ML101880263
| ML101880263 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 06/24/2010 |
| From: | Hesser J Arizona Public Service Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 102-06209-JHH/CJS, TAC ME2337, TAC ME2338, TAC ME2339 | |
| Download: ML101880263 (54) | |
Text
10 CFR 50.90 LA RS A
subsidiary of Pinnacle West Capital Corporation John H. Hesser Mail Station 7605 Palo Verde Nuclear Vice President Tel: 623-393-5553 PO Box 52034 Generating Station Nuclear Engineering Fax: 623-393-6077 Phoenix, Arizona 85072-2034 102-06209-J HH/CJS June 24, 2010 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
Dear Sirs:
Subject:
Palo Verde Nuclear Generating Station (PVNGS)
Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Request to Amend Technical Specification (TS) 3.8.7, "Inverters -
Operating," to Extend Completion Time for Restoration of an Inoperable Inverter - Request of Additional Information Response (TAC Nos. ME2337, ME2338, and ME2339)
In accordance with 10 CFR 50.90, Arizona Public Service Company (APS) submitted letter No. 102-06069, dated September 28, 2009 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML092810227), requesting an amendment to Operating License Nos. NPF-41, NPF-51, and NPF-74, that revises the Technical Specifications (TS) that are incorporated as Appendix A to the Operating Licenses for PVNGS Units 1, 2, and 3.
Specifically, the proposed license amendment would revise Required Action A.1 of TS 3.8.7, "Inverters - Operating," to extend the Completion Time for restoration of an inoperable vital alternating current (AC) inverter from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days. On April 13, 2010, the Nuclear Regulatory Commission (NRC) Staff provided APS a Request for Additional Information (RAI) to assist its evaluation of the license amendment request. to this letter provides the APS response to the NRC request. The basis for the APS determination that the proposed license amendment does not involve a significant hazards consideration, under the standards set forth in 10 CFR 50.92(c), is unchanged as a result of the additional information provided in this response.
By copy of this letter, this submittal is being forwarded to the Arizona Radiation Regulatory Agency (ARRA) pursuant to 10 CFR 50.91 (b)(1).
No commitments are being made by this letter. Should you need further information regarding this amendment request, please contact Russell A. Stroud, Licensing Section Leader, at (623) 393-5111.
A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway 0 Comanche Peak 0 Diablo Canyon
- Palo Verde
- San Onofre 0 South Texas 0 Wolf Creek
ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Request to Amend Technical Specification 3.8.7 - RAI Response Page 2 I declare under penalty of perjury that the foregoing is true and correct.
Executed on OoJ2-qL-)
(Date)
Sincerely, JHH/RAS/CJS/gat
Enclosure:
APS Response to NRC Request of Additional Information cc:
E. E. Collins Jr.
J. R. Hall L. K. Gibson R. I. Treadway A. V. Godwin T. Morales NRC Region IV Regional Administrator NRC NRR Project Manager NRC NRR Project Manager NRC Senior Resident Inspector for PVNGS Arizona Radiation Regulatory Agency Arizona Radiation Regulatory Agency
ENCLOSURE APS Response to NRC Request of Additional Information
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response DRAFT REQUEST FOR ADDITIONAL INFORMATION ARIZONA PUBLIC SERVICE COMPANY, ET. AL.
PALO VERDE NUCLEAR GENERATING STATION, UNITS 1, 2, AND 3 DOCKET NOS. STN 50-528, 50-529, AND 50-530 LICENSE AMENDMENT REQUEST TO EXTEND THE COMPLETION TIME IN TECHNICAL SPECIFICATION 3.8.7 FOR RESTORATION OF AN INOPERABLE INVERTER TAC NOS. ME2337, ME2338, AND ME2339 By letter dated September 28, 2009, Arizona Public Service Company (APS) submitted a license amendment request for the Palo Verde Nuclear Generating Station (PVNGS),
Units 1, 2, and 3. The proposed amendment would revise Technical Specification (TS) 3.8.7, "Inverters - Operating," to extend the allowable Completion Time for Required Action A.1, applicable when one inverter is inoperable, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days.
APS is providing responses to each of the U.S. Nuclear Regulatory Commission (NRC) staff requests for additional information provided on April 13, 2010.
I. Electrical Review NRC Electrical Review RAI Question 1 Provide current as-built simplified one-line schematics of the Vital Direct Current system and the Vital Alternating Current (AC) Instrumentation and Control power system including the backup regulated power supply.
APS Response Current as-built simplified one-line schematics of the vital direct current (DC) system and the vital alternating current (AC) Instrumentation and control power system including the backup regulated power supply are provided for PVNGS Units 1, 2, and 3 in the Attachment to this Enclosure.
NRC Electrical Review RAI Question 2 Describe in detail the maintenance plan/schedule to conduct online corrective maintenance, which is cited in the LAR as justification for the extension of the completion time from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days. In the response, include a description of all post-maintenance and surveillance testing necessary to return the inverter to operable status.
1
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response APS Response An objective of this LAR is to provide a technical basis for the Technical Specification LCO action completion time, which is risk-informed, rather then qualitative. While the extended completion time proposed by the LAR could permit routine scheduled maintenance at power, that is not the primary objective of the proposed amendment.
Preventive maintenance on the inverters is currently performed during refueling outages. There are no current plans to perform corrective or routine preventive maintenance on a scheduled basis at power. Should the need for such maintenance be identified as a result of component performance, the necessary corrective or preventive maintenance would be planned and scheduled at that time. An effect of the LAR will be to permit more time (7-days vs. 24-hours) for emergent corrective maintenance and post-maintenance testing, should such a need arise during power operations.
As stated in response to Clinton Power Station NRC RAI Question 3, in Enclosure 4, of the original LAR package, corrective maintenance at power is not expected to be routine. Specifically, the response states:
.Major overhauls are not anticipated at Palo Verde; only sufficient repair to restore operability. An estimate of two entries per year on each of the four inverters was used in the calculations, which is believed to be very conservative.
During power operations, operators perform limited non-intrusive verifications from panel meters on the inverter cabinets. These verifications include input and output voltage, input and output current and frequency. Data outside specified parameters are alarmed through the system engineering network for trending and reporting information (SENTRI) tool. Procedure 40ST-9ZZ05, Weekly Electrical Distribution Checks, Appendix D - 120 VAC Class 1E Inverters Checklist, records DC bus supply to inverter, inverter input, inverter output, main breaker position, transfer switch position, and inverter AC output voltage and frequency. These checks involve the use of a Fluke multimeter to take readings from the back of the AC output voltage meter for each inverter and include opening and closing inverter cabinet doors.
In order to establish a consistent approach to online corrective maintenance on the inverters, a comprehensive maintenance plan (i.e., troubleshooting game plan) has been developed. The game plan directs that the current revision of PVNGS procedure 32MT-9ZZ58, Preventive Maintenance of Elgar Inverters, be followed. Second party verification is required for appropriate steps throughout the game plan. A sensitive issues briefing is conducted with the affected organizations. If a failure occurs during normal operation, components or equipment will be quarantined for root cause analysis.
As-found conditions are documented.
A series of non-intrusive checks are performed prior to the inverter being de-energized for troubleshooting, such as a visual inspection for anomalies such as discoloration, expanded/popped capacitors, cracked components, loose Molex connectors, blown 2
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response fuses and recording of various alarm conditions, voltage, current, frequency readings and breaker positions.
Operations personnel are responsible to de-energize the associated distribution panel.
Loads are powered from their associated voltage regulator and the inverter is de-energized. Prior to being de-energized, proper operation of the silicon controlled rectifier (SCR) gating signals is verified. A strip chart recorder or Fluke oscilloscope is connected to record gate drive wave forms and is evaluated for proper signal. DC to DC converter card output voltage readings are also recorded.
Once de-energized, inverter printed circuit boards solder connections are inspected, and deficiencies are recorded and reworked. Various appendices are included in the troubleshooting game plan to provide additional specific instructions for such activities as replacement of: blown fuses, commutating diodes, inverter printed circuit boards, logic control boards, static transfer switch logic boards, and control panel cooling fan and/or air switches. A materials list is also included as an appendix to the troubleshooting game plan.
The retest portion of the troubleshooting game plan includes the following post-maintenance and surveillance testing instructions:
If any static transfer switch components were replaced, test in accordance with procedure 32MT-9ZZ58; section Single Phase Inverter Static Switch Test. Connect a load bank to the bus side of the AC output breaker.
Post-maintenance testing involves having the inverter energized from a load bank and the load bank brought up to 100 percent inverter load. The output voltage and frequency are recorded at the start and end of 15 minutes.
Following this post-maintenance test, the inverter is energized from its normal source and Operations configures the normal lineup. Operations perform procedure 40ST-9ZZ05, Weekly Electrical Distribution Checks, Appendix D - 120 VAC Class 1E Inverters Checklist.
In addition, any affected system or component Technical Specification surveillances are performed [e.g., control element assembly (CEA) position indication resets, essential chilled water and ventilation systems restoration actions, and the inoperable action surveillance for the core operating limit supervisory system (COLSS) out-of-service, as appropriate].
NRC Electrical Review RAI Question 3 Provide a detailed discussion concerning corrective actions and causal analyses which were undertaken for the numerous inverter failures at PVNGS, including the current status and whether inverter reliability issues have been adequately addressed. Also, 3
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response provide a detailed discussion of other options evaluated (such as modifications, procurement of additional spare parts and/or complete inverters, etc.) to allow operation and necessary maintenance within the requirements of the existing Technical Specifications.
APS Response The 120 VAC class 1E instrument system (PN system) experienced four Elgar inverter events within a five month period, from April 24, 2008, through September 18, 2008.
The first event was due to a failed DC/DC converter card at Unit 1 [April 24, 2008, equipment identification (EQID) number-1EPNCN13]. The second event occurred at Unit 2 on July 23, 2008, (EQID - 2EPNBN12) and was associated with four degraded SCRs (one failed / three leaking) plus one blown fuse [reference root cause evaluation under Condition Report / Disposition Request (CRDR) 3202468]. The third and fourth events, two static transfers, occurred at Unit 2 on September 15, 2008, (EQID -
2EPNCN13) and September 18, 2008, (EQID - 2EPNAN11). The investigations for the DC to DC card failure on April 24, 2008, as well as the two transfers in September 2008 are addressed in CRDR 3165478.
The probable cause of the inverter failure on April 24, 2008, was determined to be the failure of a voltage regulator on the DC-DC converter board due to random electronic failure. The converter board did not have a -15 VDC output. This was verified by the on-site electronic rework facility. it was determined that the board was approximately 29 years old at the time of failure. As a result of this failure, each of the DC to DC converter boards were replaced in each inverter. Also, as a result of this failure, DC to DC converter output voltage readings are recorded as part of routine observations.
The root cause of the two static transfer events which occurred in September 2008 has not been determined.
Elgar service personnel were consulted in the efforts to identify the causes of the inverter failures and to improve performance. It is probable that the activation of the instantaneous over-current (zip) circuit was the cause of the spurious transfers. Upon activation of the zip circuit, the inverter shuts down, searches for the initiating fault condition and will start up if the fault condition has cleared. This fits the scenario in which the inverter was found immediately after the transfer events. There were no alarms recorded, no failed components, and the inverter was powered up.
A possible cause of the activation of the zip circuit is radio-frequency interference (RFI).
RFI may have affected the electrical circuit due to electromagnetic conduction emitted from an external source, such as a high powered radio. Another possibility is harmonics from another circuit, or even external noise may have been introduced to the circuit.
The zip circuit set point has been raised from 110 percent to 157 percent of inverter load at the recommendation of the Elgar field representative, which is consistent with industry operating experience.
As described in response to NRC Electrical Review RAI Question 2, above, a troubleshooting game plan has been developed and this game plan was exercised on a 4
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response training inverter to identify specific circuit board monitoring points and to ensure that the desired measurements could be made without any risk to personnel or equipment. As a result of the testing performed on the training inverter, several additional troubleshooting measurements were identified that were incorporated into the game plan. These included additional voltage and current measurements, as well as, a recommended set point adjustment on the analog logic board instantaneous over-current set point.
The direct cause of the July 23, 2008 Unit 2, inverter 2EPNBN12 failure was an SCR which leaked reverse current from the cathode to the gate termination. The apparent cause of the failure was that preventive maintenance was ineffective in identifying the degraded SCR. As a result of the findings, SCR testing voltage was increased from a low of approximately 5.81 volts to 6.31 volts to ensure better identification of 'leaking' SCRs.
The overall system performance since 2008 shows a positive trend as there were no functional failures during 2009 and through April 2010. A failure, however, occurred shortly after returning the Unit 1 PN channel D (1 EPNDN14) inverter to service after maintenance during the recent Unit 1 R15 refueling outage. Troubleshooting identified bad gate signals on SCR driver boards, which was attributed to a failed pulse width modulation (PWM) logic board. The logic board was replaced and the inverter was returned to service with no further problems noted.
As a result of the failures during 2008, a recovery plan was developed for the PN system to re-establish inverter reliability. Under the recovery plan, the system color improved from yellow to white in March 2010. An indication that inverter reliability issues have been adequately addressed is good performance of the inverters throughout 2009 and into 2010.
