ML12286A017

License Amendment Request - Extended Power Uprate, Attachment 12, Risk Assessment, Attachment 13 - Flow Induced Vibration and Attachment 14 - EPU Related Changes to STF-493 Instrument Setpoints

ML12286A017
Person / Time
Site:	Peach Bottom
Issue date:	09/28/2012
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
References
Download: ML12286A017 (205)

Text

Attachment 12 Peach Bottom Atomic Power Station Units 2 and 3 NRC Docket Nos. 50-277 and 50-278 Risk Assessment

Risk Assessment Attachment 12 Page 1 TABLE OF CONTENTS Section Page 1.0 Introduction ....................................................................................................................... 2 2.0 Scope .............................................................................................................................. 13 3.0 Methodology .................................................................................................................... 15 4.0 PRA Changes Related to EPU Changes .................................................................. 23 5.0 Conclusions ................................................................................................................... 102 6.0 References .................................................................................................................... 123 Appendix A PRA Technical Adequacy Appendix B Impact of EPU on Shutdown Operator Action Response Times

Risk Assessment Attachment 12 Page 2 Section 1 INTRODUCTION The Peach Bottom Atomic Power Station (PBAPS) is currently pursuing an increase in reactor power from the current licensed thermal power of 3514 MWt to 3951 MWt, an Extended Power Uprate (EPU) of 120% of the original licensed thermal power (OLTP). The EPU is a constant pressure power uprate (CPPU).

The purpose of this report is to:

(1) Identify any significant change in risk associated with the Extended Power Uprate (EPU) as measured by the PBAPS Probabilistic Risk Assessment (PRA) models.

(2) Provide the basis for the impacts on the risk model associated with EPU.

1.1 BACKGROUND

The 2009A update to the Peach Bottom (PB) PRA model is the most recent evaluation of the risk profile at PB for internal event challenges. The PB PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events.

The PRA model quantification process used for the PB PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

Exelon Generation Company (Exelon) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating Exelon nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the Peach Bottom PRA.

PRA Maintenance and Update The Exelon risk management process ensures that the applicable PRA model remains an accurate reflection of the as-built and as-operated plants. This process is defined in the Exelon Risk

Risk Assessment Attachment 12 Page 3 Management program, which consists of a governing procedure and subordinate implementation procedures. The PRA model update procedure delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating Exelon nuclear generation sites. The overall Exelon Risk Management program defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, errors or limitations identified in the model, industry operating experience), and for controlling the model and associated computer files.

To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed:

• Design changes and procedure changes are reviewed for their impact on the PRA model.

• New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

• Maintenance unavailabilities are captured, and their impact on CDF is trended.

• Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every four years.

In addition to these activities, Exelon risk management procedures provide the guidance for particular risk management and PRA quality and maintenance activities. This guidance addresses:

• Documentation of the PRA model, PRA products, and bases documents.

" The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

" The process for updating the full power, internal events PRA models for Exelon nuclear generation sites.

• The use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10CFR50.65 (a)(4)).

In accordance with this guidance, regularly scheduled PRA model updates nominally occur on an approximately 4-year cycle; longer intervals may be justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant.

The PBAPS PRA is derived based on realistic assessments of system capability over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the PRA analysis. Therefore, PRA success criteria may be different than the design basis assumptions used for licensing PBAPS. This analysis uses the PRA to provide

Risk Assessment Attachment 12 Page 4 insights about how plant risk from postulated accidents, including severe accidents, is impacted by EPU implementation.

1.2 PRA QUALITY Several assessments of technical capability have been made, and continue to be made, for the PBAPS, Units 2 and 3 PRA models. These assessments are as follows and further discussed in Appendix A of this document.

• An independent PRA peer review was conducted under the auspices of the BWR Owners Group in 1998, following the Industry PRA Peer Review process [1].

This peer review included an assessment of the PRA model maintenance and update process.

• In 2004, a gap analysis was performed against the available version of the ASME PRA Standard [2] and the draft version of Regulatory Guide 1.200, DG-1 122 [3].

In 2006, an assessment of the extent to which the previously defined gaps had been addressed was performed in conjunction with a PRA model update.

• During 2005 and 2006 the PBAPS, Units 2 and 3 PRA model results were evaluated in the BWR Owners Group PRA cross-comparisons study performed in support of implementation of the mitigating systems performance indicator (MSPI) process [4].

" In November of 2010, a BWROG peer review was conducted on the PB209A Unit 2 and PB309A Unit 3 PRA models (that is, the 2009A PRA models used as the basis for the EPU risk assessment). This review was performed using ASME/ANS RA-Sa-2009 [5] and RG 1.200, Rev. 2 [6].

In summary, there are a few identified issues that remain open from the peer review. These deviations do not significantly impact the base PRA model or its ability to support the full range of PRA applications. Appendix A provides more details of this evaluation including an assessment of the peer review findings on the EPU risk assessment. Additionally, sensitivity studies were performed, where warranted, as described in Appendix A and Section 5.7.1 of this report.

Scope and Level of Detail The PBAPS 2009A PRA model is of sufficient quality and scope to measure the potential changes in plant risk related to EPU implementation. The PBAPS PRA modeling is highly detailed, including a wide variety of initiating events (e.g., transients, internal floods, LOCAs inside and outside containment, support system failure initiators), modeled systems, extensive level of detail, operator actions, and common cause events.

Risk Assessment Attachment 12 Page 5 External hazards were evaluated in the PBAPS Individual Plant Examination of External Events (IPEEE) submittal in response to the NRC IPEEE Program (Generic Letter 88-20, Supplement 4)

[7]. The IPEEE Program was a one-time review of external hazard risk and was limited in its purpose to the identification of potential plant vulnerabilities and the understanding of associated severe accident risks.

The results of the PBAPS IPEEE study are documented in the PBAPS IPEEE Main Report [8] and related correspondence. The primary areas of external event evaluation at PBAPS were internal fire and seismic. The internal fire events were addressed by using a modified version of the EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology [9] and the seismic evaluations were performed in accordance with the EPRI Seismic Margins Analysis (SMA) methodology [10]. As such, there are no comprehensive CDF and LERF values available from the IPEEE to support the EPU risk assessment.

Since the performance of the IPEEE, a Fire PRA was performed. The EPRI FIVE Methodology [9]

and Fire PRA Implementation Guide (FPRAIG) [11] screening approaches, EPRI Fire Events Database [12] and plant specific data were used in this 2002 study, to develop the PBAPS Fire PRA. An update to that Fire PRA model was performed in 2007 that included explicit analysis of the main control room (MCR) and cable spreading room (CSR) that had previously not been included. The ignition frequencies for the MCR and CSR were developed using the guidance in NUREG/CR-6850 [13]. The Fire PRA model was also integrated with the PB205C and PB305C internal events models as part of the 2007 update.

In addition to internal fires and seismic events, the PBAPS IPEEE analysis of high winds, floods, and other (HFO) external hazards was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. Since both PBAPS units were designed (with construction started) prior to the issuance of the 1975 Standard Review Plan (SRP) criteria, PECO

[now Exelon] performed a plant hazard and design information review for conformance with the SRP criteria. For seismic and fire events that were not screened out, additional analyses were performed to determine whether or not the hazard frequency was acceptably low. HFO events were screened out by compliance with the 1975 SRP criteria [14]. As such, these hazards were determined in the PBAPS IPEEE to be negligible contributors to overall plant risk.

Risk Assessment Attachment 12 Page 6 Although a quantifiable Fire PRA model exists for PBAPS, this model has not been approved for general use in quantified risk applications because there are several areas of conservatism in the current treatment that result in skewing the total reported CDF towards the upper bound.

PBAPS does not maintain a shutdown PRA model. However, insights from other available industry studies were utilized to allow for quantitative comparisons of the likelihood of boiling and fuel damage scenarios based on equipment availability, reliability, and decay heat levels.

The magnitude of the changes to shutdown risk resulting from EPU was estimated by examining how the corresponding increased heat load and equipment changes would impact the risk profile at PBAPS. Therefore, the impact on shutdown risk based on EPU conditions is based on more generic shutdown insights and assumptions obtained from a review of other industry BWR shutdown PRA results.

Summary In summary, it is found that the PBAPS integrated Level 1 and Level 2 PRA model provides the necessary scope and level of detail to allow the calculation of CDF and radioactive release frequency changes due to the EPU. The External Events models will allow for a review of the largest contributors to External Events risk and how they might be impacted by EPU. The information from generic shutdown PRA results will provide the capability to determine the magnitude of the changes to plant shutdown risk that would occur based on EPU implementation.

1.3 PRA DEFINITIONS AND ACRONYMS Definitions The following PRA terms are used in this study:

CDF - Core Damage Frequency (CDF) is a risk measure for calculating the frequency of a severe core damage event at a nuclear facility. CDF is calculated in units of events per reactor year. Core damage is the end state of the Level 1 Probabilistic Risk Assessment (PRA). A core damage event is defined in the PBAPS PRA by the following:

The onset of core damage is defined as the time at which more than two-thirds of the active fuel becomes uncovered, without sufficient injection available to recover the core quickly, i.e., water level below one-third core height and falling plus calculated peak core temperatures from MAAP greater than 1800°F for more than 10 minutes.

Risk Assessment Attachment 12 Page 7 LERF - Large Early Release Frequency (LERF) is a risk measure for calculating the frequency of an offsite radionuclide release that is "large" in fission product magnitude and "early" in release timing. LERF is calculated in units of events per reactor year. LERF is one of the end states of the Level 2 PRA. A large (high) and early release is defined in the PBAPS PRA by the following:

A "large" (high) magnitude release is defined as a radionuclide release of sufficient magnitude to have the potential to cause early fatalities (e.g.,

greater than 10% of the core inventory of Cesium Iodide in the release). An "early" timing release is defined as the timing in which minimal offsite protective measures can be implemented (e.g., less than 8.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> from declaration of general emergency based on PBAPS evacuation studies).

Initiating Event - Any event that causes a scram (e.g., Loss of Feedwater, MSIV Closure) and requires the initiation of mitigation systems to reach a safe and stable state. An initiating event is modeled in the PRA to represent the primary transient event that can lead to a core damage event given failure of adequate mitigation systems (i.e., adequate with respect to the transient in question).

Internal Events - Those initiating events caused by failures internal to the system boundaries. Examples include MSIV Closure, Loss of an AC Bus, Loss of Offsite Power, and internal floods.

External Events - Those initiating events caused by failures external to the system boundaries. Examples include fires, seismic events, and tornadoes.

HEP - Human Error Probability (HEP) is the probabilistic estimate that the operating crew fails to perform a specific action (either properly or within the necessary time frame) to support accident mitigation. The HEP is calculated using industry methodologies and considers a number of performance shaping factors such as:

- training of the operating crew,

- availability of adequate procedures,

- man-machine interface issues,

- time required to perform action,

- time available to perform action.

HRA - Human Reliability Analysis (HRA) is the systematic process used to evaluate operator actions and quantify human error probabilities.

MAAP - The Modular Accident Analysis Program (MAAP) is an industry recognized thermal hydraulic code used to evaluate design basis and beyond design basis accidents. MAAP can be used to evaluate thermal hydraulic profiles within the primary system (e.g., RPV pressure, boildown timing) prior to core damage. MAAP also can be used to evaluate post core damage phenomena such as RPV breach, containment mitigation, and offsite radionuclide release magnitude and timing.

Risk Assessment Attachment 12 Page 8 Level I PRA - The Level 1 PRA is the evaluation of accident scenarios that begin with an initiating event and progress to core damage. Core damage is the end state for the Level 1 PRA. The Level 1 PRA focuses on the capability of plant systems to mitigate a core damage event.

Level 2 PRA - The Level 2 PRA is a continuation of the Level 1 PRA evaluation.

The Level 2 PRA begins with the accident scenarios that have progressed to core damage and evaluates the potential for offsite radionuclide releases. Offsite radionuclide release is the end state for the Level 2 PRA. The Level 2 PRA focuses on the capability of plant systems (including containment structures) to prevent a core damage event to result in an offsite release.

RAW - The Risk Achievement Worth (RAW) is the calculated increase in a risk measure (e.g., CDF or LERF) given that a specific system, component, operator action, etc. is assumed to fail (i.e., failure probability of 1.0). RAW is presented as a ratio of the risk measure given the component is failed divided by the risk measure given the component is assigned its base failure probability.

FV - The Fussell-Vesely (FV) importance is a measure of the contribution of a specific system, component, operator action, etc. to the overall risk. F-V is presented as the percentage of the overall risk to which the component failure contributes. In other words, the F-V importance represents the overall decrease in risk if the component is guaranteed to successfully operate as designed (i.e., failure probability of 0.0).

Acronyms The following acronyms are used in this study:

AC Alternating Current ANS American Nuclear Society ARI Alternate Rod Insertion ASEP Accident Sequence Evaluation Program ASME American Society Mechanical Engineers ATWS Anticipated Transient Without Scram BEID Basic Event Identification BOC Break Outside Containment BOP Balance of Plant BWR Boiling Water Reactor CAD Containment Atmosphere Dilution CBDT Cause-Based Decision Tree CCDP Conditional Core Damage Probability CCF Common Cause Failure CDF Core Damage Frequency CET Containment Event Tree CLERP Conditional Large Early Release Probability

Risk Assessment Attachment 12 Page 9 CLTP Current Licensed Thermal Power CLTR Constant Pressure Power Uprate LTR CPPU Constant Pressure Power Uprate CRD Control Rod Drive CS Core Spray CSR Cable Spreading Room CST Condensate Storage Tank CWG Conowingo (SBO Line)

DBA Design Basis Accident DC Direct Current DHR Decay Heat Removal DW Drywell DWS Drywell Spray ECCS Emergency Core Cooling System EF Error Factor EOC End of Cycle EOP Emergency Operating Procedure EPRI Electric Power Research Institute EPU Extended Power Uprate ESW Emergency Service Water FIVE Fire Induced Vulnerability Evaluation F&O Facts and Observations FPRAIG Fire PRA Implementation Guide F-V Fussell-Vesely (risk importance measure)

FW Feedwater GE General Electric HCTL Heat Capacity Temperature Limit HEP Human Error Probability HFE Human Failure Event HFO High Winds, Floods, and Other (External Hazards)

HP High Pressure HPCI High Pressure Coolant Injection HPSW High Pressure Service Water HRA Human Reliability Analysis HX Heat Exchanger ILRT Integrated Leak Rate Test INS Instrument Nitrogen System IORV Inadvertent Open Relief Valve IPE Individual Plant Evaluation IPEEE Individual Plant Evaluation of External Events

Risk Assessment Attachment 12 Page 10 ISLOCA Interfacing Systems LOCA LAR License Amendment Request LERF Large Early Release Frequency LOCA Loss of Coolant Accident LOOP Loss of Offsite Power LP Low Pressure LPCI Low Pressure Coolant Injection LPCS Low Pressure Core Spray LTR Licensing Topical Report MCR Main Control Room MAAP Modular Accident Analysis Program MELLLA+ Maximum Extended Load Line Limit Analysis Plus MG. Motor Generator MOV Motor Operated Valve MSIV Main Steam Isolation Valve MSL Main Steam Line MSPI Mitigating Systems Performance Indicator NPSH Net Positive Suction Head NRC Nuclear Regulatory Commission NSSS Nuclear Steam Supply System OLTP Original Licensed Thermal Power OOS Out of Service PB Peach Bottom PBAPS Peach Bottom Atomic Power Station PIMS Plant Information Monitoring System PRA Probabilistic Risk Assessment PSL Pressure Suppression Limit PSSA Probabilistic Shutdown Safety Assessment PUSAR Power Uprate Safety Analysis Report R&R Risk and Reliability RAW Risk Achievement Worth (risk importance measure)

RBCCW Reactor Building Closed Cooling Water RCIC Reactor Core Isolation Cooling RCS Reactor Coolant System RG Regulatory Guide RHR Residual Heat Removal RM Risk Management RPS Reactor Protection System RPT Recirculation Pump Trip RTP Reactor Thermal Power

Risk Assessment Attachment 12 Page 11 RPV Reactor Pressure Vessel RRW Risk Reduction Worth (risk importance measure)

RWCU Reactor Water Clean-Up RWST Refueling Water Storage Tank SAMG Severe Accident Management Guidelines SBO Station Blackout SDC Shutdown Cooling SLC Standby Liquid Control SMA Seismic Margins Analysis SORV Stuck Open Relief Valve SPC Suppression Pool Cooling SR Supporting Requirement SRP Standard Review Plan SRV Safety Relief Valve SSC Systems, Structures, and Components SV Safety Valve SW Service Water TAF Top of Active Fuel TBCCW Turbine Building Closed Cooling Water TDT Torus Dewatering Tank TF Transient - Loss of Feedwater THERP Technique for Human Error Rate Prediction TT Transient - Turbine Trip URE Updating Requirements Evaluation

Risk Assessment Attachment 12 Page 12 1.4 GENERAL ASSUMPTIONS The extended power uprate (EPU) risk evaluation includes a limited number of general assumptions as follows:

This analysis is based on all the inputs provided by Exelon [15] in support of this assessment. For systems where no hardware or procedural changes have been identified, the risk evaluation is performed assuming no impact as a result of the EPU.

• Replacement of components with enhanced like components does not result in any supportable significant increase in the long-term failure probability for the components. Equipment reliability can be postulated theoretically to behave as a "bathtub" curve (i.e., the beginning and end of life phases being associated with higher failure rates than the steady-state period); however, no significant impact on the long term average of component reliability is supportable at this time and no modifications to the PRA are suggested for these types of changes.

The PRA success criteria are different than the success criteria used for design basis accident evaluations. The PRA success criteria assume that systems that can realistically perform a mitigation function (e.g., main condenser or containment venting for decay heat removal) are credited in the PRA model. In addition, the PRA success criteria are based on the availability of a discrete number of systems or trains (e.g., number of pumps for RPV makeup).

Risk Assessment Attachment 12 Page 13 Section 2 SCOPE The scope of this risk assessment for the Extended Power Uprate at PBAPS addresses the following plant risk contributors:

• Level 1 Internal Events At-Power (CDF)

• Level 2 Internal Events At-Power (LERF)

• External Events At-Power

- Seismic Events

- Internal Fires

- Other External Events

• Shutdown Assessment Risk impacts due to internal events are assessed using the PBAPS Level 1 and Level 2 2009A1 PRA Models for Pre-EPU and EPU conditions. External events are evaluated using the insights and results from the PBAPS Individual Plant Examination for External Events (IPEEE) Submittal [8]

and more recent fire PRA investigations. The impacts on shutdown risk contributions are evaluated on both qualitative and a quantitative bases.

The PBAPS IPE [17] and IPEEE [8] submittals were reviewed for identification of vulnerabilities, outliers, anomalies or weaknesses that would impact the PBAPS EPU risk assessment. The IPE submittal noted that no plant vulnerabilities leading to core damage or a large release were uncovered in the IPE process and the results of the IPE were comparable to the NRC sponsored NUREG/CR-4550 study [28]. Additionally, the IPEEE did not identify any vulnerabilities associated with seismic, fire or other external events. However, a number of areas for improvement were identified with respect to seismic and fire risk. Actions to address these and their closure are documented in the Exelon PIMS Action Request System [29]. Based on this review, there are no vulnerabilities, outliers, anomalies or weaknesses that would impact the results and conclusions of the PBAPS EPU risk assessment. In summary, all of the commitments resulting from the PBAPS IPE and IPEEE Programs have been adequately resolved.

Risk Assessment Attachment 12 Page 14 As is discussed in Section 3, all the PRA elements are reviewed to ensure that identified EPU plant, procedural, or training changes that could affect the risk profile are addressed. The information input to this process is based on the PBAPS EPU modification list developed by Exelon

[15].

Risk Assessment Attachment 12 Page 15 Section 3 METHODOLOGY This section of the report addresses the following:

• Analysis approach used in this risk assessment (Section 3.1)

• Identification of principal elements of the risk assessment that may be affected by the Extended Power Uprate and associated plant changes (Section 3.2)

• Plant changes used as input to the risk evaluation process (Section 3.3)

• PRA Scoping assessment (Section 3.4) 3.1 ANALYSIS APPROACH NEDC-33004P-A, Revision 4, "Constant Pressure Power Uprate", Class III, July 2003 [18], (also referred to as CLTR) was approved by the NRC as an acceptable method for evaluating the effects of Constant Pressure Power Uprates. Section 10.5 of the CLTR addresses the effect of Constant Pressure Power Uprate on CLTR Individual Plant Evaluation.

The approach used to examine the risk profile changes and confirm the conclusions from the CLTR for PBAPS is described in the following subsections.

3.1.1 Identify PRA Elements This task is to identify the key PRA elements to be assessed as part of this analysis for potential impacts associated with plant changes. The identification of the PRA elements stems from the ASME/ANS PRA Standard review elements [5]. Section 3.2 summarizes the PRA elements assessed for the PBAPS EPU.

3.1.2 Gather Input The input required for this assessment includes the identification of all plant hardware modifications, operational changes, and procedure updates that are implemented as part of the

Risk Assessment Attachment 12 Page 16 extended power uprate. This includes changes such as instrument setpoint changes, added equipment, and procedural modifications.

3.1.3 Scoping Evaluation This task is to perform a scoping evaluation by reviewing the plant input against the key PRA elements. The purpose is to identify those items that require further quantitative analysis and to screen out those items that are estimated to have negligible or no impact on plant risk as modeled by the PBAPS PRA model.

3.1.4 Qualitative Results The result of this task is a summary which dispositions all the risk assessment elements regarding the effects of the extended power uprate. The disposition consists of three Qualitative Disposition Categories:

Category A: Potential PRA change due to power uprate. PRA modification desirable or necessary Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change A short explanation providing the basis for the disposition is provided in Section 4.

3.1.5 Implement and Quantify Required PRA Changes This task is to identify the specific PRA model changes required to address the EPU, implement them, and quantify the models. Section 4.1 summarizes the review of PRA analysis impacts associated with the increased power level. These effects and other effects related to plant or procedural changes are identified and documented in Section 4.

Risk Assessment Attachment 12 Page 17 3.2 PRA ELEMENTS ASSESSED The PRA elements to be evaluated and assessed can be derived from a number of sources. The ASME/ANS PRA Standard [5] provides a convenient division for the internal events "elements" to be examined.

Each of the major risk assessment elements is examined in this evaluation. Most of the risk assessment elements are anticipated to be unaffected by the Extended Power Uprate. The risk assessment elements addressed in this evaluation for impact due to the EPU (refer to Section 4 for impact evaluation) include the following:

• Initiating Events

• Accident Sequence Modeling

" Systemic/Functional Success Criteria, e.g.:

- Time to Boil-off

- RPV Inventory Makeup

- Heat Load to the Suppression Pool

- Blowdown Loads

- RPV Overpressure Margin

- SRV Actuations

- SRV Capacity for ATWS

• System Modeling

• Component Reliability / Failure Data

• Human Reliability Analysis

• Internal Flooding

• LERF Analysis

" Quantification 3.3 INPUTS (PLANT CHANGES)

This section summarizes the inputs to the risk evaluation, which include hardware modifications, setpoint changes, procedural and operational changes associated with the extended power uprate.

3.3.1 Hardware Modifications The hardware modifications associated with the extended power uprate have been identified by Exelon as input to this assessment [15]. These hardware modifications were reviewed to determine their potential impact on the PRA model. This assessment is based on review of the

Risk Assessment Attachment 12 Page 18 plant hardware modifications and engineering judgment based on knowledge of the PRA models.

The majority of the changes are characterized by either:

• Replacement of components with enhanced like components, or

• Upgrade of existing components For many of the identified changes, there is either no direct PRA impact or the impact is encompassed within sensitivity cases that increase various initiator frequencies. First, the transient initiator frequencies are increased to conservatively bound the potential impact from various changes to the BOP side of the plant. Additionally, potential operational issues were taken into account in a sensitivity case for the loss of feedwater transient initiating event frequency. Finally, this analysis doubles the LOCA initiating event frequency in a quantitative sensitivity case, which is assumed to address any potential changes in the LOCA frequency related to the EPU changes.

Refer to Section 5.7.1 for results of the sensitivity cases.

Given this, however, the review did identify that the following set of changes were determined to have an impact on the PRA model.

" Install a Third Spring Safety Valve on Main Steam Line

• Install Residual Heat Removal (RHR) Heat Exchanger Cross-Tie Modifications

" High Pressure Service Water (HPSW) Cross-connect

• CST Standpipe and Swapover Point

• SLC Boron Enrichment A scoping evaluation for the changes identified above is summarized in Section 3.4-1.

Risk Assessment Attachment 12 Page 19 3.3.2 Procedural Changes In order to ensure the plant is operated safely, adjustments to the PBAPS Emergency Operating Procedures/Severe Accident Management Guidelines (EOPs/SAMGs) will be made consistent with EPU operating conditions. The full set of anticipated changes is documented in the Human Factors Evaluation discussed in Section 2.11 of the PUSAR. In almost all respects, the EOPs/SAMGs are expected to remain unchanged because they are symptom-based; however, certain parameter thresholds and curves are dependent upon power and decay heat levels and will require procedure modification.

Based on generic EPU evaluations by the nuclear steam and supply system (NSSS) vendor, General Electric [16], EOP variables that play a role in the PRA and which may require adjustment for the EPU include:

• Heat Capacity Temperature Limit (HCTL)

• Pressure Suppression Limit (PSL)

These variables may require adjustment to reflect the change in power level, but will not be adjusted in a manner that involves a change in accident mitigation philosophy. The HCTL and PSL relate to long-term scenarios and any perturbations in the scenario timings associated with EPU changes to these curves will be minor. However, because the human reliability analysis (HRA) methodology can be sensitive to these types of changes, the timing data have been explicitly addressed in the event tree evaluations and the HRA for EPU conditions in the PB209A1 PRA model.

Additional required PRA model changes have also been identified to account for changes to implement the RHR cross-tie modification when needed and to throttle the flow to meet the associated revised NPSH curves.

Risk Assessment Attachment 12 Page 20 3.3.3 Setpoint Chanqes The RPV operating pressure and the operating temperature are not being changed as part of the EPU. In addition, changes to the following setpoints which could have an impact on the PRA model are not anticipated for the EPU:

• Recirculation Pump Trip/Anticipated Transient without Scram .(RPT/ATWS) high dome pressure

" Safety Valve/Safety Relief Valve (SV/SRV) setpoints Setpoint changes for the EPU that have been identified include:

• Main Steam hi-flow instrument setpoint changes

• Cross Around Relief setpoint changes (steam piping for HP and LP turbines)

• Power Range Neutron Monitoring setpoint changes Other minor setpoint changes may be made to various systems for operational margin purposes.

Such minor setpoint changes have no direct quantifiable impact on the plant risk.

3.3.4 Plant Operating Conditions The key plant operational modifications to be made in support of the EPU are:

• Increase in the current licensed thermal power from 3514 to 3951 MWt (general change, not identified in the Modification List)

• Corresponding increase in the FW/Condensate flow and steam flow rates (general change, not identified in the Modification List)

" Following EPU (prior to MELLLA+), the acceptable region of operating flows at 100% Reactor Thermal Power (RTP) will be narrowed.

RPV pressure will remain unchanged for the EPU, and the maximum core flow will also remain unchanged.

Risk Assessment Attachment 12 Page 21 3.4 PRA SCOPING EVALUATION The scoping evaluation examines the hardware, procedural, setpoint, and operating condition changes to assess whether there are PRA impacts that need to be considered in addition to the increase in power level. These changes will also be examined in Section 4 relative to the PRA elements that may be affected. The scoping evaluation conclusions reached are discussed in the following subsections.

3.4.1 Hardware Changes The hardware changes required to support the EPU (see Section 3.3.1) were reviewed and determined not to result in new accident types or a measurable increase in the frequency of challenges to plant response. This assessment is based on review of the plant hardware modifications and engineering judgment based on knowledge of the PRA models. The majority of the changes are characterized by either:

• Replacement of components with enhanced like components, or

• Upgrade of existing components Extensive changes to plant equipment have been shown by operating experience to result in an increase in system unavailability or failure rate during the initial testing and break-in period. It can be expected that there will be some short-term increase in such events at PBAPS but the frequency and duration of such events cannot be predicted. Nevertheless, it is expected that a steady state condition equivalent to (or potentially better than) current plant performance would result.

Given this, however, the review did identify that the following set of changes were determined to have an impact on the PRA model. Reference to the PRA change discussion is noted in parenthesis.

• Install a Third Spring Safety Valve on Main Steam Line (refer to Section 4.1.2.5)

• Install Residual Heat Removal (RHR) Heat Exchanger Cross-Tie Modifications (refer to Section 4.1.2.3)

• High Pressure Service Water (HPSW) Cross-connect (refer to Section 4.1.2.3)

• CST Standpipe and Swapover Point (refer to Section 4.1.4)

" SLC Boron Enrichment (refer to Section 4.2 under the ATWS heading)

Risk Assessment Attachment 12 Page 22 3.4.2 Procedure Changes Final changes to the EOPs/SAMGs as a result of the EPU were not available prior to completion of the PRA evaluation. However, the list of anticipated changes documented in the Human Factors Evaluation discussed in Section 2.11.1.1 of the PUSAR was reviewed for applicability to the PRA model. Based on this review, for the most part it is assumed that the procedural changes (e.g.,

modification to HCTL curve) have a minor impact on the PRA results, and are encompassed within the timing changes associated with EPU conditions that have been directly factored into the risk assessment (refer to Section 4.1.6 of this report). However, specific representation for implementation of the RHR cross-tie when needed and throttling the RHR flow has been specifically included in the PRA model for EPU conditions. Refer to Section 4.1.2.3 of this report for more details on the PRA modeling of the RHR cross-tie.

3.4.3 Setpoint Changes Most of the planned setpoint changes will not result in any quantifiable impact to the PRA. Key setpoints that play a role in the PRA are planned to remain unchanged, such as:

• Main Steam SRV opening and closing setpoints

• RPV pressure setpoint (e.g., ATWS RPT high pressure setpoint)

The analyses discussed in Sections 2.8.4.2 and 2.8.5.7 of the PUSAR show that the above existing current license thermal power (CLTP) setpoints remain adequate for EPU conditions, which results in no required changes to the PRA model.

3.4.4 Normal Plant Operational Chanqes The Feedwater/Condensate flow rates will be increased to support the EPU. Despite the increase in flow, there is no indication modeling-wise that this operational change will significantly impact component failure rates or initiating event frequencies in the long term.

Risk Assessment Attachment 12 Page 23 Section 4 PRA CHANGES RELATED TO EPU CHANGES Section 3 has examined the plant changes (hardware, procedural, setpoint, and operational) that are part of the extended power uprate (EPU). Section 4 examines these changes to identify PRA modeling changes necessary to quantify the risk impact of the EPU. This section discusses the following:

• Individual PRA elements potentially affected by EPU (4.1)

• Level 1 PRA (4.2)

• Internal Fires Induced Risk (4.3)

• Seismic Risk (4.4)

• Other External Hazards Risk (4.5)

• Shutdown Risk (4.6)

• Radionuclide Release (Level 2 PRA) (4.7) 4.1 PRA ELEMENTS POTENTIALLY AFFECTED BY POWER UPRATE A review of the PRA elements has been performed to identify potential effects associated with the extended power uprate. The result of this task is a summary which dispositions all the PRA elements regarding the effects of the extended power uprate. The disposition consists of three qualitative disposition categories.

Category A: Potential PRA change due to. power uprate. PRA modification desirable or necessary Category B: Minor perturbation, negligible impact on PRA, no PRA changes required Category C: No change Table 4.1-1 summarizes the results from this review. Based on Table 4.1-1, only a small number of the PRA elements are found to be potentially influenced by the power uprate.

Risk Assessment Attachment 12 Page 24 Table 4.1-1 REVIEW OF PRA ELEMENTS FOR POTENTIAL RISK MODEL EFFECTS Disposition PRA Elements Category Basis Initiating Events B No new initiators or increased frequencies of existing initiators are anticipated to result from the PBAPS EPU. However, quantitative sensitivity cases that increase the transient and LOCA frequencies are performed as part of this analysis.

Success Criteria B There are a number of potential effects that could alter success criteria. These are discussed in the text. They include the following:

" Timing

" RPV Inventory Makeup

" Heat Load to the Suppression Pool

• Blowdown Loads

• RPV Overpressure Margin (number of SRVs/SVs required)

" SRV Actuations post-trip

" RPV Depressurization (number of SRVs required)

" Structural Evaluations

Risk Assessment Attachment 12 Page 25 Accident Sequences C For the most part, the EPU does not change the (Structure, Progression) plant configuration or operation in a manner such that new accident sequences or changes to existing accident scenario progressions result.

The one exception is the incorporation of the requirement to align the new RHR cross-tie valve under certain conditions to avoid the need for crediting containment accident pressure.

Additionally, the accident progression is slightly modified in timing. The majority of these changes are incorporated in the Human Reliability Analysis (HRA). One additional aspect is the impact on long term LOOP recovery probabilities due to timing differences to reach the containment vent pressure to prevent overpressure failure. See Section 4.1.3.

System Modeling B For the most part, no new system failure modes or significant changes in system failure probabilities due to the EPU. The exceptions for PBAPS are the incorporation of the new RHR cross-tie valve and the addition of a CST stand-pipe.

Data Analysis C No change to component failure probabilities.

Human Reliability A The change in initial power level in turn results in Analysis decreases in the time available for operator actions. See discussion of operator actions in Section 4.1.6.

Internal Flooding C No changes in the internal flooding modeling are anticipated based on EPU. The initiating event frequencies and impact vectors (i.e., the affected equipment from the flood event) from the flooding analysis are unchanged from EPU. Any changes in the overall contribution from flooding would be related to other modeling changes (e.g., HEP changes). However, quantitative sensitivity cases that increase the internal flood initiating event frequencies are performed as part of this analysis.

Risk Assessment Attachment 12 Page 26 Quantification C No changes in PRA quantification process (e.g.,

truncation limit, flag settings, etc.) due to EPU.

Level 2 B Slight changes in accident progression timing result from the increased decay heat. This resulted in slightly different release category magnitude and timing results. The release magnitude and timing category assignments were unchanged, however, since the PRA release categories are defined based on the percentage of Csl released to the environment.

The PRA elements from Table 4.1-1 are discussed to summarize whether they may be affected by the extended power uprate and the associated changes.

4.1.1 Initiating Events The CLTR states that the increase in power level results in the plant operating closer to limits which can potentially increase event frequency and affect CDF and LERF results. However, although experience indicates that major changes to equipment can increase equipment unavailability in the short-term due to break-in ("bathtub curve"), this impact cannot be easily quantified and steady state conditions are expected to be equivalent or better than current plant performance. Therefore, the evaluation of the plant and procedural changes indicates no new initiators or increased frequencies of existing initiators are anticipated to result from the PBAPS EPU.

The PBAPS PRA initiating events can be categorized into the following:

• Transients

• Loss of Offsite Power (LOOP)

• Loss of Coolant Accidents (LOCAs)

• Support System Failures

• Internal Floods

Risk Assessment Attachment 12 Page 27 Additionally, external event initiators are also discussed for completeness.

