ML11145A088

Response to Request for Additional Information Regarding Severe Accident Management Design Alternative Review

ML11145A088
Person / Time
Site:	Watts Bar
Issue date:	05/13/2011
From:	Stinson D Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
TAC MD8203
Download: ML11145A088 (18)

Text

Tennessee Valley Authority, Post Office Box 2000, Spring City, Tennessee 37381-2000 May 13, 2011 10 CFR 50.4 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001 Watts Bar Nuclear Plant, Unit 2 Docket No. 50-391

Subject:

WATTS BAR NUCLEAR PLANT (WBN) - UNIT 2 - RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION REGARDING SEVERE ACCIDENT MANAGEMENT DESIGN ALTERNATIVE REVIEW (TAC NO.

MD8203)

References:

1. NRC to WVA letter dated March 30, 2011, "Watts Bar Nuclear Plant (WBN)

Unit 2 - Response to Request for Additional Information Regarding Severe Accident Management Alternative Review (TAC No. MD8203)"

2. TVA to NRC letter dated January 31, 2011, "Watts Bar Nuclear Plant (WBN)

Unit 2 - Response to Request for Additional Information Regarding Severe Accident Management Alternative Reviews (TAC No. MD8205)"

3. NRC to TVA letter dated January 11, 2011, "Watts Bar Nuclear Plant, Unit 2

- Request for Additional Information Regarding Severe Accident Management Alternative Review (TAC No. MD8203)"

The purpose of this letter is to provide a response to a majority of the NRC requests for additional information (RAI) regarding the Severe Accident Management Design Alternatives (SAMDA) analysis discussed in Reference 1. Reference 1 provided additional RAls based upon NRC review of TVA's letter provided in Reference 2. provides TVA's response to these RAls with the exception of item numbers 2, 3, 5 and 15. In addition, Enclosure 1 also includes responses to a few verbal RAls received after the receipt of Reference 1. Responses to the remaining RAls will be provided in future correspondence. provides the list of commitments made in this letter.

U.S. Nuclear Regulatory Commission Page 2 May 13, 2011 Ifyou have any questions, please contact Bill Crouch at (423) 365-2004.

I declare under the penalty of perjury that the foregoing is true and correct. Executed on the 13th day of May, 2011.

Respectfully, David Stinson Watts Bar Unit 2 Vice President

Enclosures:

1. Responses to NRC Request for Additional Information

2. List of Commitments cc (Enclosures)

U. S. Nuclear Regulatory Commission Region II Marquis One Tower 245 Peachtree Center Ave., NE Suite 1200 Atlanta, Georgia 30303-1257 NRC Resident Inspector Unit 2 Watts Bar Nuclear Plant 1260 Nuclear Plant Road Spring City, Tennessee 37381

ENCLOSURE I RESPONSES TO NRC REQUEST FOR ADDITIONAL INFORMATION By letter dated January31, 2011, the Tennessee Valley Authority (TVA) provided a response to the Nuclear Regulatory Commission (NRC) staff regardingquestions related to TVA's Updated Analysis of Severe Accident Mitigation Design Alternatives (SAMDAs) for Watts Bar Nuclear Plant (WBN), Unit 2. In its review of this information, the NRC staff requires further information and clarificationon TVA's response. The information listed in the following request for additionalinformation (RAI) refers to the RAI responses in the January31, 2011, letter.

1. RAIl

a. Provide the core damage frequency (CDF)and the large early release frequency (LERF) for the WBN Unit 2 model reviewed in November 2009 by the Westinghouse Owners Group (WOG).

TVA Response:

The following are the WBN Unit 2 CDF and LERF for the model reviewed by the PEER review team:

CDF: 2.89E-05 per reactor-year.

LERF: 2.90E-06 per reactor-year.

Truncation Level 1 E-12

b. The only difference between the model reviewed by the WOG and the independent plant examination (IPE)model appears to be changes made to resolve findings and observations. Describe the most significant changes made in the peer-reviewed model to obtain the IPE model.

TVA Response:

The most significant changes made to the PEER review model were: (1) the model was updated to address battery depletion so that all batteries were not failed at time zero following an LOSP; (2) a correction was made to the type code assignment for the turbine-driven Auxiliary Feedwater pump fail to start basic event; and (3) the condition of the steam generator after core damage was revised to link to the correct plant damage state.

4. RAI 2.a.ii and iii The response to these RAIs discussingmapping the containment event tree (CET) end states to release categories states (p. EI-37) that "Single linked-fault tree Level 2 End State gates are defined for each of the majorcontributors to each of the 4 Release Categories."

Describe what is meant by "major",what is left out of the quantificationof release categories,and the significance of contributorsnot accounted for in the release categories.

E1-1

TVA Response:

The use of the word "major" was inaccurate. Table 2.a.ii-1 provides the mapping of "all" the CET event sequences to Level 2 CET end states. No CET sequences are left out of this mapping. The Level 2 Containment Event Tree End States listed in column 3 of Table 2.a.ii-1 accounts for all the CET sequences. Table 2.a.ii-2 provides the frequencies of all the Level 2 CET end states and the total of all the CET end states for each release category.

Nothing is left out of the quantification.

6. RAI 2.c The response to RAI 1.a (p. EI-4) gives the WBN Unit 2 LERF as 1.70E-06 per year while the sum of release categories I and 2 frequencies is 1.61 E-06. Discuss the reasonsfor this difference.

TVA Response:

Release Categories 1 (LERF) and 2 (Bypass) both added together are the total LERF contribution. The SAMA study was performed with the model truncated at 1E-12 and should be 1.61 E-06, which is the sum of Release Categories I and II. The LERF frequencies are not inputs to the SAMA benefits assessment. Release category frequencies are used instead.