Other options considered to allow operation and necessary maintenance within the requirements of the existing Technical Specifications include conceptual studies to determine alternatives for possible inverter replacement and installation of swing inverters. An action in the PN recovery plan includes an assessment for installation of static transfer switches in Unit 1.
Replenishment of critical boards has been reviewed and/or established. Purchase orders have been issued to obtain additional parts to meet minimum stocking levels for critical parts. A modification to raise the instantaneous over-current (zip) set point on the analog logic board has been completed in each of the inverters. Full board inspections are completed during the performance of procedure 32MT-9ZZ58, Preventive Maintenance of Elgar Inverters.
5
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC Electrical Review RAI Question 4 Provide a detailed discussion of the loss-of-power effects for each of the Vital AC busses on an operating unit along with abnormal operating procedures (AOPs) developed to respond to such events. In addition, provide more detail as to why the assumption is made that a loss of offsite power (and resulting unit trip) was the only reason for the de-energization of a vital bus while powered from the backup supply (loss of a vital bus could occur while the unit is operating due to other failures in the backup supply path), for the purpose of evaluating effects on the plant.
APS Response The effects of a loss of each vital 120 VAC class instrumentation panel (PNA-D25, PNB-D26, PNC-D27 or PND-D28) is provided, followed by a discussion of the PRA assumptions. The level of detail provided, while extensive, establishes the operator actions context for a loss of vital AC instrumentation. The increased time for completion of the LCO action, proposed by this LAR, does not increase the potential for a loss of vital instruments. It simply provides a risk-informed basis for the completion time.
As described in the following sections, there are a number of time sensitive actions that are competed by the operations staff when there is a loss of vital instrumentation. This LAR has the effect of balancing some of the demands on the operations staff. Once approved, the LAR will permit more focused operator attention upon risk significant actions, as compared to actions that are based upon qualitative completion times.
General Design Description - The vital PN 120 VAC class busses provide power to the class 1E equipment. The 120 VAC vital instrument busses are arranged in two channels per train and are normally powered from the inverters. There are four channels designated as A, B, C and D for each unit. The alternate power supply for the vital instrument busses are class 1 E constant voltage source regulators powered from train-related class 1 E motor control centers.
Technical Specifications - The governing specification for the inverters is Technical Specification LCO 3.8.7, Inverters-Operating. With vital AC instrument bus(ses)
(channels A or C, or channels B or D; see also, Technical Specification Bases, Table B 3.8.9-1) in one train inoperable, the remaining operable vital AC bus electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the unit and maintain it in the safe shutdown condition. Overall reliability is reduced, however, since an additional single failure could result in the minimum required ESF functions not being supported. Therefore, the required vital AC instrument busses must be restored to operable status within two hours by powering the bus from the associated inverter by inverted DC voltage or the class 1 E voltage regulating transformer.
LCO 3.8.9, Distribution Systems - Operating, condition B, is relevant upon a loss of any of the four vital 120 VAC busses. This has a 2-hour completion time to restore power 6
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response and a second completion time of 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />. The second completion time for action B.1 is a limit on the maximum time allowed for any combination of periods the distribution subsystems are inoperable during any contiguous occurrence of failing to meet the LCO. Failure to meet either of these completion times requires the plant to be shutdown to Mode 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.
LCO 3.1.5, Control Element Assembly (CEA) Alignment - Another unique situation of the short LCO completion time is the loss of either PN channel C or PN channel D. As identified in the detailed information sections of this response, loss of PN channel C results in a loss of power to the reed switch position transmitters (RSPT) associated with the control element assembly calculator (CEAC) number 2. This causes a loss of 1 of the 3 position indications required by LCO 3.1.5, condition B.
Control element drive mechanism control system (CEDMCS) cabinet C5 is also powered from PN channel C. This loss of power results in false upper electrical limits (UEL), lower electrical limits (LEL) and rod drop contacts (RDC) for CEAC number 1 and the channel A, B, and C core protection calculator (CPC) and their respective target rods in all four CPC's. A byproduct of the RDC is to reset the CEA pulse counters (plant computer function) to 0 inches withdrawn.
The combination of these losses results in 75 percent of the CEAs having only a single position indication. LCO 3.1.5, condition B, allows for only one CEA position indicator channel operable for only one CEA per CEA group. The loss of power, as assumed by this NRC Electrical RAI, causes a situation where multiple CEAs will have only a single position indication available. As this condition is not addressed in LCO 3.1.5, the requirements of LCO 3.0.3 become applicable. It states:
When an LCO is not met and the associated ACTIONS are not met, an associated ACTION is not provided, or if directed by the associated ACTIONS, the unit shall be placed in a MODE or other specified condition in which the LCO is not applicable. Action shall be initiated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to place the unit, as applicable, in:
- a. MODE 3 within 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />;
- b. MODE 5 within 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br />.
The loss of PN channel D has the result of entering LCO 3.0.3 for much the same reason as the loss of PN channel C.
A loss of any one of four channels will result in the loss of incore nuclear instruments and thus will result in the loss of the core operating limit supervisory system (COLSS).
Operator requirements are to perform (within 15 minutes) surveillance test procedure 72ST-9RX03, DNBR/LHR/AZTILT/ASI with COLSS Out of Service, to ensure that Linear Heat Rate (LCO 3.2.1), Azmuthal Power Tilt (LCO 3.2.3), Departure from Nucleate Boiling Ratio (LCO 3.2.4), and Axial Shape Index (LCO 3.2.5) are all within allowable values.
7
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Loss of Vital AC Instrument Bus Description - A detailed description of the actions which the operations staff are directed to perform for the loss of each vital AC instrument bus is provided in the following sections of this response. Abnormal operating procedure 40AO-9ZZ1 3, Loss of Class Instrument or Control Power, is the primary governing procedure for addressing this abnormal condition.
With some exceptions, the loss of PN channel A or PN channel B have basically the same impacts. Likewise, the PN channel C and PN channel D have fairly equal effects on the operating unit.
The following table illustrates the basic differences in impact on plant systems based on the loss of one of the class PN busses.
Channels Equipment / Condition Impacted by Loss of PN Bus anBels Al BIC DI Emergency Plan Classification.
X X Pressurizer Heaters lost (conditional).
I I
Loss of Ability to Start Reactor Coolant Pumps.
X Loss of Automatic Make up to Volume Control Tank.
X Loss of CVCS Letdown:
X Loss of COLSS (complete).
X X
X X
Loss of associated Essential Chill Water System.
X X
CEA Calculator No. 1 inputs Lost to Operable CPCs.
I I
I I
Trips of Associated Channel RPS and ESF Inputs.
X X X X Reactor Trip Breakers A & C Tripped Open.
X X
Reactor Trip Breakers B & D Tripped Open.
X X
ADV's 179 & 184 Fail Closed (normally closed). Can be operated locally.
X ADV's 178 & 185 Fail Closed (normally closed). Can be operated locally.
X Loss of Associated QSPDS System.
X X
Partial Actuations (half leg trips) of ESFAS.
X X
X X
Loss of Associated Shutdown Cooling Valve Electrical Opening Capability.
X I
X X
Loss of Associated Radiation Monitors.
X X
Associated BOP-ESFAS Actuations (CREFAS, FBEVAS, CPIAS).
X X
Automatic and Manual CEA Motion Lost (Remain Trippable).
X X
LCO 3.0.3 Entry on Loss of CEA Indications.
X X
Note: An "X" indicates the stated condition occurs. An "I" indicates an impact to the system where actions are available to restore/ maintain the function.
Detailed Information - Loss of Vital Instrumentation and Control Distribution Panel PNA-D25 - Should power be lost to PNA-D25, the following effects can be expected, followed by the associated operator actions.
The potential exists that pressurizer class heaters will be lost if the selected heater control circuit level transmitter was powered from the PN channel A bus. Should this occur, an early direction in procedure 40AO-9ZZ1 3, Loss of Class Instrument or Control Power, addresses transferring the heater control to the PN channel B bus powered 8
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response pressurizer level instrument. The pressurizer heaters can be reset following this transfer.
Also, a loss of channel A pressurizer level indication will be detected as a level deviation, low, between the indicated level and the level set point, if the level control selector switch was selected to the level instrument power from the PN channel A bus.
This will result in the automatic start of the normally secured 3 rd charging pump in an attempt to correct the 'indicated' low pressurizer level condition. Upon detection, operators transfer this control to the PN channel B powered pressurizer level instrument.
Due to a loss of instrumentation power, the reactor coolant pumps (RCP) cannot be started due to the nuclear cooling water (NC) low flow interlock for seal and bearing cooling. If running, the RCPs will continue to run.
The boric acid makeup pumps will become unavailable due to a loss of the channel A refueling water tank (RWT) level transmitter CHA-LT-21 0. This will result in the operators being directed to place both boric acid makeup and the reactor makeup water controllers in manual, preventing any automatic make-up to the volume control tank (VCT).
Loss of the channel A powered incore nuclear instrument inputs results in the loss of both trains of the COLSS, if reactor power is greater than 20 percent. This will require the operating crew to perform surveillance test procedure 72ST-9RX03, DNBRILHR/AZTILT/ASI with COLSS Out of Service. This must be performed within 15 minutes of the loss of power.
Power is also lost to the flow transmitter for the train A essential chilled water system.
This will result in the chiller tripping, if running, and will prevent starting. This will require the performance of procedure 40ST-9EC03, Essential Chilled Water & Ventilation Systems Inoperable Action Surveillance, within one hour of the initial loss of PNA-D25.
Any CPC energized, and not in bypass at the time of the loss of power, will require operators to enter an 'inoperable' code into that CPC, to identify the CEA calculator as inoperable, to keep that CPC operable.
Loss of power to one leg of the engineered safety features actuation system (ESFAS) logic matrices AB, AC, AD and loss of power to the plant protection system (PPS) initiation path number 1 for the ESFAS actuations results in channel A and B, leg 1-3 trips. Loss of PN channel A will result in simultaneously de-energizing the initiation relay lamps on C channel. No equipment will be actuated by this unless other failures exist.
Loss of power to channel A input parameter instruments results in channel A trips on each parameter that has a trip set point. Parameters that fail high or low are 9
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response inoperable. The operators will bypass the PPS channel A trip bistables that are not bypassed in PPS Channels B, C, or D.
Reactor trip switch gear (RTSG) breakers A and C trip open due to loss of power to one leg of the reactor protection (RPS) logic matrices AB, AC, and AD. RTSG breaker A also receives a trip signal on a supplementary protection logic assembly (SPLA) trip and loss of power to RPS initiation path number 1. Any situation where the B and/or D RTSG were to open at this time, would result in a reactor trip.
Atmospheric Dump Valves (ADVs) SGA-HV-i 79 and 184 fail closed due to loss of power to their associated controllers. These valves are normally closed, and redundant ADVs SGB-HV-1 78 and 185 remain available.
Power is lost to the qualified safety parameter display system (QSPDS) channel A. The redundant QSPDS channel B remains available.
Instrument power is lost to pressurizer pressure instrument RCA-PY-103. Interlocks associated with this'instrument will prevent shutdown cooling (SDC) isolation valves SIA-UV-651 and 655 from being opened electrically. If originally opened, the valve(s) will remain open and can be closed electrically.
Power is lost to the following train A powered radiation monitors which may have incorrect set points, when power is restored:
RU-29 CR Vent Intake RU-37 Power Access Purge RU-31 Fuel Pool Area RU-148 CTMT High Range RU-33 I Refueling Machine Area RU-150 Primary Coolant In addition, loss of power to the balance of plant essential safety function actuation system (BOP-ESFAS) remote indicator cabinets SQA-C01 and C05 will result in actuations of the control room essential filtration actuation system (CREFAS), fuel building essential filtration actuation system (FBEVAS), and the containment purge isolation actuation system (CPIAS). Guidance is provided in procedure 40AO-9ZZ13, Loss of Class Instrument or Control Power, to bypass and reset these systems and restore normal ventilation systems to service.
In the unlikely event that channel A 120 VDC is also lost, then the train A BOP-ESFAS will be de-energized. Operators disable train A equipment, as needed, to prevent load shed and subsequent sequencing following power restoration.
Detailed Information - Loss of Vital Instrumentation and Control Distribution Panel PNB-D26 - Should power be lost to PNB-D26, the following effects can be expected, followed by the associated operator actions.
The potential exists that pressurizer class heaters will be lost if the selected heater control circuit level transmitter was powered from the PN channel B bus. Should this 10
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response occur, an early direction in procedure 40AO-9ZZ1 3, Loss of Class Instrument or Control Power, addresses transferring the heater control to the PN channel A bus powered pressurizer level instrument. The pressurizer heaters can be reset following this transfer.
Also, a loss of channel B pressurizer level indication will be detected as a level deviation, low, between the indicated level and the level set point, if the level control selector switch was selected to the level instrument power from the PN channel B bus.
This will result in the automatic start of the normally secured 3 rd charging pump in an attempt to correct the 'indicated' low pressurizer level condition. Upon detection, operators transfer this control to the PN channel A powered pressurizer level instrument.
Chemical and volume control system (CVCS) letdown isolation valve CHB-UV-515 closes due to loss of power. This results in a loss of letdown. The operators are directed to procedure 40AO-9ZZ05, Loss of Letdown. If necessary, during a plant shutdown/ cooldown, the charging pumps can be cycled to maintain pressurizer level.