Transients The evaluation of the EPU plant and procedural changes do not result in any new transient initiators, nor is there anticipated any direct impact on transient initiator frequencies due to the EPU (i.e., no changes are being made for the EPU to the number of normally operating pumps and equipment in BOP systems). The Peach Bottom transient initiating event frequencies are calculated by performing a Bayesian update of generic industry frequencies obtained from NUREG/CR-6928 supplemented with information from NUREG/CR-5750 with Peach Bottom specific experience over the dates January 1, 2003 to December 31, 2008. This method establishes an accepted basis for the applicability of the transient initiating event frequencies utilized in the Peach Bottom PRA model.

However, sensitivity quantifications were performed that increase the turbine trip initiator frequency and loss of condenser vacuum initiating event frequency to bound the various changes to the BOP side of the plant (e.g., main turbine modifications). Additionally, potential operational issues were taken into account in the sensitivity case for the loss of feedwater transient scenario (refer to Table 5.7-1).

Loss of Offsite Power (LOOP)

No change in the Loss of Offsite Power initiating event frequency is expected. Analysis described in Sections 2.3.2 and 2.3.3 of the PUSAR indicated that the existing off-site power and on-site power systems were determined to be adequate for operation with the EPU related electrical output. The isolated phase bus duct was modified to accommodate the additional power output.

Based on this analysis, there is no significant impact on grid stability due to the PBAPS EPU.

LOCAs No changes to RPV operating pressure, inspection frequencies, or primary water chemistry are planned in support of the EPU; as such, no impact on LOCA frequencies due to the EPU can be postulated. However, acknowledging that increased flow rates of the EPU can result in increased piping erosion/corrosion rates, a risk sensitivity case quantification is performed that increases the LOCA initiating event frequencies including main steam and feedwater line breaks (refer to Table 5.7-1).

Risk Assessment Attachment 12 Page 28 Support System Initiators No significant changes to support systems (e.g., AC, DC, Service Water, etc.) are planned in support of the EPU; as such, no impact on support system initiating event frequencies due to the EPU can be postulated.

Internal Flood Initiators Since the methodology used in calculating the initiating event frequency for internal flooding is based on the length of piping found within a system and the fact that the geometry and most of the flow rates associated with the major flooding sources are not changing, the internal flooding initiator frequencies remained the same. The addition of the RHR cross-tie piping was examined for potential impact and was determined to be a very negligible contributor to the internal flood frequency in those areas. However, since the higher flow rates associated with EPU could have an impact on some of the internal flooding initiating event frequencies (e.g., steam and feedwater flow rates), a separate sensitivity evaluation was explored which conservatively increased all of the internal flood frequencies. Refer to Section 5.7.1 for results of the sensitivity cases.

External Event Initiators The frequency of external event initiators (e.g., fires, seismic events, extreme winds) is not linked to reactor power or operation; as such, no impact on external event initiator frequencies due to the EPU can be postulated.

The CLTR states that the increase in power level could have an impact on the PBAPS PRA external events, which could impact the CDF and LERF results. However, since the frequency of external events is not affected by EPU, the potential impacts on their mitigation (fire, seismic, and other external events) are discussed in more detail in Sections 4.3, 4.4, and 4.5, respectively.

Internal Events Summary No planned operational modifications as part of the PBAPS EPU include operating equipment beyond design ratings. However, sensitivity cases that increase transient initiating event frequencies are quantified in this EPU risk analysis to bound the various changes to the BOP side of the plant and potential operational issues (refer to Section 5.7.2).

Risk Assessment Attachment 12 Page 29 In summary, it is anticipated that the long-term initiating event frequency is unchanged and no change is being made to the PRA initiating events in the base case analysis as a result of EPU.

This is consistent with CLTR conclusions on this issue:

"Basedon PRA experience for upratedBWRs, EPU is not expected to have a majoreffect on the initiating event frequencies, as long as equipment operating limits, conditions,and/orratings are not exceeded."

4.1.2 Success Criteria The success criteria for the 2009A pre EPU PRA are derived based on realistic evaluations of system capability over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> mission time of the PRA analysis. These success criteria therefore may be different than the design basis assumptions used for licensing PBAPS. PRA Analyses are required to consider all proceduralized plant capabilities not limited to those credited as part of plant's design basis to obtain an accurate evaluation of risk. For example, CRD flow for injection to the RPV is credited after initial injection from HPCI or RCIC to avoid core damage in the PRA model, but this is not credited in any design basis analysis. This analysis uses the PRA to provide insights about how plant risk from postulated accidents, including severe accidents, is impacted by EPU implementation. The following subsections discuss different aspects of the success criteria as used in the PRA. Both the PBAPS EPU task reports performed by General Electric and MAAP 4.0.6 runs [19] performed for the PBAPS EPU risk assessment were used to assess impacts on success criteria.

4.1.2.1 Timing Shorter times to boil-off are likely on an absolute basis due to the increased power levels. The reduction in timings can impact the human error probability calculations, especially for short-term operator actions. This has been directly factored into revised HEP values for EPU conditions (See HRA discussion in Section 4.1.6).

Risk Assessment Attachment 12 Page 30 4.1.2.2 RPV Inventory Makeup Requirements The PRA success criteria for RPV makeup remains the same for the post-uprate configuration.

Both high pressure (e.g., FW, HPCI, and RCIC) and low pressure (e.g., LPCI, CS, and condensate) injection systems have more than adequate flow margin for the post-uprate configuration. This includes the EPU reduction in the maximum RHR flow rate to 10,600 GPM.

RPV injection systems that were considered marginal in the pre-uprate configuration (e.g., CRD) as an independent RPV makeup source during the initial stages of an accident are still deemed marginal and are not adequate in the post-uprate configuration. However, following initial operation of another injection system, CRD remains a viable RPV makeup source at high and low pressures in the post-EPU configuration (i.e., late injection source) for certain accidents. All success criteria have been verified with MAAP4.0.6 runs for both pre-EPU and EPU conditions.

4.1.2.3 Heat Load to the Pool Energy to be absorbed by the pool during an isolation event or RPV depressurization increases for the EPU case relative to the original license basis power level. For non-ATWS scenarios, the RHR heat exchangers, the main condenser, and the containment vent all have capacities that exceed the increase in heat load due to extended power uprating. The heat removal capability margins are sufficiently large such that the changes in power level associated with EPU do not affect the success criteria for these systems. By design, the main condenser and RHR SPC systems are sufficient for containment heat removal for the EPU condition [Refer to Section 2.6.5 of the PUSAR]. With respect to containment venting, MAAP run PBOO10 shows that the emergency containment vent is clearly sufficient for the EPU conditions. Note that run PBOO10 assumes loss of all injection at the time of the vent for the purposes of evaluating other accident issues, but the vent is successful in controlling containment pressure.

One change to the RHR system has been implemented regarding eliminating the need to credit containment accident pressure for design basis LOCA calculations. That is, a split flow alignment of the heat exchangers is employed in response to LOCA conditions. This has been factored into the risk assessment in the following fashion:

Risk Assessment Attachment 12 Page 31 a) The drag valves or orifices between the RHR pump and the RHR heat exchanger are replaced with MOVs with divisional power dependencies.

b) A cross-tie MOV between the A and C RHR pumps (and the B and D RHR pumps) is included to allow for split flow from one RHR pump to discharge to both heat exchangers in the RHR loop.

c) A human error probability (HEP) has been developed to represent the human failure rate associated with aligning suppression pool cooling in a timely fashion given the conditions exist that require the cross-tie to be implemented for success of systems taking suction from the suppression pool. The initial HEP value has been derived at 6.OE-2 for implementation in the PRA model. A longer term action is also included to reflect the need to align the RHR cross-tie and throttle the flow to maintain NPSH. The HEP value associated with this action is much lower since it only includes the remaining execution steps (i.e., the cognitive contribution to the initial HEP evaluation dominates the failure probability) d) Logic has been added to the model to include the requirement for success of the cross-tie with flow through both RHR heat exchangers in a loop for the scenarios of interest (i.e., large break LOCA initiator with coincident containment isolation failure).

e) The success criteria for other scenarios (i.e., non DBA type LOCA scenarios) remain the same in the model.

For the HPSW cross-connect, representation of the cross-connect valve was already included in the PRA model for beyond design basis events. Use of the HPSW cross-connect will come into play for those scenarios where flow from the opposite HPSW loop is required to meet the RHR heat exchanger service water flow requirements (including the cases when flow through two heat exchangers is now required).

Additionally, changes for EPU will be made to install a manual power supply transfer switch for the HPSW cross-connect valve to be powered from an alternate power supply and replace existing MOV actuators with a larger size. Credit for this manual transfer switch was conservatively not included in the risk evaluation. Otherwise, these modifications are considered to be upgrades and enhancements to existing components, which are expected to have a positive risk impact.

Risk Assessment Attachment 12 Page 32 4.1.2.4 Blowdown Loads Dynamic loads would increase slightly because of the increased stored thermal energy. This change would not quantitatively influence the PRA results. Analyses for LOCA under EPU conditions indicate that dynamic loads on containment remain acceptable for the EPU case [Refer to Section 2.6 of the PUSAR].

4.1.2.5 RPV Overpressure Margin The RPV dome operating pressure will not be increased as a result of the power uprate. However, the RPV pressure following a failure to scram is expected to increase slightly. For transient scenarios, Section 2.8.4.2 of the PUSAR indicates that there is sufficient overpressure protection for transient response especially since an additional SV is being added for ATWS considerations as part of the EPU modifications. Since the dominant failure mechanism will remain as common cause failure of the SRVs (as data for group-sizes larger than eight is typically not available), there would be no change to the common cause failure contribution and any increase in the independent failure contributions to risk (not modeled) would be extremely negligible.

For ATWS scenarios, Section 2.8.5.7 of the PUSAR indicates that with the incorporation of an additional safety valve and with changes to the RPT system that allow for quicker trip of the recirculation pump trips, there is actually more margin to the ASME Service Level C peak RPV pressure criterion. As such, there is no change warranted to the overpressure success criteria for ATWS scenarios.

The 2009A pre EPU PBAPS PRA does not require any SRVs for initial RPV overpressure control for LOCA initiators. This success criterion also remains unchanged for the EPU.

As such, no model changes to the PBAPS PRA regarding this function are required for this EPU risk assessment.

Risk Assessment Attachment 12 Page 33 4.1.2.6 SRV Actuations The SRV setpoints have not been changed as a result of the PBAPS EPU. Given the power increase of the EPU, one may postulate that the probability of a stuck open relief valve given a transient initiator would increase due to an increase in the number of SRV cycles.

The 2009A PRA base stuck open relief valve probability may be modified using different approaches to consider the effect of a postulated increase in valve cycles. The following three approaches are considered:

1. The upper bound approach would be to increase the stuck open relief valve probability by a factor equal to the increase in reactor power (i.e., a factor of 1.125 in the case of the PBAPS EPU). This approach assumes that the stuck.

open relief valve probability is linearly related to the number of SRV cycles, and that the number of cycles is linearly related to the reactor power increase.

2. A less conservative approach to the upper bound approach would be to assume that the stuck open relief valve probability is linearly related to the number of SRV cycles, but the number of cycles is not necessarily directly related to the reactor power increase. In this case the postulated increase in SRV cycles due to the EPU would be determined by thermal hydraulic calculations (e.g., MAAP runs).

3. The lower bound approach would be to assume that the stuck open relief valve probability is dominated by the initial cycle and that subsequent cycles have a much lower failure rate. In this approach the base stuck open relief valve probability could be assumed to be insignificantly changed by a postulated increase in the number of SRV cycles.

Approach #1 is used to modify the PRA stuck open relief valve probability. The SORV probability basic events in the PBAPS PRA are increased 12.5% for the EPU base case risk evaluation:

Pre-EPU EPU BE ID Description Probability Probability APHSRVTMDX SRVS FAIL TO RECLOSE 1.90E-3 2.14E-3 12 / MSIV CLOSURE EVENTS APHSRVTTDXI SRVS FAIL TO RECLOSE 2.40E-4 2.70E-4 2 / TT OR TF EVENTS

Risk Assessment Attachment 12 Page 34 Note that for ATWS scenarios, even though an extra safety valve is available, the fail to reclose probability of the SRVs is based on all 11 SRVs being challenged. This would not change for EPU such that a PRA model change is not warranted. Additionally, it is noted that the stuck open relief valve (SORV) probability for ATWS scenarios is not a risk significant contributor to the PRA model results. As such, any postulated change to the SORV probability for ATWS scenarios due to EPU would result in a negligible change to the CDF and LERF risk metrics.

4.1.2.7 RPV Emergency Depressurization The current 2009A PRA requires two SRVs for RPV emergency depressurization. MAAP cases performed in support of this EPU risk assessment show that this success criterion remains unchanged by the EPU. Therefore, the PRA success criterion of 2 SRVs is maintained in this analysis. Note however, that there are some timing differences related to maintaining this requirement, and these have been factored into the human error probabilities for emergency depressurization as described in Section 4.1.6 below.

4.1.2.8 Structural Evaluations This assessment did not identify issues associated with postulated impacts from the EPU on the PRA modeling of structural (e.g., piping, vessel, containment) capacities. This is consistent with CLTR conclusions on this issue [16]:

"The RPV is analyzed for power uprate conditions. Transients, accident conditions, increased fluence, and past operating history are considered to recertify the vessel. Plant specific analyses at power uprate conditions demonstrates that containment integrity will be maintained."

.... no significant effect on LOCA probability. Increase in flow rates is addressed by compliance with Generic Letter 89-08, Erosion/Corrosionin Piping..."

4.1.2.9 Success Criteria Summary The PRA success criteria are affected by the increased boil off rate, the increased heat load to the suppression pool, and the increase in containment pressure and temperatures.

Risk Assessment Attachment 12 Page 35 MAAP runs demonstrate the significant margins associated with the installed systems. However, MAAP runs did indicate the impact of EPU on timing for achieving success. The impact of these timing changes is then reflected in the human error probabilities developed for the PB209A1 EPU PRA model. The impact of these changes on the human reliability analysis is described in more detail in Section 4.1.6 below.

Besides the change to the RHR heat exchanger alignment under certain situations, the changes to the SORV probabilities, the changes for the CST standpipe, and the timing issues described above, no other changes in the modeled success criteria have been identified for the Level 1 or Level 2 PRA.

This assessment is consistent with CLTR conclusions on this issue:

"Basedon PRAs done for other upratedplants, EPU is not expected to have a major impact on the PRA success criteria."

The changes described above and in the operator response section below are directly factored into the risk assessment and the changes to CDF and LERF are reported.

4.1.3 Accident Sequence Modelinq For the most part, the EPU does not change the plant configuration or operation in a manner such that new accident sequences or changes to existing accident scenario progressions result.

This assessment for PBAPS is consistent with CLTR conclusions on this issue [16]:

"The basic BWR configuration, operation and response is unchanged by power uprate. Generic analyses have shown that the same transients are limiting. ... Plant-specific analyses demonstrate that the accident progressionis basically unchanged by the uprate."

One exception is the reduction in available accident progression timing for some scenarios and the associated impact on operator action HEPs (this aspect is addressed in the Human Reliability Analysis section). The other exception for PBAPS is the need to align the cross-tie valve for the

Risk Assessment Attachment 12 Page 36 RHR system to eliminate the need for crediting containment accident pressure under certain conditions as described in Section 4.1.2.3 above.

Another aspect of the accident sequence modeling to consider is the impact on LOOP recovery times. Note that the short term LOOP response is driven by things such as battery capacity that are not being affected by the EPU. However, the longer term LOOP response is sensitive to EPU since it is partially based on the time to reach containment venting conditions which is a direct function of the decay heat level. There are two longer term time frames utilized in the PRA model (10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> for LOCA cases and 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for non-LOCA cases). These broad categories are not based on any one MAAP run, but a series of potentially representative runs. MAAP runs [19] for EPU conditions indicate that about 10-15% timing change can be anticipated depending on various aspects of the accident sequence progression. To account for this, the LOOP failure to recover probability basic events in the PBAPS PRA are adjusted to account for 15% less time available for the EPU base case risk evaluation. Note that the reported times in the basic event descriptions are not changed for this initial EPU assessment, but the values are changed to reflect the reductions in times that would be available.

Pre-EPU EPU Probabilit Probabilit BE ID Description y y NOOSP201 0-GRID FAILURE TO RECOVER OSP AT 20 HRS / 0.189 0.205 NO RECOVERY AT 10 HRS - GRID RELATED LOOP NOOSP2010- FAILURE TO RECOVER OSP AT 20 HRS / 0.203 0.214 PLANT NO RECOVERY AT 10 HRS - PLANT RELATED LOOP NOOSP2010- FAILURE TO RECOVER OSP AT 20 HRS / 0.219 0.232 SWYD NO RECOVERY AT 10 HRS -

SWITCHYARD RELATED LOOP NOOSP2010- FAILURE TO RECOVER OSP AT 20 HRS / 0.596 0.612 WTHR NO RECOVERY AT 10 HRS - WEATHER RELATED LOOP NOOSP105-GRID FAILURE TO RECOVER OSP IN 10 HRS / 0.275 0.388 NO RECOVERY IN 5 HRS - GRID RELATED LOOP NOOSP105-PLANT FAILURE TO RECOVER OSP IN 10 HRS / 0.264 0.373 NO RECOVERY IN 5 HRS - PLANT RELATED LOOP

Risk Assessment Attachment 12 Page 37 NOOSP105-SWYD FAILURE TO RECOVER OSP IN 10HRS / 0.287 0.398 NO RECOVERY IN 5 HRS - SWITCHYARD RELATED LOOP NOOSP105-WTHR FAILURE TO RECOVER OSP IN 10HRS / 0.656 0.731 NO RECOVERY IN 5 HRS - WEATHER RELATED LOOP Similarly, the AC power non-recovery probabilities utilized in the Level 2 analysis are also adjusted to account for less time available to recover off-site power to prevent vessel failure. The adjusted conditional Level 2 model non-recovery probabilities are shown below.

EPU Pre-EPU Probabilit BE ID Description Probability y 2RX-IBE- OFFSITE POWER NOT RECOVERED IN 0.224 0.305 OPFPLANT TIME TO PREVENT VESSEL FAILURE (RPV AT HIGH PRESSURE) FOR CLASS IBE - PLANT RELATED LOOP 2RX-IBE-OPF- OFFSITE POWER NOT RECOVERED IN 0.263 0.350 SWYD TIME TO PREVENT VESSEL FAILURE (RPV AT HIGH PRESSURE) FOR CLASS IBE - SWITCHYARD RELATED LOOP 2RX-IBE-OPF-GRID OFFSITE POWER NOT RECOVERED IN 0.314 0.410 TIME TO PREVENT VESSEL FAILURE (RPV AT HIGH PRESSURE) FOR CLASS IBE - GRID RELATED LOOP 2RX-IBE-OPF- OFFSITE POWER NOT RECOVERED IN 0.630 0.694 WTHR TIME TO PREVENT VESSEL FAILURE (RPV AT HIGH PRESSURE) FOR CLASS IBE - WEATHER RELATED LOOP 2RX-IBE- OFFSITE POWER NOT RECOVERED IN 0.170 0.224 OPSPLANT TIME TO PREVENT VESSEL FAILURE (RPV AT LOW PRESSURE) FOR CLASS IBE - PLANT RELATED LOOP 2RX-IBE-OPS- OFFSITE POWER NOT RECOVERED IN 0.205 0.263 SWYD TIME TO PREVENT VESSEL FAILURE (RPV AT LOW PRESSURE) FOR CLASS IBE - SWITCHYARD RELATED LOOP 2RX-IBE-OPS-GRID OFFSITE POWER NOT RECOVERED IN 0.246 0.314 TIME TO PREVENT VESSEL FAILURE (RPV AT LOW PRESSURE) FOR CLASS IBE - GRID RELATED LOOP

Risk Assessment Attachment 12 Page 38 2RX-IBE-OPS- OFFSITE POWER NOT RECOVERED IN 0.579 0.630 WTHR TIME TO PREVENT VESSEL FAILURE (RPV AT LOW PRESSURE) FOR CLASS IBE - WEATHER RELATED LOOP 2RX-IBL- OFFSITE POWER NOT RECOVERED IN 0.329 0.418 OSPPLANT TIME TO PREVENT VESSEL FAILURE FOR CLASS IBL - PLANT RELATED LOOP 2RX-IBL-OSP- OFFSITE POWER NOT RECOVERED IN 0.354 0.442 SWYD TIME TO PREVENT VESSEL FAILURE FOR CLASS IBL-SWITCHYARD RELATED LOOP 2RX-IBL-OSP-GRID OFFSITE POWER NOT RECOVERED IN 0.342 0.434 TIME TO PREVENT VESSEL FAILURE FOR CLASS IBL - GRID RELATED LOOP 2RX-IBL-OSP- OFFSITE POWER NOT RECOVERED IN 0.703 0.759 WTHR TIME TO PREVENT VESSEL FAILURE FOR CLASS IBL - WEATHER RELATED

_LOOP 4.1.4 System Modeling For the most part, the PBAPS plant changes associated with the EPU do not result in the need to change any system modeling in support of this risk assessment. One exception is the addition of the cross-tie valve for the RHR system to eliminate the need for crediting containment accident pressure under certain conditions. The impact on the PRA modeling from this modification was described above in Section 4.1.2.3.

Another system modification that required changes to the PRA system modeling was the addition of the CST standpipe for the hotwell reject/makeup line nozzle. This impacted the system modeling as follows:

a) First, it eliminates the potential scenario that inadvertently drains the CST to the hotwell.

This is implemented in the EPU PRA model by eliminating the logic gates that included this diversion path for water in the CST.

Risk Assessment Attachment 12 Page 39 b) Second, however, since this line also provides the suction source for CRD, the available CST inventory to support CRD injection is reduced. Since the standpipe elevation would require that CST makeup be provided from the RWST or TDT via use of the refueling water transfer pumps (i.e. gravity drain from those tanks would not be viable to support extended CRD injection to the RPV), then credit for gravity drain was removed from the model.

4.1.5 Data Analysis (Component Reliability)

The CLTR states that the minimum acceptable required system or component capability may increase as a result of the increased power level, which may affect the system or component reliability and CDF and LERF results.

However, EPU will not significantly impact the reliability of equipment. The majority of the hardware changes in support of the EPU may be characterized as either:

• Replacement of components with enhanced like components

" Upgrade of existing components Although equipment reliability as reflected in failure rates can be theoretically postulated to behave as a "bathtub" curve (i.e., the beginning and end of life phases being associated with higher failure rates than the steady-state period), no significant effect on the long-term average of initiating event frequencies, or equipment reliability during the 24 hr. PRA mission time due to the replacement/modification of plant components is anticipated, nor is such a quantification supportable at this time. No planned operational modifications as part of the PBAPS EPU include operating equipment beyond design ratings. Therefore, no significant effect on the long-term average failure rates (initiating events and equipment reliability) due to replacement/modification of components is anticipated. If any degradation were to occur as a result of EPU implementation, existing plant monitoring programs would address any such issues. This assessment is consistent with CLTR conclusions on this issue [18]:

"...CPPU is not expected to have a major effect on component or system reliability, as long as equipment operating limits, conditions, and/or ratings are not exceeded."

Risk Assessment Attachment 12 Page 40 Additionally, it is noted that minor variations in system or component design response times that may be postulated or planned due to the EPU would not impact the PRA risk profile. A review of the PBAPS EPU System Task Reports that affect systems modeled in the PRA was performed.

These task reports identify the EPU effects on the subject system. There are no significant changes to system and component response times due to the EPU for any of these systems, and thus, there is no impact on the PRA risk profile or EPU risk assessment.

4.1.6 Human Reliability Analysis (Operator Response)

The CLTR states that the increase in power level results in changes to event dynamics.

The PBAPS risk profile, like other plants, is dependent on the operating crew actions for successful accident mitigation. The success of these actions is in turn dependent on a number of performance shaping factors. The performance shaping factor that is principally influenced by the power uprate is the time available within which to detect, diagnose, and perform required actions.

The higher power level results in reduced times available for some actions.

MAAP calculations for the PBAPS EPU configuration were performed to determine how the operator action timelines were impacted. All the post-initiator human error probabilities (HEPs) in the model were then re-calculated using the same human reliability analysis (HRA) methods used in the PBAPS HRA document. Refer to Table 4.1-2 for a summary of the changes in operator action timings and associated HEPs due to the EPU. Table 4.1-3 includes the corresponding changes to the human reliability dependency analysis. Application specific model documentation, PB-ASM-001 [19] provides detailed documentation of the impact of EPU on the HRA. The methodology employed for the derivation of the post-initiator HEPs in the Peach Bottom HRA is described below.

One additional action was added to the model related to aligning an RHR cross-tie to two RHR heat exchangers supported by two HPSW pumps to allow operation of the pumps with suction from the suppression pool without crediting containment accident pressure. Specific control

Risk Assessment Attachment 12 Page 41 room indications that will be made to support the use of the RHR cross-tie and HPSW cross-connect modifications are subsumed in the human reliability assessment for those actions.

Other than that, no significant changes are to be made to the Control Room for the EPU that would impact the existing actions included in the PBAPS PRA human reliability analysis.

Potential changes to be made to the Control Room displays for the EPU are re-scaling certain indicators/recorders and/or replacement of certain indicators with digital units. None of these Control Room display changes will have a measurable impact on the human reliability analysis for the PBAPS PRA. However, the changes that were identified to the HEP values as identified in Tables 4.1-2 and 4.1-3 are factored directly into the risk assessment and the changes to CDF and LERF are reported.

Post-Initiator HRA Methodology The human error probability values for the new Human Failure Events (HFEs) for aligning the RHR cross-tie and all other risk significant post-initiator actions (where significant HFEs are defined here as having a risk achievement worth (RAW) greater than or equal to 2.0 or a risk reduction worth (RRW) greater than or equal to 1.005) are derived from a combination of analytical methods. The EPRI Cause Based Method [25] and the ASEP HRA time reliability correlation [26] procedure have been chosen as the bases for determining the non-response probabilities (Pc) for Peach Bottom analysis. The execution error (PE) is derived using the NUREG/CR-1278 [27] HRA procedure called Technique for Human Error Rate Prediction (THERP). The final HEP value utilized in the PRA model includes both components of the post-initiator HEPs (Pc + PE).

The cause-based approach involves the identification of situation-specific error factors. The approach is one of decomposition, consisting of identifying potential failure mechanisms and, for each mechanism, identifying specific causes of human error, evaluating the impact of certain performance shaping factors on a human action specific basis, and also allowing for potential recovery mechanisms. This is essentially an analytical approach, as opposed to the empirical approach represented by the use of human reliability curves. The actions for which the cause-based approach is used exclusively are generally not time limited. Available time is considered primarily in the application of the recovery factors, whose impact is considered to be time

Risk Assessment Attachment 12 Page 42 dependent. The cause-based evaluation is performed for each Peach Bottom post-initiator human action identified for evaluation.

The ASEP HRA Time Reliability Correlation Procedure is a shortened version of the procedure, models, and data for HRA that are presented in the Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications (NUREG/CR- 1278). This procedure was developed to enable system-knowledgeable personnel to perform an effective analysis. The time dependent non-response probabilities (Pc) from the methodology are applied according to its basic principles for short-term actions (time available for diagnosis, Td <1 hour) in order to compensate for possible non-conservative estimates produced by the cause-based method.

The non-response probability for short-term action is taken to be the sum of the cause-based and ASEP results; longer term actions (time available for diagnosis, Td >=1 hour) do not include the ASEP component.

4.1.7 Internal Flooding No changes in the internal flooding modeling were incorporated based on EPU. The initiating event frequencies and impact vectors (i.e., the affected equipment from the flood event) from the flooding analysis are unchanged from EPU. Any changes in the overall contribution from flooding would be related to other modeling changes (e.g., HEP changes).

4.1.8 Quantification No changes in the PBAPS PRA quantification process (e.g., truncation limit, etc.) due to the EPU have been identified (nor were any anticipated). Changes in the quantification results (accident sequence frequencies) were realized as a result of the minor modeling changes described above.

4.1.9 Level 2 PRA Analysis The Level 2 PRA framework, functional fault trees, and Level 2 basic event failure probabilities remain unchanged in the transition from pre-EPU to EPU.

Risk Assessment Attachment 12 Page 43 Fission product inventory in the reactor core is higher as a result of the increase in power due to the EPU. The increase in fission product inventory results in an increase in the total radioactivity available for release given a severe accident. The total activity available for release is approximately 12.5% higher. However, this does not impact the definition or quantification of the LERF risk measure used in Regulatory Guide 1.174, and as the basis for this risk assessment.

The PBAPS PRA release categories are defined based on the percentage (as a function of EOC inventories) of CsI released to the environment, this is consistent with most industry PRAs.

Given the minor change in Level 1 results, minor changes in the Level 2 release frequencies can be anticipated. Such changes are directly attributable to the changes described previously and the minor changes in short term accident sequence timing and the impact on HEPs. The structure of the accident sequence modeling in the Level 2 PRA is not impacted by the EPU. MAAP4.0.6 calculations for pre-EPU and EPU conditions showed that although variations in the absolute magnitude of the releases may occur and reductions in the calculated times between the declaration of a General Emergency and the time of first fission product release to the environment may occur, neither of the differences would be sufficient to alter the assigned release categories in the Level 2 containment event trees.

Although radiological source terms might be higher from EPU power levels, the definition of LERF in the PBAPS PRA is based on fractional releases which do not change. The PBAPS PRA does not include a Level 3 model and this is not explicitly required to be evaluated for EPU.

Risk Assessment Attachment 12 Page 44 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC NUMB PBAPS BE ID PASCTION I HUMAN PRE-EPU ERROR EPU HUMAN ERROR EPU BASIS ER DESCRIPTION PROBABILITY1 PROBABILITY Al AHU--650DX12 OPERATOR FAILS TO 3.8E-03 2.2E-02 EPU conditions reduce system DEPRESSURIZE TO 650 PSIG window (i.e., the end of system FOR CONDENSATE window. reduced from 23 to 19 INJECTION minutes).

A2 AHUALTDPDXI2 FAILURE TO OPEN NON-ADS 2.5E-02 3.5E-02 EPU conditions reduce system SRVS OR TBP VALVES window (i.e., the end of system window reduced from 12.4 to 10.9 minutes).

A3 AHU-ATWSDX12 FAILURE TO EMERG 1.OE-02 1.3E-02 EPU conditions reduce system DEPRESSURIZE AFTER HPI window (i.e., the end of system FAILS IN ATWS window reduced from 12.4 to 10.9 minutes).

A50 AHU--BCIDXI2 OPERATOR FAILS TO 3.5E-03 2.3E-02 EPU conditions reduce system BYPASS CONTAINMENT window (i.e., the end of system ISOLATION window reduced from 23 to 19 minutes).

A4 AHUBTL-RDXI2 OPERATOR FAILS TO VALVE 1.3E-03* 1.4E-03 EPU conditions reduce system IN N2 BOTTLES (FROM MCR) (1.9E-03) window (i.e., the end of system window reduced from 47.9 to 40.6 minutes). Also, MAAP basis changed from PB0005 to PBOO07 as more representative.

1 Pre-EPU HEPs marked with an "*"symbol have been updated to be consistent with the EPU HRA and to maintain an appropriate basis for comparison. Prior values are shown in parenthesis.

Risk Assessment Attachment 12 Page 45 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A4 AHUBTL-RDXD2 OPERATOR FAILS TO VALVE 1.0* 9.3E-01 EPU conditions reduce system IN N2 BOTTLES (FROM MCR) (0.68) window (i.e., the end of system

- LATE, CONDITIONAL. window reduced from 47.9 to 40.6 minutes). Also, MAAP basis changed from PBOO05 to PBOO07 as more representative.

A5 AHU--CADDXl2 OPERATOR FAILS TO ALIGN 1.1E-02* 2.3E-02 EPU conditions reduce system CAD TANK TO UNIT 2 INS 'B' (3.8E-02) window (i.e., the end of system window reduced from 47.9 to 40.6 minutes). Also, removed over conservatism of doubling the manipulation time estimate.

A6 AHU--FINDXI2 OPERATOR FAILS TO INHIBIT 2.1E-03* 2.9E-03 EPU conditions reduce system ADS (2.4E-03) window (i.e., the end of system window reduced from 21.5 to 17.6 minutes). Also, removed over conservatism of delay time to recognize cue.

A7 AHU--INFDXl2 FAILURE TO INHIBIT ADS IN 1.5E-02* 1.6E-02 On re-examination of SP ATWS WITH FEEDWATER (2.1E-03) conditions, it was determined.

AVAILABLE that level reduction to -172" would be required on high SP temp. Action to inhibit ADS now required by 12.5 minutes for pre EPU and 12.2 minutes for EPU.

Risk Assessment Attachment 12 Page 46 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC NUMB PBAPS BE ID PASCTION I HUMAN PRE-EPU ERROR EPU HUMAN ERROR EPU BASIS ER DESCRIPTION PROBABILITY1 PROBABILITY A8 AHU--INXDXI2 FAILURE TO INHIBIT ADS IN 2.1E-02* 2.2E-02 EPU conditions reduced the time ATWS W/O FEEDWATER (1.3E-02) available for response, but the AVAILABLE basis was also changed from high DWP/low level to low level with high DWP bypass (10.5 minutes) as it is more limiting.

A10 AHU--SSIDXl2 OPERATOR FAILS TO 3.7E-04 4.4E-04 EPU conditions reduce system INITIATE EMERGENCY window (i.e., the end of system DEPRESSURIZE (STEAM window reduced from 37 to 32 MEDIUM LOCA) minutes).

A10 AHU--WSIDXl2 OPERATOR FAILS TO 1.8E-02 No change PBAPS MAAP calculations INITIATE EMERGENCY bound the relevant LGS DEPRESSURIZE (WATER calculation that is used as the MEDIUM LOCA) system window basis. EPU conditions would impact the scenario slightly, but the break size is considered to dominate the results and the PBAPS bounding cases imply the LGS calc is still valid, so the LGS calc has been retained as the basis (10 minutes to CD).

All AHU--XTEDXl2 FAILURE TO INITIATE 3.2E-04 3.3E-04 EPU conditions reduce system MANUAL window (i.e., the end of system DEPRESSURIZATION (LOOP window reduced from 47.9 to CASES) 40.6 minutes).

Risk Assessment Attachment 12 Page 47 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY All AHU--XTRDXI2 FAILURE TO INITIATE 3.2E-04 3.3E-04 EPU conditions reduce system MANUAL window (i.e., the end of system DEPRESSURIZATION (NON- window reduced from 47.9 to LOOP CASES) 40.6 minutes).

A9 BHU--MAXDXI2 FAILURE TO MAXIMIZE CRD 2.1E-02 No change EPU conditions reduce system FLOW PER T-246 window; however, the diagnosis time remains in the same CBDT time frame and the HEP is not impacted.

A12 BHU-PUMPDXI2 FAILURE TO START 6.9E-03 No change EPU conditions reduce system STANDBY CRD PUMP OR window; however, the diagnosis RESTART RUNNING PMP time remains in the same CBDT time frame and the HEP is not impacted.

A13 DHU--DWSDXl2 OPERATORS FAIL TO UTILIZE 7.6E-04 No change EPU conditions reduce system DWS FOR DHR window; however, the diagnosis time remains in the same CBDT time frame and the HEP is not

. _ impacted.

A45 DHU-LEAKDXI2 OPERATOR FAILS TO STOP 9.4E-04 No change The timing basis is unrelated to LEAK FLOOD BY TRIPPING reactor power and the HEP was PUMP not impacted.

A45 DHU-RUPTDX12 OPERATOR FAILS TO STOP 5.7E-02 No change The timing basis is unrelated to RUPTURE FLOOD BY reactor power and the HEP was TRIPPING PUMP not impacted.