6a. RAI 2.d 2nd paragraph,2nd sentence (p. E1-65) "...since the proportionof the Late containment failure sequences (i.e., Release Category Ill) are not excluded from the intact containment frequency;... ". What is meant by "the proportion"is not clear.

TVA Response:

Late containment failures result from core damage sequences in which there is an extended loss of containment heat removal. Such loss of containment heat removal sequences which also fail to have an early release are then assumed to result in late containment failure.

However, when evaluating the CAFTA model for intact containment frequency, the late containment failure sequence cutsets were not removed. So the proportion of the evaluated intact containment frequency which corresponds to late containment failure frequency has incorrectly not been removed nor excluded. It has in fact been double counted with the late containment failure frequency. This aspect of the model does not affect the SAMA evaluation since intact containment sequences have very limited offsite releases. Changes in the intact containment failure frequency on accident costs can be adequately represented by the models for total core damage frequency cost impacts and offsite consequence impacts can be neglected.

7. RAI 4.a.i

a. The last paragraphon page EI-80 indicates that all basic events with a risk reduction worth (RRW) of 1.007 or higher were reviewed for all types of SAMDAs - hardware and operatorerrorimprovement. Confirm that the reference to an RRW of 1.007 in this paragraphis an error and should be an RRW of 1.026, since the following paragraph states that the review is "further extended" down to an RRW of 1.007.

E1-2

TVA Response:

TVA agrees that it would have been clearer to leave off the statement "i.e., including hardware and enhancements to reduce operator action error rates" from the paragraph referring to the 1.007 cutoff. While all such events were "considered", the next paragraph makes it clear that only those events with RRWs greater than 1.026 were assessed for fixes that cost more than $100,000. Events with RRWs between 1.026 and 1.007 were only assessed for fixes that cost less than $100,000 as only such low cost changes could possibly be cost-beneficial.

b. In Table 4ai-1, no SAMDAs are identified for SEQFD2A-A and SEQFD2B-B. The justification appears to be the citation of the entry for diesel generatorfailure, which is addressedby a number of SAMDAs rangingfrom a new 2 MW DG to bypassing DG trips. None of these directly address the sequencerfailure such as the possibility of manual loading of the DG following sequencerfailure. Sequencer failures contribute a total of about 2.3 percent to the CDF,which would correspondto a benefit of approximately5200,000 at the 95th percentile. Discuss this possibility.

TVA Response:

For SAMA analysis, IVA considered sequencer failures as represented by basic events SEQFD2A-A and SEQFD2B-B for emergency diesel generators (EDGs) 2A-A and 2B-B respectively, to be part of the EDGs themselves. Failures of the sequencers are modeled as failing the respective ERCW pump which is needed for cooling the associated EDG. The loss of ERCW cooling to the EDG without rapid operator intervention would lead to overheating the EDG, making further recovery from such sequencer failures unlikely. Sequencer failures resulting in loss of the under voltage logic would prevent the loads from the shutdown boards from shedding prior to startup on EDG power. Such a failure mode would be complex to recover within a short time frame. However, other sequencer failure modes may be either not a failure mode of onsite power or easily recoverable; e.g., mistiming a load or failure to load a specific load group other than the associated ERCW pump. The WBN Unit 2 EDGs are very large capacity and not expected to fail even with 3 or 4 loads starting simultaneously.

The WBN Unit 2 CAFTA model does not credit recovery of the EDGs nor any of the failure modes of the sequencers during a station blackout. Instead credit for electric power recovery is limited to the recovery of offsite power to the shutdown boards.

However, existing WBN Unit 2 procedures and training do explicitly direct the operators to attempt to recover onsite power to the shutdown boards. For example, step 6.a.3 of ECA-0.0 for loss of shutdown power directs the operators to ensure the ERCW supply to the running EDGs by manually starting a pump.

If the shutdown boards are not energized, then the operators transfer to either AOI-35, "Loss of Offsite Power"; AOI-40, "Station Blackout"; or AOI-43, "Loss of any Shutdown Boards." AOI-40, "Station Blackout," is the most relevant procedure for this discussion.

Operators are trained on each of these procedures every four years. Attachment C of AOI-40 instructs the operators on the steps to follow if the shutdown boards are deenergized. They are to start the affected EDG, manually close its output breaker, and ensure that ERCW flow is provided to the running EDG. If the output breaker fails to close, detailed instructions are provided to ensure that the operators can close the output breaker manually.

E1-3

As these procedures and training already exist today, enhancements to credit recovery from sequencer failures are considered already implemented.

8. RAI 4.a.ii The response to this RAI develops a lower RRW cutoff, apparently based on only RC2 on the stated basis that reducing the LERF frequency had the greatestimpact for bypass sequences (i.e., RC2). RC2, however, due to its low frequency, contributes only a small amount (-1 percent) to the overall MACR and consequently eliminating the risk completely would only have a very small benefit (approximately$120,000). How the tower RRW cutoff values given were determined is not clear.Also, the basis (RC2 or both RC1 and RC2) for the event ranking and the associatedRRW values in Table 4.a. li-1 is not clear. The importance of the events in Table 4.a.ii-1 appearto be essentially the same (after converting RRW to F-V) as in Table 15.h of the October 14, 2010, submittal. Provide additional clarificationon these issues.

TVA Response:

The ranking of basic events for LERF was determined by solving the frequency for the portion of the WBN Unit 2 CAFTA model that represents the sum of Release Categories 1 and 2; which is defined as LERF for this study. The RRW importance measures reported in Table 4.a.ii-1 were computed with respect to the cutsets contributing to this LERF frequency.

