Text

License Amendment Request Proposed Changes to Technical Specifications Sections 3.5.1,3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 to Extend the Allowed Outage Times
	ML100810151
Person / Time
Site:	Limerick
Issue date:	03/19/2010
From:	Cowan P; Exelon Generation Co, Exelon Nuclear
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML100810151 (182)
	v • d • e

Exelon Nuclear 200 Exelon Way Kennett Square, PA 19348 March 19,2010 www.exeloncorp.com Exelon.

Nuclear 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Limerick Generating Station, Units 1 and 2 Facility Operating License Nos. NPF-39 and NPF-85 NRC Docket Nos. 50-352 and 50-353

Subject:

License Amendment Request Proposed Changes to Technical Specifications Sections 3.5.1,3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 to Extend the Allowed Outage Times

References:

1.

NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, II Revision 1, November 2002.

2.

NRC Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," August 1998.

3.

NRC Regulatory Guide 1.200, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," Revision 1, January 2007.

Pursuant to 10 CFR 50.90, "Application for amendment of license or construction permit,"

Exelon Generation Company, LLC (Exelon), proposes changes to the Technical Specifications (TS), Appendix A of Operating License Nos. NPF-39 and NPF-85 for Limerick Generating Station (LGS), Units 1 and 2, respectively.

This submittal requests changes to extend the TS allowed outage time (AOT) for the Unit 1 and Unit 2 Suppression Pool Cooling (SPC) mode of the Residual Heat Removal (RHR) system, the Residual Heat Removal Service Water (RHRSW) system, the Emergency Service Water (ESW) system, and the A.C. Sources - Operating (Emergency Diesel Generators) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to

.seven (7) days in order to allow for repairs of the RHRSW system piping. Specifically, a footnote will be added to the affected LCOs to indicate that the 72-hour AOT for the affected system may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures in effect.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Docket Nos. 50-352 and 50-353 March 19, 2010 Page 2 The proposed changes have been evaluated using the risk informed processes described in Regulatory Guide (RG) 1.174 (Reference 1) and RG 1.177 (Reference 2). The risk associated with the proposed changes was found to be acceptable.

The LGS Generic Letter (GL) 89-13 Program performs periodic Ultrasonic Testing (UT) on the safety-related raw water systems, ESW and RHRSW, to ensure that corrosion and erosion does not degrade the structural integrity of the systems. Exelon has recently implemented a Buried Pipe Raw Water Corrosion Program, which integrates and supplements the inspections performed under the GL 89-13 program. The Buried Pipe Raw Water Corrosion Program utilizes Guided Wave technology to perform qualitative assessment exams on the ESW and RHRSW system piping.

The data gathered from both the UT and Guided Wave inspections is utilized by the station to determine the scope for additional inspections and future repair/replacements. Based on the inspections performed, LGS has identified that localized corrosion is evident in the large diameter RHRSW and ESW system piping. Five Code Case N-661 weld overlay repairs were performed on the 30 RHRSW return line piping (four overlays on the 'A' subsystem and one overlay on the 'B' subsystem) to address flaw areas. Additional weld overlay repairs are anticipated prior to replacement of the piping.

Strategic, proactive replacement of the large diameter RHRSW and ESW system piping is necessary to preclude future emergent repair and replacement activities, and to ensure the long-term reliability of the piping systems. LGS has developed a segmented approach for a proactive replacement plan. The segments are prioritized based on a review of the UT data, Guided Wave data, previous repair history and risk to plant operation. The first priority is the RHRSW return line piping. The plan is to complete the replacement of portions of each RHRSW return line during future refueling outages. The 'A' RHRSW return line piping is expected to coincide with Unit 1 outages. The 'B' RHRSW return line piping is expected to coincide with Unit 2 outages. Piping replacement is currently scheduled to begin on the 'A' RHRSW return line during the 2012 Unit 1 refueling outage. The RHRSW return lines are common to both units with an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

provides the evaluation of the proposed changes. Attachment 2 provides the marked-up TS pages indicating the proposed changes. Attachment 3 provides an evaluation of the technical adequacy of the PRA and summary of PRA assessment in accordance with Regulatory Guide 1.200, Revision 1 (Reference 3). Attachment 5 provides an overview drawing of the ESW and RHRSW systems.

This amendment request contains one regulatory commitment to implement the compensatory measures discussed in Section 4.2 of Attachment 1 during the extended AOTs. This commitment is listed in Attachment 4.

Exelon has concluded that the proposed changes present no significant hazards consideration under the standards set forth in 10 CFR 50.92.

License Amendment Request Changes to TS LCOs 3.5.1,3.6.2.3,3.7.1.1,3.7.1.2 and 3.8.1.1 Docket Nos. 50-352 and 50-353 March 19,2010 Page 3 Exelon requests approval of the proposed amendment by March 19, 2011. Upon NRC approval, the amendment shall be implemented within 60 days of issuance.

The proposed changes have been reviewed by the Plant Operations Review Committee and approved by the Nuclear Safety Review Board.

We are notifying the State of Pennsylvania of this application for changes to the Technical Specifications by transmitting a copy of this letter and its attachments to the designated State Official.

If you have any questions or require additional information, please contact Glenn Stewart at 610-765-5529.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on the 19th day of March 2010.

Pamela B. Cowan Director, Licensing & Regulatory Affairs Exelon Generation Company, LLC Attachments:

1.

Evaluation of Proposed Changes 2.

Markup of Proposed Technical Specifications Pages 3.

Risk Assessment and Technical Adequacy of the PRA 4.

Summary of Regulatory Commitments 5.

Emergency Service Water/RHR Service Water Overview Drawing cc:

Regional Administrator - NRC Region I NRC Senior Resident Inspector - Limerick Generating Station NRC Project Manager, NRR - Limerick Generating Station Director, Bureau of Radiation Protection - Pennsylvania Department of Environmental Protection w/ attachments

ATTACHMENT 1 License Amendment Request Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 EVALUATION OF PROPOSED CHANGES

Subject:

Proposed Changes to Technical Specifications Sections 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 to Extend the Allowed Outage Times

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

S

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 1 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, Application for amendment of license or construction permit, Exelon Generation Company, LLC (Exelon), proposes changes to the Technical Specifications (TS), Appendix A of Operating License Nos. NPF-39 and NPF-85 for Limerick Generating Station (LGS), Units 1 and 2, respectively.

This submittal requests changes to extend the allowed outage time (AOT) for the Unit 1 and Unit 2 Suppression Pool Cooling (SPC) mode of the Residual Heat Removal (RHR) system, the Residual Heat Removal Service Water (RHRSW) system, the Emergency Service Water (ESW) system, and the A.C. Sources - Operating (Emergency Diesel Generators [EDGs]) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to seven (7) days in order to allow for repairs of the RHRSW system piping. Specifically, a footnote will be added to the affected LCOs to indicate that the 72-hour AOT for the affected systems may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures in effect.

The proposed changes have been evaluated using the risk informed processes described in Regulatory Guide (RG) 1.174 (Reference 1), and RG 1.177 (Reference 2).

The risk associated with the proposed changes was found to be acceptable.

A description and evaluation of the proposed changes are provided in this attachment. provides the marked-up TS pages indicating the proposed changes. provides the evaluation of the technical adequacy of the PRA and a summary of the PRA assessment in accordance with Regulatory Guide 1.200 (Reference 3). Attachment 5 provides an overview drawing of the ESW and RHRSW systems.

2.0 PROPOSED CHANGE

S Exelon proposes that TS 3.7.1.1, Action a.3, be revised (through the addition of a footnote) to allow one subsystem of RHRSW to be inoperable for 7 days and TS 3.7.1.2, Action a.3, be revised to allow one loop of ESW to be inoperable for 7 days. Exelon also proposes that the TS affecting one loop of the SPC mode of RHR (TS 3.6.2.3, Action a.)

and two onsite A.C. Sources (EDGs; TS 3.8.1.1, Action b and Action e.1.) be revised to allow them to be inoperable for the same 7-day period. In order to maintain compliance with TS 3.5.1 (Emergency Core Cooling Systems [ECCS]), Exelon also proposes that the OPCON 3 portion of the TS 3.5.1 APPLICABILITY statement be amended to allow, during the extended AOT period, for the alignment of one Low Pressure Coolant Injection (LPCI) subsystem of the RHR system in the RHR shutdown cooling (SDC) mode. These extensions will be taken concurrently to permit completion of repairs to one RHRSW subsystem piping during shutdown of one unit and operation of the other unit.

These proposed TS changes involve a revision to extend the AOT for one RHRSW subsystem, one loop of the SPC mode of the RHR system, one ESW loop, and two EDGs from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days. Specifically, a footnote will be added to the affected LCOs to indicate that the 72-hour AOT for the affected system may be extended once per

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 2 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in the NRC Safety Evaluation approving this amendment request established and in effect. Markups showing the specific changes to the affected TS pages are provided in Attachment 2.

3.0 BACKGROUND

RHRSW SYSTEM DESCRIPTION The RHRSW system is a safety-related system, designed to supply cooling water to the RHR heat exchangers of both units. The RHRSW system is designed to provide a reliable source of cooling water for all operating modes of the RHR system, including heat removal under post-accident conditions. It also provides water to flood the reactor core, or to spray the primary containment after an accident, if necessary.

The system is common to the two reactor units, and consists of two subsystems. Each subsystem services one RHR heat exchanger in each unit, and provides sufficient cooling for safe shutdown, cooling, and accident mitigation of both units. The two RHRSW system return headers are cross-connected for flexibility. Two valves in series are provided on the cross-connect, so failure in one subsystem cannot affect the operation of the other. Each subsystem has two pumps located in the spray pond pump structure. One pump supplies 100% flow to one RHR heat exchanger. During two-unit operation, there are two heat exchangers (one per unit), and therefore, two of the four pumps are required for safe shutdown and accident mitigation.

The RHRSW system is available for normal shutdown or emergencies, and if necessary, the RHRSW system can be used in conjunction with the RHR system SPC mode to maintain the suppression pool below specified temperature limits.

The RHRSW pump motors obtain their power from separate Class 1E buses; the 'A' and

'B' pumps from Unit 1 buses D11 and D12, respectively, and the 'C' and 'D' pumps from the Unit 2 buses D21 and D22, respectively. If a LOOP occurs, the EDGs start automatically, providing emergency power to the buses. The pumps are started manually.

The RHRSW return and the return from both ESW loops share a common return header to the spray pond. Loss of one RHRSW/ESW return header does not affect the capability of the second return header to safely shut down either or both units during emergency conditions.

Under certain maintenance configurations, flow from the two ESW return headers may be combined in one line for a limited period of time. Any active valves which could fail and disable this line will be administratively controlled in the safe position. Passive failures which could cause the total failure of this line during this limited duration have been evaluated and are not considered credible.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 3 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes Upon standby EDG or ESW pump start, the RHRSW system automatically aligns itself to the spray pond mode, if it is not already in that mode. If the cooling tower mode is available, the system can be manually aligned to it. Bypass lines are provided to discharge water directly to the pond, rather than the spray networks, during periods when the pond is frozen.

The RHRSW pumps can be manually started from the control room. The 'A' RHRSW pump and associated valves can be operated from the Unit 1 remote shutdown panel.

The 'C' RHRSW pump and associated valves can be operated from the Unit 2 remote shutdown panel. The 'B' RHRSW pump can also be remote locally operated from the 'B' RHRSW pump motor circuit breaker cubicle.

ESW SYSTEM DESCRIPTION The ESW system is designed to supply cooling water to selected equipment during a LOOP condition or LOCA. The ESW system is safety-related. The system is common to Units 1 and 2, and consists of two independent loops ('A' and 'B'), with two 50% system capacity (100% loop capacity) pumps per loop. The ESW system is designed to supply cooling water to the following safety-related equipment:

a. RHR motor oil coolers

b. RHR pump compartment unit coolers

c. Core spray pump compartment unit coolers

d. Control room chillers

e. Standby diesel generator heat exchangers

f.

Reactor Core Isolation Cooling (RCIC) pump compartment unit coolers

g. High Pressure Coolant Injection (HPCI) pump compartment unit coolers

h. Spent fuel pools (makeup water)

In addition to the above equipment, emergency procedures direct providing ESW to the following nonsafety-related equipment during a LOOP:

a. Reactor Enclosure Cooling Water (RECW) heat exchangers

b. Turbine Enclosure Cooling Water (TECW) heat exchangers During normal plant operation all of the above equipment, with the exception of the EDGs, is provided with cooling by the service water system. Essential heat loads normally cooled by the service water system are automatically transferred to the ESW system under LOOP and LOCA accident conditions.

The ESW pumps start automatically on EDG operation (e.g., EDGs D11 or D21 cause ESW pump 'A' to start) after speed, voltage, and bus breaker conditions are met, and after a load sequencing delay. ESW pump operation causes automatic valve and sluice gate realignments to:

a. Take pump suction from the spray pond.

b. Provide ESW to safety-related equipment.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 4 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

c. Return the ESW to the spray pond via the RHRSW system.

Each EDG can be supplied with cooling water from ESW loop 'A' or loop 'B'. Normal system alignment, however, is such that loop 'A' supplies cooling water to the D11/D21 and D13/D23 EDGs, and loop 'B' supplies the D12/D22 and D14/D24 EDGs.

Each loop is designed such that ESW flow to one unit can be isolated without adversely affecting flow to the other unit.

The ESW pumps can be manually started from the control room. The 'A' ESW pump and associated 'A' loop valves can be operated from the remote shutdown panel. The 'B' and

'C' ESW pumps can also be operated from the 'B' and 'C' pumps' motor circuit breaker cubicles, respectively.

ESW loop 'A' and 'B' piping is physically separated or protected so that no single postulated event can impair the systems capability to perform its required safety functions. The ESW flow is combined with the RHRSW flow before it is returned to the spray pond or cooling tower. The return from each ESW loop is connected to both the 'A' and 'B' RHRSW subsystems.

During certain maintenance configurations, one ESW loop may be lost due to the loss of a single ESW/RHRSW combined return header. However, sufficient redundancy and heat removal capacity remains in the other ESW loop such that ESW can perform its safety function.

CURRENT CONDITION The LGS Generic Letter 89-13 Program performs periodic Ultrasonic Testing (UT) on the safety-related raw water systems, ESW and RHRSW, to ensure that corrosion and erosion does not degrade the structural integrity of the systems. Exelon has recently implemented a Buried Pipe Raw Water Corrosion Program, which integrates and supplements the inspections performed under the GL 89-13 program. The Buried Pipe Raw Water Corrosion Program utilizes Guided Wave technology to perform qualitative assessment exams on the ESW and RHRSW system piping.

The data gathered from both the UT and Guided Wave inspections is utilized by the station to determine the scope for additional inspections and future repair/replacements.

Based on the inspections performed, LGS has identified that localized corrosion is evident in the large diameter RHRSW and ESW system piping. Five Code Case N-661 weld overlay repairs were performed on the 30 RHRSW return line piping (four overlays on the 'A' subsystem and one overlay on the 'B' subsystem) to address flaw areas.

Additional weld overlay repairs are anticipated prior to replacement of the piping.

Strategic, proactive replacement of the large diameter RHRSW and ESW system piping is necessary to preclude future emergent repair and replacement activities, and to ensure the long-term reliability of the piping systems. LGS has developed a segmented approach for a proactive replacement plan. The segments are prioritized based on a

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 5 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes review of the UT data, Guided Wave data, previous repair history and risk to plant operation. The first priority is the RHRSW return line piping. The plan is to complete the replacement of portions of each RHRSW return line during future refueling outages. The

'A' RHRSW return line piping is expected to coincide with Unit 1 outages. The 'B' RHRSW return line piping is expected to coincide with Unit 2 outages. Piping replacement is currently scheduled to begin on the 'A' RHRSW return line during the 2012 Unit 1 refueling outage. The RHRSW return lines are common to both units with an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

4.0 TECHNICAL ANALYSIS

These proposed TS changes are requested to allow adequate time to effect repairs of piping in one RHRSW subsystem during a shutdown of one unit and operation of the other unit.

The ESW and RHRSW systems each consist of two independent loops/subsystems, common to both units (i.e., 'A' and 'B' loops/subsystems). One RHRSW subsystem will be removed from service during this repair.

In order to minimize the impact to plant safety, both ESW loops will be aligned to return through the remaining operable RHRSW return header. Therefore, cooling will be maintained for all safety related equipment for the duration of the piping repairs.

4.1 PLANT SYSTEM IMPACT The ESW and RHRSW systems and their supported systems are designed with sufficient independence and redundancy such that the removal from service of a component and/or subsystem will not prevent the systems from performing their required safety function.

Based on the support functions of the ESW and RHRSW systems, a review of the plant was performed to determine the impacts that the inoperable RHRSW subsystem would have on other systems. The impacts were evaluated for each system as discussed below. As described below, the consequences of any postulated accident occurring during the extended AOTs were found to be bounded by the previous analyses described in the LGS Updated Final Safety Analysis Report (UFSAR). Asterisks (*)

specified in any of the component ID numbers within this section delineate Unit 1 or Unit 2 equipment.

With 'A' RHRSW subsystem inoperable and drained for maintenance (Unit 2 operating and Unit 1 shutdown)

a. RHRSW - TS 3.7.1.1, ACTION a.3., provides for an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with one RHRSW subsystem inoperable. The result of the inoperable RHRSW subsystem is to declare the 'A' RHR heat exchanger inoperable on each unit. This impacts the Unit 1 RHR modes of operation as described in Item c. below.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 6 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes The removal of the 'A' RHRSW subsystem from service will also result in the 'A' RHRSW return header to the spray pond being inoperable. This header is also used by the 'A' and 'B' loops of ESW. The impact on the ESW system is evaluated in Item b. below.

Unit-2 For Unit 2 only, the removal of the 'A' RHRSW subsystem from service will also temporarily eliminate the ability of the RHRSW system from supporting a non-TS operation of the RHR system. The 'A' RHRSW subsystem is designed to be able to provide water to the RHR system as a backup source for post-accident containment spray and core flooding. The RHRSW supply to the RHR system is used for extreme emergency conditions when the RHR system cannot perform its cooling function. Since this is a non-TS function, and the probability of needing this function during the extended AOTs is judged to be low, the loss of this function for seven days is considered to be acceptable.

b. Emergency Service Water - TS 3.7.1.2, Action a.3., provides for an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with one ESW loop Inoperable. The result of the inoperable ESW loop is to declare all equipment cooled by that ESW loop inoperable on each unit. With the

'A' RHRSW header inoperable, both the 'A' and 'B' loops of ESW shall be aligned to return to the operable 'B' RHRSW return header only. With only one RHRSW return header available, neither loop of ESW is single failure proof. However, valves HV-11-011A, HV-11-011B, HV-11-015A and HV-11-015B are the only single active failure components in the ESW system which would have the potential for causing the complete failure of ESW during the extended AOT. The ESW return valves, HV-11-011A and HV-11-011B, to the 'A' RHRSW return header will be administratively controlled in the closed position and de-energized.

To assure the availability of ESW, the ESW return valves, HV-11-015A and HV-11-015B, to the 'B' RHRSW return header will be administratively controlled in the open position and de-energized prior to entering the extended AOT. This will eliminate the possibility of a single active failure rendering ESW inoperable.

Even though the ESW system meets single active failure criteria in this alignment, it will not be single passive failure proof. As a result, the ESW system will not meet the requirements of GDC 44, "Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure." Therefore, the 'A' ESW loop will be declared inoperable and the TS Action for a single ESW loop inoperable will be entered. Associated components cooled by the 'A' ESW loop will also be declared inoperable, as required by LGS TS 3/4.7.1.2, Action a.3, "With one emergency service water system loop otherwise inoperable, declare all equipment aligned to the inoperable loop inoperable**, restore the inoperable loop to OPERABLE status with at least one OPERABLE pump within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 7 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 1 For Unit 1 only, the removal of the 'A' RHRSW subsystem from service will temporarily eliminate the ability of the ESW system to provide a backup cooling water supply for the TECW system. In this backup alignment, TECW is supplied from the 'A' ESW loop, but the return from the TECW heat exchangers is piped directly into the 'A' RHRSW return line, which will be drained and out of service.

While spurious opening of this valve would not cause sufficient loss of ESW flow to disable the 'A' ESW loop, leakage from ESW into the inoperable 'A' RHRSW subsystem is not desirable. Therefore, valve HV-012-110 will be administratively controlled in the closed position and electrically disabled to prevent spurious operation. This is not a safety related function of ESW. For Unit 1, declaring the

'A' ESW loop inoperable will not result in entering any additional TS actions, since Technical Specification 3/4.7.1.2 only requires one loop of ESW in operating conditions 4, 5 and *.

Unit 2 For Unit 2 only, declaring the 'A' ESW loop inoperable and entering TS 3/4.7.1.2, Action a.3, will result in the following components also being declared inoperable and entering into the accompanying TS Actions:

D21 and D23 EDGs, TS 3.8.1.1, A.C. Sources, Action b.: "With two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. Restore at least one of the inoperable diesel generators to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e."

D21 and D23 EDGs, TS 3.8.1.1, A.C. Sources, Action e.1: "For two train systems, with one or more diesel generators of the above required A.C.

electrical power sources inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter that at least one of the required two train system subsystem, train, components, and devices is OPERABLE and its associated diesel generator is OPERABLE. Otherwise, restore either the inoperable diesel generator or the inoperable system subsystem to an OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 2 'A' Core Spray subsystem, TS 3.5.1, ECCS Operating, Action a.1: "With one CSS subsystem inoperable, provided that at least two LPCI subsystems are OPERABLE, restore the inoperable CSS subsystem to OPERABLE status within 7 days or be in at least HOT

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 8 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 2 'A' and 'C' LPCI subsystems, TS 3.5.1, ECCS Operating, Action b.4: "With two LPCI subsystems inoperable, provided that at least one CSS subsystem is OPERABLE, restore at least three LPCI subsystems to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 2 'A' SPC loop, TS 3.6.2.3.a, Suppression Pool Cooling: See discussion in paragraph c. RHR below under Decay Heat Removal Capability.

While the above listed components will be declared inoperable, they will not be removed from service and will be verified available to perform their design basis function prior to entering the proposed configuration.

c. RHR - The inoperability of the 'A' RHR heat exchanger (due to the inoperability of the 'A' RHRSW subsystem) impacts the various modes of RHR operation and emergency core cooling system (ECCS) capability as discussed below.

DECAY HEAT REMOVAL CAPABILITY The RHR heat exchangers provide methods of residual decay heat removal and suppression pool/drywell temperature control. Residual decay heat removal is a normal shutdown cooling mode of operation when a unit is shutdown. Two loops of the SDC mode of RHR are required to be operable while in OPCON 3 (TS 3.4.9.1) with reactor vessel pressure less than the RHR cut-in permissive set point, in OPCON 4 (TS 3.4.9.2), and in OPCON 5 (TS 3.9.11.2) with irradiated fuel in the reactor vessel and the water level less than 22 feet above top of the reactor pressure vessel flange, otherwise an alternate method of decay heat removal is required to be demonstrated.

Unit 2 is expected to stay in OPCON 1. Therefore, these SDC modes of RHR TS would not be applicable. However, since there is a possibility that Unit 2 might be forced to shut down during the extended AOT period, the shutdown sequence and compliance with TS must be evaluated. Upon entering OPCON 3, and while depressurizing to the RHR cut-in permissive set-point, the 'B' and 'D' RHR pumps would be maintained operable in their normal LPCI mode alignment. This would maintain the plant's level of compliance with the TS (as required for the extended AOTs) during OPCON 3, prior to depressurizing below the RHR cut-in permissive setpoint.

The LPCI alignment would maintain the two LPCI subsystems (i.e., 'B' and 'D')

operable for automatic operation. The 'B' loop of suppression pool spray (SPS) and the 'B' loop of SPC would also be maintained operable since they could be

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 9 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes aligned from the control room if an accident were to occur. Once the RHR cut-in permissive set-point is reached in OPCON 3, then TS 3.4.9.1, ACTION a. must be entered since only the 'B' loop of SDC would be operable. The 'B' loop of SDC would be operable since it would be capable of being aligned from the control room (except for system flushing) under normal shutdown conditions. The operability of alternate methods of decay heat removal would be demonstrated to meet the requirements of TS 3.4.9.1, ACTION a. The alternate methods of decay heat removal that would be considered to meet TS 3.4.9.1, ACTION a. are covered by LGS procedure GP-6.2, "Shutdown Operations - Shutdown Condition Tech Spec Actions." However, an alternate method would only need to be put into operation if the 'B' loop of SDC became inoperable and if the operability of the 'B' loop of SDC could not be reestablished by implementing LGS Off Normal procedure ON-121, "Loss of Shutdown Cooling."

In OPCONs 4 or 5, the 'B' and 'D' loops of SDC, which both use the operable 'B' RHR heat exchanger, will be considered operable in accordance with LGS procedure GP-6.2 and will satisfy the shutdown cooling requirements in OPCONs 4 and 5, if required.

The RHRSW system is manually operated and is not required during the first 10 minutes of an event. Long-term actions (i.e., greater than 10 minutes) will be affected to the extent that only the 'B' RHR heat exchanger will be operable for long-term decay heat removal. Long-term cooling requirements will be met by the operable 'B' RHR heat exchanger and the operable 'B' RHRSW subsystem in either the SPS or SPC modes of operation, as discussed below.

Decay heat removal for suppression pool/drywell temperature control is an accident mitigation function. The RHR system supports this function by two modes of operation, SPS and SPC, both of which utilize the RHR heat exchangers. TS 3.6.2.2 requires that two loops of the SPS mode of the RHR system be operable in OPCONs 1, 2 and 3. The AOT for one inoperable loop of SPS is seven days, therefore no relief from this AOT is required. TS 3.6.2.3 requires that two loops of SPC mode of the RHR system be operable in OPCONs 1, 2 and 3. The AOT for one inoperable loop of SPC is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The AOT for this LCO is proposed to be extended to seven days.

LGS UFSAR Section 6.2.1.1.3.3.1.6 demonstrates that one operable RHR heat exchanger is adequate for accident mitigation. Two cases with only one operable RHR heat exchanger are presented. In the first case, the operable RHR heat exchanger is placed in service, in containment spray, while one LPCI pump and one Core Spray subsystem inject water into the vessel. In the other case, the RHR heat exchanger is placed in service with an associated RHR pump taking suction from the suppression pool and discharging to the vessel while another RHR pump (in LPCI mode of operation) and one Core Spray subsystem inject directly into the vessel. Both cases assume a LOOP and that the HPCI system is available for the entire accident. This analysis is for a rupture of a recirculation

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 10 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes line and is bounding for other events. During the extended AOT, there will be sufficient equipment available to operate in either one of these modes.

Since one RHRSW subsystem with two RHRSW pumps can mitigate a Design Basis Accident (DBA) on one unit and support the safe shutdown of the other unit, then the potential heat removal demand during the period that these TS changes will be in effect is within the capacity of the single operable 'B' RHRSW subsystem.

Therefore, by maintaining the 'B' RHR heat exchanger and the 'B' RHRSW subsystem and associated equipment/systems operable during this period, the RHR and RHRSW systems will be able to provide adequate decay heat removal, and the consequences of an accident will remain unchanged.

The following components (if they were to individually fail) would have the potential of completely preventing the RHR 'B' heat exchanger or the 'B' RHRSW subsystem from performing their safety functions (i.e., requiring use of the heat exchanger) while RHRSW subsystem 'A' is removed from service.

RHR heat exchanger, RHR inlet valve:

HV-51-*F047B (normally open - safety function - open)

RHR heat exchanger, RHR outlet valve:

HV-51-*F003B (normally open - safety function - open)

RHR heat exchanger, RHR bypass valve:

HV-C-51-*F048B (normally open - safety function - throttled closed)

RHR heat exchanger, RHRSW inlet valve:

HV-51-*F014B (normally closed - safety function - open)

RHR heat exchanger, RHRSW outlet valve:

HV-51-*F068B (normally closed - safety function - throttled open)

RHRSW spray pond spray network B, inlet valve:

HV-12-032B (normally closed - safety function - open)

RHRSW spray pond spray network D, inlet valve:

HV-12-032D (normally closed - safety function - open)

RHRSW Pump 0B-P506 (normally standby - safety function running)

RHRSW Pump 0D-P506 (normally standby - safety function running)

Random failures of these components are included in the probabilistic risk assessment and compensatory measures have been identified to reduce the risk associated with these potential failures.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 11 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

d. Systems supporting RHRSW RHRSW to spray nozzles crosstie (spray A/C to spray B/D)

HV-12-034A (normally closed - safety function -closed)

RHRSW to spray nozzles crosstie (spray A/C to spray B/D)

HV-12-034B (normally closed - safety function -closed)

The above valves separate the subsystem A and subsystem B spray networks.

These valves are all normally closed with the HV-12-034A valve locked closed and de-energized. Therefore, separation of the operable 'B' RHRSW subsystem from the inoperable 'A' RHRSW subsystem is maintained.

RHRSW to Unit 1 Cooling Tower Valves HV-12-111 and HV-12-113 (D11 & D23)

Unit 1 Cooling Tower to RHRSW/ESW Wet Well Valves HV-12-112 and HV-12-114 (D11 & D23)

The above valves isolate the 'A' RHRSW subsystem lines to and from the Unit 1 cooling tower. Since both EDG D11 and D23 will be verified available prior to entering the proposed configuration, these valves will be capable of being operated as designed.

RHRSW to Unit 2 Cooling Tower Valves HV-12-211 and HV-12-213 (D12 & D24)

Unit 2 Cooling Tower to RHRSW/ESW Wet Well Valves HV-12-212 and HV-12-214 (D12 & D24)

The above valves isolate the 'B' RHRSW subsystem lines to and from the Unit 2 cooling tower. Since both EDG D12 and D24 will be operable, these valves will be capable of being operated as designed.

The RHRSW system was designed with sufficient capacity so that one RHRSW subsystem with two pumps in operation and two spray networks can mitigate a DBA on one unit while supporting the safe shutdown of the other unit. In order to maintain the full operability of the 'B' RHRSW subsystem, Unit 1 EDGs D12 and D14, and Unit 2 EDGs D22 and D24, will be maintained operable.

Therefore, the 'B' RHRSW subsystem can fulfill its design function during a DBA and limit the consequences of the accident during the extended AOT.

e. Remote Shutdown System (RSS) - The capability to perform a plant shutdown from the remote shutdown panel will not be available during the extended AOT since equipment such as the A RHRSW and C RHRSW pumps are operated

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 12 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes from the remote shutdown panel and will not be available. However, alternate means of performing a remote plant shutdown are available by operating equipment locally/remotely in accordance with station Special Event Procedure SE-6, "Alternate Remote Shutdown."

f.

Automatic Alignment of Spray Pond Sprays - With the 'A' RHRSW return header drained and the 'A' loop of ESW aligned to the operable 'B' RHRSW return header, starting of the 'A' and 'C' ESW pumps will not cause automatic realignment of the spray pond return from the winter bypass line to the spray networks. Operator action will be required to realign the valves for this condition.

Since the modifications will be performed with one unit shutdown, the heat loads that would be transferred to the spray pond following an accident in the operating unit would be significantly lower than those used in the bounding spray pond analysis. Therefore, any delays associated with manual alignment of the spray valves would not adversely affect the maximum analyzed spray pond temperature. This is not a unit specific impact.

With 'B' RHRSW Subsystem Inoperable and drained for maintenance (Unit 1 operating and Unit 2 shutdown)

a. RHRSW -TS 3.7.1.1, ACTION a.3., provides for an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with one RHRSW subsystem inoperable. The result of the inoperable RHRSW subsystem is to declare the 'B' RHR heat exchanger inoperable on each unit. This impacts the Unit 1 RHR modes of operation as described in Item c. below.

The removal of the 'B' RHRSW subsystem from service will also result in the 'B' RHRSW return header to the spray pond being inoperable. This header is also used by the 'A' and 'B' loops of ESW. The impact on the ESW system is evaluated in Item b. below.

Unit-1 For Unit 1 only, the removal of the 'B' RHRSW subsystem from service will also temporarily eliminate the ability of the RHRSW system from supporting a non-TS operation of the RHR system. The 'B' RHRSW subsystem is designed to be able to provide water to the RHR system as a backup source for post-accident containment spray and core flooding. The RHRSW supply to the RHR system is used for extreme emergency conditions when the RHR system cannot perform its cooling function. Since this is a non-TS function, and the probability of needing this function during the extended AOTs is judged to be low, the loss of this function for seven days is considered to be acceptable.

b. Emergency Service Water - TS 3.7.1.2, Action a.3., provides for an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months with one ESW loop inoperable. The result of the inoperable ESW loop is to declare all equipment cooled by that ESW loop inoperable on each unit. With the

'B' RHRSW header inoperable, both the 'A' and 'B' loops of ESW shall be aligned to return to the operable 'A' RHRSW return header only. With only one RHRSW return header available, neither loop of ESW is single failure proof. However,

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 13 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes valves HV-11-011A, HV-11-011B, HV-11-015A and HV-11-015B are the only single active failure components in the ESW system which would have the potential for causing the complete failure of ESW during the extended AOT. The ESW return valves, HV-11-015A and HV-11-015B, to the 'B' RHRSW return header will be administratively controlled in the closed position and de-energized.

To assure the operability of ESW, the ESW return valves, HV-11-011A and HV-11-011B, to the 'A' RHRSW return header will be verified open and administratively controlled in the open position and de-energized prior to entering the extended AOT. This will eliminate the possibility of a single active failure rendering ESW inoperable.

Even though the ESW system meets single active failure criteria in this alignment, it will not be single passive failure proof. As a result, the ESW system will not meet the requirements of GDC 44, "Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure." Therefore, the 'B' ESW loop will be declared inoperable and the TS Action for a single ESW loop inoperable will be entered. Associated components cooled by the 'B' ESW loop will also be declared inoperable, as required by LGS TS 3/4.7.1.2., Action a.3, "With one emergency service water system loop otherwise inoperable, declare all equipment aligned to the inoperable loop inoperable**, restore the inoperable loop to OPERABLE status with at least one OPERABLE pump within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 2 For Unit 2 only, the removal of the 'B' RHRSW subsystem from service will temporarily eliminate the ability of the ESW system to provide a backup cooling water supply for the TECW system. In this backup alignment, TECW is supplied from the 'B' ESW loop, but the return from the TECW heat exchangers is piped directly into the 'B' RHRSW return line, which will be drained and out of service.

