Bend ATWS Event Tree conservatively assumes Main Steam Isolation Valve (MSIV) closure for ATWS accident sequences due to the potential for a Level 8 isolation signal, and does not credit the Power Conversion System for steaming, i.e., does not credit steaming to the main condenser. Due to the small contribution (0.27%) of ATWS to RBS core damage, this assumption has a very small conservative impact on RBS PRA results.

A review of the Reference Leg Leakdown initiators shows that the River Bend design does not allow leakdown to impact more than one condensing pot and thus would not cause a significant impact on the overall risk. The worst case loss of a reference leg would prevent an automatic actuation of 2 low pressure ECCS trains and would partially impact the automatic actuation of RCIC and ATWS-Recirculation Pump Trip (ATVWS-RPT). The failure of automatic actuation of low pressure ECCS or the partial impact of RCIC due to reference leg leakdown can be recovered by manually actuating the system, which will not be impacted because the remaining level sensors are available to direct the operators to perform manual actions. The partial failure of ATWS-RPT due to reference leg leakdown would also require a failure of the level sensor on the other train and a failure of a high reactor pressure trip signal. This combination of failures would increase loss of ATWS-RPT probability from 2E-1 0 to 2E-8. The point estimate used for ATWS-RPT for RI-ISI is 1 E-4. Therefore, the impact of a reference leg leakdown on one condensing pot is negligible to the overall risk of core damage and large early releases.

The RBS PRA model accounts for adverse environmental conditions during accident sequences. As an example of consideration of environmental effects, the RBS PRA models required operator actions to install interlocks to override RCIC isolation on high Main Steam Tunnel temperatures upon loss of the Unit Cooler serving that location. Another example of accounting for environmental effects is in the consideration of room heatup if HVAC systems are not available;' this phenomenon is modeled for the safety-related switchgear in the Control Building and in the effects on equipment such as pumps in the plant itself. Environmental effects are considered in the modeling of containment failures that result in steaming paths to the auxiliary building, which result in the failure of electrical equipment, including relief valves for the reactor vessel, due to auxiliary building temperature and humidity. Proper modeling of flood-induced environmental effects in the Internal Flooding PRA is discussed in relation to Supporting Requirement IF-C3 in of River Bend letter RBG-46944 dated August 11, 2009, which provided supplemental information on the River Bend request to implement RI-ISI Code Case N-716.

to RBG-47009 Page 10 of 14 The self-assessment of the RBS PRA against the ASME PRA standard concluded that supporting requirement SY-A20, referred to in SY-A17.d, met Capability Category I1. The self-assessment concluded that equipment capabilities assumed in the PRA model were consistent with rated capabilities.

Thus, it is concluded that the RBS PRA has appropriately modeled conditions, such as trips and isolations, which could prevent the performance of mitigative functions.

2d.

HR-B1 (not met), HR-B2 (not met), and HR-G4 (not met). HR-B1 and HR-B2 describes how operator actions can be screened from consideration.

HR-G4 describes how time available for human actions is developed. Please review the scenarios relevant to RI-ISI and confirm that the SR requirements have been met for these scenarios.

Response to Question 2.d:

The subject Supporting Requirements and comments from the River Bend PRA Self-Assessment performed in late 2008 are:

SR #:

Supporting Requirement:

Comments:

HR-B1 Combined Capability Categories 2 The HEP screening process in the and 3:

River Bend pre-initiator evaluation is not identified consistent with If screening is performed, ESTABLISH ASME PRA Standard.

rules for screening individual activities from further consideration.

Example: Screen maintenance and test activities from further consideration only if; (a) equipment is automatically re-aligned onsystem demand, or (b) following maintenance activities, a

-post-maintenance functional test is performed that reveals misalignment, or (c) equipment position is indicated in the control room, status is routinely checked, and realignment can be affected from the control room, or (d) equipment status is required to be checked frequently (i.e., at least once a shift)

HR-B2 For all Capability Categories:

Dependent pre-initiator HEPs are addressed where multiple trains or DO NOT screen activities that could functions are affected.

simultaneously have an impact on.