In the previous response to RAI 4.a.ii, TVA was requested to determine the RRW cutoff for LERF that would correspond to a minimum SAMA cost of $26,773. Consistent with the response to RAI 4.a.i, the RRW to LERF that would correspond to a SAMA cost of $100,000 was also determined to facilitate screening of potential SAMAs.

The frequency of the LERF category is made up of both Release Category 1 (large early containment failures) and Release Category 2 (Bypass events). Events that contribute to either category contribute to LERF. To respond to the RAI, the minimum change in the LERF frequency (and consequentially minimum RRW) that would just translate to the requested SAMA costs was to be determined.

Release Category 2 sequences (Bypass events) have greater consequences in terms of off-site exposure costs and off-site economic costs than do Release Category 1 (large early containment failures) sequences so that the minimum change in frequency required would be if the entire change in frequency from a proposed SAMA came from Release Category 2 contributors. The cost contributions from the change in total core damage frequency (i.e.,

from onsite exposure costs, onsite economic costs, and replacement power costs) is the same for either Release Category. So when performing the trial and error calculation to arrive at the change in frequency that would just yield the $26,773 and $100,000 SAMAs costs, all of the assessed frequency was taken from Release Category 2 and not from Release Category 1. This is conservative (i.e., smallest RRW) in that if the change in frequency instead resulted from a combination of sequence frequency changes involving both Release Categories 1 and 2, then the impact on the MACR would be lower; i.e. a greater RRW would be required to yield the same change in SAMA cost. As noted in the supplemental RAI, zeroing out the Release Category 2 frequency would yield more than

$100,000 benefit so it was not necessary to consider larger LERF frequency reductions.

That the Release Category 2 frequency contributes only a small amount to the overall MACR is not relevant to this discussion.

E11-4

9. RAI 4.d The response to this RAI provides a good review of fire risk contributorsand potential actions that might be taken to reduce these risks. In Table 4.d-1, newly identified SAMDA 314, "Enhancetrainingfor local control of AFW [auxiliary feedwater] given station blackout, loss of control air,or fires affecting AFW LCVs [level control valves), "is indicated to have already been implemented, citing previous commit to SAMDAs 285 and 299. While these SAMDAs cite enhancements to trainingin a general sense, neither appears to specifically addressthe trainingenhancement needed for SAMDA 314. Provide a specific citation that incorporatesthe requirements of SAMDA 314.

TVA Response:

SAMA 314 to enhance training for local control of AFW given station blackout, loss of control air, or fires affecting the AFW LCVs was defined in Table 4.d-2 in the prior response to RAIs.

SAMA 299 was previously defined and committed to as per the SAMA October 2010 submittal. Plant operations personnel are already to be regularly trained in important human actions modeled in the PSA. SAMA 299 was defined to extend this training to maintenance and testing staff who may be involved in the implementation of selected actions should the need arise. While the important human actions are not explicitly listed, this commitment is to be implemented to cover all important human action events in the PSA. TVA will extend that commitment to include the actions important in the FIVE analysis; i.e., for local control of AFW given a fire.

A review of the 18 key fire scenarios in Table 4.d-1 in TVA's response to SAMA RAIs reveals that the recovery actions in question are to recover from fires whose impacts either cause or lead to a loss of control air or a station blackout. In the WBN Unit 2 CAFTA model, human failure event HAFR1 addresses recovery from losses of control air for which the operators are to take local control of the TD AFW LCVs, and human failure event HAAF1 is for recovery during a station blackout. These local actions are directed by SOI-3.02 (AFW system), rev. 46. AOI-1 0 (Loss of control air) directs the operators to loss SOI-3.02 for recovery action HAFRI. ECA-0.0 (loss of shutdown power) directs the operators to SOI-3.02 for station blackout events. The operators are trained using the simulator for recovery from loss of control air (action HAFR1) twice a year and every other year for recovery from station blackouts (action HAAF1). However, the simulator training for these recovery events is not specialized for fires as the root cause of the loss of control air system or a station blackout.

Table 9-1 below lists the fire areas which may involve scenarios that lead to the indicated plant impacts assuming that a fire engulfs the entire fire area.

Procedures have been developed for WBN Unit 2 that specifically direct the responses to fires occurring in these areas. Table 9-2 cross-references the applicable fire safe shutdown response procedures to the above key fire areas. Specific procedural guidance is available for all the key areas. Operator training on these specific procedures is conducted every four years.

As part of its response to questions on the Appendix R analysis, TVA has further reviewed how best to address such scenarios that lead to loss of control air to the AFW valves as a result of fires. It was decided to provide a new capability to allow the operators to transfer from the normal compressed air supply to the station nitrogen system for control of the AFW LCVs. The controls for this transfer are to be provided from the control room. As this capability will markedly reduce the potential for execution errors, this change will have a E1-5

much greater risk benefit than the enhanced training as envisioned by SAMA 314. TVA commits to implement this enhanced transfer capability. The transfer capability will not be extended to the steam generator PORVs because the steam generator safety valves are sufficient for these scenarios.

