ML102571398
| ML102571398 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 09/03/2010 |
| From: | Hesser J Arizona Public Service Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 102-06248-JHH/MEP/CJS, TAC ME2337, TAC ME2338, TAC ME2339 | |
| Download: ML102571398 (11) | |
Text
10 CFR 50.90 LA M
A subsidiary of Pinnacle West Capital Corporation John H. Hesser Mail Station 7605 Palo Verde Nuclear Vice President Tel: 623-393-5553 PO Box 52034 Generating Station Nuclear Engineering Fax: 623-393-6077 Phoenix, Arizona 85072-2034 102-06248-JHH/MEP/CJS September 03, 2010 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001
Dear Sirs:
Subject:
Palo Verde Nuclear Generating Station (PVNGS)
Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Response to Second Request for Additional Information (RAI) -
Request to Amend Technical Specification (TS) 3.8.7, "Inverters -
Operating," to Extend Completion Time for Restoration of an Inoperable Inverter (TAC Nos. ME2337, ME2338, and ME2339)
In accordance with 10 CFR 50.90, Arizona Public Service Company (APS) submitted letter number 102-06069, dated September 28, 2009 [Agencywide Documents Access and Management System (ADAMS) Accession No. ML092810227], requesting an amendment to Operating License Nos. NPF-41, NPF-51, and NPF-74, for PVNGS Units 1, 2, and 3, respectively. Specifically, the proposed license amendment would revise Technical Specification (TS) Required Action A.1 of TS 3.8.7, "Inverters - Operating," to extend the Completion Time for restoration of an inoperable vital alternating current (AC) inverter from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days.
In letter number 102-06209, dated June 24, 2010 (ADAMS Accession No. ML101880263), APS provided responses to the NRC staff Request for Additional Information (RAI) dated April 20, 2010. On July 15, 2010, the Nuclear Regulatory Commission (NRC) Staff provided APS a second RAI to assist in the evaluation of the license amendment request.
The enclosure to this letter provides the APS response to the NRC request. The basis for the APS determination that the proposed license amendment does not involve a significant hazards consideration, under the standards set forth in 10 CFR 50.92(c), is unchanged as a result of the additional information provided in this response.
By copy of this letter, this submittal is being forwarded to the Arizona Radiation Regulatory Agency (ARRA) pursuant to 10 CFR 50.91 (b)(1 ).
A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway
- Comanche Peak
- Diablo Canyon
- Palo Verde
- San Onofre
- South Texas 0 Wolf Creek
ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Response to Second RAI - Request to Amend Technical Specification 3.8.7 Page 2 No commitments are being made by this letter. Should you need further information regarding this response, please contact Russell A. Stroud, Licensing Section Leader, at (623) 393-5111.
I declare under penalty of perjury that the foregoing is true and correct.
Executed on 6b*p ft:*/
(Date)
Sincerely,
ý-
e& 56V' JHH/RAS/CJS/gat
Enclosure:
APS Response to NRC Second Request for Additional Information cc:
E. E. Collins Jr.
J. R. Hall L. K. Gibson J. H. Bashore A. V. Godwin T. Morales NRC Region IV Regional Administrator NRC NRR Senior Project Manager NRC NRR Project Manager NRC Senior Resident Inspector (acting) for PVNGS Arizona Radiation Regulatory Agency Arizona Radiation Regulatory Agency
ENCLOSURE APS Response to NRC Second Request for Additional Information
ENCLOSURE APS Response to NRC Second Request for Additional Information Introduction By letter number 102-06069, dated September 28, 2009, Arizona Public Service Company (APS) submitted a license amendment request for the Palo Verde Nuclear Generating Station (PVNGS), Units 1, 2, and 3. The proposed amendment would revise Technical Specification (TS) 3.8.7, "Inverters - Operating," to extend the allowable Completion Time for Required Action A.1, applicable when one inverter is inoperable, from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 7 days.
In letter number 102-06209, dated June 24, 2010, APS provided responses to the NRC staff Request for Additional Information (RAI) dated April 20, 2010. On July 15, 2010, the Nuclear Regulatory Commission (NRC) Staff provided APS a second RAI to assist in the evaluation of the license amendment request.
