ML13330A953

From kanterella
Jump to navigation Jump to search
Enclosure 4, Attachments 3, 4 and 5, Reactor Trip System (RTS) and Engineered Safety Fatures Actuation System (ESFAS) Instrumentation Completion Times, Bypass Times, and Surveillance Test Interval Extensions Based On..
ML13330A953
Person / Time
Site: Sequoyah  Tennessee Valley Authority icon.png
Issue date: 11/22/2013
From:
Tennessee Valley Authority
To:
Office of Nuclear Reactor Regulation
Shared Package
ML13329A881 List:
References
CAW-13-3823, LTR-RAM-I-13-032, Rev 1 NP, NUREG-1431, Rev 4 WCAP-10271, WCAP-14333, WCAP-15376
Download: ML13330A953 (68)


Text

ENCLOSURE 4 ATTACHMENTS 3, 4, AND 5 TENNESSEE VALLEY AUTHORITY SEQUOYAH NUCLEAR PLANT, UNITS 1 AND 2 Reactor Trip System (RTS) and Engineered Safety Features Actuation System (ESFAS) Instrumentation Completion Times, Bypass Times, and Surveillance Test Interval Extensions Based on WCAP-10271, WCAP-14333, and WCAP-15376 NON-PROPRIETARY VERSIONS AND AFFADAVIT FOR WITHHOLDING

WESTINGHOUSE NON-PROPRIETARY CLASS 3 Attachment 3 LTR-RAM-I-13-032, Rev. 1 NP-Attachment

SUMMARY

REPORT REV. 1 Sequoyah Nuclear Plant, Units 1 and 2 Implementation of Master and Slave Relays Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 Westinghouse Electric Company LLC 1000 Westinghouse Drive Cranberry Township, PA 16066

© 2013 Westinghouse Electric Company LLC All Rights Reserved

Attachment 3 Westinghouse Non-Proprietary Class 3

SUMMARY

REPORT Rev. 1 Sequoyah Nuclear Plant, Units 1 and 2 Implementation of Master and Slave Relays Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 1.0 Purpose The purpose of the program is to provide the technical justification for implementation of the master and slave relays Completion Time (CT) and Surveillance Test Interval (STI) changes justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 (References 1 and 2, respectively) for the Sequoyah Nuclear Plant (SQN) Units 1 and 2.

2.0 Background Information The NRC approved the following Technical Specification (TS) changes for the master and slave relays justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 for the engineered safety features actuation signals (ESFAS) (TS 3.3.2, ESFAS Instrumentation) for a solid state protection system (SSPS):

WCAP-14333-P-A, Rev. 1 Master relays:

CT from 6 hrs to 24 hrs Slave relays:

CT from 6 hrs to 24 hrs WCAP-15376-P-A, Rev. 1 Master relays:

STI from 2 months to 6 months The other TS changes justified in these WCAPs have already been addressed for SQN Units 1 and 2 in Rev. 2 of the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev.

1 and WCAP-15376-P-A, Rev. 1 summary report. Currently, SQN Units 1 and 2 ESFAS TS (3/4.3.2) do not include the master and slave relays; therefore, there are no CTs or Surveillance Requirements (SRs) included in the TS for the master and slave relays. Tennessee Valley Authority (TVA) is in the process of converting the SQN Units 1 and 2 TS to the Standard TS (NUREG-1431). NUREG-1431 includes the actuation relays (master and slave relays). Therefore, following implementation of NUREG-1431, the SQN Units 1 and 2 TS will also include the actuation relays, including the Actions and SRs associated with them.

Note that the surveillance frequency for the slave relays contained in NUREG-1431 is 92 days (quarterly), and is bracketed, which means that the frequency must be adopted or another frequency must be justified on a plant-specific basis. TVA is responsible for determining and justifying the slave relay surveillance frequency, since it was not justified in WCAP-15376-P-A, Rev. 1.

1 September 26, 2013

Attachment 3 Implementation of these master and slave relays changes requires the licensee to address the Conditions and Limitations in the NRCs Safety Evaluations for each WCAP.

For WCAP-14333-P-A, Rev. 1 this requires:

1. Confirmation of the applicability of the WCAP-14333-P-A, Rev. 1 analysis to the plant
2. Address Tier 2 and 3 requirements For WCAP-15376-P-A, Rev. 1 this requires:
1. Confirm the applicability of the WCAP-15376-P-A, Rev. 1 analysis to the plant
2. Address Tier 2 and 3 requirements
3. Address concurrent testing of one logic cabinet and associated reactor trip breaker (RTB) (not applicable to implementing the changes for the master and slave relays)
4. Confirm the modeling assumptions for the human reliability assessment are applicable Implementation Guidelines have previously been developed for each WCAP (References 3 and 4) and were followed in the program.

Tier 2 requirements provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when equipment is out of service. These requirements place limitations on additional equipment that can be removed from service when in one of the risk-informed extended CTs.

Tier 3 ensures that risk significant out-of-service equipment is evaluated prior to performing any maintenance activities. Tier 3 evaluations are addressed by the plants Configuration Risk Management Program used to comply with 10CFR50.65(a)(4) and are out of scope of this program.

An additional commitment included in the Implementation Guidelines for WCAP-15376-P-A, Rev. 1 addresses setpoint uncertainty calculations and assumptions, including instrument drift. This commitment is not applicable to the master and slave relays.

In addition, monitoring requirements for the changes implemented were developed and an assessment of how external events impact the WCAP results was addressed. These are not Conditions or Limitations in the Safety Evaluations, but the NRC has requested this information for plants previously requesting the changes in these two WCAPs.