Table 9-1 Fire Areas Contributing to SAMA 314 Fire Impact Contributing Fire Areas Loss of Control Air 0 Aux Bldg 713-A1&713-A22, 737-AlA, 737-Al C, 757-A13, 757-A22

• Control Bldg CB 708-C4 0 Turbine Bldg Station Blackout 0 Aux Bldg 737-Al B, Table 9-2 Response Procedures Developed for the Key Fire Areas Fire Areas Response Procedure

• Aux Bldg 713-Al &713 0 AOI-30.2 C.46 Rev. 002; steps 21,22,&23 and Table (general area and valve 2; Ensure TDAFWP running, and local control HUT gallery) established for AFW LCVs and S/G PORVs

" Aux Bldg 737-AlA 0 AOI-30.2 C.36, Rev. 003;steps 24&25 establish local (corridor) control for TDAFWP and AFW LCVs

" Aux Bldg 737-Al B, 0 AOI-30.2 C.37, Rev. 002; steps 23&24 Ensure local (corridor) control established for AFW LCVs and S/G PORVs

• Aux Bldg 737-AiC 0 AOI-30.2 C.48 Rev. 002; step 23 Ensure local control (corridor) established for S/G PORVs (per Table 2, at N2 station)

• Aux Bldg 757-A13 0 AOI-30.2 C.27 Rev. 002; steps 21&22 Ensure local (refueling room) control established for AFW LCVs and S/G PORVs

• Aux Bldg 757-A22 (125v 0 AOI-30.2 C.30 Rev. 001 ;steps 21&22 Ensure local battery board room) control established for AFW LCVs and S/G PORVs

" Control Bldg CB 708-C4 0 AOI-30.2 C.69 Rev. 004; steps 35.2.1/2 if control air (Unit 2 aux. instrument lost, Direct AUO to use manual AFW flow control and room) use SG PORV N2 station for controlling cooldown

• Turbine Bldg 0 AOI-30.2 C.60 Rev. 003; attachment 3 directs AUO local actions depending n which AFW pump is available for cooldown; E1-6

10. RAI 4.e.ii The response to this RAI indicates that one reason that SAMDA 29 is not feasible is that the use of a diesel-driven fire pump for injection would require AC power to provide DC power after battery depletion to allow the power-operatedrelief valves (PORVs) to remain open. It would appearthat a much smallerAC power source would suffice to allow the PORVs to remain open than that which would be requiredto operate the residual heat removal and other pumps to provide cooling. Furtherit is stated that depressurizationto the point of allowing the fire pump would be challenging for the operator. Such actions are, however, proceduralizedin TVA procedure SAG-2 (7/23/10) response to originalSAMDA RAIs, p. El-41). While a recirculationpath may ultimately be needed, it is conceivable that containment flooding would not be an issue until very late in the scenario. Provide additionaldiscussion of this SAMDA to support its screening.

TVA Response:

SAMA 29 is to prepare procedures and install connections to allow for an existing diesel driven fire pump at the site to be used as a last resort for RCS injection when the RCS is at low pressures. Independent failures of all high and low pressure RCS injection combined with the occurrence of a small LOCA would be very low frequency. Instead, the scenarios where this combination of system failures is most likely is when there are sufficient support system failures to disable all other RCS injection sources and lead to a small LOCA as a result of failing all RCP seal cooling; e.g., for (1) station blackouts, (2) losses of ERCW, or (3) losses of CCS. If there is no small LOCA and steam generator cooling is maintained, then a source of RCS injection would not be required for mitigation of any of these three scenario classes.

TVA has proceduralized steps to ensure RCP seal cooling and to extend steam generator cooling using the TD AFW pump for many scenarios including the three scenario types identified above. Procedures have been developed to provide for CCP cooling to maintain RCP seal injection under loss of ERCW or loss of CCS conditions by taking advantage of connections to the diesel driven fire pump. Procedures for extending the time for steam generator cooling under station blackout conditions (i.e., after the batteries discharge) are also in place and credited in the WBN Unit 2 PSA models. The diesel-driven fire pump would be one source of makeup for continued AFW flow after the CST is depleted.

Procedures for the alignment of backup sources of emergency AC power to the shutdown boards have also been developed for station blackout conditions which if successful would restore high pressure injection capability. These actions are considered in the PSA models used for SAMA evaluations.

Substantial effort has also been dedicated to the development of severe accident management guidelines for the industry and specifically for WBN Unit 2.

Emergency Operating Instruction FR-C.1, "Inadequate Core Cooling," Rev. 16 is entered when the maximum in-core thermocouples are greater than 12001F as would be applicable for the three classes of scenarios noted above. If adequate AFW flow is available, then the operators are directed to first isolate potential RCS leakage paths (Pressurize PORVs, letdown, excess letdown, reactor vessel head vents) and to depressurize the steam generators sufficiently to allow the cold leg accumulators to inject. The steam generator depressurization is then halted when the RCS reaches 250 psig so as to isolate the accumulators after discharge. Only then would further depressurization of the steam E1-7

generators be permitted. By contrast, for station blackout scenarios, operators are directed by ECA-0.0 to not depressurize below 250 psig to avoid injection of nitrogen from the accumulators.

If the in-core thermocouples remain above 1200OF as would be expected for a small LOCA scenario with failure of all high pressure injection, then FR-C. 1 directs the operators to start an available RCP in the RCS loops with steam generator cooling. If, however, no steam generator cooling is available or no RCPs are available, then the operators are directed to open all pressurizer PORVs and head vents to further depressurize the RCS. They are also then to depressurize all intact steam generators to further aid RCS cooling. Only after performing all these steps and with in-core thermocouples still showing above 1200*F do the operators transfer to SACRG-1, "Severe Accident Control Room Guideline Initial Response."

SACRG-1 provides actions to respond to a severe accident in which the core may be damaged. Therefore, TVA believes the benefits of the proposed SAMA 29 are limited to the potentially positive impacts of protecting the containment and not to reduce the core damage frequency.

SACRG-1 could, for example, be entered from FR-C.1, "Inadequate Core Cooling," when core in-core thermocouples remain greater than 12000 F and actions to cool the core are not successful. The TSC Diagnostic flow chart is entered by the TSC emergency response personnel when directed by the control room via step 5 of procedure SACRG-1. SAG-2 is entered when called for by the TSC Diagnostic Flow Chart based on high RCS pressure; i.e., when greater than 400 psig. As noted in the NRC follow-up to RAI 4.e.ii above, SAG-2 is a guideline that instructs how and when the operators are to depressurize the RCS.