APS is providing responses to the July 15, 2010, NRC staff RAI on probabilistic risk assessment (PRA) issues. The additional NRC question numbers are based upon the APS June 24, 2010 response.
NRC Request - PRA Review RAI Question 3c (spurious component operations in the fire PRA model)
The response to this question states that potential spurious operation of components was analyzed, but does not provide any further details as to the scope of this review, criteria applied, results, etc. (It was instead stated that spurious operations are not significant to plants with hot standby end states - the staff does not agree). The staff needs to understand more specifically how this aspect of the PVNGS fire PRA modeling was addressed. The licensee needs to provide additional information on how it identified and evaluated spurious operations for its PRA analyses supporting this application, and what spurious operations have been included in the fire PRA model.
APS Response Single spurious operations, considered in the 10 CFR 50, Appendix R, Fire Protection Program for Nuclear Power Facilities, analysis, were also considered in the development of the Palo Verde Fire PRA. Of the single spurious operations considered, the one spurious operation that was explicitly modeled in the Palo Verde Fire PRA is spurious main steam isolation caused by cable failures in any compartment through which the cables to the actuation solenoid valves run. The other single spurious operations screened out. Multiple spurious operations (MSO) were not considered in the Palo Verde Fire PRA.
To address the RAI question, APS has performed an assessment of MSOs, in addition to the single spurious operation that was included in the Palo Verde Fire PRA. In order to determine what sort of multiple spurious operations of equipment might be relevant to having a vital AC inverter out-of-service, the following approach was used:
1
ENCLOSURE APS Response to NRC Second Request for Additional Information
- 1. Review the PRA model with Channel A inverter out-of-service to see what locations (fire compartments) would be sensitive to a fire under that condition.
- 2. Review the PRA model with the Channel B inverter out-of-service to see what locations would be sensitive to a fire under that condition. The Channel C and D vital AC buses only provide power to the Plant Protection System, and are not represented in the PRA results due to their extremely low PRA importance.
- 3. For each of the above two cases, consider what other equipment and cables are present in cutsets for those fire compartments that include the out-of-service inverter, and postulated spurious operation of other equipment that could be affected by those fires. The PVNGS Fire PRA Equipment Loss Database was used, which was developed for the Palo Verde Fire PRA and is documented in engineering study 13-NS-C049, Appendix B.
The guidance for consideration of multiple spurious operations is in NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2, Detailed Methodology, Section 9.5. This guidance was used to determine which types of circuit failures to consider. None were excluded, although this is not meant to imply that a full study, that would meet the requirements of the NUREG, was performed. In addition, a MSO study was done for PVNGS in 2009 using NEI 00-01, Guidance for Post-Fire Safe-Shutdown Circuit Analysis. The study lists MSO concerns that have been identified as potentially applicable to pressurized water reactors in general. Not all of the potential MSOs have yet been formally dispositioned by the station, but each of them was examined for this application.
The current Palo Verde fire PRA model (PRADATA.R19 fire CDF) was quantified twice, once for Channel A, once for Channel B, under the following conditions:
- 1. The Channel A(B) vital AC inverter failure event, 1PNAN11 ---- IN-NO or 1PNBN12 ---- IN-NO, was given a value of 1.0 (so that it appears in the cutsets) with the first character replaced with a zero in order for the event to appear first in each cutset, which allows sorting on that event in a spreadsheet.
- 2. The inverter transfer to alternate AC source switch failure event, 1 PNAN 11TS--
CB-FT or 1PNBN12TS--CB-FT, was set to FALSE, since the Channel A(B) bus would have been previously placed on the voltage regulator, thus could not have failed to transfer.
The resulting cutsets show that fires in six compartments contain the Channel A inverter failure event, and fires in seven compartments contain the Channel B inverter failure event. Thus, these are the only compartments where spurious operation of equipment would be of concern for the Channel A(B) inverter being out-of-service. The compartment assessments are described in greater detail.