Miscalibration dependencies using multiple trains of a redundant system Figure 2 of the PRA-RB-01-002S03 or diverse systems (HR-A3).

appears to be too optimistic to RBG-47009 Page 11 of 14 regarding the assignment of multiple miscalibration errors because it does not reflect:

• Common measuring standards

" Common crews

• Common procedures The 1 E-8 used for miscalibration is judged to be non-conservative and not supported by the THERP or ASEP methods.

Miscalibration probabilities of 9E-16 in Table 2 are judged to be unsupportable and detract from the high quality of the RBS PRA.

Miscalibration of Low Rx Pressure Signals (LPCI/LPCS interlock) is listed as negligible. This is contrary to HR SR-B2 and is judged to be unsupportable and detract from the high quality of the RBS PRA.

4 4.

HR-G4 For Capability Category II:

BASE the time available to complete actions on appropriate realistic generic thermal/ hydraulic analyses, or simulation from similar plants (e.g.,

plant of similar design and operation).

SPECIFY the point in time at which operators are expected to receive relevant indications.

Plant specific MAAP calculations are not used to provide allowed times for crew response.

Thermal hydraulic analyses appropriate for River Bend are not used to set time available.

No generic analysis is presented or referenced to support allowable action times.

Interface of success criteria and plant specific calculations:

HEP - BA-SSWINJ (Section 5.2.5 in PRA-RB-01-002S03) allows 20 min. for SW alignment to prevent core damage.

This appears to be in need of a clear definition of core damage (based on a measurable parameter) as required by SR SC-B2 and a method to calculate the parameter (e.g.,

RBS MAAP calculation).

Neither of these two could be found.

The 20 min. time allowed for a DBA to RBG-47009 Page 12 of 14 LOCA is judged to be significantly longer than any, other BWR reviewed by the BWROG during the BWROG certification process.

With regard to Standard SR's HR-B1 and HR-B2, the screening criteria used for identifying. pre-accident human errors are as follows:

/

Instrument miscalibration errors are screened out from consideration in the model if:

1) The instrument is not used for an automatic actuation of the equipment.

2) The instrument is not used for normal operation of the system Restoration errors are screened out if:

1) Flow is normally passing through the component

2) The component receives an automatic signal to change position on an accident.

3) The component must be manually aligned as part of a post-accident action

4) Mispositioning of the component results in an alarm.

However, these criteria were not consistently applied in the Revision 4 model. The following were the major findings in the pre-accident HRA review:

1) The Reactor Level sensors were combined into one event for all Reactor Level transmitters. The model was changed to reflect the level sensors used for HPCS vs. Low Pressure Core Injection (LPCI)/Low Pressure.Core Spray (LPCS) vs. ATWS-RPT.

2) The Reactor Pressure sensors were combined into one event for all Reactor pressure transmitters. The model was changed to reflect the pressure sensors used for LPCI/LPCS low pressure permissive vs. ATWS-RPT.

3) The Drywell Differential Pressure sensors were combined into one event for all Drywell pressure transmitters. The model was changed to reflect the pressure sensors used for HPCS vs. LPCI/LPCS.

4) A review of restoration errors found a few additional errors that needed to be added to model. The most important of these errors is the restoration of the emergency diesel generators following test and maintenance. A review of these changes relating to restoration actions results in increasing ODF by less than 0.4%. Therefore, the impact of these missing events are' negligible.

The impact of the changes regarding instrumentation is to reduce the CDF impact from the individual instruments or sets of sensors/transmitters while making the model more realistic. Thus, the current model is slightly conservative and acceptable to support the N-716 RI-ISI application. The diesel restoration model is by far the most important pre-accident HRA which is being added to the RBS PRA for Revision 5. Therefore, the 0.4% CDF increase is expected to bound the changes to the model due pre-accident HRA events which are being added for Revision 5.

to RBG-47009 Page 13 of 14 With regard to Standard SR HR-G4, the limited reliance on non-plant specific thermal-hydraulic calculations is discussed in question 2.a. For transients, the time to core damage has been based on RBS plant-specific calculations with the BWRSAR code, developed by Oak Ridge National Laboratory and discussed in NUREG/CR-5571. The associated RBS definition of core damage is in the BWRSAR calculation and is being included in the Success Criteria supplement which is being compiled as part of the ongoing Revision to the RBS PRA.