Risk Assessment Attachment 12 Page 48 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID DESCRIPTION HUMAN ERROR ERROR ER P BBSCTION PROBABILITYN PROBABILITY A14 DHU--SDCDXl2 FAILURE OF OPERATOR TO 2.9E-03 No change EPU conditions reduce system INITIATE RHRISDC window; however, the diagnosis time remains in the same CBDT time frame and the HEP is not impacted.

A15 DHU--SPADXI2 FAILURE OF OPERATOR TO 2.OE-03 2.3E-02 EPU conditions reduce system INITIATE RHR/SPC(ATWS) window (i.e., the end of system window reduced from 30 to 25 minutes).

A16 DHU--SPCDXD2 CONDITIONAL FAILURE OF 2.5E-02 5.OE-02 EPU conditions reduce system OPERATOR TO INITIATE window (i.e., the end of system SPC/SDC - LATE window reduced from 22.9 to 18.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.) This changes the long term HEP that is the basis for this conditional HEP.

A17 DHU--SPCDXI2 FAILURE OF OPERATOR TO 2.2E-04 No change EPU conditions reduce system INITIATE RHR/SPC window; however, the diagnosis time remains in the same CBDT time frame and the HEP is not impacted.

A56 DHU--SPXDXD2 OPERATORS FAIL TO ALIGN NA 5.5E-5 New action to allow operation of RHR PUMP DISCHARGE X- pumps taking suction from the TIE FOR SPC SP without crediting containment accident pressure for NPSH.

Risk Assessment Attachment 12 Page 49 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID P PSCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A57 DHU--SPXDXI2 OPERATORS FAIL TO NA 6.OE-2 New action to allow operation of INITIATE ONE TRAIN OF RHR pumps taking suction from the IN SUPPRESSION POOL SP without crediting containment COOLING MODE BEFORE accident pressure for NPSH.

CROSS-TIE A54 EHUCHGERDXI OPERATOR FAILS TO 2.OE-03 No change The timing basis is unrelated to 0 PERFORM FAST TRANSFER reactor power and the HEP was OF BATTERY CHARGERS not impacted.

A18 EHUCWGCNDXI CWG OPERATOR FAILS TO 4.4E-02 No change The timing basis governed by the 0 ESTABLISH CONOWINGO AC power recovery interval and LINE the HEP was not impacted.

A19 EHUCWGPBDXI PB OPERATOR FAILS TO 2.7E-02 No change The timing basis governed by the 0 ESTABLISH CONOWINGO AC power recovery interval and LINE the HEP was not impacted.

A20 EHU-LOCADXIO FAILURE TO START DIESEL 1.2E-01 2.OE-01 EPU conditions reduce system AFTER NO AUTO-INIT (LOCA) window (i.e., the end of system window reduced from 7.1 to 6.4 minutes).

A20 EHU-LOOPDXIO FAILURE TO START DIESEL 4.5E-04 4.7E-04 EPU conditions reduce system AFTER NO AUTO-INIT (NO window (i.e., the end of system LOCA) window reduced from 47.9 to 40.6 minutes).

A21 EHU-SE1 1 DXIO FAILURE TO X-TIE 1.9E-02 No change EPU conditions reduce system EMERGENCY AC POWER window; however, the diagnosis PER SE-11 time remains in the same CBDT time frame and the HEP is not impacted.

Risk Assessment Attachment 12 Page 50 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A22 FHUBLMSVDXI2 FAIL TO BYPASS THE MSIV 1.OE+00 No change No credit taken for the action.

RPV LOW LEVEL INTERLOCK (LEVEL 1)

A55 FHULEVELDXI2 OPERATORS FAIL TO TAKE 3.2E-02 No change For overfill prevention, higher MANUAL CONTROL OF FW power would increase the time available for action. In this case, the assumed 15 minute system window was not increased and the HEP was not impacted.

A23 HHUCSTSPDXl2 FAILURE OF OPERATOR TO 2.3E-02 No change Assumed HPCI makeup rate was MANUALLY TRANSFER not changed for EPU conditions WATER SOURCES and HEP was not impacted.

A24 HHU--HLTDXl2 OPERATOR FAILS TO TRIP 8.4E-02 2.1E-02 EPU conditions increase the HPCI ON HIGH LEVEL system window (i.e., the end of system window increased from 13.7 to 20.1 minutes). This system window is increased because the higher power results in an increased boil off rate, which competes with the flow into the RPV.

A47 JHU-2344DX12 OPERATOR FAILS TO 2.6E-03 No change EPU conditions reduce system CORRECTLY ALIGN CROSS window; however, the diagnosis CONNECT time remains in the same CBDT time frame and the HEP is not I I_ I_ Iimpacted.

Risk Assessment Attachment 12 Page 51 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A25 JHU--ECTDXI2 OPERATOR FAILS TO 1.7E-03 3.4E-3 EPU conditions reduce system CORRECTLY ALIGN HPSW window (i.e., the end of system FOR COOLING TOWER FLOW window reduced from 10.3 to 7.9 minutes). In addition, it was determined that the pre-EPU time to HCTL was 9.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> instead of 10.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Update of the pre-EPU timing does not impact the HEP.

A26 JHUHWINJDXD OPERATOR FAILS TO INJECT 4.8E-02 2.OE-02 EPU conditions result in earlier 2 WITH HPSW THROUGH RHR containment failure (41.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (LATE) instead of 51.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />). As this is the cue for the action, the system window is significantly expanded.

CRD remains operable to the time of core damage, which is reduced from 59.6 to 53.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The net impact of the changes is an increased diagnosis time and lower HEP.

A26 JHUHWINJDX12 OPERATOR FAILS TO INJECT 4.4E-02 5.6E-02 EPU conditions reduce system WITH HPSW THROUGH RHR window (i.e., the end of system (EARLY) window reduced from 37 to 32 minutes).

A27 MHUNOLPWDXI TSC FALLS TO GUIDE OPS TO 1.0E+00 No change No credit taken for the action.

2 SE-11, ATTACHMENT W WHEN NO LOOP

Risk Assessment Attachment 12 Page 52 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A28 MHUSE11WDXI OPERATORS FAIL TO 5.8E-02 No change EPU conditions reduce system 2 IMPLEMENT SE-1 1 window; however, the diagnosis ATTACHMENT W time remains in the same CBDT time frame and the HEP is not impacted.

A29 OHU-ECCIDX12 OPERATOR FAILS TO LINE 1.OE+00 No change No credit taken for the action.

UP INJECTION BEFORE VENTING A23 RHUCSTSPDX12 HUMAN ERROR FAILURE TO 2.3E-02 No change Assumed RCIC makeup rate TRANSFER IN TIME CST/SP was not changed for EPU conditions and HEP was not impacted.

A30 RHU--HLTDXl2 OPERATOR FAILS TO TRIP 9.9E-04 No change EPU conditions altered both the RCIC ON HIGH LEVEL time of the cue (1.5 hr to 1.8 hr) to and the end of the system window (2 hr to 2.3 hr), but the diagnosis time remained constant at 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

A31 SHU--SLCDXD2 FAILURE TO INITIATE SLC / 1.OE-01 No change This is a short term action and ISOLATE RWCU (LATER) EPU conditions did reduce the diagnosis time, but this action represents only the execution portion of the action. The CBDT timeframe, which governs execution recovery, was not changed, so the HEP was not impacted.

Risk Assessment Attachment 12 Page 53 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER 1 DESCRIPTION PROBABILITY PROBABILITY A31 SHU--SLCDXl2 FAILURE TO INITIATE SLC I 4.3E-03 No change EPU conditions did reduce the ISOLATE RWCU (EARLY) diagnosis time, but this action represents only the execution portion of the action. The CBDT timeframe, which governs execution recovery, was not changed, so the HEP was not impacted.

A49 UHU-2803LPD2 OPERATORS FAIL TO 2.7E-03 No change The timing basis is unrelated to LOCALLY OPEN MOV-2803 reactor power and the HEP was TO ALIGN HPSW TO ECT not impacted.

COOLING A32 UHU--ECTDXIO OPERATOR FAILS TO 2.3E-03 No change The timing basis is unrelated to PROPERLY ALIGN FOR ECT reactor power and the HEP was OPERATION not impacted.

A48 UHUSLUCELND OPERATORS FAIL TO 2.OE-02 No change The timing basis is unrelated to 0 LOCALLY CLOSE SLUICE reactor power and the HEP was GATES 23427A(B) OR not impacted.

33427A(B)

A33 VHU--LCEDXI2 FAILURE TO CONTROL RPV 1.1E-01 1.6E-01 EPU conditions reduce system LEVEL WITH LP ECCS W/ window (i.e., the end of system HPCI FAILED window reduced from 5.8 to 5.0 minutes).

A33 VHU--LCLDXI2 FAILURE TO CONTROL RPV 9.8E-03 1.2E-02 EPU conditions reduce system LEVEL WITH LP ECCS AFTER window (i.e., the end of system HPCI OK window reduced from 14.9 to 13.3 minutes).

Risk Assessment Attachment 12 Page 54 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A34 VHU-VENTDX12 OPERATOR FAILS TO 1.3E-02 1.4E-02 EPU conditions reduce system INITIATE VENT GIVEN RHR window (i.e., the end of system HARDWARE FAILURE window reduced from 22.9 to 18.9 minutes).

A32 WHU-2209DXI0 OPERATOR ERROR ESW 2.6E-04 No change The timing basis is unrelated to PUMP BAY CROSSTIE FTO reactor power and the HEP was not impacted.

A35 WHU-- FAILURE TO START ESW 9.5E-02 No change The timing basis is unrelated to ESWDXD0 PUMP LATER reactor power and the HEP was not impacted.

A35 WHU--ESWDXIO FAILURE TO START ESW 7.3E-02 No change The timing basis is unrelated to PUMP EARLY reactor power and the HEP was not impacted.

A36 WHU-- OPERATORS FAIL TO START 4.OE-03 No change The timing basis is unrelated to NSWDXD2 STANDBY SW PUMP (LATER) reactor power and the HEP was not impacted.

A36 WHU--NSWDXI2 OPERATORS FAIL TO START 1.OE+00 No change The timing basis is unrelated to STANDBY SW PUMP (EARLY) reactor power and the HEP was not impacted.

A37 YHU--CSTDXl2 OPERATORS FAIL TO REFILL 9.1 E-03 No change EPU conditions reduce system CST FROM RWST (RW window; however, the diagnosis PUMPS) time remains in the same CBDT time frame and the HEP is not impacted.

Risk Assessment Attachment 12 Page 55 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PBAPS ACTION PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID BASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A38 YHU--GRFDXl2 OPERATORS FAIL TO REFILL 1.4E-02 No change; EPU conditions reduce system CST FROM RWST (GRAVITY however set to window; however, the diagnosis FEED) 1.0 based on time remains in the same CBDT incorporation of time frame and the HEP is not CST standpipe impacted.

that would make gravity feed unfeasible A52 YHUGRTDTDXI OPERATOR FAILS TO REFILL 2.1E-02 No change; EPU conditions reduce system 2 UNIT 2 CST VIA TDT GRAVITY however set to window; however, the diagnosis FEED 1.0 based on time remains in the same CBDT incorporation of time frame and the HEP is not CST standpipe impacted.

that would make gravity feed unfeasible A53 YHUGRTDTDXI OPERATOR FAILS TO REFILL 5.4E-03 No change; EPU conditions reduce system 3 UNIT 3 CST VIA TDT GRAVITY however set to window; however, the diagnosis FEED 1.0 based on time remains in the same CBDT incorporation of time frame and the HEP is not CST standpipe impacted.

that would make gravity feed unfeasible A51 YHU--TDTDXl2 OPERATORS FAIL TO REFILL 3.3E-02 No change EPU conditions reduce system CST FROM TDT (RW PUMPS) window; however, the diagnosis time remains in the same CBDT time frame and the HEP is not impacted.

Risk Assessment Attachment 12 Page 56 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID DASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A39 ZHUFWHPLDXD EXECUTION ERROR FOR 1.OE-01 No change This is a short term action and 2 LEVEL / POWER LATER IN AN EPU conditions did reduce the ATWS diagnosis time, but this action represents only the execution portion of the action. The CBDT timeframe, which governs execution recovery, was not changed, so the HEP was not impacted.

A39 ZHUFWHPLDXI EXECUTION ERROR FOR 2.3E-02 No change This is a short term action and 2 LEVEL / POWER EARLY IN AN EPU conditions did reduce the ATWS diagnosis time, but this action represents only the execution portion of the action. The CBDT timeframe, which governs execution recovery, was not changed, so the HEP was not impacted.

A40 ZHU-HIGHDXI2 FAILURE TO MANUALLY 2.2E-03 3.2E-03 EPU conditions reduce system INITIATE HPCI/RCIC window (i.e., the end of system INJECTION window reduced from 21.5 to 17.6 minutes).

A41 ZHU--HRLDXl2 OPERATOR FAILS TO TAKE 4.6E-02 4.OE-02 EPU conditions altered both the MANUAL CONTROL OF time of the cue (3 to 1.6 min) to HPCI/RCIC -EARLY and the end of the system window (9.8 to 9 min), but the diagnosis time increase, so the HEP was slightly reduced.

Risk Assessment Attachment 12 Page 57 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC ER

[ DESCRIPTION

[PROBABILITY PRE-EPU 1

EPU HUMAN EPU BASIS PROBABILITY A42 ZHU--LPADXI2 FAILURE TO MANUALLY 4.6E-02 6.OE-02 EPU conditions reduce system INITIATE LOW PRESS ECCS window (i.e., the end of system (ATWS OR LOCA) window reduced from 7.1 to 6.4 minutes).

A42 ZHU--LPIDXl2 FAILURE TO MANUALLY 8.3E-04 1.2E-03 EPU conditions reduce system INITIATE LOW PRESS ECCS window (i.e., the end of system (TRANSIENT) window reduced from 49.6 to 41.3 minutes).

A46 ZHULVCLCDX12 OPERATOR FAILS TO 1.5E-03 1.7E-03 EPU conditions reduce system CONTROL RPV LEVEL window (i.e., the end of system ADEQUATELY WITH LPI (NOT window reduced from 22.1 to TOO LOW, LLOCA) 21.4 minutes).

A43 ZHULVCTRDXI2 OP FAILS TO CONTROL 2.6E-04 No change EPU conditions reduce system LEVEL IN A TRANS W/ ECCS window (i.e., the end of system INJECTION window reduced from 51.8 to 42.1 minutes); however, the contribution from ASEP is negligible and the change does not impact the total HEP.

A44 ZHUPWLVLDXD COGNITIVE ERROR FOR 6.7E-02 5.8E-02 There was no change to the 2 LEVEL / POWER LATER IN AN system window for this action, ATWS but because it is developed as a conditional probability and because the early time frame HEP changed, this HEPRalso

_changed.

Risk Assessment Attachment 12 Page 58 TABLE 4.1-2 PEACH BOTTOM INDEPENDENT POST-INITIATOR HEP RESULTS

SUMMARY

FOR PRE-EPU AND EPU CONDITIONS CALC I PRE-EPU EPU HUMAN EPU BASIS NUMB PBAPS BE ID PASCTION HUMAN ERROR ERROR ER DESCRIPTION PROBABILITY1 PROBABILITY A44 ZHUPWLVLDX12 COGNITIVE ERROR FOR 4.3E-02 5.0E-02 EPUI conditions reduce system LEVEL / POWER EARLY IN AN window (i.e., the end of system ATWS window reduced from 6.0 to 5.6 I I I I minutes).

Risk Assessment Attachment 12 Page 59 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEP FAILURE HEPS AND JOINT HEP JITEP FAILURE PROBABILIT ASSUMD EID J BEID INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED PROBABILITY( Y DEPENDENCE AL LEVEL

• AHU--XTEDXI: FAILURE TO INITIATE

• 3.2E-04 ZHU--ADLDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (LOOP * (zero) 2.2E-04 CASES),

• DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC

• AHU--XTRDXI: FAILURE TO INITIATE

• 3.2E-04 ZHU--ADTDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (NON- (zero) 2.2E-04 LOOP CASES),

• DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC

• AHU--XTEDXI: FAILURE TO INITIATE

• 3.2E-04 ZHU--AHLDXI 4.8E-5 No Change MANUAL DEPRESSURIZATION (LOOP * (medium) 2.2E-03 CASES),

• ZHU-HIGHDXI: FAILURE TO MANUALLY INITIATE HPCI/RCIC INJECTION

• AHU--XTRDXI: FAILURE TO INITIATE

• 3.2E-04 ZHU--AHTDXI 4.8E-5 No Change MANUAL DEPRESSURIZATION (NON- * (medium) 2.2E-03 LOOP CASES),

• ZHU-HIGHDXI: FAILURE TO MANUALLY INITIATE HPCI/RCIC INJECTION

Risk Assessment Attachment 12 Page 60 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEP FAILURE HEPS AND JOINT HEP JITHP FAILURE PROBABILIT INDEPENDENT HFE BEID AND DESCRIPTION ASSUMD EID J BEID ASSUMED PROBABILITY( Y DEPENDENCE R T LEVEL

• YHU--CSTDXI: OPERATORS FAIL TO e 9.1E-03 ZHU--CSTDXI 2.4E-3 No Change REFILL CST FROM RWST (RW PUMPS) * (high) 1.4E-02

• YHU--GRFDXI: OPERATORS FAIL TO REFILL CST FROM RWST (GRAVITY * (high) 5.4E-03 FEED) * (complete) 3.3E-

" YHUGRTDTDXI: OPERATOR FAILS TO 02 REFILL UNIT 2 CST VIA TDT GRAVITY FEED

• YHU--TDTDXI: OPERATORS FAIL TO REFILL CST FROM TDT (RW PUMPS)

" AHU--CADDXI: OPERATOR FAILS TO 1. E-02 ZHU-AADIDXI 1.OE-6 No Change ALIGN CAD TANK TO UNIT 2 INS 'B', (high) 1.3E-03

" AHUBTL-RDXI: OPERATOR FAILS TO VALVE IN N2 BOTTLES (FROM MCR) * (conditional) 1.0

" AHUBTL-RDXD: OPERATOR FAILS TO * (medium) 1.OE-01 VALVE IN N2 BOTTLES (FROM MCR) - * (zero) 2.2E-04 LATE, CONDITIONAL

• IHURESETDXI: OPERATORS FAIL TO RESET COMPRESSOR AFTER TRIP ON LOOP

" DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC

Risk Assessment Attachment 12 Page 61 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEPS AJOINTNTHEPPPROBABILITHEP HEP FAILURE INDEPENDENT HFE BEID AND DESCRIPTION HEPS AND JOINT HEP FAILURE ASSUMED BEID PROBABILITY( Y DEPENDENCE 1)

LEVEL

• AHU--XTEDXI: FAILURE TO INITIATE

• 3.2E-04 ZHU--ABDDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (LOOP * (zero) 6.9E-03 CASES)

" BHU-PUMPDXI: FAILURE TO START e (zero) 2.2E-04 STANDBY CRD PUMP OR RESTART RUNNING PMP

" DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC

" AHU--XTEDXI: FAILURE TO INITIATE e 3.2E-04 ZHU--ADMDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (LOOP * (zero) 2.2E-04 CASES)

" DHU--SPCDXI: FAILURE OF OPERATOR o (zero) 5.8E-02 TO INITIATE RHR/SPC,

• MHUSE11WDXI: OPERATORS FAIL TO IMPLEMENT SE-11 ATTACHMENT W

" AHU--XTRDXI: FAILURE TO INITIATE o 3.2E-04 (or 3.2E- ZHU--ADYDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (NON- 04)

LOOP CASES) (or AHU--XTEDXI) * (zero) 2.2E-04

• DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC, * (zero) 3.3E-03 ZHU--CSTDXI: OPERATORS FAIL TO REFILL CST FROM RWST (ANY MEANS)

Risk Assessment Attachment 12 Page 62 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEP FAILURE HEPS AND JOINT HEP JITEP PROBABILIT V

ASSUMD JOID FAILURE INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED BEID PROBABILITY( Y DEPENDENCE R L LEVEL

• AHU--XTRDXI: FAILURE TO INITIATE

• 3.2E-04 (or 3.2E- ZHU---AJDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (NON- 04)

LOOP CASES) (or AHU--XTEDXI) e(zero) 1.7E-03

" JHU--ECTDXI: OPERATOR FAILS TO CORRECTLY ALIGN HPSW FOR COOLING TOWER FLOW

" AHU--XTRDXI: FAILURE TO INITIATE 9 3.2E-04 (or 3.2E- ZHU-ADLKDXI 1.OE-6 No Change MANUAL DEPRESSURIZATION (NON- 04)

LOOP CASES) (or AHU--XTEDXI) 9(zero) 9.4E-04

• DHU-LEAKDXI: OPERATOR FAILS TO STOP LEAK FLOOD BY TRIPPING PUMP

" ZHU--HRLDXI: OPERATOR FAILS TO

• 4.6E-02 ZHU--HRZDXI 2.5E-2 2.OE-2 TAKE MANUAL CONTROL OF HPCI/RCIC

-EARLY * (high) 8.4E-02 HHU--HLTDXI: OPERATOR FAILS TO TRIP HPCI ON HIGH LEVEL (or RHU--HLTDXI)

Risk Assessment Attachment 12 Page 63 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU EPU JOINT INDEPENDENT JON-EP HEP FAILURE HEPS AND JOINT HEP JOINT HEP PROBABILIT INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED ASSUME BEID BEID PROBABILITY(

FAILURE Y DEPENDENCE P L LEVEL

• DHU--SPCDXI: FAILURE OF OPERATOR

• 2.2E-04 ZHU--BDJDXI 5.OE-7 No Change TO INITIATE RHRISPC * (zero) 6.9E-03

• BHU-PUMPDXI: FAILURE TO START STANDBY CRD PUMP OR RESTART * (medium) 4.4E-02 RUNNING PMP * (conditional) 4.8E-

• JHUHWINJDXI: OPERATOR FAILS TO 02 INJECT WITH HPSW THROUGH RHR (EARLY)

• JHUHWINJDXD: OPERATOR FAILS TO INJECT WITH HPSW THROUGH RHR (LATE)

" BHU-PUMPDXI: FAILURE TO START

• 6.9E-03 ZHU--BDVDXI 5.0E-7 No Change STANDBY CRD PUMP OR RESTART RUNNING PMP * (zero) 2.2E-04

• DHU--SPCDXI: FAILURE OF OPERATOR * (medium) 1.3E-02 TO INITIATE RHR/SPC

" VHU-VENTDXI: OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE

Risk Assessment Attachment 12 Page 64 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEP FAILURE HEPS AJOINTNTHEPPPROBABILIT HEPS AND JOINT HEP FAILURE INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED BEID PROBABILITY( Y DEPENDENCE 1)

LEVEL

• DHU--SPCDXI: FAILURE OF OPERATOR

• 2.2E-04 ZHU--DJMDXI 5.OE-7 No Change TO INITIATE RHR/SPC * (zero) 4.4E-02

" JHUHWINJDXI: OPERATOR FAILS TO INJECT WITH HPSW THROUGH RHR (conditional) 0 4.8E-(EARLY) 02

" JHUHWINJDXD: OPERATOR FAILS TO * (zero) 5.8E-02 INJECT WITH HPSW THROUGH RHR (LATE)

• MHUSE11WDXI: OPERATORS FAIL TO IMPLEMENT SE-11 ATTACHMENT W

• DHU--SPCDXI: FAILURE OF OPERATOR

• 2.2E-04 ZHU--DJYDXI 5.OE-7 No Change TO INITIATE RHR/SPC * (zero) 4.4E-02

• JHUHWINJDXI: OPERATOR FAILS TO INJECT WITH HPSW THROUGH RHR (conditional)4.8E-0 (EARLY) 02

• JHUHWINJDXD: OPERATOR FAILS TO e (zero) 3.3E-03 INJECT WITH HPSW THROUGH RHR (LATE)

• ZHU--CSTDXI: OPERATORS FAIL TO REFILL CST FROM RWST (ANY MEANS)

Risk Assessment Attachment 12 Page 65 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT HEPS JOINT HEP HEP FAILURE JOINTINTHEPPPROBABILIT HEPS AND JOINT HEP FAILURE INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED BEID PROBABILITY( Y DEPENDENCE 1)

LEVEL

• MHUSE1 1WDXI: OPERATORS FAIL TO

• 5.8E-02 ZHU--DMVDXI 5.OE-7 No Change IMPLEMENT SE-1 1 ATTACHMENT W *(zero) 2.2E-04

• DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC * (medium) 1.3E-02

" VHU-VENTDXI: OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE

• THU--THXDXI: OPERATOR FAILS TO

• 1.OE-02 ZHU--DTVDXI 5.OE-7 No Change ALIGN STANDBY TBCCW HX (zero) 2.2E-04

" DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHR/SPC * (medium) 1.3E-02

" VHU-VENTDXI: OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE

• DHU--SPCDXI: FAILURE OF OPERATOR e 2.2E-04 ZHU---DVDXI 8.3E-7 1.8E-6 TO INITIATE RHR/SPC &(conditional) 2.5E-

• DHU--SPCDXD: CONDITIONAL FAILURE 02 OF OPERATOR TO INITIATE SPC/SDC -

LATE * (medium) 1.3E-02

• VHU-VENTDXI: OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE

Risk Assessment Attachment 12 Page 66 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEPS AJOINTNTHEPPPROBABILIT HEP HEP FAILURE HEPS AND JOINT HEP FAILURE INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED BEID PROBABILITY( Y DEPENDENCE 1)

LEVEL

• DHU--SPCDXI: FAILURE OF OPERATOR

• 2.2E-04 ZHU--DVYDXI 5.OE-7 No Change TO INITIATE RHR/SPC * (medium) 1.3E-02

• VHU-VENTDXI: OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE * (zero) 3.3E-03 FAILURE

" ZHU--CSTDXI: OPERATORS FAIL TO REFILL CST FROM RWST (ANY MEANS)

• JHUHWINJDXI: OPERATOR FAILS TO

• 4.4E-02 ZHU---JVDXI 1.3E-4 6.6E-5 INJECT WITH HPSW THROUGH RHR (EARLY) (conditional) 0 02 4.8E-

" JHUHWINJDXD: OPERATOR FAILS TO INJECT WITH HPSW THROUGH RHR * (low) 1.3E-02 (LATE)

" VHU-VENTDXI: OPERATOR FAILS TO INITIATE VENT GIVEN RHR HARDWARE FAILURE

• EHU-SE11DXIO: FAILURE TO X-TIE

• 1.9E-02 ZHUALTACDXIO 3.2E-3 No Change EMERGENCY AC POWER PER SE-1 1 * (medium) 2.7E-02

• EHUCWGPBDXIO: PB OPERATOR FAILS TO ESTABLISH CONOWINGO LINE

Risk Assessment Attachment 12 Page 67 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEP FAILURE HEPS AND JOINT HEP JITEP PROBABILIT Y

INDEPENDENT HFE BEID AND DESCRIPTION ASSUMD J BEIDEID FAILURE ASSUMED PROBABILITY( Y DEPENDENCE P I LEVEL

• AHU--XTRDXI: FAILURE TO INITIATE

• 3.2E-04 (or 3.2E- ZHU---ABDXI 5.1 E-5 5.3E-5 MANUAL DEPRESSURIZATION (NON- 04)

LOOP CASES) (or AHU--XTEDXI) e(medium) 2.1E-02

" BHU--MAXDXI: FAILURE TO MAXIMIZE CRD FLOW PER T-246 (or BHU-PUMPDXI)

" AHUBTL-RDXI: OPERATOR FAILS TO 9 1.3E-03* ZHU--AAADXI 9.9E-5* 1.1E-4 VALVE IN N2 BOTTLES (FROM MCR) (medium) 3.5E-03 (1.5E-4)

• AHU--BCIDXI: OPERATOR FAILS TO BYPASS CONTAINMENT ISOLATION * (medium) 1.1E-02" AHU--CADDXI: OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 2 INS 'B'

• AHU--XTRDXI: FAILURE TO INITIATE

• 3.2E-04 (or 3.2E- ZHU---ATDXI 1.9E-5 2.OE-5 MANUAL DEPRESSURIZATION (NON- 04)

LOOP CASES) (or AHU--XTEDXI) * (low) 1.3E-02

• THU--THXDXI: OPERATOR FAILS TO ALIGN STANDBY TBCCW HX AHU--BCIDXI: OPERATOR FAILS TO e 3.5E-03 ZHU---ADDXI 1.0E-6 No Change BYPASS CONTAINMENT ISOLATION * .(zero) 2.2E-04 DHU--SPCDXI: FAILURE OF OPERATOR TO INITIATE RHRISPC

Risk Assessment Attachment 12 Page 68 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEPS AJOINTNTHEPPPROBABILIT HEP FAILURE INDEPENDENT HFE BEID AND DESCRIPTION HEPS AND JOINT HEP FAILURE ASSUMED BEID PROBABILITY( Y DEPENDENCE 1)

LEVEL

• BHU--MAXDXI: FAILURE TO MAXIMIZE 9 2.1E-02 ZHU---BFDXI 1.7E-3 No Change CRD FLOW PER T-246 (or BHU-PUMPDXI) e (low) 3.2E-02

• FHULEVELDXI: OPERATORS FAIL TO TAKE MANUAL CONTROL OF FW

" FHULEVELDXI: OPERATORS FAIL TO

• 3.2E-02 ZHUA650JDXI 6.8E-4 4.2E-3 TAKE MANUAL CONTROL OF FW * (zero) 3.8E-03

" AHU--650DXI: OPERATOR FAILS TO DEPRESSURIZE TO 650 PSIG FOR = (medium) 4.4E-02 CONDENSATE INJECTION

• JHUHWINJDXI: OPERATOR FAILS TO INJECT WITH HPSW THROUGH RHR (EARLY)

• AHUBTL-RDXI: OPERATOR FAILS TO

• 1.3E-03* ZHU--ADWDXI 1.OE-6 No Change VALVE IN N2 BOTTLES (FROM MCR) e(medium) 1.1E-02

• AHU--CADDXI: OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 2 INS 'B' * (zero) 2.2E-04

• DHU--SPCDXI: FAILURE OF OPERATOR * (zero) 4.OE-03 TO INITIATE RHR/SPC

• WHU-NSWDXD: OPERATORS FAIL TO START STANDBY SW PUMP (LATER)

Risk Assessment Attachment 12 Page 69 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEPS AJOINTNTHEPPPROBABILIT HEP FAILURE INDEPENDENT HFE BEID AND DESCRIPTION HEPS AND JOINT HEP FAILURE ASSUMED BEID PROBABILITY( Y DEPENDENCE 1)

LEVEL

" FHULEVELDXI: OPERATORS FAIL TO

• 3.2E-02 ZHU--FHRDXI 1.7E-2 No Change TAKE MANUAL CONTROL OF FW *(high) 4.6E-02

" ZHU--HRLDXI: OPERATOR FAILS TO TAKE MANUAL CONTROL OF HPCI/RCIC

-EARLY

" AHU--XTRDXI: FAILURE TO INITIATE

• 3.2E-04 or (3.2E- ZHU--AAXDXI 4.8E-5 5.3E-5 MANUAL DEPRESSURIZATION (NON- 04)

LOOP CASES) (or AHU-XTEDXI) * (medium) 3.5E-03

• AHU--BCIDXI: OPERATOR FAILS TO BYPASS CONTAINMENT ISOLATION

Risk Assessment Attachment 12 Page 70 TABLE 4.1-3

SUMMARY

OF CHANGES IN POST-INITIATOR DEPENDENT HEPS DUE TO EPU PRE-EPU PRE-EPU EPU JOINT INDEPENDENT JOINT HEP HEP FAILURE HEPS AND JOINT HEP JITHP FAILURE PROBABILIT INDEPENDENT HFE BEID AND DESCRIPTION ASSUMED BEID ASSUMED BEID PROBABILITY( Y DEPENDENCE A)

LEVEL

" AHUBTL-RDXI: OPERATOR FAILS TO

• 1.3E-03* ZHU---AADXI 6.6E-4* 6.6E-4 VALVE IN N2 BOTTLES (FROM MCR) * (conditional) 1.0* (6.8E-4)

• AHUBTL-RDXD: OPERATOR FAILS TO VALVE IN N2 BOTTLES (FROM MCR)- * (high) 1.1E-02" LATE, CONDITIONAL

" AHU--CADDXI: OPERATOR FAILS TO ALIGN CAD TANK TO UNIT 2 INS 'B' 1 Pre-EPU HEPs marked with an "*" symbol have been updated to be consistent with the EPU HRA and to maintain an appropriate basis for comparison. Prior values for the dependent HEPs are shown in parenthesis.

Risk Assessment Attachment 9 Page 71 4.2 LEVEL 1 PRA Section 4.1 summarized possible effects of the EPU by examining each of the PRA elements.

This section examines possible EPU effects from the perspective of accident sequence progression. The dominant accident scenario types (classes) that can lead to core damage are examined with respect to the changes in the individual PRA elements discussed in Section 4.1.

Loss of Inventory Makeup Transients The loss of inventory accidents (non-LOCA) are determined by the number of systems, their success criteria, and operator actions for responding to their demands. The following bullets summarize key issues:

FW, HPCI, RCIC, and Low Pressure Makeup System(1 ) flow rates - all of these systems have substantial margin in their success criteria relative to the EPU power increase to match the coolant makeup flow required for postulated accidents.

CRD - CRD is not initially an adequate makeup source to the RPV at the current PBAPS power rating for events initiated from full power. CRD is considered successful in the PBAPS PRA for late RPV injection given initial RPV injection from another source. MAAP cases PB044a and PB044b indicate that the timing requirements for initiating CRD are reduced for EPU conditions compared to pre-EPU conditions. However, the diagnosis time remains in the same Cause-Based Decision Tree (CBDT) time frame and the HEP is not impacted.

HPSW Injection to the RPV - this system also has substantial margin in its success criteria relative to the EPU power increase to match the coolant makeup flow required for postulated accidents.

The success criterion used in the 2009A PRA for the number of SRVs required to open to assure RPV emergency depressurization is two (2). Based on the MAAP evaluations (e.g., MAAP case PBO05a), the 2 SRVs success criterion remains adequate for the EPU condition. However, timing differences associated with this requirement have been factored into the HEP analysis for operator actions to depressurize (refer to Table 4.1-2 above).

The SRV setpoints are not changed for the PBAPS EPU. Given the power increase of the EPU, one may postulate that the probability of a stuck-open relief valve given a transient initiator would increase due to an increase in the (1) Core Spray, LPCI, and Condensate.

Risk Assessment Attachment 9 Page 72

• number of SRV cycles. This change has been incorporated into the PBAPS 2009A1 EPU model.

Operator actions include emergency depressurization and system control and initiation. The injection initiation/recovery and emergency depressurization timings are slightly impacted by the EPU. As such, changes to the existing risk profile associated with loss of inventory makeup accidents result.

ATWS Following a failure to scram coupled with additional failures, a higher power level and increase in suppression pool temperature would result for the EPU configuration compared with the current PBAPS configuration (assuming similar failures).

The number of SRVs that must fail to open during an isolation ATWS in order to overpressurize the RPV is two (2) for the EPU case. This is consistent with the 2009A pre-EPU model (given the installation of an additional SV that is planned as part of the EPU hardware modifications) such that no change to the common cause failure contribution for this event is required for use in the 2009A1 EPU model.