2
ENCLOSURE APS Response to NRC Second Request for Additional Information Additionally, any effects were assessed as to whether they are more severe with the inverter out-of-service than they would be if it were available. This is facilitated by knowing exactly what functions the vital AC channels and their inverters support, which specifically are supplying power to the Plant Protection System. These include the instrumentation that provides the safety signals for actuation (in an any-two-of-four logic scheme) and one of two power supplies for cooling the balance of plant engineered safety features actuation system (BOP ESFAS) actuation modules. They also supply power to the current-to-pneumatic converters for the Atmospheric Dump Valves (two on each train).
The most likely means to core damage from a failed Channel A or B vital AC channel is loss of cooling to the BOP ESFAS cabinet, which if undetected by a temperature detector and unmitigated by operator action, can result in a spurious load shed of the associated train engineered safety features (ESF) bus with the inability to restore power. This scenario is of low probability due to the redundancy of power supplies, but is a high consequence failure. This specific failure is more likely without the inverter supplying the vital bus, since a random failure of the back-up voltage regulator or its power supply would result in loss of one of the two sources of cooling to the BOP ESFAS cabinet (the other source is the same-channel DC bus).
The first situation to be examined is spurious operations on the opposite train. A fire that affects only the opposite train from that of the unavailable inverter cannot affect the back-up power supply to the vital AC channel. The spurious actuations of concern for this application are those that could either be mitigated or would not happen if the subject inverter were available.
For the Channel B inverter out-of-service, the Train A compartments of interest are 5A (Train A Switchgear Room), 7A (Channel A DC Equipment Room) and 9A (Channel A Battery Room). 5A is inclusive of everything in 7A and 9A.
In the Train A Switchgear Room notable examples of spurious equipment response are as follows:
" Loss of control of the Train A auxiliary feedwater (AFW) pump and valves. The pump itself and the associated valves could be affected such that the operator would not be able to control flow to the steam generators (SGs), which could result in over-feeding of one or both SGs. However, this would require at least four spurious signals affecting three valves and the pump itself. It was determined that the control circuits for one valve in the flowpath to each SG are powered from a different DC channel and would not be affected. As a result, all valve control would not be lost.
Train A Charging Pump spurious operation. The charging pumps supply flow for auxiliary pressurizer spray, reactor coolant pump seal injection and make-up to the reactor coolant system (RCS). Its presence or absence has an insignificant effect on core damage frequency (CDF). The PVNGS reactor coolant pumps 3
ENCLOSURE APS Response to NRC Second Request for Additional Information (RCPs) are not subject to development of a seal loss of coolant accident (LOCA), so loss of seal injection or controlled bleed-off is inconsequential.
Auxiliary spray is used for cooling down to Mode 5. Since the safe end-state for fire scenarios is Mode 3, Hot Standby, auxiliary spray is not required.
High pressure safety injection (HPSI) pump start. The HPSI shut-off head is lower than normal RCS pressure, and Mode 3 is the end-state for all fire scenarios, so over-pressurization or lifting of low temperature over-pressure (LTOP) relief valves is not of concern.
Opening the containment spray (CS) valve, which could slowly drain the refueling water tank (RWT) into the containment building. Re-location of the RWT inventory is not a concern as the inventory would still be available for DBA mitigation, though fire-induced LOCA is not likely. The CS pump control circuit and spray valve circuits are not in the same fire compartments.
" Interfacing system LOCA from the letdown system and shutdown cooling isolation valves. Letdown has multiple isolation valves, not all of which can be disabled by a fire. No more than two of the three shutdown cooling isolation valves on either train can be affected by a fire in any compartment.
Furthermore, they are not designed to be capable of opening against full RCS pressure.
" Spurious power operated relief valve (PORV) opening. Palo Verde does not have PORVs on the RCS.
" Inadvertent operation of pressurizer heaters. This could lead to lifting safety valves if the power supply is not shut off or pressurizer spray failed or was not available. Inadvertent LOCA through the pressurizer code safeties is modeled.
" Spurious opening of reactor vessel or pressurizer head vents. At least two valves would have to open. Orifices severely restrict flow. This likely would not be a LOCA, but would be considered RCS leakage.
Inability to close or spurious opening of some containment isolation valves.