Specifically, the RBS PRA has defined the time to core damage as the time by which a measurable amount of hydrogen has been generated, as calculated by the BWRSAR code. Thus, any indications of energy release due to the Metal-Water Reaction or indications of hydrogen presence in the core is used to determine time to core damage.

As discussed in question 2.a, realistic generic thermal-hydraulic analyses from similar design BWR/6 plants, obtained from GE's NEDO-24708A document, are used to address the timing of plant responses to LOCA or stuck open relief valve scenarios. Use of these thermal-hydraulic analyses as input to plant Human Reliability Analyses is consistent with the requirements of SR HR-G4. The timing when relevant indications are available to cue operator responses are documented in the HRA calculations and associated spreadsheets.

RBS Plant-Specific MAAP analyses conducted to address time to core damage for stuck-open relief valve scenarios are also applicable for Small Break LOCA scenarios. Those RBS MAAP analyses apply a peak core temperature criteria of 2200F for the definition of core damage, and result in a 30 minute time to core damage which is consistent with the results of the generic BWRJ6 analyses of NEDO-24708A. Note that experience with the various Entergy plant PRA's also leads to the conclusion that the time to core damage is not very sensitive to the specific definition of core damage that is used.

Documentation to demonstrate that the RBS PRA meets the requirements of the ASME PRA Standard is being compiled for improved clarity and traceability as part of the ongoing PRA revision.

The River Bend PRA Human Reliability Analyses are supported by coordinated detailed spreadsheet calculations of human failure events which were not reviewed as part of the self-assessment. These spreadsheets quantify the success probabilities for human failure events using EPRI's HCR / ORE assessment methodology ( human cognitive )reliability (HCR) / operator reliability experiments (ORE)). Plant specific recognition and response times are inputs to these calculations and are based on information from operator interviews and plant procedures. Though the RBS HRA calculation has not been recently reviewed by an industry peer review team, this same HRA methodology and associated spreadsheet documentation has successfully been through RG 1.200 peer reviews for PRA models for three other plants. Reviewers have generally been complimentary of this HRA method and documentation, thus it is expected this will be judged Capability Category II at the next RBS PRA Peer Review.

The remaining specific comment from the Self-Assessment related to SR HR-G4 involves event BA-SSWINJ. That event is an operator recovery using injection of Service Water for Large Break LOCA scenarios. The probability for BA-SSWINJ to RBG-47009 Page 14 of 14 was developed assuming a 20 minute time to Core Damage for Large Break LOCA.

As part of PRA Revision 5, River Bend is consistently adopting a 10 minute time to Core Damage for Large Break LOCA, consistent with NEDO 24708A analyses.

Recalculation of this event would result in a probability of operator failure to inject before core damage of 1.02E-01 based on a 10 minute time to core damage, vice 2.6E-03 based on 20 minutes being available. Sensitivity analyses show this would result in a CDF increase of only 1 E-08/year compared to the base CDF of 3.55E-06/year, a 0.3% increase, which would not impact the use of the RBS PRA model for RI-ISI decision making. It is thus concluded that the findings of the self-assessment against SR HR-G4 have very small impact andare not significant with respect to the use of the RBS PRA in support of the N-716 relief request.

References

1. Entergy Letter to NRC dated June 16, 2009, Request for Alternative -

Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013 / RBG 46922)

2. NRC letter to Entergy July 29, 2009, River Bend Station, Unit 1 -

Supplemental Information Needed For Acceptance Of Requested Licensing Action Re: Risk-informed Relief Request Based On ASME Code Case N-716 (TAC ME1507)

3. Entergy Letter to NRC dated August 11, 2009 Supplement to Request for Alternative - Implementation of a Risk-Informed Inservice Inspection Program Based on ASME Code Case N-716 (RBS-ISI-013/RBG-46944)

C,

ATTACHMENT 2 TO RBG-47009 List of Regulatory Commitments to RBS-47009 Page 1 of 1 List of Regulatory Commitments The following table identifies those actions committed to by Entergy in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE (Check one)

SCHEDULED ONE-CONTINUING COMPLETION COMMITMENT TIME COMPLIANCE DATE (If ACTION Required)

As discussed during the December 2009 NRC audit X

12/15/2011 of the RBS PRA Self-Assessment against the ASME PRA Standard, Entergy commits to review the impact of the ongoing PRA Revision 5 on the RI-ISI program by December 15, 2011.