The increased power level reduces the time available to perform operator actions. Given the shorter time frames associated with ATWS scenarios, this time reduction has an impact on ATWS scenarios. Refer to Table 4.1-2 for changes in ATWS related HEPs. Given these ATWS HEP changes, changes to the existing risk profile associated with ATWS accidents result.

Note that for EPU conditions, the use of enriched boron is anticipated to reduce the time required to shutdown the reactor, and increase the time available to the operators to initiate SLC to prevent containment overpressurization and/or core damage. However, for the 2009A1 EPU model, it was still assumed that the HEP values associated with SLC initiation should be based on shorter available times. This may provide a slight conservative bias to the calculated delta risk for the EPU assessment results. That is, the EPU PRA model assumes that a pro-rated shorter time is available to initiate SLC pumps compared to the pre-EPU available times. This assumption combined with the future use of enriched boron after EPU implementation ensures that the PRA results are not overly optimistic, and will show the maximum net increase from EPU.

Risk Assessment Attachment 9 Page 73 LOCAs The blowdown loads may be slightly higher because of the higher initial power. The GE task analyses confirm that the blowdown loads and SSCs remain acceptable after EPU. This includes the assessment that containment accident pressure is no longer required to ensure NPSH is satisfied for the pumps taking suction from the torus. However, this is contingent upon implementation of the RHR cross-tie and associated HEP to perform the alignment within one hour of a large break LOCA initiator coincident with a containment isolation failure as described in Section 4.1.2.3 above. The net result is actually a risk reduction in this very low likelihood scenario because the strategy now exists to avoid the need for overpressure credit that didn't exist before (i.e. prior to implementation of the EPU modifications).

Other than the RHR cross-tie issue described above, the success criteria for the systems to respond to a LOCA are delineated by system trains. Sufficient margin is available in these success criteria to allow adequate core cooling for EPU. MAAP 4.0.6 cases were used to verify that the success criteria did not change. However, since some timing values are impacted, slight changes to the existing risk profile associated with LOCA accidents result.

SBO Station Blackout represents a unique subset of the loss of inventory accidents identified above.

The station blackout scenario response is almost totally dominated by AC and DC power issues.

In all other respects, SBO sequences are like the transients discussed above. Extended power uprate will not increase the loads on diesel-generators or batteries. As discussed earlier, the success criteria for mitigating systems is largely unchanged for the EPU. However, the LOOP recovery times are adjusted in the EPU analysis as discussed in Section 4.1.3 to account for shorter available recovery times that would be present for EPU conditions given an SBO occurs.

Additionally, a few operator actions are impacted by the reduced available timings of the EPU, and are propagated through the SBO accident sequences.

As such, minor changes to the existing risk profile associated with SBO accidents result.

Risk Assessment Attachment 9 Page 74 Loss of Containment Heat Removal Sequences that involve the loss of containment heat removal are affected slightly in terms of the time to reach the containment venting pressure or ultimate pressure. The impact on long-term LOOP non-recovery probabilities has been factored into the assessment by assuming that 15%

less time is available in these scenarios as described in Section 4.1.3. However, the success criteria for the key systems (RHR, main condenser, and torus hard-piped vent) in the loss of containment heat removal accident sequences are not affected. Other systems (e.g., DW coolers) are considered marginal or inadequate for containment heat removal for the current PBAPS power level. Such systems would remain inadequate for the EPU.

The time available to initiate containment heat removal is over 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> in the PRA. The reduction in this very long time frame due to the EPU has no quantifiable impact on the HEPs for containment heat removal initiation.

In summary, only minor changes to the risk profile associated with loss of decay heat removal accidents result.

ISLOCA / BOC Similar to the LOCA analysis, the success criteria for the systems to respond to an ISLOCA or BOC are delineated by system trains. Sufficient margin is available in these success criteria to allow adequate core cooling for EPU. Since the risk from these events is dominated by failure of early isolation or failure of injection within 1-2 hours from an external source, there is little or no change to the existing risk profile associated with ISLOCA and BOC accidents.

4.3 INTERNAL FIRES INDUCED RISK The frequency of fires is not dependent on reactor power or operation. Thus, no impact on fire initiating event frequency is postulated.

Since the performance of the IPEEE, a Fire PRA was performed. The EPRI FIVE Methodology [9]

and Fire PRA Implementation Guide (FPRAIG) [11] screening approaches, EPRI Fire Events Database [12] and plant specific data were used in this 2002 study, to develop the PBAPS Fire

Risk Assessment Attachment 9 Page 75 PRA. An update to that Fire PRA model was performed in 2007 that included explicit analysis of the main control room (MCR) and cable spreading room (CSR) that had previously not been included. The ignition frequencies for the MCR and CSR were developed using the guidance in NUREG/CR-6850 [13]. The Fire PRA model was also integrated with the PB205C and PB305C internal events models as part of the 2007 update.

While the fire analysis did yield a CDF, the intent of the analysis was to identify the most risk significant fire areas in the plant using a screening process and by calculating conservative core damage frequencies for fire scenarios. The screening attributes of the fire PRA are summarized below.

Risk Assessment Attachment 9 Page 76 4.3.1 Attributes of Fire PRA Fire PRAs are useful tools to identify design or procedural items that could be clear areas of focus for improving the safety of the plant. Fire PRAs use a structure and quantification technique similar to that used in the internal events PRA.

Historically, since less attention has been paid to fire PRAs, conservative modeling is common in a number of areas of the fire analysis to provide a "bounding" methodology for fires. This concept is contrary to the base internal events PRA which has had more analytical development and is closer to a realistic assessment (i.e., not conservative) of the plant.

There are a number of fire PRA topics involving technical inputs, data, and modeling that prevent the effective comparison of the calculated core damage frequency figure of merit between the internal events PRA and the fire PRA. These areas are identified as follows:

Initiating Events: The frequency of fires and their severity are generally conservatively overestimated. A revised NRC fire events database indicates the trend toward both lower frequency and less severe fires. This trend reflects the improved housekeeping, reduction in transient fire hazards, and other improved fire protection steps at nuclear utilities. The database used in the PBAPS fire assessment used significantly older data that is conservative compared to more current data.

System Response: Fire protection measures such as sprinklers, C02, and fire brigades may be given minimal (conservative) credit in their ability to limit the spread of a fire. Therefore, the severity of the fire and its impact on requirements is exacerbated.

In addition, cable routings are typically characterized conservatively because of the lack of data regarding the routing of cables or the lack of the analytic modeling to represent the different routings. This leads to limited credit for balance of plant systems that are extremely important in CDF mitigation.

Sequences: Sequences may subsume a number of fire scenarios to reduce the analytic burden. The subsuming of initiators and sequences is done to envelope those sequences included.

This causes additional conservatism.

Risk Assessment Attachment 9 Page 77 Fire Modeling: Fire damage and fire propagation are conservatively characterized. Fire modeling presents bounding approaches regarding the fire immediate effects (e.g., all cables in a tray are always failed for a cable tray fire) and fire propagation.

The fire PRA is subject to more modeling uncertainty than the internal events PRA evaluations.

While the fire PRA is generally self-consistent within its calculational framework, the fire PRA calculated quantitative risk metric does not compare well with internal events PRAs because of the number of conservatisms that have been included in the fire PRA process. Therefore, the use of the fire PRA figure of merit as a reflection of CDF may be inappropriate. Any use of fire PRA results and insights should properly reflect consideration of the fact that the "state of the technology" in fire PRAs is less evolved than the internal events PRA.

Relative modeling uncertainty is expected to narrow substantially in the future as more experience is gained in the development and implementation of methods and techniques for modeling fire accident progression and the underlying data.

4.3.2 EPU Impact on Fire Risk A qualitative impact on the PBAPS fire risk profile due to the EPU is estimated here based on review of the PBAPS fire PRA results. This estimate is performed as follows:

• As the dominant change in the internal events model is related to the change in operator error terms, examine the fire PRA model results and make similar changes to those defined in Tables 4.1-2 and 4.1-3 in the fire PRA model.

" The set of applicable fire PRA model human error probability changes are shown in Table 4.3-1. This includes an evaluation first to update the HEP values to be consistent with the 2009A model values and then an evaluation to provide the updated values for EPU conditions as well.

Based on making the changes to the applicable HEP values for both pre-EPU and EPU conditions, the fire CDF increase and dominant scenarios are listed in Table 4.3-2.

The fire impact calculation estimate is summarized in Table 4.3-2. As can be seen from Table 4.3-2, it is estimated here that the PBAPS fire PRA CDF would increase by approximately 2.5E-07 due to the EPU. This represents less than 1% of the calculated fire CDF which on a percentage basis is much less than that calculated for the internal events CDF. Given that the

Risk Assessment Attachment 9 Page 78 success criteria did not change in going from pre-EPU to EPU conditions, then it is reasonable to assume that the timing differences associated with EPU conditions would have a small impact on the risk from fire events. The small increase in CDF makes sense since the dominant fire scenarios are more related to the experienced equipment failures due to the fire initiating event rather than being related to the operator actions required to respond to the fire events.

This is evident in Table 4.3-2 which shows that the majority of the dominant fire scenarios were not impacted by the changes to the HEP values for EPU conditions. Qualitatively, then, regardless of the actual total CDF that is calculated, it is concluded that the risk increase due to EPU on fire risk is negligible.

Risk Assessment Attachment 9 Page 79 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU AHU-- 1.90E- 7.49E- OPERATOR AHU-- OPERATOR 3.80E- 2.20E- Make 3.80E- 2.20E-600DX12 03 06 FAILS TO 650DX12 FAILS TO 03 02 pre-EPU 03 02 DEPRESSURIZE DEPRESSURIZE and EPU TO 600 PSIG FOR TO 650 PSIG Change CONDENSATE FOR INJECTION CONDENSATE INJECTION AHUALTDP 2.30E- 1.53E- FAILURE TO AHUALTDP FAILURE TO 2.50E- 3.50E- Make 2.50E- 3.50E-DXI2 02 03 OPEN DXI2 OPEN NON-ADS 02 02 pre-EPU 02 02 ALTERNATE SRVS OR TBP and EPU DEPRESSURIZAT VALVES Change ION AHUBTL- 1.50E- 2.82E- OPERATOR AHUBTL- OPERATOR 1.3E- 1.40E- Make 1.30E- 1.40E-RDXl2 03 02 FAILS TO VALVE RDX12 FAILS TO 03* 03 pre-EPU 03 03 IN N2 BOTTLES VALVE IN N2 and EPU (FROM MCR) BOTTLES Change (FROM MCR)

AHU-- 1.OOE+ 2.11E- OPERATOR AHU-- OPERATOR 1.1E- 2.30E- 1.0 in No No CADDXI2 00 01 FAILS TO ALIGN CADDXI2 FAILS TO ALIGN 02* 02 Fire PRA Chang Chang CAD TANK TO CAD TANK TO - Leave e e UNIT 2 INS'B' UNIT 2 INSB'B' as is AHU-- 2.50E- 6.60E- OPERATOR AHU-- OPERATOR 2.1E- 2.90E- Make 2.10E- 2.90E-FINDXI2 03 03 FAILS TO FINDXI2 FAILS TO 03* 03 pre-EPU 03 03 INHIBIT ADS INHIBIT ADS and EPU I _Change

Risk Assessment Attachment 9 Page 80 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU AHU-- 2.70E- 1.52E- FAILURE TO AHU-- FAILURE TO 3.20E- 3.30E- Make 3.20E- 3.30E-XTRDXI2 04 02 INITIATE XTRDXI2 INITIATE 04 04 pre-EPU 04 04 MANUAL MANUAL and EPU DEPRESS. DEPRESSURIZA Change (NON-LOOP TION (NON-CASES) LOOP CASES)

BHU-- 1.60E- 7.55E- FAILURE TO BHU-- FAILURE TO 2.1OE- No Make 2.1OE- No MAXDXI2 02 03 MAXIMIZE CRD MAXDXI2 MAXIMIZE CRD 02 chang pre-EPU 02 change FLOW PER T-246 FLOW PER T- e Change -

246 BHU- 5.80E- 3.36E- FAILURE TO BHU- FAILURE TO 6.90E- No Make 6.90E- No PUMPDXI2 03 03 START PUMPDX12 START 03 chang pre-EPU 03 change STANDBY CRD STANDBY CRD e Change PUMP OR PUMP OR RESTART RESTART RUNNING PMP RUNNING PMP DHU- 1.OOE- 4.91E- OPERATOR 0.1 in No No OVERDXl2 01 04 FAILS TO Fire PRA Chang Chang OVERRIDE -Leave e e SHROUD LOW as is LEVEL PERMISSIVE DHU- 1.OOE+ 4.97E- OPERATOR DHU- OPERATOR 5.70E- No 1.0 in No No RUPTDX12 00 06 FAILS TO STOP RUPTDX12 FAILS TO STOP 02 chang Fire PRA Chang Chang RUPTURE RUPTURE e - Leave e e FLOOD BY FLOOD BY as is TRIPPING PUMP TRIPPING PUMP

Risk Assessment Attachment 9 Page 81 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU DHU-- 2.50E- 6.31E- FAILURE OF DHU-- FAILURE OF 2.90E- No Make 2.90E- No SDCDXI2 03 05 OPERATOR TO SDCDX12 OPERATOR TO 03 chang pre-EPU 03 change INITIATE INITIATE e Change RHR/SDC RHR/SDC DHU-- 4.10E- 3.40E- COND. FAILURE DHU-- CONDITIONAL 2.50E- 5.OOE- Make 2.50E- 5.OOE-SPCDXD2 01 04 OF OPERATOR SPCDXD2 FAILURE OF 02 02 pre-EPU 02 02 TO INIT. OPERATOR TO and EPU SPC/SDC - LATE INITIATE Change SPC/SDC - LATE DHU-- 2.10E- 3.47E- FAILURE OF DHU-- FAILURE OF 2.20E- No Make 2.20E- No SPCDX12 05 04 OPERATOR TO SPCDX12 OPERATOR TO 04 chang pre-EPU 04 change INITIATE INITIATE e Change RHRJSPC RHR/SPC I DHU- 1.OOE+ 2.46E- RHR PUMP 1.0 in No No TRANPX2 00 03 SYSTEM Fire PRA Chang Chang REPAIRS NOT -Leave e e COMPLTD(TRAN as is SIENT)

EHUCWGC 1.60E- 1.43E- CWG OPERATOR EHUCWGC CWG 4.40E- No Make 4.40E- No NDXIO 02 03 FAILS TO NDXIO OPERATOR 02 chang pre-EPU 02 change ESTABLISH FAILS TO e Change CONOWINGO ESTABLISH LINE CONOWINGO LINE

Risk Assessment Attachment 9 Page 82 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU EHUCWGPB 1.00E+ 1.OOE- PB OPERATOR EHUCWGPB PB OPERATOR 2.70E- No 1.0 in No No DXIO 00 01 FAILS TO DXIO FAILS TO 02 chang Fire PRA Chang Chang ESTABLISH ESTABLISH e - Leave e e CONOWINGO CONOWINGO as is LINE LINE EHU- 4.OOE- 7.02E- FAILURE TO EHU- FAILURE TO 4.50E- 4.70E- Make 4.50E- 4.70E-LOOPDXIO 04 04 START DIESEL LOOPDXIO START DIESEL 04 04 pre-EPU 04 04 AFTER NO AFTER NO and EPU AUTO-INIT (NO AUTO-INIT (NO Change LOCA) LOCA)

EHU- 1.OOE+ 7.94E- FAILURE TO X- EHU- FAILURE TO X- 1.90E- No 1.0 in No No SE11DXIO 00 02 TIE SE11DXIO TIE 02 chang Fire PRA Chang Chang EMERGENCY AC EMERGENCY e - Leave e e POWER PER SE- AC POWER PER as is 11 SE-11 EHU- 1.50E- 5.81E- EHU-SE11DXIO 1Ox used 1.90E- No SE11DXIO- 01 02 modified to 0.15 in Fire 01 change 0.15 PRA-Do same for pre-EPU HHU-- 1.30E- 9.72E- OPERATOR HHU-- OPERATOR 8.40E- 2.10E- Make 8.40E- 2.10E-HLTDXI2 02 07 FAILS TO TRIP HLTDXI2 FAILS TO TRIP 02 02 pre-EPU 02 02 HPCI ON HIGH HPCI ON HIGH and EPU LEVEL LEVEL Change HHU- 1.20E- 6.90E- MAINTENANCE Pre- No No HPCIDMI2 04 05 ERROR initiator - Chang Chang DISABLES HPCI Leave as e e I _is

Risk Assessment Attachment 9 Page 83 Table-4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU IHUTRAIND 1.OOE+ 7.06E- OPERATOR 1.0 in No No X12 00 05 FAILS TO Fire PRA Chang Chang CROSSTIE U2 - Leave e e INSTRUM AIR as is TRAINS JHU- 1.OOE- 7.96E- OPERATOR JHU- OPERATOR 2.60E- No Make 2.60E- No 2344DX12 01 04 FAILS TO CORR. 2344DX12 FAILS TO 03 chang pre-EPU 03 change ALIGN CROSS CORRECTLY e Change CONNECT ALIGN CROSS CONNECT JHU-- 1.50E- 3.09E- OPERATOR JHU-- OPERATOR 1.70E- 3.40E- Make 1.70E- 3.40E-ECTDXI2 03 05 FAILS TO CORR ECTDXI2 FAILS TO 03 03 pre-EPU 03 03 ALIGN HPSW CORRECTLY and EPU FOR COOLING ALIGN HPSW Change TOWER FLOW FOR COOLING TOWER FLOW JHUHWINJD 3.40E- 2.18E- OPERATOR JHUHWINJD OPERATOR 4.80E- 2.OOE- Make 4.80E- 2.OOE-XD2 02 03 FAILS TO XD2 FAILS TO 02 02 pre-EPU 02 02 INJECT WITH INJECT WITH and EPU HPSW THRU HPSW Change RHR (LATE) THROUGH RHR (LATE)

JHUHWINJD 5.30E- 2.27E- OPERATOR JHUHWINJD OPERATOR 4.40E- 5.60E- Make 4.40E- 5.60E-X12 02 03 FAILS TO X12 FAILS TO 02 02 pre-EPU 02 02 INJECT WITH INJECT WITH and EPU HPSW THRU HPSW Change RHR (EARLY) THROUGH RHR (EARLY)

Risk Assessment Attachment 9 Page 84 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU KHUDGFAN 1.OOE+ 2.16E- OPERATOR 1.0 in No No DXIO 00 02 FAILS TO Fire PRA Chang Chang MANUALLY - Leave e e INITIATE as is SUPPLEMENTAL FAN MHUSE11W 1.OOE+ 4.55E- OPERATORS MHUSE11W OPERATORS 5.80E- No 1.0 in No No DXI2 00 02 FAIL TO DXI2 FAIL TO 02 chang Fire PRA Chang Chang IMPLEMENT SE- IMPLEMENT S.E- e - Leave e e 11 11 as is ATTACHMENT W ATTACHMENT w

MHUSE11W 4.00E- 1.15E- MHUSE11WDX12 lx used 5.80E- No DXI2-0.043 02 05 modified to 0.043 in Fire 02 change PRA - Do same for pre-EPU RHU-- 1.OOE+ 4.81E- FAILURE TO 1.0 in No No LCLDXI2 00 05 LOCALLY RESET Fire PRA Chang Chang TURBINE AFTER - Leave e e OVERSPEED as is TRIP RHU- 1.20E- 2.25E- MAINTENANCE Pre- No No RCICDMI2 04 06 ERROR initiator - Chang Chang DISABLES RCIC Leave as e e

____________ _____________ _______________ ______is ___________is

Risk Assessment Attachment 9 Page 85 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU THU-- 1.OOE+ 1.86E- OPERATOR 1.0 in No No THXDX12 00 05 FAILS TO ALIGN Fire PRA Chang Chang STANDBY - Leave e e TBCCW HX as is VHU- 1.80E- 2.37E- OPERATOR VHU- OPERATOR 1.30E- 1.40E- Make 1.30E- 1.40E-VENTDXl2 03 03 FAILS TO VENTDXl2 FAILS TO 02 02 pre-EPU 02 02 INITIATE VENT INITIATE VENT and EPU GIVEN RHR GIVEN RHR Change HARDWARE HARDWARE FAILUR FAILURE WHU-- 1.OOE+ 2.64E- FAILURE TO WHU-- FAILURE TO 9.50E- No Make 9.50E- No ESWDXDO 00 02 START ESW ESWDXDO START ESW 02 chang pre-EPU 02 change PUMP LATER PUMP LATER e Change WHU-- 1.30E- 2.66E- FAILURE TO WHU-- FAILURE TO 7.30E- No Make 7.30E- No ESWDXIO 02 02 START ESW ESWDXIO START ESW 02 chang pre-EPU 02 change PUMP EARLY PUMP EARLY e Change WHU-- 1.OOE+ 3.64E- OPERATORS WHU-- OPERATORS 4.OOE- No 1.0 in No No NSWDXD2 00 02 FAIL TO START NSWDXD2 FAIL TO START 03 chang Fire PRA Chang Chang STANDBY NSW STANDBY SW e - Leave e e PUMP (LATER) PUMP (LATER) as is WHU-- 1.OOE- 2.27E- WHU--NSWDXD2 5x used 2.OOE- No NSWDXD2- 02 04 modified to 0.015 in Fire 02 change 0.015 PRA-Do same for pre-EPU

Risk Assessment Attachment 9 Page 86 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU WHU-- 1.OOE+ 3.91E- OPERATORS WHU-- OPERATORS 1.OOE No 1.0 in No No NSWDX12 00 02 FAIL TO START NSWDX12 FAIL TO START +00 chang Fire PRA Chang Chang STANDBY NSW STANDBY SW e - Leave e e PUMP (EARLY) PUMP (EARLY) as is YHU-- 6.60E- 2.15E- OPERATORS YHU-- OPERATORS 9.1OE- No Make 9.1OE- No CSTDXI2 03 04 FAIL TO REFILL CSTDX12 FAIL TO REFILL 03 chang pre-EPU 03 change CST FROM CST FROM e Change RWST (RW RWST (RW PUMPS) PUMPS)

YHU-- 1.10E- 2.78E- OPERATORS YHU-- OPERATORS 1.40E- No Make 1.40E- No GRFDX12 02 04 FAIL TO REFILL GRFDX12 FAIL TO REFILL 02 chang pre-EPU 02 change CST FROM CST FROM e Change RWST (GRAVITY RWST FEED) (GRAVITY FEED)

ZHU- 1.OOE- 1.20E- FLOOR HEP FOR ZHU- FLOOR HEP 1.OOE- No Same No No AADIDXI2 06 04 AHU--CAD, AADIDXI FOR AHU--CAD, 06 Chang value Chang Chang AHUBTL-R, AHUBTL-R, e applies e e IHURESET, DHU- IHURESET,

-SPC DHU--SPC ZHU-- 1.OOE- 6.25E- FLOOR HEP FOR ZHU-- FLOOR HEP 1.00E- No Same No No ABDDXI2 06 05 AHU-XTE, BHU- ABDDXI FOR AHU-XTE, 06 Chang value Chang Chang PUMP, AND BHU-PUMP, e applies e e DHU--SPCDXI AND DHU--

SPCDXI

Risk Assessment Attachment 9 Page 87 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU ZHU- 5.OOE- 9.58E- FLOOR HEP FOR Deleted - 0.00 0.00 ADFVDXI2 07 04 AHUXTR, Set to DHUSPC*, MISC zero FW, AND VENT ZHU- 5.OOE- 9.94E- FLOOR HEP FOR Deleted - 0.00 0.00 ADJYDXI2 07 04 AHU--XTR, DHU-- Set to SPC, JHUHWINJ, zero ZHU--CST ZHU-- 1.OOE- 9.73E- FLOOR HEP FOR ZHU-- FLOOR HEP 1.OOE- No Same No No ADLDXI2 06 06 AHU--XTEDXI ADLDXI FOR AHU-- 06 Chang value Chang Chang AND DHU-- XTEDXI AND e applies e e SPCDXI DHU--SPCDXI ZHU- 1.OOE- 2.55E- FLOOR HEP FOR ZHU- FLOOR HEP 1.OOE- No Same No No ADLKDX12 06 05 AHU--XT*DXI ADLKDXl FOR AHU-- 06 Chang value Chang Chang AND DHU- XT*DXl AND e applies e e LEAKDXI DHU-LEAKDXI ZHU-- 1.OOE- 9.73E- FLOOR HEP FOR ZHU-- FLOOR HEP 1.OOE- No Same No No ADMDX12 06 06 AHU--XTE, DHU-- ADMDXl FOR AHU--XTE, 06 Chang value Chang Chang SPC, AND DHU--SPC, AND e applies e e MHUSE11WDXI MHUSE11WDXI ZHU-- 1.OOE- 9.94E- FLOOR HEP FOR ZHU-- FLOOR HEP 1.OOE- No Same No No ADTDXI2 06 04 AHU--XTRDXI ADTDXl FOR AHU-- 06 Chang value Chang Chang AND DHU-- XTRDXI AND e applies e e SPCDXl DHU--SPCDXI ZHU- 5.OOE- 9.94E- FLOOR HEP FOR Deleted - 0.00 0.00 ADVYDXI2 07 04 AHU--XTR, DHU-- Set to SPC, VHU-VENT, zero ZHU--CST

Risk Assessment Attachment 9 Page 88 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU ZHU-- 1.OOE- 2.84E- FLOOR HEP FOR ZHU-- FLOOR HEP 1.OOE- No Same No No ADYDXI2 06 04 AHU--XTE, DHU-- ADYDXI FOR AHU--XTE, 06 Chang value Chang Chang SPC, VHU-VENT, DHU--SPC, e applies e e ZHU--CST VHU-VENT, ZHU--CST ZHU-- 1.50E- 5.90E- JOINT HEP FOR ZHU-- JOINT HEP FOR 4.80E- No Make 4.80E- No AHLDX12 03 06 AHU--XTEDXI AHLDXI AHU--XTEDXI 05 Chang pre-EPU 05 Chang AND ZHU- AND ZHU- e Change e HIGHDXI HIGHDXI ZHU-- 1.50E- 9.66E- JOINT HEP FOR ZHU-- JOINT HEP FOR 4.80E- No Make 4.80E- No AHTDXI2 03 03 AHU--XTRDXI AHTDXI AHU--XTRDXI 05 Chang pre-EPU 05 Chang AND ZHU- AND ZHU- e Change e HIGHDXI HIGHDXI ZHU--- 1.OOE- 2.55E- FLOOR HEP FOR ZHU---AJDXI FLOOR HEP 1.OOE- No Same No No AJDXI2 06 05 AHU--XTRDXI FOR AHU-- 06 Chang value Chang Chang AND JHU-- XTRDXI AND e applies e e ECTDXI JHU--ECTDXI ZHUALTAC 4.60E- 2.OOE- JOINT HEP FOR ZHUALTAC JOINT HEP FOR 3.20E- No Make 3.20E- No DXIO 03 03 EHU-SE11DXIO DXIO EHU-SE11DXI0 03 Chang pre-EPU 03 Chang AND AND e Change e EHUCWGPBDXIO EHUCWGPBDXI 0

ZHU-- 5.OOE- 4.40E- FLOOR HEP FOR ZHU-- FLOOR HEP 5.OOE- No Same No No BDJDX12 07 04 BHU-PUMP, DHU- BDJDXI FOR BHU- 07 Chang value Chang Chang

-SPC, AND PUMP, DHU-- e applies e e JHUHWINJDXI SPC, AND JHUHWINJDXI

Risk Assessment Attachment 9 Page 89 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU ZHU-- 5.OOE- 4.57E- FLOOR HEP FOR ZHU-- FLOOR HEP 5.00E- No Same No No BDVDXI2 07 04 BHU-PUMP, DHU- BDVDXI FOR BHU- 07 Chang value Chang Chang

-SPC, AND VHU- PUMP, DHU-- e applies e e VENTDXI SPC, AND VHU-VENTDXI ZHU-- 3.30E- 1.15E- OPERATORS ZHU-- OPERATORS 2.40E- No Make 2.40E- No CSTDX12 03 02 FAIL TO REFILL CSTDXI FAIL TO REFILL 03 Chang pre-EPU 03 Chang CST FROM CST FROM e Change e RWST (ANY RWST (ANY MEANS) MEANS)

ZHU-- 5.00E- 6.30E- FLOOR HEP FOR Deleted - 0.00 0.00 DFVDXl2 07 04 SDC/SPC, MISC Set to FW, AND VENT zero ZHU-- 5.OOE- 4.15E- FLOOR HEP FOR ZHU-- FLOOR HEP 5.OOE- No Same No No DJMDXI2 07 04 DHU--SPC, DJMDXI FOR DHU--SPC, 07 Chang value Chang Chang JHUHWINJ, AND JHUHWINJ, AND e applies e e MHUSE11WDXI MHUSE11WDXI ZHU-- 5.OOE- 4.32E- FLOOR HEP FOR ZHU-- FLOOR HEP 5.OOE- No Same No No DMVDX12 07 04 DHU--SPC, DMVDXI FOR DHU--SPC, 07 Chang value Chang Chang MHUSE11W, AND MHUSE11W, e applies e e VHU-VENTDXI AND VHU-VENTDXI ZHU-- 5.00E- 4.32E- FLOOR HEP FOR ZHU-- FLOOR HEP 5.00E- No Same No No DTVDX12 07 04 DHU--SPC, THU-- DTVDXI FOR DHU--SPC, 07 Chang value Chang Chang THX, AND VHU- THU--THX, AND e applies e e VENTDXI VHU-VENTDXI I I_ I I

Risk Assessment Attachment 9 Page 90 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU ZHU-- 5.OOE- 9.94E- FLOOR HEP FOR ZHU-- FLOOR HEP 5.OOE- No Same No No DVYDX12 07 04 DHU--SPC, VHU- DVYDXI FOR DHU--SPC, 07 Chang value Chang Chang VENT, AND ZHU-- VHU-VENT, AND e applies e e

_ CSTDXI ZHU--CSTDXI ZHU- 2.1OE- 9.13E- FAILURE TO ZHU- FAILURE TO 2.20E- 3.20E- Make 2.20E- 3.20E-HIGHDXI2 03 06 MANUALLY HIGHDXI2 MANUALLY 03 03 pre-EPU 03 03 INITIATE INITIATE and EPU HPCI/RCIC HPCI/RCIC Change INJECTION INJECTION ZHU-- 7.20E- 5.44E- OPERATOR ZHU-- OPERATOR 4.60E- 4.OOE- Make 4.60E- 4.OOE-HRLDXI2 02 04 FAILS TO TAKE HRLDX12 FAILS TO TAKE 02 02 pre-EPU 02 02 MANUAL MANUAL and EPU CONTROL OF CONTROL OF Change HPCI/RCIC - HPCI/RCIC -

EARLY EARLY ZHU-- 1.90E- 2.76E- JOINT HEP FOR ZHU-- JOINT HEP FOR 2.50E- 2.OOE- Make 2.50E- 2.OOE-HRZDXI2 01 03 HHU--HLT/ RHU-- HRZDXI HHU--HLT/ RHU- 02 02 pre-EPU 02 02 HLT, AND ZHU-- -HLT, AND ZHU- and EPU HRLDXI2 -HRLDXI2 Change ZHU--- 9.OOE- 1.03E- JOINT HEP FOR ZHU---JVDXI JOINT HEP FOR 1.30E- 6.60E- Make 1.30E- 6.60E-JVDXI2 05 04 JHUHWINJDXD JHUHWINJDXD 04 05 pre-EPU 04 05 AND VHU- AND VHU- and EPU VENTDXI VENTDXI Change ZHU-- 6.20E- 6.40E- FAILURE TO ZHU-- FAILURE TO 8.30E- 1.20E- Make 8.30E- 1.20E-LPIDXI2 04 07 MANUALLY LPIDXI2 MANUALLY 04 03 pre-EPU 04 03 INITIATE LOW INITIATE LOW and EPU PRESS ECCS PRESS ECCS Change (TRANSIENT) (TRANSIENT)

Risk Assessment Attachment 9 Page 91 Table 4.3-1 Estimate of EPU Impact on Fire Human Error Probabilities Fusse II- Fire Fire PRA Proba- Vesel Equivalent Pre- Commen Pre- Fire HEP bility y Description 2009A HEP Description EPU EPU t EPU EPU ZHU-- 1.40E- 5.36E- OP FAILS TO ZHULVCTR OP FAILS TO 2.60E- No Make 2.60E- No LVCDXI2 04 04 CNTRL LEVEL IN DXI2 CONTROL 04 chang pre-EPU 04 change A TRANS W/ LEVEL IN A e Change ECCS INJ. TRANS W/

ECCS INJECTION

Risk Assessment Attachment 12 Page 92 Table 4.3-2 Estimate of Impact on Fire CDF Due to EPU Scenario Description Pre EPU EPU CDF Delta CDF CDF Unit 2 Reactor Recirculation Pump MG Set room 4.23E-06 4.23E-06 -0.00 4kV Switchgear Bus 20A17, Breaker 1708 3.91 E-06 3.91 E-06 -0.00 4kV Switchgear Bus 20A018, Breaker 1801 3.44E-06 3.44E-06 -0.00 Cable Spreading Room Relay Cabinet 20C32 3.43E-06 3.43E-06 -0.00 4kV Switchgear Bus 20A01 8, Breaker 1808 2.37E-06 2.37E-06 -0.00 2AC043 portion of the Remote Shutdown Panel 2.22E-06 2.23E-06 +1.OE-08 Same as scenario 38-F with Alternate Battery Charger 2.05E-06 2.05E-06 -0.00 Success Main Control Room Abandonment Back Panel Fire 1.82E-06 1.82E-06 -0.00 4kV Switchgear Bus 20A015 1.54E-06 1.58E-06 +4.OE-08 MCR Cabinet Fire - 00C29B 1.52E-06 1.52E-06 -0.00 MCR Cabinet Fire - 00C29C 1.27E-06 1.27E-06 -0.00 MCR Cabinet Fire - 00C29A 1.21 E-06 1.21 E-06 -0.00 All other Areas 1.45E-05 1.47E-05 +2.OE-07 Total Fire CDF 4.35E-05 4.38E-05 +2.5E-07

Risk Assessment Attachment 12 Page 93 4.4 SEISMIC RISK The frequency of earthquakes is not dependent on reactor power or operation. Thus,.no impact on the seismic initiating event frequency is postulated.

The PBAPS seismic risk analysis was performed as part of the Individual Plant Examination for External Events (IPEEE) [8]. PBAPS performed a seismic margins assessment (SMA) following the guidance of EPRI NP-6041 [10]. The SMA is a deterministic evaluation process that does not calculate risk on a probabilistic basis. No core damage frequencies were quantified as part of the seismic risk evaluation.

The IPEEE submittal [8] identified several areas for seismic margin improvement (Refer to Table 7.2-1b of the IPEEE submittal). These changes have all been subsequently addressed and in effect will reduce the seismic risk at the site.

Based on the efforts to correct the seismic issues that were identified as part of the IPEEE program and the ongoing process to monitor seismic issues at the plant, no additional measures are considered to be required based on the implementation of EPU. The EPU has little or no impact on the seismic qualifications of the systems, structures and components (SSCs).

Specifically, the power uprate results in additional thermal energy stored in the RPV, but the additional blowdown loads on the RPV and containment given a coincident seismic event will not alter the results of the SMA.