Except for containment sump recirculation valves, both trains must be affected; no fire can affect both trains. Open sump valves do not present an open path to the RWT or Auxiliary Building due to check valves and closed loop piping pressure rating.
" Spurious starting and loading of the diesel generator (DG). Non-sequenced loading can result in damage to the DG. This is only an issue if off-site power is lost. This represents loss of function and is currently modeled.
None of these events is more likely with the Channel B inverter out-of-service as compared to in-service. Nor could these events be avoided if the inverter were 4.
ENCLOSURE APS Response to NRC Second Request for Additional Information available. Spurious ESF actuations due to effects on Plant Protection System instrumentation signals or power supplies are somewhat more likely with a fire on the opposite train along with random failure of the voltage regulator or its power supply.
This is because it takes instrumentation signals, or loss of power, from two channels to result in an actuation. Spurious ESF actuations are generally not, however, an impediment to successful mitigation. As mentioned earlier, spurious main steam isolation is assumed for a fire in any compartment through which the cables for the solenoid actuating valves run (loss of power results in valve closure).
Consideration of the opposite situation of an unavailable inverter on Channel A along with a fire in a Train B compartment yields similar results, except that loss of control of AFW flow on Train B could affect the Train A (steam-driven) AFW pump if SG overfill occurred. There is a low potential for the pump control circuit (such that it could not be secured) and two AFW valves being simultaneously affected.
There is also the potential for a fire in the compartments associated with the same train as the unavailable inverter. Specifically, compartments 5A, 7A, 9A and 47A (Channel A Containment Electrical Penetration Room) for the Channel A inverter and 5B (Train B ESF Switchgear Room), 7B (Channel B DC Equipment Room) and 9B (Channel B Battery Room) for the Channel B inverter. A fire in any of these compartments can interrupt power to the back-up voltage regulator, as well as cause spurious actuations.
The opposite train is left intact, however, so the effects are minimal.
A fire in any of the remaining compartments of concern only affects off-site power to the back-up voltage regulator. Spuriously actuated equipment is not of concern in these compartments, since little, if any, PRA equipment is present.
In conclusion, any increase in CDF or large early release frequency (LERF) from multiple spurious operations while a vital AC inverter is out-of-service is minimal. This is because of redundancy in power supplies for the BOP ESFAS cooling fans, as well as the relatively low PRA importance of any individual vital AC bus.
NRC Request - PRA Review RAI Question 14 (tier 2 requirements in the TS Bases)
In the license amendment request section 3.4.5 for evaluation of tier 2 requirements, it is stated that "there is reasonable assurance that risk-significant plant equipment configurations will not occur...This conclusion is based on implementation of specific compensatory measures...". The staff interprets these statements to mean that if these compensatory measures on equipment availability are not implemented, then a risk-significant configuration could occur.
The response to question 14 includes the statement: "the Technical Specification Bases statements describe prudent administrative controls, which do not restrict application of Technical Specification 3.8.7, Action A. 1." If the statements in the TS Bases have no impact on the application of the proposed extended CT, then it is 5
ENCLOSURE APS Response to NRC Second Request for Additional Information unclear to the staff how the tier 2 restrictions, identified by the licensee as required to reach the conclusion that "there is reasonable assurance that risk-significant plant equipment configurations will not occur...", achieve their intended purpose.
It is also not clear to the staff why planned outages of diesel generators and instrumentation channels must be prohibited in order to avoid a risk-significant configuration, but unplanned outages need not be prohibited.
The licensee needs to clarify whether a risk-significant configuration can occur due to simultaneous unavailability of an inverter with either a diesel generator or instrumentation channel, and if so, to propose a tier 2 control which does assure the TS action is not applied under those conditions for either planned or unplanned unavailabilities. Further, if the control is not to be a note in the TS required action (this is the staffs preferred implementation method), then the licensee will need to justify why the restriction should not be in the TS action, include a specific regulatory commitment on the docket, and identify how the restrictions on equipment operability are implemented. For a permanent TS change, if it is essential to restrict unavailability of other TS components, then including such requirements in the TS Bases is not considered acceptable.