However, use of SAG-2 to depressurize the RCS is only for scenarios that have likely already or soon will progress to core damage. The existing procedures already call for RCS depressurization thereby limiting the potential for high pressure melt ejections which could lead to early containment failures. The potential benefits of SAMA 29 are therefore limited to changing the Release Category types assigned to the three applicable classes of scenarios from the Late Release Category to the Intact Release Category. The benefits of RCS depressurization to limit the potential for early containment failure are already considered independent of SAMA 29.

SAG-2 directs the operators to first consider the positive and negative effects prior to depressurizing the RCS under these conditions. The potential positive effects are: (1) to prevent high pressure melt ejection, (2) prevent creep rupture of the steam generator tubes which are dry, and (3) eventually to permit low pressure injection sources if available. The potential negative impacts include: (1) containment overpressure (only one pressurizer PORV is to be used if containment pressure approaches 56 psig), (2) potential containment failure due to hydrogen burns (based on severe accident management guidance in CA-3),

(3) release of fission products to the environment via ruptured or leaking steam generators, and (4) the loss of steam generator inventory when under low feed conditions (i.e.,

operators are otherwise expected to maintain steam generator water level above 54%

narrow range).

Only if there are no applicable negative impacts is RCS depressurization directed by SAG-2.

Neither normal spray (requiring RCP operation) nor auxiliary spray (requiring a CCP) would be available to achieve RCS depressurization for the three classes of scenarios of interest.

Using both pressurizer PORVs, the potential for containment overpressure is not expected in the short term. However, if containment pressure rises only one PORV is then permitted, and the potential for successfully depressurizing to a low, permitting fire water injection is further reduced.

E1-8

Note that the potential negative effects of injection from unborated water sources are not credited in the current procedures for WBN and would have to be assessed if the cooling tower water basin were to be used as a water source by the diesel driven fire pump.

The potential for severe hydrogen burns is a complicated one that is dependent on the containment pressure in the absence of containment venting, and the degree of Zircalloy-water reactions (likely to be in the 75% range for core uncovery and reflooding scenarios) as applicable here. The impact of RCS flooding by a low pressure injection source as proposed, with relief to containment could affect the containment pressure and temperature depending on the actual injection flow rates achieved. During a real accident, the measured hydrogen concentration within containment prior to RCS depressurization would also be considered.

For the scenarios of interest to us here, there is no significant potential for release of fission products to the environment because the steam generators are not expected to be ruptured or leaking. However, if steam generator cooling is also not available, then depressurizing the secondary side could exacerbate the pressure drops across the steam generator tubes under the elevated RCS temperatures associated with degraded core conditions and thereby promote temperature-induced tube failures.

If steam generator cooling is initially available, then the loss of steam generator inventory is a potential concern but of even greater concern is the potential loss of steam generator cooling at the low RCS pressures required to permit injection using the diesel-drive fire water pump. Limited heat transfer to the secondary side could occur at such low RCS pressures.

Even under steam generator cooling conditions, there is no assurance that use of the available paths for RCS depressurization once opened will be sufficient to fully depressurize the RCS to the low pressures required for injection by the diesel-driven fire pump. The existing diesel-driven fire pump has a rating of 2500 gpm at just 125 psig.

Without steam generator cooling it is almost assured that such low RCS pressures would not be reached. Severe Accident Management Guideline CA-2, "Injection Rate for Long Term Decay heat Removal," Rev.002 for WBN identifies the minimum injection flow rate required to match decay heat with time after trip in the absence of steam generator cooling.

Even 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after trip, the required flow rate, assuming subcooled when injected and crediting vaporization to steam, is 150 gpm. Severe Accident Management Guideline CA-I, "RCS Injection to Recover Core," Rev. 002, indicates the flow capacity when holding both pressurizer PORVs open as a function of RCS pressure. For a flow rate of 150 gpm through just two open PORVs, the RCS pressure would have to be greater than 400 psig.

Therefore, even if the operators held open the PORVs long enough to reach 125 psig, required by the diesel driven fire pump for injection, the injected water would flash to steam on contact with the degraded core and again pressurize the RCS. Once pressurized, the injection flow would stop and there would again be a period of time of RCS depressurization.

It's unclear what the effect of these intermittent periods of injection, flashing, and depressurization would have on RCS boundary components. Of concern would be the rate of transfer of heat to the then depressurized steam generators.

Were the steps in SAG-2 followed and low pressure injection from the diesel-driven fire pump successful, effectively the decay heat would be transferred via steam release through the open pressurizer PORVs and go into heating the containment. Since containment heat removal is not available for the scenarios of interest, this approach would further increase containment pressure increasing the likelihood of overpressure.

E1-9

The above paragraphs suggest that while the potential negative effects of RCS depressurization are real, they are not assured for the scenarios of interest. But if steam generator cooling is initially available despite the small LOCA, it makes little sense to depressurize the RCS below the diesel-driven fire pump shutoff head which would degrade the effective heat transfer to the secondary side.

Instead, the proceduralized recovery actions already assigned to take advantage of the diesel-driven fire pump (i.e., as a long term makeup source for AFW, as a cooling water source to recover from losses of ERCW, and to supply cooling to the A train CCP pump) can be retained. After RCP seal failure and the onset of core damage, recovery of a CCP would allow high pressure injection to be re-established. For extended station blackouts, the A train CCP could not be recovered but maintaining AFW cooling, as the only remaining active heat removal system, would still be a primary concern.