The decrease in time available for operator actions, and the associated increases in calculated HEPs, will have a non-significant impact on seismic-induced risk. Industry BWR seismic PRAs have typically shown (e.g., Peach Bottom NUREG/CR-4550 study [20]; and the Limerick Generating Station Severe Accident Risk Assessment [21]) that seismic risk is overwhelmingly dominated by seismic induced equipment and structural failures.

Based on the above discussion, the increase in the PBAPS seismic risk due to the EPU is much less than that calculated for internal events.

Risk Assessment Attachment 12 Page 94 4.5 OTHER EXTERNAL EVENTS RISK In addition to internal fires and seismic events, the PBAPS IPEEE Submittal analyzed a variety of other external hazards:

• High Winds/Tornadoes

• External Floods

• Transportation and Nearby Facility Accidents The PBAPS IPEEE analysis of high winds, tornadoes, external floods, transportation accidents, and nearby facility accidents was accomplished by reviewing the plant environs against regulatory requirements regarding these hazards. Based upon this review, it was concluded that PBAPS meets the applicable NRC Standard Review Plan requirements and therefore has an acceptably low risk with respect to these hazards.

Based on the other external events being low risk contributors and the fact that the EPU changes would not significantly change the risk from these types of events, the increase in the PBAPS other external events risk due to the EPU is much less than that calculated for internal events.

4.6 SHUTDOWN RISK The impact of the Extended Power Uprate (EPU) on shutdown risk is similar to the impact on the at-power Level 1 PRA. Based on the insights of the at-power PRA impact assessment, the areas of review appropriate to shutdown risk are the following:

• Initiating Events

• Success Criteria

• Human Reliability Analysis The following qualitative discussion applies to the shutdown conditions of Hot Shutdown (Mode 3), Cold Shutdown (Mode 4), and Refueling (Mode 5). The EPU risk impact during the transitional periods such as at-power (Mode 1) to Hot Shutdown and Startup (Mode 2) to at-power is subsumed by the at-power Level 1 PRA. This is consistent with the U.S. PRA industry, and with NRC Regulatory Guide 1.174, which states that not all aspects of risk need to be addressed for every application. While higher conditional risk states may be postulated during

Risk Assessment Attachment 12 Page 95 these transition periods, the short time frames involved produce an insignificant impact on the long-term annualized plant risk profile.

4.6.1 Shutdown Initiatinq Events Shutdown initiating events include the following major categories:

• Loss of RCS Inventory

- Inadvertent Draindown

- LOCAs

" Loss of Decay Heat Removal (includes LOOP)

No new initiating events or increased potential for initiating events during shutdown (e.g., loss of DHR train) can be postulated due to the EPU.

4.6.2 Shutdown Success Criteria The impact of the EPU on the success criteria during shutdown is similar to the Level 1 PRA.

The increased power level decreases the time to boildown. However, because the reactor is already shutdown, the boildown times are much longer compared to the at-power PRA. The estimated time to uncover the core with the existing power level (CLTP) is 11.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (10.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> for the EPU) at one day into the outage with the RPV level at the flange. The estimated time to uncover the core exceeds 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> when the water level is flooded up into the refueling cavity for both pre-EPU and EPU conditions.

The increased decay heat loads associated with the EPU impacts the time when low capacity decay heat removal (DHR) systems can be considered successful alternate DHR systems. The EPU condition delays the time after shutdown when low capacity DHR systems may be used as an alternative to Shutdown Cooling (SDC). However, this reduction in time for alternate decay heat removal system success minimally impacts shutdown risk.

Other success criteria are marginally impacted by the EPU. The EPU has a minor impact on shutdown RPV inventory makeup during loss of decay heat removal scenarios in shutdown because of the low decay heat level compared to at-power heat loads. The heat load to the suppression pool during loss of decay heat removal scenarios in shutdown (i.e., during shutdown

Risk Assessment Attachment 12 Page 96 phases with the RPV intact) is also lower because of the low decay heat level such that the margins for suppression pool cooling capacity are adequate for the EPU condition.

The EPU impact on the success criteria for blowdown loads, RPV overpressure margin, and SRV actuation is estimated to be negligible because of the low RPV pressure and low decay heat level during shutdown.

4.6.3 Shutdown HRA Impact The primary impact of the EPU on risk during shutdown operations is the decrease in allowable operator action times in responding to off-normal events. However, as can be seen in Tables B-2 through B-4 of Appendix B, the reduction in times to core damage (i.e., CLTP case compared to EPU case) is on the order of 10%. Such small changes in already lengthy allowable operator response times result in negligible changes (<<1%) in calculated human error probabilities.

The allowable operator action times to respond to loss of heat removal scenarios during shutdown operations are many hours long. Very early in an outage the times are approximately 5-10 hours; later in an outage the times are dozens of hours. A reduction from 7.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 6.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (refer to "1 Day After Shutdown" case in Table B-2 of Appendix B) in allowable action times would not result in a significant increase in human error probabilities for most operator actions using current human reliability analysis methods. The allowable timing reductions for times later in the outage would result in indiscemible changes in HEPs using current human reliability analysis methods.

4.6.4 Shutdown Risk Summary Based on a review of the potential impacts on initiating events, success criteria, and HRA, the EPU is assessed to have a non-significant impact (delta CDF of roughly one percent per calculations in Appendix B) on shutdown risk.

Risk Assessment Attachment 12 Page 97 This assessment is consistent with CLTR conclusions on this issue [18]:

"The shutdown risks for BWR plants are generally low and the impact of CPPU [constant pressure power uprate] on the CDF and LERF during shutdown is expected to be negligible."

PBAPS Outage Risk Management Process The plant uses a computerized risk monitor (PARAGON) and site-specific management guidelines as tools for controlling outage risk. The impact of the outage activities upon key safety functions is assessed as follows:

• Identify key safety functions affected by the SSC planned for removal from service.

" Consider the degree to which removing the SSC from service will impact the key safety functions.

• Consider degree of redundancy, duration of out-of-service condition, and appropriate compensatory measures, contingencies, or protective actions that could be taken if appropriate for the activity under consideration.

The Key Safety Function Matrices were developed consistent with guidance provided by NUMARC 91-06. The shutdown key safety functions are achieved by using systems or combinations of systems. The scope of the Systems, Structures and Components (SSCs) to be addressed by the assessment for shutdown conditions are those SSCs necessary to support the following shutdown key safety functions (from Section 4 of NUMARC 91-06):

0 Decay heat removal capability 0 Inventory Control 0 Power Availability 0 Reactivity control 0 Containment (primary/secondary)

Managing the risk involves invoking some or all of the following elements:

0 Pre-job briefs of operating and maintenance crews 0 System engineering oversight 0 Management oversight 0 Outage management approval of the proposed activity 0 Pre-staged parts and materials 0 Walkdown of tagouts and maintenance activity prior to conducting the maintenance 0 Mockup training 0 Reduce OOS time through overtime or additional shift coverage.

0 Contingency plans for returning equipment to service in a timely manner if needed.

Risk Assessment Attachment 12 Page 98

• Compensatory measures to minimize initiators and/or mitigate the consequences.

• Reschedule or minimize work on functionally related equipment.

• Proceduralize other success paths of the safety function affected.

4.7 RADIONUCLIDE RELEASE (LEVEL 2 PRA)

The Level 2 PRA calculates the containment response under postulated severe accident conditions and provides an assessment of the containment adequacy. In the process of modeling severe accidents (i.e., the MAAP code), the complex plant structure has been reduced to a simplified mathematical model that uses basic thermal hydraulic principles and experimentally derived correlations to calculate the radionuclide release timing and magnitude

[22]. Changes in plant response due to EPU represent relatively small changes to the overall challenge to containment under severe accident conditions.

Approximately 125 Level 1 and Level 2 MAAP runs were performed in support of the PBAPS EPU risk assessment. The Level 2 MAAP runs were focused on the assessment of any significant changes in release categories. No changes to the PBAPS PRA Level 2 accident progression logic modeling or release magnitude assignment were evaluated to be necessary for EPU.

The following aspects of the Level 2 analysis are briefly discussed:

• Level 1 input

• Accident Progression

• Human Reliability Analysis

• Success Criteria

• Containment Capability

• Radionuclide Release Magnitude and Timing Level 1 Input The front-end evaluation (Level 1) involves the assessment of those scenarios that could lead to core damage. The subsequent treatment of mitigating actions and the inter-relationship with the containment after core damage (Level 2) is then treated in the PBAPS Containment Event Trees (CETs).

Risk Assessment Attachment 12 Page 99 In the PBAPS Level 1 PRA, accident sequences are postulated that lead to core damage and potentially challenge containment. The PBAPS Level 1 PRA has identified discrete accident sequences that contribute to the core damage frequency and represent the spectrum of possible challenges to containment.

The Level 1 core damage sequences are also propagated through the Level 2 CETs. Therefore, changes to the Level 1 PRA modeling directly impact the Level 2 PRA results. However, the percentage increase in total CDF due to the EPU is not a direct translation to the percentage increase in total LERF. For example, a change to long-term core damage accidents would not impact the LERF results as much as early-term core damage accidents that have a larger potential to result in a Level 2 large and early release sequence.

Therefore, the Level 2 at-power internal events PRA model is also re-quantified as part of this EPU risk assessment.

Accident Progression The EPU does not change the plant configuration and operation in a manner that produces new accident sequences or changes accident sequence progression phenomenon. This is particularly true in the case of the Level 2 post-core damage accident progression phenomena.

The minor changes in decay heat levels have a minor impact on Level 2 PRA safety functions, such as containment isolation, ex-vessel debris coolability and challenges to the ultimate containment strength. No Level 2 safety function success criteria (e.g., gpm of coolant required for in-vessel or ex-vessel debris cooling) would be changed due to the EPU (although the timing requirements may be shifted somewhat).

Regarding energetic phenomena occurring at or near the time of core slump or RPV breach, such accident progression scenarios are appropriately modeled in the PBAPS Level 2 PRA as leading directly to High magnitude releases. This is a reasonable and standard PRA industry approach. This approach would not be changed due to the EPU.

Risk Assessment Attachment 12 Page 100 Thereforej no changes are made as part of this assessment to the Level 2 models (either in structure or basic event phenomenon probabilities) with respect to accident progression modeling.

Human Reliability Analysis Since the PBAPS PRA employs a fully integrated Level 1 transfer to the Level 2 PRA model, changes to HEP values (refer to Section 4.1.6) have a direct effect on both the Level 1 and Level 2 results. In other words, changing HEPs can affect the outcome of core damage, which then provides the input to the sequences responsible for calculating release categories.

Success Criteria No changes in success criteria have been identified with regard to the Level 2 containment evaluation. The slight changes in accident progression timing and decay heat load has a minor or negligible impact on Level 2 PRA safety functions, such as containment isolation, ex-vessel debris coolability and challenges to the ultimate containment strength. (Refer to Section 4.1.2.8 of this report). Therefore, no changes to Level 2 modeling with respect to success criteria are made as part of this analysis.

Containment Capability As discussed in Section 4.1.2.8 earlier in this report, no issues have been identified with respect to the EPU that have any impact on the capacity of the PBAPS containment as analyzed in the PRA.

The PBAPS containment capacity with respect to severe accidents is analyzed in the PRA using plant specific structural analyses as well as information from industry studies and experiments.

The minor changes to the plant from the EPU have no impact on the definition of these containment loading profiles or the likelihood of containment isolation failure. The slightly higher decay heat levels associated with the EPU will result in a minor reduction in times to reach

Risk Assessment Attachment 12 Page 101 loading challenges; however, the time frames are long (many hours) and the accident timing reductions of 10-15% due to the EPU will typically have a small impact on the Level 2 results.

Release Magnitude and Timing The following issues can substantially increase or decrease the ability to retain fission products or mitigate their release:

• Radionuclide removal processes

• Containment failure modes

• Phenomenology

• Accident sequence timings Each of these issues is considered and analyzed in the PBAPS Level 2 PRA.

The PBAPS Level 2 PRA release categorization scheme uses both release magnitude and timing. Release categories were assigned to the PBAPS 2009A pre EPU PRA based on results of representative MAAP runs for many accident scenarios, and based on judgment and standard industry approaches for selected scenarios.

The PBAPS release magnitude classification is based on the percentage (as a function of the initial EOC inventory in the core) of Csl released to the environment; this approach is consistent with the majority of US BWR PRAs and standard industry techniques. Changes to the release magnitude categories assigned to individual accident sequences in the PBAPS Level 2 PRA are not necessary; this was confirmed by MAAP runs.

Level 2 Impact Summary Based on the above discussion, the impact of the EPU on the PBAPS Level 2 PRA results, independent of the Level 1 analysis, is estimated to be small. The change in the Level 2 is due primarily to changes in the Level 1 accident sequences propagated through to the Level 2 quantification. That is, an increase in a Level 1 accident sequence gave rise to a proportional increase in the Level 2 result that was associated with that core damage state, i.e., the Level 2 results are coupled to the Level 1 results.

Risk Assessment Attachment 12 Page 102 Section 5 CONCLUSIONS The Extended Power Uprate (EPU) for PBAPS has been reviewed to determine the net impact on the risk profile associated with operation at an increase in power level to 3951 MWt. This examination involved the identification and review of plant and procedural changes, plus changes to the risk spectrum due to changes in the plant response.

The change in plant response, procedures, hardware, and setpoints associated with the increase in power have been investigated using the 2009A pre-EPU and 2009A1 EPU PRA models; a focused analysis of fire risk; the IPEEE study for seismic and other external events; and a qualitative evaluation of shutdown events. This section provides overall conclusions with respect to success criteria, the Level 1 PRA, the Level 2 PRA, internal fires, seismic events, other external events, and shutdown events. The review has indicated that small perturbations on individual inputs could be identified.

This section summarizes the risk impacts of the EPU implementation on the following areas:

• Level 1 Internal Events PRA

• Fire Induced Risk

• Seismic Induced Risk

• Other External Events Risk

• Shutdown Risk

• Level 2 PRA In addition, the guidelines from the NRC (Regulatory Guide 1.174) are followed to assess the change in risk as characterized by core damage frequency (CDF) and Large Early Release Frequency (LERF) 5.1 LEVEL 1 PRA Qualitative engineering insights regarding the adequacy of procedures and systems to prevent postulated core damage scenarios are among the principal results of the Level 1 portion of the PRA. These insights deal with the adequacy of, or improvements to, PBAPS procedures or systems (frontline or support) to accomplish their safety mission of preventing core damage.

The severe accident scenarios that have been identified in the Level 1 PRA have been reviewed

Risk Assessment Attachment 12 Page 103 and the relatively small perturbations due to power uprate do not affect the scenario development or the qualitative insights.

The PRA model changes incorporated for the power uprate evaluation are:

• Representation of the RHR cross-tie (as discussed in Section 4.1.2.3)

• Representation of the CST standpipe (as discussed in Section 4.1.4)

• Revised SORV probabilities (as discussed in Section 4.1.2.6)

• Revised HEPs (as presented in Tables 4.1-2 and 4.1-3)

• Revised LOOP recovery probabilities based on reduced time available (as discussed in Section 4.1.3)

Other than the representation of the RHR cross-tie and CST standpipe, no additional modeling structure changes to the PB209A PRA model were necessary to reflect the EPU in the PB209A1 PRA model. Only basic event value changes and LOOP recovery time impacts were incorporated into the PB209A1 PRA model to represent the remaining EPU impacts.

Based on the model impact discussed previously, the EPU is estimated to increase the PBAPS Unit 2 internal events PRA CDF from the base value of 3.60E-06/yr to 3.70E-06/yr, an increase of 1.OE-07/yr (2.8%). The composition and comparative distribution of the EPU results remain basically unchanged with respect to the base PBAPS PRA. Table 5.1-1 shows quantitative CDF comparisons categorized by initiating event and Table 5.1-2 compares various accident sequences. The at-power internal events LERF increased from the base value of 4.58E-07/yr to 4.74E-07/yr, an increase of 1.6E-08/yr (3.5%) for Unit 2. Table 5.1-3 shows quantitative LERF comparisons categorized by initiating event. Since the base case CDF and LERF are slightly lower for Unit 3 and based on a review of the changes in CDF and LERF for the EPU assessment, the EPU is expected to provide very similar impacts for Unit 3. Shutdown risk and external event risk was also evaluated and determined to be impacted to a similar or lesser degree than the internal events risk (refer to Sections 5.2 through 5.5).

Risk Assessment Attachment 12 Page 104 Table 5.1-1 Comparison of PBAPS CLTP CDF vs. EPU CDF by Initiator Initiator Description CLTP Value EPU Value %Increase by Relative % of (l/yr) (llyr) Initiator CDF Increase LOSS OF CONDENSER VACUUM 6.41 E-07 6.59E-07 +2.8% +0.5%

(%TCV)

MSIV CLOSURE (%TMSIV) 4.50E-07 4.59E-07 +2.0% +0.2%

TURBINE TRIP (%TTR) 3.16E-07 3.35E-07 +6.1% +0.5%

GRID CENTERED LOOP INITIATING 2.80E-07 2.73E-07 -2.6%(1) -0.2%

EVENT (%LOOP-GRID)

LOSS OF U2 SW INITIATING EVENT 2.71E-07 2.73E-07 +0.6% +0.1%

(%SW2)

MEDIUM LOCA (%S1) 2.53E-07 2.68E-07 +6.0% +0.4%

LOSS OF 4KV AC BUS E12 1.95E-07 2.04E-07 +4.5% +0.2%

(%TACBUSE12)

LOSS OF FEEDWATER (%TF) 1.82E-07 1.89E-07 +3.6% +0.2%

SMALL LOCA (%S2) 1.34E-07 1.45E-07 +8.3% +0.3%

OTHER LOCA CONTRIBUTORS 8.94E-08 8.04E-08 _10.0%(2) -0.2%

(%A, %VMSL, %VFW)

ALL OTHER INITIATORS 7.88E-07 8.15E-07 +3.5% +0.8%

TOTAL: 3.60E-06 3.70E-06 N/A +2.8%

(1) Note that this reduction is related to the incorporation of the CST standpipe for EPU. This eliminated some LOOP scenarios that resulted in inadvertent draindown of the CST.

(2) Note that this reduction is due to the new success path that now exists with the alignment of the RHR cross-tie given a Large LOCA and containment isolation failure occurs.

Risk Assessment Attachment 12 Page 105 Table 5.1-2 Comparison of PBAPS CLTP CDF vs. EPU CDF by Sequence Sequence Designator Description CLTP EPU Value Relative %

Value (lyr) of CDF (lIyr) Increase RCVSEQ-TM-38 MSIV Closure, Sequence 38: Initial failures 4.50E-07 4.57E-07 +0.2%

of HPCI and RCIC with failure to depressurize RCVSEQ-TF-13 Loss of Feedwater, Sequence 13: Loss of 2.99E-07 3.OOE-07 +0.0%

pond or SW with failure of long term DHR RCVSEQ-TM-26 MSIV Closure, Sequence 26: CCF or 2.55E-07 2.55E-07 Dependent HEP failures lead to intermediate time frame CD RCVSEQ-TT-1 0 Turbine Trip, Sequence 10: Loss of 4 kV AC 2.41 E-07 2.54E-07 +0.4%

bus, failure of HPCI, and failure to depressurize RCVSEQ-TT-38 Turbine Trip, Sequence 38: Initial failures of 1.82E-07 1.90E-07 +0.2%

FW, HPCI, and RCIC, and failure to depressurize RCVSEQ-S1-23 Medium LOCA, Sequence 23: LOCA below 1.64E-07 1.68E-07 +0.1%

TAF, failure of HPCI, and'failure to depressurize RCVSEQ-LP2-18 Loss of Offsite Power, Sequence 18: Station 1.48E-07 1.48E-07 blackout with failure to recover offsite power RCVSEQ-A-06 Large LOCA, Sequence 6: Large LOCA with 1.41 E-07 1.31 E-07 -0.3%

failure of all ECCS (including due to loss of CAP)

RCVSEQ-TM-15 MSIV Closure, Sequence 15: Loss of long 1.37E-07 1.46E-07 +0.3%

term DHR mostly from dependent HEP failures

Risk Assessment Attachment 12 Page 106 Table 5.1-2 Comparison of PBAPS CLTP CDF vs. EPU CDF by Sequence Sequence Designator Description CLTP EPU Value Relative %

Value Iyr) of CDF

_(1yr) (Increase RCVSEQ-TM-13 MSIV Closure, Sequence 13: Loss of 1.14E-07 1.14E-07 --

injection after venting containment at PCPL OTHER SEQUENCES Miscellaneous 1.48E-06 1.54E-06 +1.7%

TOTAL: 3.60E-06 3.70E-06 +2.8%

Table 5.1-3 Comparison of PBAPS CLTP LERF vs. EPU LERF by Initiator Initiator Description 1 CLTP Value EPU Value %increase by Relative % of I L (1/yr) (1yr Initiator LERF Increase V SEQUENCE THRU LPCI LINES 9.21 E-08 9.24E-08 +0.4% +0.1%

(%VLPCI)

TURBINE TRIP (%TTR) 6.96E-08 7.73E-08 +11.0% +1.7%

LOSS OF CONDENSER VACUUM 5.27E-08 5.50E-08 +4.4% +0.5%

(%TCV)

GRID CENTERED LOOP INITIATING 4.25E-08 4.88E-08 +14.9% +1.4%

EVENT (%LOOP-GRID)

WEATHER CENTERED LOOP 3.70E-08 3.97E-08 +7.2% +0.6%

INITIATING EVENT (%LOOP-WTHR)

MSIV CLOSURE (%TMSIV) 2.83E-08 2.94E-08 +4.0% +0.2%

SMALL LOCA (%S2) 2.74E-08 2.80E-08 +2.1% +0.1%

Risk Assessment Attachment 12 Page 107 LARGE LOCA (%A) 2.09E-08 6.92E-09 -66.9%(1) -3.1%

LOSS OF FEEDWATER (%TF) 1.79E-08 1.87E-08 +4.3% +0.2%

OTHER LOCA CONTRIBUTORS 1.06E-08 1.19E-08 +12.2% +0.3%

(%S1, %VMSL, %VFW)

ALL OTHER INITIATORS 5.91 E-08 6.61 E-08 +11.7% +1.5%

TOTAL: 4.58E-07 4.74E-07 [ N/A +3.5%

(1) Note that this reduction is due to the new success path that now exists with the alignment of the RHR cross-tie given a Large LOCA and containment isolation failure occurs.

Risk Assessment Attachment 12 Page 108 5.1.1 Startup Testing CCDPs An additional assessment was performed to calculate the conditional core damage probability (CCDP) and conditional large early release probability (CLERP) associated with startup tests that will simulate a Turbine Trip and an MSIV Closure event. This information is provided below in Table 5.1-4. It is obtained from the base case EPU analysis by dividing the CDF (or LERF) associated with each of the initiators by the initiating event frequency to obtain the conditional probabilities.

Table 5.1-4 Conditional Probabilities for PBAPS EPU Startup Testing Initiating Initiating Initiating Conditional Initiating Conditional Event Event Event Core Core Event Large Large Early Frequency Damage Damage Early Release Frequency Probabilities Release Probabilities (CDF) (CCDP) Frequency (CLERP)

(LERF)

Turbine Trip 0.754/yr 3.4E-7 4.4E-7 7.7E-8 1.OE-7 MSIV 0.075/yr 4.6E-7 6.1 E-6 2.9E-8 3.9E-7 Closure The calculated CCDPs are 4.4E-7 and 6.1E-6 for non-isolation (turbine trip) and isolation (MSIV closure), respectively. Also, the calculated CLERPs are 1.OE-7 and 3.9E-7 for the non-isolation (turbine trip) and isolation (MSIV closure), respectively. These CCDPs and CLERPs represent the additional probabilities of core damage and large early release, caused by performing the proposed tests (i.e., the initiating events occur). If both tests are performed, the total additional probabilities would thus be 6.5E-6 (CCDP) and 4.9E-7 (CLERP). Note the analyses do not credit compensatory measures that may reduce the risk of core damage given that extra operators may be staged for the proposed tests.

5.2 FIRE INDUCED RISK The fire impact calculation estimate is summarized in Section 4.3. It is estimated that the PBAPS fire PRA CDF would increase by approximately 2.5E-07 due to the EPU. This represents less than 1% of the calculated fire CDF which on a percentage basis is much less

Risk Assessment Attachment 12 Page 109 than that calculated for the internal events CDF. Given that the success criteria did not change in going from pre-EPU to EPU conditions, then it is reasonable to assume that the timing differences associated with EPU conditions would have a small impact on the risk from fire events. The small increase in CDF makes sense since the dominant fire scenarios are more related to the experienced equipment failures due to the fire initiating event rather than being related to the operator actions required to respond to the fire events. This is evident in the results summary table which shows that the majority of the dominant fire scenarios were not impacted by the changes to the HEP values for EPU conditions. Qualitatively, then, regardless of the actual total CDF that is calculated, it is concluded that the risk increase due to EPU on fire risk is negligible.

5.3 SEISMIC RISK Based on a review of the PBAPS IPEEE, the conclusions of the seismic margins assessment (SMA) will be unaffected by the EPU. The power uprate has little or no impact on the seismic qualifications of the systems, structures and components (SSCs). Specifically, the power uprate results in additional thermal energy stored in the RPV, but the additional blowdown loads on the RPV and containment given a coincident seismic event, will not alter the results of the SMA. Refer to Section 4.4 of this report for further discussion.

5.4 OTHER EXTERNAL HAZARDS Based on review of the PBAPS IPEEE, the power uprate has no significant impact on the plant risk profile associated with tornadoes, external floods, transportation accidents, and other external hazards. Refer to Section 4.5 of this report for further discussion.

5.5 SHUTDOWN RISK The impact of the Extended Power Uprate (EPU) on shutdown risk is similar to the impact on the at-power Level 1 PRA. Shutdown risk is affected by the increase in decay heat power. However, the lower power operating conditions during shutdown (e.g., lower decay heat level, lower RPV pressure) allow for additional margin for mitigation systems and operator actions. Based on a review of the potential impacts on initiating events, success criteria, and HRA, the EPU implementation will have a minor impact on shutdown risk. Refer to Section 4.6 and Appendix B

Risk Assessment Attachment 12 Page 110 of this report for further discussion which indicate that the EPU is assessed to have a non-significant impact (delta CDF of roughly one percent).

5.6 LEVEL 2 PRA The Level 2 PRA calculates the containment response under postulated severe accident conditions and provides an assessment of the containment adequacy. As described in Section 4.7, the change in the Level 2 is due primarily to changes in the Level 1 accident sequences propagated through to the Level 2 quantification. Therefore, the majority of the impact on LERF from EPU is related to the timing differences associated with EPU compared to CLTP conditions. These timing differences have been factored into the EPU risk assessment for LOOP recovery times as described in Section 4.1.3 and the HEP value changes as described in Section 4.1.6.

The end result for EPU is an estimated increase of the PBAPS at-power internal events LERF (see Table 5.7-1) from the base value of 4.58E-7/yr to 4.74E-7/yr, an increase of 1.6E-8 (3.5%).

As such, the EPU change in power represents a relatively small change to the key figure of merit for measuring containment adequacy, LERF.

Risk Assessment Attachment 12 Page 111 5.7 QUANTITATIVE BOUNDS ON RISK CHANGE 5.7.1 Sensitivity Studies As discussed in the previous sections, the best estimate change in the PBAPS risk profile due to the EPU is a 2.8% increase in CDF and a 3.5% increase in LERF. One of the methods to provide valuable input into the decision-making process is to perform sensitivity calculations for situations with different assumed conditions to bound the results.

These sensitivity studies investigated the impact on the at-power internal events CDF and LERF.

As the change in CDF and LERF is minor, only conservative sensitivity cases (i.e., those that will tend to increase the calculated risk increases) are analyzed here. Table 5.7-1 displays the calculated results with an explanation and description of each of the sensitivity cases performed.

The results of the sensitivity cases indicate that although increases in the calculated risk metrics could occur, they are not significant enough to change the conclusions of the risk assessment.

One additional evaluation was performed to address the potential for increased internal flood initiating event frequencies. This is not included in the set of sensitivity cases provided in Table 5.7-1 since the majority of the internal flood initiators are from systems that are not experiencing an increase in system flow (e.g., fire protection and service water). Therefore, the potential impact from the increased EPU flow rates is better represented and encompassed with the LOCA frequency changes identified in Sensitivity Case #3. In any event, to determine the potential impacts from an increase to the internal flood frequencies, it is noted that the total internal flood contribution to CDF is less than 7% and the total contribution to LERF is less than 2%. Therefore, even if all of the internal flood initiating event frequencies were to double (which is not credible given the flow rates for most of the flooding initiators are not changing), there would not be a significant change to the calculated risk metrics.

Risk Assessment Attachment 12 Page 112 Table 5.7-1 Results of PBAPS EPU PRA Sensitivity Cases Parameter CLTP EPU Case #1a Case #1b Case #2 Case #3 Case #4 Post-Initiator HEPs Base CLTP Calculated Calculated Calculated Calculated Calculated Calculated values using EPU using EPU using EPU using EPU using EPU using EPU SORV Probabilities Base CLTP Increased Increased Increased Increased Increased Increased values 13%(') 13% 13% 13% 13% 13%

Turbine Trip w/Bypass Base CLTP Base CLTP 0.904(2) Base CLTP Base CLTP Base CLTP 0.904

(%TTR, with units of value (0.754) value value value value 1 IAr' Loss of Feedwater Base CLTP Base CLTP Base CLTP 0.200(2) Base CLTP Base CLTP 0.200

(%TF, with units of value (0.050) value value value value 1 Aitr_

Loss of Condenser Base CLTP Base CLTP Base CLTP Base CLTP 0.289(2) Base CLTP 0.289 Vacuum Initiator value (0.139) value value value value LOCA Initiators Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Increased Increased

(%A, %S1, %S2, with values values values values values 2x(2) (1.04E- 2x I mnifr r-f /IIrl is gAnf- A I Anl=-_

FW/MSL Initiators Base CLTP Base CLTP Base CLTP Base CLTP Base CLTP Increased Increased

(%VFW, %VMSL, with values values values values values 2x(2) (3.54E- 2x units of l/yr) (1.77E-9, 9, 3.06E-8) 1.53E-8)

Core Damage 3.60E-06 3.70E-06 3.76E-06 4.28E-06 4.42E-06 4.20E-06 5.57E-06 r- .... ..... _ _r-I, .4 nr'- -7 / .- n n% /,

• n-r -x / . " -r- -7 I/ m C - 7 I mA

, ,4 -r- ^ I Large EEarly Release

• * ,, ,, I r--__-__,___

4.58E-07 4.74E-07 I J4 j~"

• ___

4.90E-07

.L r-- _

5.32E-07 I\.. O E \

5.35E-07 I______r- __

5.22E-07 I.LA O OQ -E 6.58E-07

.' '/*""

(1)The CDF and LERF contributions from the SORV probabilities are 2.1 E-9 and 9.9E-1 0, respectively.

(2) Refer to the Notes to Table 5.7-1 which follow.

Risk Assessment Attachment 12 Page 113 Table 5.7-2 summarizes the delta risk impact assessment results for the base case and for the sensitivity cases from several key categories. A discussion of each category is then provided.

Table 5.7-2 Summary of PBAPS EPU PRA Delta Risk From the Base Case and Sensitivity Cases Impact A CDF A LERF Comment Operator Reliability +1.OE-7 +1.6E-8 New Risk (Included in base case assessment)

Turbine Trip Initiator +6.OE-8 +1.6E-8 Sensitivity (Case #1a)

Loss of Feedwater +5.8E-7 +5.8E-8 Sensitivity (Case #1b)

Initiator Loss of Condenser +7.2E-7 +6.1 E-8 Sensitivity (Case #2)

Initiator SORV Probability <1.OE-8 <1.OE-9 New Risk (Included in base case assessment)

LOCA Initiators +5.OE-7 +4.8E-8 Sensitivity (Case #3)

Total New Risk 1.OE-7 1.6E-8 New Risk Total with 2.OE-6 2.OE-7 New Risk + Sensitivity Sensitivity (Case #4)

Operator Reliability The impact of increased decay heat and reduced time available for operator actions was evaluated. The impact on CDF and LERF associated with reduced times for these actions was calculated on a consistent basis as follows:

• The HEPs for EPU were estimated using the same technique as utilized for pre EPU (refer to Tables 4.1-2 and 4.1-3)

The differences between the CDF and LERF values for the pre-EPU and EPU configurations were calculated. The resulting changes in CDF and LERF are summarized in the above table.

Risk Assessment Attachment 12 Page 114 Turbine Trip Sensitivity Because of the various changes to the BOP side of the plant for EPU, the frequency of turbine trip could increase slightly. The initiating event frequency task for the PRA update will not increase the frequency of turbine trips based on EPU; however, the potential sensitivity of an increase was evaluated.

The revision to the turbine trip initiating event frequency (%TTR) uses an approach that assumes an additional turbine trip is experienced in the first year following start-up in the EPU condition and an additional 0.5 event in the second year. The change in the long-term average of the turbine trip initiating event frequency is calculated as follows for this sensitivity case:

0 Base long-term turbine trip frequency is 0.754/yr 0 10 years is used as the "long-term" data period

• End of 10 years does not reach the end-of-life portion of the bathtub curve

• Assuming 1.5 additional trips in the first and second years as described above, the revised Turbine Trip w/Bypass frequency for this sensitivity case is calculated as:

%TTR = (10 x 0.754) + 1.5 = 0.904/yr 10 All other parameters are maintained the same as the EPU base case.

Base Case EPU PRA Initiating Event (IE) IE CDF LERF Sensitivity Frequency E If it is assumed that %TTR increases by 20%, the change in CDF would be 3.35E- 7.73E- 6.OE-8, and the change in LERF would

%TTR - Turbine Trip 0.754/yr 7 8 be 1.6E-8, which represents only a few percent increase in risk when compared to the total pre EPU CDF and LERF values.

Loss of Feedwater Sensitivity Because feedwater margins are also affected by EPU, the frequency of a loss of feedwater initiator could increase slightly. The initiating event frequency task for the PRA update will not increase the frequency of loss of feedwater based on EPU; however, the potential sensitivity of an increase was evaluated.

Risk Assessment Attachment 12 Page 115 A similar assessment was performed assuming that the EPU changes would manifest into an increase to the loss of feedwater initiating event frequency (%TF).

• Base long-term loss of feedwater frequency is 0.050/yr

• 10 years is used as the "long-term" data period

• End of 10 years does not reach the end-of-life portion of the bathtub curve

• Assuming 1.5 additional loss of feedwater events in the first and second years, the revised Loss of Feedwater frequency for this sensitivity case is calculated as:

%TF = (10 x 0.050) + 1.5 = 0.200/yr 10 All other parameters are maintained the same as the EPU base case.

Base Case EPU PRA Initiating Event (IE) IE CDF LERF Sensitivity Frequency If it is assumed that %TF increases by 300% to 0.20/yr, the change in CDF would be 5.8E-7, and the change in

%TF - Loss of 0.05/yr 1.89E- 1.87E- LERF would be 5.8E-8. This represents Feedwater 7 8 an additional -16% increase in CDF risk and -13% increase in LERF risk when compared to the total pre EPU CDF and LERF values.