While spurious opening of this valve would not cause sufficient loss of ESW flow to disable the 'B' ESW loop, leakage from ESW into the inoperable 'B' RHRSW subsystem is not desirable. Therefore, valve HV-012-210 will be administratively controlled in the closed position and electrically disabled to prevent spurious operation. This is not a safety related function of ESW. For Unit 2, declaring the

'B' ESW loop inoperable will not result in entering any additional TS actions, since TS 3.7.1.2 only requires one loop of ESW in operating conditions 4, 5 and *.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 14 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes Unit 1 For Unit 1 only, declaring the 'B' ESW loop inoperable and entering TS 3.7.1.2, Action a.3, will result in the following components also being declared inoperable and entering into the accompanying TS Actions:

D12 and D14 EDGs, TS 3.8.1.1, A.C. Sources, Action b.: "With two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter. Restore at least one of the inoperable diesel generators to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . See also ACTION e."

D12 and D14 EDGs, TS 3.8.1.1, A.C. Sources, Action e.1: "For two train systems, with one or more diesel generators of the above required A.C.

electrical power sources inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter that at least one of the required two train system subsystem, train, components, and devices is OPERABLE and its associated diesel generator is OPERABLE. Otherwise, restore either the inoperable diesel generator or the inoperable system subsystem to an OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 1 'B' Core Spray subsystem, TS 3.5.1, ECCS Operating, Action a.1: "With one CSS subsystem inoperable, provided that at least two LPCI subsystems are OPERABLE, restore the inoperable CSS subsystem to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 1 'B' and 'D' LPCI subsystems, TS 3.5.1, ECCS Operating, Action b.4: "With two LPCI subsystems inoperable, provided that at least one CSS subsystem is OPERABLE, restore at least three LPCI subsystems to OPERABLE status within 7 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ."

Unit 1 'B' SPC loop, TS 3.6.2.3.a, Suppression Pool Cooling: See discussion in paragraph c. RHR below under Decay Heat Removal Capability While the above listed components will be declared inoperable, they will not be removed from service and will be verified available to perform their design basis function prior to entering the proposed configuration.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 15 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

c. RHR - The inoperability of the 'B' RHR heat exchanger (due to the inoperability of the 'B' RHRSW subsystem) impacts the various modes of RHR operation and ECCS capability as discussed below.

DECAY HEAT REMOVAL CAPABILITY The RHR heat exchangers provide methods of residual decay heat removal and suppression pool/drywell temperature control. Residual decay heat removal is a normal shutdown cooling mode of operation when a unit is shutdown. Two loops of the SDC mode of RHR are required to be operable while in OPCON 3 (TS 3.4.9.1) with reactor vessel pressure less than the RHR cut-in permissive set point, in OPCON 4 (TS 3.4.9.2), and in OPCON 5 (TS 3.9.11.2) with irradiated fuel in the reactor vessel and the water level less than 22 feet above top of the reactor pressure vessel flange, otherwise an alternate method of decay heat removal is required to be demonstrated.

Unit 1 is expected to stay in OPCON 1. Therefore, these SDC modes of RHR TS would not be applicable. However, since there is a possibility that Unit 1 might be forced to shutdown during the extended AOT period, the shutdown sequence and compliance with TS must be evaluated. Upon entering OPCON 3, and while depressurizing to the RHR cut-in permissive set-point, the 'A' and 'C' RHR pumps would be maintained operable in their normal LPCI mode alignment. This would maintain the plant's level of compliance with the TS (as required for the extended AOTs) during OPCON 3, prior to depressurizing below the RHR cut-in permissive setpoint.

The LPCI alignment would maintain the two LPCI subsystems (i.e., 'A' and 'C')

operable for automatic operation. The 'A' loop of SPS and the 'A' loop of SPC would also be maintained operable since they could be aligned from the control room if an accident were to occur. Once the RHR cut-in permissive set-point is reached in OPCON 3, then TS 3.4.9.1, ACTION a. must be entered since only the 'A' loop of SDC would be operable. The 'A' loop of SDC would be operable since it would be capable of being aligned from the control room (except for system flushing) under normal shutdown conditions. The operability of alternate methods of decay heat removal would be demonstrated to meet the requirements of TS 3.4.9.1, ACTION a. The alternate methods of decay heat removal that would be considered to meet TS 3.4.9.1, ACTION a. are covered by LGS procedure GP-6.2, "Shutdown Operations - Shutdown Condition Tech Spec Actions." However, an alternate method would only need to be put into operation if the 'A' loop of SDC became inoperable and if the operability of the 'A' loop of SDC could not be reestablished by implementing LGS Off Normal Procedure ON-121, "Loss of Shutdown Cooling."

In OPCONs 4 or 5, the 'A' and 'C' loops of SDC, which both use the operable 'A' RHR heat exchanger, will be considered operable in accordance with LGS procedure GP-6.2 and will satisfy the shutdown cooling requirements in OPCONs 4 and 5, if required.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 16 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes The RHRSW system is manually operated and is not required during the first 10 minutes of an event. Long-term actions (i.e., greater than 10 minutes) will be affected to the extent that only the 'A' RHR heat exchanger will be operable for long-term decay heat removal. Long-term cooling requirements will be met by the operable 'A' RHR heat exchanger and the operable 'A' RHRSW subsystem in either the SPS or SPC modes of operation, as discussed below.

Decay heat removal for suppression pool/drywell temperature control is an accident mitigation function. The RHR system supports this function by two modes of operation, SPS and SPC, both of which utilize the RHR heat exchangers. TS 3.6.2.2 requires that two loops of the SPS mode of the RHR system be operable in OPCONs 1, 2 and 3. The AOT for one inoperable loop of SPS is seven days, therefore no relief from this AOT is required. TS 3.6.2.3 requires that two loops of SPC mode of the RHR system be operable in OPCONs 1, 2 and 3. The AOT for one inoperable loop of SPC is 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The AOT for this LCO is proposed to be extended to seven days.

LGS UFSAR Section 6.2.1.1.3.3.1.6 demonstrates that one operable RHR heat exchanger is adequate for accident mitigation. Two cases with only one operable RHR heat exchanger are presented. In the first case, the operable RHR heat exchanger is placed in service, in containment spray, while one LPCI pump and one Core Spray subsystem inject water into the vessel. In the other case, the RHR heat exchanger is placed in service with an associated RHR pump taking suction from the suppression pool and discharging to the vessel while another RHR pump (in LPCI mode of operation) and one Core Spray subsystem inject directly into the vessel. Both cases assume a LOOP and that the HPCI system is available for the entire accident. This analysis is for a rupture of a recirculation line and is bounding for other events. During the extended AOT, there will be sufficient equipment available to operate in either of these modes.

Since one RHRSW subsystem with two RHRSW pumps can mitigate a DBA on one unit and support the safe shutdown of the other unit, then the potential heat removal demand during the period that these TS changes will be in effect is within the capacity of the single operable 'A' RHRSW subsystem.

Therefore, by maintaining the 'A' RHR heat exchanger and the 'A' RHRSW subsystem and associated equipment/systems operable during this period, the RHR and RHRSW systems will be able to provide adequate decay heat removal, and the consequences of an accident will remain unchanged.

The following components (if they were to individually fail) would have the potential of completely preventing the RHR 'A' heat exchanger or the 'A' RHRSW subsystem from performing their safety functions (i.e., requiring use of the heat exchanger) while RHRSW subsystem 'B' is removed from service.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 17 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes RHR heat exchanger, RHR outlet valve:

HV-51-*F003A (normally open - safety function - open)

RHR heat exchanger, RHR inlet valve:

HV-51-*F047A (normally open - safety function - open)

RHR heat exchanger, RHR bypass valve:

HV-C-51-*F048A (normally open - safety function - throttled closed)

RHR heat exchanger, RHRSW inlet valve:

HV-51-*F014A (normally closed - safety function - open)

RHR heat exchanger, RHRSW outlet valve:

HV-51-*F068A (normally closed - safety function - throttled open)

RHRSW spray pond spray network A, inlet valve:

HV-12-032A (normally closed - safety function - open)

RHRSW spray pond spray network C, inlet valve:

HV-12-032C (normally closed - safety function - open)

RHRSW Pump 0A-P506 (normally standby - safety function running)

RHRSW Pump 0C-P506 (normally standby - safety function running)

Random failures of these components are included in the probabilistic risk assessment and compensatory measures have been identified to reduce the risk associated with these potential failures.

d. Systems supporting RHRSW RHRSW to spray nozzles crosstie (spray A/C to spray B/D)

HV-12-034A (normally closed - safety function -closed)

RHRSW to spray nozzles crosstie (spray A/C to spray B/D)

HV-12-034B (normally closed - safety function -closed)

The above valves separate the subsystem A and subsystem B spray networks.

These valves are all normally closed with the HV-12-034A valve locked closed and de-energized. Therefore, separation of the operable 'A' RHRSW subsystem from the inoperable 'B' RHRSW subsystem is maintained.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 18 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes RHRSW to Unit 2 Cooling Tower Valves HV-12-211 and HV-12-213 (D11 & D23)

Unit 2 Cooling Tower to RHRSW/ESW Wet Well Valves HV-12-212 and HV-12-214 (D11 & D23)

The above valves isolate the 'B' RHRSW subsystem lines to and from the Unit 2 cooling tower. Since both EDG D11 and D23 will be operable, these valves will be capable of being operated as designed.

RHRSW to Unit 1 Cooling Tower Valves HV-12-111 and HV-12-113 (D12 & D24)

Unit 1 Cooling Tower to RHRSW/ESW Wet Well Valves HV-12-112 and HV-12-114 (D12 & D24)

The above valves isolate the 'A' RHRSW subsystem lines to and from the Unit 1 cooling tower. Since both EDG D12 and D24 will be verified available prior to entering the proposed configuration, these valves will be capable of being operated as designed.

The RHRSW system was designed with the capacity so that one RHRSW subsystem with two pumps in operation and two spray networks can mitigate a DBA on one unit while supporting the safe shutdown of the other unit. In order to maintain the full operability of the 'A' RHRSW subsystem, Unit 1 EDGs D11 and D13, and Unit 2 EDGs D21 and D23, will be maintained operable.

Therefore, the 'A' RHRSW subsystem can fulfill its design function during a DBA and limit the consequences of the accident during the extended AOT.

e. Remote Shutdown System (RSS) - The capability to perform a plant shutdown from the remote shutdown panel will be available during the extended AOT since equipment such as the A RHRSW and C RHRSW pumps are operated from the remote shutdown panel and will be available.

f.

Automatic Alignment of Spray Pond Sprays - With the 'B' RHRSW return header drained and the 'B' loop of ESW aligned to the operable 'A' RHRSW return header, starting of the 'B' and 'D' ESW pumps will not cause automatic realignment of the spray pond return from the winter bypass line to the spray networks. Operator action will be required to realign the valves for this condition.

Since the modifications will be performed with one unit shutdown, the heat loads that would be transferred to the spray pond following an accident in the operating unit would be significantly lower than those used in the bounding spray pond analysis. Therefore, any delays associated with manual alignment of the spray valves would not adversely affect the maximum analyzed spray pond temperature. This is not a unit specific impact.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 19 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes The minimum equipment required to mitigate the consequences of an accident and/or safely shutdown the plant will be operable or the plant will be shut down.

Therefore, by extending certain AOTs and extending the assumptions concerning the combinations of events for the longer duration of each extended AOT, Exelon concludes, based on the evaluations above, that at least the minimum equipment required to mitigate the consequences of an accident and/or safely shut down the plant will still be operable during the extended AOT. Therefore, the consequences of an accident previously evaluated in the SAR will not be increased.

4.2 COMPENSATORY MEASURES The following assumptions and compensatory measures have been specified to reduce the sources of increased risk in accordance with the guidelines provided in NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (Reference 4). The implementation of the compensatory measures described below during the extended AOTs represents a regulatory commitment as indicated in Attachment 4.

A discussion of the compensatory actions with associated qualitative risk insights is provided immediately below. The risk insights are included in parenthetical text, and although they are not all explicitly accounted for in the PRA analysis discussed below, they would all serve to reduce the risk during the extended AOT.

1. Adequate staffing will be maintained onsite to facilitate timely response to unexpected conditions during the period of reliance on the extended AOTs. {This action provides appropriate management and technical support to resolve equipment issues in a timely manner thereby maximizing their availability for plant transient mitigation.}

2. Besides the protected opposite RHRSW subsystems and ESW loop required to be operable by TS, elective maintenance, discretionary maintenance and testing on all RHR subsystems and EDGs that provide support to the protected RHRSW subsystem will be suspended during the period of reliance on the extended AOTs. Additionally, the following actions will be taken prior to entry into the proposed configuration:

a. Proper standby alignment of the opposite RHRSW subsystem will be ensured prior to entry into the AOT to reduce the contribution from potential pre-initiator errors.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 20 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

b. Availability of the following equipment will be verified:.

When RHRSW subsystem A is unavailable:

Diesel Generator 11 Diesel Generator 21 Diesel Generator 23 ESW loop A Unit 2 LPCI subsystem A Unit 2 LPCI subsystem C Unit 2 Core Spray subsystem A When RHRSW subsystem B is unavailable:

Diesel Generator 12 Diesel Generator 14 Diesel Generator 24 ESW loop B Unit 1 LPCI subsystem B Unit 1 LPCI subsystem D Unit 1 Core Spray subsystem B Elective maintenance, discretionary maintenance and testing on the above listed equipment will be suspended during the period of reliance on the extended AOTs.

{These actions will reduce risk by ensuring that risk significant plant configurations are avoided.}

3. Activities that adversely affect risk exposure will be prohibited in the LGS 500kV and 220kV electrical switchyards to minimize the possibility of an induced LOOP and loss of power to protected equipment during the period of reliance on the extended AOTs. {This action reduces the potential for an inadvertent LOOP occurring due to switchyard activity and thereby decreases the likelihood of LOOP or SBO initiating events.}

4. Operational Risk Activities will be restricted during the extended AOTs. Station Vice-President approval will be required to perform emergent operational risk activities during the period of reliance on the extended AOTs. {This action reduces the likelihood of initiating events.}

5. The extended weather forecast will be examined to ensure severe weather conditions that would threaten the loss of offsite power are not predicted prior to entry into the AOT. In the event of an unforeseen severe weather condition due to rapidly changing conditions, such as severe high winds, a briefing with crew operators will be performed to reinforce operator actions and responses in the event of a loss of offsite power (E-10/20). {This action increases the likelihood of successful operator recovery actions in response to the initiating event of a loss of off-site power.}

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 21 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

6. Shift briefs will be performed to reinforce other potentially important operator actions associated with the performance of the extended AOT (i.e., operator actions to refill the condensate storage tank (CST), operator actions to vent containment, operator actions to maximize control rod drive (CRD) injection to the vessel, and operator actions to support continued use of feedwater and condensate post-trip as necessary and if available). Additionally, during the A RHRSW subsystem outage, a shift brief on alternate remote shutdown operations will be performed since some of the normally operated equipment from the remote shutdown panel will not be available. {These actions increase the likelihood of success of operator actions that may be needed to respond to a plant trip given one of the RHRSW subsystems is unavailable.}

7. Shift briefs and pre-job walkdowns to reduce and manage transient combustibles prior to entrance into the extended AOT will be used to alert the staff about the increased sensitivity to fires in the following areas during the extended RHRSW outage windows. Additionally, any hot work activities in the following areas will be prohibited during the time within the extended RHRSW AOT. {These actions will reduce the overall risk from fire.}

For the 'A' RHRSW subsystem outage window:

Unit 1

Fire Area 15, Unit 1 Division 2 (D12) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room Unit 2

Fire Area 17, Unit 2 Division 2 (D22) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room For the 'B' RHRSW subsystem outage window:

Unit 1

Fire Area 13, Unit 1 Division 1 (D11) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room

Fire Area 26, Remote Shutdown Panel Unit 2

Fire Area 19, Unit 2 Division 1 (D21) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room

Fire Area 26, Remote Shutdown Panel 8a. When the 'A' RHRSW return header is undergoing maintenance, the 'A' and 'B' loop of ESW return flow shall be aligned to the operable 'B' RHRSW return header only. The ESW return valves (i.e., HV-11-015A and HV-11-015B) to the

'B' RHRSW return header will be administratively controlled in the open position

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 22 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes and de-energized prior to entering the extended AOT. The ESW return valves, HV-11-011A and HV-11-011B, to the 'A' RHRSW return header will be administratively controlled in the closed position and de-energized as part of the work boundary. (See Item b. in the review of plant impacts described in Section 4.1.) {This action eliminates a potential single active failure that prevents ESW return flow to the spray pond (ultimate heat sink), and therefore reduces overall risk.}

8b. When the 'B' RHRSW return header is undergoing maintenance, the 'A' and 'B' loop of ESW return flow shall be aligned to the operable 'A' RHRSW return header only. The ESW return valves (i.e., HV-11-011A and HV-11-011B) to the

'A' RHRSW return header will be administratively controlled in the open position and de-energized prior to entering the extended AOT. The ESW return valves, HV-11-015A and HV-11-015B, to the 'B' RHRSW return header will be administratively controlled in the closed position and de-energized as part of the work boundary. (See Item b. in the review of plant impacts described in Section 4.1.) {This action eliminates a potential single active failure that prevents flow to the spray pond (ultimate heat sink), and therefore reduces overall risk.}

4.3 FIVE KEY SAFETY PRINCIPLES Regulatory Guide (RG) 1.174 (Reference 1) describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed permanent licensing-basis changes by considering engineering issues and applying risk insights.

This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177 (Reference 2) describes an acceptable risk-informed approach specifically for assessing proposed permanent TS changes in AOTs. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

One acceptable approach to making risk-informed decisions about proposed TS changes is to show that the proposed changes meet the five key safety principles stated in RG 1.174 and RG 1.177. These five key safety principles are addressed below.

1.

COMPLIANCE WITH CURRENT REGULATIONS 10 CFR 50.36(c) provides that TS will include Limiting Conditions for Operation (LCOs) which are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee will shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met. The proposed changes involve extension of the affected AOTs from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days. The LCOs themselves remain unchanged, as do the required remedial actions or shutdown requirements in accordance with 10 CFR 50.36(c). In addition, the proposed changes do not deviate from any existing regulatory requirements. Therefore, the proposed changes are consistent with current regulations.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 23 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes

2.

DEFENSE-IN-DEPTH PHILOSOPHY Consistency with the defense-in-depth philosophy is maintained if:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g., no risk outliers).

Defenses against potential common cause failures are preserved and the potential for the introduction of new common cause failure mechanisms is assessed.

Independence of barriers is not degraded.

Defenses against human errors are preserved.

The intent of the general design criteria in 10 CFR Part 50, Appendix A, is maintained.

A discussion of the proposed changes against the defense-in-depth criteria listed above is provided below.

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

The proposed change involves extensions of the AOT for the RHRSW system, the SPC mode of the RHR system, the ESW system, and emergency A.C. power (EDGs) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days for RHRSW subsystem piping repairs. The systems that are affected during a particular RHRSW LCO outage are all associated with the subsystem that corresponds to the affected RHRSW subsystem, leaving safety equipment supported by the remaining RHRSW subsystem fully operable and capable of performing its safety functions. Prevention of core damage will be assured based on the availability of redundant and diverse high pressure and low pressure injection systems in conjunction with depressurization systems that are supported by the operable RHRSW subsystem.

Additionally, ECCS pumps will be maintained operable or verified available prior to entering the proposed configuration. Prevention of containment failure will be assured based on adequate decay heat removal capability provided by safety systems supported by the operable RHRSW subsystem. Although the proposed AOT changes do impact core damage frequency (CDF) and large early release frequency (LERF), this impact is reduced by the compensatory measures as described previously in Section 4.2. The time averaged risk increase is acceptable because the proposed AOT changes are temporary rather than permanent. Consequence mitigation remains acceptable during the AOT extensions. Therefore, a reasonable balance among prevention of core damage, prevention of containment failure, and consequence mitigation is preserved.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 24 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes Over-reliance on programmatic activities to compensate for weaknesses in plant design is avoided.

The proposed change involves extensions of the AOT for the RHRSW system, the SPC mode of the RHR system, the ESW system, and emergency A.C. power (EDGs) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days for RHRSW subsystem piping repairs. The systems that are affected during a particular RHRSW LCO outage are all associated with the subsystem that corresponds to the affected RHRSW subsystem, leaving safety equipment supported by the remaining RHRSW subsystem fully operable and capable of performing its safety functions. The proposed extensions of the AOT (4-day increase to 7 days vs. the current 72-hour AOT) results in a corresponding increase in the amount of time that the redundancy that is normally afforded by the other (inoperable) RHRSW subsystem will not be available, thereby increasing the amount of time that safety systems are vulnerable to single failures. However, as discussed above, the ECCS equipment remains operable or available. Steps will be taken to minimize the likelihood of losing offsite power during the use of these AOT extensions.

Compensatory measures discussed previously in Section 4.2 include programmatic activities. However, because this is a proposed change of limited duration, some use of programmatic activities can be credited for minimizing the risks involved and for maintaining defense-in-depth.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,

no risk outliers).

The safety equipment associated with the operable RHRSW subsystem will continue to be capable of performing the necessary safety functions consistent with accident analysis assumptions. Compensatory measures discussed previously, including (for example) the restriction of all elective maintenance on the operable safety equipment, will assure the availability and capability of the operable safety equipment while operating in the allowed outage period. Therefore, sufficiently redundant, independent, and diverse capabilities will be maintained for performing critical safety functions during the proposed AOT extensions. A more detailed description of the system impacts was previously discussed above.

Defenses against potential common cause failures are preserved and the potential for the introduction of new common cause failure mechanisms is assessed.

As discussed in the previous paragraph, compensatory measures will be established to assure the availability and capability of redundant, independent, and diverse means of accomplishing critical safety functions during the proposed AOT extensions. The proposed plant configuration poses no new common cause failures since the compensatory measures taken (for example, administratively controlling HV-11-015A and HV-11-015B open) ensure no single active failure will render the operable ESW loop or RHRSW subsystem and supported systems inoperable. Existing station work practices include programmatic controls to minimize the likelihood of human error

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 25 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes induced common cause failures. As such, appropriate measures will be taken to preserve defenses against potential common cause failures and no new common cause failure mechanisms will be introduced.

Independence of barriers is not degraded.

As discussed above, means of achieving and maintaining safe shutdown conditions will be maintained during the proposed AOT extensions. These means are independent, redundant, and diverse and, consequently, they will prevent undue challenges to the fuel cladding, reactor coolant pressure boundary, and containment from occurring.

Therefore, the independence of barriers will not be degraded by the proposed AOT extensions.

Defenses against human errors are preserved.

Compensatory measures discussed previously in Section 4.2 will assure that critical safety functions will be maintained during the proposed AOT extensions. The compensatory measures include operator briefs to assure that the operating staff is fully aware of the plant configuration and actions that may be needed in order to respond to problems that could arise during the proposed AOT extensions for performing repairs of one RHRSW subsystem piping. Compensatory measures will also be established to prohibit discretionary maintenance on equipment required to be operable. The increased AOT will provide the necessary time to implement RHRSW subsystem piping repairs.

This will reduce time pressure during the repairs, which will facilitate improved operator and maintenance personnel performance resulting in reduced errors. These measures will assure that the defenses against human errors will be adequately preserved during the proposed AOT extensions.

The intent of the General Design Criteria in 10 CFR Part 50, Appendix A, is maintained.

The proposed change involves an extension of the current TS AOT for systems that are impacted by the RHRSW subsystem piping repairs. The systems that are affected during a particular RHRSW LCO outage are all associated with the subsystem that corresponds to the affected RHRSW subsystem, leaving one train of safety equipment fully operable and capable of performing its safety functions. The proposed changes do not modify the plant design bases or the design criteria that were applied to structures, systems, and components during plant licensing. Consequently, the plant design with respect to the General Design Criteria is not affected by the proposed change.

3.

EVALUATION OF SAFETY MARGINS The design, operation, testing methods, and acceptance criteria for structures, systems, or components (SSCs), specified in applicable codes and standards (or alternatives approved for use by the NRC) will continue to be met as described in the plant licensing basis (including the UFSAR and TS Bases), since these are not affected by the proposed changes. Similarly, the proposed changes do not impact safety analysis acceptance criteria as described in the plant licensing basis. In addition, the proposed

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 26 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes changes do not impact any of the assumptions or inputs to the safety analyses. Thus, safety margins are maintained by the proposed changes.

4.

EVALUATION OF RISK IMPACT For permanent TS changes, RG 1.174 and RG 1.177 provide numerical risk acceptance guidelines that are helpful in determining whether or not the fourth key principle (small risk increases consistent with the intent of the Commission's Safety Goal Policy Statement) has been satisfied. These guidelines are not intended to be applied in an overly prescriptive manner; rather, they provide an indication, in numerical terms, of what is considered acceptable. The intent in comparing risk results with the risk acceptance guidelines is to demonstrate with reasonable assurance that the fourth key principle is met.

For limited applicability TS changes such as that requested in this amendment application, examination of the risk metrics identified in RG 1.174 and RG 1.177 provides insight about the potential risk impacts, even though neither of these RGs provides numerical risk acceptance guidelines for evaluating limited applicability TS changes. However, it should be noted that NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, (Reference 4) addresses monitoring risk during maintenance activities and provides quantitative guidelines that indicate that routine activities should generally not involve an increase in incremental conditional core damage probability (ICCDP) of greater than 1E-6 or an incremental conditional large early release probability (ICLERP) of greater than 1E-7.

This planned RHRSW subsystem outage configuration would not be considered routine maintenance. For limited applicability AOT changes, the ICCDP and ICLERP acceptance guidelines of 1.0E-05 and 1.0E-06 are established for compatibility with the ICDP and ILERP limits in Section 11 of NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions (i.e., with effective compensatory measures implemented to reduce the sources of increased risk). The NRC has endorsed the NUMARC 93-01 guidelines in RG 1.182 (Reference 5).

The risk evaluation presented below addresses the last two key principles of the NRC staff's philosophy of risk-informed decision-making, which concern changes in risk and performance measurement strategies. These key principles were evaluated by using the three-tiered approach described in RG 1.177.

Tier 1 - The first tier evaluates the LGS PRA and the impact of the change on plant operational risk, as expressed by the change in core damage frequency (CDF) and the change in large early release frequency (LERF). The change in risk is compared against the acceptance guidelines presented in RG 1.174. The first tier also aims to ensure that plant risk does not increase unacceptably during the period when equipment is taken out of service per the license amendment, as expressed by the incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP). The incremental risk is compared against the acceptance guidelines presented in RG 1.177.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 27 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes Tier 2 - The second tier addresses the need to preclude potentially high-risk plant configurations that could result if equipment, in addition to that associated with the proposed license amendment, is taken out of service simultaneously, or if other risk-significant operational factors such as concurrent system or equipment testing, are also involved. The objective of this part of the review is to ensure that appropriate restrictions on dominant risk-significant plant configurations associated with the AOT extensions are in place.

Tier 3 - The third tier addresses the LGS overall configuration risk management program to ensure that adequate programs and procedures are in place for identifying risk-significant plant configurations resulting from maintenance or other operational activities and taking appropriate compensatory measures to avoid such configurations. The purpose of configuration risk management is to ensure that equipment removed from service prior to or during the proposed extended AOT period will be appropriately assessed from a risk perspective. For limited applicability TS changes such as that requested in this amendment application, examination of the risk metrics identified in RG 1.174 and RG 1.177 provides insight about the potential risk impacts, even though neither of these RGs provides numerical risk acceptance guidelines for evaluating limited applicability TS changes against the fourth key principle. It can be demonstrated with reasonable assurance that a TS change meets the fourth key principle if its associated risk metrics satisfy the risk acceptance guidelines in RG 1.174 and RG 1.177, or are not substantially above the risk acceptance guidelines in RG 1.174 and RG 1.177 and effective compensatory measures to maintain lower risk are implemented while the TS change is in effect.

The discussion that follows addresses Tiers 1, 2, and 3 of RG 1.177.

Tier 1 - PRA Capability and Insights The 2008A update to the LGS PRA model is the most recent evaluation of the risk profile at LGS for internal event challenges. The LGS PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the LGS PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

There have been several assessments to support a conclusion that the LGS PRA model adequately meets the PRA standard such that it can be used to support risk applications in accordance with RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities. These are all described in Section 4 of Attachment 3.

The guidance in RG 1.200, Revision 1 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. This information along with the details of the risk assessment performed for the proposed AOT extensions are also provided in of this submittal.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 28 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes The following table provides the risk metrics from the internal events, internal flood, and internal fire models associated with the requested AOT extensions. Note that the values in the table reflect the entire 7-day AOT for the 'A or 'B' RHRSW subsystem outage and do not take direct credit for all of the compensatory measures identified above in Section 4.2. Also, note that external events risk (i.e., from seismic and other external hazards) has been treated qualitatively or with bounding calculations as described in Attachment

3. In general, the identified compensatory measures will also reduce the risk from other external events.

Figure of Merit Unit 1 Risk Assessment Result Unit 2 Risk Assessment Result Delta CDF 1.03E-6/yr 9.88E-7/yr ICCDP (RHRSW Subsystem A) 5.92E-7 6.72E-7 ICCDP (RHRSW Subsystem B) 1.39E-6 1.22E-6 Delta LERF(1) 4.15E-10/yr 4.16E-10/yr ICLERP (RHRSW Subsystem A)(1) 1.15E-10 6.69E-10 ICLERP (RHRSW Subsystem B)(1) 6.81E-10 1.28E-10 (1) This only includes internal events and internal floods since the internal fire PRA model does not currently support LERF quantification, but as indicated in Attachment 3, the potential contribution to LERF from internal fires would not lead to challenging the LERF acceptable guidelines for the RHRSW subsystem extended AOT configurations.

Although not applicable, per se, to limited applicability TS changes, RGs 1.177 and 1.174 provide core damage risk increase acceptance thresholds of 5E-7 (ICCDP), 5E-8 (ICLERP), 1E-6/yr (delta-CDF), and 1E-7/yr (delta-LERF), respectively. All of the values reported above for the extended AOT are either below or are not substantially above the acceptance guidelines of these Regulatory Guides for permanent changes to the TS. In addition, Exelon will implement the identified compensatory measures during the AOT.

These measures will effectively serve to lower the core damage and large early release risk associated with the extended AOT. The compensatory measures to maintain lower risk ensure that the TS change fully meets the intent of the ICCDP and ICLERP acceptance guidelines of 1.0E-05 and 1.0E-06 established for compatibility with the ICDP and ILERP limits in Section 11 of NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions.

Tier 2 - Avoidance of Risk-Significant Plant Configurations The compensatory measures identified in Section 4.2 all serve to lessen the calculated increase in the core damage risk when an RHRSW subsystem is out-of-service.

Since the second compensatory measure that will be taken while in the extended AOT is that certain other PRA-modeled equipment will not be voluntarily taken out-of-service, risk-significant plant configurations are inherently avoided. Additionally, should an emergent condition arise such that plant equipment becomes inoperable, in addition to the planned out-of service equipment, the associated risk will be assessed and managed in accordance with the Tier 3 program discussed below.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 29 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes Tier 3 - Risk-Informed Configuration Risk Management Tier 3 requires a proceduralized process to assess the risk associated with both planned and unplanned work activities. The objective of the third tier is to ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity. As stated in Section 2.3 of RG 1.177, "a viable program would be one that is able to uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation." The third-tier requirement is an extension of the second-tier requirement, but addresses the limitation of not being able to identify all possible risk-significant plant configurations in the second-tier evaluation. Programs and procedures are in place at LGS which serve to address this objective. In particular, Exelon procedure WC-AA-101, "On-Line Work Control Process, is an integral part of the work management process at the plant. The configuration risk management program in WC-AA-101 ensures that configuration risk is assessed (using a blended approach that combines defense-in-depth insights as well as PRA-based insights) and managed prior to initiating any maintenance activity consistent with the requirements of 10 CFR 50.65(a)(4). This also ensures that risk is reassessed if an emergent condition results in a plant configuration that has not been previously assessed.

PRA Analysis Summary The PRA analysis demonstrates with reasonable assurance that the proposed TS change satisfies the risk acceptance guidelines in RG 1.174 and RG 1.177, or is not substantially above the risk acceptance guidelines in RG 1.174 and RG 1.177. This combined with effective compensatory measures to maintain lower risk ensures that the TS change fully meets the intent of the ICCDP and ICLERP acceptance guidelines of 1.0E-05 and 1.0E-06 established for compatibility with the ICDP and ILERP limits in Section 11 of NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions.

Additionally, a PRA technical adequacy evaluation was performed consistent with the requirements of RG 1.200, Revision 1. This included a process to identify potential key sources of model uncertainty and related assumptions associated with this application.

This resulted in the identification of issues that could both decrease or increase the calculated risk metrics. None of these identified sources of uncertainty were significant enough to change the conclusions from the risk assessment results presented here.

The information related to the headings below is contained in the Evaluation of Risk Impact discussion above or in the overall PRA discussion provided in Attachment 3. A brief description of where this information is included is provided below.

Quality of the PRA Information regarding the technical adequacy of the PRA model consistent with the guidance in RG 1.200, Rev. 1 is included in Section 4 of Attachment 3.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 30 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes Scope of the PRA A discussion of the scope of the PRA model used for this evaluation is provided in Section 1.4 of Attachment 3.

PRA Modeling The PRA modeling of the risk assessment is discussed in Section 1.5 and Section 3 of.

Assumptions A discussion of potential key assumptions for the risk assessment is provided in Appendix B of Attachment 3.

Sensitivity and Uncertainty Analyses A discussion of sensitivities and sources of model uncertainty are provided in Appendix B of Attachment 3.

Use of Compensatory Measures The identification of the compensatory measures was derived from a detailed review of the results of the risk assessment provided in Attachment 3. Qualitative impacts on the PRA analysis of the compensatory measures are identified in Section 4.2 and the Tier 2 discussion above. Although not all compensatory actions can be explicitly credited in the base PRA analysis, the identified actions would lessen the overall risk incurred during the extended AOT.

Contemporaneous Configuration Control The configuration risk management process is discussed in the Tier 3 discussion provided above.

5.

IMPLEMENTATION AND MONITORING Equipment performance monitoring at LGS is accomplished through implementation of the Maintenance Rule in accordance with the requirements of 10 CFR 50.65.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Exelon has concluded that the proposed changes to the Limerick Generating Station, Unit 1 and Unit 2, Technical Specifications, which involve changes to extend the Allowed Outage Time (AOT) for the Residual Heat Removal Service Water (RHRSW) system, the Suppression Pool Cooling (SPC) mode of the Residual Heat Removal (RHR)

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 31 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes system, Emergency Service Water (ESW) system, and Emergency A.C. Power from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days do not involve a Significant Hazards Consideration. In support of this determination, an evaluation of each of the three (3) standards, set forth in 10 CFR 50.92, "Issuance of amendment," is provided below.

1.