It is also recognized that the three classes of severe accident scenario types addressed by SAMA 29 all involve RCP seal LOCAs and therefore may already be addressed in large part by SAMA 58, "Install improved reactor coolant pump (RCP) seals." TVA has committed to follow the progress and experience with the new Westinghouse seal package design and, if proven reliable during operation, to install the new package at WBN Unit 2. Further discussion of SAMAs 215 and 226 which also address these same scenarios is discussed in the response to item 16. TVA believes that the approach identified in the response to item 16 adequately addresses the scenarios applicable to SAMA 29. Once the approach identified in the response to item 16 is incorporated, the frequency of the applicable scenario types for SAMA 29 is expected to be significantly reduced so that SAMA 29 would then be clearly not cost-effective.

11. RAI 4.e.v The response to this RAI indicatesthat the significant room cooling failures are the centrifugal chargingpump (CCP)area, the turbine-driven auxiliaryfeedwater pump room and the DG switchgearrooms. Provide the status of procedures and/oravailabilityof necessaryportable equipment (such as fans and ducting) that would reduce the likelihood of equipment failures due to room cooling failures for each of these areas. If not included in procedures or portable equipment is not available, discuss the feasibility and cost benefit of such SAMDAs addressingthese failures. While as is stated for SAMDA 337, that for the CCP area there are no direct alarms or indicationsin the control room concerning the room cooling failure, it is possible that the room cooling failures would be discovered by other means such that having portable fans available would provide a benefit.

TVA Response:

TVA has made provisions for such equipment in other areas of the plant for various scenarios. Since the equipment is relatively inexpensive and easy to use, WBN will make additional temporary equipment available including portable fans and flexible ductwork that can be moved to these areas in case of loss of cooling. Procedures will be written to provide direction on the use of the fans. Since the risk effectiveness of the equipment would be difficult to quantify due to the uncertainty in method of detection, a cost benefit analysis is not being prepared for this item.

El-10

11a. RAI 5.b With regardto Item 12 below of the requestedclarificationsconcerning SAMDA 70, and earlierresponse to RAI 5.b, considerany cost savings associatedwith spreading the cost of the engineering and design of SAMDA 70 between both units since it was stated earlier that TVA would align the licensing and design bases of the two units to the fullest practical extent.

TVA Response:

SAMA 70 is to provide accumulators for the TD AFW pump flow control valves in the event of a loss of control air. The stated costs for these new accumulators are for the affected unit only. There are no cost savings per unit found by applying the changes of each unit since the costs associated with engineering and design were not considered.

However, as part of its response to questions on the Appendix R analysis, TVA has further reviewed how best to address such scenarios that lead to loss of control air to the AFW valves as a result of fires. It was decided to provide a new capability to allow the operators to transfer from the normal compressed air supply to the station nitrogen system for control of the AFW LCVs (new SAMA 339). The controls for this transfer are to be provided from the control room. As this capability will markedly reduce the potential for execution errors, this change will have a much greater risk benefit than the limited capacity accumulators as envisioned by SAMA 70. WVA commits to implement this enhanced transfer capability. The transfer capability will not be extended to the steam generator PORVs because the steam generator safety valves are sufficient for these scenarios. Therefore, SAMA 70 is considered superseded by new SAMA 339.

12. RAI 5.e The response to this RAI concerning SAMDA 70 discusses changing the cognitive portion of the human errorfor events HAFRI and HAAFI. It is noted that the former event is incorporatedin several dependent human error events including HRADEP.POST-221 and 180. Clarify whether these dependent human errors changed when the benefit of this SAMDA was determined. If not, discuss the impact of these changes on the result, noting that this SAMDA has a benefit/cost ratio of 0.99 considering uncertainty. Note also that if the 95th percentile to point estimate ratio of 2.78 is used in the uncertainty analysis instead of the 2.70, which is the ratio of the 95th percentile value to the mean, this SAMDA becomes slightly cost beneficial. Provide a revised evaluation of this SAMDA that accounts for these issues and the stated conservatism in the benefit calculation.

TVA Response:

By changing the cognitive portion of the human error events for events HAFRI and HAAFR, some of the dependent human error values do change, including those noted above. When assessing the benefits of this SAMA, these changes were also made to the associated dependent human error event values. Only very slight changes to the dependent human error event values result, and these make no difference to the assessed benefit for SAMA 70.

In the response to item 1la, TVA commits to install a control station within the control room for aligning the nitrogen system to the AFW LCVs in the event of a loss of control air (SAMA 328). The benefits of SAMA 339 are clearly more effective than SAMA 70 for responding to these losses of control air sequences since it greatly reduces the execution El-11

portion of the human error events to locally align the nitrogen bottles. Since SAMA 70 addresses these same losses of control air sequences, with the implementation of SAMA 339, it is not cost effective.

The response to item 5b considers the greater proposed uncertainty factor of 2.78 versus the factor of 2.70 used. With the exception of SAMA 70 (superseded by SAMA 339), none of the SAMA cost benefit conclusions change for this revision to the 95% uncertainty factor sensitivity case.

13. RAI 5f It is noted that there is no reduction in CDF for SAMDA 93. The usual purpose of containment venting is to prevent core damage for loss of containment heat removal sequences where the functioning core injection systems would fail upon containmentover pressurefailure. The importance of these sequences for WBN Unit 2 is not known. Discuss the reason why there is no CDF reduction for this SAMDA.

TVA Response:

Containment venting is not usually modeled for PWRs. The WBN Unit 2 CAFTA model adopts a similar approach as to that found in NUREG/CR-4550, Volume 5, Rev. 1, Part 1 for Sequoyah Unit 1. This approach evaluates the frequency of core damage independent of containment heat removal. The subsequent loss of containment heat removal then only affects the assigned Release Category, not the frequency of core damage. See for example the transient event tree shown on Page 4.4-18 of the above cited NUREG/CR-4550.