Loss of Condenser Sensitivity Because condenser margins are also affected by EPU, the frequency of a loss of condenser initiator could increase slightly. The initiating event frequency task for the PRA update will not increase the frequency of loss of condenser based on EPU; however, the potential sensitivity of an increase was evaluated by assuming that the EPU changes would manifest into an increase to the loss of condenser initiating event frequency.

• Base long-term loss of condenser frequency is 0.139/yr

• 10 years is used as the "long-term" data period

• End of 10 years does not reach the end-of-life portion of the bathtub curve

• Assuming 1.5 additional loss of condenser events in the first and second years, the revised loss of condenser initiating event frequency is calculated as:

%TCV = (10 x 0.139) + 1.0 + 0.5 = 0.289/yr 10 All other parameters are maintained the same as the EPU base case.

Risk Assessment Attachment 12 Page 116 Base Case EPU PRA Initiating Event (IE) IE CDF LERF Sensitivity Frequency If it is assumed that %TCV increases by 108% to 0.289/yr, the change in CDF would be 7.2E-7, and the

%TCV - Loss of 6.59E- 5.50E- change in LERF would be 6.1E-8.

Condenser 0.139/yr 8 This represents an additional -20%

increase in CDF risk and -13%

increase in LERF risk when compared to the total pre EPU CDF and LERF values.

Stuck Open SRV (SORV)

The SRV setpoints will not be changed as a result of the PBAPS EPU. Given the power increase of the EPU, however, one may postulate that the probability of a stuck open relief valve given a transient initiator would increase due to an increase in the number of SRV cycles.

In the base case risk assessment, the PBAPS PRA for EPU conditions was modified by increasing the stuck open relief valve probability by a factor equal to the increase in reactor power (i.e., a factor of 1.125 in the case of EPU). This approach assumes that the stuck open relief valve probability is linearly related to the number of SRV cycles, and that the number of cycles is linearly related to the reactor power. The results of this change which is included in the base case EPU assessment are shown below.

Event Base Case EPU PRA Probability CDF LERF That portion of the reported CDF SORV - Stuck Open and LERF values due to the SORV SRV probability increases by -13% is (APHSRVTMDXl2, 2.14E-3 2.1E-9 9-9E-10 only 2.3E-10 for CDF and 1.1E-10 APHSRVTTDXI2) 2.70E-4 for LERF. This represents a negligible increase in risk when compared to the total pre EPU CDF and LERF values.

Risk Assessment Attachment 12 Page 117 Loss of Coolant Accident (LOCA) Sensitivity Because of increased flow rates it is assumed that increased reactor energy could result in LOCA frequency increases. The initiating event frequency task for the PRA update will not increase the frequency of LOCAs based on EPU; however, the potential sensitivity of an increase was evaluated.

This sensitivity case conservatively doubles the LOCA initiator frequencies for the small, medium and large LOCA categories. The initiating event frequencies for feedwater high energy line breaks were also doubled due to increased flow in this system as a result of EPU.

Large LOCA: %A = 5.20E-5

• 2 = 1.04E-4/yr Medium LOCA: %S1 = 1.70E-3

• 2 = 3.40E-3/yr Small LOCA: %S2 = 8.49E-3

• 2 = 1.70E-2/yr FW Line Break: %VFW = 1.77E-9

• 2 = 3.54E-9/yr MS Line Break: %VMSL = 1.53E-8

• 2 = 3.06E-8/yr All other parameters are maintained the same as the EPU base case.

Risk Assessment Attachment 12 Page 118 Base Case EPU PRA Initiating Event (IE) IE CDF Sensitivity Frequency If it is assumed that the LOCA frequency increases by100%, the change in CDF would be 5.OE-7, and LOCA - Loss of the change in LERF would be 4.8E-LColat See above 4.93E-7 4.68E-8 8. This represents an additional Coolant -14% increase in CDF risk and

-10% increase in LERF risk when compared to the total pre EPU CDF and LERF values.

5.7.2 Results Summary The key result of the PBAPS EPU risk evaluation is the following:

Minor risk increases were calculated for both CDF and LERF. The risk increase is associated with reduced times available for certain operator actions and AC power recovery, and the assumed increase in the SORV probability.

The best estimate of the risk increase for at-power internal events due to the EPU is a delta CDF of 1.OE-7/yr (an increase of 2.8% over the base CDF of 3.6E-6/yr). The best estimate at-power internal events LERF increase due to the EPU is a delta LERF of 1.6E-8 (an increase of 3.5% over the base LERF of 4.6E-7/yr).

Using the NRC guidelines established in Regulatory Guide 1.174 and the calculated results from the Level 1 and 2 PRA, the best estimate for the PBAPS CDF risk increase due to the EPU (1.OE-7/yr) is in Region III (i.e., "very small" risk changes). The best estimate for the LERF increase (1.6E-8/yr) is also in the lower range of Region Ill. (See Figures 5.7-1 and 5.7-2.).

Additionally, based on the information available for external events impacts, it is estimated that the incorporation of these contributors would not change this conclusion.'

The quantitative sensitivity cases performed in this analysis also showed that the delta CDF and the delta LERF remain within or very close to the lower region of Region Ill except for the combined sensitivity case (#4) which pessimistically increased all of the initiator frequencies at once. Even in that case, the above increase in risk meets the acceptance guidelines described

Risk Assessment Attachment 12 Page 119 in Regulatory Guide 1.174, which states that an increase in CDF in the range of 1E-6 to 1E-5 will be considered when it can be reasonably shown that the total CDF is less than 1E-4. Similarly, an increase in LERF in the range of 1 E-7 to 1 E-6 will be considered when it can be reasonably shown that the total LERF is less than 1 E-5.

- -Region 11 1.0C-s .,

10.6 105 1 0-4 CDF 3 Figure 5.7-1 PBAPS EPU Risk Assessment CDF Result Versus RG 1.174 Acceptance Guidelines* for Core Damage Frequency (CDF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

Risk Assessment Attachment 12 Page 120

-J 1 0.6 10"15 io-7 10"6 10-5 LERF-0 Figure 5.7-2 PBAPS EPU Risk Assessment LERF Result Versus RG 1.174 Acceptance Guidelines* for (LERF)

• The analysis will be subject to increased technical review and management attention as indicated by the darkness of the shading of the figure. In the context of the integrated decision-making, the boundaries between regions should not be interpreted as being definitive; the numerical values associated with defining the regions in the figure are to be interpreted as indicative values only.

Risk Assessment Attachment 12 Page 121 A bounding assessment is provided to demonstrate that the total CDF is less than 1E-4 and the total LERF is less than 1E-5. As shown in Table 4.3-2, the CDF contribution due to internal fires in the unscreened fire areas is calculated at 4.4E-5/yr for Unit 2 EPU conditions. The fire PRA does not quantify the LERF risk measure, however, review of NUREG-1742 [24], indicates that the fire CDF for BWRs is primarily determined by plant transient type of events such that the LERF distribution from the fire CDF can be assumed to be similar to that from the internal events model.

The reported fire PRA CDF value is approximately a factor of 12 higher than the internal events CDF values. The fire CDF values are estimated to be very conservative given the methods employed in developing the fire PRA for Peach Bottom when compared to the best estimate CDF and LERF values obtained from the internal events models. Given this, it is reasonable to assume that the total impact from external events risk is bounded by assuming a factor of 12 on the internal events evaluation. With this conservative assumption, the bounding assessment for total CDF and total LERF is shown in Table 5.7-3.

Table 5.7-3 Bounding Estimate of Total CDF and Total LERF for EPU Description EPU CDF EPU LERF Internal Events Contribution - Bounding 5.6E-06 6.6E-07 Sensitivity Case External Events Contribution - Bounding <6.7E-05 <8.OE-06 factor of 12x internal Events Contribution Total:] <7.3E-05 <8.7E-06 As shown in Table 5.7-3, since the bounding total CDF is less than 1E-4 and the bounding total LERF is less than 1E-5, and the maximum quantified new risk in the pessimistic sensitivity case is less than 1 E-5 for CDF and less than 1 E-6 for LERF, the quantified impact of EPU is acceptable.

As the combined sensitivity case falls into Region II from RG 1.174 (i.e., for "small" risk changes), it is also worth noting that this pessimistic case is also very close'to still meeting the EPRI PSA Applications Guide "Non Risk Significant" criteria for permanent plant changes [23] (i.e., the 55%

and 44% increase demonstrated in Case 4 are close to the allowable limits of 53% for CDF and 47% for LERF, respectively, based on a base CDF of 3.6E-6 and a base LERF of 4.6E-7).

Risk Assessment Attachment 12 Page 122 Other sensitivity cases presented in Appendix A as part of the identification of potential key sources of model uncertainty also lead to the same conclusions. That is, the results of the model uncertainty sensitivity studies indicated that although some alternative assumptions could challenge the acceptance guidelines for "very small" changes in risk, there is no one issue that would result in exceeding the acceptance guidelines for "small" changes in risk. One notable sensitivity case is that with no credit for the RHR cross-tie to eliminate the need for containment overpressure, the EPU CDF increases to 3.72E-6 (compared to 3.70E-6 for the base case EPU estimate) and the LERF increases to 4.94E-7 (compared to 4.74E-7 for the base case EPU estimate). These increases represent a fairly negligible change compared to the base case best estimate results.

The PBAPS EPU is assessed to result in a small impact on the plant risk profile and thus is acceptable from a risk evaluation perspective.

Risk Assessment Attachment 12 Page 123 Section 6 REFERENCES

[1] Boiling Water Reactors Owners' Group, BWROG PSA Peer Review Certification Implementation Guidelines, Revision 3, January 1997.

[2] American Society of Mechanical Engineers, Standard for ProbabilisticRisk Assessment for Nuclear Power Plant Applications, ASME RA-S-2002, New York, New York, April 2002.

[3] U.S. Nuclear Regulatory Commission, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Draft Regulatory Guide DG-1 122, November 2002.

[4] Peach Bottom MSPI Basis Document, Rev. 2, March 27, 2007.

[5] ASME/American Nuclear Society, Standard for Level 1/Large Early Release Frequency ProbabilisticRisk Assessment for Nuclear Power Plant Applications, ASME/ANS RA-Sa-2009, March 2009.

[6] Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of ProbabilisticRisk Assessment Results for Risk Informed Activities, Revision 2, March 2009.

[7] NRC Generic Letter 88-20, Individual Plant Examination of External Events (IPEEE)for Severe Accident Vulnerabilities- 10 CFR 50.54(o, Supplement 4, June 28, 1991.

[8] PECO Energy Co., Peach Bottom Atomic Power Station, Units 2 and 3, Individual Plant Examination for External Events, Main Report, May 1996.

[9] Professional Loss Control, Inc., Fire-InducedVulnerability Evaluation (FIVE)

Methodology Plant Screening Guide, EPRI TR-1 00370, Electric Power Research Institute, Final Report, April 1992.

[10] NTS Engineering, et. al., A Method for Assessment of Nuclear Power Plant Seismic Margin, EPRI NP-6041, Electric Power Research Institute, Final Report, August 1991.

[11] W.J. Parkinson, et. al., Fire PRA Implementation Guide, EPRI TR-105928, Electric Power Research Institute, December 1995.

[12] NSAC/179L, Electric Power Research Institute, Fire Events Databasefor U.S. Nuclear Power Plants,Rev. 1, January, 1993.

[13] EPRI/N RC-RES, Fire PRA Methodology for Nuclear Power Facilities,EPRI 1011989, NUREG/CR-6850, Final Report, September 2005.

[14] Letter from Bartholomew C. Buckley (USNRC) to James A. Hutton (PECO Energy Company), Review of Peach Bottom Atomic Power Station, Units 2 and 3, Individual Plant Examination of External Events Submittal (TAC Nos. M83657 and MA83658),

November 22, 1999 (Docket Nos. 50-277 and 50-278).

Risk Assessment Attachment 12 Page 124

[15] EPU Modification List for PBAPS, Attachment A to "Design Input Request T1006, EPU Risk Assessment", EPU-DIR-T1006-0, April 9, 2012.

[16] General Electric, Generic Evaluations for General Electric Boiling Water Reactor Extended Power Uprate, NEDC-32523P-A, February 2000.

[17] Philadelphia Electric Company, Individual Plant Examination, Peach Bottom Atomic Power Station, Units 2. and 3, 1992.

[18] General Electric, Licensing Topical Report, Constant PressurePower Uprate, NEDC-33004P-A, Revision 4, Class III, July 2003.

[19] Exelon Risk Management Team, Peach Bottom Application Specific Model for EPU, PB-ASM-001, June 2011.

[20] Sandia National Laboratories, Analysis of Core Damage Frequency: Peach Bottom Unit 2 ExternalEvents, NUREG/CR-4550, Vol. 4, Rev. 1, Part 3, December 1990.

[21] Philadelphia Electric Company, Limerick Generating Station Severe Accident Risk Assessment, April 1983.

[22] Henry, R.E. et. Al., MAAP4 Modular Accident Analysis Program for LWR Power Plants, Computer Code User's Manual, Volumes 1-4, EPRI Project RP3131-02, May 1994 -

January 2003.

[23] Electric Power Research Institute, PSA Applications Guide, EPRI TR-105396, Final Report, August 1995.

[24] U.S. Nuclear Regulatory Commission, Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program, NUREG-1 742, Vol. 2, April 2002.

[25] Parry, G. W., An Approach to the Analysis of Operator Actions in Probabilistic Risk Assessment, EPRI TR-100259, June 1992.

[261 Swain, A.D., Accident Sequence Evaluation Program Human Reliability Analysis Procedure, NUREG/CR-4772, SAND86-1996, February 1987.

[27] Swain, A.D., Guttmann, H.E., Handbook of Human Reliability Analysis with Emphasis on Nuclear PowerPlant Applications, NUREG/CR-1 278, August 1983.

[28] Kolaczkowski, A. M., et al., Analysis of Core Damage Frequency: Peach Bottom Unit 2 Internal Events, NUREG/CR-4550, Vol. 4, Rev. 1, Part 1, August 1989.

[29] PIMS Action Request No. Al 033832, Evaluation No. 2, 31 December 2000.

Risk Assessment Attachment 12 Page 125 Appendix A PRA Technical Adequacy A.1 Overview The guidance provided in Regulatory Guide 1.200, Revision 2 [6], "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" is used for the EPU risk assessment. The guidance in RG-1.200 indicates that the following steps should be followed when performing PRA assessments:

1. Identify the parts of the PRA used to support the application

- SSCs, operational characteristics affected by the application and how these are implemented in the PRA model

- A definition of the acceptance criteria used for the application

2. Identify the scope of risk contributors addressed by the PRA model

- If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

3. Summarize the risk assessment methodology used to assess the risk of the application

- Include how the PRA model was modified to appropriately model the risk impact of the change request.

4. Demonstrate the Technical Adequacy of the PRA

- Identify plant changes (design or operational practices) that have been incorporated at the site, but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

- Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide. Provide justification to show that where specific requirements in the standard are not adequately met, it will not unduly impact the results.

- Document peer review findings and observations that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

- Identify key assumptions and approximations relevant to the results used in the decision-making process.

Items 1 through 3 were incorporated into the main body of this report. The purpose of the remaining portion of this appendix is to provide a PRA model evolution summary and to address the requirements identified in Item 4 above

Risk Assessment Attachment 12 Page 126 A.2 PRA Model Evolution and Review Summary The 2009A versions of the PBAPS PRA models are the most recent evaluations of the Unit 2 and Unit 3 risk profile at PBAPS for internal event challenges. The PBAPS PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the PBAPS PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

Exelon Generation Company, LLC (Exelon) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating Exelon nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the PBAPS PRA.

PRA Maintenance and Update The Exelon risk management process ensures that the applicable PRA model is an accurate reflection of the as-built and as-operated plants. This process is defined in the Exelon Risk Management program, which consists of a governing procedure and subordinate implementation procedures. The PRA model update procedure delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating Exelon nuclear generation sites. The overall Exelon Risk Management program defines the process for implementing regularly scheduled and interim PRA model updates, for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, industry operating experience, etc.),

and for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed:

• Design changes and procedure changes are reviewed for their impact on the PRA model.

" New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

• Maintenance unavailabilities are captured, and their impact on CDF is trended.

• Plant specific initiating event frequencies, failure rates, and maintenance unavailabilities are updated approximately every four years.

Risk Assessment Attachment 12 Page 127 In addition to these activities, Exelon risk management procedures provide the guidance for particular risk management maintenance activities. This guidance includes:

& Documentation of the PRA model, PRA products, and bases documents.

0 The approach for controlling electronic storage of Risk Management (RM) products including PRA update information, PRA models, and PRA applications.

• Guidelines for updating the full power, internal events PRA models for Exelon nuclear generation sites.

• Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10 CFR 50.65(a)(4)).

In accordance with this guidance, regularly scheduled PRA model updates nominally occur on an approximately 4-year cycle; longer intervals may be justified if it can be shown that the PRA continues to adequately represent the as-built, as-operated plant. The 2009A models were completed in July of 2010.

As indicated previously, RG 1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated in to the PRA model, relevant peer review findings, and consistency with applicable PRA Standards) will be discussed in turn in this section. An uncertainty analysis including the identification of key assumptions is provided in Section A.3.

A.2.1 Plant Changes Not Yet Incorporated into the PRA Model A PRA updating requirements evaluation (URE- Exelon PRA model update tracking database) is created for all issues that are identified that could impact the PRA model. The URE database includes the identification of those plant changes that could impact the PRA model.

A review of the open UREs indicates that there are no plant changes that have not yet been incorporated into the PRA model that would affect this application. However, it is noted that the proposed changes for EPU have been fully implemented into the risk assessment as described in the main body of this report.

Risk Assessment Attachment 12 Page 128 A.2.2 Consistency with Applicable PRA Standards Several assessments of technical capability have been made for the PBAPS internal events PRA models. These assessments are as follows and further discussed in the paragraphs below.

• An independent PRA peer review was conducted under the auspices of the BWR Owners Group in 1998, following the Industry PRA Peer Review process [1]. This peer review included an assessment of the PRA model maintenance and update process.

• In 2004, a gap analysis was performed to assess gaps between the peer review scope/detail of the Industry PRA Peer Review results relative to the available version of the ASME PRA Standard [2] and the draft version of Regulatory Guide 1.200, DG-1122

[3]. In 2006, an assessment of the extent to which the previously defined gaps had been addressed was performed in conjunction with a PRA model update.

• During 2005 and 2006 the PBAPS, Units 2 and 3, PRA model results were evaluated in the BWR Owners Group PRA cross-comparisons study performed in support of implementation of the mitigating systems performance indicator (MSPI) process [4].

" After the completion of the most recent PRA update, an industry peer review in accordance with the combined ASME/ANS PRA Standard [5] and Regulatory Guide 1.200, Revision 2 [6] was performed in November 2010. The results of that assessment are used as the basis for the capability assessment provided in Tables A-1 and A-2.

A summary of the disposition of the 1998 Industry PRA Peer Review facts and observations (F&Os) for the PBAPS, Units 2 and 3, PRA models was documented as part of the statement of PRA capability for MSPI in the PBAPS MSPI Basis Document [4]. As noted in that document, there were no significance level A F&Os from the peer review, and all significance level B F&Os were addressed and closed out with the completion of the current PB205C and PB305C models of record. Also noted in that submittal was the fact that, after allowing for plant-specific features, there are no MSPI cross-comparison outliers for PBAPS (refer to the third bulleted item above).

A Gap Analysis for the 2002 PBAPS, Units 2 and 3, PRA models (PB202 and PB302, respectively) was completed in January 2004. This Gap Analysis was performed against PRA Standard RA-S-2002 [2] and associated NRC comments in draft regulatory guide DG-1 122 [3], the draft version of Regulatory Guide 1.200 Revision 0. This gap analysis defined a list of 83 supporting requirements from the Standard for which potential gaps to Capability Category II of the Standard were identified.

For each such potential gap, a PRA URE was documented for resolution.

Risk Assessment Attachment 12 Page 129 A PRA model update was completed in 2006, resulting in the PB205C and PB305C updated models. In updating the PRA, changes were made to the PRA to address most of the identified gaps, as well as to address other open UREs. Following the update, an assessment of the status of the gap analysis relative to the new model and the updated requirements in Addendum A of the ASME PRA Standard concluded that 59 of the gaps were fully resolved (i.e., are no longer gaps),

and another seven were partially resolved.

As indicated above, a PRA model update was completed in 2010, resulting in the PB209A and PB309A updated models. This model was subject to a peer review in November 2010 [A-3]. In general, the peer review results supported the high quality of the PRA model as approximately 95% of all the supporting requirements were characterized as meeting Capability Category II or better. Those supporting requirements that were assessed as not meeting Capability Category II are described in Table A-1 with their impact on this application noted.

Risk Assessment Attachment 12 Page 130 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY IIFROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS I IMPORTANCE TO NO. SRs COMMENT APPLICATION 2-2 Section 2.4 documented a number of IE-A5 Assessed as meeting Not significant as the special initiators based on comparisons Capability Category I. PBAPS PRA model includes or review. However, it's not evident that a a full range of special structured approach has been performed. initiators which are consistent with many BWRs (e.g. loss of SW, loss of IA, loss of RBCCW, loss of TBCCW, loss of individual 4kV ac buses, and loss of individual 125V dc buses).

These are sufficient to determine the EPU impacts.

6-2 The Initiating Event NB PB-PRA-001, IE-B3 Assessed as meeting Not significant as the Rev.2 addresses grouping in Section 2.5 Capability Category I. PBAPS PRA model includes and summarizes the events in Table 2.6- a full range of initiating

2. Many events have been subsumed into events which are other events as discussed in Section 2.5. comparable with many The subsuming is based on simple BWRs. These are sufficient statements rather than a discussion of to determine the EPU event progression, success criteria, impacts.

timing and operator action. Certain items are not even discussed, but summarized in Table 2.6-2. For example, there is no discussion of Turbine Trip without Bypass, or Pressure Regulator Fails Open.or Pressure Regulator Fails Closed (except for some foot notes).

Risk Assessment Attachment 12 Page 131 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY II FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS / IMPORTANCE TO NO. SRs COMMENT APPLICATION 2-5 ISLOCA was analyzed and documented IE-C14 Assessed as not met. The Not significant given that the in the IE notebook, but it was based on ISLOCA update has not yet current approach is IPE and no particular consideration of been performed. However, reasonably conservative, protective interlocks, relevant surveillance the current ISLOCA values and ISLOCA scenarios test, check valve, etc. The newer failure are conservative compared would be very minimally data from NUREG/CR-6928 could be to other sites that have impacted by EPU.

considered. In addition, the RHR utilized the more detailed shutdown cooling discharge line appears methodology.

missing in the analysis.

6-5 The SR calls for Peach Bottom's success SC-B5 Assessed as not met. Not significant given that the criteria to be compared with those for Although a formally current success criteria have other similar plants. documented comparison has been validated based on There is no evidence such a comparison not been performed, in plant-specific MAAP runs or was performed. practice this type of other comparable generic comparison is done as the sources.

results of the model are analyzed and reviewed.

3-1 Alignment pre-initiators are included for HR-Al Assessed as not met. Not significant given that some risk significant systems (i.e., HPCI, several pre-initiators are RCIC, LPCS, and SLC), but these were included in the model, and in not included as a result of a review of any event, the pre-initiators procedures and practices. Refer to would not be impacted by Sections 2.3.3, 4.3, 5.1, and Appendix B EPU.

of the HRA Notebook (PB-PRA-004).

Risk Assessment Attachment 12 Page 132 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY II FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS IIMPORTANCE TO NO. SRs COMMENT APPLICATION 3-3 As described in Sections 2.3.3, 4.3, HR-A3 Assessed as not met. Not significant given that 5.1,and Appendix B of the HRA Notebook several pre-initiators are (PB-PRA-004), the process for the included in the model, and in identification of misalignment of modeled any event, the pre-initiators equipment does not address common would not be impacted by misalignment. EPU.

3-4 The process described in the HRA HR-B1 Assessed as not met. Not significant given that Notebook (PB-PRA-004) does not several pre-initiators are establish any rules for screening included in the model, and in individual activities. Some System any event, the pre-initiators Notebooks (PB-PRA-005) (e.g., HPCI, would not be impacted by RCIC, LPCS, SLC) include pre-initiators EPU.

and identify appropriate screening rules in Section 6.1.5 but do not identify activities which might have been screened.

Risk Assessment Attachment 12 Page 133 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY IIFROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS /IMPORTANCE TO NO. SRs COMMENT APPLICATION 5-8 Table 5.1-4 of the HRA Notebook (PB- HR-D2 Assessed as meeting Not significant given that PRA-004) includes a number of pre- Capability Category I. Not several pre-initiators are initiators types (e.g., flow, delta- all significant pre-initiators included in the model, and in temperature, steam leak) that are not were evaluated with an any event, the pre-initiators documented in Table 5.1-2 or Appendix individual detailed HEP would not be impacted by B. analysis. Rather, the event EPU.

was assigned a 'type' based on the transmitter it is associated with, and the types were assigned an HEP value based on the limited set of detailed pre-initiator evaluations that were performed as described in Appendix B of the HRA notebook (PB-PRA-004).

1-4 No evidence was found for using plant- DA-C8 Assessed as meeting Not significant given that the specific operational records to determine Capability Category I. The estimates utilized are the time that components were standby status times are sufficient for determining the configured in their standby status. estimated based on the EPU impacts.

anticipated equipment rotation moving forward.

This provides an appropriate level of accuracy for the model.

Risk Assessment Attachment 12 Page 134 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY II FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS I IMPORTANCE TO NO. SRs COMMENT APPLICATION 6-11 The data from the maintenance Rule is DA-C 11 Assessed as not met. This Not significant given that the used directly without checking to see if it level of refinement would unavailability values utilized includes only those maintenance or test have a very small impact on are sufficient for determining activities that could leave the component, the actual unavailability the EPU impacts.

train, or system unable to perform its values utilized in the model.

function when demanded as required by the SR.

6-9 Inter-system unavailability, (e.g., DA-C14 Assessed as not met. RHR, Not significant given that the HPCI/RCIC systems) data was not HPSW, and CS loop coincident unavailability evaluated and a value of 1.OE-5 was maintenance terms included values utilized are sufficient arbitrarily assigned. for intra-system for determining the EPU unavailability terms. impacts.

However, the SR is not met for inter-system unavailability terms as the model includes coincident outage times for a few pertinent combinations (e.g.

HPCI/RCIC, RHR Loops),

but since no known overlap existed for these combinations, an arbitrarily small value (1.0E-5) was assigned.

Risk Assessment Attachment 12 Page 135 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY II FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS I IMPORTANCE TO NO. SRs COMMENT APPLICATION 4-5 Per PB-PRA-015 RO "L2 PRA Analysis LE-D4 Assessed as meeting Not significant given that the Notebook", ISLOCA is classified as Class Capability Category I. current approach is V "Unisolated LOCA outside reasonably conservative, containment" per Table 4.3-2 of PB-PRA- and ISLOCA scenarios 015 RO "L2 PRA Analysis Notebook" would be very minimally detailed assessment and frequency impacted by EPU.

analysis of the ISLOCA was not performed, but rather a simplified approach for determining the ISLOCA frequencies as discussed in section 3.3.3 of PB-PRA-001 R2 "Initiating Events Notebook".

2-14 No documentation is identified for model IFPP-B3 Assessed as not met. The None.

uncertainty associated with the plant sources of model uncertainty partitioning. and related assumptions are documented based on the guidance provided in EPRI 1016737 (as endorsed in NUREG-1855). This assessment did address the items to consider per the EPRI guidance which did not include any specific items related to the IFPP plant partitioning category. This indicates that there are no sources of model uncertainty for the IFPP category that need to be considered.

Risk Assessment Attachment 12 Page 136 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY II FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLEl CURRENT STATUS / IMPORTANCE TO NO. SRs COMMENT APPLICATION 3-19 Plant-specific experience was gathered IFEV-A6 Assessed as meeting None.

as shown in Appendix H of the Internal Capability Category I. It is Flood Evaluation Summary Notebook clear that the available pipe (PB-PRA- 012). However, only generic failure data is extremely flood frequencies were used. sparse and the associated uncertainties are quite large. There is essentially no PBAPS specific evidence of internal flooding of the size comparable to that used in the EPRI analysis. As such, any Bayesian update of the generic data would not improve this already sparse data set. Specifically, it is further postulated that it is inappropriate to introduce the false rigor of the Bayesian update process given the unknowns introduced by the failure mechanisms, the generic uncertainty distribution size, and the age related effects.

In other words, the past PBAPS specific evidence i.e., past 35+ years of operation is not necessarily characteristic of future performance of the piping systems. This exercise of judgment in the use of relevant data is allowed by the Bayesian update process.

Risk Assessment Attachment 12 Page 137 TABLE A-1 STATUS OF GAPS TO CAPABILITY CATEGORY II FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS / IMPORTANCE TO NO. SRs COMMENT APPLICATION 1-7 Note: This SR is modified by the notes in IFSN-A6 Assessed as meeting Not significant given that the the RG 1.200. Following those notes, this Capability Category I. This overall impact would be SR can only be judged to be met at CC I. additional level of refinement minimal and therefore would No assessment was done relating to would have minimal impact be very minimally impacted factors such as pipe whip, humidity, on the internal flooding by EPU.

condensation, etc., as required by the RG analysis results.

1.200 notes.

6-15 Inter-area propagation has been IFSN-A8 Assessed as meeting Not significant given that the addressed in the scenario development. Capability Category I. This overall impact would be However, flow path via drain lines, and additional level of refinement minimal and therefore would areas connected via backflow through would have minimal impact be very minimally impacted drain lines involving failed check valves, on the internal flooding by EPU.

pipe and cable penetrations (including analysis results.

cable trays) do not appear to be addressed.

Risk Assessment Attachment 12 Page 138 A.2.3 Applicability of Peer Review Findings and Observations The remaining set of findings from the recent 2010 peer review related to the current ANS/ASME PRA Standard for internal events and internal flood associated with supporting requirements that are otherwise met at Capability Category II are described in Table A-2 with their impact on this application noted.

A.2.4 PRA Quality Summary Based on the above, the PBAPS PRA is of sufficient quality and scope for this application. The modeling is detailed; including a comprehensive set of initiating events (transients, LOCAs, and support system failures) including internal flood, system modeling, human reliability analysis and common cause evaluations.

Risk Assessment Attachment 12 Page 139 TABLE A-2 STATUS OF OPEN FINDINGS FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS I IMPORTANCE TO NO. SRs COMMENT APPLICATION 3-6 No evidence was found that plant testing HR-C2 Open - However, the failure None.

procedures were used to define pre- QU-D6 modes identified in the SR initiator activities that would cause are already included in the system unavailability or plant trips, generic or plant-specific data utilized for each system, component, and initiating event modeled.

3-13 Random checks in Appendices B and H DA-D5 Closed -A separate check None.

in the Component Data Notebook (PB- was performed on all of the PRA-004, Volume 2) showed that in CCF values utilized in the some cases the CCF applied was not model. The few directly applied in the associated file. discrepancies were corrected in the models used for this assessment.

Risk Assessment Attachment 12 Page 140 TABLE A-2 STATUS OF OPEN FINDINGS FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS ! IMPORTANCE TO NO. SRs COMMENT APPLICATION 3-14 No confirmation that experience from the DA-D6 Assessed as meeting None.

plant was used to confirm the applicability Capability Category I. It is of the generic CCF alpha factors to the agreed that specific plant specific conditions. documentation related to the applicability of the use of generic alpha factors was not provided. However, a review of the plant-specific failures listed in Table B-3 of the Component Data Notebook (PB-PRA-004, Volume 1) indicates that there is no evidence of significant common cause failure activity at PBAPS that would render the use of the generic alpha factors questionable.

4-4 Section 3.5.5 of PB-PRA-001, Revision 2 HR-G1 Open - Detailed analysis not Not significant given that the estimates value for recovery from 'loss of yet performed. A current recovery value DC bus' BUT without the detailed conservative recovery value utilized of 0.5 is conservative analysis. of 0.5 is applied in model. and the loss of DC bus initiators were not significant contributors to the delta risk assessment.

Risk Assessment Attachment 12 Page 141 TABLE A-2 STATUS OF OPEN FINDINGS FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE] CURRENT STATUS / IMPORTANCE TO NO. SRs COMMENT APPLICATION 5-9 Of the four systems (i.e., RPS, ARI, RPT SY-Al Open - Further refinement Not significant given that the and SLC) identified in Table 2.3-2 of the SY-A7 could be employed for these current treatment is Event Tree Notebook (PB-PRA-002) as systems but is not required adequate for the needed to support the reactivity control for every application of the determination of the EPU function only SLC has a System model. impacts.

Notebook (PB-PRA-005).

Except for SLC, modeling for these systems is primarily point estimates in the Data Notebook (PB-PRA- 010).

Without more developed system modeling, system interactions may not be evident. (ARI typically uses RPT for an initiation signal and requires DC power for actuation of air pilot valves.) The inclusion of operator actions (e.g., scram the reactor, trip the recirculation pumps, or initiate ARI) may provide more realistic risk. Some BWRs have associated spurious operation of the reactor mode switch with a failure to scram.

Risk Assessment Attachment 12 Page 142 TABLE A-2 STATUS OF OPEN FINDINGS FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLEI CURRENT STATUS/ IIMPORTANCE TO NO. SRs COMMENT APPLICATION 6-3 There is adequate documentation to meet IE-D2 Open - These comments None.

the SR. The treatment of four categories are either documentation of LOOP is an improvement. However, issues or reference issues there is room for further improvement: that addressed by other

1. See F&O written in response to IE-B3 findings.

to improve documentation.

2. There are a lot of pages written up to calculate the frequency of Large LOCA, but it does not look like the value is used in the PRA. The documentation can be simplified by just referring to the value used and eliminating the text relating to the unused value.

3. The steam LOCA and liquid LOCA seem be getting lumped together. It is not clear if these LOCAs are treated in the same manner (i.e., using the same success criteria).

4. The ISLOCA analysis has not been updated from the IPE days.

5. It might be useful to document why certain events such as the following are excluded from the PRA: Multiple IORV, Multiple SORV, Stuck-open safety valve.

Risk Assessment Attachment 12 Page 143 TABLE A-2 STATUS OF OPEN FINDINGS FROM THE 2010 PEER REVIEW FINDING DESCRIPTION OF FINDING APPLICABLE CURRENT STATUS I IMPORTANCE TO NO. SRs COMMENT APPLICATION 6-14 Plant walkdown was conducted to identify IFPP-A4 Open - This finding relates None.

flood sources. No specific walkdown was IFSO-A6 to providing additional detail conducted to identify the SSCs in the in the walkdown sheets flood areas or the pathways. These were IFSNA17 which would enhance the identified through drawings, and verified fidelity of the model by mini-walkdowns at the discretion of the documentation. However, it PRA analysts. The walkdown is not expected to change documentation is very sketchy. A lot more the results of the internal information needs to be collected during flood analysis.

walkdown to help flood scenario development. The location of drains, curbs, doors, sills need to be identified.

The paths through stairwells need to be identified. The flood pathways developed in the flood scenarios need to be verified by walkdown.

Risk Assessment Attachment 12 Page 144 A.3 Uncertainty Analysis RG-1.174 [A-1] identifies three high level types of uncertainties - parameter, model, and completeness uncertainty. These are each discussed in the context of the EPU risk assessment in the sections which follow.