Do the proposed changes involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed TS changes will not increase the probability of an accident since they will only extend the time period that one RHRSW subsystem, one loop of SPC, one ESW loop and two Emergency Diesel Generators (EDGs) can be out of service. The extension of the time duration that one RHRSW, one ESW loop and two EDGs are out of service has no direct physical impact on the plant. The proposed inoperable RHRSW subsystem, ESW loop and two EDGs are normally in a standby mode while the unit is in OPCON 1 or 2 and are not directly supporting plant operation. Therefore, they can have no impact on the plant that would make an accident more likely to occur due to their inoperability.

During transients or events which require these subsystems to be operating, there is sufficient capacity in the operable loops/subsystems and available but inoperable equipment to support plant operation or shutdown. Therefore, failures that are accident initiators will not occur more frequently than previously postulated as a result of the proposed changes.

In addition, the consequences of an accident previously evaluated in the Updated Final Safety Analysis Report (UFSAR) will not be increased. With one RHRSW subsystem inoperable, one SPC loop, one ESW loop and two EDGs inoperable but verified available prior to entering the proposed configuration, a known quantity of equipment is inoperable. Based on the support functions of the RHRSW system, a review of the plant was performed to determine the impacts that the inoperable RHRSW subsystem would have on other systems. The impacts were identified for each system and it was determined whether there were any adverse affects on the systems. It was then determined how the adverse affects would impact each system's design basis and overall plant safety. The consequences of any postulated accidents occurring on Unit 1 or Unit 2 during these AOT extensions was found to be bounded by the previous analyses as described in the UFSAR. Since the inoperable ESW loop, selected emergency core cooling system (ECCS) pumps and EDGs will be verified available prior to entering the proposed configuration, they would have no impact on other systems.

The minimum equipment required to mitigate the consequences of an accident and/or safely shut down the plant will be operable or available. Therefore, by extending certain AOTs and extending the assumptions concerning the combinations of events for the longer duration of each extended AOT, Exelon

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 32 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes concludes that at least the minimum equipment required to mitigate the consequences of an accident and/or safely shut down the plant will still be operable or available during the extended AOT.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2.

Do the proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed TS changes will not create the possibility of a different type of accident since they will only extend the time period that one RHRSW subsystem and one loop of SPC can be out of service, and one ESW loop and two EDGs can be inoperable but verified available prior to entering the proposed configuration. The extension of the time duration that one RHRSW subsystem and one SPC loop is out of service, and one ESW loop and two EDGs are inoperable but verified available prior to entering the proposed configuration has no direct physical impact on the plant and does not create any new accident initiators. The systems involved are accident mitigation systems. All of the possible impacts that the inoperable equipment may have on its supported systems were previously analyzed in the UFSAR and are the basis for the present TS Action statements and AOTs. The impact of inoperable support systems for a given time duration was previously evaluated and any accident initiators created by the inoperable systems was evaluated. The lengthening of the time duration does not create any additional accident initiators for the plant.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3.

Do the proposed changes involve a significant reduction in a margin of safety?

Response: No.

The present RHRSW, SPC, ESW and EDG AOT limits were set to ensure that sufficient safety-related equipment is available for response to all accident conditions and that sufficient decay heat removal capability is available for a loss of coolant accident (LOCA) coincident with a loss of offsite power (LOOP) on one unit and simultaneous safe shutdown of the other unit. A slight reduction in the margin of safety is incurred during the proposed extended AOT due to the increased risk that an event could occur in a 7-day period versus a 72-hour period. This increased risk is judged to be minimal due to the low probability of an event occurring during the extended AOT and based on the following discussion of minimum ECCS/decay heat removal requirements.

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 33 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes The inoperable ESW loop, selected ECCS pumps and EDGs will be verified available prior to entering the proposed configuration; therefore, extension of the AOT will have no affect on the minimum ECCS equipment available or margin of safety.

The reduction in the margin of safety from the extension of the RHRSW, SPC, ESW and EDG AOT limits is not significant since the remaining operable ECCS equipment is adequate to mitigate the consequences of any accident. This conclusion is based on the information contained in General Electric Company documents NEDO-24708A, "Additional Information Required for NRC Staff Generic Report on Boiling Water Reactors," Revision 1, dated December 1980, and NEDC3093P-A, "BWR Owner's Group Technical Specification Improvement Methodology (with Demonstration for BWR ECCS Activation Instrumentation),"

dated December 1988. These documents describe the minimum requirements to successfully terminate a transient or LOCA initiating event (with scram),

assuming multiple failures with realistic conditions, and were used to justify certain TS AOTs per UFSAR Sections 6.3.1.1.2.o and 6.3.3.1. The minimum requirements for short-term response to an accident would be either one Low Pressure Coolant Injection (LPCI) pump or one Core Spray subsystem in conjunction with Automatic Depressurization System (ADS), or the High Pressure Coolant Injection (HPCI) system, which would be adequate to re-flood the vessel and maintain core cooling sufficient to preclude fuel damage. For long-term response, the minimum requirements would be one loop of RHR for decay heat removal, along with another low pressure ECCS subsystem. These minimum requirements will be met since implementation of the proposed TS changes will require the operability or availability of HPCI, ADS, two LPCI subsystems (or one LPCI subsystem and one RHR subsystem during decay heat removal) and one Core Spray subsystem be maintained during the 7-day period.

Operations personnel are fully qualified by normal periodic training to respond to and mitigate a Design Basis Accident, including the actions needed to ensure decay heat removal while LGS Unit 1 and Unit 2 are in the operational configurations described within this submittal. Accordingly, procedures are already in place that address safe plant shutdown and decay heat removal for situations applicable to those in the proposed AOTs.

Therefore, the proposed changes do not involve a significant reduction in a margin of safety.

Based on the above, Exelon concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

5.2 Applicable Regulatory Requirements/Criteria 10 CFR 50.36(c) provides that TS will include Limiting Conditions for Operation (LCOs) which are the lowest functional capability or performance levels of equipment required

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 34 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the licensee will shut down the reactor or follow any remedial action permitted by the technical specifications until the condition can be met. The proposed changes involve extensions of the affected AOTs from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days. The LCOs themselves remain unchanged, as do the required remedial actions or shut down requirements in accordance with 10 CFR 50.36(c). Therefore, the proposed changes are consistent with current regulations.

Regulatory Guide (RG) 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," (Reference

1) describes a risk-informed approach, acceptable to the NRC, for assessing the nature and impact of proposed permanent licensing-basis changes by considering engineering issues and applying risk insights. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," (Reference 2) describes an acceptable risk-informed approach specifically for assessing proposed permanent TS changes in AOTs. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

One acceptable approach to making risk-informed decisions about proposed TS changes is to show that the proposed changes meet the five key safety principles stated in RG 1.174 and RG 1.177 shown below.

1. The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change.

2. The proposed change is consistent with the defense-in-depth philosophy.

3. The proposed change maintains sufficient safety margins.

4. When proposed changes result in an increase in core-damage frequency (CDF) or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

The five principles are discussed in Section 4.0 of this attachment.

RG 1.200, Revision 1, describes one acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. The guidance is intended to be consistent with the NRCs PRA Policy Statement and subsequent, more detailed, guidance in RG 1.174. It is also intended to reflect and endorse guidance provided by standards-setting and nuclear industry organizations. In RG 1.200, as in RG 1.174, the quality of a PRA analysis used to support an application is measured in terms of its appropriateness with respect to scope, level of detail, and technical acceptability. A

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 35 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes discussion of the technical adequacy of the LGS PRA relative to its use in support of this license amendment based on RG 1.200, Revision 1 is provided in Attachment 3.

Although not the direct subject matter of this requested amendment, the following 10 CFR 50, Appendix A, General Design Criteria apply to the systems covered by the proposed changes in this amendment application.

CRITERION 17 - ELECTRIC POWER SYSTEMS "An onsite electric power system and an offsite electric power system shall be provided to permit the functioning of structures, systems, and components important to safety.

The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The onsite electric power supplies, including the batteries, and the onsite electric distribution system shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained. Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies."

CRITERION 34 - RESIDUAL HEAT REMOVAL.

"A system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded. Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 36 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure."

CRITERION 38 - CONTAINMENT HEAT REMOVAL.

"A system to remove heat from the reactor containment shall be provided. The system safety function shall be to reduce rapidly, consistent with the functioning of other associated systems, the containment pressure and temperature following any loss-of-coolant accident and maintain them at acceptably low levels. Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure."

CRITERION 44 - COOLING WATER "A system to transfer heat from structures, systems, and components important to safety, to an ultimate heat sink shall be provided. The system safety function shall be to transfer the combined heat load of these structures, systems, and components under normal operating and accident conditions. Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure."

Finally, 10 CFR 50.36, "Technical specifications," requires that a licensee's TS be derived from the analyses and evaluation included in the safety analysis report.

There are no changes being proposed in this amendment application such that commitments to the regulatory requirements and guidance documents above would come into question. The evaluations documented above confirm that LGS will continue to comply with all applicable regulatory requirements.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant

License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 37 of 37 Docket Nos. 50-352 and 50-353 Evaluation of Proposed Changes hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

7.0 REFERENCES

1. NRC Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

Revision 1, November 2002.

2. NRC Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," August 1998.

3. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 1, January 2007.

4. NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, revision 3, July 2000.

5. Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants," May 2000.

ATTACHMENT 2 License Amendment Request Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 Proposed Changes to Technical Specifications Sections 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Markup of Proposed Technical Specifications Pages Unit 1 TS Pages 3/4 5-1 3/4 6-16 3/4 7-1 3/4 7-3 3/4 8-1 3/4 8-2 Unit 2 TS Pages 3/4 5-1 3/4 6-16 3/4 7-1 3/4 7-3 3/4 8-1 3/4 8-2

3/4.5 EMERGENCY CORE COOLING SYSTEMS 314.5.1 ECCS - OfEBATING LIMITING CONDITION FOR OPERATION.

3.5.1 The emergency core cooling systems shall be OPERABLE with:

a.

The core spray system (CSS) consisting of two subsystems with each subsystem comprised of:

1.

Two OPERABLE CSS pumps, and 2.

An OPERABLE flow patch capable of taking suction from the suppression chamber and transferring the water through the spray sparger to the reactor vessel.

b.

The low pressure coolant injection (LPCI) system of the residual heat removal system consisting of four subsystems with each subsystem comprised of:

1.

One OPERABLE LPCI pump, and 2.

An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water to the reactor vessel.

c.

The high pressure coolant injection (HPCI) system consisting of:

1.

One OPERABLE HPCI pump, and 2.

An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water to the reactor vessel.

d.

The automatic depressurization system (ADS) with at least five OPERABLE ADS valves.

APPUCABIUD:

OPERATIONAL CONDITION I, 2* ** "

and 3* **~

The HPCl system is not required to be OPERABLE when reactor steu dome pressure 1s less than or equal to 200 psig.

- The ADS is not required to be OPERABLE when the reactor steu dome pressure is less that or equal to 100 psig.

'See Special Test Exception 3.10.6.

Amendment No aa ~

li1Q. 131 liN J 6 1998 3/4 5-1 "Two LPCI subsystems of the RHR system may be inoperable in that they are aligned in the shutdown cooling mode when reactor vessel pressure is less than the RHR Shutdown cooling permissive setpoint.

62se~r;V LIMERICK - UNIT 1

INSERT rAI (ECCS 3.5.1 APPLICABILITY)

1. If Once per calendar year for one unit only, during the extended Allowed Outage Time period of up to 7 days to allow for repairs of one RHRSW subsystem piping, in addition to two inoperable LPCI subsystems and one inoperable CSS subsystem, one of the two remaining LPCI subsystems may be inoperable in that it is aligned in the shutdown cooling mode when reactor vessel pressure is less than the RHR Shutdown Cooling permissive setpoint.

CONTAINMENT SYSTEMS SUPPRESSION POOL COOLING LIMITING CONDITION fOR OPERATION 3.6.2.3 The suppression pool cooling mode of the residual heat removal (RHR) system shall be OPERABLE with two independent loops, each loop consisting of:

a.

One OPERABLE RHR pump, and b.

An OPERABLE flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger.

APPLICABILITY:

OPERATIONAL CONDITIONS 1. 2, and 3.

ACIroN:

a.

With one suppression pool cooling loop inoperable, restore the inoperable loop to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b.

With both suppression pool cooling loops inoperable. be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

SURVEIl lANCE REQUIREMENTS 4.6.2.3 The suppression pool cooling mode of the RHR system shall be demonstrated OPERABLE:

a.

In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position.

is in its correct position.

b.

By verifying that each of the required RHR pumps develops a flow of at least 10.000 gpm on recirculation flow through the flow path including the RHR heat exchanger and its associated closed bypass valve, the suppression pool and the full flow test line when tested pursuant to Specification 4.0.5.

Whenever both RHR subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by

~his ACTION. maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

LIMERICK - UNIT 1 3/4 6-16 Amendment No.

~. ;g, 8&, !J+/-. 186

INSERT [8] (SPC 3.6.2.3.a)

- The 72-hour Allowed Outage Time for one inoperable suppression pool cooling loop may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

OPERATIONAl CONDITIONS I, 2, 3, 4, and 5.

3/4.Z PI.NfJ SYSTEMS

~L4.7.1 SERVICE MAIER SYSTtMS REsIDUAL HEAT REMOVAl" U;rWICE WAIER SYSTEM - 'OIltON SYSTEM LI~nJN§ CQtfflWON fOB QPEB6.UQN 3.7.1.1 At least the following independent residual heat re.oval service water (RHRSW) system subsystems, with each subsyst.. comprised of:

a.

Two OPERABLE RHRSV pumps, and b.

An OPERABLE flow path capable of taking suction froll the RHR service water PUIIPs wet pits which are supplied froll the spray pond or the cooling tower basin and transferring the water through one Unit 1 RHR heat exchanger, shall be OPERABLE:

a.

In OPERABLE CONDITIONS I, 2, and 3, two subsystems.

b.

In OPERABLE CONDITIONS 4 and 5, the subsystea(s) associated with systems and components required OPERABLE by Specification 3.4.'.2, 3.9.11.1, and 3.9.11.2.

APPLICABILIUj ACTION; a.

In OPERATIONAl CONDITION I, 2, or 3:

I.

With one RHRSW pump inoperable, restore the inoperable pump to OPERABLE status within 30 days, or be in at least HOT SHUTDOWN within the nut 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLO SHlJTDQVff within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2.

With one RHRSW pump in each subsyst.. inoperable, restore at least one of the inoperable RHRSW PUlPS to OPERABLE status within 7 days or be in at least HOT SHlJTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLO SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.

With one RHRSW subsyst.. otherwise inoperable, restore the inoperable subsyst.. to OPERABLE status with at least one OPERABLE RHRSW pump within 72 hou or be in at least HOT SHU1'1JOWN Within the next 12 hou and in COlO SHUTOOIIN within the following 24 'hours.

t*

r 4.

Mith both RHRSW subsysteM otherwise inoperable, restore at least one subsyst.. to OPERABlE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months or be in at least HOT SHUTDOVR within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLO SHUTDOWN* within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Whenever both RHRSW subsyst.. are inoperable, if unable to attain COLD SHUTDOWfC as required by the ACTION, uintain reactor coolant tlllperature as low as practical by use of alternate heat removal..thods.

@:20 LIMERICK - UNIT 1 3/4 7-1 Amendment No. 5&, ee, 131 NOV 1 6 1998

INSERT rCl (RHRSW 3.7.1.1.a.3)

- The 72-hour Allowed Outage Time for one inoperable RHRSW subsystem may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

OPERATIONAL CONDITIONS I, 2, 3, 4. 5, and *.

PlANT SYSTEMS EMERGENCy SERVICE WATER SYSTEM - COMMON SYSTEM LIMITING CONDITION FOR OPERATION 3.7.1.2 At least the fa11owing independent emergency service water syst... loops, with each loop cOIlIPri sed of:

a.

Two OPERABLE emergency service water pumps, and b.

An OPERABLE flow path capable of taking suction from the emergency service water pumps wet pits which are supplied from the spray pond or the cooling tower basin and transferring the water to the associated Unit 1 and cOIlIDOn safety-related equipment, shall be OPERABLE:

a.

In OPERATIONAL CONDITIONS 1, 2, and 3, two loops.

b.

In OPERATIONAl CONDITIONS 4, 5, and., one loop.

APPLICABIUD:

ACTION; a.

In OPERATION CONDITION 1, 2, or 3:

1.

With one emergency service water pump inoperable. restore the inoperable pump to OPERABLE status within 4S days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2.

With one emergency service water pump in each loop inoperable.

restore at least one inoperable pump to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.

With one emergency service water system loop otherwise inoperable. declare all equipment aligned to the inoperable loop inoperable". restore the inoperable loop to OPERABLE status with at least one OPERABLE PUlP within 72 ho~._~be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

When handling irradiated fuel in the secondary containment.

"The diesel generators may be aligned to the OPERABLE emergency service water syst.. loop prOVided confirmatory flow testing has been performed.

Those diesel generators no aligned to the OPERABLE emergency service water system loop shall be declared inoperable and the actions of 3.8.1.1 taken.

@~!~

I LIMERICK - UNIT 1 3/4 7-3 Amendment No. iT, 04&, 86, 131 NOV 1 6 t998

INSERT [OJ (ESW 3.7.1.2.a.3)

The 72-hour Allowed Outage Time for one inoperable emergency service water system loop may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

3/4.8 ELECTRICAL POWER SYSTEMS 3/4.8.1 A.C. SOURCES A,e. SOURCES - OPERATING lIMITING CONDITION. fOR OPERATION 3.8.1.1 As a minimum. the following A.C, electrical power sources shall be OPERABLE:

a.

Two physically independent circuits between the offsite transmission network and the onsite Class IE distribution system. and b,

Four separate and independent diesel generators, each with:

1, A separate day tank containing a minimum of 200 gallons of fuel, 2.

A separate fuel storage system containing a minimum of 33,500 gallons of fuel. and 3.

A separate fuel transfer pump.

APPLICABILliY:

OPERATIONAL CONDITIONS I, 2. and 3.

ACTION:

a.

With one diesel generator of the above required A.C, electrical power sources inoperable. demonstrate the OPERABILITY of the remaining A,e.

sources by performing Surveillance Requirement 4.8.1.1.1,a within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and at least once per 7 days thereafter.

If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining operable diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . unless the absence of any potential common-mode failure for the remaining diesel generators is determined.

Restore the inoperable diesel generator to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

See also ACTION e.

b.

With two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance ReqUirement 4.8,1.1.1.a within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter.

If either of the diesel generators became inoperable due to any cause other than an inoperable support system. an independently testable component. or preplanned preventive maintenance or testing. demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance ReqUirement 4.8.1.1,2.a.4 for one diesel generator at a time. within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , unless the absence of any potential cammon-mode failure for the remaining diesel generators is determined, Restore at least one of the inoperable diesel generators to OPERABLE status within 72 hou or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD HUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

See also ACTION e.

LIMERICK - UNIT 1 3/4 8-1 Amendment No.

~,

~, 189

INSERT [El (EDGs 3.8.1.1.b)

The 72-hour Allowed Outage Time for two inoperable diesel generators may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

ACnON:

(COnti...)

I.

In adItIt1. to till ACTJMS Ibo¥e:

L

,. two va** ~1 wi. DIll or... di Ul'l of

.................. A.G..,ld11ca',..

1'1II1**

vertt,v wi*** J....... It laut... per U IIouN fte" tIIft at.,... _

of.. ~,... tn**.,.. **

vatn. COlli**"... cIWI_ ** DPIUILI.. ttl uAd'"

eIf..,......... t. DPIUILL OCIIIrwfM. I"IItDrI.t.... till

.......1.

cit..., IIM'1t.oP or..

~.

t 1*.,......,..

to

CIPIIAILI wt 71' or lie f. It. le1d IIDT

~ wtta U

t. au MI'r'IJCMt wtthlll W f.n.....,. ~.

2.

,.,... LPCl*.,..... wtth.. or cIt..l flMrat.ol'l of..

,.., A.L I11CtP1cal IIIII'CflI t.......,** VlII"tt,v wftlrl. J IIICI.. U.... UllNaftett.... at.

le1d.. If U'CI.,......,.... tNf_*

ftl utoe1.... cIt..,

......... 11 LL OthItrw1M. lie t 1... 11I1' -.rDNI Wi_f ftIIR 11 til au SIII'IIIrMI wt.f....

Tlrft ACnDN

,... thDtI.,... COVI.... t......,tc:att_

3.7.1.1... 3.7.1.1.

LDEUCI

IIUT 1 114..1

.......... 11.40 I

lAY aI"

INSERT £F] (EDGs 3.8.1.1.e.1 )

The 72-hour Allowed Outage Time may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

3/4.5 EMERGENCY CORE COOLING SYSTEMS 3/4.5.1 Eecs - OPERATING LIMITING CONDITION FOR OPERATION 3.5.1 The emergency core cooling systems shall be OPERABLE with:

a.

The core spray system (CSS) consisting of two subsystems with each subsystem comprised of:

1.

Two OPERABLE CSS pumps, and 2.

An OPERABLE flow patch capable of taking suction from the suppression chamber and transferring the water through the spray sparger to the reactor vessel.

b.

The low pressure coolant injection (LPCI) system of the residual heat removal system consisting of four subsystems with each subsystem comprised of:

1.

One OPERABLE LPCI pump. and 2.

An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water to the reactor vessel.

c.

The high pressure coolant injection (HPel) system consisting of:

1.

One OPERABLE HPCI pump. and 2.

An OPERABLE flow path capable of taking suction from the suppression chamber and transferring the water to the reactor vessel.

d.

The automatic depressurization system (ADS) with at least five OPERABLE ADS valves.

~

AP~LltABIL!JY; OPERATIONAL CONDITION 1, ~ ** t, and 3* ** ~~

"'The HPCI system is not required to be OPERABLE when reactor steam dome pressure is less than or equal to 200 p51g.

- The ADS is not required to be OPERABLE when the reactor steam dome pressure is less that or equal to 100 psig.

ISee Special Test Exception 3.10.6.

1. Two lPCI subsystems of the RHR system may be inoperable in that they are aligned in the shutdown cooling mode when reactor vessel pressure is less than the RHR Shutdown cooling permissive setpoint.

§r0)

LIMERICK - UNIT 2 3/4 5-1 Amendment No. Te, 92

.ttOV 1 6 1998

INSERT rAJ (ECCS 3.5.1 APPLICABILITY)

1. 1. Once per calendar year for one unit only, during the extended Allowed Outage Time period of up to 7 days to allow for repairs of one RHRSW subsystem piping, in addition to two inoperable LPCI subsystems and one inoperable CSS subsystem, one of the two remaining LPCI subsystems may be inoperable in that it is aligned in the shutdown cooling mode when reactor vessel pressure is less than the RHR Shutdown Cooling permissive setpoint.

CONTAINMENT SYSTEMS SUPPRESSION POOL COOLING 3.6.2.3 The suppression pool cooling mode of the residual heat removal (RHR) system shall be OPERABLE with two independent loops, each loop consisting of:

a.

One OPERABLE RHR pump, and b.

An OPERABLE flow path capable of recirculating water from the suppression chamber through an RHR heat exchanger.

APPLICABILITY:

OPERATIONAL CONDITIONS I, 2, and 3.

ACTION:

a.

With one suppression pool cooling loop inoperable, restore the inoperable loop to OPERABLE status within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

b.

With both suppression pool cooling loops inoperable, be in at least HOT SHUTDOWN within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN* within the next 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4.6.2.3 The suppression pool cooling mode of the RHR system shall be demonstrated OPERABLE :

a.

In accordance with the Surveillance Frequency Control Program by verifying that each valve (manual, power-operated, or automatic) in the flow path that is not locked, sealed, or otherwise secured in position, is in its correct position.

b.

By verifying that each of the required RHR pumps develops a flow of at least 10,000 gpm on recirculation flow through the flow path including the RHR heat exchanger and its associated closed bypass valve, the suppression pool and the full flow test line when tested pursuant to Specification 4.0.5.

Whenever both RHR subsystems are inoperable, if unable to attain COLD SHUTDOWN as required by this ACTION, maintain reactor coolant temperature as low as practical by use of alternate heat removal methods.

IMERICK - UNIT 2 3/4 6-16 Amendment No. JG, +9,

~,147

INSERT [BJ (SPC 3.6.2.3.a)

- The 72-hour Allowed Outage Time for one inoperable suppression pool cooling loop may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

service water LIMITING CONDITION EOR OPERATIon 3.7.1.1 At least the following independent residual heat reDDval (RHRSW) syst.. subsystelS, with each subsyst.. comprised of:

a.

Two OPERABLE RHRSW PUIIPs, and b.

An OPERABLE flow path capable of taking suction from the RHR service water PUIIIPS wet pits which are supplied frOll the spray pond or the cooling tower basin and transferring the water through one Unit 2 RHR heat exchanger, shall be OPERABLE:

a.

In OPERATIONAL CONDITIONS I, 2, and 3, two subsystllllS.

b.

In OPERATIONAL CONDITIONS 4 and 5. the sUbsystem(s) associated with systems and components required OPERABLE by Specification 3.4.9.2, 3.9.11.1. and 3.9.11.2.

APPLICABILITY; OPERATIONAl CONDITIONS I. 2. 3, 4. and S.

ACTION:

a.

In OPERATIONAL CONDITION I. 2. or 3:

1.

With one RHRSW pump inoperable. restore the inoperable PUIIP to OPERABLE status within 30 days. or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2.

With one RHRSW pump in each sUbsyst. inoperable. restore at least one of the inoperable RHRSW p~s to OPERABLE status within 7 days or be in at. least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.

With one RHRSW subsyst. otherwise inoperable. restore the inoperable subsyst.. to OPERABLE status with at least one OPERABLE RHRSW pump within 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

-if*

4.

With both RHRSW subsystems otherwise inoperable, restore at least one subsyst.. to OPERABLE status within B hours or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOW* within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

Whenever both RHRSW subsystellls are inoperable, if unable to attain COLD SHUTDOWN

. as required by this ACTION. ointain reactor coolant t8lllPerature IS low IS prlctical by use of alternate heat r&lOval methods.

C~::J~!._0

.1lV 1 6 1998 LIMERICK - UNIT 2 3/4 1-1 Amendment No.*, ~. 92

INSERT Fe] (RHRSW 3.7.1.1.a.3)

- The 72-hour Allowed Outage Time for one inoperable RHRSW subsystem may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW SUbsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

Sy 3.7.1.2 At least the following independent emergency service water system loops, with each loop comprised of:

a.

Two OPERABLE emergency service water PUJIPS, and b.

An OPERABLE flow path capable of taking suction frca the emergency service water pumps wet pits which are supplied frca the spray pond or the cooling tower basin and transferring the water to the associated Unit 2 and cOlMlOn safety-related equipment, shall be OPERABLE:

a.

In OPERATIONAl CONDITIONS 1, 2, ind 3, two loops.

b.

In OPERATIONAL CONDITIONS 4, 5, and *, one loop.

APPLICABILITY:

OPERATIONAL CONDITIONS 1, 2, 3, 4, 5, and *.

ACTION:

In OPERATION CONDITION I, 2, or 3:

1.

With one emergency service water pump inoperable, restore the inoperable pump to OPERABLE status within 4S days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLO SHUTDOWN within the follOWing 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2.

With one emergency service water pump in each loop inoperable, restore at least one inoperable pump to OPERABLE status Within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the follOWing 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3.

With one emergency service water syst. loop otherwise inoperable, declare I all equipment aligned to the inoperable loop inoperable**, restore the

_,~~i~nrno~e~rab1e loop to OPERABLE status with at least one OPERABLE pump within 72

.I'"

aurar be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

i.

When handling irradiated fuel in the secondary containment.

- The diesel generators may be aligned to the OPERABLE emergency service water system loop proVided confinlatory flow testing has been performed.