Loss of the channel B powered incore nuclear instrument inputs results in the loss Of both trains of the COLSS, if reactor power is greater than 20 percent. This would require the performance of surveillance test procedure 72ST-9RX03, DNBR/LHRIAZTILT/ASI with COLSS Out of Service. This must be performed within 15 minutes of the loss of instrument power.
Power is also lost to the flow transmitter for the train B essential chilled water system.
This will result in the chiller tripping, if running, and will prevent starting. This will also require the performance of procedure 40ST-9EC03, Essential Chilled Water &
Ventilation Systems Inoperable Action Surveillance, within one hour of the initial loss of PNB-D26.
Loss of power to each channel B input parameter instruments results in channel B PPS trips on the parameters that have a trip set point. Parameters that fail high or low are inoperable. The operators are directed to bypass the PPS channel B trip bistables that are not bypassed in channels A, C, or D.
RTSG breakers B and D trip open due to loss of power to one leg of the RPS logic matrices AB, AC, and BC. RTSG breaker B also receives a trip signal on a SPLA trip and loss of power to RPS initiation path number 2. Any situation where the A and/or C RTSG were open at this time would result in a reactor trip.
Loss of power to one leg of the ESFAS logic matrices AB, AC, BC and loss of power to PPS initiation path number 2 for all ESFAS actuations results in channel A and B leg 2-4 trips. Loss of PN channel B will result in simultaneously de-energizing the initiation relay lamps on the D channel.
11
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Any CPC energized, and not in bypass at the time of the loss of power will require operators to enter an 'inoperable' code in that CPC, to identify the CEA calculator as Inoperable, to keep that CPC operable.
In the unlikely event that channel B 120 VDC is also lost, then the train B BOP-ESFAS will be de-energized. The operators disable train B equipment, as needed, to prevent load shed and subsequent sequencing following power restoration.
Instrument power is lost to pressurizer pressure instrument RCB-PY-104. Interlocks associated with this instrument will prevent SDC isolation valves SIB-UV-652 and 656 from being opened electrically from the control room. A local-remote switch located at the power supply panel PHB-M36, if selected to local, will allow powered operation of these valves.
The following radiation monitors lose power which may have incorrect set points when power is restored:
RU-1 Containment Atmosphere RU-145 Fuel Building Vent Exhaust Low Range RU-30 Control Room Vent Intake RU-146 FB Vent Exhaust Mid Range RU-34 Containment Purge RU-149 Containment High Range RU-38 Power Access Purge RU-151 Primary Coolant In addition, loss of power to the BOP-ESFAS remote indicator cabinets SQB-C01 and C05 will result in actuations of the CREFAS, FBEVAS and the CPIAS. Guidance is provided in procedure 40AO-9ZZ1 3, Loss of Class Instrument or Control Power, to bypass and reset these systems and restore normal ventilation systems to service.
Power is lost to the QSPDS channel B. The redundant A channel QSPDS remains available.
ADVs SGB-HV-1 78 and 185 fail closed due to loss of power to their associated controllers. These valves are normally closed, and redundant ADVs SGA-HV-179 and 184 remain available.
Detailed Information - Loss of Vital Instrumentation and Control Distribution Panel PNC-D27 - Should power be lost to PNC-27, the following effects can be expected, followed by the associated operator actions.
Loss of the channel C powered incore nuclear instrument inputs results in the loss of both trains of the COLSS, if reactor power is greater than 20 percent. This would require the operating crew to perform surveillance test procedure 72ST-9RX03, DNBR/LHR/AZTILT/ASI with COLSS Out of Service. This must be performed within 15 minutes of the loss of power.
Any CPC energized, and not in bypass at the time of the loss of power, would require operators to enter an 'inoperable' code in that CPC, to identify the CEA calculator as inoperable, to keep that CPC operable.
12
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Loss of power to one leg of the ESFAS logic matrices BC, BD, CD and loss of power to PPS initiation path number 3 for each ESFAS actuations results in channel A and B leg 1-3 trips. Loss of PN channel C will result in simultaneously de-energizing the initiation relay lamps on channel A. No equipment will be actuated by this unless other failures exist.
Loss of power to the channel C input parameter instruments results in channel C PPS trips on the parameters that have a trip set point. Parameters that fail high or low are inoperable. The operators are directed to bypass the PPS channel C trip bistables that are not bypassed in channels A, B, or D.
RTSG breaker A and C trip open due to loss of power to one leg of the RPS logic matrices BC, BC, and CD. RTSG breaker C also receives a trip signal on a SPLA trip and loss of power to RPS initiation path number 3. Any situation where the B and/or D RTSG were to open at this time, would result in a reactor trip.
Instrument power is lost to pressurizer pressure instrument RCC-PY-105. Interlocks associated with this instrument will prevent SDC isolation valve SIC-UV-653 from being opened electrically.
If open, the valve will remain open and can be closed electrically.
CEAC 2 in the CPC channels becomes inoperable due to loss of power to the CEA RSPT and may generate penalty factors when reenergized.
CEDMCS looses power to cabinet C5. This results in false UEL, LEL and RDC indications on the operator module and core mimic for CEA number I and CPC A, B, C target rods. The UEL, LEL inputs to the subgroup logic prevents CEA motion for all subgroups in AS, MS, and MG. Movement in manual individual is prevented for the affected CEAs. Because of this, the operators will not be able to move the CEAs.
Detailed Information - Loss of Vital Instrumentation and Control Distribution Panel PND-D28 - Should power be lost to PND-28, the following effects can be expected, followed by the associated operator actions.
Loss of the Channel D powered incore nuclear instrument inputs results in the loss of both trains of the COLSS, if'reactor power is greater than 20 percent. This will require the operating crew to perform surveillance test procedure 72ST-9RX03, DNBRILHR/AZTILT/ASI with COLSS Out of Service. This must be performed within 15 minutes of the loss of power.
Any CPC energized, andlnot'in bypass at the time of the loss of power, would require operators to enter an 'inoperable' in that CPC, to identify the CEA calculator as inoperable, to keep that CPC operable.
Loss of power to one leg of the ESFAS logic matrices AD, BD, CD and loss of power to PPS initiation path number 4 for the ESFAS actuations results in channel A and B leg 2-13
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response 4 trips. Loss of PN channel D will result in simultaneously de-energizing the initiation relay lamps on B channel. No equipment would be actuated by this unless other failures exist.
Loss of power to the channel D input parameter instruments results in channel C PPS trips on the parameters that have a trip set point. Parameters that fail high or low are inoperable. The operators would bypass the PPS channel D trip bistables that are not bypassed in channels A, B, or C.
RTSG breakers B and D trip open due to loss of power to one leg of the RPS logic matrices AD, BC, and CD. RTSG breaker D also receives a trip signal on a SPLA trip and loss of power to RPS initiation path number 3. Any situation where the A and/or C RTSG were open at this time would result in a reactor trip.
Instrument power is lost to pressurizer pressure instrument RCD-PY-106. Interlocks associated with this instrument will prevent SDC isolation valve SID-UV-654 from being opened electrically. If open, the valve will remain open and can be closed electrically.
CEAC 2 in the CPC channels becomes inoperable due to loss of power to the CEA RSPT and may generate penalty factors when reenergized.
CEDMCS looses power to cabinet C6. This results in false UEL, LEL and RDC indications on the operator module and core mimic for CEA number 1 and CPC channel D target rods. The UEL, LEL inputs to the subgroup logic prevents CEA motion for the subgroups in AS, MS, and MG. Movement in manual individual is prevented for the affected CEAs.
PRA Assumptions Discussion - The assumption that a loss-of-off-site power (LOOP) is the only reason for loss of power to a vital bus, while it is powered from the voltage regulator, meant that LOOP is the only initiating event that would lead to this condition.
The probabilistic risk analysis (PRA) model includes all components in the power supply to the voltage regulator. So, it is correct that any fault in the voltage regulator supply path to the vital bus would cause a loss of power to the vital AC bus, but these faults are modeled as subsequent failures following an initiating event, not initiating events. Loss of power to a single vital AC channel is not an initiating event, because there is sufficient redundancy in power supplies for reactor protection logic and essential safety features actuation logic that no trip or actuations occur. Furthermore, no loss of equipment that could cause a transient occurs.
Conclusion - As stated in the beginning of this response, the LAR proposed increased LCO completion time does not increase the potential for a loss of vital instrumentation; it simply provides a risk-informed basis for the completion time. While time sensitive actions are required when there is a loss of vital instrumentation, this LAR will reduce the immediate demands on the operations staff. Once approved, this LAR will better focus the operators on risk significant actions, as compared to actions that are based upon qualitative completion times.
14
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC Electrical Review RAI.Question 5 Provide a detailed discussion of compensatory measures enacted whenever an inverter is out of service (inoperable) during the proposed 7-day Completion Time, and how such compensatory measures are documented (e.g., captured in the Final Safety Analysis Report) to ensure their consistent and continued use going forward.
APS Response Operations will declare the inverter inoperable and perform the necessary log entries documenting the time. Procedures are currently in place to address or mitigate the loss of a 120 VAC class instrument channel as described in detail in response to NRC Electrical Review RAI Question 4. As described in Section 3, Limitations and Precautions, of procedure 40OP-9PNO1/2/3/4, 120 VAC Class 1E Instrument Channel AIB/CID:
Section 3.3 - Electrical lineups required by Tech Spec 3.8.7 and 3.8.9 are to be maintained when bypassing an Inverter or de-energizing a 120 VAC Bus.
Section 3.4 - A simultaneous loss of any two PN busses will cause one of the six PPS trip matrixes to be completely de-energized. This will result in a reactor trip as well as a complete ESF initiation for all outputs (i.e., CIAS, CSAS, SIAS, etc.)
to both "A" and "B" Trains. Therefore, only in exceptional cases, as deemed necessary by the CRS/Shift Manager, shall more than one PN bus be placed on the backup voltage regulator at any one time. This will ensure that the effects of a loss of offsite power will only momentarily de-energize one PN bus until it is re-energized by the diesel generator.
Bus power is provided by the associated voltage regulator. Maintenance rule performance criteria of unavailability (UA) is updated upon approval of the maintenance work to carefully track the amount of time the inverter is out of service.
To provide a defense-in-depth administrative control of planned inverter maintenance, this LAR includes a change to the Technical Specification Bases. Specifically, as further described in the response to NRC PRA Review RAI Question 14 below, the administrative control states:
Planned inverter maintenance or other activities that require entry into Required Action A.1 will not be undertaken concurrent with the following:
- a. Planned maintenance on the associated train Diesel Generator (DG);
or 15
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response
- b. Planned maintenance on another RPS or ESFAS channel that results in that channel being in a tripped condition.
These actions are taken because it is recognized that with an inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that train is dependent on power from the associated DG following a loss of offsite power event.
As required by 10 CFR 50.71 (e), the approved license amendment safety evaluation will be reviewed for impacts to the UFSAR and addressed, as needed.
II. PRA Review NRC PRA Review RAI Question 1 The LAR describes the process for capturing plant design and procedure changes, but does not address plant operating experience (i.e., failure data and initiating events data). Describe how such plant-specific data and experience is reviewed and incorporated into the Probabilistic Risk Assessment (PRA) models. If the current model used for this application does not use recent plant-specific data, justify that the results would not be significantly impacted.
APS Response Unavailability, unreliability, and initiating event (IE) frequency data are periodically updated. Unreliability data is based either on generic data, or Bayes-updated data if sufficient plant-specific data is available. The unavailability, unreliability, and IE frequency data were last updated in November 2005, although the unreliability and unavailability data for the mitigating system performance index (MSPI) system components were updated in 2008.
The PRA model revision used for this LAR was issued in September 2007. Emergency diesel generator (EDG) failure rates were updated with the other MSPI components.
For the EDGs, both failure modes (start and run) decreased, and risk achievement worth (RAW) for both failure modes also decreased.
Most initiating event frequencies were last updated in 2001, although loss of coolant accident (LOCA) frequencies were updated in 2002, and Steam Line Break frequency was updated in 2005. The most recent PRA revision (March 2010) updated all initiating event frequencies. Those that increased were loss of main feedwater pumps, loss of instrument air,'miscellaneous transients (uncomplicated trips), and loss of a DC bus.
The first three have no significant impact on the importance of the vital AC system-.
Loss of a DC bus could have some impact. Examination of the importance of the inverters and voltage regulators shows that the RAW of the vital AC inverters increased 16
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response from undetectable to 3.4 E-4, and that the back-up voltage regulator RAW decreased slightly from 3.6 E-6 to 3.1 E-6. Thus the update of initiating event frequencies in the March 2010 model did not significantly impact the conclusions of the analysis performed for the LAR using the September 2007 model.
NRC PRA Review RAI Question 2 The LAR does not identify if there are outstanding plant changes (configuration changes or procedure changes) which would require a change to the PRA models, but which have not yet been incorporated into the PRA models used for this application. Identify if such changes exist, and if so, provide an appropriate disposition that the risk impact of these changes would not adversely impact the acceptability of the proposed Technical Specifications (TS) change.
APS Response Procedure 70DP-ORA03, Probabilistic Risk Assessment Model Control, Section 3.2.1, Identification and Resolution of Potential Impacts to PRA Models, provides direction on assessing impacts on the PRA model. Plant design changes are captured the same way procedure changes are, through periodic review of relevant changed documents.