Containment spray for containment heat removal is not a requirement for successful recirculation from the sump.

It is unlikely that there will be sequences relying on successful recirculation from the containment sump when containment spray recirculation is failed for the following reasons.

Both the RHR and containment spray pumps depend on the same trains of electric power, CCS (for pump seal and oil cooling), and ERCW cooling (for room cooling). The RHR heat exchangers shared by both low or high pressure recirculation cooling and containment spray recirculation cooling both depend on CCS cooling. Because of these shared dependencies it is very unlikely that low or high pressure recirculation cooling would be available to provide containment heat removal but containment spray cooling would not. This is even more unlikely at WBN Unit 2 because the operators are instructed (i.e., procedure E-1, step 26, Rev. 16) to manually align train B or A of RHR cooling to provide containment spray in the event recirculation from the sump is successful on RHR but both trains of containment spray are unavailable for containment heat removal.

Still it is conceivable that low or high pressure recirculation from the sump is required when containment spray recirculation fails for independent reasons. For sequences in which high or low pressure recirculation from the containment sump is credited to prevent core damage, the failure of containment heat removal could conceivably lead to a gradual overpressure of the containment. Were this to occur, the loss of containment back pressure could conceivably lead to a loss of net positive suction head of the RHR pumps taking suction from the containment sump.

According to document MDQ00106320060110, Rev. 002; CCP, SIP, CSP, and RHR NPSH Evaluation for WBN Units 1 and 2, there is at least 10.5 ft. excess NPSH available to the Unit 2 RHR pumps (Appendix B, page 4 of 9 of MDQ00106320060110) when the containment is at 0 psig, the sump water temperature is at its large LOCA design El-12

temperature of 190'F, the RHR pumps are operating at 5000 gpm, and the CCPs and CSPs are all assumed operating at run out flow as would bound the case at the time of sump switchover.

Large LOCAs have a low frequency of occurrence. For each of the four cold legs, the WBN PSA lists a Large LOCA frequency of just 3.33E-7 per year. A conservative estimate of the independent failure probability of both containment spray trains is 1E-2. In the event of their failure, the operators may still use the RHR pumps to also provide containment spray recirculation. Human failure event HARS1, with a failure probability of just 9.7E-4, represents the failure to align an RHR pump for containment spray recirculation in the WBN Unit 2 model. The frequency of such large LOCA sequences with failure of all containment spray recirculation is then bounded by the product of these factors, or 4*3.33E-7*1 E-2*9.7E-4= 1.3E-1 1 per year. This estimate of the sequence frequency of interest for the loss of containment heat removal translates to a very small cost benefit.

For smaller LOCA conditions where the RCS remains at higher pressures and temperatures, the recirculation flow rates would be much lower than needed to mitigate a large LOCA and the RCS exit temperatures would be higher. However, if steam generator cooling is available then, the RCS exit temperatures would be decreased with time as the operators cooldown and depressurize the RCS and eventually transfer to closed loop RHR. For such scenarios with steam generator cooling, the chances of containment overpressurization even without containment spray are low. This is particularly true since the operators would likely take steps to depressurize the RCS and transition to closed loop RHR cooling as soon as possible.

However, for successful feed and bleed scenarios with recirculation from the sump successful, and no containment heat removal from containment spray, then containment pressure could continue to rise and the containment sump water may be hotter than 212°F at the time of containment overpressurization.

The frequency of successful feed and bleed cooling at WBN Unit 2 can be estimated by totaling the frequency of feed and bleed cooling failures due to operator action failure and backing out the failed operator actions. The basic events involving operator failure to initiate feed and bleed cooling failure are HAOB2, HRADEP-POST-128, HRADEP-POST-220, and HRADEP-POST-221. The frequency of a challenge for feed and bleed cooling from internal events is then calculated to be 6.46E-4 per year.

Assuming the operators successfully align for feed and bleed cooling and that RHR cooling is successful, both containment spray trains must still fail independently and the operators must fail to align an operating RHR train for containment spray recirculation to obtain the type of sequence where containment venting may be beneficial. A conservative estimate of the independent failure probability of both containment spray trains is 1E-2. In the event of their failure, the operators may still use the RHR pumps to also provide containment spray recirculation. Human failure event HARS1, with a failure probability of just 9.7E-4, represents the failure to align an RHR pump for containment spray recirculation in the WBN Unit 2 model. The frequency of such feed and bleed cooling sequences with failure of all containment spray recirculation is then bounded by the product of these factors, or 6.46E-4*1 E-2*9.7E-4= 6.27E-9 per year. This estimate of the sequence frequency of interest for the loss of containment heat removal translates to a very small cost benefit of just

$27,000*6.27E-9/1.2E-7= $1,400.

This computed addition to the benefit provided by installing containment venting (i.e., SAMA

93) by potentially reducing the core damage frequency is very small. Adding this estimate to El-13

the previously computed benefit of $962,278 does not change the conclusion that this SAMA is not cost beneficial even considering the sensitivity case for 95% CDF reported in Table 2.a.iv-10.

14. RAI 5.g The response to this RAI discusses a number of different sensitivity studies for the assumptions used to evaluate SAMDA 110. Several results are provided, none of which correspondwith that given in Table 2.a.iv-B for this SAMDA. Clarify this and indicate the external events multiplierused in the response to this RAJ.