Those diesel generators not aligned to the OPERABLE emergency service water system loop shall be declared inoperable and the actions of 3.8.1.1 taken.

~~~

I LIMERICK - UNIT 2 3/4 1-3 JOV 1 6 \\998 Amendment No..... 1&. 92

INSERT [01 (ESW 3.7.1.2.a.3)

The 72-hour Allowed Outage Time for one inoperable emergency service water system loop may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

3/4.8 ELECTRICAL POWER SYSTEMS 3/4.8.1 A,e, SOURCES A,e. SOURCES - OPERATING

! IMUING CONDITION fOB OPERATION 3.8.1.1 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a.

Two physically independent circuits between the offsite transmission network and the onsite Class IE distribution system, and b.

four separate and independent diesel generators, each with:

1.

A separate day tank containing a minimum of 200 gallons of fuel.

2.

Aseparate fuel storage system containing a minimum of 33,500 gallons of fuel, and 3.

A separate fuel transfer pump.

APPLICABILITY:

OPERATIONAL CONDITIONS 1. 2. and 3.

ACTION:

a.

With one diesel generator of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performing Surveillance Requirement 4.8.1.1.1.a within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months and at least once per 7 days thereafter.

If the diesel generator became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining operable diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time. within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . unless the absence of any potential common mode failure for the remaining diesel generators is determined.

Restore the inoperable diesel generator to OPERABLE status within 30 days or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD SHUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

See also ACTION e.

b.

With two diesel generators of the above required A.C. electrical power sources inoperable, demonstrate the OPERABILITY of the remaining A.C.

sources by performi ng Surveil 1anee Requi rement 4.8.1. 1. 1.a withi n 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months and at least once per a hours thereafter.

If either of the diesel generators became inoperable due to any cause other than an inoperable support system, an independently testable component, or preplanned preventive maintenance or testing, demonstrate the OPERABILITY of the remaining diesel generators by performing Surveillance Requirement 4.8.1.1.2.a.4 for one diesel generator at a time. within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . unless the aosence of any potential common-mode failure for the remaining diesel generators is determined.

Restore at least on of the inoperable diesel generators to OPERABLE status within 72 hou or be in at least HOT SHUTDOWN within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in COLD HUTDOWN within the following 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

See also ACTION e.

c?~~??J LIMERICK - UNIT 2 3/4 8-1 Amendment No. 150

INSERT [EJ (EDGs 3.8.1.1.b)

The 72-hour Allowed Outage Time for two inoperable diesel generators may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

'. ELECTRICAL POWER SVSTEMS LIMITING CONDITION FOR OPERATION (Continued).

ACTION:

(Continued) e.

In.ddition to the ACTIONS above:

1.

Fo... two tr.in 5ySteIIS, with one or 110.... diesel gene....tors of the above required A.C. electric.l PGW8" SOU1"Cel inope"able.

ve"ify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and.t lealt once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months the....after that at least one of the required two t...ain Iyst. subsyst**

tr.in. COIIIPonents, and devices' fa OPERABLE and its associ.ted die.el generator is OPERABLE.

Otherwise,.....tore either the inoperable diesel generator o....the i....nble sysu. subsyst.

to 1ft OPERABLE -.. within 72 ~~.; in.t least HOT SHUTDOWN within the next 12 IIouJ"I and in COLD StfU'I'DDWN within the fonowing 24 houn.

2.

For the LPCI systeu, with two or.re die**l generato1"S of the above required A.C. elect,,1cal powe... 10II1"CII inoperable, verify within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months and at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months the....afte... that at )Hlt two of the requi.red LPCI I)'.u. sub.ysteM, trains.

cOllPOMJlt. and devices are OPERABLE and its associated diesel generator il OPERABLE.

Otherwise. be in at lent HOT StlJTDOWN within the next 12 houn and in COLD SHlJ1'DDWN witMn the following 24 houri.

This ACTI. does not apply for those systMs covered in Specifications 3.7.1.1 and 3.7.1.2.

LIMERICK - UNIT 2 3/48-2

INSERT [FJ (EDGs 3.8.1.1.e.1)

The 72-hour Allowed Outage Time may be extended once per calendar year for one unit only for a period of up to 7 days to allow for repairs of one RHRSW subsystem piping with the opposite unit shutdown, reactor vessel head removed and reactor cavity flooded, and the compensatory measures identified in NRC Safety Evaluation dated XXXXX X, XXXX established and in effect.

ATTACHMENT 3 License Amendment Request Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 Proposed Changes to Technical Specifications Sections 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Risk Assessment and Technical Adequacy of the PRA

.RM DOCUMENTATION NO: LG-LAR-Q3

.STATION: Umerlck Generating Station UNtT(S) AFFECTED: 1 and 2 REV: 2 PAGE NO.1 TITLE: Risk Assessment Input for the Limerlok Teohnlcal Specification Change for the SuppressIon Pool Cooffng Allowed Outage Time from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days

SUMMARY

This assessment Is performed in support of lhe license amendment request (LAR) submittal to extend the snowed outage time (AOT) for the Unit 1 and Unit 2 Suppression Poot Cooling (SPC) mode of the Residual Heat Removal (RHR) system and the Resfdua' Heat Removal Service Water (RHRSW) system from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to seven (7) days in order to allow for repairs of the RH*RSW system piping. Other LeOs may be administratively entered as part of the overall LAR SUbmittal, but these systems would stilJ ba considered available and as such would not factor into the results of the risk assessment.

Revision 2 incorporates additional minor editorial changes.

The risk assessment is perlormed in accordance YJith ER-AA-60Q-1046. Rev. 4, Risk Metrics-NOED and LAR.

[ 1Review required after periodic Update

[ X] Internal Rfvl DocumentatIon

[

] External RM Documentation Electronic CalcuJation Data Flies:

1.

ERIN \\\\Er1npa06\\exeJonrm1\\LJmerick\\AiskDoouments\\LG-LAA-03\\ (multiple fifes) 2.

Exelon KSQA15(on *Pbsnw503\\Vot1\\Sqadata)\\LGSApps\\LG-lAR4J3\\ (mua'p{e fles)

Method of Review:

[ X ) Detaifed

[] Alternatel ] Revfewof External Document This AM documentation supersedes:

N""'""/A....._

...*ln Its entirety.

Prepared by:

Reviewed by:

Approved by:

D.E~ Vanover V.A. Warren

v. M. Andersen Extsmal Events I

Z'~d' Z:V~

I 3/3!Je

-~-----S-ig-n------

Date P461000066-3424

Limerick RHRSW/SPC AOT Extension 2

P467090055-3424 TABLE OF CONTENTS Section Page

1.0 INTRODUCTION

.................................................................................................. 4 1.1 PURPOSE................................................................................................. 4

1.2 BACKGROUND

......................................................................................... 4 1.2.1 Technical Specification Changes.................................................... 4 1.3 REGULATORY GUIDES........................................................................... 5 1.3.1 Regulatory Guide 1.200, Revision 1................................................ 5 1.3.2 Regulatory Guide 1.174.................................................................. 6 1.3.3 Regulatory Guide 1.177.................................................................. 6 1.3.4 Acceptance Guidelines................................................................... 7 1.4 SCOPE...................................................................................................... 9 1.5 LIMERICK PRA MODEL.......................................................................... 10 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION.................................. 13 3.0 RISK ANALYSIS................................................................................................. 15 3.1 ASSUMPTIONS....................................................................................... 15 3.2 INTERNAL EVENTS................................................................................ 16 3.3 EXTERNAL EVENTS............................................................................... 19 3.3.1 Internal Fires................................................................................. 19 3.3.2 Seismic......................................................................................... 21 3.3.3 External Floods and Other External Hazards................................ 21 3.4 RESULTS COMPARISON TO ACCEPTANCE GUIDELINES................. 22 3.5 UNCERTAINTY ASSESSMENT.............................................................. 25 3.5.1 Parametric Uncertainty.................................................................. 25 3.5.2 Modeling Uncertainty.................................................................... 25 3.6 RISK

SUMMARY

..................................................................................... 26 4.0 TECHNICAL ADEQUACY OF PRA MODEL...................................................... 27 4.1 PRA QUALITY OVERVIEW..................................................................... 27 4.2 SCOPE.................................................................................................... 28

4.3 FIDELITY

PRA MAINTENANCE AND UPDATE..................................... 29 4.4 STANDARDS........................................................................................... 30 4.5 PEER REVIEW AND PRA SELF-ASSESSMENT................................... 30 4.6 APPROPRIATE PRA QUALITY............................................................... 31 4.6.1 Plant Changes Not Yet Incorporated into the PRA Model............. 31 4.6.2 Consistency with Applicable PRA Standards................................ 32 4.6.3 Relevant Peer Review Findings.................................................... 32 4.6.4 Identification of Key Assumptions................................................. 33 4.7 GENERAL CONCLUSION REGARDING PRA CAPABILITY.................. 53 5.0

SUMMARY

AND CONCLUSIONS..................................................................... 54

Limerick RHRSW/SPC AOT Extension 3

P467090055-3424 5.1 SCOPE INVESTIGATED......................................................................... 54 5.2 PRA QUALITY......................................................................................... 55 5.3 QUANTITATIVE RESULTS VS. ACCEPTANCE GUIDELINES.............. 56

5.4 CONCLUSION

S...................................................................................... 56

6.0 REFERENCES

................................................................................................... 59 APPENDICES A

EXTERNAL EVENTS ASSESSMENT B

UNCERTAINTY ANALYSIS

Limerick RHRSW/SPC AOT Extension 4

P467090055-3424

1.0 INTRODUCTION

1.1 PURPOSE The purpose of this analysis is to assess the acceptability, from a risk perspective, of a change to extend the Limerick Generating Station (LGS) allowed outage time (AOT) for the Unit 1 and Unit 2 Suppression Pool Cooling (SPC) mode of the Residual Heat Removal (RHR) system and the Residual Heat Removal Service Water (RHRSW) system from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to seven (7) days in order to allow for repairs of the RHRSW system piping. Specifically, a footnote will be added to the affected LCOs to indicate that the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months AOT for the affected system may be extended for a period of up to 7 days to allow for repairs of the RHRSW system piping. These proposed changes are requested to be effective only during opposite unit outages, and as such would be entered no more than once per year. Other LCOs may be administratively entered as part of the overall LAR submittal, but these systems would still be considered available and as such would not factor into the results of the risk assessment.

The analysis follows the guidance provided in Regulatory Guide 1.200 [Ref. 1], An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities.

1.2 BACKGROUND

1.2.1 Technical Specification Changes Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA or risk survey and any available literature on risk insights and PSAs... Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commissions ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, Technical Specifications, in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision-making and regulatory efficiency. The PRA policy statement included the following points:

Limerick RHRSW/SPC AOT Extension 5

P467090055-3424

1.

The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defense-in-depth philosophy.

2.

PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

4.

The Commission's safety goals and subsidiary numerical objectives are to be used with consideration of uncertainties in making regulatory judgments The movement of the NRC to more risk-informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit changes to the plant design basis including Technical Specifications. Regulatory Guides 1.174 [Ref. 2] and 1.177 [Ref. 3] both provide processes to incorporate PRA input for decision makers regarding a Technical Specification modification.

1.3 REGULATORY GUIDES Three Regulatory Guides provide primary inputs to the evaluation of a Technical Specification change. Their relevance is discussed in this section.

1.3.1 Regulatory Guide 1.200, Revision 1 Regulatory Guide 1.200, Revision 1 describes an acceptable approach for determining whether the quality of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decision-making for light-water reactors. This guidance is intended to be consistent with the NRCs PRA Policy Statement and more detailed guidance in Regulatory Guide 1.174.

It is noted that RG 1.200, Revision 1 endorses Addendum B of the ASME PRA Standard [Ref. 4] applicable to full power internal event (FPIE) PRA models. Since that time, the new ASME/ANS Combined PRA Standard [Ref. 5] has been released.

Although the Combined Standard is presently issued and endorsed by RG 1.200 Revision 2 [Ref. 6], neither of these document revisions materially impact the FPIE events portion of the analysis.

Limerick RHRSW/SPC AOT Extension 6

P467090055-3424 1.3.2 Regulatory Guide 1.174, Revision 1 Regulatory Guide 1.174 specifies an approach and acceptance guidelines for use of PRA in risk informed activities. RG 1.174 outlines PRA related acceptance guidelines for use of PRA metrics of Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) for the evaluation of permanent TS changes. The guidelines given in RG 1.174 for determining what constitutes an acceptable permanent change specify that the CDF and the LERF associated with the change should be less than specified values, which are dependent on the baseline CDF and LERF, respectively.

RG 1.174 also specifies guidelines for consideration of external events. External events can be evaluated in either a qualitative or quantitative manner.

1.3.3 Regulatory Guide 1.177 Regulatory Guide 1.177 specifies an approach and acceptance guidelines for the evaluation of plant licensing basis changes. RG 1.177 identifies a three-tiered approach for the evaluation of the risk associated with a proposed TS change as identified below:

Tier 1 is an evaluation of the plant-specific risk associated with the proposed TS change, as shown by the change in core damage frequency (CDF) and incremental conditional core damage probability (ICCDP).

Where applicable, containment performance should be evaluated on the basis of an analysis of large early release frequency (LERF) and incremental conditional large early release frequency (ICLERP). The acceptance guidelines given in RG 1.177 for determining an acceptable permanent TS change is that the ICCDP and the ICLERP associated with the change should be less than 5E-07 and 5E-08, respectively.

Tier 2 identifies and evaluates, with respect to defense-in-depth, any potential risk-significant plant equipment outage configurations associated with the proposed change. The licensee should provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when equipment associated with the proposed TS change is out-of-service.

Tier 3 provides for the establishment of an overall configuration risk management program (CRMP) and confirmation that its insights are incorporated into the decision-making process before taking equipment out-of-service prior to or during the AOT. Compared with Tier 2, Tier 3 provides additional coverage based on any additional risk significant configurations that may be encountered during maintenance scheduling over extended periods of plant operation. Tier 3 guidance can be satisfied by the Maintenance Rule (10 CFR 50.65(a)(4)), which requires a licensee to assess and manage the increase in risk that may result from activities such as surveillance, testing, and corrective and preventive maintenance.

Limerick RHRSW/SPC AOT Extension 7

P467090055-3424 This risk analysis supports the Tier 1 element of RG 1.177, specifically the comparison of the results with the acceptance guidelines for ICCDP and ICLERP associated with changing a Technical Specification Allowed Outage Time. Other portions of the LAR submittal will address Tier 2 and Tier 3 elements.

1.3.4 Acceptance Guidelines Risk significance in an LAR is determined by comparison of changes in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) and values of Incremental Conditional Core Damage Probability (ICCDP) and Incremental Conditional Large Early Release Probability (ICLERP) produced by a permanent change to either the plant design basis or Technical Specifications to the guidelines given in Regulatory Guide 1.174 and Regulatory Guide 1.177. Reg. Guide 1.174 specifies the acceptable changes in CDF and LERF for permanent changes. Reg. Guide 1.177 specifies the acceptable ICCDP and ICLERP for permanent changes, usually associated with changing an AOT.

The guidelines given in Reg. Guide 1.174 for determining an acceptable permanent change are that the CDF and the LERF associated with the change should be less than specified values which are dependent on the baseline CDF and LERF, respectively. These acceptance values of CDF and LERF are given in Reg. Guide 1.174 Figures 3 and 4, respectively. Based on the baseline CDF and LERF for Limerick, the RG 1.174 minimum acceptance guidelines are 1.0E-6/yr and 1.0E-7/yr for CDF and LERF, respectively. The guidelines given in Reg. Guide 1.177 for determining an acceptable Tech Spec change is that the ICCDP and the ICLERP associated with the change should be < 5E-07 and < 5E-08, respectively.

For TS changes such as that requested in this amendment application, examination of the risk metrics identified in RG 1.174 and RG 1.177 provides insight about the potential risk impacts, even though neither of these RGs provides numerical risk acceptance guidelines for evaluating limited applicability TS changes. However, it should be noted that NUMARC 93-01, Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, [Ref. 8] addresses monitoring risk during maintenance activities and provides quantitative guidelines that indicate that routine activities should generally not involve an increase in incremental conditional core damage probability (ICCDP) of greater than 1E-6 or an incremental conditional large early release probability (ICLERP) of greater than 1E-7. This planned RHRSW Loop outage configuration would not be considered routine maintenance. For limited applicability AOT changes, the ICCDP and ICLERP acceptance guidelines of 1.0E-05 and 1.0E-06 are established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions (i.e. with effective compensatory measures implemented to reduce the sources of increased risk). The NRC has endorsed the NUMARC 93-01 guidelines in Regulatory Guide 1.182 [Ref. 9].

Limerick RHRSW/SPC AOT Extension 8

P467090055-3424 Based on the available quantitative guidelines for other risk-informed applications, it is judged that the quantitative criteria shown in Table 1-1 represent a reasonable set of acceptance guidelines. For the purposes of this evaluation, these guidelines demonstrate that the risk impacts are acceptably low. This combined with effective compensatory measures to maintain lower risk will ensure that the TS change meets the intent of small risk increases consistent with the Commission's Safety Goal Policy Statement.

Table 1-1 Proposed Risk Acceptance Guidelines Risk Acceptance Guideline Basis ICCDP < 1E-6, or ICCDP < 1E-5 with effective compensatory measures implemented to reduce the sources of increased risk ICCDP is an appropriate metric for assessing risk impacts of out of service equipment per RG 1.177 & NUMARC 93-01 1E-6 is consistent with NUMARC 93-01 guidance for routine maintenance 1E-5 is consistent with NUMARC 93-01 guidance for maintenance activities requiring risk management actions The NRC has endorsed the NUMARC 93-01 guidelines in Regulatory Guide 1.182 Greater than RG 1.177 guideline (5E-7) for permanent TS changes, but that criterion is applied to changes which are allowed to be entered repeatedly over the life of the plant, whereas the proposed AOT is of limited applicability.

ICLERP < 1E-7, or ICLERP < 1E-6 with effective compensatory measures implemented to reduce the sources of increased risk ICLERP is an appropriate metric for assessing risk impacts of out of service equipment per RG 1.177 & NUMARC 93-01 1E-7 is consistent with NUMARC 93-01 guidance for routine maintenance 1E-6 is consistent with NUMARC 93-01 guidance for maintenance activities requiring risk management actions The NRC has endorsed the NUMARC 93-01 guidelines in Regulatory Guide 1.182 Greater than RG 1.177 guideline (5E-8) for permanent TS changes, but that criterion is applied to changes which are allowed to be entered repeatedly over the life of the plant, whereas the proposed AOT is of limited applicability.

CDF < 1.0E-6 In Region III from Figure 3 of RG 1.177 for very small changes in CDF risk.

Addresses intent to enter into AOT no more than once per year.

LERF < 1.0E-7 In Region III from Figure 4 of RG 1.177 for very small changes in LERF risk.

Addresses intent to enter into AOT no more than once per year.

Limerick RHRSW/SPC AOT Extension 9

P467090055-3424 1.4 SCOPE This section addresses the requirements of RG 1.200, Revision 1 Section 3.2 which directs the licensee to define the treatment of the scope of risk contributors (i.e., internal initiating events, external initiating events, and modes of power operation at the time of the initiator). Discussion of these risk contributors are as follows:

Full Power Internal Events (FPIE) - The LGS PRA model used for this analysis includes a full range of internal initiating events (including internal flooding) for at-power configurations. The SPC system is credited in the PRA for decay heat removal. Note that portions of the RHRSW subsystem impacted by this LAR are also credited for alternate injection which is also credited in the PRA model. The FPIE model is further discussed in Section 1.5.

Low Power Operation - The FPIE assessment is judged to adequately capture risk contributors associated with low power plant operations. The FPIE analysis assumes that the plant is at full power at the time of any internal events transient, manual shutdown, or accident initiating event.

This analytic approach results in conservative accident progression timings and systemic success criteria compared to what may otherwise be applicable to an initiator occurring at low power. As such, low power risk impacts are not discussed further in this risk assessment.

Shutdown / Refueling - In consideration of shutdown and refueling modes (i.e., Modes 3, 4, and 5), the shutdown risk is not part of this assessment since the intent is for one unit to remain at-power for the duration of the extended AOT while the other unit is shutdown. The risk assessment for the AOT extension in this LAR is associated with the at-power unit while accounting for the fact that the other unit is shutdown (refer to Section 3.1, assumption d)

Internal Fires - An interim fire PRA is available for LGS. The LGS interim Fire PRA [Ref. 10] is used to provide both quantitative and qualitative insights to the analysis of the RHRSW/SPC AOT extension (refer to Section 3.3.1 and Appendix A.3).

Seismic - Consistent with most sites, LGS does not currently maintain a Seismic PRA. A bounding assessment is performed in this analysis (refer to Section 3.3.2 and Appendix A.4) based on insights from the LGS FPIE PRA model and site specific seismic hazard curves.

Other External Events - Other external event risks were assessed in the LGS IPEEE study [Ref. 11] and found to be insignificant risk contributors.

These conclusions are revisited for this RHRSW/SPC AOT extension assessment (refer to Section 3.3.3 and Appendix A.2).

Limerick RHRSW/SPC AOT Extension 10 P467090055-3424 1.5 LIMERICK PRA MODEL This section addresses the requirements of Section 3.1 of RG 1.200, Revision 1 which directs the licensee to identify the portions of the PRA used in the analysis.

The PRA analysis for the TS change uses the LG108A (Unit 1) and LG208A (Unit 2) full power internal events Level 1 Core Damage Frequency (CDF) model and the associated Level 2 Large Early Release Frequency (LERF) model to calculate the risk metrics [Ref. 12].

This risk assessment is performed for both LGS Unit 1 and Unit 2. The models for both units are maintained individually but are very similar. Table 1-2 shows the CDF and LERF risk metrics for both units.

Table 1-2 Limerick FPIE CDF and LERF Risk Metrics Risk Metric LG108A - Unit 1 LG208A - Unit 2 CDF 3.20E-06 3.19E-06 LERF 5.01E-08 5.00E-08 The general configuration for the extended AOT is with one unit at-power and the other unit in an outage. The extended AOT risk assessment is applicable for the at-power unit. For the extended AOT, one loop of RHRSW (including 2 RHRSW pump trains and the return path to the spray pond or cooling tower) will be unavailable. Additionally, the extended AOT configuration will involve both ESW loops returning through the one remaining RHRSW return header. That is, one set of ESW return valves (HV 011A/B for return to the RHRSW A path or HV-11-015A/B for return to the RHRSW B path) will be de-energized open while the opposite set is closed for performance of the RHRSW piping repairs.

This analysis is specific to the ESW and RHRSW systems with all relevant configurations represented in the PRA model. All functions supported by RHRSW and ESW will be affected such that the large majority of the accident sequences will be impacted and therefore a full model re-quantification will be performed for each representative configuration. The PRA analysis involved identifying the system and components or maintenance activities modeled in the PRA which are most appropriate for use in representing the extended AOT configurations. These are shown in Table 1-3 for the RHRSW A Loop outage and in Table 1-4 for the RHRSW B Loop outage. This includes setting those maintenance terms to false that will not be allowed to be out of service for the extended AOT configuration.

Limerick RHRSW/SPC AOT Extension 11 P467090055-3424 Table 1-3 RHRSW Loop A Extended AOT Configuration Representation Basic Event Description Value WMV11AHQI0 HV-11-011A - ESW A return path to RHRSW A loop TRUE WMV11BHQI0 HV-11-011B - ESW B return path to RHRSW A loop TRUE WMV15AHQI0 HV-11-015A - ESW A return path to RHRSW B loop FALSE WMV15BHQI0 HV-11-015B - ESW B return path to RHRSW B loop FALSE WMV110DPI(1)

HV-12-110 - U1 TECW ESW return to RHRSW fails to open TRUE DTRHRATM(1)

Unit 1 RHR Loop A in Test and Maintenance TRUE DTRHRBTM(1)

Unit 1 RHR Loop B in Test and Maintenance FALSE DTRHRATM2(2)

Unit 2 RHR Loop A in Test and Maintenance TRUE DTRHRBTM2(2)

Unit 2 RHR Loop B in Test and Maintenance FALSE JTRPMATM0 RHRSW Pump Leg A in Test and Maintenance TRUE JTRPMBTM0 RHRSW Pump Leg B in Test and Maintenance FALSE JTRPMCTM0 RHRSW Pump Leg C in Test and Maintenance TRUE JTRPMDTM0 RHRSW Pump Leg D in Test and Maintenance FALSE (1) This basic event change only impacts the Unit 1 model.

(2) This basic event change only impacts the Unit 2 model.

Limerick RHRSW/SPC AOT Extension 12 P467090055-3424 Table 1-4 RHRSW Loop B Extended AOT Configuration Representation Basic Event Description Value WMV11AHQI0 HV-11-011A - ESW A return path to RHRSW A loop FALSE WMV11BHQI0 HV-11-011B - ESW B return path to RHRSW A loop FALSE WMV15AHQI0 HV-11-015A - ESW A return path to RHRSW B loop TRUE WMV15BHQI0 HV-11-015B - ESW B return path to RHRSW B loop TRUE WMV210DPI2(2)

HV-12-210 - U2 TECW ESW return to RHRSW fails to open TRUE DTRHRATM(1)

Unit 1 RHR Loop A Maintenance FALSE DTRHRBTM(1)

Unit 1 RHR Loop B Maintenance TRUE DTRHRATM2(2)

Unit 2 RHR Loop A Maintenance FALSE DTRHRBTM2(2)

Unit 2 RHR Loop B Maintenance TRUE JTRPMATM0 RHRSW Pump Leg A in Test and Maintenance FALSE JTRPMBTM0 RHRSW Pump Leg B in Test and Maintenance TRUE JTRPMCTM0 RHRSW Pump Leg C in Test and Maintenance FALSE JTRPMDTM0 RHRSW Pump Leg D in Test and Maintenance TRUE (1) This basic event change only impacts the Unit 1 model.

(2) This basic event change only impacts the Unit 2 model.

No other aspect of the PRA model required adjustment for this risk application. The entire PRA model is quantified for this assessment using the average maintenance PRA model (i.e., no additional portions other than those identified in Tables 1-3 and 1-4 were excluded (or zeroed out) of the quantification other than those Technical Specification violations that are normally excluded in the disallowed maintenance logic in the base PRA model). In any event, after analyzing the risk results, other maintenance terms may become candidates for limiting elective maintenance to help reduce the overall risk associated with the extended AOT.

Limerick RHRSW/SPC AOT Extension 13 P467090055-3424 2.0 ANALYSIS ROADMAP AND REPORT ORGANIZATION The analysis and documentation utilizes the guidance provided in RG 1.200, Revision 1.

The guidance in RG 1.200, Revision 1 indicates that the following steps should be followed to perform this study:

1. Per Section 3.1 of RG 1.200, identify the parts of the PRA used to support the application

Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

Provide a definition of the acceptance guidelines used for the application.

2. Per Section 3.2 of RG 1.200, identify the scope of risk contributors addressed by the PRA model

If not full scope (i.e. internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Per Section 3.3 and 4.2 of RG 1.200, demonstrate the Technical Adequacy of the PRA

Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide (currently, in RG-1.200, Revision 1 this is just the internal events PRA standard).

Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

Identify key assumptions and approximations relevant to the results used in the decision-making process.

4. Per Section 4.2 of RG 1.200, summarize the risk assessment methodology used to assess the risk of the application

Limerick RHRSW/SPC AOT Extension 14 P467090055-3424

Include how the PRA model was modified to appropriately model the risk impact of the change request.

Table 2-1 summarizes the RG 1.200 identified actions and the corresponding location of that analysis or information in this report.

Table 2-1 RG 1.200 ANALYSIS ACTIONS ROADMAP RG 1.200 Actions Report Section

1. Identify the parts of the PRA used to support the application Section 1.5 and Section 3 1a. Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

Section 1.5 1b. Provide a definition of the acceptance guidelines used for the application.

Section 1.3.4

2. Identify the scope of risk contributors addressed by the PRA model. If not full scope (i.e., internal and external events), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

Section 1.4

3. Demonstrate the Technical Adequacy of the PRA.

Section 4 3a. Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

Section 4.6.1, Table 4-1 3b. Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the RG (currently, in RG 1.200 Rev. 1. RG 1.200 Rev. 1 addresses the internal events ASME PRA standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Section 4.6.2, Table 4-2 3c. Document PRA peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

Section 4.6.3, Table 4-3 3d. Identify key assumptions and approximations relevant to the results used in the decision-making process.

Section 3.5 and Appendix B

4. Summarize the risk assessment methodology used to assess the risk of the application. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Section 1.5 and Section 3

Limerick RHRSW/SPC AOT Extension 15 P467090055-3424 3.0 RISK ANALYSIS This section evaluates the plant-specific risk associated with the proposed TS change, based on the risk metrics of CDF, ICCDP, LERF, and ICLERP.

3.1 ASSUMPTIONS The following inputs and general assumptions are used in estimating the plant risk due to the proposed RHRSW/SPC System AOT extension.

a.

The RHRSW/SPC System AOT is assumed to increase from its current duration of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to a proposed duration of 7 days.

b.

The base analysis in this risk assessment assumes one entry per year into the proposed AOT. This is consistent with the current plans to enter the extended AOT only during upcoming outages.

c.

This risk assessment does not credit the averted risk due to a forced shutdown that would be required due to exceeding the existing AOT.

d.

With the opposite unit for the risk assessment in an outage, the assumptions regarding the availability of the shared RHRSW pumps to support the at-power unit are consistent with the base FPIE PRA model assumptions. That is, one RHRSW pump is sufficient in all scenarios except LOOP scenarios (which would impact both units at LGS). If a LOOP occurs, then it is assumed that two RHRSW pumps are required to adequately remove decay heat in the at-power PRA model assessment (since one is in use in the outage unit). If only one RHRSW pump were available (given a random failure of the remaining protected train during the extended AOT) and offsite power is available, then that pump would preferentially be used in suppression pool cooling or shutdown cooling mode as required to support the at-power unit that scrams or is forced to shut down. Decay heat from the outage reactor with the benefit provided by additional water inventory with the cavity flooded and the fuel pool gates open, would be controlled via use of the RWCU system (vessel) and fuel pool cooling system (fuel pool). If a LOOP does occur, however a full complement of service water cooling capabilities for FPC will not be available and RWCU cooling capabilities will only be available from ESW.

Hence, it is assumed (somewhat conservatively) that two RHRSW pumps are required for success in the at-power unit for all LOOP scenarios.

Limerick RHRSW/SPC AOT Extension 16 P467090055-3424 3.2 INTERNAL EVENTS The proposed technical specification change involves simultaneous unavailability of several ESW and RHRSW components. The revised CDF and LERF values for the AOT configurations are obtained by re-quantifying the base PRA model with all of the identified events set to TRUE or FALSE As shown in Table 1-3 and 1-4 compared to their base-case probability values.

The evaluation of CDF and ICCDP (or LERF and ICLERP) for the AOT change for a plant that has a fuel cycle length of TCYCLE is determined as shown below.

The new annual average CDF due to the change in the AOT, CDFNEW, is given by the following equation [Ref. 13]:

B CYCLE B

A CYCLE A

NEW CDF T

T CDF T

T CDF

+

=

where:

CDFBASE = baseline annual average CDF with current average unavailability of all systems and components.

CDFA = CDF evaluated from the PRA model with the A Loop equipment out of service and any compensatory measures for the A Loop implemented.

CDFB = CDF evaluated for the PRA model with the B Loop equipment and any compensatory measures for the B Loop implemented.

TA = Total additional time per refueling cycle (TCYCLE) that A Loop is out-of service for the extended AOT (the maintenance activity is required to occur once per loop per cycle and is assumed to require the maximum AOT of 7 days for the LAR).

TB = Total additional time per refueling cycle (TCYCLE) that B Loop is out of service for the extended AOT (the maintenance activity is required to occur once per loop per cycle and is assumed to require the maximum AOT of 7 days for the LAR).

TCYCLE = refueling cycle length which may be greater than one year (~700 days for the representative plant).

]

1 3

[

1

+

Eq CDF T

T T

BASE CYCLE B

A

Limerick RHRSW/SPC AOT Extension 17 P467090055-3424 Note: Equation 3-1 produces the weighted average of the CDFs for the conditions, with the weight being the fraction of a period of time over which each condition exists. The CDF to be compared to the Reg. Guide 1.174 guidelines is given by CDF = CDFNEW - CDFBASE

[Eq. 3-2]

Use of this equation assumes that by far the biggest impact of extending the AOT results from the shifting of the maintenance from shutdown to operations. The impact on the unavailability resulting from non-scheduled maintenance is minor, because of the low probability of maintenance, and the fact that maintenance times are typically much smaller than the AOT.

Therefore, CDF in this application is approximated by the difference between the annual average CDF with the AOT extended and the CDF with the current AOT Tech Spec. The CDF has dimensions of per year.

The ICCDP associated with each RHR/RHRSW Loop equipment being OOS using the new AOT is given by ICCDPRHRSW X = (CDFRHRSW X - CDFBASE) x AOTNEW

[Eq. 3-3]

where CDFRHRSW X = the annual average CDF calculated with the X (A or B) Loop equipment OOS, respectively.

CDFBASE = baseline annual average CDF with average unavailability for all equipment. This is the CDF result of the baseline PRA.

AOTNEW = the new extended AOT (in units of years, e.g. 7 days

1 year / 365 days = 1.92E-2 years)

Note: ICCDP is a dimensionless probability.

Risk significance relative to LERF and ICLERP is determined using equations of the same form as noted above for CDF and ICCDP. As previously stated, the corresponding risk significance guidelines are LERF vs. base LERF as given in Reg.

Guide 1.174 Figure 4 and ICLERP < 1E-07 as shown in Table 1-1 above.

The relevant inputs to Equations 3-1 through 3-3 (and the equivalent for LERF) are shown in Table 3.2-1 below. The corresponding output parameters from the equations above are then provided in Table 3.2-2. The analysis is performed for CDF and LERF from the internal events and internal floods PRA model.

Limerick RHRSW/SPC AOT Extension 18 P467090055-3424 Table 3.2-1 FPIE RISK ASSESSMENT INPUT PARAMETERS Input Parameter Unit 1 Value Unit 2 Value CDFBASE 3.20E-06/yr 3.19E-06/yr CDFA 7.17E-06/yr 7.21E-06/yr CDFB 7.36E-06/yr 7.35E-06/yr LERFBASE 5.01E-08/yr 5.00E-08/yr LERFA 5.61E-08/yr 8.49E-08/yr LERFB 8.56E-08/yr 5.67E-08/yr TA 7 Days 7 Days TB 7 Days 7 Days TCYCLE 700 Days 700 Days AOTNEW 1.92E-02(1) 1.92E-02(1)

(1) One 7-day TS entry assumed per year.

Table 3.2-2 FPIE RISK ASSESSMENT BASE OUTPUT RESULTS Risk Metric Unit 1 Value Unit 2 Value CDFNEW 3.28E-06/yr 3.27E-06/yr CDF 8.13E-08/yr 8.18E-08/yr ICCDPA 7.61E-08 7.71E-08 ICCDPB 7.98E-08 7.98E-08 LERFNEW 5.05E-08/yr 5.04E-08/yr LERF 4.15E-10/yr 4.16E-10/yr ICLERPA 1.15E-10 6.69E-10 ICLERPB 6.81E-10 1.28E-10