These change documents include the mechanical and electrical drawings. When a document has been revised, an 'impact' to the PRA model is initiated and the change is evaluated for its impact to the PRA model. An open impact evaluation was performed for this LAR and is documented in the engineering study performed by the PRA group in support of the LAR. No changes were identified that would affect the analysis performed for the LAR. An exception to the above routine document reviews is that the fire suppression system drawings are not currently routinely reviewed. In response to this RAI, however, it was verified that no fire suppression system changes have occurred that Would affect the way the fire suppression system is modeled in the PRA.
NRC PRA Review RAI Question 3 The LAR identified that the licensee used an integrated fire PRA model to assess the risk impact from internal fires for this application. The LAR did not provide sufficient information as to the technical adequacy of this model, as required to support a risk-informed licensing action, for the staff to conclude that the fire PRA model is of sufficient quality and scope to support this application. The staff requests the following additional information relevant to the technical adequacy of this model for this application.
APS Response The Palo Verde fire PRA model was developed in accordance with the EPRI Fire PRA Implementation Guide (TR-105928) using the EPRI Fire Events Database (TR-1000894). The fire PRA model used for this application has not been evaluated for 17
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response compliance with RG 1.200 since the version of the RG 1.200 in effect at the time of the LAR submittal did not include specific supporting and peer review requirements for fire models. The risk results provided from the fire PRA model were included as additional information to support the conclusion that the requested change meets RG 1.174 acceptance criteria, but not as the principal basis for that conclusion.
A qualitative assessment of LAR change on fire risk has also been performed.
Palo Verde's Fire Hazards Analysis was developed on a train basis. Any fire would leave one train capable of supporting safe shutdown. A fire completely disabling one of the two trains would leave two functioning channels of vital AC, which is sufficient for operating any needed equipment, such as an Auxiliary Feedwater Pump, an Atmospheric Dump Valve, and monitoring plant conditions. The increased risk from such a scenario is only minimally affected by loss of the second train's two channels of vital AC.
Nevertheless, since the ICCDP and ICLERP values calculated from the fire PRA are three orders of magnitude lower than internal events values, it is highly unlikely that any shortcomings in the fire PRA model would result in an increase in either metric sufficient to result in different'conclusions. This would seem quite sufficient for this application.
Responses to each of the specific RAI sub-questions are provided below.
NRC PRA Review RAI Question 3a Address how the current fire PRA model satisfies the technical elements identified in Regulatory Guide (RG) 1.200 Rev. 1, Section 1.2.4.
APS Response The technical elements of RG 1.200 Rev. 1, Section 1.2.4 are addressed as follows:
Screening Analysis - Only areas and compartments separate from the nuclear support and power generation areas were screened out. The compartments in'the Auxiliary, Main Steam Support Structure, Control, Turbine and Corridor Buildings were modeled, even if there were no trip initiators or mitigating equipment or cables present. This is conservative, since the potential exists for a manual trip due to fire in any of these areas (which would not be included if they were screened).
Fire Initiation Analysis - EPRI TR-1000894, EPRI Fire Events Database, was used as the source for frequencies with apportionment among compartments and equipment per the EPRI Fire PRA Implementation Guide.
Fire Damage Analysis - Fire event trees were constructed that split the total frequency for a compartment into fractional contributions from each fire source in the compartment and from transient materials. Fire propagation 18
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response potential is modeled. Fire suppression is only credited where it can reasonably be expected to arrest propagation to needed mitigating equipment or cables within the same compartment, and would not render equipment unavailable from the spray. The fire propagation code COMPBRN was used only to generate a few bounding cases for fires. Over one hundred specific plant damage states were defined, which are linked to mitigation event trees.
Plant Response Analysis and Quantification - Each plant damage state from the previous step is then an input to a mitigation event tree. Several types of transient event trees were used from the internal events analysis, including uncomplicated reactor trip, turbine trip, loss of off-site power and loss of HVAC. Most transient event trees include induced LOCA through stuck-open pressurizer safety valves.
NRC PRA Review RAI Question 3b Provide an appropriate justification of any outstanding plant changes not incorporated into the fire PRA model per RG 1.200, Rev. 1, Section 4.2.
APS Response There are no plant changes that have not been incorporated into the model.
NRC PRA Review RAI Question 3c Describe how spurious component operations are addressed in the fire PRA model.
APS Response Components were analyzed regarding their potential spurious operation and how a fire-induced transient might be impacted. Given that hot standby is a safe end-state, very few spurious operations are of concern. For example, high pressure safety injection (HPSI) pump head is below normal RCS pressure; shutdown cooling isolation valves will not open against high pressure. Main steam and feedwater isolation valves were assumed to close for a fire in any compartment through which their cables pass (they fail closed on loss of power, and cannot re-open against pressure). Atmospheric dump valve spurious operation would require three hot shorts in different areas.
NRC PRA Review RAI Question 3d Describe how plant components, modeled in the PRA but not in the scope of the plant's fire safe shutdown licensing basis, have been addressed in the fire PRA. Specifically, 19
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response identify how cable route information for such components is handled if these components are credited in the fire PRA.
APS Response The Palo Verde cable routing database is comprehensive. Only a few cables in the Turbine Building lack complete routing information. Plant equipment was not credited if its cable routing was unknown.
NRC PRA Review RAI Question 3e Identify how the human reliability analysis was modified for the fire PRA to account for the impacts of fire on these actions; identify any fire-specific recovery actions credited in the fire PRA, their failure probabilities, and the basis for the probabilities.
APS Response The EPRI Fire PRA Implementation Guide applies penalty factors of two or three depending upon time constraints and whether the action is inside or outside of the control room. HRAs were not credited if the operator had to go into a compartment affected by the fire. The only HRA specific to fire is establishing plant control from the remote shutdown panel in the event of a control room fire. The time constraint is associated with establishing controlled secondary heat removal that allows proceeding to plant cooldown. There are only twelve critical steps. The HRA value is 8.8 E-3.
NRC PRA Review RAI Question 3f Identify the reviews (internal, external, and/or peer) completed for the fire PRA model to assure its quality.
APS Response ERIN Engineering performed an independent assessment of the fire PRA in 2003. A total of 39 Facts & Observations (F&Os) were generated, of which one was Category A (Extremely important and necessary to address to assure the technical adequacy of the PSA, the quality of the PRA, or the quality of the PRA update process), and six were Category B (Important and necessary to address, but may be deferred until the next PRA update). Only five F&Os are currently open, all of them either Category C (considered desirable to maintain maximum flexibility in PRA applications and consistency in the industry, but not likely to significantly affect results or conclusions) or D (editorial or minor technical item, left to the discretion of the host utility).
20
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC PRA Review RAI Question 4 The LAR does not provide an internal flood analysis for this application, but instead states general conclusions about the insignificance of internal floods generally, and that "equipment of importance for the vital AC application" is not located in areas where a significant flood could occur. Provide the basis for this conclusion; what equipment is important for this application, where is it physically located, what are the significant flood sources; so that the staff can reach a conclusion about the importance of internal floods for this application.
APS Response The equipment important to this application, along with its location and potential flooding sources are shown in the following table. This information was gathered from the ongoing internal flood model development effort. All the flood walkdowns for flood sources and affected equipment in the listed areas have been completed.
Equipment Location and Elevation Flooding Sources Vital AC inverters DC equipment rooms, Control None direct (Note 1)
Building ground level Vital AC distribution panels
.DC equipment rooms, Control None direct (Note 1)
Building ground level Back-up voltage regulators DC equipment rooms, Control None direct (Note 1)
Building ground level DC busses DC equipment rooms, Control None direct (Note 1)
Building ground level Battery Chargers DC equipment rooms, Control None direct (Note 1)
Building ground level Motor Control Centers ESF switchgear rooms, Air Cooling Unit supplied by supplying voltage regulators Control Building ground level Essential Chilled Water, and battery chargers approximately 130 gpm capacity, 2" diam. (Note 1);
Domestic water piping <2" diameter Auxiliary Building containment Air Cooling Unit supplied by electrical, penetration rooms on Essential Chilled Water, ground level and 20 feet approximately 130 gpm above ground level capacity, <2" diameter (Notes 1 and 2)
Fire suppression (Note 2)
Load Centers supplying above ESF switchgear rooms, Air Cooling Unit supplied by MCCs Control Building ground level Essential Chilled Water, approximately 130 gpm capacity, 2" diam. (Note 1);
Domestic water piping <2"
_diameter ESF switchgear ESF switchgear rooms, Air Cooling Unit supplied by Control Building ground level Essential Chilled Water, approximately 130 gpm capacity, 2" diam. (Note 1);
Domestic water piping <2" diameter 21
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Equipment Location and Elevation Flooding Sources Diesel Generators Diesel Generator Building Fire suppression (pre-action, ground level dry pipe, cross-zone actuated, diverse detectors)
Essential Spray Pond (cooling water supply) (Note 3)
Off-Site Power ESF Service Outside ground level Fire suppression (deluge type, Transformers dry pipe)
Note 1: Make-up to the Essential Chilled Water expansion tanks comes from the Condensate Storage and Transfer system. A train-dedicated transfer pump can supply about 130 gpm once the expansion tank low level condition actuates it. This is well within the capacity of the floor drains. Any spray could only impinge the back of one Load Center. Doors from the switchgear rooms to the DC Equipment Rooms have threshold seals that would further limit any flow into those rooms. All electrical equipment is elevated off the floor at least two inches.
Note 2: MCCs are in NEMA-4 rated (spray-tight).enclosures. Fire suppression piping is dry (pre-action type).
Note 3: The effects of Spray Pond cooling water piping rupture are limited to a single Diesel Generator by raised thresholds, sump pumping and door seals.. Fire suppression piping is dry.
NRC PRA Review RAI Question 5 The self-assessment identified the failure to conduct walkdowns with system engineers and operators, as required by the American Society of Mechanical Engineers (ASME)
PRA standard, element SR SY-A4. The licensee's disposition acknowledges the deficiency, but justifies that system engineer reviews of fault tree models and PRA analysts' familiarity with the plant layout and operations is acceptable. The staff does not agree with this generic disposition, which excludes operator input to the system model development. Describe the experience of PRA analysts with regard to plant layout and current plant operations specific to the vital AC inverter system and other plant systems important for this application.
APS Response Walkdowns of the modeled systems were performed by the PRA group. The PRA group at the time of the walkdowns included two engineers holding Senior Reactor Operator licenses for Palo Verde. One of the licensed individuals was a licensed operator trainer for several years, and the other was a Shift Technical Advisor for seven years at Palo Verde.
The PRA documentation makes extensive reference to the abnormal and emergency operating procedures, both in understanding how the systems work, and also in Human Reliability Analysis. System operation, as modeled and documented-, is consistent with those procedures. There is reasonable expectation of fidelity given the numerous times procedure changes have been examined for their impact to the PRA model.
22
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC PRA Review RAI Question 6 The self-assessment identified the failure to address the state-of-knowledge correlation in estimating the mean core damage frequency, as required by the ASME standard, elements SR QU-A2b and SR QU-E3. The licensee's disposition acknowledges the deficiency, but justifies that the uncertainty in the underlying failure data and its treatment of this "older" data as median values compensate for ignoring the correlation.
The staff does not agree with this justification for not considering correlated data sources. Evaluate the results for this application to determine if the failure to address correlated data is having a significant adverse impact on the results; either justify that this impact is not occurring, or provide an appropriate sensitivity study to bound the impact.
APS Response As a point of clarification, Palo Verde was not claiming to meet the standard regarding the "State of Knowledge Correlation." Rather, that not meeting it was partially compensated for by taking generic data, presented as "best estimate," as median values and converting them to means. Since the mean is higher, this would yield higher CDF and LERF values. However, since the LAR submittal, significant improvements in documentation have been achieved, including this particular area. The following is a paraphrased excerpt from the updated engineering study that documents the current March 2010 PRA model results:
EPRI Technical Report TR-1013941, Guideline for the Treatment of Uncertainty in Risk-Informed Applications, December 2006, says that the "state of knowledge correlation" is not generally of concern for Level 1 base case PRA, particularly for models that generate a large number of cutsets. Paragraph 3.1.1.5 suggests performing a Monte Carlo simulation with at least 10,000 samples to help minimize this type of uncertainty (10,000 samples is used in the Palo Verde PRA solution).
The state of knowledge correlation is also minimized by use of common-cause modeling and also by small error factors. In general, error factors for failure parameters used by multiple basic events that contribute significantly to CDF are three (3) or less. It is also smaller where correlated variables contribute less to the total result. EPRI Technical Report TR-1 009652, Guideline for the Treatment of Uncertainty in Risk-Informed Applications Technical Basis Document, December 2004, paragraphs F7 and F9, conclude that the state of knowledge correlation effect is not significant for typical nuclear power plant PRAs.
CDF results for the model version used for this LAR were re-run to provide the calculated mean resulting from the uncertainty analysis for the base case, along with the minimum cut-upper bound, which was provided in the original submittal. The estimated internal events mean CDF from the uncertainty analysis was just over 1%
greater than the minimum cut-upper bound. Cutset examination shows that correlated variables do not contribute a large fraction of the result. Components that could be 23
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response correlated, such as auxiliary feedwater and safety injection pumps and valves, have parameters with small error factors (3 or less) and are in common-cause groups. The internal events CDF solution has 82,800 cutsets.