TVA Response:

The estimated benefits presented in Table 2.a.iv-8 for each phase 2 SAMA evaluation are for the revised SAMA RAI results. As noted in the discussion following Table 2.a.iv-6, in response to other RAIs, some changes in the Release Category doses and economic consequences revised the base case MACR. The base core damage MACR increased by 7% due to the changes in dose and economic costs. Because the Release Category doses and economic costs both increased and decreased in the four categories, there are some (RAI) SAMA results that increased and some that decreased. For the same external events multiplier of 2.0, the benefits for SAMA 110 decreased from $67,569 reported in the original SAMA submittal to $63,746 in the response to the first set of RAIs. Instead of assuming a multiplier of 2.28, the revised benefit for SAMA 110 was reported in Table 2.a.iv-8 as

$72,670. These two revised values were also used in the sensitivity calculations.

The initial response to RAI 5g did present alternative sensitivities for evaluating the benefits of SAMA 110. One sensitivity set only split fraction CFE4 to zero, and the second adopted a debris impingement containment failure mode of 0.332 and revised the DCH failure probability accordingly. Both of these sensitivities yielded lower benefits than $63,746 value. Therefore, the original approach to assessing the benefit of SAMA 110 was retained in Table 2.a.iv-8. The only differences with the original SAMA assessment are in the external event multiplier and revised Release Category consequences.

16. Cover Letter With respect to SAMA 58, TVA has committed to follow the progressand experience with the new Westinghouse sealpackage design, and, if proven reliable during operation,to install the new package at WBN Unit 2. While it is true that SAMDAs 215 and 226 are mutually exclusive and installationof the new seal would preclude the necessity for other means of reducingreactorcoolant pump seal failures such as SAMDA 215 or 226, there is no commitment to implement eitherSAMDA 215 or 226 (which are cost beneficial considering uncertainty)should the new seal design not be implemented at WBN Unit 2.

Describe the process TVA would use to evaluate SAMDAs 215 and 226 in the eventuality that SAMA 58 is not implemented.

TVA Response:

In the SAMA response dated January 31, 2011, WBN stated that "several SAMAs dealing with reactor coolant pump (RCP) seal protection are showing cost-beneficial at the 95%

uncertainty sensitivity. SAMA 58 was the original SAMA dealing with improved RCP seals and is the subject of RAI 4.a.iv in Enclosure 1. SAMA 215, dealing with ensuring RCP seal cooling and SAMA 226 on installation of permanent self-powered charging pump, also become cost-beneficial at this level of uncertainty. These SAMAs are mutually exclusive with SAMA 58 in that, if one is implemented, then the others are not required. WBN is interested El-14

in the new seal package technology being demonstrated by Westinghouse at the Farley Nuclear Plant (SAMA 58). However, prudence dictates that additional operation experience is needed prior to our implementation of SAMA 58. Therefore, WBN commits to follow the progress and experience with this seal package design, and, if proven reliable during operation, it would be installed at the earliest refueling outage following startup during normal seal package replacements. This issue also applies to numerous other SAMAs (i.e.,

SAMAs 50, 55 and 56)."

The RAI requests the process TVA would use to evaluate SAMDAs 215 and 226 ifthe seal package design is not proven reliable. Since the RCP seal integrity is important to the risk profile, TVA revises its commitment to the following: WBN commits to follow the progress and experience with this seal package design, and if proven reliable during operation, it would be installed at the earliest refueling outage following startup during normal seal package replacements. Also, if not proven reliable, TVA will use the latest PSA model at the time to re-evaluate SAMAs 215 and 226 as well as 10 CFR 50.55 and 10 CFR 50.56 to determine if an alternative SAMA is cost beneficial for implementation and implement the SAMA accordingly.

El-15

ENCLOSURE 2 LIST OF COMMITMENTS

1. Enclosure 1 provides TVA's response to these NRC RAIs with the exception of 2, 3, 5 and

15. Responses to the remaining RAIs will be provided in future correspondence. (Cover Letter)

2. SAMA 299 was defined to extend this training to maintenance and testing staff who may be involved in the implementation of selected actions should the need arise. While the important human actions are not explicitly listed, this commitment is to be implemented to cover all important human action events in the PSA. TVA will extend that commitment to include the actions important in the FIVE analysis; i.e., for local control of AFW given a fire.

(Item No. 9)

3. It was decided to provide a new capability to allow the operators to transfer from the normal compressed air supply to the station nitrogen system for control of the AFW LCVs. The controls for this transfer are to be provided from the control room. As this capability will markedly reduce the potential for execution errors, this change will have a much greater risk benefit than the enhanced training as envisioned by SAMA 314. TVA commits to implement this enhanced transfer capability (new SAMA 339). The transfer capability will not be extended to the steam generator PORVs because the steam generator safety valves are sufficient for these scenarios. (Item No. 9)

3. TVA has made provisions for such equipment in other areas of the plant for various scenarios. Since the equipment is relatively inexpensive and easy to use, WBN will make additional temporary equipment available including portable fans and flexible ductwork that can be moved to these areas in case of loss of cooling. Procedures will be written to provide direction on the use of the fans. Since the risk effectiveness of the equipment would be difficult to quantify due to the uncertainty in method of detection, a cost benefit analysis is not being prepared for this item. (Item No. 11)

4. The RAI requests the process TVA would use to evaluate SAMDAs 215 and 226 ifthe seal package design is not proven reliable. Since the RCP seal integrity is important to the risk profile, TVA revises its commitment to the following: WBN commits to follow the progress and experience with this seal package design, and if proven reliable during operation, it would be installed at the earliest refueling outage following startup during normal seal package replacements. Also, if not proven reliable, TVA will use the latest PSA model at the time to re-evaluate SAMAs 215 and 226 as well as 10 CFR 50.55 and 10 CFR 50.56 to determine if an alternative SAMA is cost beneficial for implementation and implement the SAMA accordingly. (Item No. 16)

E2-1