APS Response The Tier 2 compensatory measures specified in the submittal were based on qualitative assessments and industry precedence, rather than the PRA results. To answer this question specifically, APS examined the risk ratio for equipment taken out-of-service concurrently with a vital AC inverter out-of-service. The DGs and the Station Blackout Generators (SBOGs) are used to re-power the affected vital AC channel if off-site power were lost to the associated back-up voltage regulator.
The examination was bounded by a DG out-of-service, since the DGs are much more risk-significant than are the SBOGs. It also bounds the potential for multiple losses of vital AC that could result in RPS and ESFAS actuations.
If the CDF or LERF ratio approaches the transition to an orange risk management action level (RMAL), it would be necessary to implement Tier 2 compensatory measures in accordance with procedure 70DP-ORA05, Assessment and Management of Risk While Performing Maintenance in Modes 1 and 2. This is the implementing procedure for the maintenance rule (10 CFR 50.65), paragraph a(4), configuration risk management program. Both revision 16 of the PRA model (used for the original inverter LAR) and the current revision 19 were used to demonstrate that the result would not be affected.
The following table shows the combined internal events and fire CDF and LERF ratios for both PRA model revisions using the zero-maintenance model. Case 0 is no equipment out-of-service, Case 1 is both Channel A inverter and Train A DG out-of-6
ENCLOSURE APS Response to NRC Second Request for Additional Information service (OOS-PNAN1 1 and OOS-DGA). This is the bounding case, since Train B DG is less important than Train A.
I*M 6*CDF R R6 LERF.,
R19CDF *
,RI RI9LERF Case 1 8.113E-6/yr 3.931 E-7/yr 4.348E-6/yr 2.071E-7/yr Case 0 4.216E-6/yr 2.005E-7/yr 2.478E-6/yr 1.148E-7/yr Ratio 1.92 1.96 1.75 1.80 As can be seen from the above table, the risk ratio is less than two for both CDF and LERF using both models. This would not warrant entry into a yellow or orange RMAL.
Risk ratios for orange were 10 and 25 for CDF and LERF, respectively, for the older PRA model and are much higher in the current PRA model. These ratio values are associated with integrated risk over 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> reaching a conditional core damage probability (CCDP) of 1 E-6 or a conditional large early release probability (CLERP) of 1 E-7. Thus, no compensatory actions are required due to the PRA results, and it is not relevant whether-a DG outage happens to be planned or unplanned.
As described in the APS Electrical Review Question 5, PRA Review Questions 13 and 14 responses summarized below, the APS commitments documented in the proposed Technical Specification Bases are qualitative, prudent actions which are in addition to the quantitative PRA results. The proposed Technical Specification Bases provide greater confidence (though not relied upon in the PRA results) that vital busses will remain powered during periods of planned inverter maintenance.
The administrative controls are, therefore, not 'equipment operability requirements.' As a result, APS has not proposed the addition of these qualitative administrative controls as part of Technical Specification 3.8.7, in the form of a note, as suggested in the NRC RAI. These administrative controls are consistent with other licensees that have received similar extensions of the inverter allowed out-of-service time, as described in Enclosures 4 and 6 of the original LAR.
As described in the APS response to PRA Review Question 14c and Electrical Review Question 5, the word 'planned' has been added to the DG administrative control in the TS Bases, such that the controls now read:
Planned inverter maintenance or other activities that require entry into Required Action A.1 will not be undertaken concurrent with the following:
- a. Planned maintenance on the associated train Diesel Generator (DG);
or
- b. Planned maintenance on another RPS or ESFAS channel that results in that channel being in a tripped condition.
7
ENCLOSURE APS Response to NRC Second Request for Additional Information These actions are taken because it is recognized that with an inverter inoperable and the instrument bus being powered by the regulating transformer, instrument power for that train is dependent on power from the associated DG following a loss of offsite power event.
As described in the APS response to PRA Review Question 14c, the objective of the Technical Specification Bases statement relates to 'planned' maintenance, and as such, there was no intent to include 'unplanned' maintenance on the associated train diesel generator within the administrative control statement. For example, should planned inverter maintenance be underway and a need for corrective maintenance be identified on the associated train DG, there would not be a PRA reason to delay the emergent DG maintenance until the planned inverter maintenance activities were completed.
8