NRC PRA Review RAI Question 7 The self-assessment identified the failure to perform cross-comparisons to other similar plants to identify causes of significant differences, as required by the ASME standard, element SR QU-D3. The licensee's disposition identifies a dated comparison performed by the owners' group. Discuss the results of this comparison; were any results of the PRA identified as an outlier? What was the disposition of these outliers, if they exist?
APS Response There are numerous unique characteristics of the Palo Verde design that make cross-comparisons to other plants less insightful. Taken from the current PRA documentation, these characteristics are listed below:
" Unlike most multi-unit sites, the three units are completely independent and physically separate; there are no shared mitigation systems. The only significant connection is through the switchyard where the units share the output of three dual-secondary winding start-up transformers for off-site power. There are no inter-unit dependencies, nor is there capability for one unit to support another in mitigating an event. There are procedures to route emergency diesel generator output from one unit to another, but this is not currently credited in the model due to its complexity and timing.
Off-site power is always the preferred source for the ESF busses; the unit auxiliary transformer (UAT) does not supply the ESF busses. The fast bus transfer only affects power to station auxiliaries, not the ESF busses. Loss of power to an ESF bus (even both) is not expected to trip the unit. Despite this, loss of either ESF bus is modeled as an initiating event due to the short Technical Specification allowed outage time in that condition, which would force a near-term shutdown.
The Station Blackout Generators (SBOGs) are common to the three units. Their 13.8kV output is brought into each unit through its Train A ESF Service Transformer from which it can supply either ESF bus. This results in some asymmetry, primarily in station blackout cutsets. Although procedural guidance exists for supplying two units with power from the SBOGs, it is highly unlikely that more than one unit would need power from them. The PRA does not account for simultaneously supplying more than one unit.
Palo Verde does not have power operated relief valves (PORVs) to provide a core heat removal alternative to secondary cooling. This results in the auxiliary 24
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response feedwater (AF) system being by far the most risk-significant front-line mitigating system and the PRA results being dominated by secondary cooling failures.
The steam generators are unique in the U.S. nuclear industry in two ways:
First, they are the only ones with an economizer section. (The economizer is located at the bottom of the tube bundle on the cold leg side. Its purpose is to improve thermal efficiency by allowing a higher average temperature in the boiler section.)
At full power, 90% of the feedwater is directed to the economizer section and 10% to the downcomer. Auxiliary feedwater is directed only to the downcomer.
There are, therefore, two separate feedwater containment penetrations for each of the two SGs. Also, an economizer feedwater line break behaves differently from a downcomer line break, so must be modeled separately. Steam and downcomer feedwater line breaks are cool-down events, because inventory is lost as steam and significant feedwater flow continues. An economizer line break is a heat-up event, because inventory is lost as water; i.e., the entire SG blows down without any feedwater being delivered to remove core heat.
The second unique feature is that each SG has two steam lines. There is an atmospheric dump valve (ADV) on each of the two lines on each SG for a total of four ADVs.
Palo Verde's reactor coolant pumps are also unique in the industry. The seal package design is such that even if all three seal stages fail, clearances are so tight that only seventeen gallons perrminute would leak from each pump at full system pressure. This is within the capacity of two of the three charging pumps (two of the three are normally operating). Thus, as long as the RCP is shut down prior to damage, an RCP seal LOCA cannot occur. This, along with not'having PORVs, results in much lower importance of the safety injection system. It also makes the plant less vulnerable to station blackout, since loss of seal cooling does not lead to a LOCA that cannot be mitigated due to loss of all AC power.
Furthermore, with the RCP shut down, either seal injection (supplied by the charging pumps) or seal cooling (supplied by non-class component cooling water, backed up by class component cooling water) is adequate to prevent any seal degradation. Pressure breakdown is normally staged across the three seals; however, each seal is capable of withstanding full system pressure.
Palo Verde's original auxiliary feedwater design had two class 1 E pumps, one turbine-driven (Train A) and one motor-driven (Train B), with a start-up electric auxiliary feedwater pump located in the Turbine Building that was powered from non-class distribution and which feeds into the downcomer feedwater lines upstream of containment isolation. Before the plant was licensed, it was determined that, without PORVs, more reliability was needed for auxiliary feedwater. As a result, the non-class pump was given Train A ESF power, 25
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response valves needing to be operated to use the pump were also given Train A power, and the containment isolation valves altered such that there would be no dependence on Train B to keep them open.
In addition, the turbine-driven pump can be operated locally with no power at all for the 24-hour PRA mission time. Due to very limited loading on the channel C and D batteries, two channels of steam generator (SG) level indication remain available under station blackout conditions. The end result is a highly asymmetric system in terms of reliability and relative importance.
Palo Verde is designed to accommodate a full load rejection without tripping the reactor. This is accomplished by a steam bypass system that can dump 70 percent of full steam flow to the condenser and a reactor power cutback system that drops some control rods to rapidly reduce reactor power and primary temperature. The reactor regulating system adjusts other control rods to establish a steady-state plant power around 30%. The operators then decide whether the turbine can be rapidly recovered or if a controlled reactor shutdown is to be done. This makes turbine trip a smaller contributor to risk, since failure or unavailability of the above control systems is required for a turbine trip to lead to a reactor trip.
Most plants rely on some normally-operating systems for post-transient or accident mitigation, such as service water, component cooling water, chilled water for HVAC, and perhaps HVAC systems themselves. Palo Verde has class 1 E standby systems for all of these functions (two independent trains).
Furthermore, the class 1 E mitigating systems have no dependence on instrument air. Although the PRA model credits the Balance of Plant (BOP) systems, they are of low importance. It also alleviates the need to model loss of those BOP systems as complex initiators.
Palo Verde's inland, low desert location results in several unusual or unique conditions: no salt spray, no icing, no fluctuations in ultimate heat sink water supply levels, ultimate heat sink temperature that fluctuates in a predictable (seasonal) way, and chemistry-controlled ultimate heat sinks (no biological fouling). Condenser heat sink water is treated effluent from the Phoenix metro area. Between two and three weeks worth of water can be stored on site in two ponds to support all three units at full power. The safety grade ultimate heat sinks are two concrete basins with spray nozzles for evaporative cooling. Make-up is from either treated effluent water or domestic water. The combined water volume of the two basins can support safe shutdown needs for a more than a week without make-up. Each train can use the volume of the opposite train by opening a cross-tie valve (combined 26-day inventory).
The closest design to Palo Verde is that of San Onofre Units 2 and 3. The power rating, while not the same is close (3,410 MWt vs. Palo Verde's 3,800 MWt original design), and they also do not have power operated relief valves.
26
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response However, it is a dual-unit site with system sharing capability, its location and ultimate heat sink are very different, and its off-site power system is significantly different from Palo Verde. Comparing initiating event frequencies and relative CDF contributions shows the following:
SONGS uses a much higher small break LOCA frequency. Palo Verde used an estimated value from NUREG/CR-5750 tailored to our specific small break LOCA break range (the break size range for SONGS may be different). That break range is defined as greater than charging pump make-up capacity up to the point where secondary cooling is no longer effective, because sub-cooling cannot be maintained. The overall CDF portion from all LOCAs at SONGS is over 40%, but a significant part of this is from RCP seal LOCAs, to which Palo Verde is not susceptible.
The SONGS loss of off-site power frequency is about twice as large as Palo Verde. This initiator value is unique to each site. In spite of their frequency being higher, their fraction of core damage from this IE is only 10% vs. 30% for Palo Verde.
The SONGS turbine trip and uncomplicated reactor trip frequencies are similar to Palo Verde, although the CDF contribution at SONGS is about 20% vs. about 28% for Palo Verde.
The SONGS loss of component cooling water frequency is lower than Palo Verde; however, theirs is a loss of class component cooling water, whereas Palo Verde is non-class, which does not supply cooling to ESF components or HVAC. Thus, the contribution to CDF is higher for SONGS.
A Combustion Engineering Owners Group (CEOG) cross-comparison was performed in 1998 for the fifteen Combustion Engineering units that looked at all initiators, their frequencies and CDF contributions. Palo Verde was found to be an outlier on three IE frequencies (greater than one standard deviation, but less than two); small break LOCA and steam generator tube rupture (SGTR) were on the high side, and turbine trip with reactor trip (TT/RT) on the low side. However, CDF contribution was not an outlier for any initiator. The high small break LOCA frequency was due to the combination of small and very small break sizes. The SGTR frequency was high due to Bayes updating the industry value with Palo Verde's own SGTR event. The low TT/RT frequency is due to Palo Verde's capability to withstand load rejection without tripping the reactor. This document also compared common cause methods and values, failure data, HRA methods and results, LOCA success criteria, uncertainty and importance results, and system dependencies, such as HVAC, direct component cooling, electrical, etc. No conclusions were drawn from most comparisons. In any event, virtually everything examined at that time has been changed at least once since then.
Another CEOG cross-comparison was performed in 1999 that covered three dominant CDF contributors: small break LOCA, loss of DC bus and loss of off-site power. Among 27
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response the parameters compared were IE frequencies, overall internal events CDF, CDF from each of three subject lEs, top contributing cutsets for each of the three lEs and CDF by frequency range. Palo Verde was not an outlier in any area; generally we were close to the mean.
In late 2008, a comparison of the top most important operator actions at SONGS, Waterford-3 and Palo Verde was performed. Although significant differences exist, reasons for those differences were found in the areas of RCP seals design and capability, design of the auxiliary feedwater systems, and HVAC capabilities and dependencies.
NRC PRA Review RAI Question 8 The self-assessment identified that sources of model uncertainty are not identified, and that there was no systematic approach to assure key assumptions are identified, as required by the ASME standard, elements SR QU-E1 and SR QU-E2. The licensee's disposition addresses only parametric uncertainties. There is no-discussion or disposition of other sources of uncertainty or the key assumptions. Discuss other sources of uncertainty and key assumptions relevant to this application, and provide appropriate sensitivity studies to bound the impacts.
APS Response The following are paraphrased excerpts from the current March 2010 documentation of the PRA model for areas of uncertainty relevant to this application:
Loss of off-site power frequency is one parameter with high uncertainty. There is not a statistically significant history of these events, plus the electrical grid is not a static system. A large number of variables, such as generation availability, load magnitude and characteristics (location, power factor, etc.) and weather contribute to the likelihood of either a local disturbance sufficient to cause loss of the plant's switchyard or general collapse of the grid, which requires much more recovery time and relies on procedures never (or very rarely) actually used.
Furthermore, there are several operating entities, as well as presumed availability of some minimum set of black-start capable power plants and transmission facilities, along with command function and monitoring availability for remote operation of breakers. It is, therefore, useful to do a sensitivity study on LOOP frequency.
NOTE: A sensitivity study was performed on loss of off-site power frequency and reported in the LAR submittal in Section 3.4.4.
Another source of uncertainty is lack of completeness. Since resources are required to produce the modeling of the plant, the depth of modeling is often a function of how important a system is believed to be. There may also be 28
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response limitations in modeling and quantification software that in turn limit the number of basic events, number of minimal cutsets, or would result in an unacceptable solution time. (No such shortcomings are known to exist in Risk Spectrum or the solution engine RSA T.)
NOTE: The vital AC system is thoroughly modeled; lack of completeness is not an issue.
Probabilistic risk assessment is intended to be based on best-estimate plant response. Where best-estimate analyses are not available, PRA analysts may resort to design basis analyses and success criteria, which can be significantly more conservative. Examples are environmental factors, such as equipment or room temperature limits. One best-estimate analysis that has been done and applied in the Palo Verde PRA is: Room heat-up calculations to determine either the equilibrium temperature or how long it takes to reach some maximum temperature.
Table H-13of EPRI Technical Report TR-1009652, shows sources of modeling uncertainty specific to quantification. Those sources are shown in the following table along with how each is dispositioned:
Sources of Uncertainty in Quantification Truncated The truncation analysis serves to minimize this uncertainty. The HRA sequences/cutsets dependence analysis also assists in this by causing cutsets with operator actions to rise several orders of magnitude, where they can be examined (all HRAs are set to a value of 1.0).
Rare Event Care Was taken to ensure success branch values are close to 1.0, (no less than Approximation 0.9).
Cutset Merging Risk Spectrum solves the whole model rather than sequence-by-sequence. Thus only minimal cutsets result.
State of Knowledge The State of Knowledge correlation effect is minimized by several factors, Correlation including:
Correlated variables do not contribute a large fraction of the total numerical result 0
Common-cause modeling is used for components that could be correlated 0
Error factors are generally 3.0 or less NRC PRA Review RAI Question 9 The self-assessment identified that there was no documented basis for crediting a decontamination factor for scrubbing effects, as required by the ASME standard,.
29
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response element SR LE-C10. The disposition of this item implies that scrubbing is credited for preventing large releases for steam generator tube rupture, based on an assumed operator response to assure steam generators are water-filled ("flooded"). Describe where the large early release frequency (LERF) analysis credits scrubbing, and provide a basis for this credit.