Limerick RHRSW/SPC AOT Extension 19 P467090055-3424 3.3 EXTERNAL EVENTS A summary of the assessment of external event risks is provided in this section. Further details are found in Appendix A.

3.3.1 Internal Fires The impact on the internal fires risk profile due to the proposed AOT extension is evaluated using the LGS Interim FPRA [Ref. 10]. The LGS FPRA is an interim implementation of NUREG/CR-6850; that is, not all tasks identified in NUREG/CR-6850 are yet completely addressed or implemented due to the changing state-of-the-art of industry at the time of the 2007-2008 LGS FPRA development. Therefore, it is used to develop both quantitative and qualitative insights for this risk assessment.

The internal fires risk impact assessment is discussed in detail in Appendix A.3 including the identification of current limitations and conservatisms associated with the current Fire PRA model. From a quantitative perspective, however, the same set of basic event changes identified for the FPIE model in Tables 1-3 and 1-4 were also deemed applicable for the Fire PRA model.

The same process in Section 3.2 that was used for the FPIE model can also be used with the Fire PRA model results. The relevant inputs to Equations 3-1 through 3-3 are shown in Table 3.3-1 below. The corresponding output parameters from the equations above are then provided in Table 3.3-2. Note that only fire CDF is available, therefore a qualitative evaluation is performed for fire LERF (see note 1 to Table 3.3-2).

Table 3.3-1 FIRE PRA RISK ASSESSMENT INPUT PARAMETERS Input Parameter Unit 1 Value Unit 2 Value FCDFBASE 1.30E-05/yr 1.43E-05/yr FCDFA 3.99E-05/yr 4.53E-05/yr FCDFB 8.11E-05/yr 7.39E-05/yr TA 7 Days 7 Days TB 7 Days 7 Days TCYCLE 700 Days 700 Days AOTNEW 1.92E-02 1.92E-02

(

Limerick RHRSW/SPC AOT Extension 20 P467090055-3424 Table 3.3-2 FIRE PRA RISK ASSESSMENT BASE OUTPUT RESULTS Risk Metric Unit 1 Value Unit 2 Value FCDFNEW 1.40E-05/yr 1.52E-05/yr FCDF 9.50E-07/yr 9.06E-07/yr ICFCDPA 5.16E-07 5.95E-07 ICFCDPB 1.31E-06 1.14E-06 FLERFNEW N/A(1)

N/A(1)

FLERF N/A N/A ICFLERPA N/A N/A ICFLERPB N/A N/A (1) Due to the nature of the RHRSW function in mostly providing a long term containment heat removal function, there is a very limited impact on LERF as is indicated by the comparison of CDF and LERF for the internal events results.

The accident scenarios contributing to the change in risk from fires are not expected to be any different from those for internal events. Therefore, although not explicitly quantified, a significant increase in the LERF related risk metrics is not expected from the fire analysis.

From a qualitative perspective, the fire risk analysis for Limerick identifies a few scenarios where both trains of RHRSW Loop A/B, and/or both trains of RHR/SPC Loop A/B, if failed by a fire, could result in an increased likelihood of core damage during the extended RHRSW outage window. Each of these areas was reviewed to determine if other mitigation measures were available to respond to the fire (e.g. containment vent and other injection sources) or if the postulated fire is extremely remote. After performing this screening, a few areas in each unit were identified as being most important during the RHRSW Loop A outage window and a few areas in each unit were identified as being most important during the RHRSW Loop B outage window.

For the RHRSW Loop A outage window, the following areas were identified as potentially benefitting from additional compensatory measures that could further reduce the risk of fires from these areas.

Unit 1

Fire Area 15, Unit 1 Division 2 (D12) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS B panel 10-C601 (Bay A, B))

Fire Area 25, Auxiliary Equipment Room (Cable Fires)

Unit 2

Limerick RHRSW/SPC AOT Extension 21 P467090055-3424

Fire Area 17, Unit 2 Division 2 (D22) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS B panel 20-C601 (Bay A, B))

Fire Area 25, Auxiliary Equipment Room (Cable Fires)

For the RHRSW Loop B outage window, the following areas were identified as most important:

Unit 1

Fire Area 13, Unit 1 Division 1 (D11) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS A panel 10-C601 (Bay C, D, E, F))

Fire Area 25, Auxiliary Equipment Room (Cable Fires and Termination Cabinet Fires)

Fire Area 26, Remote Shutdown Panel (Severe Fire)

Unit 2

Fire Area 19, Unit 2 Division 1 (D21) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS A panel 20-C601 (Bay C, D, E, F))

Fire Area 25, Auxiliary Equipment Room (Cable Fires and Termination Cabinet Fires)

Fire Area 26, Remote Shutdown Panel (Severe Fire)

Heightened awareness in the form of shift debriefs or pre-job walkdowns to reduce and manage transient combustibles prior to entrance into the extended AOT completion time will be used to alert the staff about the increased sensitivity to fires in these areas during the extended RHRSW outage windows. Additionally, hot work will be limited in these areas during the extended RHRSW outage windows. This heightened awareness when combined with the other compensatory actions will reduce the potential for core damage from postulated fire scenarios.

3.3.2 Seismic Exelon does not currently maintain a seismic PRA for LGS. The impact on the seismic risk profile due to the proposed AOT extension is evaluated using a focused, bounding seismic risk assessment to evaluate the role of the RHRSW loops in mitigating seismic-induced events.

The seismic risk impact assessment is discussed in Appendix A.4. The assessment concluded that seismic risk can be appropriately screened as a non-significant contributor to the risk assessment of the proposed AOT extension.

3.3.3 External Floods and Other External Hazards In addition to internal fires and seismic events, the Limerick IPEEE evaluated high winds and tornadoes, external floods, and transportation and nearby facility accidents.

Limerick RHRSW/SPC AOT Extension 22 P467090055-3424 The design of the LGS plant facilities meets the NRCs 1975 Standard Review Plan criteria for each of the other external events evaluated.

These conclusions were reviewed for applicability to this RHRSW/SPC AOT extension assessment and as such, external flooding and other external hazards were also screened as non-significant contributors to the risk assessment of the proposed AOT extension (refer to Appendix A.2).

3.4 RESULTS COMPARISON TO ACCEPTANCE GUIDELINES Table 3.4-1 for Unit 1 and 3.4-2 for Unit 2 shows a comparison of the individual hazard group core damage risk metrics to the acceptance guidelines defined in Section 1.3.4.

Due to the nature of the RHRSW functions, the focus is on the core damage risk metrics since the large early risk metrics were determined not to be significant contributors for this LAR. The results indicate that the acceptance guideline values are not exceeded in most cases and just barely exceeded for the Unit 1 total CDF risk metric. However, these results did not directly account for all of the proposed compensatory measures.

For example, the identification of protected equipment trains will help to reduce fire risk in those areas, and heightened awareness of important operator actions and fire areas would reduce the risk even further, but this has not been directly quantified.

Limerick RHRSW/SPC AOT Extension 23 P467090055-3424 Table 3.4-1 COMPARISON OF UNIT 1 INDIVIDUAL HAZARD GROUP RESULTS TO ACCEPTANCE GUIDELINES Figure of Merit Value Acceptance Guideline Below Acceptance Guideline Internal Events and Internal Floods CDF 8.13E-08/yr

<1.0E-06/yr Yes ICCDPA 7.61E-08

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB 7.98E-08

<1.0E-06, or <1.0E-5(1)

Yes Internal Fires CDF 9.50E-07/yr

<1.0E-06/yr Yes ICCDPA 5.16E-07

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB 1.31E-06

<1.0E-06, or <1.0E-5(1)

Yes(1)

Other Hazard Groups CDF Negligible

<1.0E-06/yr Yes ICCDPA Negligible

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB Negligible

<1.0E-06, or <1.0E-5(1)

Yes Total Values CDF 1.03E-06/yr

<1.0E-06/yr No(2)

ICCDPA 5.92E-07

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB 1.39E-06

<1.0E-06, or <1.0E-5(1)

Yes(1)

(1) Per NUMARC 93-01 as endorsed by RG 1.182, a value between 1E-06, but less than 1E-05 may be deemed acceptable with effective compensatory measures implemented to reduce the sources of increased risk.

(2) This results in a movement from Region III and just barely into Region II from the quantitative acceptance guidelines in RG 1.174 for permanent technical specification changes. This will be discussed further in Section 5.3.

Limerick RHRSW/SPC AOT Extension 24 P467090055-3424 Table 3.4-2 COMPARISON OF UNIT 2 INDIVIDUAL HAZARD GROUP RESULTS TO ACCEPTANCE GUIDELINES Figure of Merit Value Acceptance Guideline Below Acceptance Guideline Internal Events and Internal Floods CDF 8.18E-08/yr

<1.0E-06/yr Yes ICCDPA 7.71E-08

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB 7.98E-08

<1.0E-06, or <1.0E-5(1)

Yes Internal Fires CDF 9.06E-07/yr

<1.0E-06/yr Yes ICCDPA 5.95E-07

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB 1.14E-06

<1.0E-06, or <1.0E-5(1)

Yes(1)

Other Hazard Groups CDF Negligible

<1.0E-06/yr Yes ICCDPA Negligible

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB Negligible

<1.0E-06, or <1.0E-5(1)

Yes Total Values CDF 9.88E-07/yr

<1.0E-06/yr Yes ICCDPA 6.72E-07

<1.0E-06, or <1.0E-5(1)

Yes ICCDPB 1.22E-06

<1.0E-06, or <1.0E-5(1)

Yes(1)

(1) Per NUMARC 93-01 as endorsed by RG 1.182, a value between 1E-06, but less than 1E-05 may be deemed acceptable with effective compensatory measures implemented to reduce the sources of increased risk.

Limerick RHRSW/SPC AOT Extension 25 P467090055-3424 3.5 UNCERTAINTY ASSESSMENT 3.5.1 Parametric Uncertainty Consistent with the ASME PRA Standard, quantitative parametric uncertainty analyses for both CDF and LERF are evaluated to determine if the point estimates calculated by the PRA model appropriately represent the mean. The results of these analyses are summarized in Appendix B.2.1.

The parametric uncertainty analysis shown in Appendix B.2.1 supports the use of the point estimate to represent the mean for the calculation of the changes in the risk metrics for the extended AOT.

3.5.2 Modeling Uncertainty An assessment of modeling uncertainties is documented in Sections B.1 and B.2.2.

Section B.1 provides an examination of the specific sequences and cutsets that affect the change in the CDF risk metric associated with the change in the RHRSW/SPC AOT.

Section B.2.2 provides an assessment of the candidate sources of model uncertainty for the RHRSW/SPC AOT change request.

The model uncertainty assessment highlighted the following sources of uncertainty as being important to address with potential compensatory measures:

Heightened awareness should be maintained regarding the important operator actions associated with the performance of the extended AOT (i.e., operator actions to refill the CST, operator action to vent containment per T-200, and operator action to maximize CRD injection to the vessel per T-240).

Proper standby alignment of the opposite RHRSW train should be ensured prior to entry into the AOT as this would reduce the contribution from potential pre-initiator errors.

The PRA analysis already includes exclusion of several maintenance combinations that would not be allowed to be performed during the extended AOT (opposite train RHRSW pumps and opposite train ESW loop). It was also noted that avoiding elective maintenance on the individual EDGs that support the protected RHRSW pump trains would also reduce the overall CDF contribution from LOOP events:

When RHRSW Loop A is unavailable EDGX12TM, Diesel Generator 12 supports RHRSW Pump B EDGX24TM2, Diesel Generator 24 supports RHRSW Pump D

Limerick RHRSW/SPC AOT Extension 26 P467090055-3424 When RHRSW Loop B is unavailable EDGX11TM, Diesel Generator 11 supports RHRSW Pump A EDGX23TM2, Diesel Generator 23 supports RHRSW Pump C

Avoiding elective maintenance on the RHR trains that support the protected RHRSW loop would also reduce the CDF contribution from various contributors:

When RHRSW Loop A is unavailable DPM02BTM, Unit 1 RHR Pump B DPM02DTM, Unit 1 RHR Pump D DPM02BTM2, Unit 2 RHR Pump B DPM02DTM2, Unit 2 RHR Pump D When RHRSW Loop B is unavailable DPM02ATM, Unit 1 RHR Pump A DPM02CTM, Unit 1 RHR Pump C DPM02ATM2, Unit 2 RHR Pump A DPM02CTM2, Unit 2 RHR Pump C The results of the modeling uncertainty assessments do not change the conclusions of this risk assessment for the proposed RHRSW/SPC AOT changes, but it does provided added assurance that the compensatory measures have been appropriately identified.

3.6 RISK

SUMMARY

This analysis demonstrates with reasonable assurance that the proposed TS change is within the current risk acceptance guidelines in RG 1.174 and not substantially above the current acceptance guidelines in RG 1.177 for permanent changes. This combined with effective compensatory measures to maintain lower risk ensures that the TS change meets the intent of the ICCDP and ICLERP acceptance guidelines of 1.0E-05 and 1.0E-06 established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions.

Limerick RHRSW/SPC AOT Extension 27 P467090055-3424 4.0 TECHNICAL ADEQUACY OF PRA MODEL The 2008A update to the LGS PRA model (LG108A and LG208A) is the most recent evaluation of the risk profile at LGS for FPIE challenges. The LGS PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the LGS PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

Exelon employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating Exelon nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the LGS PRA.

4.1 PRA QUALITY OVERVIEW The quality of the LGS FPIE PRA is important in making risk-informed decisions. The importance of the PRA quality derives from NRC Policy Statements as implemented by RGs 1.174 and 1.177, rule making and oversight processes. These can be briefly summarized as follows using the words of the NRC Policy Statement (1995):

1. The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-artand supports the NRCs traditional defense-in-depth philosophy.

2. PRAshould be used in regulatory mattersto reduce unnecessary conservatism

3. PRA evaluations in support of regulatory decisions should berealisticand appropriate supporting data should be publicly available for reviews.

4. The Commissions safety goalsand subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments

5. Implementation of the [PRA] policy statement will improve the regulatory process in three ways:

Foremost, through safety decision making enhanced by the use of PRA insights; Through more efficient use of agency resources; and

Limerick RHRSW/SPC AOT Extension 28 P467090055-3424 Through a reduction in unnecessary burdens on licensees.

PRA quality is an essential aspect of risk-informed regulatory decision making. In this context, PRA quality can be interpreted to have five essential elements:

Scope (Section 4.2): The scope (i.e., completeness) of the FPIE PRA.

The scope is interpreted to address the following aspects:

Challenges to plant operation (Initiating Events):

3/4 Internal Events (including Internal Floods) 3/4 External Hazards 3/4 Fires Plant Operational states:

3/4 Full Power 3/4 Low Power 3/4 Shutdown The metrics used in the quantification:

3/4 Level 1 PRA - CDF 3/4 Level 2 PRA - LERF 3/4 Level 3 PRA - Health Effects

Fidelity (Section 4.3): The fidelity of the PRA to the as-built, as-operated plant.

Standards (Section 4.4): ASME/ANS PRA Standard [Ref. 4] as endorsed by the NRC in Regulatory Guide 1.200 [Ref. 1].

Peer Review (Section 4.5): An independent PRA peer review provides a method to examine the PRA process by a group of experts. In some cases, a PRA self-assessment using the available PRA Standards endorsed by the NRC can be used to replace or supplement this peer review.

Appropriate Quality (Section 4.6): The quality of the PRA needs to be commensurate with its application. In other words, the needed quality is defined by the application requirements.

4.2 SCOPE The LGS PRA is a full power, internal events (FPIE) PRA that addresses both CDF and LERF. The quantitative insights from the FPIE PRA are directly applicable to the RHRSW/SPC AOT Extension PRA application. This scope is judged to be adequate to support the RHRSW/SPC AOT PRA application. Consideration of other modes of operation is addressed in Section 1.4 and an evaluation of other potential hazard groups is included in Appendix A of this report.

Limerick RHRSW/SPC AOT Extension 29 P467090055-3424 Because not all PRA standards are available to define the appropriate elements of PRA quality for all applications, the NRC has adopted a phased implementation approach.

This phased approach uses available PRA tools and their quantitative results where standards are available and endorsed by the NRC. Where standards are not yet available or endorsed, this approach uses qualitative insights or bounding approaches as needed.

The quality assessment performed in this section confirms the adequacy of the FPIE PRA. This quality assessment does not address the risk implications associated with low power or shutdown operation, nor does it address the quality assessment of external events (including fire). However, the results of the analysis for these other contributors have been used to obtain additional insights for potential compensatory measures and otherwise do not change the conclusions of the assessment.

4.3 FIDELITY

PRA MAINTENANCE AND UPDATE The Exelon risk management process for maintaining and updating the PRA ensures that the PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the Exelon Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation procedures. Exelon procedure ER-AA-600-1015, "FPIE PRA Model Update" delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating Exelon nuclear generation sites. The overall Exelon Risk Management program, including ER-AA-600-1015, defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed:

Design changes and procedure changes are reviewed for their impact on the PRA model.

New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

Maintenance unavailabilities are captured, and their impact on CDF is trended.

Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every four years.

In addition to these activities, Exelon risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance includes:

Limerick RHRSW/SPC AOT Extension 30 P467090055-3424

Documentation of the PRA model, PRA products, and bases documents.

The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

Guidelines for updating the full power, internal events PRA models for Exelon nuclear generation sites.

Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)).

In accordance with this guidance, regularly scheduled PRA model updates nominally occur on a four year cycle; shorter intervals may be required if plant changes, procedure enhancements, or model changes result in significant risk metric changes.

4.4 STANDARDS The ASME PRA Standard provides the basis for assessing the adequacy of the LGS PRA as endorsed by the NRC in RG 1.200, Revision 1. The predecessor to the ASME PRA Standard was NEI 00-02 which identified the critical internal events PRA elements and their attributes necessary for a quality PRA.

4.5 PEER REVIEW AND PRA SELF-ASSESSMENT There are three principal ways of incorporating the necessary quality into the PRA in addition to the maintenance and update process. These are the following:

A thorough and detailed investigation of open issues and the implementation of their resolution in the PRA.

A PRA Peer Review to allow independent reviewers from outside to examine the model and documentation. The ASME PRA Standard specifies that a PRA Peer Review be performed on the PRA.

The use of the ASME PRA Standard to define the criteria to be used in establishing the quality of individual PRA elements There have been several assessments to support a conclusion that the Limerick PRA model adequately meets the PRA standard such that it can be used to support risk applications in accordance with Regulatory Guide (RG) 1.200.

The LGS PRA model for internal events received a formal industry peer review in November 1998. The model was updated in 2001 to address all of the significant

Limerick RHRSW/SPC AOT Extension 31 P467090055-3424 findings from that review. Subsequently, LGS was one of the five nuclear plants that piloted application of RG 1.200. As part of that process a PRA gap analysis that compared the LGS PRA to the requirements of the NRC-endorsed ASME PRA Standard was completed in 2003 in support of the LGS pilot for Risk-Informed activities.

Additionally, the Limerick PRA model was subject to an NRC RG 1.200 pilot assessment in July 2004, and following the completion of the PRA model update in 2005 to strategically address the identified gaps, a peer review against Addendum B of the ASME PRA Standard was performed in October 2005 [Ref. 15].

In the SER that was issued on September 28, 2006 from the NRC [Ref. 16] for implementation of the surveillance frequency control program (SFCP), which allows for relocation of surveillance test intervals to a licensee-controlled program, the following concluding statement was included regarding the quality of the Limerick PRA model:

Based on the peer review completed in 1998, the self-assessment using DG-1112 in 2003, and the peer review using RG 1.200, and draft Addendum B of ASME RA-Sa-2003, the licensee has demonstrated that the LGS PRA model for internal events is of adequate quality to support implementation of the SFCP consistent with the PRA quality requirements of NEI 04-10,Rev. 0.

Additionally, in May of 2008, a focused peer review against Addendum B of the ASME PRA Standard of the updated internal flooding analysis was performed [Ref. 17]. The results of that peer review will also serve as input into the remaining portion of the PRA technical adequacy assessment which follows.

It should be noted that PRAs can be used in applications despite not meeting all of the Supporting Requirements of the Combined ASME/ANS PRA Standard. This is well recognized by the NRC and is explicitly stated in the Combined ASME/ANS PRA Standard.

4.6 APPROPRIATE PRA QUALITY The PRA is used within its limitations to augment the deterministic criteria for plant operation. This is confirmed by the PRA Peer Review and the PRA Self-Assessment.

As indicated previously, RG 1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated in to the PRA model, consistency with applicable PRA Standards, relevant peer review findings, and the identification of key assumptions) is discussed below.

4.6.1 Plant Changes Not Yet Incorporated into the PRA Model A PRA updating requirements evaluation (URE) is Exelons PRA model update tracking database. These UREs are created for all issues that are identified with a potential to

Limerick RHRSW/SPC AOT Extension 32 P467090055-3424 impact the PRA model. The URE database includes the identification of those plant changes that could impact the PRA model. A review of the current open items in the URE database associated with plant changes for LGS is summarized in Table 4-1 along with an assessment of the impact for this application.

The results of the assessment documented in Table 4-1 are that none of the plant changes have any measurable impact on the RHRSW/SPC AOT extension request.

4.6.2 Consistency with Applicable PRA Standards As indicated above, formal peer reviews against Addendum B of the ASME PRA Standard were performed in October 2005 and a focused peer review for internal flooding was performed in May 2008. The results of that review plus the identification of a few items based on changes to the PRA Standard that have evolved since that time lead to the identification of the LGS PRA as not meeting Capability Category II for a small number of Supporting Requirements (SRs) listed below. These SRs are summarized in Table 4-2 along with the status after the completion of the 2008A LGS PRA update plus their impact for the base model.

In summary, prior to the completion of the 2008A update there were 29 Supporting Requirements that were judged to be Not Met or only meeting Capability Category I.

At the completion of the 2008A update, there are just eight supporting requirements that are judged to be Not Met or only meeting Capability Category I. As indicated in Table 4-2 for those items that have not been closed, these remaining gaps have very limited or no impact on the model results and also have very limited or no impact on the RHRSW/SPC AOT extension request.

4.6.3 Relevant Peer Review Findings RG 1.200, Revision 1 provides the following guidance with respect to meeting the ASME PRA Standard requirements and hence to the quality of a PRA model:

If the requirement has been met for the majority of the systems or parameter estimates, and the few examples can be put down to mistakes or oversights, the requirement would be considered to be met. If, however, there is a systematic failure to address the requirement (e.g. component boundaries have not been defined anywhere), then the requirement has not been complied with. In either case, the examples of noncompliance are to be (1) rectified or demonstrated not to be relevant to the application, and (2) documented.

The results of the October 2005 and May 2008 peer reviews are also used to identify the relevant peer review findings for the PRA model used for this assessment. These findings are summarized in Table 4-3 along with an assessment of the impact for the base model development. The associated F&Os with the Not Met or Capability Category I issues identified above are not repeated in this assessment. Table 4-3,

Limerick RHRSW/SPC AOT Extension 33 P467090055-3424 therefore only includes those Findings (i.e. B level F&Os associated with the 2005 peer review and Findings from the 2008 internal flooding focused peer review) that are associated with SRs that were otherwise assigned to be at least Capability Category II from the peer review consistent with the RG-1.200 guidance quoted above.

In summary, prior to the completion of the 2008A update there were 19 additional peer review findings not already encompassed within the entries in Table 4-2. At the completion of the 2008A update, there are just seven relevant findings that are judged to not be fully closed. As indicated in Table 4-3, however, these remaining open items have no or very limited impact on the model results and also should have no or very limited impact on most applications of the model. Tables 4-2 and 4-3 also include an evaluation of the impact of these findings on the model for this application.

4.6.4 Identification of Key Assumptions Key assumption identification is discussed in detail in Appendix B and summarized in Section 3.5.

Limerick RHRSW/SPC AOT Extension 34 P467090055-3424 TABLE 4-1 IMPACT ON THE LIMERICK PRA MODEL OF PLANT CHANGES SINCE THE LAST PRA UPDATE URE NUMBER DESCRIPTION DISPOSITION IMPACT ON THE APPLICATION LG2004-086 OPRM mod ecr 01-00353 and 354. The modification adds the reactor power instability scram to RPS.

Deferred. Enhancement/ level of detail not considered necessary at this time.

Non-significant impact. This is considered a minor modification to the RPS logic and would not significantly impact the results.

LG2005-001 Use of Temporary battery charger per ECR 05-00023. ECR 05-00023 allows use of a temporary non-seismically qualified battery charger if the permanent charger is failed to maintain voltage and prevent the battery from discharging. This is supported by TS.

Deferred. This is a level of detail that would not significantly impact the results. Use of temporary charger can be assumed to be approximately equivalent to existing charger if put into place.

No impact, current treatment is conservative LG2005-006 Alternate power supply for C and D ESW.

D13 & D14 provide alternate power supply to 0CESW & 0DESW Deferred. This is a level of detail refinement that is not considered absolutely necessary to implement at this time (2008 update).

No impact, current treatment is conservative LG2005-007 Credit EDG X-tie to X-Unit 4 kV (Ref. ECR 04-00651 approved in Feb 2005 and Design Analysis LE-0111 Deferred. Only cross-tie of the EDGs within each unit are credited. This retains a slight conservative treatment without overcomplicating the logic structure within the PRA model. It is a level of detail refinement that is not considered absolutely necessary to implement at this time (2008 update).

No impact, current treatment is conservative

Limerick RHRSW/SPC AOT Extension 35 P467090055-3424 TABLE 4-1 IMPACT ON THE LIMERICK PRA MODEL OF PLANT CHANGES SINCE THE LAST PRA UPDATE URE NUMBER DESCRIPTION DISPOSITION IMPACT ON THE APPLICATION LG2007-048 ECR 05-00040 (Unit # 1) removes the love controllers from the control logic for the RHR and Core Spray unit coolers and directly interlocks the unit coolers start and stop logic to their associated pump (RHR or Core Spray) start and stop logic. This ECR also install new digital STS controllers to perform the alarm function in the unit coolers control logic and to satisfy the Appendix R requirement for RHR pump room unit cooler 1AV210 only.

Mod deferred, not to be added to model until installed at the plant.

No impact, change not implemented LG2007-049 ECR 05-00041 (Unit # 2) removes the love controllers from the control logic for the RHR and Core Spray unit coolers and directly interlocks the unit coolers start and stop logic to their associated pump (RHR or Core Spray) start and stop logic. This ECR also install new digital STS controllers to perform the alarm function in the unit coolers control logic.

Mod deferred - see LG2007-048.

No impact, change not implemented

Limerick RHRSW/SPC AOT Extension 36 P467090055-3424 TABLE 4-1 IMPACT ON THE LIMERICK PRA MODEL OF PLANT CHANGES SINCE THE LAST PRA UPDATE URE NUMBER DESCRIPTION DISPOSITION IMPACT ON THE APPLICATION LG2008-009 Contingency to Isolate "A" RHRSW Return Piping to U1 Cooling Tower and X-Tie to U2 Cooling Twr. ECR TCP 08-00231 -

Contingency Repair due to External Pipe Corrosion in man hole MH-212. PSA Model is impacted (HV-012-111, -113, -017A, -

017B) and will be reviewed and revised if contingency is implemented.

(1) Verify which if any of these ECRs (08-00231, 08-00273, 08-00276) implementation has occurred prior to incorporation into LGS PRA Model.

[Note that this mod has not been implemented at the site.]

(2) Scope includes isolation (closure) of valves HV-012-111 and HV-012-113 in MH-212. Scope also includes removal of HV-012-017A and cut / cap its pipe in MH-212. This defeats the cross-tie from "A" RHRSW return to U2 Cooling Tower as well as "B" RHRSW Return to U1 Cooling Tower (HV-012-017B). Scope of ECR 08-00231 later changed to change position of HV-012-113 to "NLC", HV-012-111 to "NLO", HV-012-017A(B) changes are de-scoped from ECR.

(3) Also, revise PRA Summary Notebook, LGS-PRA-013, section 4.4.3 (Insight) and section 4.5.10 (Sensitivity Impact of Not Crediting ESW/RHRSW Discharge to the Cooling Towers - 5% CDF reduction if OPS Action HEP was not 1.0)

No impact, change not implemented

Limerick RHRSW/SPC AOT Extension 37 P467090055-3424 TABLE 4-1 IMPACT ON THE LIMERICK PRA MODEL OF PLANT CHANGES SINCE THE LAST PRA UPDATE URE NUMBER DESCRIPTION DISPOSITION IMPACT ON THE APPLICATION LG2009-001 Inhibit AUTO-START of "C" SLCS PP (ECR 07-00413). ECR 07-00413 proposes to inhibit the AUTO-START of "C" SLCS PP.

Ref. PIMS AR A1637702-11.ECR design engr (Ken Collier) advises that "There is no licensing or regulatory requirement to have three SLC pumps in operation with an auto start signal" and that "LGS is the only plant to my knowledge that has 3 SLCS PPs".

The individual SLCS pump importance values are negligible even in the updated model even though ATWS I.E. contribution is changing from 7.5% (2004B PRA model) to about 17% in the 2008A PRA model.

This is because other factors (non-SLCS-related) are causing the ATWS contribution increase. A change would be required to disable the auto function in the logic for the C pump, but this will still have a very small impact since the overall ATWS contribution is due to other operator action failures not directly related to SLCS injection. Future PRA revision would require a parallel OPs action for a manual start of "C" SLCS PP if needed (if 1 of other 2 PPs FTS.)

[Note that this mod has not been implemented at the site.]

Very minimal impact. ATWS scenarios are not significant contributors for the proposed RHRSW/SPC AOT extension (Refer to Appendix B, Table B-1).

Limerick RHRSW/SPC AOT Extension 38 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION IE-A7 Review plant-specific operating experience for initiating event pre-cursors.

Minimal impact. This SR was assigned meeting only Category I since formal documentation of the pre-cursor review was not provided.

The Limerick initiating event development is thorough and includes a comprehensive set of initiating events consistent with most industry BWRs.

The current treatment is believed to provide the best estimate response for the plant, and as such not fully meeting this SR has minimal impact on the base model analysis and for most applications of the model.

Minimal impact, a full range of intiating events are included in the model

Limerick RHRSW/SPC AOT Extension 39 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION SY-A12b Include those failures that can cause flow diversion pathways that result in failure to meet the system success criteria.

Very limited impact. This SR was identified as Not Met since it was identified that the HPCI min-flow valve failure to close should be modeled. The failure of the min-flow valve to close was incorporated into the HPCI system logic model as part of the 2008 update.

Diversion paths were considered in the development of all of the system logic models. All relevant single valve failures are included. A detailed investigation to look for additional potential diversion paths stemming from multiple valve failures would have a small impact on the CDF and LERF results, and as such will not significantly impact the base model assessment. However, this type of investigation could be useful to support some applications (particularly the Fire PRA model where multiple spurious operations should be considered).

Minimal impact, flow diversion failures will not signifcantly add to the existing system or train failure probabilities.

HR-A1 This supporting requirement indicates that the test and maintenance pre-initiators should be derived from a review of procedures and practices.

Very limited impact. The model includes several test and maintenance pre-initiators for a number of risk significant systems, but these were not derived from a formal review of procedures and practices.

No impact, test and maintenance pre-initiators exist for all relevant systems associated with this LAR (i.e.

HPCI, RCIC, EDG, and RHR loops).

Limerick RHRSW/SPC AOT Extension 40 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION DA-C6 Document and employ the methodology used for determining the standby component number of demands to include plant specific:

surveillance tests maintenance acts surveillance tests or maintenance on other components operational demands Minimal impact. For the most part, the estimated demands were determined from the Maintenance Rule database. This database specifically includes the contribution from the listed items, but the contribution is not specifically mapped to each in all cases.

The current treatment is believed to provide a reasonable representation of the best estimate response for the plant, and as such not fully meeting this SR has minimal impact on the base model analysis and for most applications of the model.

Minimal impact as the current data values provide a reasonable representation of the best estimate reliability response for the plant DA-C7 Base number of tests, maintenance activities, and unplanned maintenance on actual plant experience.

Minimal impact. Providing documentation of the maintenance and test procedures and how they are used to estimate demands seems unnecessary since the estimated demands were mostly determined from the Maintenance Rule database.

The current treatment is believed to provide a reasonable representation of the best estimate response for the plant, and as such not fully meeting this SR has minimal impact on the base model analysis and for most applications of the model.

Minimal impact as the current data values provide a reasonable representation of the best estimate reliability response for the plant

Limerick RHRSW/SPC AOT Extension 41 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION IF-B3 Supporting Requirement IF-B3 specifies that the total volume and temperature and pressure of the flood source be specified.

Very minimal impact.

Screening of scenarios was not based on volume of water within the system. It was based on initiating event frequencies and bounding CCDPs with no credit for mitigation measures.

Additionally, flood sources at LGS are low-temperature systems and temperature would not be expected to influence the accident progression.

Minimal impact. Flooding scenarios are not very significant contributors for the proposed RHRSW/SPC AOT extension (Refer to Appendix B, Table B-2).

IF-C2b Supporting Requirement IF-C2b calls for and accounting for drains in estimating flood volumes and SSC impacts from flooding.

Very minimal impact. The few scenarios that were analyzed in detail were judged not to be significantly impacted by drain capacities.

Minimal impact. Flooding scenarios are not very significant contributors for the proposed RHRSW/SPC AOT extension (Refer to Appendix B, Table B-2).

IF-D1 Supporting Requirement IF-D1 calls for the identification of the appropriate initiating event from the flood scenario.

Addressed in 2008 update.

Revision 1 of the flooding report re-established the appropriate initiating events for each scenario. The updated version was integrated in to the LG108A and LG208A models.

No Impact IF-E1 Supporting Requirement IF-E1 calls for the associated plant initiating event group to confirm applicability of the accident sequence model.

Addressed in 2008 update.

Revision 1 of the flooding report ensured that the major flood sources were not credited in the subsequent accident progression modeling. The updated version was integrated in to the LG108A and LG208A models.

No Impact

Limerick RHRSW/SPC AOT Extension 42 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION IF-E5a Supporting Requirement IF-E5a calls for a systematic assessment of the existing operator actions that are included in flood sequences.

Minimal impact. Supporting detailed HEP evaluations were developed for the major flood contributors.

Further analysis for all existing HEPs associated with the flooding analysis is not expected to significantly impact the results where all but a few contributors were left in the model as bounding scenarios.

Minimal impact. Flooding scenarios are not very significant contributors for the proposed RHRSW/SPC AOT extension (Refer to Appendix B, Table B-2).

IF-E6 Supporting Requirement IF-E6 calls for explicitly quantifying flood-related LERF.

Addressed in 2008 update.

The updated analysis was integrated in to the LG108A and LG208A models that include an evaluation of LERF.

No Impact IF-E7 Supporting Requirement IF-E7 calls for explicitly reviewing applicability of the flood-related LERF sequences.

Addressed in 2008 update.

The updated analysis was integrated in to the LG108A and LG208A models that include a specific evaluation of LERF including all of the impacts from the flood scenarios.