A.3.1 Parameter Uncertainty The cutset results for the different CDF assessments were reviewed to determine if the epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributor cutsets do not involve basic events with epistemic correlations (i.e. the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b from EPRI 1016737 [A-2], then it is acceptable to use the point estimate directly in the risk assessment.

To verify that the use of the point estimate is acceptable in these four cases, a detailed Monte Carlo calculation using EPRI R&R workstation UNCERT software was performed to compare the mean value determined from the Monte Carlo simulation as compared to the point estimate. The parametric uncertainty assessment directly takes into account the state-of-knowledge correlations since .the basic event database for Peach Bottom is fully populated with the appropriate correlations and corresponding uncertainty parameters. The uncertainty in the HEP estimates was characterized via the application of error factors based on the following HEP ranges. These error factor (EF) assignments are consistent with those determined by the EPRI HRA Calculator using the same cognitive and execution quantification methods.

• HEP < 0.001, assigned EF = 10

" HEP between 0.001 and 0.1, assigned EF = 5

• HEP > 0.1, assigned EF = 1 The results of the parametric uncertainty assessments are provided in Table A-3 below. Figures displaying the probability density function for all of the cases appear after the table. Based on the minimal difference in the comparison of the mean value with the point estimate values provided, the use of the CDF point estimate for this assessment is deemed acceptable.

Note that a similar assessment was performed for the LERF figure of merit and the trend was similar. That is, the parametric mean values were very close to the point estimate mean values.

Risk Assessment Attachment 12 Page 145 The results of those assessments are also provided in Table A-3 below. Again, figures displaying the probability density function for all of the cases appear after the table. Based on the minimal difference in the comparison of the mean value with the point estimate values provided, the use of the LERF point estimate for this assessment is deemed acceptable.

Table A-3 PARAMETRIC UNCERTAINTY EVALUATIONS AND COMPARISON TO POINT ESTIMATE RESULTS Result CDF LERF Pre-EPU EPU Pre-EPU EPU Propagated Mean Values(1)

CDF(1) or LERF(1) 3.63E-06/yr 3.73E-06/yr 4.60E-07/yr 4.78E-07/yr Point Estimate Mean Values(2)

CDF(2) or LERF(2) 3.60E-06/yr 3.70E-06/yr 4.58E-07/yr 4.74E-07/yr (1) Developed based on the parametric mean value for each case from a Monte Carlo simulation with 25,000 samples.

(2) Developed based on the point estimate value for each case.

Risk Assessment Attachment 12 Page 146 5,-[ 1.5 -06 50% 312E06 m.,

• : 7.1 E.06 I75000 20 7.E-6 81-6 115 ZE5 3E-5 40E-5 Rý / Pmabl 75.E-5D Me*n-o : 373E-00 500% 3210E.

Z0-5 33-5 4t 5 US- G0-5 715- 1.E-4 F15 v / P.di50y Figure A-1 Pre-EPU and EPU CDF Cases

Risk Assessment Attachment 12 Page 147

~5ZI NEI L ýý-97 cM-7E7I

_i1 11-7 2E aE.7 4E7 6E.7 ' ES ZES 3E-6 4E-6 5E-6 &E- 1 i-5

]ý iR&~

5E-8 6.E-8 ZE7, E.l 44El 7 5t.7 G.E-7 1.E-S 2-S6 3ES4 ES SE6 E 11E-5 FrEq /ProbbkOry Figure A-2 Pre-EPU and EPU LERF Cases

Risk Assessment Attachment 12 Page 148 A.3.2 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737 ,[B-2] and in NUREG-1885 [B-3] and considers the following:

1. Characterize the manner in which the PRA model is used in the application

2. Characterize modifications to the PRA model

3. Identify application-specific contributors

4. Assess sources of model uncertainty in the context of important contributors

a. Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty

b. Screen based on relevance to parts of PRA needed or based on relevance to the results

5. Identify sources of model uncertainty and related assumptions relevant to the application

a. This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results A.3.2.1 Characterize the Manner in which the PRA Model is Used in the Application The manner in which the PRA model is used in this application is fully described in the main body of this report and will not be reproduced here.

A.3.2.2 Characterize Modifications to the PRA Model There were a few changes made to the model as described in Section 4 of this report. These are summarized below. Additional details are also provided in the application specific model documentation [19].

• The RHR cross-tie mod has been included in the system logic model as described in Section 4.1.2.3.

• The SRV stuck open probabilities have been increased as described in Section 4.1.2.6.

" The LOOP non-recovery probabilities have been adjusted to account for less time available for EPU conditions as described in Section 4.1.3.

• The incorporation of the CST standpipe has been included in the system logic model as described in Section 4.1.4.

Risk Assessment Attachment 12 Page 149 The human reliability analysis has been completely updated based on EPU conditions as described in Section 4.1.6. Table 4.1-2 provides the complete set of independent human error probability values for both pre EPU and EPU conditions. Table 4.1-3 provides the complete set of dependent human error probability values for both pre EPU and EPU conditions.

A.3.2.3 Identify Application-Specific Contributors Based on the detailed review of the results, the following items are the important contributors to the change compared to the base case results:

" Various independent operator actions - refer to Table 4.1-2

" Various dependent operator actions - refer to Table 4.1-3

" Large LOCA initiating event frequency

" SORV failure probability

" Probability that lack of containment overpressure leads to failure of ECCS from the suppression pool

" Containment isolation failure probability

• Human error probability for implementation of the RHR cross-tie (or effectiveness of RHR cross-tie)

A.3.2.4 Assess Sources of Model Uncertainty in Context of Important Contributors A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1016737 for Peach Bottom was then performed to determine which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application.

Based on this review, some of the items were already identified and many of the items were easily screened, but the following items were added for investigation since they were evaluated to be potentially applicable for this application.

• LOOP frequency and fail to recover probabilities

• The assumption that an RPV Overpressure Protection failure event results in an event equivalent to a Large LOCA

" Common cause failure values Based on the identified important contributors as summarized in Section A.3.2.3 and the addition of applicable base PRA model sources of uncertainty identified in Section A.3.2.4, the next step

Risk Assessment Attachment 12 Page 150 is to perform a qualitative assessment or semi-quantitative screening assessment to determine if sources of uncertainty have been utilized in the PRA that affects the important contributors for the application. Since the EPU risk assessment does not readily lend itself to a quantitative screening assessment, a qualitative assessment is then provided for each of the previously identified important contributors or potential sources of uncertainty.

The. results of this assessment are shown in Table A-4.

Table A-4 Identification of Potential Key Sources Uncertainty Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Various Yes Yes The credited actions are Yes - include independent procedurally directed with the as part of and dependent calculated HEP values derived HEP operator from an accepted methodology development actions that has been peer reviewed to as a class the ASME/ANS PRA standard.

Although variations to the HEP values may lead to changes in the risk assessment results, only very bounding assumptions regarding the appropriate HEP values for these individual actions would lead to exceeding the risk metric acceptance guidelines. In any event, the independent and dependent post-initiator HEPs are identified as potential key sources of uncertainty for this application as part of the HEP development as a global source of uncertainty.

Risk Assessment Attachment 12 Page 151 Table A-4 Identification of Potential Key Sources Uncertainty Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Large LOCA No Yes The large LOCA initiating event Yes initiating event frequency for PBAPS is based frequency on NRC estimated values.

However, the large LOCA frequency is still higher than that reported in even more recent studies (e.g. NUREG-6928). In any event, Section 5.7 includes a separate sensitivity study for the LOCA frequencies, not due to the uncertainty in the frequency, but to account for the potential EPU impacts on piping failure mechanisms.

SORV failure No Yes The SORV failure contribution is No probability just 2.1E-9 for CDF and 9.9E-10 for LERF. The probability increase by -13%only resulted in a 2.3E-10 increase in CDF and a 1.1E-10 increase in LERF. Therefore, any reasonable variations to this value will not lead to challenging the acceptance guidelines.

Therefore, the SORV failure probability is not retained as a potential key source of uncertainty.

Risk Assessment Attachment 12 Page 152 Table A-4 Identification of Potential Key Sources Uncertainty Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Probability that Yes Yes The base pre EPU model Yes containment considered a 10% likelihood isolation failure that given containment leading to lack overpressure conditions do not of containment exist in certain scenarios, then overpressure all ECCS pumps taking suction also leads to from the suppression pool failure of would fail. The EPU ECCS from the modifications included the suppression implementation of an RHR pool cross-tie to eliminate the need for containment overpressure in certain scenarios. An alternative less optimistic assumption for this event (e.g.

assuming containment overpressure failure would always lead to loss of ECCS) could actually result in a larger risk reduction than that calculated in the base case for the EPU assessment.

Therefore, the probability that lack of containment overpressure leads to failure of ECCS from the suppression pool is identified as a potential key source of uncertainty.

Risk Assessment Attachment 12 Page 153 Table A-4 Identification of Potential Key Sources Uncertainty Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Containment No Yes The dominant contributor to the No isolation failure containment isolation failure probability probability is based on information from EPRI that has been utilized for various ILRT extension requests. This is conservative for this application and the uncertainty associated for this issue is bounded by the probability that lack of containment overpressure leads to failure of ECCS from the suppression pool described above. Therefore, the containment isolation failure probability is not retained as a potential key source of uncertainty.

LOOP Yes No Uncertainty in the LOOP No frequency and frequency and recovery fail to recover probabilities will lead to some probabilities change in the calculated deltas since LOOP scenarios comprise a portion of the calculated ACDF, but the overall assessment is not limited to only LOOP events. Additionally, the loop initiating event frequency and fail to recover values are fairly well accepted (being based on NUREG-6890).

As such the LOOP recovery values are not retained as a potential key source of uncertainty.

Risk Assessment Attachment 12 Page 154 Table A-4 Identification of Potential Key Sources Uncertainty Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Human error No Yes The implementation of the RHR Yes probability for cross-tie does not have a implementation significant impact on the overall of the RHR CDF and LERF results, but is cross-tie (or noted as a potential source of effectiveness model uncertainty due to its of RHR cross- importance in the context of the tie) EPU changes.

Postulated Yes No The source of model uncertainty Yes overpressure from the base model failure mode assessment is derived from the being assumption that the success equivalent to a criteria for overpressure failures Large LOCA of the RPV are equivalent to the large LOCA success criteria.

For this application, however, given that the success criteria are assumed to be the same, the source of model uncertainty is more related to the frequency of overpressure failures (especially with respect to the increased pressures that may arise post-trip from EPU conditions). Therefore, the overpressure failure probability (leading to large LOCAs) is identified as a potential key source of uncertainty.

Risk Assessment Attachment 12 Page 155 Table A-4 Identification of Potential Key Sources Uncertainty Source of Source of Application Source of Model Uncertainty Potential Uncertainty Model Important Assessment Key Source Uncertainty Contributor of for Base Uncertainty Model Common Yes No Due to the nature of the EPU No Cause Failure evaluation, the change in the Values risk metrics tended to be dominated by the changes to HEP values and as such CCF values do not play a big role in the risk assessment. Therefore, it is not identified as a potential key source of uncertainty for this application.

A.3.2.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors shown in Table A-4, several sensitivity cases were prepared for further exploration. This includes the following cases:

• Human error probability development as a class

" Large LOCA initiating event frequency

• Likelihood that containment isolation failure leading to lack of containment overpressure also leads to failure of all ECCS taking suction from the suppression pool.

• Human error probability for implementation of the RHR cross-tie (or effectiveness of RHR cross-tie)

• RPV overpressure failure probability The first sensitivity case involves the Human Error Probability (HEP) development as a class. For this sensitivity study, all post-initiator independent and dependent HEP events are set to their 95th percentile values. The results of this sensitivity case are presented in Table A-5.

Risk Assessment Attachment 12 Page 156 Table A-5 HEP SENSITIVITY CASE FOR THE EPU RISK ASSESSMENT CASE CDF LERF Pre-EPU 1.31 E-05/yr 1.07E-06/yr EPU 1.37E-05/yr 1.26E-06/yr Delta 6.OE-07/yr 1.9E-07/yr Exceeds Acceptance No (1.OE-05/yr) No(1.OE-06/yr)

Guideline for Small Change Exceeds Very Small No (1.OE-06/yr) Yes (1.OE-07/yr)

Acceptance Guideline As expected, the results of the sensitivity case show that significant changes to the HEPs have a profound impact on the calculated risk metrics. These results are similar to most BWR PRA uncertainty evaluations when this sensitivity case is performed and is not unexpected. However, even when the extreme assumptions are utilized for the HEP values, only the LERF delta risk results exceed the acceptance guidelines for "very small" changes in risk, and neither the CDF or LERF results exceed the acceptance guidelines for "small" changes in risk.

The second postulated sensitivity case is bounded by the LOCA frequency sensitivity case described in Section 5.7 which includes a variation on all the LOCA frequencies. Therefore, the large LOCA frequency uncertainty is bounded by that case which showed a 16.7% increase in CDF and a 14.0% increase in LERF compared to a 2.8% change in CDF and 3.5% change in LERF for EPU conditions when no changes to the LOCA frequencies are employed. The results of this sensitivity case would not change the conclusions from this analysis.

The third sensitivity case involves the likelihood that containment isolation failure leading to a lack of containment overpressure also leads to failure of all ECCS taking suction from the suppression pool. The base case analysis assumes that this is dictated by a 10% failure likelihood (ZPH-NPSHDXI2 = 0.1). In this sensitivity case, the assumed likelihood value is raised to 100% (i.e.,

lack of containment overpressure will always fail ECCS, ZPH-NPSHDX12 =1.0). The results are summarized in Table A-6 which indicates that the base case CDF and LERF would increase but the delta risk metric would actually decrease. This provides an estimate of the maximum benefit of implementing the RHR cross-tie modification that eliminates the need for containment overpressure.

Risk Assessment Attachment 12 Page 157 Table A-6 LIKELIHOOD THAT LACK OF CONTAINMENT OVERPRESSURE FAILS ECCS SENSITIVITY CASE FOR THE EPU RISK ASSESSMENT CASE CDF LERF Pre-EPU 3.88E-06/yr 7.32E-07/yr EPU 3.71 E-06/yr 4.93E-07/yr Delta -1.7E-07/yr -2.4E-07/yr Exceeds Acceptance No (1.OE-05/yr) No (1.OE-06/yr)

Guideline for Small Change Exceeds Very Small No (1.OE-06/yr) No (1.OE-07/yr)

Acceptance Guideline The fourth sensitivity case involves taking no credit for implementation of the RHR cross-tie. This is accomplished in the sensitivity case by setting the operator action for implementing the cross-tie to 1.0 (DHU--SPXDXI2). This change leads to a 3.3% increase in CDF and a 7.9% increase in LERF compared to a 2.8% change in CDF and 3.5% change in LERF for EPU conditions when nominal credit is taken for implementation of the RHR cross-tie (i.e., DHU-SPXDXl2=0.06). The results of this sensitivity case would not change the conclusions from this analysis.

The final sensitivity case involves the RPV overpressure failure probabilities for both ATWS and non-ATWS conditions. Based on the discussion in Section 4.1.2.5 no changes to these parameters were warranted (i.e., ARV--COMCPI2 for non-ATWS scenarios and ARV-ATWSCPI2 were both left at their pre EPU values). However, this sensitivity case explored factor of 2 increases to both of these values. Doubling the RPV overpressure failure probabilities resulted in a 5.0% increase in CDF and a 4.6% increase in LERF compared to a 2.8% change in CDF and 3.5%

change in LERF for EPU conditions when no changes to the RPV overpressure failure probabilities are employed. The results of this sensitivity case would not change the conclusions from this analysis.

Risk Assessment Attachment 12 Page 158 A.3.3 Completeness Uncertainty The interim Fire PRA model was utilized to obtain quantitative risk metric results as described in Section 4.3. The seismic hazard group was demonstrated to be an insignificant contributor based on qualitative reasoning in Section 4.4. In Section 4.5, the disposition of those hazard groups not included in the PRA for the EPU risk assessment is provided. As discussed there, the majority of those hazard groups were screened based on qualitative considerations from the IPEEE. Section 4.6 presents a consideration of shutdown risk from the EPU changes. Additionally, there are no open items from the recent industry peer review related to model completeness associated with the internal events PRA model.

Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment.

A.4 UNCERTAINTY ANALYSIS CONCLUSIONS As previously indicated, the uncertainty analysis addresses the three generally accepted forms of uncertainty - parameter, model, and completeness uncertainty. The conclusions from these assessments are as follows.

Parameter Uncertainty The parameter uncertainty assessment indicated that the use of the point estimate results directly for this assessment is acceptable.

Model Uncertainty Several sensitivity cases were explored to consider the potential impacts of potential key sources of uncertainty in the risk assessment. The results of the sensitivity studies indicated that although some alternative assumptions could challenge the acceptance guidelines for very small changes in risk, there is no one issue that would result in exceeding the acceptance guidelines for small changes in risk.

Therefore, it is concluded that there are no key sources of model uncertainty that would challenge

Risk Assessment Attachment 12 Page 159 the characterization of the EPU impacts on the plant as not risk significant.

Completeness Uncertainty There is no major form of completeness uncertainty that would impact the results of this assessment.

Risk Assessment Attachment 12 Page 160 ADDITONAL REFERENCES

[A-i] Regulatory Guide 1.174, An Approach for Using ProbabilisticRisk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002.

[A-2] Treatment of Parameterand Model Uncertaintyfor ProbabilisticRisk Assessments, EPRI Report 1016737, Palo Alto, CA, December 2008.

[A-3] Peach Bottom Atomic Power Station PRA Peer Review Report, BWROG Final Report, May 2011.

Risk Assessment Attachment 12 Page 161 Appendix B IMPACT OF EPU ON SHUTDOWN OPERATOR ACTION RESPONSE TIMES This appendix describes the thermal hydraulic analyses performed to support the assessment that the PBAPS EPU has a non-significant impact on human response times during plant shutdown accident scenarios.

B.1 INTRODUCTION The risk due to accidents during shutdown is strongly dependent upon the time available from the start of the event to the onset of core damage. As time elapses after shutdown, accidents leading to boiling of coolant within the RPV and consequential inventory losses take more time to evolve.

The burden on plant systems decreases as well, introducing the chance of accident mitigation with non-safety, low capacity systems.

The effect of decreasing decay heat on the times to boil and core damage is accounted for in two ways. The first is the calculation of decay heat present at a particular point in the outage. The second takes into consideration the heat capacity of the water and structures in the system available to absorb decay heat before boiling and core damage occur. Both of these aspects are addressed in this appendix to support the assessment of the relationship of decay heat levels and times available in which to perform human actions to prevent core damage during shutdown accident scenarios.

B.2 ASSUMPTIONS The following assumptions were used in the following calculation of the times to boil off the fuel coolant and reach core damage. These assumptions allow for some simplifications in the calculation, and also allow for an appropriate degree of conservatism in the results.

The time to boil and time to core damage calculations are appropriate for conditions of RPV vented and maintained at atmospheric pressure.

Risk Assessment Attachment 12 Page 162 The time to core damage is conservatively estimated by calculating the time to reach 2/3 core height, and then extrapolating the time to gap release based on decay heat level ratios by assuming that gap release occurs 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after 2/3 core height is reached one day after shutdown. Gap release is the release of fission products in the fuel pin gap, which occurs immediately after failure of the fuel cladding and is the first radiological indication of core damage. This approach is based on calculations performed by Sandia and summarized in SECY-93-190. [B-4]

There is no heat loss from the system to the surroundings via the water surface or through the vessel walls.

The calculation of decay heat levels and times to boiling and core damage in this assessment conservatively do not include removal of spent fuel out of the core.

The decay heat as a function of time after shutdown is derived from a curve fit to the ASB 9-2 Branch Technical Position methodology assuming 100% initial power and 16,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of power operation.

B.3 DECAY HEAT LEVEL CALCULATION There are several methods available to calculate decay heat as a function of time after shutdown.

The NRC has provided an acceptable method of calculating the decay heat rate in Branch Technical Position ASB 9-2 [B-1]. This method uses the following equation:

11 11 Ps = P (1+K)(1/200 EArexp(- - ( 1 /2 0 0 )E' Anexp[-an(ts + ] (B-i)

) ants) to)]

n=1 n=1 Where: Ps = decay heat level (MBtu/hr)

Po = normal operating power (MBtu/hr) t = time after shutdown (seconds) t = operating history K = uncertainty factor 7

= 0.2 for t, < 103,0.1 for 103 < to <10 An, a, = fit coefficients as specified in Reference B-1.

Risk Assessment Attachment 12 Page 163 Other less complex formulas have been developed and provide reasonable estimates of decay heat rates. Reference B-2 provides the simplest of these, assuming an infinite power history:

P s(t) = P o (0.0950) t s-0. 26 (B-2) where Ps(t), P0 and ts are as defined above. A comparison of Equation B-2 to Equation B-i, assuming 16,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> of power operation, shows that Equation B-2 underestimates the decay heat in the first day or two by 10-20%, and it overestimates the decay heat thereafter (by 10-75%).

At 70 days after shutdown, the decay heat calculated by Equation B-2 is about 75% higher than that calculated using the ASB 9-2 method [B-l].

Another abbreviated formula is found in Reference B-3. This formula, called the Wigner-Way formula, also includes a factor for the power history:

Ps(t) = P0 (0.0622) [tS-0-2 - (to + ts)-0"2] (B-3)

As with Equation B-i, to is the operating history in seconds, also assumed to be 16,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> for comparison purposes. Equation B-3 shows a better correlation late in the outage, but the first twenty to thirty days after shutdown are under predicted (by 10-20% compared to the ASB 9-2 formula). A separate curve fit to the ASB 9-2 equation can be developed of the form:

P s(t) = P o (0.02561) t S(hrs)"0.

4 2 37 1 (B-4) where tS(hr) is the time since shutdown in hours. This simple equation is considered to have an advantage over Equations B-2 and B-3 because it agrees with the ASB 9-2 data to within about 10% over the full time period of interest. Although the agreement is not as accurate as the Wigner-Way formula after about 40 days, the agreement at the critical earlier times is much better.

Equation B-4 is often used in industry BWR PSSAs to support boil-off timing calculations.

Risk Assessment Attachment 12 Page 164 Using Equation B-4, the decay heat level as a function of time after shutdown is given as:

PBAPS CLTP: P s(t) = (3514 MWt) (3.4118E6 Btu/hr / 1 MWt) (0.02561) t S(hrs)-042371 Ps(t) = (3.07E8) tS(h,)"°'42371 Btu/hr (B-5a)

PBAPS EPU: P s(t) = (3951 MWt) (3.4118E6 Btu/hr / 1 MWt) (0.02561) t S(hrs)°42371 P s(t) = (3.45E8) t S(hrs)- 42371 Btu/hr (B-5b)

B.4 RPV HEATUP AND BOILOFF CALCULATIONS Once the core decay heat rate has been calculated using Equation B-5, the times to fuel coolant boiling and core damage can be calculated using simple heat transfer formulas based on the volume of water available. The principal shutdown states are represented by the following water level configurations:

• normal level

• at the flange level

• reactor cavity flooded Nominal water volumes and associated heat capacities for use in this calculation are summarized in Table B-i, [B-5].

Risk Assessment Attachment 12 Page 165 Time to Boil The time required for the vessel water to reach the boiling temperature (given loss of coolant decay heat removal) is represented by the following equation:

tb = Ebil / Ps(t) hrs. (B-6) where:

tb = time to boil (hours)

EbOil - Ewater + Estruct Ewater = energy absorbed by heated water volume to reach saturation (MBtu)

Estrct = energy absorbed by fuel and clad (MBtu)

Pm(t) = decay heat level (MBtu/hr),

and Ewater V/v * (hT~t - hTinh)

V = volume of water that heats up to the saturation temperature (ft 3) v = specific volume of water at Tinit (assumed constant at 0.0167 ft3/Ilbm over the temperature range of interest) hTsat = enthalpy of water at Tat, 212°F (Btu/Ibm),

hTiif = enthalpy of water at the initial RPV temperature, Tift (Btu/Ibr);

and Estrut = MCpstruJt (Tat - Tin-t)

MCpctm = configuration specific structure heat capacity (Btu/OF - See Table B-1i)

Since the specific heat of water is 1.0 Btu/(Ibm°F), the difference in the enthalpies in the Ewater expression above (hTsat - hTinf) is equivalent to the temperature difference in the Estct expression (Tsat - Tina). This allows the complete expression for Eboi to simplify to:

Eboil = [(V/v) + MCPSTRUCT] * [TSAT - Tin- (B-7)

Risk Assessment Attachment 12 Page 166 Substituting in the appropriate constant values, Equation B-7 can be rewritten as:

Eboil = C * [212-mTini] (B-8) where the constant C is calculated for each of the water volumes and structure capacities given in Table B-1. Thus, with the initial temperature, Tinit in OF and the decay heat load, Ps(t) in Btu/hr, the time to reach saturation for the different configurations are given by Equations B-9 through B-1 3.

t b, 2/3 core height = 0.32E6 * (212 - Tinit) / Ps(t) hours (B-9) tbTAF = 0.43E6 * (212 - Tinit) / Ps(t) hours (B-10) tbNormalLevel - 0.80E6 * (212 - Tinit) / Ps(t) hours (B-11) tbFlange Level = 1.11E6 * (212 - Tinit) / P(t) hours (B-12) tb.Cav yFiooded = 7.56E6 * (212 - Tif) / Ps(t) hours (B-13) where Ps(t) is the decay heat level (refer to Equation B-5) and Tnit is the initial water temperature (e.g., 14 0 °F early in the outage before cavity flooded and 100°F later in the outage after the cavity flooded).

Risk Assessment Attachment 12 Page 167 Table B-1 PBAPS NOMINAL WATER VOLUMES AND HEAT CAPACITIES FOR THE TIME TO BOIL AND TIME TO CORE DAMAGE CALCULATIONS Heat Capacity (Btu/OF)(1)

Water Level j)Water Structure 2/3 Core Height 5272 0.32E6 (2)

Top of Active Fuel 7252 0.43E6 (2)

Normal Level 13,412 0.80E6 (2)

Flange Level 18,617 1.11 E6 (2)

Cavity Flooded 126,229 7.56E6 (2)

NOTES:

(1) The term heat capacity is used in Eq. B-8. The water heat capacity is defined as Volume/v (where v is the specific volume of water and is assumed constant at 0.0167 ft3/Ibm). The specific heat for water was assumed to be 1.0 Btu/(Ibm°F). Refer to text on preceding pages for further details.

(2) Structural heat capacities are conservatively not credited in this calculation.

Risk Assessment Attachment 12 Page 168 Time to Uncover Fuel (Boil Off) and Core Damaqe The time to uncover the core due to boil off (due to loss of coolant decay heat removal) is the sum of the time required to bring the full heated water volume to saturation and the time to boil off an equivalent volume of water that lies above the core. This can be represented by an equation similar in format to the time to boil equation (Equation B-6):

tcu = Etot 1 / Ps (t) (B-14) where:

tcU = time to uncover the core (hours)

Etotal - Eboil + Eboiloff Eboil= energy absorbed to reach saturation as defined for Equation B-6 (MBtu)

Eboioff = energy absorbed by the water that vaporizes during boiloff (MBtu),

and Vb / v~t * (hfg)

Vb equivalent volume of water that must vaporize for the collapsed level to reach TAF (ft3) specific volume of water at saturation (Tsat = 212 0 F), or Vsat 0.0167 ft3/lbm hfg heat of vaporization at 212°F and 14.7 psia, or 970.32 Btu/Ibm.

With constant values again assumed where appropriate, Equations B-15 through B-17 below provide the time to uncover the core for the different shutdown water level configurations:

tcu,Normal Level = [0.80E6 * (212 - Tinit) + 3.58E8] / Ps(t) hours (B-1 5) tcu,Flange Level = [1.11E6 * (212 -Tint) + 6.60E8] / Ps(t) hours (B-1 6) tcu,Caviy Flooded = [7.56E6 * (212 - Tinit) + 6.91 E9] / Ps(t) hours (B-1 7) where Ps(t) is the decay heat level (refer to Equation B-5)

Risk Assessment Attachment 12 Page 169 This analysis assumes the initial bulk water temperature is 140F for days 0 through 5; 120F for days 6 through 10; and 1OOF for days 11 and beyond.

The time to uncover the core with the existing power level (CLTP) is 9.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (8.2 hrs for the EPU case) at one day into the outage if the water level is at the RPV flange elevation at the time of a loss of decay heat removal event. The available time greatly exceeds 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> at one day into the outage when the water level is flooded up into the refueling cavity (over 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> for the EPU case).

For the impact on shutdown human error probabilities, it is necessary to know the approximate time of core damage so that this time can be used as the maximum allowable time window rather than conservatively estimating the time to reach an uncovered core. For this PBAPS EPU evaluation, the time to core damage is estimated by incorporating the additional time available from boiloff down to 2/3 core height, and then extrapolating the time to gap release by assuming that gap release occurs 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after 2/3 core height is reached one day after shutdown [B-4]. The resulting equation for core damage, tcd, is:

tcd = tcu + [1.16E8 + 0.5

• Ps(ld)] / Ps(t) hours (B-18) where:

" 1.16E8 represents the amount of decay heat required to boildown from TAF to 2/3 core height (i.e., [(7252-5262)/0.0167] x 970.32).

• Ps(ld) is the decay heat 1 day after shutdown (refer to Eq. B-5)

" Ps(t) is the decay heat as a function of time after shutdown (refer to Eq. B-5)

This equation for estimating the time to core damage during refueling incidents is the approach typically used in U.S. industry BWR PSSAs. This equation was developed in the BWR PSSA industry to reflect BWR fuel heatup timing estimates provided in NSAC-169 and SECY-93-190 [B-4, B-8]. SECY-93-190 reports that fuel heatup calculations performed for Grand Gulf by Sandia show that at 4 days after shutdown approximately 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> are available between reaching TAF and before fuel pin gap release occurs; and almost 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> is available at 15 days after shutdown.

Risk Assessment Attachment 12 Page 170 Given the nature of shutdown risk, the time to core damage due to boil-off is not static but increases with increasing times after shutdown. An equation is used for ease of modeling shutdown incidents. Although one may use MAAP runs to estimate the time to core damage (as is done in the at-power PRA), it is not practical given that numerous different runs would be required for different times after shutdown.

Comparisons of the time to core damage due to boil off (given loss of coolant decay heat removal) for the normal, RPV flange, and cavity flooded water level configurations for the CLTP and the EPU cases are provided in Tables B-2 through B-4. Note that the times to core damage for the flood-up configuration are in the range of multiple days (much longer than the time frames considered in PRAs).

Risk Assessment Attachment 12 Page 171 B.5 EPU IMPACT ON SHUTDOWN RISK Impact Due to Changes in HEPs The primary impact of the EPU on risk during shutdown operations is the decrease in allowable operator action times in responding to off-normal events.(') However, as can be seen from Tables B-2 through B-4, the reduction in times to core damage (i.e.; CLTP case compared to EPU case) is on the order of 10%. Such small changes in already lengthy allowable operator response times result in negligible changes (<<1%) in calculated human error probabilities.

The allowable operator action times to respond to loss of heat removal scenarios during shutdown operations are many hours long. Very early in an outage the times are approximately 5-6 hours; later in an outage the times are dozens of hours. A reduction from 7.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 6.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> (refer to "1 Day After Shutdown" case in Table B-2) in allowable action times would not result in a significant increase in human error probabilities for most operator actions using current human reliability analysis methods. The allowable timing reductions for times later in the outage would result in indiscernible changes in HEPs using current human reliability analysis methods.

(1) Another postulated impact is any changes to system success criteria during shutdown operations (specifically with respect to decay heat removal systems) that may result from the EPU. A postulated impact would be that the time into the outage at which backup low capacity heat removal options would be sufficient to prevent coolant boiling would be extended a number of hours. Such a postulated impact is estimated to result in an insignificant change in shutdown risk (e.g., 1% or less change in shutdown CDF).

Risk Assessment Attachment 12 Page 172 Impact Due to Changes in Offsite AC Recovery Failure Probabilities In addition to traditional human error probabilities, offsite AC recovery failure probabilities can be influenced by changes in allowable action times. An approximate calculation is performed here to estimate the impact on shutdown risk due to changes in the offsite AC recovery failure probability.

The calculation is described as follows:

" A 30-day refueling outage is assumed and is divided into the following four (4) phases:

- Day 1 of the outage

- Day 2 of the outage

- Days 3-29 of the outage

- Day 30 of the outage

• These phases are defined to address the higher decay heat in the beginning days of the outage, the "flooded-up" days in the middle of the outage when decay heat issues are not the main risk contributor, and the end of the outage when the coolant level is lowered back down into the vessel.

• The following initial water level configurations are assumed for the phases:

- Day 1 of the outage (NORMAL RPV LEVEL)

- Day 2 of the outage (RPV FLANGE LEVEL)

- Days 3-29 of the outage (FLOODED UP)

- Day 30 of the outage (NORMAL)

A review of industry BWR PSSAs (Cooper, Duane Arnold, Dresden, Fermi, LaSalle, Nine Mile Pt. U-2, Quad Cities, and Columbia) was performed to assist in defining the contribution of LOOP/SBO accident scenarios to the CDF of each of the above general phases. Based on the review, the CDF contribution from LOOP/SBO scenarios is significant in the first few days of the outage when the decay heat is higher, it drops significantly in the middle of the outage when decay heat is lower and the cavity is flooded (draindown events dominate these periods), and then it increases at the end of the outage when the coolant level is lowered back down into the vessel.

Based on the above information, the LOOP/SBO contributions to CDF as a function of outage phase are assumed here as follows:

LOOP/SBO Contribution to Outagqe Phase Phase CDF

- Day 1 30%

- Day 2 30%

- Day 3-29 10%

- Day 30 20%

Risk Assessment Attachment 12 Page 173

" The review of industry PSSAs also supported the estimation of the contributions to overall shutdown CDF from the different phases of the outage.

This review indicates the majority of the outage CDF is comprised of the middle portion of the outage (primarily due to the fact that this is the longest period of the outage, and involves significant equipment outages).

Based on the above information, the phase CDF contributions to overall outage CDF are assumed here as follows:

Contribution to Outage Outaqe Phase CDF

- Day 1 10%

- Day 2 15%

- Day 3-29 70%

- Day 30 5%

• INEELUEXT-04-02326 is used here to estimate changes in offsite AC recovery failure probabilities due to reductions in allowable timings. [B-6] The INEEL "composite" (i.e., integrated data for plant, switchyard, grid, and weather related LOOP events) LOOP non-recovery curve for LOOP events experienced during shutdown conditions is used. The LOOP non-recovery probabilities are determined for CLTP and EPU core damage times, and then ratioed to model the impact of the EPU on the LOOP recovery failure probabilities.

• The assessment is performed on a normalized CDF basis.

This calculation is summarized In Table B-5. As can be seen from Table B-5, the increase in shutdown CDF due to increases in AC power recovery failure probabilities due to the EPU is estimated at approximately 1%.

Summary Based on the above discussions and calculations, the qualitative conclusions of this assessment is that the PBAPS EPU has an non-significant impact on shutdown risk (approximately 1% increase in shutdown CDF). This estimate considers the EPU impact on the shutdown post-initiator HEPs, offsite AC recovery failure probabilities, and decay heat removal systems success criteria.

Risk Assessment Attachment 12 Page 174 Table B-2 TIME TO CORE DAMAGE DUE TO BOIL OFF (Initial Water Level: Normal Level)

Time to Core Damage (hrs.)