APS Response The LERF analysis credits scrubbing in accident scenarios with no loss of steam generator secondary cooling by means of normal auxiliary feedwater or through the turbine-driven auxiliary feedwater pump (when loss of offsite power occurs). A SGTR event was assumed to contribute directly to LERF when the flow through the break is uncovered and flashes out through the Atmospheric Dump Valves. An Iodine Decontamination Factor (DF) of 1.0 should be assumed for the flashed fraction of RCS water, and a DF of 100.0 may be assumed for non-flashed fraction. Prior to loss of power, the flow continues to go through the condenser and the corresponding DF is 100.0. These DF values are consistent with the Safety Analysis Basis Document on record (SABD-3.06.03, Rev. 06). These LERF model DF values were validated by engineers from the Transient Analyses Group who are responsible for the generation of SABDs.
In 2005, Westinghouse Electric Corporation (WEC) completed WCAP-16341-P, Guideline for PRA Level 2 Analysis. The new guidelines are designed to meet the ASME Standard, R.G. 1.200 capability category I1. In their report, WEC provided plant-specific results on key aspects of LERF modeling parameters including the credit for SGTR flow scrubbing. The new PVNGS Steam Generator design (with pristine tubes,
<2.5% plugged) allows for scrubbing credit.
A sample Event Tree from the WEC report is provided below to demonstrate that induced-SGTR questions (6th and 8th) are asked on the tree branches with AFW failure (5th question from the left). The Iodine-free water level above the break location allows for a negligible value of flashing fraction at normal SG water levels. When coupled with required operator action to "flood" the SG, the water level above the break location exceeds 30 feet.
30
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response YESý NO Figure 6-lb Simplified Level. 2 Station Blackout Event. Tree___
5-.
.4ý1 SUR 05
.1 ST 7z W.-
Ii
.4-.1 v
P-12 R11-7-10 CF EI PC Eýila ER043 rE21 ERF51.5.
P135 P11
[23.0-C EsRFso McrCF555 WC-AP-63 14 1 1-P. Revision 0 November 2005 31
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC PRA Review RAI Question 10 The self-assessment identified that the limitations of the LERF model for applications were not identified, as required by the ASME standard, element SR LE-G5. The licensee disposition acknowledges the deficiency, and then states that the existing LERF model is "clearly adequate for this application..." Provide the basis for how the LERF model was found to be clearly adequate.
APS Response The main reasons the LERF model was determined to be adequate for the intended application are:
" The basic events in the PRA model representing the vital AC inverters are minor contributors within fault trees leading to eventual loss of shutdown cooling and core damage. These basic events have no direct impact on containment performance or containment bypass.
" The vital AC inverters' fail-safe design, equipment redundancy, and redundancy in power sources led to negligibly low risk-importance measures for these equipment (Fussell-Vesely and Risk Achievement Worth).
- The resulting increase in LERF (presented in the original application) is two orders of magnitude lower than the allowable insignificant increase described in Regulatory Guide 1.174. The LERF increase obtained was the total contribution from internal events and fire PRA plus seismic effects. The deficiencies noted in the PRA model from the in-house self-assessment are largely associated with the lack of a plant flood-model. The flood-model contribution to increase in LERF has to be a factor of 300 higher than the combined contributions from internal events and fire PRAs. The APS response to NRC PRA Review RAI Question 4 provides related details about the risk impact from the missing plant flood model.
Furthermore, the design of Palo Verde reflects important industry and NRC issues related to flood risks. Hence, the flood-model contribution to risk increase in this application is expected to be very small or negligible.
NRC PRA Review RAI Question 11 The self-assessment identified 15 separate deficiencies related to documentation of the PRA model. The staff expects that licensees pursuing risk-informed changes to their license have a robust program for configuration control of the PRA, including maintaining adequate documentation per the industry consensus standards. Given the scope of this deficiency in documentation, address how the technical adequacy of the overall PRA model has been assured for this application.
32
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response APS Response Since the LAR was submitted, significant improvements have been made in model documentation, in the March 2010 PRA model. The only remaining supporting requirements for documentation not met are those associated with system modeling (SY-Ci, -C2 and -C3) and Level 2 (LE-G4 and -G5).
In the system modeling area, APS assures that the assumptions and boundary conditions are maintained in memos within the Risk Spectrum PRA database. As such, they are directly linked to the fault tree gates, basic events or parameters to which they apply. Since this LAR was submitted, additional memos have been added to address the more global aspects of a system model, such as system boundaries and operation in normal and emergency conditions. The only reason supporting requirement SY-Ci is stated as not met, is that the information contained in these memos is not organized in a manner that facilitates peer review in a system notebook. Furthermore, the following sub-elements of SY-C2 are considered to be met: a, b, c (schematics do exist in outdated system studies; boundaries have not changed in any significant manner), d, f, g, h, i, j (spatial information is documented in one of fire PRA studies, but not in internal events PRA documents), and k, I, n, q, r and s (nomenclature is documented in a Risk Management department procedure). The following sub-elements are considered to be not applicable: e, m and p. This leaves only sub-element o. System fault trees are not solved by themselves, due to the linked nature of the model. Cutset analysis typically can reveal shortcomings or inconsistencies within the fault trees.
Supporting requirement SY-C3 addresses key assumptions and uncertainties. Using the EPRI guides mentioned earlier in the response to NRC PRA Review RAI Question 8 (specifically, Table H-12 of EPRI Technical Report TR-1 009652), the following table shows the areas of uncertainty that are applicable to system modeling and how (or if) they are addressed in the Palo Verde PRA:
Sources of System Modeling Uncertainty Source How Addressed Super components Super components in the PRA model are the diesel generators, chiller packages, and instrument air compressor packages. Reliability and availability data used are consistent with the boundaries of the super component.
Black box models The only components in the Palo Verde PRA model that might be considered a black box are the load sequencers, the Supplementary Protection Logic Assemblies (diverse reactor trip) and the non-class control systems, such as Steam Bypass Control and Reactor. Power Cutback systems. Failure rates for similar components are used with relatively high error factors.
33
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Source How Addressed Use of generic "black box" models (for No generic black box models are used in the example, RPS, rod insertion, and so on)
Palo Verde PRA model.
Treatment of equipment repair Equipment repair is not credited in the Palo Verde PRA - this results in conservative results if equipment can, in fact, be repaired.
Credit for manual operation or local operation Any credit taken for manual or local operation is done through appropriate Human Reliability Analysis.
Component boundaries Boundaries are specified to assure both completeness and non-overlap.
Modeling of unique components (data Data are used that come as close as possible applicability) to the unique component. This could be conservative or non-conservative, but an appropriately high error factor is assigned.
[This does not apply to this LAR.]
Use of spare equipment No use of spare equipment is currently, credited.
Design or construction flaws This is an unknown quantity and cannot be accounted for.
System capabilities (flows, capacities and so System capabilities are verified in modeling.
on)
Flow diversions Significant potential flow diversion pathways are accounted for in the model.
[This does not apply to this LAR.]
Treatment of instrumentation required for There are four channels of instrumentation, operator actions which receive power from the four independent vital AC channels. Loss of all four is modeled as a secondary cooling failure, since the operator has no indication of steam generator inventory. This would be a highly unlikely situation. The Channel C and D batteries are expected provide power to their associated vital AC distribution panels for more than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> even under Station,Blackout conditions.
Alternative systems Available alternative systems are appropriately modeled.
[This does not apply to this LAR.]
34
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Source How Addressed Offsite resources Off-site resources (Technical Support Center) are credited in the PRA model with regard to improvement of HRA values due to additional checks that the correct actions are performed.
Physical resources, such as equipment repair or substitution are not credited. This may result in a conservative estimate of CDF or LERF, since Emergency Response Facilities are generally fully staffed within two hours of declaration of an Alert or higher level emergency.
Alignments The failure to restore a component or train to service following maintenance is explicitly modeled.
Active/passive failure mechanisms Reliability data include failure mechanisms that.
are applicable.
Active/passive degradation mechanisms These types of degradation are beyond the (corrosion, erosion, inspection detail, hidden capability of PRA. Degradation is expected to flaws, aging, and so on) be detected through periodic testing and monitoring programs.
Dynamic system response modeling limited by Only discreet failures and recoveries are Boolean logic models typically modeled in the Palo Verde PRA. This generally results in conservatism; the main reason convolution techniques are used in some PRAs is to reduce conservatism and obtain lower risk results.
Operability of equipment in beyond design Environmental conditions are considered when basis environments crediting equipment or operator actions in the PRA.
Operability of equipment given a loss of room Environmental conditions are considered when cooling crediting equipment or operator actions in the PRA. Palo Verde's ESF and AF pumps have been shown through engineering calculations not to be vulnerable to room heat-up during the 24-hour PRA mission time. However, electrical equipment and instrumentation in the DC equipment rooms and the Control Room are modeled as vulnerable to high temperature, thus dependent upon HVAC, which is appropriately accounted for in the modeling.
Operation of pumps without flow (for example, Minimum flow recirculation requirements are deadheading of low-pressure safety injection considered and modeled where appropriate.
pumps in small LOCAs)
[This does not apply to this LAR.]
35
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Source How Addressed Water hammer impacts on system This is not accounted for.
performance
[This does not apply to this LAR.]
Multi-unit interactions Palo Verde's three units are completely independent of each other, with the exception of off-site power supplies and grid interactions.
Common cause failure of groups (intra-system Intra-system common cause is modeled in and inter-system) accordance with NUREG/CR-5485. Inter-system common cause is not accounted for.
Time dependence of system failures due to Systems on which other systems depend are system interdependencies or environmental modeled according to their capabilities, both in conditions time and expected environmental conditions.
DC power dependencies on chargers and The DC busses are currently modeled as batteries requiring either the battery (for short-term power when off-site power is lost) or requiring a charger with the battery to act as a voltage stabilizer for the charger (for longer term, following battery discharge); i.e., the energy in the battery is not credited long-term, even if the battery was not discharged.
Subtle interactions (NUREG/CR-4550 Vol. 1)
There is no documentation that subtle interactions were specifically investigated during construction of the original fault trees.
However, the methodology of NUREG/CR-4550 was followed in model development.
Furthermore, over twenty years of plant operation has contributed insights that have been incorporated into the fault tree modeling, initiating event updates and failure data updates.
The gaps in documentation are associated with system notebooks which have not been updated to facilitate peer review. However, the notes in the Risk Spectrum PRA model file provide a suitable alternative to the modeling assumptions information in the system notebooks. Also, given that most sources of uncertainty listed in the above table are addressed in the internal events PRA model, and those that are not addressed are typically not addressed in any PRA model, we have high confidence that the Palo Verde PRA model is adequate for this application.
In the Level 2 area LE-G4, key assumptions are in two engineering studies documenting the Level 2 analysis. They are also presented in the Risk Spectrum data base memos linked to the appropriate model parameters. Key uncertainties are not impacting this inverter application due to the large margin (a factor of 300) for LERF increase versus allowable increase.
36
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response The LE-G5 deficiency of not meeting Cat II was addressed in the response to NRC PRA Review RAI Question 10.
NRC PRA Review RAI Question 12 It is unclear how the cause/effect relationship was modeled in the PRA for this application. Specifically, with the inverter inoperable, it is assumed that the associated instrument bus is energized from its backup alternating current (AC) power supply, and that this power supply would then be subject to random failures. This seems to be contradicted in Enclosure 1, Section 3.4.4, in the discussion of the static transfer switch, where the submittal states that the operator action for aligning the backup power is set to "TRUE", which would indicate automatic failure and de-energizing of the associated bus. Clarify how the PRA model was modified for evaluating this configuration. If the bus is assumed energized from its alternate source, confirm how the TS require this configuration.
APS Response The HRA for aligning a back-up voltage regulator for a second failed inverter is set to TRUE solely for the purpose of obtaining a conservative risk result. Thus, the situation modeled is one voltage regulator already supplying one vital AC bus (complying with LCO 3.8.7, condition A) when a second inverter fails, thus requiring alignment of its back-up voltage regulator. This is not really a meaningful scenario, since the unit would be in LCO 3.0.3 and would be required to shut down. However, it points out that even if the manual transfer switch operation HRA failure probability was. high, the risk significance would still be -very low.
NRC PRA Review RAI Question 13 Identify how equipment unavailability other than the inverter was addressed by the PRA model in determining the risk metrics for this application. Specifically, also address any PRA assumptions for the proposed tier 2 restrictions on diesel generator (DG) unavailability and Reactor Protection System (RPS) and Engineered Safety Features Actuation System (ESFAS) channel maintenance.
APS Response In accordance with Regulatory Guide 1.177, paragraph 2.3.3.1, random maintenance events are included in the fault trees for all components. It was assumed there could be
. maintenance occurring on any other system allowed by the Technical Specifications when an inverter is out of service. Thus, the analysis is conservative; since it is unlikely the components of greatest importance would be the ones that are unavailable concurrently.
37
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC PRA Review RAI Question 14 The proposed tier 2 restrictions on DG maintenance and planned RPS or ESFAS channel maintenance, applicable for planned inverter maintenance activities, are proposed to be included in the TS Bases, rather than being restrictions of the TS action.
APS Response Responses to each of the specific RAI sub-questions are provided below.