No Impact QU-B4 Use min-cut upper bound or an exact solution. The rare event approximation may be used when basic event probabilities are below 0.1.

Fully addressed in the 2008 update with the conversion to the use of the CAFTA software.

No Impact QU-B8 Set logic flags to either TRUE or FALSE (instead of setting the event probabilities to 1.0 or 0.0), as appropriate for each accident sequence, prior to the generation of cut sets.

Fully addressed in the 2008 update. All HEP values that were evaluated in detail and were determined to be 1.0 and other 1.0 value basic events are set to TRUE in the model.

No Impact

Limerick RHRSW/SPC AOT Extension 43 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION QU-D3 Compare results to those from similar plants.

Addressed in the 2008 update. A detailed comparison to other Exelon BWRs is included in section 4.6 of the Summary Notebook. Additional, the quantification notebook does provide comparison to a typical BWR to explain plusses and minuses of the Limerick features with respect to the calculated CDF and LERF values.

No Impact QU-F5 Document limitations in the quantification process that would impact applications.

Addressed in the 2008 update. There are no limitations of CAFTA and the Limerick modeling that would significantly impact the results of the base model assessment or applications of the model. However, as noted in the quantification notebook (LG-PRA-014), the use of the Forte quantification engine may not work at very low truncation limits.

No Impact. The base PRA model truncation limits of 1E-11 were used for the CDF evaluations and 1E-12 for the LERF evalautions.

QU-F6 Document the quantitative definition used for significant basic event, significant cut set, and significant accident sequence.

Addressed in the 2008 update. It was noted that other than in the HRA notebook, the documentation did not include the applied definition of significant. It is now noted here that the ASME Standard definition is generally applied.

No Impact

Limerick RHRSW/SPC AOT Extension 44 P467090055-3424 TABLE 4-2 IMPACT OF PRA STANDARD SUPPORTING REQUIREMENTS NOT AT LEAST CATEGORY II FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION QU-E1 QU-E2 QU-E4 QU-F4 IE-D3 AS-C3 SC-C3 SY-C3 HR-I3 DA-E3 IF-F3 LE-G4 Several SRs associated with treatment of model uncertainty and related model assumptions have been recently redefined.

NRC has issued a clarification to its endorsement of the PRA Standard, and these clarifications have been rolled into the latest version of the PRA Standard. NRC and EPRI have recently completed guidance on an acceptable process for meeting these requirements.

Addressed in the 2008 update. An assessment based on the final EPRI guidance [Ref. 8] for the base PRA model has been performed and included in Appendix A of the LGS Summary Notebook (LG-PRA-013). The results of that assessment are factored into the identification of potentially key assumptions for applications of the model as described in Appendix B of this report.

Minimal Impact. The base PRA results are referenced by the application, and application specific sensitivity studies are performed based on NRC and EPRI guidance.

Limerick RHRSW/SPC AOT Extension 45 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION AS-A5 Define the accident sequence model in a manner that is consistent with the plant-specific system design, EOPs, abnormal procedures, and plant transient response.

Addressed in the 2008 update. A finding was identified that noted that credit for re-opening of MSIVs in some transient scenarios may need to be re-examined. Credit for re-opening of MSIVs was removed as part of the 2008 update.

No Impact AS-B3 For each accident sequence, identify the phenomenological conditions created by the accident progression.

Very limited impact. A finding was identified to provide a firmer basis for the potential impacts from the High Energy Line Breaks outside of containment.

The current treatment that ultimately relies on injection from an external source outside of the reactor enclosure dominates the impact of these events, and as such not fully addressing this finding has minimal impact on the base model analysis and most applications of the model.

Minimal impact as high energy line breaks scenarios are not very significant contributors for the proposed RHRSW/SPC AOT extension (Refer to Appendix B, Table B-2).

AS-B6 Model time-phased dependencies in the accident sequences.

Addressed in the 2008 update. A finding was identified that noted that the HEPs for manual depressurization and initiating drywell sprays given vapor suppression failure are treated independently, and that better justification is required to support that sufficient time would be available to support these actions.

The subject actions were re-analyzed as part of the 2008 update to appropriately account for the time available and also to capture the dependencies.

No Impact

Limerick RHRSW/SPC AOT Extension 46 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION SC-B1 Use appropriate realistic analysis/evaluations that are applicable to the plant.

Addressed in the 2008 update.

There were 2 separate findings associated with this SR.

A finding identified that the current treatment of utilizing a 0.5 failure probability for the use of fire water injection to the RPV because detailed thermal/hydraulic evaluations were not available to support use of this mode of injection does not meet the intent of this SR. Engineering calculations made since the peer review in support of the B5b mitigative measure implementation provide a high level of confidence that injection from the fire water system into the RPV is indeed feasible.

Therefore, the current model includes a detailed HEP evaluation to support the use of this system when appropriate.

A second finding indicated that the time available to respond for emergency depressurization in medium LOCA events should be re-evaluated. The updated HRA analysis addressed this issue considering both representative steam and water line breaks with separate HEP values derived for each.

No Impact

Limerick RHRSW/SPC AOT Extension 47 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION SY-A6 In defining the system boundary, include within the boundary the components required for system operation.

Addressed in the 2008 update. A finding noted that since the EDG HVAC system is not included in the EDG boundary then CCF parameters should be included for the EDG HVAC system.

The incorporation of CCF parameters for the EDG HVAC system was added as part of the 2008 update.

No Impact

Limerick RHRSW/SPC AOT Extension 48 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION SY-A11 Incorporate the effect of variable success criteria into the system modeling.

Addressed in the 2008 update.

There were 3 findings associated with this SR.

One item related to crediting RHRSW to ESW cross-tie early. Credit for use of the RHRSW to ESW cross-tie was removed as part of the 2008 update.

The second item related to crediting 4kV cross-tie early. Adjustments were made to ensure that credit for the 4 kV cross-tie was disabled in very early time frame scenarios (i.e. prior to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months ).

The third item related to crediting use of HPCI and RCIC in a serial fashion when it is not specifically procedurally directed.

However, the current treatment is believed to provide a reasonable approximation of plant response since only allowing for two hours of battery life per division provides a slight conservative bias to the results.

Additionally, it is well known that the TRIP (EOP) guidance will provide the ultimate guidance in response to LOOP/SBO events such that both HPCI and RCIC will be used as long as either is available.

No Impact

Limerick RHRSW/SPC AOT Extension 49 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION SY-A13 Include consideration of all failure modes, consistent with available data and model level of detail.

Addressed as part of the 2008 update. A finding identified that spurious operation of instruments and transmitters that can trip a mitigating system have not been included in the system fault trees.

As noted in the Limerick System Notebooks, spurious operations are included with mis-calibration events only. Spurious operation events are implicitly subsumed by these events. This is consistent with the exclusion criteria listed in SY-A14.

No Impact SY-B8 Identify and account for spatial and environmental hazards that may impact multiple systems or redundant components in the same system.

Addressed as part of the 2008 update. A finding identified the need to better justify not requiring room cooling when HPCI is credited beyond six hours in the sequence modeling. Room cooling requirements for HPCI and RCIC operation beyond six hours were incorporated as part of the 2008 update.

No Impact HR-G4 Base the time available to complete actions on appropriate thermal/hydraulic analysis.

Addressed as part of the 2008 update. The finding identified that the time available determination for the failure to depressurize HEP may have been non-conservative.

The HEP analysis was totally redone as part of the 2008 update with conversion of the HEPs to the EPRI HRA calculator. Several refinements were made to establish the basis for the times available including the action in question for this specific finding.

No Impact

Limerick RHRSW/SPC AOT Extension 50 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION HR-H3 Account for any dependency between the HFE for operator recovery and any other HFEs.

Very limited impact. A finding suggested that an alternative method could be employed to handle human error dependencies across system boundaries.

The approach used in the Limerick model does account for dependencies across system boundaries in an appropriate fashion and utilizes a standard approach to do so. All of the HFE dependency examples provided in the finding are already included in the Limerick model, and restructuring the current analysis to the suggested approach is judged to have a minimal impact on the overall CDF and LERF results, and as such would not significantly impact the results of the base model assessment or applications.

Minimal impact as human error dependencies are addressed in the PRA model used for this application.

This finding is better characterized as a suggestion of a potential alternate means of addressing human error dependencies.

DA-B1 Group components according to their type and according to the characteristics of their usage.

Very limited impact. A finding noted that better justification could be provided to support the fact that usage characteristics were included in the component grouping.

The updated data analysis utilizes groupings consistent with the available data including the recently implemented generic data from NUREG/CR-6928. Full compliance with this finding is judged to be a documentation issue, and as such would not significantly impact the results of the base model assessment or in applications.

Minimal impact as the current data values provide a reasonable representation of the best estimate reliability response for the plant

Limerick RHRSW/SPC AOT Extension 51 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION DA-B2 Do not include outliers in the definition of a group.

Very limited impact. A finding noted that there was no specific discussion of how outliers (if any) were treated.

A formal analysis to find outliers was not performed, but this is mostly expected to be a documentation issue, and in any event will not have a substantial impact on the CDF and LERF results. As such, fully addressing this finding would not significantly impact the results of the base model assessment or in applications.

Minimal impact as the current data values provide a reasonable representation of the best estimate reliability response for the plant DA-C10 Count only completed tests or unplanned operational demands as success for component operation.

No impact. This was performed for some systems, but not all.

However, it is also judged to not be totally necessary since the failure and demand data includes actual plant experiential data over the last several years for the Maintenance Rule risk significant systems.

No Impact DA-C12 Evaluate the duration of the actual time that the equipment was unavailable for each contributing activity and interview maintenance and operations staff to generate estimates of ranges in the unavailable time.

No impact. This is judged to not be necessary since the total unavailability data includes actual plant test and maintenance experiential data over the last several years for the Maintenance Rule risk significant systems.

No Impact DA-C14 Identify instances of plant-specific or applicable industry experience for each repair term included in the model.

Addressed as part of the 2008 update. A finding indicated that the referenced sources for the repair terms in the Limerick PRA model were dated. Credit for diesel and pump repair was removed from the Level 1 model as part of the 2008 update.

No Impact

Limerick RHRSW/SPC AOT Extension 52 P467090055-3424 TABLE 4-3 IMPACT OF SIGNIFICANT PRA PEER REVIEW FINDINGS FOR THE LIMERICK PRA MODEL SR(S)

ISSUE DESCRIPTION IMPACT ON BASE MODEL IMPACT ON APPLICATION IF-C2a For each flood zone and flood source, include in the documentation the specific automatic or operator actions that could be taken to isolate each flood event.

Very limited impact. No automatic actions were identified as being credited for flood termination or mitigation. Operator actions that are credited with terminating or mitigating a flooding event are generally described but could benefit from more detailed reference to specific valve numbers, etc.

No Impact QU-A4 Include recovery actions in the quantification process in applicable sequences and cut sets.

Addressed as part of the 2008 update. A finding identified the same issues that are covered in the F&Os associated with AS-A5 (for FW/PCS recovery), and in D-C14 (for the repair terms used in the model). As noted above, both of these issues have been addressed.

No Impact QU-D1c Review results to determine that the flag event settings, mutually exclusive event rules, and recovery rules yield logical results.

Addressed as part of the 2008 update. A finding identified that a non-minimal cutset appeared in the LERF cutsets.

Changes to the 2008 model ensured that the non-minimal LERF cutset no longer appears in the results.

No Impact LE-C9a Justify any credit taken for equipment survivability or human action that could be impacted by containment failure.

Addressed as part of the 2008 update. A finding identified that the treatment of vapor suppression failure cases may need to be re-evaluated. These cases (i.e.

accident class 3D) are now assumed to lead directly to a LERF endstate.

No Impact

Limerick RHRSW/SPC AOT Extension 53 P467090055-3424 4.7 GENERAL CONCLUSION REGARDING PRA CAPABILITY The LGS PRA maintenance and update processes and technical capability evaluations provide a robust basis for concluding that the PRA is suitable for use in risk-informed licensing actions, specifically in support of the requested extended AOT for the RHRSW/SPC system.

Previously identified gaps to specific requirements in the ASME PRA Standard have been reviewed to determine which gaps might merit application-specific sensitivity studies in the presentation of the application results. No gaps were identified as needing specific sensitivity studies for this RHRSW/SPC AOT extension request.

Limerick RHRSW/SPC AOT Extension 54 P467090055-3424 5.0

SUMMARY

AND CONCLUSIONS 5.1 SCOPE INVESTIGATED This analysis evaluates the acceptability, from a risk perspective, of a change to the LGS TS for the RHRSW/SPC system to increase the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days when one RHRSW loop is inoperable.

The analysis examines a range of risk contributors as shown in Table 5-1.

TABLE 5-1

SUMMARY

OF RISK INSIGHTS FOR RHRSW/SPC AOT EXTENSION RISK CONTRIBUTOR APPROACH INSIGHTS Internal Events Quantify ICCDP & ICLERP for planned configuration ICCDP < 1E-6 ICLERP < 1E-7 Evaluate CDF and LERF assuming one entry per year into extended AOT CDF < 1E-6/yr LERF < 1E-6/yr Base risk within acceptance guidelines Compensatory measures keep risk well within the acceptance guidelines The FPIE assessment is judged to adequately capture risk contributors associated with low power plant operation.

Internal Fire Qualitatively and quantitatively evaluated:

Identify fire scenarios impacted by configuration Estimate fire risk impacts due to configuration and quantify delta-CDF Identify compensatory measures Internal events compensatory measures apply to fire scenarios New fire-related compensatory measures identified Quantitative guidelines for normal work controls challenged, but acceptable with risk management actions implemented.

Seismic Perform a bounding assessment factoring in insights from the LGS FPIE PRA model and site specific seismic hazard curves.

Seismic risk impacts negligible Other External Hazards Qualitatively evaluate each hazard based on the LGS IPEEE and a re-examination for the specific configuration with one RHRSW loop inoperable.

Other External Event risks were found to be negligible contributors

Limerick RHRSW/SPC AOT Extension 55 P467090055-3424 TABLE 5-1

SUMMARY

OF RISK INSIGHTS FOR RHRSW/SPC AOT EXTENSION RISK CONTRIBUTOR APPROACH INSIGHTS Overall At-Power Risks Quantify ICCDP & ICLERP for planned configuration with normal work controls ICCDP < 1E-6 ICLERP < 1E-7 If exceeded compare to acceptance guidelines with risk management actions implemented to reduce sources of risk ICCDP < 1E-5 ICLERP < 1E-6 Evaluate CDF and LERF assuming one entry per year into extended AOT CDF < 1E-6/yr LERF < 1E-6/yr Quantitative guidelines for normal work controls challenged, but acceptable with risk management actions implemented.

5.2 PRA QUALITY The PRA quality has been assessed and determined to be adequate for this risk application, as follows:

Scope - The LGS PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA has the necessary scope to appropriately assess the pertinent risk contributors.

Fidelity - The LGS PRA model (LG108A and LG208A) is the most recent evaluation of the risk profile at LGS for FPIE challenges. The PRA reflects the as-built, as-operated plant.

Standards - The PRA has been reviewed against the ASME PRA Standard and the PRA elements are shown to have the necessary attributes to assess risk for this application.

Peer Review - The PRA has received a peer review. Based on addressing the peer review results and subsequent gap analyses to the current standards, the PRA is found to have the necessary attributes to assess risk for this application.

Appropriate Quality - The PRA quality is found to be commensurate with that needed to assess risk for this application.

Limerick RHRSW/SPC AOT Extension 56 P467090055-3424 5.3 QUANTITATIVE RESULTS VS. ACCEPTANCE GUIDELINES As shown in Tables 3.4-1 for Unit 1 and 3.4-2 for Unit 2, this analysis demonstrates with reasonable assurance that the proposed TS change is within the current risk acceptance guidelines (i.e. in Region III or barely in Region II) in RG 1.174 and not substantially above the acceptance guidelines in RG 1.177 for permanent changes.

This combined with effective compensatory measures to maintain lower risk ensures that the TS change meets the intent of the ICCDP and ICLERP acceptance guidelines of 1.0E-05 and 1.0E-06 established for compatibility with the ICDP and ILERP limits of Section 11 in NUMARC 93-01, which is applicable for voluntary maintenance activities requiring risk management actions.

5.4 CONCLUSION

S This analysis demonstrates the acceptability, from a risk perspective, of a change to the LGS TS for the RHRSW/SPC system to increase the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 7 days when one RHRSW loop is inoperable.

A PRA technical adequacy evaluation was also performed consistent with the requirements of ASME PRA Standard, Addendum B and RG 1.200, Revision 1. This included a process to identify potential key sources of model uncertainty and related assumptions associated with this application. This resulted in the identification of issues that could both decrease and increase the calculated risk metrics. None of these identified sources of uncertainty were significant enough to change the conclusions from the risk assessment results presented here.

However, the assessment of risk from internal events and internal fires did help to identify the following actions as important compensatory measures that will help to reduce the overall risk during the performance of the extended AOT:

Shift briefs will be performed to reinforce other potentially important operator actions associated with the performance of the extended AOT (i.e., operator actions to refill the condensate storage tank (CST), operator actions to vent containment, operator actions to maximize control rod drive (CRD) injection to the vessel, and operator actions to support continued use of feedwater and condensate post-trip as necessary and if available). Additionally, during the A RHRSW subsystem outage, a shift brief on alternate remote shutdown operations will be performed since some of the normally operated equipment from the remote shutdown panel will not be available.

Proper standby alignment of the opposite RHRSW subsystem should be ensured prior to entry into the AOT as this would reduce the contribution from potential pre-initiator errors.

Limerick RHRSW/SPC AOT Extension 57 P467090055-3424

Besides the protected opposite RHRSW subsystems and ESW loop, elective maintenance should be avoided and other protective measures should be maintained on all RHR subsystems and EDGs that provide partial support to the protected RHRSW subsystem.

Activities that adversely affect risk exposure will be prohibited in the LGS 500kV and 220kV electrical switchyards to minimize the possibility of an induced LOOP and loss of power to protected equipment during the period of reliance on the extended AOTs. Operational Risk Activities will be restricted during the extended AOTs. Station Vice-President approval will be required to perform emergent operational risk activities during the period of reliance on the extended AOTs.

The extended weather forecast will be examined to ensure severe weather conditions are not predicted prior to entry into the AOT. In the event of an unforeseen severe weather condition due to rapidly changing conditions, such as severe high winds, a briefing with crew operators will be performed to reinforce operator actions and responses in the event of a loss of offsite power (E-10/20).

Shift briefs and pre-job walkdowns to reduce and manage transient combustibles prior to entrance into the extended AOT will be used to alert the staff about the increased sensitivity to fires in the following areas during the extended RHRSW outage windows. Additionally, any hot work activities in the following areas will be prohibited during the time within the extended RHRSW AOT.

For the A RHRSW subsystem outage window:

Unit 1

Fire Area 15, Unit 1 Division 2 (D12) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room Unit 2

Fire Area 17, Unit 2 Division 2 (D22) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room For the B RHRSW subsystem outage window:

Unit 1

Fire Area 13, Unit 1 Division 1 (D11) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room

Fire Area 26, Remote Shutdown Panel

Limerick RHRSW/SPC AOT Extension 58 P467090055-3424 Unit 2

Fire Area 19, Unit 2 Division 1 (D21) safeguard 4kV switchgear room

Fire Area 24, Main Control Room

Fire Area 25, Auxiliary Equipment Room

Fire Area 26, Remote Shutdown Panel

Limerick RHRSW/SPC AOT Extension 59 P467090055-3424

6.0 REFERENCES

[1]

Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 1, January 2007.

[2]

Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis,"

Revision 1, November 2002.

[3]

Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," Revision 0, August 1998.

[4]

Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, Addenda RA-Sa-2003, and Addenda RA-Sb-2005, December 2005.

[5]

Addenda to RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, February 2009.

[6]

RG 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk Informed Activities, Revision 2, March 2009.

[7]

Draft Regulatory Guide DG-1227 (Proposed Revision 1 of Regulatory Guide 1.177, dated August 1998), "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," August 2009.

[8]

Industry Guidelines for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants, NUMARC 93-01, Revision 3, July 2000.

[9]

Regulatory Guide 1.182, Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants, May 2000.

[10]

Exelon Risk Management Team, Limerick Generating Station Probabilistic Risk Assessment Fire PRA Results Notebook, LGS104C and LGS204C Models, Revision 0, LG-PRA-021.06, March 2008.

[11]

PECO Energy, Limerick Generating Station Individual Plant Examination for External Events, June 1995.

[12]

Exelon Risk Management Team, Limerick Generating Station Probabilistic Risk Assessment Summary Notebook, LG108A and LG208A Models, LG-PRA-013, Revision 2, September 2009.

Limerick RHRSW/SPC AOT Extension 60 P467090055-3424

[13]

Exelon, ER-AA-600-1046, Risk Metrics - NOED and LAR, Revision 4.

[14]

Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

[15]

Limerick Generating Station PRA Peer Review Using ASME PRA Standard Requirements, November 2005.

[16]

Letter from U.S. NRC to Exelon Nuclear, Limerick Generating Station, Units 1 and 2 - Issuance of Amendment Re: Relocate Surveillance Test Intervals to Licensee-Controlled Program (TAC NOS. MC3567 and MC3568), September 28, 2006.

[17]

Limerick Generating Station Internal Flood PRA Peer Review Using ASME PRA Standard Requirements, August 2008.

Limerick RHRSW/SPC AOT Extension 61 P467090055-3424 Appendix A External Events Assessment A.1 RISK CHARACTERIZATION OF RHRSW SYSTEM FUNCTIONS The determination of the scope of external events to consider has been made starting from an understanding of the role that the affected equipment, e.g., RHRSW Loops, have in the plant risk profile. This understanding was gleaned from a review of the internal events and internal floods PRA results involving the RHRSW Loops and allows a risk characterization of each of RHRSW Loop.

The RHRSW system at Limerick performs a few functions including containment heat removal (via suppression pool cooling, drywell/wetwell spray, or shutdown cooling) and also provides a means to provide ultimate cooling in the form of alternate injection to the RPV in the extremely unlikely situation where all normal ECCS injection capabilities are lost. Unit 1 ultimate cooling is provided through RHR Loop B whereas Unit 2 ultimate cooling is provided through RHR Loop A. A review of the internal events and internal floods PRA results indicates that the most important PRA function is containment heat removal with alternate RPV makeup also contributing to a lesser degree.

As shown in Table A-1, for Unit 1 Loop A out of service loss of containment heat removal contributes approximately 72% to the increase in core damage. Sequences with loss of injection (mostly due to the indirect effects of loss of SPC and other failures) contribute approximately 27% to the increase in core damage. For Loop B out of service, these functions contribute approximately 67% and 32% of the increase in core damage, respectively. The reason that the B Loop has a slightly higher contribution from RPV makeup is that the RHRSW makeup line connects on the B Loop. Thus, the removal of the B Loop from service also prevents RHRSW from being used as an alternate RPV makeup source.

The Unit 2 results shown in Table A-2 show a similar trend but with the A Loop out of service resulting in slightly more of a contribution from loss of inventory sequences since the removal of the A Loop from service also prevents RHRSW from being used as an alternate RPV makeup source in Unit 2. For Loop A out of service, loss of containment heat removal contributes 69% and loss of inventory contributes 30%. For Loop B out of service, these functions contribute approximately 71% and 29% of the increase in core damage, respectively.

Limerick RHRSW/SPC AOT Extension 62 P467090055-3424 Table A-1 Unit 1 Risk Contribution by Functional Sequence A Loop OOS B Loop OOS Functional Sequence Contributor CDF Frac.

CDF Frac.

Sequences Involving Containment Heat Removal 2.96E-06 72.2%

2.88E-06 67.1%

Transient-initiated Sequences Involving Inadequate RPV Makeup 1.11E-06 27.1%

1.35E-06 31.5%

LOCA-initiated Sequences Involving Inadequate RPV Makeup 5.53E-09 0.1%

4.58E-09 0.1%

ATWS Sequences 2.19E-08 0.5%

2.23E-08 0.5%

Containment Bypass Sequences n/a n/a 3.02E-08 0.7%

Total CDF 4.10E-06 4.29E-06 Table A-2 Unit 2 Risk Contribution by Functional Sequence A Loop OOS B Loop OOS Functional Sequence Contributor CDF Frac.

CDF Frac.

Sequences Involving Containment Heat Removal 2.85E-06 68.7%

3.03E-06 70.7%

Transient-initiated Sequences Involving Inadequate RPV Makeup 1.24E-06 30.0%

1.22E-06 28.6%

LOCA-initiated Sequences Involving Inadequate RPV Makeup 4.62E-09 0.1%

5.48E-09 0.1%

ATWS Sequences 2.19E-08 0.5%

2.23E-08 0.5%

Containment Bypass Sequences 3.02E-08 0.7%

n/a n/a Total CDF 4.15E-06 4.28E-06 The second aspect of the RHRSW loop risk characterization that can be taken from the internal events model is the type of initiating event(s) that contribute to the CDF increase associated with each RHRSW loop being out of service. As shown in Table A-3 for Unit 1, the largest contribution comes from loss of offsite power events, followed by transient events. The Unit 2 results are similar as shown in Table A-4.

Limerick RHRSW/SPC AOT Extension 63 P467090055-3424 Table A-3 Unit 1 Risk Contribution by Initiator Type A Loop OOS B Loop OOS Initiator Type CDF Frac.

CDF Frac.

Loss of Offsite Power 2.12E-06 52%

2.08E-06 49%

Transients 9.51E-07 23%

9.92E-07 23%

Internal Flood 6.07E-07 15%

4.25E-07 10%

Loss of Support System 3.13E-07 8%

6.52E-07 15%

LOCA 1.06E-07 2%

1.36E-07 3%

Total CDF 4.10E-06 4.29E-06 Table A-4 Unit 2 Risk Contribution by Initiator Type A Loop OOS B Loop OOS Initiator Type CDF Frac.

CDF Frac.

Loss of Offsite Power 2.04E-06 49%

2.19E-06 51%

Transients 9.66E-07 23%

9.79E-07 23%

Internal Flood 6.61E-07 16%

4.12E-07 10%

Loss of Support System 3.39E-07 8%

5.97E-07 14%

LOCA 1.37E-07 3%

1.01E-07 2%

Total CDF 4.15E-06 4.28E-06 These insights indicate the following when considering the scope of the PRA required to assess the risk significance of the RHRSW Loop AOT:

Both the functions of Containment Heat Removal and RPV Makeup are relevant to the risk significance of the RHRSW Loops.

LOOP, Transient, and other initiators all have the potential to create a demand for the RHRSW Loops

Limerick RHRSW/SPC AOT Extension 64 P467090055-3424 A.2 ASSESSMENT OF RELEVANT HAZARD GROUPS The purpose of this portion of the assessment is to screen the spectrum of external event challenges to determine which external event hazards should be explicitly addressed as part of the LGS RHRSW/SPC System AOT extension risk assessment.

In addition to internal fires and seismic events, the Limerick IPEEE [Ref. A-1] evaluated high winds and tornadoes, external floods, and transportation and nearby facility accidents. The design of the LGS plant facilities meets the NRCs 1975 Standard Review Plan criteria for each of the other external events evaluated. No significant quantitative contribution from these external events was identified by the IPEEE evaluations. As such, the compensatory actions and risk insights in this LAR are also judged applicable to qualitatively reduce the risk associated with these events.

Additionally, with an understanding of the role that the RHRSW system plays in mitigating risk a confirmatory assessment of the relevant hazard groups can be completed. Section 6.3.3 of NUREG-1855 [Ref. A-2] provides a list of hazard groups that should be considered in a risk assessment. Table A-5 summarizes how those hazard groups were dispositioned for Limerick. The majority of the hazard groups were screened from consideration based on a review of the information provided in the Limerick IPEEE, using the screening approaches discussed in Section 6 of NUREG-1855.

Table A-5 HAZARD GROUPS CONSIDERED IN THE RISK ASSESSMENT Approach Hazard Group Basis Addressed quantitatively Internal Events Internal Floods Plant-specific PRA reflecting the as-built, as-operated plant is used to quantitatively estimate the risk impacts.

Addressed quantitatively and qualitatively Internal Fires Plant-specific PRA utilized to quantitatively estimate the risk impacts. However, the use of this model is subject to limitations and precautions as described below. More importantly then, it was utilized to identify important fire areas for consideration of potential compensatory measures.

Addressed using a conservative approach Seismic Events Using a simplified conservative analysis, the contribution of seismic risk to total risk can be shown to be minimal.

Screened from consideration based on likelihood of threat-induced challenge Accidental Aircraft Impacts Removal of an RHRSW Loop may decrease reliability of heat removal function, but per the IPEEE, the frequency of damage from accidental aircraft impacts is very small compared to other events already considered (e.g., non-recoverable LOOP)

Limerick RHRSW/SPC AOT Extension 65 P467090055-3424 Table A-5 HAZARD GROUPS CONSIDERED IN THE RISK ASSESSMENT Approach Hazard Group Basis External Floods From the Limerick IPEEE, external floods were screened as a significant contributor per NUREG-1407. Additionally, external floods would be a slow developing event which would allow restoration of out of service RHRSW Loops prior to presenting a significant challenge.

Extreme Winds and Tornados (including generated missiles)

From the Limerick IPEEE, high winds and tornadoes (including generated missiles) were screened as a significant contributor per NUREG-1407. The plant is designed for extreme winds and tornadoes. Removal of an RHRSW Loop may decrease reliability of heat removal function, but the frequency of wind/tornado-induced damage is very small compared to other events with similar consequences already considered (e.g., non-recoverable LOOP)

Turbine-Generated Missiles Removal of an RHRSW Loop may decrease reliability of heat removal function, but the frequency of turbine-generated missile-induced damage is very small compared to other events already considered with a similar consequence (e.g., Loss of Condenser)

External Fires External fires were screened for consideration in the IPEEE since the site is cleared of forestry and external fires are unlikely to spread onsite. Additionally, the plant structures are designed for the effects of external fires (i.e., safety related structures are reinforced concrete). Removal of an RHRSW Loop may decrease reliability of heat removal function, but the frequency of an external fire-induced challenge is very small compared to other events already considered (e.g., non-recoverable LOOP)

Screened from consideration based on limited role of RHRSW in mitigating hazards.

Accidents From Nearby Facilities RHRSW is not a significant system in mitigating accidents from nearby facilities. The potential increase in risk impact is dominated by potential effects of toxic gases on operators.

Operators are trained and periodically tested on their ability to put on a breathing apparatus after initiation of a toxic chemical alarm. If they succeed, there is no impact on the plant, and no need to employ RHRSW.

Limerick RHRSW/SPC AOT Extension 66 P467090055-3424 Table A-5 HAZARD GROUPS CONSIDERED IN THE RISK ASSESSMENT Approach Hazard Group Basis Release of Chemicals Stored at the Site RHRSW is not a significant system in mitigating chemical releases. The potential increase in risk impact is dominated by potential effects of toxic gases on operators.

Operators are trained and periodically tested on their ability to put on a breathing apparatus after initiation of a toxic chemical alarm. If they succeed, there is no impact on the plant, and no need to employ RHRSW.

Transportation Accidents RHRSW is not a significant system in mitigating transportation accidents that lead to chemical releases. The potential increase in risk impact is dominated by potential effects of toxic gases on operators. Operators are trained and periodically tested on their ability to put on a breathing apparatus after initiation of a toxic chemical alarm. If they succeed, there is no impact on the plant, and no need to employ RHRSW.

Explosive hazards screened on the basis of limited impact on the plant.

Transportation Accidents Pipeline Accidents (e.g.,

natural gas)

RHRSW is not a significant system in mitigating explosive hazards from transportation accidents or pipeline accidents.

Per the IPEEE, a gas-air mixture 4 times the requirements of Reg. Guide 1.91 (Rev. 1) is conservatively used to develop the explosive pressure for structural assessment.

The at-power PRA models used for this analysis therefore include:

internal events,

internal floods, and

internal fires.

In addition, the seismic hazard group will be addressed quantitatively with a conservative analysis as discussed in Section A.4. The other hazard groups were demonstrated not to be relevant based on a screening analysis as shown above. The at-power CDF and LERF for this application are such that the results lie in Region III of the RG 1.174 acceptance guidelines (or just barely into Region II - see section 3.4),

and therefore, it is unnecessary to evaluate the low-power and shutdown contribution to the base CDF and LERF (i.e. since there is sufficient margin within Region II, a LPSD base CDF of more than 8E-5/yr would need to be obtained to move into Region I and this magnitude of annualized LPSD risk is unreasonable for BWRs with a history of very

Limerick RHRSW/SPC AOT Extension 67 P467090055-3424 short duration outages). Furthermore, the change being proposed involves moving unavailability of the RHRSW loops from shutdown to power conditions. Because a detailed low power and shutdown PRA model has not been developed for this plant, the analysis will conservatively omit this risk reduction, which could be used under RG 1.174 to offset the increase in at power risk in the CDF and LERF calculations.

Conclusions of Screening Assessment Given the foregoing discussions, most of the external hazards are assessed to be negligible contributors to plant risk. Explicit treatment of these other external hazards is not necessary for most PRA applications (including the RHRSW/SPC System AOT extension risk assessment) and would not provide additional risk-informed insights for decision making.

Further information is presented in this appendix, however, to assess the risk associated with the internal fires and seismic hazard groups.

Limerick RHRSW/SPC AOT Extension 68 P467090055-3424 A.3 INTERNAL FIRES ASSESSMENT This internal fire assessment is based on the LGS Interim Fire PRA (FPRA) model developed in 2007 and 2008.

A.3.1 LGS Interim Fire PRA An update of the Fire IPEEE for Limerick Generating Station (LGS) was completed in 2002. The primary objective of the update effort was to develop an analysis with supporting documentation and tools that will facilitate maintenance and will provide guidance for future applications of the fire risk analysis, including Significance Determination Process (SDP), and other licensing applications. Early in 2007, explicit analyses of the Main Control Room and Auxiliary Equipment Room were performed, the analyses for Turbine Building compartments were refined and the Fire PRA was re-quantified using the 2004C model. Later in 2007, the plant partitioning and fire ignition frequency development tasks were revisited, and completed in accordance with NUREG/CR 6850. During that effort, cable data was collected for the CRD system, allowing its explicit treatment in the analysis. The revised ignition frequencies and CRD treatment were incorporated into the Fire PRA and the model was re-quantified.