Days After Shutdown CLTP EPU 1 7.1 6.4 5(1) 14.1 12.7 10(1) 19.5 17.5 15(1) 23.8 21.3 20(1) 26.9 24.1 25(1) 29.5 26.5 30 31.9 28.6 NOTE:

(1) The days marked with the footnote are not directly applicable to the modeled outage schedule for the water level configuration of this table (i.e., during the first couple days of the outage the water level is low, but then for the majority of the outage the water level is at the spent fuel pool level, and then is lowered again at the end of the outage), but are provided to illustrate the increasing trend in time available.

Risk Assessment Attachment 12 Page 175 Table B-3 TIME TO CORE DAMAGE DUE TO BOIL OFF (Initial Water Level: RPV Flange Level)

Time to Core Damage (hrs.)

Days After Shutdown CLTP EPU 1 11.2 10.0 5(1) 22.2 19.8 10(1) 30.5 27.3 15(1) 37.1 33.2 20(1) 41.9 37.5 25(1) 46 41.2 30 49.7 44.5 NOTE:

(1) The days marked with the footnote are not directly applicable to the modeled outage schedule for the water level configuration of this table (i.e., during the first couple days of the outage the water level is low, but then for the majority of the outage the water level is at the spent fuel pool level, and then is lowered again at the end of the outage), but are provided to illustrate the increasing trend in time available.

Risk Assessment Attachment 12 Page 176 Table B-4 TIME TO CORE DAMAGE DUE TO BOIL OFF (Initial Water Level: Cavity Flooded)

Time to Core Damage (hrs.)

Days After Shutdown CLTP EPU 1(1) 95.3 84.8 5 188.5 167.7 10 257.9 229.5 15 312.1 277.8 20 352.6 313.8 25 387.6 344.9 30(l) 418.7 372.6 NOTE:

(1) The days marked with the footnote are not directly applicable to the modeled outage schedule for the water level configuration of this table (i.e., during the first couple days of the outage the water level is low, but then for the majority of the outage the water level is at the spent fuel pool level, and then is lowered again at the end of the outage), but are provided to illustrate the increasing trend in time available.

Risk Assessment Attachment 12 Page 177 Table B-5 ESTIMATED IMPACT ON SHUTDOWN RISK DUE TO OFFSITE AC RECOVERY FAILURE PROBABILITY INCREASES DUE TO EPU Time to Core Damage (hrs)

Factor Phase Increase in 'Phase Contribution to LOOP/SBO Offsite AC Contribution to Initial Water Overall SD Contribution to Recovery Overall S/D Outage Phase Level CDF (CLTP)(1 ) Phase CDF(1) CLTP(2) EPU(2) Failure CDF (EPU)(5)

Probability(4)

Day 1 Normal 0.10 0.30 7.1 6.4 1.14 0.104 Day 2 RPV Flange 0.15 0.30 15.0 13.5 1.15 0.157 Days 3-29 Flooded 0.70 0.10 312.1 (3) 277.8(3) negligible 0.700 Day 30 Normal 0.05 0.20 31.9 28.6 1.16 0.050 Normalized CDF (CLTP): 1.00 Normalized CDF (EPU): 1.011

Risk Assessment Attachment 12 Page 178 Notes to Table B-5:

(1) Approximated based on review of industry BWR PSSAs (Cooper, Duane Arnold, Dresden, Fermi, LaSalle, Nine Mile Pt. U-2, Quad Cities, and Columbia).

(2) Calculated using Eq. B-18.

(3) The time to core damage for the "Days 3-29" phase of the outage is based on the 15th day.

(4) Based on use of generic offsite AC recovery failure probability information from INEELUEXT-04-02326 ("composite" shutdown LOOP duration curve). For example, at 6.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> the INEEIJEXT-04-02326 'composite" shutdown LOOP AC recovery failure probability is approximately 6.23E-2 and at 6.4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> it is 5.88E-2 (an increase of 1.14x).

(5) Calculated as:

= [LOOP/SBO fraction of outage phase (impacted) ] + [ Non-LOOP/SBO fraction of outage phase (not impacted) ]

= [3rd Column x 4th Column x 7th Column ] + [ 3rd Column x ( 1.0 - 4th Column ) ]

Risk Assessment Attachment 12 Page 179 REFERENCES

[B-1] U. S. Nuclear Regulatory Commission, Residual Decay Heat Energy for Light-Water Reactors for Long-Term Cooling, Branch Technical Position 9-2.

[B-2] M.M. EI-Wakil, Nuclear Heat Transport, International Textbook Company, 1971.

[B-3] K. Way, E. Wigner, The Rate of Decay of Fission Products, (Phys. Rev., 73, 1948, pp.

1318-1330)

[B-4] U. S. Nuclear Regulatory Commission, Regulatory Approach. to Shutdown and Low Power Operations,SECY-93-190, July 12, 1993,

Enclosure:

Draft Regulatory Analysis in Accordance with 10CFR50.109, dated February 1993.

[B-5] ERIN Engineering and Research, Inc., PBAPS Probabilistic Shutdown Safety Assessment (PSSA), 1999.

[B-6] INEEL/EXT-04-02326, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1986-2003, Draft, October 2004.

[B-7] Electric Power Research Institute, Safety Assessment of BWR Risk During Shutdown Operations,NSAC-175L, Final Report, August 1992.

[B-8] Electric Power Research Institute, Analysis of BWR Fuel Heatup During a Loss of Coolant While Refueling, NSAC-169, September 1991.

Attachment 13 Peach Bottom Atomic Power Station Units 2 and 3 NRC Docket Nos. 50-277 and 50-278 Flow Induced Vibration

Flow Induced Vibration Attachment 13 Page 1

1.0 INTRODUCTION

This Attachment to the submittal provides a detailed discussion of the analyses and testing program undertaken to provide assurance that unacceptable flow induced vibration (FIV) issues are not experienced at Peach Bottom Atomic Power Station (PBAPS) due to extended power uprate (EPU) implementation for affected piping systems.

Increased flow rates and flow velocities during operation at EPU conditions are expected to produce increased FIV levels in some systems. As discussed in Section 3.4.1 of Licensing Topical Report (LTR) NEDC-33004P-A, Revision 4, "Constant Pressure Power Uprate," the Main Steam (MS) and Feedwater (FW) system piping vibration levels should be monitored because their system flow rates will be significantly increased [2].

In December 2008, the Boiling Water Reactor Owners' Group (BWROG) issued NEDO-33159, Revision 2, "Extended Power Uprate (EPU) Lessons Learned and Recommendations," based on operating experience (OE) and evaluations from Boiling Water Reactor (BWR) plants that have previously implemented EPUs and from plants currently performing pre-EPU evaluations

[1]. NEDO-33159 states:

"Since the majority of EPU-related component failures involve flow induced vibration, the BWROG EPU Committee held a vibration monitoring and evaluation information exchange meeting of industry experts in June 2004. The committee determined that the current process of monitoring large bore piping systems in accordance with the requirements of American Society of Mechanical Engineers (ASME) Operation and Maintenance (O&M) Part 3 is sufficient to preclude challenges to safe shutdown.

Increases in large bore piping vibration levels are a precursor to increased vibration levels in attached small bore piping and components."

Regulatory Guide (RG) 1.20, "Comprehensive Vibration Assessment Program for Reactor Internals during Preoperational and Initial Startup Testing," was revised in 2007 to Revision 3. In addition to guidance for vibration assessment of reactor internals, this regulatory guide provides helpful information on methods for evaluating the potential adverse effects from pressure fluctuations and vibrations in piping systems for-boiling water reactor (BWR) nuclear power plants. However, additional guidance is provided with regard to piping vibration. The guidance is primarily directed to initial start-up of new plants, with general guidance interpreted for use in power uprate power ascension testing. Where applicable, this guidance has been incorporated into the EPU monitoring program for piping vibration at PBAPS.

In addition to MS and FW, the related Extraction Steam (ES), Condensate (CD) and Heater Drain (HD) systems also experience similar flow increases under EPU conditions and are included in the EPU vibration monitoring program. Other systems experience insignificant or no increase in flow and; therefore, are not included in this program. Piping system segments which have been analyzed for flow induced vibrations were selected such that the remaining piping system segments which were not specifically analyzed are bounded by the evaluations.

Flow Induced Vibration Attachment 13 Page 2 This document describes the piping vibration monitoring program to be implemented at PBAPS during power ascension to confirm acceptable vibration levels at EPU power. It addresses systems impacted by EPU and identifies locations on those systems where monitoring equipment will be installed. This document also describes the techniques to be used for collecting and storing the vibration data.

2.0 SUSCEPTIBILITY AND MONITORING The MS and FW piping will experience higher mass flow rates and flow velocities under EPU conditions. When power is increased from current licensed thermal power (CLTP) to EPU conditions, steady state FIV levels are conservatively expected to increase in proportion to the flow velocity squared. Thus, the vibration levels of the MS and FW piping are expected to increase by approximately 35% and 30%, respectively, based on a steam flow velocity increase of up to 16% and a feedwater flow velocity increase of 14%. Other possible sources of increased vibration, such as flow instabilities or acoustic resonance as a result of increased flow velocities, may contribute to EPU vibration levels.

Flow rates in portions of the CD, ES and HD systems increase similarly to MS and FW, and are therefore susceptible to increased vibrations at EPU conditions.

Based on the potential for significantly increased vibrations on the systems identified above, a confirmatory test program will be implemented to monitor piping and attached component vibration levels on the identified systems during initial power ascension to EPU conditions.

Piping in the drywell and inaccessible piping outside containment will be monitored using accelerometers installed at selected locations on the piping and attached components.. The accelerometers will be wired to remote data acquisition systems located in the reactor and turbine buildings. Piping outside containment that is included in the monitoring program and is accessible during plant operation will be monitored either remotely or by performing visual observations and by taking vibration measurements using hand-held vibration instruments during power ascension to EPU conditions.

Small bore branch piping is susceptible to the effects of the associated large bore piping FIV.

Small bore piping assessments will be performed to identify potentially susceptible configurations, and any modifications required to reduce vibration susceptibility will be made prior to EPU power ascension. The assessments will be conducted in accordance with the guidance and tools provided in EPRI's Fatigue Management Handbook (FMH). Walkdowns of the systems impacted by EPU flow increases will be performed to identify if there are any additional potentially susceptible small bore line configurations. Any necessary small bore line modifications will be made prior to EPU power ascension.

Flow Induced Vibration Attachment 13 Page 3 3.0 EPU VIBRATION MONITORING PROGRAM 3.1 Overview The portions of the MS, FW, CD, HD and ES system included in the EPU vibration monitoring program have been selected based on evaluation of the flow increases resulting from EPU implementation. Analyses using detailed methods have been performed to establish the specific EPU vibration monitoring locations and associated acceptance criteria. The EPU flow increase evaluation and vibration analysis results form the bases for EPU vibration monitoring.

Several MS-associated components will also be monitored. Although PBAPS does not have a history of safety-relief valve maintenance issues due to vibration, selected relief valves will be instrumented with accelerometers, as well as four other power-operated valves. This is in response to industry OE from an earlier EPU project. Valves selected for monitoring will make a representative sample of the effect of EPU flow changes on the vibration levels at the primary valves in the system with symmetry between trains, loops and units considered to remove unnecessary redundancies.

3.2 Vibration Monitoring Location and Acceptance Criteria Development 3.2.1 MS and FW Piping (Drywell and Turbine Building)

Detailed models of the MS and FW piping for both inside containment and outside containment were developed for this evaluation. A flat "1g" response spectrum with increases at potential flow induced vibration frequencies was applied up to 250 Hz in each of the three orthogonal directions for MS and 200 Hz in each of the three orthogonal directions for FW piping. Static loads, such as weight and thermal expansion, are not considered since these loads do not contribute to cyclic vibratory loading of the piping system. Additionally, seismic (inertia and anchor movements) and turbine stop valves loads are not considered, since these loads are transient dynamic loads that do not contribute to the steady-state cyclic vibratory loading of the system.

The results of the piping analysis are provided in terms of the accelerations, displacements, and the stresses at each node. The overall values at each node were obtained by combining the results for all three orthogonal directions using the Square Root of the Sum of Squares (SRSS) method. Adjustment factors were calculated using the maximum endurance stress values and the guidance of 2009 ASME O&M-S/G, Part 3 (OM-3) [3] and the maximum stress values from the piping analysis for each of the maximum alternating stress intensity locations.

Allowable displacement (mils peak-peak, primary) and acceleration (g's-peak, secondary) limits at the selected measurement locations were calculated based on the analysis results and ASME endurance stress limits for steady state vibration per OM-3. The primary acceptance criteria are in terms of displacement, which is proportional to pipe stress. The secondary criteria, when provided, are in terms of acceleration, which are native units to transducers used for monitoring.

Flow Induced Vibration Attachment 13 Page 4 The MS displacement and acceleration limits are applicable for vibration frequencies up to 250 Hz, which covers the frequency range in which the most significant structural displacement responses are expected, as well as safety relief valve and safety valve standpipe frequencies.

Piping displacements due to excitation frequencies above 50 Hz are typically insignificant relative to the lower frequency displacements, and thus significant piping displacements at safety relief valve standpipe frequencies are not expected.

The vibration monitoring locations were selected based on the vibration response from the modal analysis results, composite vibration displacements and effective vibration accelerations that occurred at these points relative to other locations. The measurement locations were also selected such that the general overall piping vibration responses would be sufficiently reflected and the effects of significant vibration would not be missed. Symmetry between trains, loops and units was considered to remove unnecessary redundancy and to minimize the overall number of analyses performed while selecting a representative number of monitoring locations.

The EPU vibration monitoring locations determined for the MS and FW piping inside containment from the vibration analyses are summarized in Tables 3-1 and 3-3 for Units 2 and 3, respectively. Tables 3-2 and 3-4 provide the same information for the MS and FW piping outside containment.

Flow Induced Vibration Attachment 13 Page 5 Table 3-1 Drywell EPU Monitoring Locations for MS and FW, PBAPS Unit 2 Allowable Peak-to-System Location1 Direction Peak Description Displacement, mils MS 4 X 48 At support M2191-2-HB3, in the X (north-south) and Z MS 4 Z 32 (east-west) directions.

MS 10J X 24 At support M2191-2-HB4 in the X (north-south), Y (vertical) direction and Z MS 10J Z 22 (east-west) directions.

MS 80

___80___22 X 22 At support M2191-2-HA3 in the X (north-south), Y (vertical) and Z (east-west) directions MS 80 Z 24 MS 15 X 26 At support M2191-2-HA1 in the X (north-south), and Z MS 15 Z 94 (east-west) directions.

FW 400 X 252

_ 400 252At pipe support 6DDNL-FW 400 Y 278 H33, in the X (east-west), Y (vertical), and Z (north-400 Z 272 south) directions.

FW FW 200 X 143 At pipe support 6DDNL-FW 200 Y 40 H42, in the X (east-west), Y (vertical), and Z (north-200 Z 90 south) directions.

FW Note (1): Since the Unit 2 and 3 piping geometries are similar, only the Unit 3 piping was modeled. Therefore, the Unit 2 locations are identified with the corresponding Unit 3 node numbers.

Flow Induced Vibration Attachment 13 Page 6 Table 3-2 Turbine Building EPU Monitoring Locations for MS and FW, PBAPS Unit 2 System Location1 Direction Allowable Description Peak-to-Peak Displacement, mils MS 24 X 500 At support IDB-H10, in the X (north-south)

MS 24 Y 130 direction, Y (vertical) direction, and Z (east-MS 24 Z 284 west) direction MS 52 X 190 At support IDB-H33, in the X (north-south)

MS 52 Y 234 direction, Y (vertical) direction, and Z (east-MS 52 Z 202 west) direction MS 942 X 284 At the low point drain line branch connection to the turbine lead, in the X (north-MS 942 Z 500 south) direction and Z (east-west) direction.

MS 78 X 136 At support IDB-H77, in the X (north-south) direction MS 78 Y 216 and Y (vertical) direction MS 922 X 126 At the low point drain line branch connection to the turbine lead, in the X (north-MS 922 Z 500 south) direction and Z (east-west) direction.

FW 59 Y 294 At support 2-6DD-S2, in the Y (vertical) and Z (east-FW 59 Z 276 west) directions FW 175 X 306 At support 2-6DD-H71 in the X (north-south) and Y FW 175 Y 398 (vertical) directions FW 310 Y 336 At support 2-6DD-H15 in the Y (vertical) and Z (east-FW 310 Z 330 west) directions

Flow Induced Vibration Attachment 13 Page 7 FW 435 X 216 At support 2-18GF-H372, in the X (north-south) and Z FW 435 Z 286 (east-west) directions Note 1: Since the Unit 2 and 3 piping geometries are similar, only the Unit 3 piping was modeled. Therefore, the Unit 2 locations are identified with the corresponding Unit 3 node numbers.

Flow Induced Vibration Attachment 13 Page 8 Table 3-3 Drywell EPU Monitoring Locations for MS and FW, PBAPS Unit 3 Allowable Peak-to-System Location Direction Peak Description Displacement, mils MS 4 X 48 At support M2191-3-HB3, in the X (north-south) and Z MS 4 Z 32 (east-west) directions.

MS 10J X 24

_0 __24At support M2191-3-HB4 in the X (north-south), Y (vertical) direction and Z MS 10J Z 22 (east-west) directions.

MS 80 X 22 At support M2191-3-HA3 in the X (north-south), Y (vertical) and Z (east-west) directions.

MS 80 Z 24 MS 15 X 26 At support M2191-3-HA1 in the X (north-south), and Z MS 15 Z 94 (east-west) directions FW 400 X 252

__ 400___252 At pipe support 3-6DDNL-FW 400 Y 278 H33, in the X (east-west), Y (vertical), and Z (north-400 Z 272 south) directions FW FW 200 X 143

_ _ 200_____143At pipe support 3-6DDNL-FW 200 Y 40 H42, in the X (east-west), Y (vertical), and Z (north-200 Z 90 south) directions.

FW

Flow Induced Vibration Attachment 13 Page 9 Table 3-4 Turbine Building EPU Monitoring Locations for MS and FW, PBAPS Unit 3 System Location Direction Allowable Peak-to- Description Peak Displacement, mils MS 24 X 500 In the X (north-south) direction, Y (vertical)

MS 24 Y 130 direction, and Z (east-west) direction, at support 3-lDB-MS 24 Z 284 H10 MS 52 X 190 In the X (north-south) direction, Y (vertical)

MS 52 Y 234 direction, and Z (east-west) direction, at support 3-1DB-MS 52 Z 202 H33 MS 942 X 284 In the X (north-south) direction and Z (east-west) direction, at the low point MS 942 Z 500 drain line branch connection to the turbine lead MS 78 X 136 In the X (north-south) direction and Y (vertical) direction, at support 3-lDB-MS 78 Y 216 H77 MS 922 X 126 In the X (north-south) direction and Z (east-west) direction, at the low point MS 922 Z 500 drain line branch connection to the turbine lead FW 59 Y 294 at support 3-6DD-$2, in the Y (vertical) and Z (east-west)

FW 59 Z 276 directions FW 175 X 306 at support 3-6DD-H71 in the X (north-south) and Y FW 175 Y 398 (vertical) directions FW 310 Y 336 at support 3-6DD-H15 in the

Flow Induced Vibration Attachment 13 Page 10 Y (vertical) and Z (east-west)

FW 310 Z 330 directions FW 435 X 216 at support 3-18GF-H372, in the X (north-south) and Z FW 435 Z 286 (east-west) directions

Flow Induced Vibration Attachment 13 Page 11 3.2.2 CD, ES and HD Piping (Turbine Building)

Significant flow increases occur in portions of the condensate, extraction steam and heater drain systems as a result of EPU. Monitoring locations were selected on the basis of percent flow increase due to EPU, projected EPU flow rates, piping configuration and similarity between trains and units.

Condensate:

The condensate system experiences flow increases similar to FW as a result of EPU. Two locations between the 5 th stage feedwater heaters and the reactor feedwater pumps were selected for EPU vibration monitoring in each Unit. Those locations experience the highest percent increase (14%) in flow rates under EPU conditions.

Extraction Steam:

The extraction steam system will experience the most significant flow increases in the piping from the high pressure (HP) turbine to the 5 th stage feedwater heaters and the piping from the low pressure (LP) turbine to the 3 rd stage feedwater heaters. The flow velocity increases to the 5 th and 3 rd stage heaters are 21% and 33 %, respectively.

The extraction steam lines from the HP turbine to the 5 th stage feedwater heaters will be instrumented with accelerometers at two locations in each Unit. The extraction steam lines from the LP turbine to the 3 rd stage feedwater heaters will be instrumented with accelerometers at three locations in each Unit.

Heater Drain:

The heater drain system will experience the most significant flow increases (35%) in the normal drain piping between the 4 th and 5th stage feedwater heaters. Because, the piping configurations of the three trains are similar, only the drain piping between the 'A' 4 th and 5 th stage feedwater heaters is selected for monitoring. This piping will be instrumented with accelerometers at three locations in each Unit.

Allowable displacement limits at the selected measurement locations were calculated using the acceptance criteria delineated in ASME O&M-S/G Part 3 [3].

The EPU vibration monitoring locations determined for the condensate, extraction steam and heater drain piping for Units 2 and 3 are summarized in Tables 3-5 and 3-6 respectively.

Flow Induced Vibration Attachment 13 Page 12 Table 3-5 Turbine Building EPU Monitoring Locations for CD, ES and HD, PBAPS Unit 2 System Location' Direction Allowable Peak-to-Peak Description Displacement, mils CD 95 X 500 CD 95 Y337 At support 2-18GFH-238 CD 95 Z 500 CD 930 X 417 CD 930 Y 1721GF-6 At support 2-18GFH-261 CD 930 Z 389 ES 42 X 500 ES 42 Y500 At1G-6 support 2-16GA-H-60 ES 42 Z 500 ES 23D X 397 ES 230 Y 329 At1G-5 support 2-16GA-H51 ES 23D Z 500 ES 174 X 209 At Support 2-174 Y 305 16HA-H33 ES ES 74 Y 231 At Support 2-ES 74 Z 144 IH-2 16HA-H27 ES 117 X 500Atupr2 ES 117 Z 311 HD 110 X 500 At support 2-110 Z 500 17GE-H9 HD

Flow Induced Vibration Attachment 13 Page 13 HD 140 Y 70 At support 2-17GE-394 HD 40 X 332 At support 2-40 Z 64 17GE-H2 HOD Note 1: Since the Unit 2 and 3 piping geometries are similar, only the Unit 3 piping was modeled. Therefore, the Unit 2 locations are identified with the corresponding Unit 3 node numbers.

Flow Induced Vibration Attachment 13 Page 14 Table 3-6 Turbine Building EPU Monitoring Locations for CD, ES and HD, PBAPS Unit 3 System Location 'Direction Allowable Peak-to-Peak Description Displacement, mils CD 95 X 500 At support 3-18GFH-238 CD 95 Z 500 CD 930 X 413 CD 930 Y 252 At support 3-18GFH-260-A CD 930 Z 473 ES 42 X 500 ES 42 Y 500 At support 3-16GA-H60 ES 42 Z 500 ES 23D X 397 D329 At support 3-16GA-H51 ES 23D Z 500 ES 174 X 209 At support 3-16HA-174 Z 305 H33 ES ES ES___ 74 Y 231 74__231At support 3-16HA-74 Z 144 H27 ES ES 117 X 500 At support 3-16HA-117 Z 311 H33 ES HO 110 X 500 At support 3-17GF-110 Z 500 H9 HD

Flow Induced Vibration Attachment 13 Page 15 HD 140 Y 70 At support 3-17GF-H394 HOD 40 X 332 At support 3-17GF-Z 64 H2 HD 40

Flow Induced Vibration Attachment 13 Page 16 3.2.3 MS Components (Drywell and Steam Tunnel)

PBAPS operating history indicates that excessive component vibrations are not expected at EPU conditions. In order to provide confirmation that component vibrations will be within acceptable limits at EPU conditions, selected components will be instrumented with accelerometers. The selected components include two safety-relief valves (SRV), one spring safety valve (SSV), two main steam isolation valves (MSIV) and one motor operated valve (MOV) each for the reactor core isolation cooling (RCIC) turbine steam supply line and the high pressure coolant injection (HPCI) turbine steam supply line. Both the RCIC and HPCI lines are attached to the MS piping. The EPU component vibration monitoring locations are summarized in Table 3-7. Vibration acceptance criteria for the selected locations will be based on valve seismic qualification reports as well as on the past experience and test data.

Flow Induced Vibration Attachment 13 Page 17 Table 3-7 EPU Component Monitoring Locations, PBAPS Units 2 and 3 Allowable Valve RMS System ID Direction Acceleration, Description g's MS X 0.30 RV- Dresser SSV on 70A MSL A MS Z 0.30 MS X 0.15 MS RV- y 0.35 Target Rock SRV 71E on MSL B MS Z 0.15 MS X 0.15 MS RV- Y 0.35 Target Rock SRV 71K on MSL D MS Z 0.15 MS X 0.15 MS AO-80 Y 0.10 MLMSIV on Inboard 80D MSL D MS X 0.15 MS AO-80 Y 0.10 ML MSIV on Outboard 86D MSL D MS Z 0.15 HPCI X 0.40 HPCI MO-15 0.60MO Inboard HPCI 15 MOV HPCI Z 0.40 RCIC MO- X 0.40 Inboard RCIC

Flow Induced Vibration Attachment 13 Page 18

Flow Induced Vibration Attachment 13 Page 19 3.3 Data Acquisition and Reduction Methodology The accelerometer data will be collected during EPU power ascension at pre-determined power levels using two PC-based digital data acquisition systems (DAS's). One DAS will be located in the reactor building and another DAS will be located in the turbine building. Each data set will be recorded using a minimum sample rate of 2000 samples per second per channel for a minimum duration of two minutes.

The raw time history data for each power level will be processed for comparison to applicable acceptance criteria. The data processing will include integration, determination of peak, peak-to-peak and root mean square (rms) values, and high and low pass filtering, as applicable for specific monitoring locations and acceptance criteria bases. Additional data processing, such as frequency analysis, will be performed to aid data analysis, as required.

4.0

SUMMARY

A confirmatory test program will be implemented to perform vibration monitoring during power ascension to EPU conditions. Piping and attached components on systems experiencing significant flow increases as a result of EPU will be included in the monitoring program. Piping vibration acceptance criteria will be based on ASME OM-SIG Part 3. Component vibration acceptance criteria will be based on component-specific dynamic characteristics and industry experience. Small bore piping assessments will be performed to identify potentially susceptible configurations, and any modifications required to reduce vibration susceptibility will be made prior to EPU power ascension.

Monitoring of inaccessible piping and components will be accomplished using accelerometers wired to data acquisition systems located in the reactor and turbine buildings. Accessible piping included in the monitoring program will be monitored either remotely or by performing visual observations and by taking vibration measurements using hand-held vibration instruments during power ascension to EPU conditions.

5.0 REFERENCES

1. BWR Owners' Group EPU Committee, "Extended Power Uprate (EPU) Lessons Learned and Recommendations", NEDO-33159 Revision 2, December 2008, BWR Owners' Group EPU Committee.

2. GE Nuclear Energy, "Constant Pressure Power Uprate," Licensing Topical Report NEDC-33004P-A, Revision 4, Class III (Proprietary), July 2003; and NEDO-33004, Class I (Nonproprietary), July 2003.

3. ASME OM-S/G, Standards and Guides for Operation and Maintenance of Nuclear Power Plants, Part 3, 2009 Edition, "Requirements for Preoperational and Initial Start-up Vibration Testing of Nuclear Power Plant Piping Systems."

Attachment 14 Peach Bottom Atomic Power Station Units 2 and 3 NRC Docket Nos. 50-277 and 50-278 EPU Related Changes to TSTF-493 Instrument Setpoints

EPU Related Changes for Attachment 14 TSTF - 493 Instrument Setpoints Page 1 Purpose The purpose of this Attachment is to (1) describe adhe-'rence to Technical Specification Task Force (TSTF) - 493, Revision 4 for LSSS setpoints changed by the EPU; (2) provide an overview of the safety system setpoint control program pertaining to EPU; and (3) provide the NRC staff with the calculation for a setpoint impacted by EPU and annotated in accordance with the TSTF - 493, Revision 4 in fulfillment of an NRC request for a sample calculation. This request came in a public meeting on December 7, 2011 (see Summary of December 7, 2011 Meeting With Exelon Re: Proposed Amendment Request to Implement Extended Power Uprate (ML120270288))

TSTF - 493 Revision 4 Adherence for EPU-Chanaed Setpoints The requirements of 10 CFR 50.36 for safety-related LSSS functions are provided in RIS 2006-17 and further clarified by TSTF.- 493, Revision 4. Attachment A to TSTF - 493, Revision 4 identifies the setpoint functions under Option A that are to be annotated with the TSTF - 493 notes to the Technical Specifications or Bases unless an exception is taken in accordance with TSTF - 493, Section 4.0, Technical Analysis. For the EPU License Amendment request, Exelon applies the TSTF - 493 notes and completes the supporting setpoint and uncertainty calculations for setpoints that meet the following criteria:

" They are changed by the EPU;

" They are identified in Attachment A to TSTF - 493,

• They do not fall under one of the exclusions described in TSTF - 493, Revision 4, Section 4.0 (Technical Analysis)

There are three Peach Bottom setpoints that meet these criteria and are annotated in accordance with TSTF-493, Revision 4. They are:

• Average Power Range Monitor Simulated Thermal Power - High

" Main Steam Line Flow - High.

• Main Steam Line Pressure - Low The Torus High Level Swapover Setpoint is also being changed as part of the EPU LAR (see Enclosure 9e of Attachment 9). However, this setpoint is based on an instrument that derives its input from a float switch with no associated sensor or adjustable device and is therefore excluded from application of the notes.

Calculations for Selected Instrument Attachment 14 Setpoint Revisions and Implementation of Page 2 TSTF-493 Revision 4 The TSTF-493 notes use site-specific terminology. The following is the relationship of the site terminology to that of TSTF-493:

Nominal Trip Setpoint (NTSP) is the site term for the TSTF - 493 Limiting Trip Setpoint (LTSP).

It is a predetermined limiting value for the trip setpoint so that the trip or actuation will occur before the Analytical Limit is reached, regardless of the process or environmental conditions affecting the instrumentation. This value is determined by calculation. The actual calibrated setpoint may be more conservative than the calculated NTSP obtained from the setpoint calculation.

Actual Trip Setpoint (ATSP) is the site term for the TSTF-493 Nominal Trip Setpoint (NTSP).

The ATSP is a predetermined value that is established by providing additional margin above and beyond any considerations accounted for in determining the Peach Bottom Nominal Trip Setpoint (NTSP). When no additional margin is desired, the ATSP is equivalent to the site NTSP. The ATSP is the value to which the field bistable devices are calibrated.

Leave Alone Zone (LAZ) is the site term equivalent to the TSTF-493 As-Left Tolerance (ALT).

The LAZ is a range of acceptable values around a nominal value established by adding or subtracting the required accuracy from the nominal value. When an instrument reading (cardinal point of calibration or trip setpoint) is found within this band during Surveillance Testing or calibration checks, no calibration adjustment is required. In special cases, the LAZ can be established as a non-uniform band around the nominal value. In surveillance procedures this can be called the Acceptable Limit.

Average Power Range Monitor Simulated Thermal Power - High The following notes are added to the channel calibration surveillance in the Surveillance Requirements column of the Average Power Range Monitor Simulated Thermal Power - High setpoint (Technical Specification Table 3.3.1.1-1 Item 2.b)

1. If the as-found channel setpoint is outside its predefined as-found tolerance, then the channel shall be evaluated to verify that it is functioning as required before returning the channel to service.

2. The instrument channel setpoint shall be reset to a value that is within the Leave Alone Zone (LAZ) around the Nominal Trip Setpoint (NTSP) at the completion of the surveillance; otherwise, the channel shall be declared inoperable. Setpoints more conservative than the NTSP are acceptable provided that the as-found tolerance and LAZ apply to the actual setpoint implemented in the Surveillance procedures to confirm channel performance. The NTSP methodologies used to determine the as-found tolerance and the LAZ are specified in the Bases associated with the specified function.

Main Steam Line Flow - High and Main Steam Line Pressure - Low The Surveillance Requirements Technical Specification Bases for Main Steam Line Flow - High (Technical Specification Table 3.3.6.1-1 Item 1.c) and Main Steam Line Pressure - Low (Technical Specification Table 3.3.6.1-1 Item 1.b) shall be modified with the addition of the following statement to surveillances that include verification of the setpoint:

Calculations for Selected Instrument Attachment 14 Setpoint Revisions and Implementation of Page 3 TSTF-493 Revision 4 "There is a plant specific program which verifies that this instrument channel functions as required by verifying the as-left and as-found settings are consistent with those established by the setpoint methodology."

The markups to the Technical Specifications and Technical Specification Bases related to these setpoints can be found in Attachments 2 and 3 to this EPU LAR, respectively.

Overview The instrument setpoint methodology currently implemented at PBAPS is based on the GEH Instrument Setpoint Methodology specified in NEDC-31336P-A, General Electric Instrument Setpoint Methodology (Proprietary). This methodology is procedurally-controlled and performed only by qualified personnel.

Setpoint calculations begin by identifying the applicable Safety or Design Limit. The effects of transient overshoot, response times, and any modeling uncertainties are taken into account to obtain the Analytical Limit. Exelon calculates setpoints from the Analytical Limit, establishing margins between the Analytical Limit and the Allowable Value based on performance specifications for instruments being used. Independent instrument uncertainties are quantified, and then combined using the square-root-of-the-sum-of-the-squares method. Other non-device uncertainties are added algebraically.

There is additional margin based on loop drift that is applied between the Allowable Value and the Nominal Trip Setpoint. Additional margin may be assigned between the Nominal Trip Setpoint and the Actual Trip Setpoint that takes into account the instrument As-Found Tolerance (AFT) and Leave Alone Zone, and any unique requirements for that device. If no additional margin is required, then the Actual Trip Setpoint is equal to the Nominal Trip Setpoint. The LAZ or ALT and the AFT are always around the ATSP.

At the start of each calibration, instruments controlled by Technical Specifications are declared inoperable and removed from service. Upon completion, the Operations Shift Supervisor or Manager reviews the results of the surveillance and determines whether the results are acceptable based on Technical Specification operability requirements prior to returning the instrument to service.

During calibration checks, ifthe as-found setpoint is outside the Leave Alone Zone, the condition is documented for trending purposes and appropriate corrective actions are taken before the instrument is returned to service. Once actions have been taken to correct the condition, the instrument setpoint is reset to as close to the Actual Trip Setpoint value as practicable (i.e. within the Leave Alone Zone) and the instrument is returned to service. For cases in which the as-found setpoint value is within its Leave Alone Zone, the instrument is adjusted if desirable to as close to the Actual Trip Setpoint value as practicable.

At PBAPS, trip setpoints are typically verified via channel calibration procedures.

Calculations for Selected Instrument Attachment 14 Setpoint Revisions and Implementation of Page 4 TSTF-493 Revision 4 Calculations The following calculation, provided as Enclosure 14a to this Attachment, is a sample of the setpoint calculations associated with EPU related Technical Specification setpoint changes.

PE-0251 (Enclosure 14a) - includes the calculations for Allowable Value, Nominal Trip Setpoint, As-Left Tolerance and As-Found Tolerance for the Average Power Range Monitor Simulated Thermal Power - High as a result of EPU related changes.