NRC PRA Review RAI Question 14a It is not clear why equipment operability requirements for a permanent TS change are being proposed to be placed in the Bases, rather than being placed directly in the action requirement. If Action A.1 of TS 3.8.7 is in effect, and a DG failure or RPS/ESFAS channel trip were to occur, what action would be required to comply with the TS, given the proposed TS Bases? Similarly, if DG maintenance were in progress, or if one or more RPS/ESFAS channel(s) were in trip condition when an inverter failure occurred, what action would be required by TS? Further, the licensee has not made any formal commitment for these tier 2 equipment restrictions. The licensee should clarify the intent of the proposed TS Bases changes with regard to plant operations and regulatory commitments.
APS Response The proposed Technical Specification Bases statements (Page B 3.8.7-4), related to administrative controls on planned maintenance, represent a defense-in-depth strategy to provide greater confidence that vital busses will remain powered during periods of planned inverter maintenance and are not 'equipment operability requirements.' The administrative controls, as a practical matter, will have the effect of reducing the potential for a loss of vital bus power and limit the exposure to various potential single failures during planned maintenance. The technical basis for the proposed extended Technical Specification 3.8.7, Action Completion Time of 7-days, however, as described in the response to NRC PRAReview RAI Question 14.d, below, does not rely upon these prudent administrative controls.
The Technical Specification Bases statements are not intended to modify or take the place of the Action requirements. These administrative controls are not equipment operability requirements, since Action A. 1 is entered whenever an inverter fails or maintenance is performed on an inverter (whether planned or unplanned), rendering the inverter inoperable. The existing Technical Specification Bases (Page B 3.8.7-2) states:
38
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response OPERABLE inverters require the associated AC vital instrument bus to be powered by the inverter with output voltage and frequency within tolerances, and power input to the inverters from a 125 VDC station battery.
If Action A.1 of Technical Specification 3.8.7 were in effect (i.e., inverter considered inoperable), and a DG failure or RPS/ESFAS channel trip were to occur, the vital bus would remain powered from the off-site power source and the affected RPS/ESFAS channel which tripped, would place the RPS/ESFAS closer to an actuation signal, based upon the number of channels that were tripped or bypassed at the time. The failure of the DG or the tripping of the RPS/ESFAS channel would not change the Action requirement and Completion Time. The Technical Specification Bases statements are not intended to control the Action requirement or Completion Time.
The plant would remain in Action A.1. It should be recognized that Action A.1 contains a Note that LCO 3.8.9, Distribution Systems - Operating, must be entered with any vital instrument bus de-energized. Should there be an additional loss of off-site power or a loss of the regulating transformer, the individual vital bus would become de-energized and LCO 3.8.9, Action B.1 or D entered. These Actions require restoration of vital instruments in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or plant shutdown in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.
Similarly, if DG maintenance were in progress, or if one or more RPS/ESFAS channel(s) were in a tripped condition when an inverter failure occurred, for Units 2 and 3, the static transfer switch would transfer vital instrument power to the regulating transformer and Action A.1 would be entered, since the inverter is inoperable. There would not be a loss of vital instrument power. For Unit 1, however, there is no static transfer switch, so the vital instrumentation supplied by the failed inverter would be de-energized and Technical Specification 3.8.7, Action A.1 and related LCO 3.8.9, Action B.1 entered, due to the vital instrumentation being de-energized. Again, the Technical Specification Bases statements are not intended to control the Action requirements or Completion Times.
The technical basis for the proposed extended Technical Specification 3.8.7, Action A.1 Completion Time of 7-days, as described in the response to NRC PRA Review RAI Question 14.d, below, does not rely upon the Technical Specification Bases described administrative controls. The controls are not credited PRA equipment restrictions; rather, they are prudent defense-in-depth strategies.
The purpose of placing the discussion of planned maintenance in the Technical Specification Bases was to place this prudent control in a licensing basis document (controlled under 10 CFR 50.59) that is readily accessible to the operations and work planning staffs. Consistent with NEI 99-04, Guidelines for Managing NRC Commitment Changes, APS is placing the commitment to implement the additional administrative controls for planned inverter maintenance in a licensing basis document. Specifically, NEI 99-04, Section 4.2 (page 8) states, in part:
39
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Licensees who employ a formal commitment tracking system. may choose to remove items from their tracking systems upon placement of the information into another licensing basis document.
As such, APS will be committed to implement the additional prudent administrative controls for planned inverter maintenance.
NRC PRA Review RAI Question 14b As written, it appears that the restrictions only apply to "planned" inverter maintenance or other activities. The licensee should clarify the meaning of "planned" with regards to the applicability of these restrictions.
APS Response "Planned" has reference to routine scheduled preventive or corrective maintenance. It does not include emergent corrective maintenance resulting from component failures or other design or operational deficiencies that may be identified during the course of plant operations.
NRC PRA Review RAI Question 14c The restriction on application of Action A.1 of TS 3.8.7 apparently applies to any associated DG maintenance (planned or unplanned), but only to planned RPS/ESFAS channel maintenance. The licensee should clarify its intent with regard to the planned/unplanned unavailability status of these components.
APS Response As previously stated in response to NRC PRA Review RAI 14.a, the Technical Specification Bases statements describe prudent administrative controls, which do not restrict application of Technical Specification 3.8.7, Action A. 1. The objective of the Technical Specification Bases statement relates to 'planned' maintenance, and as such, there was no intent to include 'unplanned' maintenance on the associated train diesel generator within the administrative control statement. For example, should planned inverter maintenance be underway and a need for corrective maintenance be identified on the associated train DG, there would not be a PRA reason to delay the emergent DG maintenance until the planned inverter maintenance activities were completed.
The Technical Specification Bases will be corrected to add the word "planned," such that the statement will read as follows:
Planned maintenance on the associated train Diesel Generator (DG) 40
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response NRC PRA Review RAI Question 14d Clarify how the risk analyses addressed these proposed TS Bases equipment restrictions.
APS Response The risk analysis did not take credit for any of the proposed tier 2 equipment, restrictions, since they were not derived from the PRA results as necessary to meet the Regulatory Guide 1.174 or Regulatory Guide 1.177 acceptance criteria. The tier 2 restrictions were derived from defense-in-depth considerations. Thus, random maintenance events associated with the tier 2 restrictions were not excluded from the risk analysis.
41
Enclosure APS Request to Amend Technical Specification 3.8.7 - RAI Response Attachment Simplified One-Line Schematics of the Vital Direct Current System and the Vital Alternating Current (AC) Instrumentation and Control Power System 42
LtO
- Al
~02.0 00
..I C.-
c o
I-DCI c..
I I
-T.00-2.32
-00101 00 0.0 i.
L-- :Fooso 1 -
1-1 CC C-121 Or Or 1 Or O-Vcr OrT-Or 1
}
t 01000..
Ii
~
0200--0I 203000 1250 0C 000 0 0000-0 i---
I.I
--- -F--
-ICSW 110 -ACI 01 0 0...
.1
- I SIA I 8AITEIIES
-T.
o-
- 2.
-0 'ViTIC'EIE 1"AP-W ICT I 1-- 11-- ST NITI.
Y-11 IR.
Cýý-RS Cýý -;TAII
.. I.
PEI Cl.-
ýT NUCLEAR SAFETY RELATED
I
)002 1
T.I-222I III I~022022 I
II
- 1..
-iI L2I____
Ii000fl&
1/200.0 2
2_
2
,,.',20021 00 I
--- =i.
-U*Yr**CT-O
-CEN.
'r C
27A E.
1-22 A. I.
o.... L.- --
_, - _- --o~
11-.
2 ITI
- 21.
-T
- I-.
2-0 000=0 I 2 L00
%..IIE.-
I I
10I0%2I0 Ns N-Cfe
=N N
N; 0-I Z
OJF.2220 2S III-AI 20 -2 A
2-200 A0 0 2
,2_20 o,
2n-2-1.00 h00202 222-0202 _L
_.,E-2 1-00 02-2211122020
.0,4 1
n22222A LE I
- ~L-200-
-,4 00, 2222002 P......
0 L0220 2-2200 000 00-714
-FT 20.20-022 Bi 200222 I
-A
-R I
IA A-2 I
-T 3220222 2,2020020 10022120222222221-12.2 LI 0 00-0-222 --
0 2
02-220222 222-22202
_T II
~02 2 22o 00 I**se*
A I
r*K 4*
1*
I
- AI I
- ITH
- 21. 1
-1 0 1 -
I-0 T.
',I" I
2-000 I
000 22 I
000220
-E-
-D2 00 0022000021
.20220000-0222.`000 I
22222222 0202 2220022202
- 7TO I-T Ei~Ii 0 22 I ~ ~
~
111" A
002202200S.
-A!
622202220.22220 2AS 200-
~
~
~
1 AI 22.C I022220 22222 20222 022222
[.
22-22 E
0
- F 8
05NIZWIY lD
- .,E
,*J
-11 T.?
A 10222202222022222 TO P-002.
,2 0.0 ER I.
A-LA;'_-"--
'A'
.BE -TE B
'B-
-R-EE
ý-L 1-T-
. ý _ ý _ ý _ _E, I
NUC2LEAR SAFETY RELATED LOAD GROUP2 LOCATED IN CONTROL REDO EL 100 Dig2al-S2o2202 C
g-d~ooe by:: o"i ichordj A D05R)
SINDLE LINE DIAGRAM 220 Dote: 02/ 7 1200 4 AC CLODS 0. POWER SYSTEM IL..1.Re A IG R
2 EUNT G0RDONDED VITAL INDTR AND CONTROL A
002.
FIE RENOTDISTR PANELS 1E-PNA-D25 & 1E-PNC-027 LOti-:
PV NG
ýPALO VERDE 02 022 222202 2
022222-22222 222N20 U20CLeaR 0022N22RT0020 STA.TION 0E-N OD 24
£ I
2 o
I a
5 I
I
DO III
_A, 050CC Cl A2 r
Ii JOOS 51~I A
LOA 0
1-00o.so 1
L -
7-6 0 -
-000--
IýI 200 OROC 0
I ~
~
1 CS0010C E60C60LC I
I FsAC-OCOLM 00-1CC0 01 I06 I-TR lT
-L I
AI-'E
-ARE----.------------
060000000001..
.6-..OCCS-CE-1
-1 0
-I CCCT 09 C0C0-60 0
2-161PDIIPI11
~
2--
"90057 60000 111-12
-flo 601006600
-'co
'T coooooo-ss-S
~
00000 06-00000 0I000 LOA o~
o o -
L
-j T
06500-660000
_,02 4oo4 E
2--21r21ooA.
- _DT, 3/4-Oll I
000006 AO.,0 1201.C0C0--C-0 I ~
o-0-so-oo 1560 LE--0000 0600C000R CCOTA
-0 05 IT0000 60000
~
~
~
~
LLO RAE Ll-0010090-C-5 AAOýZ020060 I
00-4-915,.-060 I-- N -I.
50001 500c600 A000-0 L IL A I I
SI 0 LOAD
. LOA 1 I
~
C00 -000-0'
- 0 0-0
- 16) 0000-0 1
21 DISTribUTION P&*L TA*[F F*R *AR[* BL*K DIAGRAM 00 00015o 00 K-n 3oo
- 60. 0000..
AL 0065 Lý 061I
_700 A
'El -- I D00 I
506500
)
I
-ý EI.,D I0.5006.0160I 1
I601.0E Io5004\\
TOE I000 SIC T
o I. so I s 001 o
1600600I.
0 0
1 L - -
0006 %0000000000 21+/-
A I S5 EN DSAET oIIRE A 'LI
.... TE _
I.
00002-..-C.-1
-AR
-~I I-A 00 6- -
O 2I 2 -E*>o
'sss ARCESS *0.ET. VE IAEAJ ARR S211 11-1-C02A LC I O
2
-0I
-RE 00 1110ACR 01 I1E1.060 A
"721 04 6050 50000 FU.CTIO.AL TA"Ll CODE ES--ZTI..
I...... ID
.2 001.6010 600ALL 1
DE 1HJ1 1111 1NV ED*
D-Cý B A WITH TIEAL TJK*FO TA"T P***
- P20, LD.OA~I A5 0
II.L 2 '-
R 2-210 0-2
-000 1 001000000 60~
I 0.0- 0009-0 1000 01 100110 0--06-0 0000 2-212A00 0
00D ALA 000.
IrOýCOLI SRT IRE TABLE IOR I*
CABLE AAADE.
I :A*
- L-r CAPEL N'*I
-ED E*ER 1.' YD...
_E N
I.E L.
.7!1*
SE-A I*A BAL KII
": I 1NS ALEEE AOS T, 01 A 5 5D A
rTýýr I-p
.2 1:ýýI'T T1. EýICA
'ALEI LETTERC"
- ^' '"""
iL.
-I
-TE 2E--
U.2'VTL NT TTON**N*
NUCLEAR SAFETY RELATED LOAD GROUP 1 II LOCATED IN CONTROL BLDG EL 1OR' [
DRO...
AEFE.-
I
-- ~~~ ~~
D'Cy~od yos hood 4(2 0518)
- =
Dote: 021t8/200U 1C~
L R--o
/A SIGN) TOE 0R NOT
~6 REOUIR 0.