The scope of the analysis includes both units of LGS and involved a general update and upgrading of the analysis to reflect the as-built plant. In 2007, the Main Control Room (Fire Area 24) and Auxiliary Equipment Room (Fire Area 25) analyses were completed and the scenarios for these compartments were integrated into the fire PRA results. The fire PRA methodology and results were reviewed by the Corporate Fire Protection Program Manager. These reviews added valuable site-specific insights which were incorporated into the analysis via a series of comment resolution cycles.

The task of updating the Limerick Fire Risk Assessment had the potential to involve significant effort. To avoid excessive expenditure of resources, a graded approach was applied. This graded approach applied analysis refinements to only those situations that were identified as potentially risk significant. This approach has the benefit of focusing resources on only those elements of the analysis that have a material impact on analysis results and conclusions. However, the consequence of having taken such an approach is the imbedding of conservatism throughout the analysis. The cumulative effect of this is not specifically known, but has resulted in the skewing of the total reported plant CDF towards the upper bound. This is contrasted with the internal events plant PRA which provides a best estimate (mean) CDF.

The specific areas of conservatism include:

1. Automatic Suppression and Detection:

Available automatic fire suppression systems, as well as detection and subsequent fire brigade response is not credited in all instances where available. Credit for

Limerick RHRSW/SPC AOT Extension 69 P467090055-3424 suppression and detection is included only if the area would have otherwise been a dominant risk contributor.

2. Operator Recovery Actions: The operator recovery actions credited in the analysis are based on those included in the plant PRA model. Additional available recovery actions developed as part of the 10CFR50.48 compliance strategy have not been credited in the analysis unless specifically noted.

3. Spurious Actuations: The potential consequences of a postulated fire event include spurious actuation of valves. The conditional probability of such an occurrence given cable damage is not unity. However, credit for this conditional probability is applied only to those compartments that otherwise would have been a dominant risk contributor.

4. PCS: The analysis did not include detailed treatment for PCS (Feedwater and Condenser). Instead, PCS was conservatively disabled for all fire scenarios where qualitative assessments could not develop reasonable confidence that they would remain available. Service Water and Instrument Air are treated as part of PCS.

5. Cable Failure Consequences: Detailed cable functional failure reviews were not performed. Instead, the logical linkage of cables and equipment from the fire protection safe shutdown analysis was taken as input for the fire risk assessment. An exception occurs in those instances where the safe shutdown analysis explicitly addresses the issue.

In summary, the current LGS FPRA [Ref. A-3] is an interim implementation of NUREG/CR-6850; that is, not all tasks identified in NUREG/CR-6850 are yet completely addressed or implemented due to the changing state-of-the-art of industry at the time of the 2007-2008 LGS FPRA development. NUREG/CR-6850 task limitations and other precautions regarding the FPRA upgrade for LGS are as follows:

1. Multiple Spurious Operation (MSO) Review (NUREG/CR-6850 Task 2) -

At the time of the LGS FPRA the BWR Owners Group was developing a generic list of MSOs to be considered. No expert panel was used to identify specific MSO scenarios not already inherently addressed in the PRA. At future updates the BRWOG list should be reviewed, an expert panel should convene, and the results of each incorporated as necessary.

2. Instrumentation Review (NUREG/CR-6850 Task

2)

The new requirements of NUREG/CR-6850 regarding the explicit identification and modeling of instrumentation required to support PRA credited operator actions is not addressed. The industry treatment for this task is still being developed.

Limerick RHRSW/SPC AOT Extension 70 P467090055-3424

3. The Balance of Plant (NUREG/CR-6850 Task 2) - The BOP is not fully treated. BOP support system failure is conservatively assumed in most areas. Additional modeling could be conducted to reduce the fire CDF due to this assumption if time and funding is available in future updates.

4. Large Early Release Frequency (LERF) (NUREG/CR-6850 Task 2) -

LERF is not considered. LERF is expected to be addressed in future updates.

5. Limited Analysis Iterations (NUREG/CR-6850 Task 9-12) - The process of conducting a FPRA is iterative, identifying conservative assumptions and high risk compartments and performing analyses to refine the assumptions and reduce those compartment risks. The ability to conduct iterations is limited based on resources. The scenarios developed for the LGS FPRA may benefit from further refinement as necessary for application or for future updates.

6. Multi-Compartment Review (NUREG/CR-6850 Task 11) - This subtask reviews the fire analysis compartment boundaries to ensure they are sufficiently robust to prevent the spread of fire between FPRA analysis compartments or that such propagations are adequately addressed by the developed scenarios. The design and plant layout of LGS make fire propagation to multiple compartments unlikely compared to the fire risk in individual compartments. Therefore, an explicit multi-compartment review was not performed.

7. Seismic Fire Interactions (NUREG/CR-6850 Task 13) - This task reviews previous assessments to identify any specific interaction between suppression system and credited components or adverse impact of fire protection system interactions that should be accounted for in the FPRA.

This has not been performed to support this FPRA.

8. Uncertainty and Sensitivity Analysis (NUREG/CR-6850 Task 15) - This task explores the impacts of possible variation of input parameters used in the development of the model and the inputs to the analysis on the FPRA results. This task is not currently addressed because the industry is still developing an appropriate methodology.

Some limitations of these items are:

Item 1(MSO), represents a source of additional fire CDF contribution (i.e.,

if the BWROG MSO list includes MSOs not addressed in the current version).

Item 2 (Instrumentation Review) represents a potential additional fire CDF contribution that cannot be estimated at this time since the methodology is not established.

Limerick RHRSW/SPC AOT Extension 71 P467090055-3424

Items 3 (BOP) and 8 (Uncertainty) are potential sources of conservatism in the results.

Item 4 (LERF) is a future scope issue not affecting the fire CDF model.

Items 5 (Iterations) and 6 (Multi-compartment) represent modeling assumptions that should be reviewed with each FPRA application to determine their applicability and/or potential impact on the decision.

Item 7 (Seismic) is a FPRA application completeness issue for which the methodology is not yet established.

Given all of the above, the LGS FPRA model is judged to provide a meaningful representation of fire CDF contributors, and is appropriate for use in risk-informed decision-making, to the extent that these limitations are recognized and addressed in each application, as appropriate. The model is, however, interim due to the stated limitations.

A.3.2 Fire Risk Analysis Results for the RHRSW AOT Extension One change was made to the base Fire PRA model results before running the cases for the RHRSW extended AOT configurations. This was done to address a known shortcoming in the model for those fire scenarios that were assigned to a Large LOCA scenario as a surrogate for spurious ADS scenarios. That is, for the fire PRA model only, the fraction of Large LOCAs below TAF was set to 0.0 since spurious ADS scenarios would be above TAF. With that change made, the following base case results are obtained for each of the unit models. These represent a reduction of only a few percent compared to the documented LGS Fire PRA [Ref. A-3], but represent a change that should be addressed before using the model in applications.

Unit 1 Base Case Fire CDF = 1.30E-5

Unit 2 Base Case Fire CDF = 1.43E-5 The fire risk analysis cases were then run in the same fashion as the internal events analysis cases. That is, the basic event changes for the equipment configuration during the extended AOT are as shown in Table 1-3 for the RHRSW Loop A outage and in Table 1-4 for the RHRSW Loop B outage. A few changes to the quantification results were then applied to account for some of the unique configuration insights associated with some of the unlikely fire scenario cases. These changes are listed below.

The analysis for a severe fire in Area 25 (Auxiliary Equipment Room) assumes that the fire would be such that shutdown would be required with local actions outside of the control room. In the base fire PRA model, a screening CCDP of 0.1 is assigned for these actions. For this assessment, the screening CCDP value (SCREENCCDP) was replaced with CCDP-25A=0.6 for the IEFR-025-A initiator. This was done to account for the possibility that the Auxiliary Equipment Room cable fire included opposite RHRSW train equipment, with a probability of

Limerick RHRSW/SPC AOT Extension 72 P467090055-3424 0.5 for each train, and to account for the original assigned screening CCDP of 0.1 used for the scenarios requiring shutdown with local operator actions outside of the control room.

The analysis for a severe fire in Area 26 (Remote Shutdown Room) assumes that shutdown would be required with local actions outside of the control room with B train equipment (since the A train equipment would be damaged by a severe fire in this area). In the base fire PRA model, a screening CCDP of 0.1 is assigned for these actions. For this assessment, the screening CCDP (SCREENCCDP) was replaced with CCDP-26C-A=0.1 for the IEFR-026-C initiator for the RHRSW loop A case. The same screening CCDP value is utilized since the A loop unavailability would not have an impact on the original screening CCDP of 0.1 used for the severe fire in the remote shutdown room scenario requiring shutdown with local operator actions with B train equipment.

Correspondingly, however, SCREENCCDP was replaced with CCDP-26C-B=1.0 for the IEFR-026-C initiator for the RHRSW Loop B case. This was done to account for the fact that the original screening CCDP of 0.1 used for the severe fire in the remote shutdown room scenario requiring shutdown with local operator actions outside of the control room with B train equipment is likely to not be able to be performed when the RHRSW Loop B equipment is unavailable.

The fire PRA results are presented for the change in fire CDF from the base case in terms of dominant fire scenarios. Table A-6 shows the Unit 1 RHRSW A Loop FCDF case results and Table A-7 shows the Unit 1 RHRSW B Loop FCDF case results.

Results for Unit 2 are presented in Tables A-8 and A-9.

Limerick RHRSW/SPC AOT Extension 73 P467090055-3424 Table A-6 SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 1 INTERNAL FIRE EVALUATIONS (RHRSW A LOOP CASE)

Figure of Merit RHRSW A Loop Case FCDFA 3.99E-05/yr FCDF = FCDFA - FCDFBASE 2.69E-05/yr Percent Contribution to FCDF IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails B Train Equipment) 30.9%

IEFR-094-A (Unit 1 RFP Turbine Fire) 10.5%

IEFR-039-0 (Sump Room and Passageway) 6.4%

IEFR-015-B/C (Unit 1 Division II 4kV Switchgear) 5.5%

IEFR-031-0 (RHR 1B, 1D Compartment) 5.0%

IEFR-123-0 (Spray Pond Pump Structure - B Half) 4.8%

IEFR-024-V012 (Main Control Room - Unit 1 ECCS B Panel) 4.1%

OTHER FIRE SCENARIOS 32.8%

Table A-7 SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 1 INTERNAL FIRE EVALUATIONS (RHRSW B LOOP CASE)

Figure of Merit RHRSW B Loop Case FCDFB 8.11E-05/yr FCDF = FCDFB - FCDFBASE 6.81E-05/yr Percent Contribution to FCDF IEFR-013-B/C (Unit 1 Division I 4kV Switchgear) 27.9%

IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails A Train Equipment) 12.5%

IEFR-024-V011 (Main Control Room - Unit 1 ECCS A Panel) 12.0%

IEFR-094-A (Unit 1 RFP Turbine Fire) 7.5%

IEFR-026-C (Remote Shutdown Room Severe Fire) 6.2%

IEFR-025-T001C (AER Unit 1 Division I Termination Cabinets) 4.4%

IEFR-122-0 (Spray Pond Pump Structure - A Half) 2.1%

OTHER FIRE SCENARIOS 27.4%

Limerick RHRSW/SPC AOT Extension 74 P467090055-3424 Table A-8 SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 2 INTERNAL FIRE EVALUATIONS (RHRSW A LOOP CASE)

Figure of Merit RHRSW A Loop Case FCDFA 4.53E-05/yr FCDF = FCDFA - FCDFBASE 3.10E-05/yr Percent Contribution to FCDF IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails B Train Equipment) 26.6%

IEFR-107-A (Unit 2 RFP Turbine Fire) 15.9%

IEFR-055-0 (RHR 2B, 2D Compartment) 4.7%

IEFR-123-0 (Spray Pond Pump Structure - B Half) 4.2%

IEFR-024-C005 (CRD Console in Main Control Room) 3.9%

IEFR-024-V047 (Main Control Room - Unit 2 ECCS B Panel) 3.6%

IEFR-017-B/C (Unit 2 Division II 4kV Switchgear) 3.3%

OTHER FIRE SCENARIOS 37.8%

Table A-9 SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 2 INTERNAL FIRE EVALUATIONS (RHRSW B LOOP CASE)

Figure of Merit RHRSW B Loop Case FCDFB 7.39E-05/yr FCDF = FCDFB - FCDFBASE 5.96E-05/yr Percent Contribution to FCDF IEFR-019-B/C (Unit 2 Division I 4kV Switchgear) 31.2%

IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails A Train Equipment) 14.3%

IEFR-024-V046 (Main Control Room - Unit 2 ECCS A Panel) 13.7%

IEFR-026-C (Remote Shutdown Room Severe Fire) 7.1%

IEFR-025-T007C (AER Unit 2 Division I Termination Cabinets) 5.0%

IEFR-107-A (Unit 2 RFP Turbine Fire) 4.9%

IEFR-122-0 (Spray Pond Pump Structure - A Half) 2.4%

OTHER FIRE SCENARIOS 21.4%

Limerick RHRSW/SPC AOT Extension 75 P467090055-3424 Based on a review of the results presented in Tables A-6 through A-9, it can be noted that scenario contributors typically involve fires that disable the available RHRSW loop in some manner, e.g., fires that fail the remaining RHR or RHRSW loops directly or that lead to loss of motive power or control power. Dominant scenarios that do not directly fail the opposite train RHRSW loop (e.g. RFP turbine fire scenarios) typically involve relatively higher initiating event frequency events with random failures of the opposite train equipment.

A review of cutsets and importance measures is also performed to help understand the fire PRA results. As with internal events, the fire PRA results indicate that the loss of containment heat removal scenarios are the most important contributor to the delta CDF. The large majority of the top fire cutsets involve loss of decay heat removal scenarios. These scenarios generally involve long time frames, i.e., >20 hours before the containment fails and RPV makeup is potentially lost. In these scenarios, the CRD system becomes very important as it provides a high pressure makeup source that draws from the CST. Thus, most of the top cutsets involve failures of CRD or failure to makeup to the CST. Various operator actions appear among the top cutsets and contributors related to these failures. These results are consistent with the internal events assessment of important operator actions identified in Appendix B.

It was also identified that fire scenarios that do involve credit for the FW/PCS typically include cutsets with operator action failures to bypass containment isolation or utilize instrument air backup to PCIG. However, it should be noted that the importance of these actions are elevated by the assumption that all fire scenarios with credit for FW/PCS always require bypass of the containment isolation signal and cross-tie of instrument air to instrument gas to maintain air supply to inboard MSIVs.

A.3.3 Fire Risk Analysis Insights Based on the preceding evaluations, fire risk can be a significant contributor. However, several insights were obtained based on the review of results for the extended AOT configuration to help identify those operator actions that are of potentially elevated importance, and those equipment configurations that are of elevated importance.

Based on the evaluation of those insights for potential compensatory measures, any remaining fire areas that may not be addressed by those measures are identified as being more susceptible to risk from fire during the extended AOT. These remaining fire areas would then possibly be subject to more specific fire initiator related compensatory measures.

Important Operator Actions During any of the RHRSW Loop outages, the following operator actions were identified as most important to contributing to the risk increase. These results are consistent with the internal events assessment of important operator actions identified in Appendix B.

Limerick RHRSW/SPC AOT Extension 76 P467090055-3424

Operator actions to refill CST (These actions support continued CRD injection or long term condensate injection with CST makeup to the hotwell)

Operator actions to vent containment (Procedural direction to vent containment per T-200 in loss of containment heat removal scenarios would increase the likelihood of continued injection capabilities compared to scenarios that proceed to containment failure)

Operator actions to maximize CRD injection to the vessel (This would ensure sufficient injection capabilities exist from the CRD system once loss of SPC would lead to loss of high pressure injection capabilities from HPCI or RCIC)

Other actions related to maintaining functionality of the MSIVs for scenarios which credited FW/PCS were also identified as important. However, the importance of these actions may be skewed by the conservative assumption in the fire PRA model that all scenarios which credit FW/PCS always require these actions to be successful.

Operator actions to bypass containment isolation (The EOPs direct the operators to bypass the PCIG isolation using GP-8. The PCIG system provides motive air to the inboard MSIVs and the SRVs)

Operator actions to align instrument air to PCIG (Given failure of the Primary Containment Instrument Gas (PCIG) system, the loads can carried by the Instrument Air system if the cross-tie between the systems is opened)

Important Equipment Configurations During any of the RHRSW Loop outages, the following important equipment configurations were identified as most important. These results are consistent with the internal events assessment of important equipment configurations identified in Appendix B.

Ensuring proper standby alignment of the opposite RHRSW train would reduce contribution from pre-initiators (JHUMNA,BDMI assume that the RHRSW supply and return valves are not left in their normally open position following maintenance, go undetected, and render the system failed when the RHRSW pumps are started)

The PRA analysis already includes exclusion of several maintenance combinations that would not be allowed to be performed during the extended AOT (opposite train RHRSW pumps and opposite train ESW loop). It was also noted that avoiding elective maintenance on the RHR trains that support the

Limerick RHRSW/SPC AOT Extension 77 P467090055-3424 protected RHRSW loop would also reduce the CDF contribution from various contributors:

When RHRSW Loop A is unavailable Unit 1 RHR Pump B, DPM02BTM Unit 1 RHR Pump D, DPM02DTM Unit 2 RHR Pump B, DPM02BTM2 Unit 2 RHR Pump D, DPM02DTM2 When RHRSW Loop B is unavailable Unit 1 RHR Pump A, DPM02ATM Unit 1 RHR Pump C DPM02CTM Unit 2 RHR Pump A, DPM02ATM2 Unit 2 RHR Pump C, DPM02ATM2 Review of Compensatory Measure Impacts on Important Fire Areas Based on a review of results from the fire PRA contributors, the following compensatory actions are highlighted as important to reduce the risk from fire events during the performance of the extended AOT.

Heightened awareness should be maintained regarding the important operator actions associated with the performance of the extended AOT (i.e., operator actions to refill the CST, operator actions to vent containment per T-200, operator actions to maximize CRD injection to the vessel per T-240, and operator actions to support continued use of FW/PCS post-trip as necessary if available).

Proper standby alignment of the opposite RHRSW train should be ensured prior to entry into the AOT as this would reduce the contribution from potential pre-initiator errors.

Besides the protected opposite RHRSW trains and ESW loop, elective maintenance should be avoided on all RHR trains that support the protected RHRSW loop.

With these compensatory measures assumed to be in place, each of the dominant contributors to the Fire PRA results is then reviewed to assess if they will help in reducing risk from those fire areas. The results of that assessment are provided in Table A-10 for the Unit 1 RHRSW Loop A case, Table A-11 for the Unit 1 RHRSW Loop B case, Table A-12 for the Unit 2 RHRSW Loop A case, and Table A-13 for the Unit 2 RHRSW Loop B case. Additional compensatory measures are also highlighted based on the results of this initial assessment following the tables.

Limerick RHRSW/SPC AOT Extension 78 P467090055-3424 Table A-10 ASSESMENT OF INITIAL COMPENSATORY MEASURES ON SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 1 RHRSW A LOOP CASE Identified Important Fire Scenario Impact of Initial Compensatory Measures IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails B Train Equipment)

Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-094-A (Unit 1 RFP Turbine Fire)

Fire risk reduced with assurance of opposite train RHRSW loop alignment and protection of equipment in that loop.

IEFR-039-0 (Sump Room and Passageway)

Fire risk reduced with protection of opposite 1B, 1D RHR trains and heightened awareness of potentially important operator actions.

IEFR-015-B/C (Unit 1 Division II 4kV Switchgear)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-031-0 (RHR 1B, 1D Compartment)

Fire risk reduced with protection of opposite 1B, 1D RHR trains and heightened awareness of potentially important operator actions.

IEFR-123-0 (Spray Pond Pump Structure - B Half)

Fire risk reduced with protection of opposite train RHRSW loop and heightened awareness of potentially important operator actions.

IEFR-024-V012 (Main Control Room - Unit 1 ECCS B Panel)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

OTHER FIRE SCENARIOS Fire risk reduced with identification of protected equipment and heightened awareness of potentially important operator actions.

Limerick RHRSW/SPC AOT Extension 79 P467090055-3424 Table A-11 ASSESMENT OF INITIAL COMPENSATORY MEASURES ON SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 1 RHRSW B LOOP CASE Identified Important Fire Scenario Impact of Initial Compensatory Measures IEFR-013-B/C (Unit 1 Division I 4kV Switchgear)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails A Train Equipment)

Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-024-V011 (Main Control Room - Unit 1 ECCS A Panel)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-094-A (Unit 1 RFP Turbine Fire)

Fire risk reduced with assurance of opposite train RHRSW loop alignment and protection of equipment in that loop.

IEFR-026-C (Remote Shutdown Room Severe Fire)

Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-025-T001C (AER Unit 1 Division I Termination Cabinets)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-122-0 (Spray Pond Pump Structure - A Half)

Fire risk reduced with protection of opposite train RHRSW loop and heightened awareness of potentially important operator actions.

OTHER FIRE SCENARIOS Fire risk reduced with identification of protected equipment and heightened awareness of potentially important operator actions.

Limerick RHRSW/SPC AOT Extension 80 P467090055-3424 Table A-12 ASSESMENT OF INITIAL COMPENSATORY MEASURES ON SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 2 RHRSW A LOOP CASE Identified Important Fire Scenario Impact of Initial Compensatory Measures IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails B Train Equipment)

Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-107-A (Unit 2 RFP Turbine Fire)

Fire risk reduced with assurance of opposite train RHRSW loop alignment and protection of equipment in that loop.

IEFR-055-0 (RHR 2B, 2D Compartment)

Fire risk reduced with protection of opposite 2B, 2D RHR trains and heightened awareness of potentially important operator actions.

IEFR-123-0 (Spray Pond Pump Structure - B Half)

Fire risk reduced with protection of opposite train RHRSW loop and heightened awareness of potentially important operator actions.

IEFR-024-C005 (CRD Console in Main Control Room)

Fire risk reduced with assurance of opposite train RHRSW loop alignment and protection of equipment in that loop.

IEFR-024-V047 (Main Control Room - Unit 2 ECCS B Panel)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-017-B/C (Unit 2 Division II 4kV Switchgear)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

OTHER FIRE SCENARIOS Fire risk reduced with protection of opposite train RHRSW loop and heightened awareness of potentially important operator actions.

Limerick RHRSW/SPC AOT Extension 81 P467090055-3424 Table A-13 ASSESMENT OF INITIAL COMPENSATORY MEASURES ON SIGNIFICANT FIRE SCENARIO CONTRIBUTORS FOR THE UNIT 2 RHRSW B LOOP CASE Identified Important Fire Scenario Impact of Initial Compensatory Measures IEFR-019-B/C (Unit 2 Division I 4kV Switchgear)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-025-A (Auxiliary Equipment Room Cable Fire Fails A Train Equipment)

Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-024-V046 (Main Control Room - Unit 2 ECCS A Panel)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-026-C (Remote Shutdown Room Severe Fire)

Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-025-T007C (AER Unit 2 Division I Termination Cabinets)

Fire risk reduced with heightened awareness of potentially important operator actions. Could benefit with further assurance that a fire in this area would be highly unlikely during the extended AOT.

IEFR-107-A (Unit 2 RFP Turbine Fire)

Fire risk reduced with assurance of opposite train RHRSW loop alignment and protection of equipment in that loop.

IEFR-122-0 (Spray Pond Pump Structure - A Half)

Fire risk reduced with protection of opposite train RHRSW loop and heightened awareness of potentially important operator actions.

OTHER FIRE SCENARIOS Fire risk reduced with protection of opposite train RHRSW loop and heightened awareness of potentially important operator actions.

Limerick RHRSW/SPC AOT Extension 82 P467090055-3424 Remaining Fire Areas of Elevated Importance Based on the results presented in Tables A-10 through A-13, the following additional insights were obtained.

For the RHRSW Loop A outage window, the following areas were identified as potentially benefitting from additional compensatory measures that could further reduce the risk of fires from these areas.

Unit 1

Fire Area 15, Unit 1 Division 2 (D12) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS B panel 10-C601 (Bay A, B))

Fire Area 25, Auxiliary Equipment Room (Cable Fires)

Unit 2

Fire Area 17, Unit 2 Division 2 (D22) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS B panel 20-C601 (Bay A, B))

Fire Area 25, Auxiliary Equipment Room (Cable Fires)

For the RHRSW Loop B outage window, the following areas were identified as most important:

Unit 1

Fire Area 13, Unit 1 Division 1 (D11) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS A panel 10-C601 (Bay C, D, E, F))

Fire Area 25, Auxiliary Equipment Room (Cable Fires and Termination Cabinet Fires)

Fire Area 26, Remote Shutdown Panel (Severe Fire)

Unit 2

Fire Area 19, Unit 2 Division 1 (D21) safeguard 4kV switchgear room

Fire Area 24, Main Control Room (ECCS A panel 20-C601 (Bay C, D, E, F))

Fire Area 25, Auxiliary Equipment Room (Cable Fires and Termination Cabinet Fires)

Fire Area 26, Remote Shutdown Panel (Severe Fire)

Pre-job walkdowns to reduce and manage transient combustibles prior to entrance into the extended AOT completion time will be performed to reduce the fire risk from these areas and heightened awareness will be maintained about the increased sensitivity to fires in these areas during the extended RHRSW outage windows. Additionally, hot work will be limited in these areas during the extended RHRSW outage windows. This heightened awareness when combined with the other compensatory actions defined above will reduce the potential for core damage from postulated fire scenarios.

Limerick RHRSW/SPC AOT Extension 83 P467090055-3424 A.4 SEISMIC ASSESSMENT This section provides information regarding a bounding assessment of the seismic risk implications of having an RHRSW Loop out of service. In order to evaluate the potential seismic risk implications, a focused, bounding seismic risk assessment is provided to evaluate the role of the RHRSW loops in mitigating seismic-induced events.

A.4.1 Methodology A simplified seismic initiator event tree is provided to partition the effects of a seismic event into the following initiator categories:

Reactor Vessel Rupture (RVR)

Large LOCA Medium LOCA Small LOCA Loss of Offsite Power (LOOP)

Transients The basic approach and structure for the partitioning of seismically-induced initiating events from the seismic PRA described in NUREG/CR-4550, Volume 4, Part 3 is used

[Ref. A-4]. The event tree structure is shown below in Figure A-1.

Figure A-1 Simplified Seismic Initiator Event Tree Seismic Event No Reactor Vessel Rupture No Large LOCA Occurs No Medium LOCA Occurs No Small LOCA Occurs No LOOP Sequence Number Initiating Event RVR ALOCA MLOCA SLOCA LOOP Seq. 1 Trans Seq. 2 LOOP Seq. 3 SLOCA Seq. 4 MLOCA Seq. 5 LLOCA Seq. 6 RVR Consistent with Ref. A.4, a LOOP condition is assumed to exist for all sequences except Sequence 1. The latest NRC data on seismic hazards, NUREG-1488 [Ref. A.5] is used

Limerick RHRSW/SPC AOT Extension 84 P467090055-3424 to define the seismic hazard for Limerick. Note that Limerick is not one of those impacted by the on-going resolution of revised seismic hazards under GI-199.

For each seismic interval category identified in NUREG-1488, the mean conditional probability of failure given the seismic initiating event is determined as shown in Table A-14.

Table A-14 BASIS FOR CONDITIONAL PROBABILITIES GIVEN SEISMIC INITIATING EVENT Initiating Event Category Basis for Probability of Occurrence Reactor Vessel Rupture (RVR)

Estimated based on NUREG/CR-4550 [Ref. A-4],

Table 4.17 for IE Category 1 (RVR).

Large LOCA Consistent with NUREG/CR-4550 [Ref. A-4], mean probability of failure based on fragility of Recirc Pump supports (m= 1.9, r=0.3 u=0.35 based on NUREG/CR-6544 [Ref. A-6]).

Medium LOCA Derived from NUREG/CR-4550 [Ref. A-4], Figure 4.20 Small LOCA Derived from NUREG/CR-4550 [Ref. A-4], Figure 4.20 Loss of Offsite Power (LOOP)

Computed mean probability of failure based on fragility of ceramic insulators given in NUREG/CR-4550 [Ref. A-4], Table 4.9 Transients All residual seismic events (i.e., those that do not cause one of the above events) are assumed to cause a transient.

Limerick RHRSW/SPC AOT Extension 85 P467090055-3424 Table A-15 provides a summary of the overall results.

Table A-15

SUMMARY

OF SEISMIC-INDUCED INITIATORS Seq.

Initiating Event Frequency

% of Total Seq. 1 Transient Initiator 1.11E-03 90.5%

Seq. 2 LOOP 1.08E-04 8.8%

Seq. 3 Small LOCA 5.84E-06 0.5%

Seq. 4 Medium LOCA 7.73E-07 0.1%

Seq. 5 Large LOCA 3.80E-07 0.0%

Seq. 6 Reactor Vessel Rupture 1.71E-06 0.1%

Total Frequency 1.22E-03 A.4.2 Risk Implications for RHRSW Loops OOS The risk significance of the seismic contribution was assessed based on: a) an understanding of the relative contributions from each of these initiating event groups to the risk from internal events, and b) a conservative assessment of the conditional core damage probability given the initiating event, as described in the following.

Transient Events The primary challenge presented by transients that requires the RHRSW loops to function is containment heat removal. While the RHRSW loops can provide an alternate means of providing RPV makeup, Limerick has many RPV makeup sources and the availability of RHRSW loops is relatively unimportant to the overall risk from loss of RPV makeup scenarios.

In order to bound the risk of seismic-induced transients, a conservative approach is taken by assuming that all seismic transient events lead to loss of condenser. This frequency, 1.11E-3/yr, can then be compared to the frequency of loss of condenser events from the internal events PRA as shown in Table A-16.

Limerick RHRSW/SPC AOT Extension 86 P467090055-3424 Table A-16 FREQUENCY OF LOSS OF CONDENSER INITIATORS Initiator Frequency Loss of Condenser Vacuum 6.2E-02/yr MSIV Closure 2.4E-02/yr Loss of Service Water 6.7E-03/yr Total Internal Events Frequency 9.3E-02/yr Seismic Transient Frequency 1.1E-03/yr Fraction of Internal Events =

1.2%

As shown in Table A-16, the frequency of seismically-induced transients is very small compared to the internal events frequency of loss of condenser events (i.e., roughly 1%). The vast majority of the seismically-induced transient frequency is due to seismic events that are less than the IPEEE review level earthquake of 0.3g. Thus, for these transients, there is high confidence of low probability of seismic failure for at least one success path for the seismic events <0.3g.

In the internal events PRA, the loss of condenser initiators during the removal of the RHRSW loop from service contributed only about 12-13% to the change in risk. 1.2% of 13% would lead to less than a one percent change in the risk metrics. Thus, it is concluded that the risk contribution from seismically-induced transients is negligible.

LOOP Events In the internal events PRA, LOOP events are relatively important contributors to the risk associated with the RHRSW loop out of service condition. This is due to the loss of condenser condition caused by the loss of offsite power. Given a loss of condenser event, the RHRSW system and the containment vent are the only two means of containment heat removal available. For Limerick, the containment vent can occur through multiple paths from the drywell or wetwell and it does not include a preferred hard pipe vent path. This means that some form of a containment vent path would be expected to be available to mitigate the seismic LOOP condition. Therefore, it can be assumed that seismic-induced LOOP events present a challenge similar to a traditional LOOP, except offsite power recovery is assumed to be precluded, i.e., unrecoverable in the timeframe considered by the PRA.

Limerick RHRSW/SPC AOT Extension 87 P467090055-3424 The risk implications of seismically-induced LOOPs is assessed by comparing the frequency of seismic-induced LOOP events to the frequency of unrecovered LOOP events that are due to other causes (i.e., grid, plant centered, and weather), as treated in the internal events PRA.

The internal events PRA utilizes LOOP occurrence and recovery data from NUREG/CR-6890 [Ref. A.7]. Based on this data, the site-specific frequency of long term losses of offsite power (i.e., those >24 hours in duration) is approximately 7E-4/yr (based on composite non-recovery probability at 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of ~2E-2 from NUREG/CR-6890 and a site LOOP initiating event frequency of ~3.5E-2/yr). This compares to the frequency of seismically-induced LOOP events from Table A-9 of 1.08E-4/yr. So, the seismically-induced LOOP events are roughly 15% of the internal events frequency.

Additionally, LOOP events contribute roughly 50% of the total delta risk from internal events (refer to Tables A-3 and A-4). Conservatively assuming that all LOOP contribution to the delta risk comes from long-term losses of offsite power means that the seismically-induced events might increase the delta risk by approximately 7.5%

(15% of 50%).

Based on internal events results in Section 3.2 for CDF, ICCDPA, and ICCDPB, a 7.5%

increase to each of those figures of merit can be approximated as shown below. The Unit 1 results from Table 3.2-2 are used for this representative calculation. These bounding values are all less than within 1% of the acceptance guidelines. Given the bounding nature of this assessment, this is judged to be insignificant.

Output Parameter Internal Events Bounding Seismic LOOP Estimate (7.5%)

CDF 8.13E-08/yr 8.13E-08/yr

0.075 = 6.1E-09/yr ICCDPA 7.61E-08 7.61E-08

0.075 = 5.7E-09 ICCDPB 7.98E-08 7.98E-08

0.075 = 6.0E-09 LOCA Events The risk from seismically-induced LOCAs will be bounded by evaluating the change in overall RHRSW reliability that occurs when one loop is out of service and using that as an indicator of the change in LOCA risk.

Based on the RHRSW model from the PRA, the overall reliability of the containment heat removal function from SPC or SDC with both RHRSW loops available assuming an unrecoverable loss of offsite power scenarios is 1.3E-3 and is 6.8E-3 with one loop out of service. Thus, the overall reliability of RHRSW changes by approximately a factor of only 5 (due to the redundant nature of the design of the system and supporting emergency diesel generators). By assuming that the RHRSW reliability will have a

Limerick RHRSW/SPC AOT Extension 88 P467090055-3424 direct impact on all LOCA risk (i.e. the remaining loop of RHRSW during the AOT would not be impacted by the seismic event and would be required to mitigate all LOCA events), the change in seismic risk can be conservatively approximated. (In a typical PRA, seismic failures of RHRSW would be correlated so that both loops would be failed. Therefore, there would be no impact on the seismic risk of a loop being out of service.)

From Table A-15, it can be seen that the sum of the frequencies of seismically-induced Small, Medium and Large LOCAs is 7.0E-6/yr (i.e., 5.8E-06/yr + 7.7E-07/yr + 3.8E-07/yr). Assuming that the change in risk can be reflected by the remaining RHRSW loop reliability, the risk change is bounded as 7.0E-6/yr

6.8E-03 = 4.8E-8/yr. Over a 7 day AOT, this contributes only approximately 9.2E-10 to the ICCDP (4.8E-8/yr

7 days /

365 days/yr), or less than 0.1% of the acceptance guidelines. Given the bounding nature of this assessment, this is judged to be insignificant.

Reactor Vessel Rupture Reactor vessel rupture (RVR) events cannot be mitigated. Thus, the unavailability of an RHR loop has no impact on the risk associated with seismically-induced RVR events.

A.4.3 Seismic Risk Impact Conclusion Bounding analyses were performed to consider the potential seismic contribution for the RHRSW/SPC loop out of service during the AOT configuration. This included an evaluation of six separate initiating event consequences from the gamut of potential seismic events. One of the categories was determined not to be impacted by the RHRSW/SPC loop out of service configuration (reactor vessel rupture), and the other five initiating event categories were determined to have no more than one percent impact compared to the acceptance guidelines. Given the results of these bounding assessments, they are not carried further in the analysis.

Limerick RHRSW/SPC AOT Extension 89 P467090055-3424 REFERENCES

[A-1] PECO Energy, Limerick Generating Station Individual Plant Examination for External Events, June 1995.

[A-2] USNRC, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, NUREG-1855, March 2009.

[A-3] Exelon Risk Management Team, Limerick Generating Station Probabilistic Risk Assessment Fire PRA Results Notebook, LGS104C and LGS204C Models, Revision 0, LG-PRA-021.06, March 2008.

[A.4] USNRC, Analysis of Core Damage Frequency: Peach Bottom, Unit 2, External Events, NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, December, 1990.

[A.5] USNRC, "Revised Livermore Seismic Hazard Estimates for 69 Sites East of the Rocky Mountains," NUREG-1488, April 1994.

[A.6] USNRC, "Methodology for Analyzing Precursors to Earthquake-Initiated and Fire-Initiated Accident Sequences," NUREG/CR-6544, April 1998.

[A.7] USNRC, Reevaluation of Station Blackout Risk at Nuclear Power Plants, NUREG/CR-6890, December, 2005.

Limerick RHRSW/SPC AOT Extension 90 P467090055-3424 Appendix B Uncertainty Analysis This appendix evaluates epistemic uncertainties that could impact the RHRSW/SPC AOT extension assessment. Section B.1 provides a breakdown of the contributors to the CDF risk increase associated with this LAR to provide a framework for performing the uncertainty analysis. Note that the focus is on CDF since there is substantial margin to the acceptance guidelines for the LERF figure of merit. Section B.2 then elaborates on the three types of epistemic uncertainty: parameter, model, and completeness uncertainties. Section B.3 then summarizes the insights obtained from the assessment.

Note that this effort focuses on the internal events and internal floods results since the internal fire results are subject to current limitations as described in Section A.3.

However, the fire PRA results have been utilized to obtain separate qualitative and quantitative insights as shown in Section A.3.3. The insights from this assessment are assessed for applicability in concert with the fire risk insights.

B.1 DECOMPOSITION OF SIGNIFICANT CONTRIBUTORS To determine the relative importance of the individual contributors for this LAR, the focus needs to be on the results of the CDF assessments for two separate cases: (1) internal events and internal floods model with the A RHRSW Loop out of service, and (2) internal events and internal floods model with the B RHRSW Loop out of service.

To obtain insights regarding the changes to the base case results when an RHRSW Loop is out of service, the first step is to take the out of service case results and remove the base case cutsets (e.g. using the CAFTA delete term process). This leads to a cutset file that can be used to provide information regarding the significant accident sequences or cutsets that are driving the delta-CDF assessment. This was done for both of the Unit 1 case runs and important groupings from the delta-CDF assessments.

The results are summarized in the sections that follow. The Unit 2 results are not presented in detail here, but they provide similar insights.

For the internal events and internal floods assessment, the results are presented for the dominant accident classes in Table B-1 and by initiator in Table B-2. This is done since it was considered to provide the most useful representation of the internal events results, since the events or failures that challenge the RHRSW system, and the mitigation alternatives to deal with the functional failures associated with the RHRSW system that contribute to risk, can be readily identified.

These results indicate that the loss of containment heat removal scenarios are the most important contributor to the delta CDF contributed by internal events. Furthermore, most of the contribution comes from initiating events that result in the loss of normal heat removal, i.e., the main condenser from loss of offsite power, miscellaneous transients, internal floods, or loss of support systems.

Limerick RHRSW/SPC AOT Extension 91 P467090055-3424 Table B-1 SIGNIFICANT ACCIDENT CLASSES FOR INTERNAL EVENTS AND INTERNAL FLOODS EVALUATIONS Figure of Merit RHRSW A Loop Case RHRSW B Loop Case CDFX 7.17E-06/yr 7.36E-06/yr CDF = CDFX - CDFBASE 3.97E-06/yr 4.16E-06/yr Class I (Transient w/ Loss of Injection) from CDF 27.1%

31.5%

Class II (Loss of Containment Heat Removal) from CDF 72.2%

67.1%

Class III (LOCAs w/ Loss of Injection) from CDF 0.1%

0.1%

Class IV (ATWS) from CDF 0.5%

0.5%

Class V (ISLOCA) from CDF 0.0%

0.7%

Table B-2 SIGNIFICANT INITIATOR CONTRIBUTIONS FOR THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATIONS Figure of Merit RHRSW A Loop Case RHRSW B Loop Case CDFX 7.17E-06/yr 7.36E-06/yr CDF = CDFX - CDFBASE 3.97E-06/yr 4.16E-06/yr Percent Contribution to CDF LOSS OF OFFSITE POWER 51.7%

48.6%

TRANSIENTS 23.2%

23.1%

INTERNAL FLOODS 14.8%

9.9%

LOSS OF SUPPORT SYSTEMS 7.6%

15.2%

LOCAs 2.6%

3.2%

In addition, the dominant cutsets for each case were reviewed with the top 10 cutsets for each case in Tables B-3 (for RHRSW Loop A unavailable) and B-4 (for RHRSW Loop B unavailable). These results are useful in understanding the important contributors and identifying potential sources of model uncertainty. Consistent with the contribution identified in Tables B-1 and B-2 by accident class and initiator, all of the top cutsets involve loss of decay heat removal scenarios. These scenarios involve long timeframes, i.e., ~20 hours before containment venting is called for and RPV makeup is

Limerick RHRSW/SPC AOT Extension 92 P467090055-3424 assumed to be required from a source external to containment. This means that systems and functions that enable RPV injection to be maintained in loss of containment heat removal scenarios become significant contributors. From the cutset review, besides random failures that fail the RHRSW B components, the following actions and events were noted as important to the assessment.

Operator actions to refill CST (ZHUCSTDXI, This would support continued CRD injection or long term condensate injection with CST makeup to the hotwell)

Operator actions to vent containment (VHUVTHDXI, Procedural direction to vent containment per T-200 in loss of containment heat removal scenarios would increase the likelihood of continued injection capabilities compared to scenarios that proceed to containment failure)

Operator actions to maximize CRD injection to the vessel (BHUMX1DXI, This would ensure sufficient injection capabilities exist from the CRD system once loss of SPC would lead to loss of high pressure injection capabilities from HPCI or RCIC)

Containment failure leads to loss of all CRD and Condensate injection capabilities (BPHCFXDXI, based on the Limerick containment structural analysis, this is the probability that a large rupture of containment occurs which is assumed to render continued injection as incapable of performing its function)

Table B-3 TOP 10 CUTSETS FOR CDF FOR THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATIONS (RHRSW A LOOP CASE)

Cutset Prob Event Prob Event Description 1

1.87E-07 9.18E-02

%TF FREQUENCY OF LOSS OF FEEDWATER TRANSIENTS 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 2

1.26E-07 6.20E-02

%TCV INITIATING EVENT FOR LOSS OF CONDENSER VACUUM 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 3

5.74E-08 9.70E-01

%SWFACTOR LOSS OF SW INITIATING EVENT (IE FLAG) 2.70E-02 BHUMX1DXI CRD FLOW NOT MAXIMIZED PER T-240 (AFTER DEP AT HCTL) 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

3.65E-03 WPHCTXDXIIEY COOLING TOWER FAILS

Limerick RHRSW/SPC AOT Extension 93 P467090055-3424 Table B-3 TOP 10 CUTSETS FOR CDF FOR THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATIONS (RHRSW A LOOP CASE)

Cutset Prob Event Prob Event Description 4

5.51E-08 9.18E-02

%TF FREQUENCY OF LOSS OF FEEDWATER TRANSIENTS 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

2.00E-02 VHUVTHDXI OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE 5

4.88E-08 2.39E-02

%TMSIV FREQUENCY OF MSIV CLOSURE TRANSIENTS 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 6

3.72E-08 6.20E-02

%TCV INITIATING EVENT FOR LOSS OF CONDENSER VACUUM 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

2.00E-02 VHUVTHDXI OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE 7

3.58E-08 4.21E-04

%FL-RB12A Fire Area 47E&W: React Bldg, Unit 1 Isolation Valve Compartment Area, flood 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 1.70E-03 DHUMANLPD FAILURE TO MANUALLY OPEN U1 RHR-HX VALVES 8

3.58E-08 4.21E-04

%FL-RB12A Fire Area 47E&W: React Bldg, Unit 1 Isolation Valve Compartment Area, flood 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 1.70E-03 DMV68BLPD RHRSW HX OUT VLV NC FAILS IN MAN. MODE AFTER FAIL.

REMOTE.

9 3.54E-08 1.95E-02

%LOOP-GRID GRID CENTERED LOOP INITIATING EVENT 6.00E-04 JHUMNBDMI FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

1.00E+00 LOOP-GRID GRID CENTERED LOOP EVENT IDENTIFIER 8.91E-01 NOTOSP5-GRID SUCCESSFUL RECOVERY OF OSP IN 5 HRS / NORECOVERY IN 2.5 HRS - GRID RELATED 3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 10 3.46E-08 1.95E-02

%LOOP-GRID GRID CENTERED LOOP INITIATING EVENT 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 3.25E-04 ECB605DNI D124 BUS XFRMR BREAKER 152-11605 FAILS TO RE-CLOSE 1.00E+00 LOOP-GRID GRID CENTERED LOOP EVENT IDENTIFIER 3.41E-01 NOOSP2E-GRID FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS -

GRID RELATED 3.88E-01 NOOSP52-GRID FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5HRS -GRID RELATED 8.25E-01 NOOSPE-GRID FAILURE TO RCVR OFFSITE PWR EARLY(30 MIN) -GRID RELATED

Limerick RHRSW/SPC AOT Extension 94 P467090055-3424 Table B-4 TOP 10 CUTSETS FOR CDF FOR THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATIONS (RHRSW B LOOP CASE)

Cutset Prob Event Prob Event Description 1

1.87E-07 9.18E-02

%TF FREQUENCY OF LOSS OF FEEDWATER TRANSIENTS 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 2

1.82E-07 1.70E-03

%SAC1 FREQUENCY OF LOSS OF AC BUS DIV. I 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 2.40E-03 EOSPTRIP0 CONSEQUENTIAL LOSS OF OFFSITE POWER GIVEN PLANT TRIP 1.00E+00 LOOP-GRID GRID CENTERED LOOP EVENT IDENTIFIER 8.91E-01 NOTOSP5-GRID SUCCESSFUL RECOVERY OF OSP IN 5 HRS /

NORECOVERY IN 2.5 HRS - GRID RELATED 3

1.26E-07 6.20E-02

%TCV INITIATING EVENT FOR LOSS OF CONDENSER VACUUM 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 4

5.74E-08 9.70E-01

%SWFACTOR LOSS OF SW INITIATING EVENT (IE FLAG) 2.70E-02 BHUMX1DXI CRD FLOW NOT MAXIMIZED PER T-240 (AFTER DEP AT HCTL) 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

3.65E-03 WPHCTXDXIIEY COOLING TOWER FAILS 5

5.51E-08 9.18E-02

%TF FREQUENCY OF LOSS OF FEEDWATER TRANSIENTS 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

2.00E-02 VHUVTHDXI OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILUR 6

4.88E-08 2.39E-02

%TMSIV FREQUENCY OF MSIV CLOSURE TRANSIENTS 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 7

3.72E-08 6.20E-02

%TCV INITIATING EVENT FOR LOSS OF CONDENSER VACUUM 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

2.00E-02 VHUVTHDXI OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILUR

Limerick RHRSW/SPC AOT Extension 95 P467090055-3424 Table B-4 TOP 10 CUTSETS FOR CDF FOR THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATIONS (RHRSW B LOOP CASE)

Cutset Prob Event Prob Event Description 8

3.54E-08 1.95E-02

%LOOP-GRID GRID CENTERED LOOP INITIATING EVENT 6.00E-04 JHUMNADMI FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

1.00E+00 LOOP-GRID GRID CENTERED LOOP EVENT IDENTIFIER 8.91E-01 NOTOSP5-GRID SUCCESSFUL RECOVERY OF OSP IN 5 HRS /

NORECOVERY IN 2.5 HRS - GRID RELATED 3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI 9

3.46E-08 1.95E-02

%LOOP-GRID GRID CENTERED LOOP INITIATING EVENT 5.00E-02 BPHCFXDXI CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION 3.25E-04 ECB505DNI D114 BUS XFRMR BREAKER 152-11505 FAILS TO RE-CLOSE 1.00E+00 LOOP-GRID GRID CENTERED LOOP EVENT IDENTIFIER 3.41E-01 NOOSP2E-GRID FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS -

GRID RELATED 3.88E-01 NOOSP52-GRID FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5HRS -

GRID RELATED 8.25E-01 NOOSPE-GRID FAILURE TO RCVR OFFSITE PWR EARLY(30 MIN) -GRID RELATED 10 2.88E-08 1.95E-02

%LOOP-GRID GRID CENTERED LOOP INITIATING EVENT 4.87E-04 JPM06ADSI0 RHRSW PUMP 0AP506 FAILS TO START 1.00E+00 LOOP-GRID GRID CENTERED LOOP EVENT IDENTIFIER 8.91E-01 NOTOSP5-GRID SUCCESSFUL RECOVERY OF OSP IN 5 HRS /

NORECOVERY IN 2.5 HRS - GRID RELATED 3.40E-03 ZHUCSTDXI JOINT HEP FOR YHUCSTDXI AND YHUALTDXI The review of top level contributors in Tables B-1 and B-2 provide a general understanding of the nature of the most important CDF contributors associated with the RHRSW Loops. A more detailed and comprehensive view of the contributors is gained through a review of the cutsets and in particular the important individual basic event contributors. Tables B-3 and B-4 present the top 10 cutsets and are included as illustrative examples. To further confirm the insights obtained from the review of information in Tables B-1 through B-4, a review of importance measures for the delta-CDF cutset equations for each of the two case runs can also be performed.

The results of the internal event assessments at the basic event level are provided in Tables B-5 and B-6. For both cases, the top 25 basic events sorted by percent contribution are provided. Note that specific initiating event contributors have been purposely excluded from this list since they have already been assessed in Table B-2.

Limerick RHRSW/SPC AOT Extension 96 P467090055-3424 Table B-5 SIGNFICANT CONTRIBUTORS TO THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATION (RHRSW A LOOP CASE)

Event Name Probability Fussell-Vesely Risk Achievement Worth Description NOOSPE 1.00E+00 3.49E-01 1

FAILURE TO RCVR OFFSITE PWR EARLY (30 MIN)

NOOSP2E 1.00E+00 3.41E-01 1

FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS LOOP-GRID 1.00E+00 2.85E-01 1

GRID CENTERED LOOP EVENT IDENTIFIER JHUMNBDMI 6.00E-04 2.74E-01 457.58 FAILURE TO OPEN MAN VLV 1152B OR 1153B FOLLOWING MAINT.

ZHUCSTDXI 3.40E-03 2.62E-01 77.8 JOINT HEP FOR YHUCSTDXI AND YHUALTDXI BPHCFXDXI 5.00E-02 2.16E-01 5.1 CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION NOOSPE-GRID 8.25E-01 1.91E-01 1.04 FAILURE TO RCVR OFFSITE PWR EARLY(30 MIN) -GRID RELATED NOOSP2E-GRID 3.41E-01 1.84E-01 1.35 FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS -GRID RELATED NOOSP52 1.00E+00 1.33E-01 1

FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5 HRS NOOSPE-WTHR 7.73E-01 1.16E-01 1.03 FAILURE TO RCVR OFFSITE PWR EARLY(30 MIN) -WEATHER RELATED NOOSP2E-WTHR 6.14E-01 1.15E-01 1.07 FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS -WTHR RELATED BHUMX1DXI 2.70E-02 9.98E-02 4.59 CRD FLOW NOT MAXIMIZED PER T-240 (AFTER DEP AT HCTL)

EDGX24TM2 1.15E-02 9.23E-02 8.93 DIESEL GENERATOR 24 IN MAINTENANCE EDGX12TM 1.15E-02 8.96E-02 8.7 DIESEL GENERATOR 12 IN MAINTENANCE VHUVTHDXI 2.00E-02 8.95E-02 5.38 OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILUR NOTOSP5-GRID 8.91E-01 8.92E-02 1.01 SUCCESSFUL RECOVERY OF OSP IN 5 HRS /

NORECOVERY IN 2.5 HRS - GRID RELATED LOOP-RANDOM 1.00E+00 7.10E-02 1

RANDOM FAILURES RESULT IN LOOP NOOSP52-WTHR 7.16E-01 7.07E-02 1.03 FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5HRS -WTHR RELATED KPHTOVER75 2.50E-01 5.63E-02 1.17 PERCENTAGE OF TIME AMBIENT TEMP EXCEEDS 75F NOOSP105 1.00E+00 5.57E-02 1

FAILURE TO RCVR OSP IN 10HRS/NO RCVRY IN 5HRS NOOSP2010 1.00E+00 5.54E-02 1

FAILURE TO RCVR OSP IN 20HRS/NO RCVRY IN 10HRS NOOSP52-GRID 3.88E-01 5.04E-02 1.08 FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5HRS -GRID RELATED EDGD24DSI2 6.42E-03 4.97E-02 8.69 FAILURE OF DIESEL TO START D24

Limerick RHRSW/SPC AOT Extension 97 P467090055-3424 Table B-6 SIGNIFICANT CONTRIBUTORS TO THE INTERNAL EVENTS AND INTERNAL FLOODS EVALUATION (RHRSW B LOOP CASE)

Event Name Probability Fussell-Vesely Risk Achievement Worth Description LOOP-GRID 1.00E+00 3.46E-01 1

GRID CENTERED LOOP EVENT IDENTIFIER NOOSPE 1.00E+00 3.29E-01 1

FAILURE TO RCVR OFFSITE PWR EARLY (30 MIN)

NOOSP2E 1.00E+00 3.23E-01 1

FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS JHUMNADMI 6.00E-04 2.56E-01 427 FAILURE TO OPEN MAN VLV 12-1152A OR 53A FOLLOWING MAINT.

ZHUCSTDXI 3.40E-03 2.52E-01 74.81 JOINT HEP FOR YHUCSTDXI AND YHUALTDXI BPHCFXDXI 5.00E-02 2.13E-01 5.05 CONTAINMENT FAILURE LEADS TO FAILURE OF CRD/COND INJECTION NOOSPE-GRID 8.25E-01 1.91E-01 1.04 FAILURE TO RCVR OFFSITE PWR EARLY(30 MIN) -GRID RELATED NOOSP2E-GRID 3.41E-01 1.87E-01 1.36 FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS -GRID RELATED NOTOSP5-GRID 8.91E-01 1.39E-01 1.02 SUCCESSFUL RECOVERY OF OSP IN 5 HRS /

NORECOVERY IN 2.5 HRS - GRID RELATED NOOSP52 1.00E+00 1.22E-01 1

FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5 HRS NOOSPE-WTHR 7.73E-01 9.63E-02 1.03 FAILURE TO RCVR OFFSITE PWR EARLY(30 MIN) -WEATHER RELATED NOOSP2E-WTHR 6.14E-01 9.60E-02 1.06 FAILURE TO RCVR OSP IN 2.5HRS/NO RCVRY IN 0.5HRS -WTHR RELATED EOSPTRIP0 2.40E-03 9.20E-02 39.22 CONSEQUENTIAL LOSS OF OFFSITE POWER GIVEN PLANT TRIP EDGX11TM 1.15E-02 8.88E-02 8.63 DIESEL GENERATOR 11 IN MAINTENANCE EDGX23TM2 1.15E-02 8.86E-02 8.62 DIESEL GENERATOR 23 IN MAINTENANCE VHUVTHDXI 2.00E-02 8.54E-02 5.18 OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILUR LOOP-RANDOM 1.00E+00 6.75E-02 1

RANDOM FAILURES RESULT IN LOOP BHUMX1DXI 2.70E-02 6.74E-02 3.43 CRD FLOW NOT MAXIMIZED PER T-240 (AFTER DEP AT HCTL)

NOOSP52-GRID 3.88E-01 5.76E-02 1.09 FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5HRS -GRID RELATED KPHTOVER75 2.50E-01 5.61E-02 1.17 PERCENTAGE OF TIME AMBIENT TEMP EXCEEDS 75F NOOSP52-WTHR 7.16E-01 5.31E-02 1.02 FAILURE TO RCVR OSP IN 5HRS/NO RCVRY IN 2.5HRS -WTHR RELATED EDGD11DSI 6.42E-03 4.84E-02 8.49 FAILURE OF DIESEL TO START D11 EDGD23DSI2 6.42E-03 4.77E-02 8.38 FAILURE OF DIESEL TO START D23

Limerick RHRSW/SPC AOT Extension 98 P467090055-3424 A review of the importance measure reports partially presented in Tables B-5 and B-6 confirm the importance of some of the contributors identified previously and provide some additional insights. These additional insights are listed below.

Ensuring proper standby alignment of the opposite RHRSW train would reduce contribution from pre-initiators (JHUMNA,BDMI assume that the RHRSW supply and return valves are not left in their normally open position following maintenance, go undetected, and render the system failed when the RHRSW pumps are started)

The PRA analysis already includes exclusion of several maintenance combinations that would not be allowed to be performed during the extended AOT (opposite train RHRSW pumps and opposite train ESW loop). It was also noted that avoiding elective maintenance on the individual EDGs that support the protected RHRSW pump trains would also reduce the overall CDF contribution from LOOP events:

When RHRSW Loop A is unavailable EDGX12TM, Diesel Generator 12 supports RHRSW Pump B EDGX24TM2, Diesel Generator 24 supports RHRSW Pump D When RHRSW Loop B is unavailable EDGX11TM, Diesel Generator 11 supports RHRSW Pump A EDGX23TM2, Diesel Generator 23 supports RHRSW Pump C

Avoiding elective maintenance on the RHR trains that support the protected RHRSW loop would also reduce the CDF contribution from various contributors:

When RHRSW Loop A is unavailable DPM02BTM, Unit 1 RHR Pump B DPM02DTM, Unit 1 RHR Pump D DPM02BTM2, Unit 2 RHR Pump B DPM02DTM2, Unit 2 RHR Pump D When RHRSW Loop B is unavailable DPM02ATM, Unit 1 RHR Pump A DPM02CTM, Unit 1 RHR Pump C DPM02ATM2, Unit 2 RHR Pump A DPM02CTM2, Unit 2 RHR Pump C

Limerick RHRSW/SPC AOT Extension 99 P467090055-3424 B.2 ASSESSMENT OF UNCERTAINTY As discussed earlier, epistemic uncertainty is generally categorized into three types parameter, model, and completeness uncertainty. These are each discussed in the sections which follow.

B.2.1 Parameter Uncertainty The cutset results for the different delta-CDF assessments were reviewed to determine if the epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributor cutsets do not involve basic events with epistemic correlations (i.e. the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b from EPRI 1016737 [B-1], then it is acceptable to use the point estimate directly in the risk assessment.

To verify that the use of the point estimate is acceptable in these four cases, a detailed Monte Carlo calculation using EPRI R&R workstation UNCERT software was performed to compare the mean value determined from the Monte Carlo simulation as compared to the point estimate. The results of those assessments are provided in Table B-7 below. Figures displaying the probability density function for all of the cases appear after the table. Based on the minimal difference in the comparison of the mean value with the point estimate values provided, the use of the point estimate for this assessment is deemed acceptable.

Note that a similar assessment was performed for the LERF figure of merit and the trend was similar. That is, the parametric mean values were very close to the point estimate mean values. Therefore, and since LERF is not a significant contributor for this assessment, the use of the point estimate is deemed acceptable.

Limerick RHRSW/SPC AOT Extension 100 P467090055-3424 Table B-7 PARAMETRIC UNCERTAINTY EVALUATIONS AND COMPARISON TO POINT ESTIMATE RESULTS Unit 1 Unit 2 Result RHRSW A Case RHRSW B Case RHRSW A Case RHRSW B Case Propagated Mean Values(1)

CDFX (1) 7.26E-06/yr 7.48E-06/yr 7.38E-06/yr 7.44E-06/yr CDFBASE (1) 3.23E-06/yr 3.22E-06/yr CDF(1) = CDFX - CDFBASE 4.03E-06/yr 4.25E-06/yr 4.16E-06/yr 4.22E-06/yr Point Estimate Mean Values(2)

CDFX (2) 7.17E-06/yr 7.36E-06/yr 7.21E-06/yr 7.35E-06/yr CDFBASE (2) 3.20E-06/yr 3.19E-06/yr CDF(2) = CDFX - CDFBASE 3.97E-06/yr 4.16E-06/yr 4.02E-06/yr 4.16E-06/yr (1) Developed based on the parametric mean value for each case from a Monte Carlo simulation with 15,000 samples.

(2) Developed based on the point estimate value for each case.

Figure B-1 Unit 1 RHRSW A and B Cases

Limerick RHRSW/SPC AOT Extension 101 P467090055-3424 Figure B-2 Unit 2 RHRSW A and B Cases B.2.2 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737

[B-1] and in NUREG-1885 [B-2] and considers the following:

1. Characterize the manner in which the PRA model is used in the application

2. Characterize modifications to the PRA model

3. Identify application-specific contributors

4. Assess sources of model uncertainty in the context of important contributors

a. Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty

b. Screen based on relevance to parts of PRA needed or based on relevance to the results

5. Identify sources of model uncertainty and related assumptions relevant to the application

a. This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results B.2.2.1 Characterize the Manner in which the PRA Model is Used in the Application The manner in which the PRA model is used in this application is fully described in Section 3 and will not be reproduced here.

Limerick RHRSW/SPC AOT Extension 102 P467090055-3424 B.2.2.2 Characterize Modifications to the PRA Model There are no specific changes made to the model that introduce any application-specific sources of model uncertainty since the base PRA model is used for the application.

B.2.2.3 Identify Application-Specific Contributors Based on the detailed assessment provide in Section B.1, the following items are the important contributors to the change compared to the base case results:

Operator actions to refill CST

Operator action to vent containment

Operator action to maximize CRD injection to the vessel

Likelihood that containment failure leads to loss of all CRD and Condensate injection capabilities

RHRSW Pre-initiators Post-Maintenance

Specific EDG Maintenance Configurations B.2.2.4 Assess Sources of Model Uncertainty in Context of Important Contributors A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1016737 for Limerick was then performed to determine which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application. Based on this review, some of the items were already identified and many of the items were easily screened, but the following items were added for investigation since they were judged to be potentially applicable for this application.

LOOP frequency and fail to recover probabilities

RHR, RHRSW, ESW pump repair failure probabilities

ISLOCA frequencies

Human Error Probability Values

Dependent Human Error Probability Values

Common Cause Failure Values Based on the identified important contributors as summarized in Section B.2.2.3 and the addition of applicable base PRA model sources of uncertainty identified in Section B.2.2.4, the next step is to perform a qualitative assessment or semi-quantitative

Limerick RHRSW/SPC AOT Extension 103 P467090055-3424 screening assessment to determine if sources of uncertainty have been utilized in the PRA that affect the important contributors for the application.

The semi-quantitative screening assessment is based on exceeding the ICCDP limit of 5.0E-7 currently specified for permanent technical specification changes in RG 1.177.

This is below the proposed ICCDP limit of 1.0E-6 for changes of limited applicability, but is judged to be appropriate since it does not directly account for the impact from external events. Recall that the ICCDP is obtained as indicated below.

ICCDPRHRSW X = (CDFRHRSW X - CDFBASE) x AOTNEW One can substitute in the known values to solve for the maximum CDFRHRSW X that would result in an ICCDP of 5.0E-7.

CDFMAX = ICCDPMAX / AOTNEW + CDFBASE CDFMAX = 5.0E-7 / 1.92E-2 + 3.20E-6 = 2.92E-5 The limiting case for Unit 1 RHRSW B is utilized to determine the minimum Risk Achievement Worth (RAW) value that could lead to exceeding the ICCDP acceptance guideline.

RAWMIN = CDFMAX / CDFRRHSW B RAWMIN = 2.92E-5 / 7.36E-6 = 3.97 A qualitative assessment is then provided for each of the previously identified important contributors or potential sources of uncertainty recognizing that a RAW of ~4.0 from the individual CDFRHRSW B cases would be required to exceed the acceptance guidelines from any single basic event.

The results of this assessment are shown in Table B-8.

Limerick RHRSW/SPC AOT Extension 104 P467090055-3424 Table B-8 Identification of Potential Key Sources Uncertainty Source of Uncertainty Source of Model Uncertainty for Base Model Application Important Contributor Source of Model Uncertainty Assessment Potential Key Source of Uncertainty Operator actions to refill CST Operator action to vent containment Operator action to maximize CRD injection to the vessel Yes Yes The credited actions are procedurally directed with the calculated HEP values derived from an accepted methodology. Although variations to the HEP values may lead to changes in the risk assessment results, only very bounding assumptions regarding the appropriate HEP values for these individual actions would lead to exceeding the risk metric acceptance guidelines for voluntary actions requiring risk management actions.

In any event, the identified HEPs for refilling the CST, venting containment, and maximizing CRD flow are identified as potential key sources of uncertainty for this application as part of the HEP development as a global source of uncertainty.

Yes - include as part of HEP development as a class Likelihood that containment failure leads to loss of all CRD and Condensate injection capabilities Yes Yes The event representing the likelihood of containment failure leading to loss of all external injection sources has a RAW value in the 3.7 - 3.8 range depending on the unit being calculated and what RHRSW loop is out of service. This means that even the very pessimistic assumption of guaranteed failure (i.e. setting BPHCFXDXI = 1.0) would not exceed the acceptance guidelines, and as such this source of model uncertainty is screened as a potential key source of uncertainty.

No

Limerick RHRSW/SPC AOT Extension 105 P467090055-3424 Table B-8 Identification of Potential Key Sources Uncertainty Source of Uncertainty Source of Model Uncertainty for Base Model Application Important Contributor Source of Model Uncertainty Assessment Potential Key Source of Uncertainty RHRSW Pre-initiators Post-Maintenance No Yes The relative importance of the RHRSW pre-initiator events indicates that verifying proper standby alignment of the remaining RHRSW train could be a potentially important action that could be taken to reduce the risk associated with the extended AOT.

Yes - but address with proposed compensatory measure.

Specific EDG Maintenance Configurations No Yes The relative importance of the maintenance terms for the EDGs that directly support the remaining RHRSW train indicates that avoiding maintenance on these EDGs during the extended AOT could be a potentially important action that could be taken to reduce the risk associated with the extended AOT.

Yes - but address with proposed compensatory measure.

LOOP frequency and fail to recover probabilities Yes Yes Uncertainty in the LOOP frequency and recovery probabilities will lead to some change in the calculated deltas since LOOP scenarios comprise approximately 50% of the calculated CDF in all cases, but the overall assessment is not limited to only LOOP events. Additionally, the loop initiating event frequency and fail to recover values are fairly well accepted (being based on NUREG-6890). A bounding assessment with no credit for LOOP recovery did not lead to an increase greater than 4.0 for the individual RHRSW loop cases, and as such the LOOP recovery values are not retained as a potential key source of uncertainty.

No

Limerick RHRSW/SPC AOT Extension 106 P467090055-3424 Table B-8 Identification of Potential Key Sources Uncertainty Source of Uncertainty Source of Model Uncertainty for Base Model Application Important Contributor Source of Model Uncertainty Assessment Potential Key Source of Uncertainty

RHR, RHRSW, ESW pump repair failure probabilities Yes No Currently, no credit is taken for repair of failed RHR, RHRSW, or ESW pumps. Any credit for repair would reduce the calculated risk metrics for this evaluation. Therefore, this is identified as a potential area of conservatism, and any changes would not lead to exceeding the acceptance guidelines. As such, the pump repair probabilities are not identified as a potential key source of uncertainty.

No ISLOCA frequencies Yes No The asymmetry noted in the LERF results reported in Section 3.2 (and in the CDF results for Accident Class V reported in Table B-1) are due to the fact that one of the RHRSW loops in each unit is utilized for enabling RHRSW as an alternate RPV makeup source. Credit for this external injection source is important in ISLOCA scenarios. However, the ISLOCA frequencies for Limerick are derived from a detailed ISLOCA analysis which includes the relevant considerations listed in IE-C12 of the ASME/ANS PRA Standard and accounts for common cause failures and captures likelihood of different piping failure modes. Additionally, the ICLERP risk metrics are about two orders of magnitude away from the acceptance guidelines. Given these two attributes, the ISLOCA frequencies are not identified as a potential key source of uncertainty.

No

Limerick RHRSW/SPC AOT Extension 107 P467090055-3424 Table B-8 Identification of Potential Key Sources Uncertainty Source of Uncertainty Source of Model Uncertainty for Base Model Application Important Contributor Source of Model Uncertainty Assessment Potential Key Source of Uncertainty Human Error Probability Values Dependent Human Error Probability Values Yes Yes The HRA was performed using a systematic approach that is consistent with the ASME PRA standard and has been peer reviewed. One of the requirements of the standard is that the HEPs be compared as a set to ensure that the ranking is appropriate to the context within which HEP is evaluated. The identification of significant contributors discussed in Section B.1 resulted in the identification of the most significant human failure events, and these are the ones identified for potential compensatory measures.

Yes - treat as part of HEP development as a class Common Cause Failure Values Yes No Due to the nature of the RHRSW Loop LAR with the evaluation of one loop of RHR out of service, the change in the risk metrics tended to be dominated by additional single failures and as such CCF values do not play a big role in the risk assessment. Therefore, it is not identified as a potential key source of uncertainty for this application.

No B.2.2.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors shown in Table B-8, one sensitivity case was prepared for further exploration. Other potential key sources of uncertainty were screened or already identified as being addressed with potential compensatory measures. That one sensitivity case involves the Human Error Probability (HEP) development as a class. For this sensitivity study, all HEP events are set to their 95th percentile values. This resulted in HEPs that were multiplied by factors in the range of 2 to 4. While this range is smaller than that which could be obtained by using a totally different HRA approach, it is sufficient, in this case, to demonstrate that the HEP values

Limerick RHRSW/SPC AOT Extension 108 P467090055-3424 are a potential key source of uncertainty. The results of this sensitivity case are presented in Table B-9 with the corresponding output parameters for comparison to the acceptance guidelines shown in Table B-10.

Table B-9 HEP SENSITIVITY CASE RISK ASSESSMENT INPUT PARAMETERS Input Parameter Base Case Value 95th HEP Value CDFBASE 3.20E-06/yr 1.46E-05/yr CDFA 7.17E-06/yr 3.55E-05/yr CDFB 7.36E-06/yr 3.61E-05/yr TA 7 Days 7 Days TB 7 Days 7 Days TCYCLE 700 Days 700 Days AOTNEW 1.92E-02 1.92E-02

(

Table B-10 HEP SENSITIVITY CASE RISK ASSESSMENT OUTPUT RESULTS Risk Metric Base Case Value 95th HEP Value CDFNEW 3.28E-06/yr 1.50E-05/yr CDF 8.13E-08/yr 9.06E-07/yr ICCDPA 7.61E-08 4.01E-07 ICCDPB 7.98E-08 4.12E-07 As expected, the results of the sensitivity case show that significant changes to the HEPs have a profound impact on the calculated risk metrics. The increase in the CDF values when the 95th HEP values are utilized above the changes made to the individual HEPs or dependent HEP events is due to the combination of HEPs that were assessed as independent (e.g. pre-initiators and post-initiators sometimes appear in the same cutset). These results are similar to most BWR PRA uncertainty evaluations when this sensitivity case is performed and is not unexpected. Additionally, a review of importance measures from the delete term cutsets between the RHRSW A or B cases and the revised base case (i.e. with all HEPs set at their 95th percentile value) indicated

Limerick RHRSW/SPC AOT Extension 109 P467090055-3424 that the same set of operator actions would be identified as most important. In this sensitivity case, however, they become even more important from a relative risk perspective. This sensitivity case result reinforces the conclusion that the modeling and quantification of crew response actions under accident conditions is an important uncertainty in the assessment of risk.

B.2.3 Completeness Uncertainty Table A-5 in Appendix A presents a summary of the disposition of those hazard groups not included in the PRA. As discussed there, the majority of those hazard groups were screened based on qualitative or quantitative considerations. The interim Fire PRA model was utilized to obtain quantitative risk metric results, but more importantly it helped to identify those fire areas that were subject to increased risk from fire during the extended RHRSW AOT for consideration of potential compensatory measures. The fire risk assessment is detailed in Section A.3. The seismic hazard group was demonstrated to be an insignificant contributor based on a simple, but conservative model as discussed in Section A.4.

Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment.

B.3 UNCERTAINTY ANALYSIS CONCLUSIONS As previously indicated, the uncertainty analysis addresses the three generally accepted forms of uncertainty - parameter, model, and completeness uncertainty. The conclusions from these assessments are as follows.

Parameter Uncertainty The parameter uncertainty assessment indicated that the use of the point estimate results directly for this assessment is acceptable.

Model Uncertainty The model uncertainty assessment highlighted the following sources of uncertainty as being important to address with potential compensatory measures:

Heightened awareness should be maintained regarding the important operator actions associated with the performance of the extended AOT (i.e., operator actions to refill the CST, operator action to vent containment per T-200, and operator action to maximize CRD injection to the vessel per T-240).

Limerick RHRSW/SPC AOT Extension 110 P467090055-3424

Proper standby alignment of the opposite RHRSW train should be ensured prior to entry into the AOT as this would reduce the contribution from potential pre-initiator errors.

Besides the protected opposite RHRSW trains and ESW loop, elective maintenance should be avoided and other protective measures should be maintained on all RHR trains and EDG trains that provide partial support to the protected RHRSW loop.

Completeness Uncertainty There is no major form of completeness uncertainty that would impact the results of this assessment.

Limerick RHRSW/SPC AOT Extension 111 P467090055-3424 REFERENCES

[B-1] Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

[B-2] USNRC, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decisionmaking, NUREG-1855, March 2009.

ATTACHMENT 4 License Amendment Request Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 Proposed Changes to Technical Specifications Sections 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Summary of Regulatory Commitments

Emergency License Amendment Request Changes to TS LCOs 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Page 1 of 1 Docket Nos. 50-352 and 50-353

SUMMARY

OF REGULATORY COMMITMENTS The following table identifies commitments made in this document. (Any other actions discussed in the submittal represent intended or planned actions. They are described to the NRC for the NRCs information and are not regulatory commitments.)

COMMITMENT TYPE COMMITMENT COMMITTED DATE OR OUTAGE ONE-TIME ACTION (YES/NO)

PROGRAMMATIC (YES/NO)

The compensatory measures identified in Section 4.2 of Attachment 1 will be implemented during the extended allowed outage times associated with the RHRSW subsystem piping repairs.

Prior to commencing the applicable RHRSW subsystem piping repairs.

Yes*

No

This is a one-time change per calendar year during the performance of the RHRSW subsystem piping repairs.

ATTACHMENT 5 License Amendment Request Limerick Generating Station, Units 1 and 2 Docket Nos. 50-352 and 50-353 Proposed Changes to Technical Specifications Sections 3.5.1, 3.6.2.3, 3.7.1.1, 3.7.1.2 and 3.8.1.1 Emergency Service Water/RHR Service Water Overview Drawing

v t e Letter Sequence Request
TAC:ME3551, (Approved, Closed)
Initiation Request, Request Acceptance Administration Questions 4 August 2010 28 September 2010 24 February 2011 21 September 2010 19 August 2010 24 September 2010 30 September 2010 14 December 2010 10 March 2011 Answers 29 October 2010 14 January 2011 23 March 2011 Results Approval Other:
MONTHYEAR2010-09-24 [Table View]

ML100810151

Text

Subject:

References:

Subject:

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

1.0 DESCRIPTION

2.0 PROPOSED CHANGE

3.0 BACKGROUND

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

SUMMARY

1.0 INTRODUCTION

1.2 BACKGROUND

SUMMARY

4.3 FIDELITY

SUMMARY

5.4 CONCLUSION

6.0 REFERENCES

1.0 INTRODUCTION

1.2 BACKGROUND

SUMMARY

4.3 FIDELITY

SUMMARY

SUMMARY

SUMMARY

5.4 CONCLUSION

6.0 REFERENCES

SUMMARY

SUMMARY

Navigation menu

Search