~-
LOGRioO: PVNGO J
SINGLE LINE DIAGRAM 7120V AC CLASS 1E POWER SYSTEM UNGROUNDED VITAL INSTR AND CONTROL DISTR PANELS 2E-PNA-D25 & 2E-PNC-D27 NUCLNAR GRE]RATO*G STATO 02-E-PNA-O01 I
___O*CPK-O
- D C O-e-DN OO
.- A N
C N C- ----
CN-PNNNDDI C
SDOD -C-L
-IT
?.....
D,':
-*0I ISS NO SNfeT NCNT*E O-NCDON*-~
L I 1C1-N-NýC Al' S
- O C
C O CNDD I
I ' ND CF--
T.,0 ON.
C N T I P1CC CNLIECINC I
C 1_
I.CC CID
-D.
1D I
T. G i
-o
ý. ýA' 2ND! -
I2 1.D-OIO-.-CINI P1 NCC.I-PD-DD I Is -EENC' I
NISssI 0,c,oSFE.T1_feATURES I
I2.-D I, All R11GIA *I'l O*
2_*5 CNDCNCFC-C------N-----N-NDN.
D C ~ 2ON N-IAC ND CC C C N
-~
NONEC CNN CNP-CNCD 5.REE R 110 Cl
_CCOREI1-11 c,-- -
21 21 IA-o7oS o, -o 329-21o
-i
- ~
P-
.:5!-:?:]
.....Il IA
-1RIITITIA CT:
PCDCFCNCC9CN 2 ~ D-SCCDNCJNC
-I I 2NDCN C
N NFC-N 2-211.
-RIN O
CNNI. CCCIC1NCC N
___CCNLCNCNCT.-
CR 1 C!DCL IC CIT DNN LCCNNNCPNC I
I..T-C 2-01JCCON ACCAANN..L N.
- 9
- D-j LC-CCCCCCLCCCC1CCCRDIIIOC
~
1Ci~::CC~-C
]NNNCD TDCC IDCCNC A-LOG YZ"
-ýL III
-AZL -
I I.1V OTAGI
-1&-
-TNCN IC- -- E R.S I-101C 1NN.DCONCCCC0 II
[NCCC-CD NC ICNCDD IC IN-IC
-AC 91CC R.
.CCCC I I ký I III TlBLE III SC*
=*LE E--R DE 2712 Cf
-s--A 11
-21
-I
-42;-.--R
.1-71 1 2 271 2-212 NN I 11I-
-E
.CCCNCCD0 N
C
-N COCNCPNC-PC-NCN CON N LE -T CCC T CC~CC-TN C
IT C
-CCOO0 L
,E.
L_
Ol CN CPCCC R
L.-...
-OTI CNN RCCC!CC CC C C
2-CNCCCNNC.
NCC O
-TE II-0 RI, C-.- -
-C
~ 1
~1~
I El IT AB-A-1 eBI-ss
-CF 14 C IDR 1-1 II-AL IIES REIEI 11 1-1 II-E-, -1 T--.
IT.
I-A IA-11 T"I 1ILE I III I.IAII
=-
24-
_T_ _.TI I,
ý "I A.. I I. I I.
I.All CA!L -A L II I-RE.
'OLL._.A..IL 1-14 1ILL-
- 1. ; I" I!%TI, CIAIýIL
-I-RI'll III.
-TI.. -0 Iý.
JAI L 'A
-U-RD RI.T.
-IE LT_
31-PII-127
-SE-IT-CON,,DE I1111^nIjET-%R I.D T. I__
RED "I
I" RA.ELD I"
NnL.TEI -T K REýýKEVEE6.
TI A -AND
, I. T-I-EL 1 10 RIILICT T.E Al IlILT Co___
I. -D-DED VIT.1 I-1
_TITIDýtý,IýýLT-I -110L T -
.. T"'
-T 1. -ALI1 C.
S`D-- I.
11 E-ER1
-TT-
. T--
T. I -
ýI IN. IATE, I
NUCLEAR SAFETY RELATED 1020 GROUP I LOCATED IN CONTROL BLDC EL 00ISNL IEDCR IGO C..
.Z Digitaly C
igned by: ra--
Manuel F(Z02416)
E LINE
-CA
.Date, 02/322005 00 20V AC CLASS IE POWER SYSTEM eate:02 3/0 S 1
C.
NOT REQUIREDUNGROUNDED CITAL INSTR AND CONTROL Reason: IN/A. 016ATURj NOT RE UIRED010STR PANELS 3E-PNA-025 & 3E-PNC-D27 LwOioRn PVNGS PALO VERDE CNTCCUCNAIO 0N-C-P C.
NCN C!9C-C CCC CCC NN-C-CC-N-C.NUCILEAR GENEIRATIG STATIN O3-E-PRD-OOI I
F-
_ i --
i -
r II -.
EII F 0..
.209-E
-15E IE-9B025009050000 920 E'DO IAFEO y FT5.1-S 29-...
-00
-0_
029002 c,
,*-z
-l I 09 01-2-009-00 2-002
'OR...................
Sm ~
~
~
D -
uumE.m I~
20020 1
II I
I F
0205201 020000LE0 Ii~~~L
-00252 2
2-9-19-22 II
- 200252, 99005 02000 I
2529.1.
1 I
090 Ij 15100
-I -
9
-I ILT
- R I
IE 01L 0- -
0.252---
2 I
N 5..
2-02..
1 A2052 U.
)2 RI.T IAIW R10.tA 2
52E 01TE00 I
.02-1-T~C IRI I -
1)A 0
_2 GI Z
-E N2 0
2-2.0 GýRT2 E-I
-~~~~L--------- -----
I0059 5550 RD929 152-GO 1
0 200502T91 GI.
IIR 090 0L092-0
- 12.
P G91l.95100 90- G,
-E GO 2902 0
.90 0 0 0 2 0 0 5 2 120501.
1 292-290929-0290
- 2!
GA%ý20220095205Z5-02 1009 25 00500 499990000120 21--02900 0901-0-E-0 I29252020 00
-2I-002-9 S-
-I0!2-S 00 5
02 o
0 I-T0500 I~lI PG TR 111 TR1-29-02-615 I.-9 4500E 59 12022123 02ER 2-2
-D.2O 0
05-0-9091týT-001 E
-2.200905490 A2
- 0
-0f 1-3 -
5
- -22 9
~
95000 3020202210CCGE FR..o 029D I ~T0(
M%0 I 201951000 I
IRF SO 1
-E DER01 TI..
35 01.0 Tiylo~
-5 7.110_L 01 SII0012 029 01 WAR aoO 019 G91 OR T.E G 11 A
1.0.N R.
1-1 11-
-1 lAll CIT
-11 IITI I- - -
T,_FOR j.T F_ 1=1 IT.
TRIP 1.
-,T.........
09.......
1 0
2-E l20202S2 0519220-1 0 1 021-250295 01 0052020 5109 29S I0 Al000000 102 ~ ~
~
~
~
E.020-0 1._
I040S9 G15 009
.E.0 10-299-0121 L
ý R-so, 5 0 9 29 1 0 0 1 2 0 0 9 0 2195 5I.
A R-R.-
E.
ITT-1
- 1TR oltz tZON I ~
e eU!lt PNG2 Se IC*E-....
1
- 10. T-SE 1-1*.
-E L-*Oll
%eS 11
-DGTE
- 1.
I
- 0 C-.S,E_-C. e..
L IJ
- uoovT.L I-I
-EIT.T %
-OT-OU
- 2.
GEE -IE 1.
ll-ýTALII ITI;Z=l 1*. C_
_..,ZDED ý I_
T.ý OISTl-T-I-
NUCLEAR SAFETY RELATED LOAD GORUP LOCATED IN CONTROL BLDG EL 100'
=:4 TRIT1D iltý 10 SINGLE LINE DAGRAM DaIe: 021 700UNGROUNDED VITAL INSTR AND CONTROL 050T AR0a sURED.
DISTR PANELS IE-PNB-026 & IE-PND-D28 PALO VERDE
-E-PNA-002 012
~ ~
~
~
~
Nc
.0.0
.022
.12
.0
.3.C9A
.NATOO SA-TIO 01EPN-0 12
- -- 4
I*TH I
I I
I I
I I
I I
I
-*" FT'rT'I I
I I
I I
I 7I I
I I
I II III CC C
CCr A._.
14 CCDCCCCýVCCCCC1jCC-C~w CC I
w CCCC CCC C
0kC.I~
S i
I U
S U
S S
C -
CCC 0A 9ý0
.... L.................
- L.
- C-C.- C, ii:'
_::-C C3/4-.. ;_ ::...
CuCI CCC p
LOGIC CAI T
TI-A.
C C C N
4
~
IL~~~~
~ ~
jCCCCCICC EC CCCCCCCCC-:rCD G*
T.
- 1-11..
- ýI.
=
Tll 1.
-27" CA DT ý CC CCC CCC CC(.D, 0 C CC C E
S Sj 0
S 0
0 I
0 CCDCC.CCCCCDCC CC*C CC CC DCC CCC C1
!T lrll:jT
^T CCCDC 0 DCX NCCC CCCCCCC CC
-F-C~6 I
El~~
CCC II n IlC CC CCCCCC CCCC C
NCC~
- momr.
- ,C
- :L A_
_'T C-C:-7%'
C-1-111.
1-
ý ---
-Al l.
-T I
.,!E"I.ER, D......
I' IýrL
-E-I..
T. --
T.
L-All-C 1.
N T;:_
'ECCCC 1--C 1
CCCCCDCCCCC -10C23ODC C-.O--CECCCC.-
CCCCC CCC C CCC CC CCCCC CCC C
-*C-C~:CC-CCCC NCCa P-1 C.
T..
I-AT..
.CC21CO.21 B
~1 NUICLECR S
O'ETY RELCTEO LOAD GROUP 2 LOCATED I N CONTROL SLOG EL COo.
I I...
C ligially igned by Ramir, David 477084) s2V S
.INGLE IC ODCCGRAC
=M ae: 0 5/2005 12:00:54 20R CA CLCSS CE POCCEC SCOGEC Resn SGA 1JRE El NIA LCCTUNDCEO CIOCL ICCO Sd0 COCTROCLC C
- 0. SIGNA RES E N/A 01CR PACELS 2E-PNB-028 &, 22E-P-028 Z=CCC Locat ion:PVNGS C,.
CCC CCCCCCC I
IC.-
CC.CCC JCCCCCPALO VERDE C
CC CCC CC CCC.CCLCA CRIDC S-A-IC 02-E-PNC-5021 14 A
R 4,
A
2.-; 22 EP.-0
- o-
- 2. I
.22
.~ ~ ~ ~ ~ 2.
.24 322222b
...' t- -1 2-C o B...
CC..
... _ C_
2 22
.22 2
0-----
2 - -- - -
22222222522 B
331o 22232.....
E2222.1)1 2I
-.".E 2
2 3 2 12T.2 D AT-2232.1 U
A S
A A
A 13 I --
-- _ _-E
AUX CA9!nT
-EEB..
-T-C.11-T 2-261.
I~
T E-J 3),22o,-25 B,.
2"-
52 222222
'i**i-22 22 2 52' 2-2 1
22-2-52 BT 2222 2522
-22'~'2-a-A2 22 252222 1 22-2 2
2
.V 222222 2 2
____s_--
S-TE.
0 2 2 x 2 2
225222 2222222 22_
,22_2 _
- ~
23-CABINET BE22222A2 I
I 222222-Dt272-A S
S U
A A
A 2..
2.22 q3/4fl S522222 T E222 22222251222 2-.E-2222222 222222222222 ZJD,*
.1 Lt)ýý
.L I C 0-Ll" ýAAC_.
L IC -%
L 4R..6LBIC Bý-
'I WE
.. E
_C I
2222212 22-52 22-22A-T-
EB -
6-B IT. T-
ýB, _
I _ETC '_
.ý.-
B2 I~2A EL-22 I,"2 C.-.12222222222222 322
,:E22.2.2.2l2.
2222222222 01 5
2..
222222.2-2
,2 2 2 552-2 02262I I
IT-54FETY
-ECTI-5 BT-
_EL....
_,.,ZT
-22.-2.
2 ' -21 222220~
B-2-A12.1 "T-.-223--
5 2 2
C..2 B22222232222 2 ~2-22
--I El iT El El AllT
.M.'UCT
-TC.
- 1. 1.. LE c-1.1EE
ýE-T....B
_ -E --.
, 7--
Col.
- 2. A T-EE --
.1-AS.
E.I.11 E1-C1 B-TIC
- 1. 1~ FUIE-I.ITI.
B.ALL 11 T-P11E1.
- 11 CAL
-L BIýAC.24"ý.
AC.
C-..CL CA-.
1NT.
I'Al Al
-AT IAIII T, SIIAIA-BE T. BEI-A-
1 21 TO -V U-1T 1-1CE 1. B.T11-1 SBLAII.. OE":A:' '-."
`B
'E 7-C".
12.V -
C-11 C-EL I C-T-NUCLEAR SAFETY RELATED LOAD GROUP 2
-TED IN CONTROL BLDG EL RDI0 i
SINGLE LINE 0IAGRA.
122V AC CLASS IE POWER SYSTEM UGNROUNDED VITAL INSTR AND CONTROL DISTR PANELS 3E-PNR-DO6 & 3E-PNT-D28 G3-E-PNA-D02 12 I
Ir 0i 4
3 2
03EP*OOD*9GN l