The scope of this project also includes a review of any unresolved Facts and Observations (F&Os) from the latest peer reviews of the SQN Units 1 and 2 PRA models to assess the potential impact on implementaion of the proposed changes. The main purpose of this task is to be consistent with Regulatory Guide (RG) 1.200. Although consistency of the SQN Units 1 and 2 internal events PRA with RG 1.200 is not an implementation requirement specified in Conditions and Limitations of the Safety Evaluations, the NRC has requested this information in previous submittals.

3.0 Summary of Results The following provides a summary of the results for each task in the program. Documents including SQNs Updated Final Safety Analysis Report (UFSAR), TS and Bases, Auxiliary Feedwater (AFW) system notebook, implementation report for previous TS changes, and survey of information letter from TVA were used to support this program.

2 September 26, 2013

Attachment 3 3.1 Task 1: Demonstrate Applicability of WCAP-14333-P-A, Rev. 1 and Tier 2 Limitations The following demonstrates the applicability of the WCAP-14333-P-A, Rev. 1 analysis and results to SQN Units 1 and 2 and also provides the Tier 2 limitations.

3.1.1 Applicability of WCAP-14333-P-A, Rev. 1 Tables 1 through 3 demonstrate that the WCAP-14333-P-A, Rev. 1 analysis and results are applicable to SQN Units 1 and 2. Additional explanatory information is provided in the Notes and Explanations at the end of each table as necessary.

From this the following is concluded for both units:

The signals available at SQN Units 1 and 2 to actuate safeguards equipment for the various events are consistent with those credited in the WCAP-14333-P-A, Rev. 1 analysis.

The current master and slave relays test intervals at the SQN Units 1 and 2 are equal to or greater than those used in the WCAP-14333-P-A, Rev. 1 analysis.

The master and slave relays at-power maintenance intervals at the SQN Units 1 and 2 are consistent with those assumed in the WCAP-14333-P-A, Rev. 1 analysis.

From this it is concluded that the WCAP-14333-P-A, Rev. 1 analysis is consistent with SQN Units 1 and 2 design and operation, and the master and slave relays changes justified in WCAP-14333-P-A, Rev. 1 are applicable to SQN Units 1 and 2.

The calculated increase in CDF for all the changes specified in WCAP-14333-P-A, Rev. 1, as provided in Table 8.4 of the WCAP, is 3.5E-07/yr for plants with predominately 2-of-4 logic requirements and 6.1E-07/yr for plants with predominately 2-of-3 logic. The calculated increase in LERF due to all the changes in WCAP-14333-P-A, Rev. 1, as provided in Table Q13.1 of the WCAP, is 2.0E-08/yr for plants with predominately 2-of-4 logic requirements and 2.2E-08/yr for plants with predominately 2-of-3 logic. Note that the CDF and LERF impact are expected to be less than the noted values from WCAP-14333-P-A, Rev. 1 since this specific assessment only addresses changes to the master and slave relays. Per Regulatory Guidance (RG) 1.174, Rev. 2 (Reference 5), for a total CDF of 1E-04/yr, changes to CDF of 1E-06/yr are acceptable; and for a total LERF of 1E-05/yr, changes to LERF of 1E-07/yr are acceptable. The SQN CDFs for internal events are 1.59E-05/yr (Unit 1) and 1.48E-05/yr (Unit 2) and LERFs for internal events are 2.20E-06/yr (Unit 1) and 2.23E-06 (Unit 2); therefore, this is consistent with the guidelines in RG 1.174, Rev. 2 that allows small increases in CDF and LERF.

From this it is concluded that implementing the master and slave relays changes justified in WCAP-14333-P-A, Rev. 1 will have an impact on CDF of less than 1.0E-06/yr and on LERF of less than 1.0E-07/yr which meets the guidance in RG 1.174, Rev. 2.

The master and slave relays changes in WCAP-14333-P-A, Rev. 1 are applicable to all of the engineered safety feature actuation functional units except for those discussed in Section 3.8 of the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report.

3 September 26, 2013

Attachment 3 Table 1 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters WCAP-14333-P-A, Rev. 1 Parameter Plant Specific Parameter Analysis Assumptions Logic Cabinet Type (1) Relay or SSPS SSPS Component Test Intervals (2)

Analog channels 3 months Addressed in previous report Logic cabinets (SSPS) 2 months Addressed in previous report Logic cabinets (Relay) 1 month Not Applicable Master Relays (SSPS) 2 months 2 months Master Relays (Relay) 1 month Not Applicable Slave Relays 3 months 18 months Reactor trip breakers 2 months Addressed in previous report Analog Channel Calibrations (3)

Done at-power Yes Addressed in previous report Interval 18 months Addressed in previous report Typical At-Power Maintenance Intervals (4)

Analog channels 24 months Addressed in previous report Logic cabinets (SSPS) 18 months Addressed in previous report Logic cabinets (Relay) 12 months Not Applicable Master relays (SSPS) Infrequent (5) Infrequent Master relays (Relay) Infrequent (5) Not Applicable 4 September 26, 2013

Attachment 3 Table 1 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters WCAP-14333-P-A, Rev. 1 Parameter Plant Specific Parameter Analysis Assumptions Slave relays Infrequent (5) Infrequent Reactor trip breakers 12 months Addressed in previous report ATWS Mitigation System Actuation Circuitry (AMSAC) (6) Credited for AFW pump start Yes Not required for the proposed changes Total Transient Event Frequency (7) 3.6/yr since the reactor trip signals are not impacted Not required for the proposed changes ATWS Contribution to CDF (current PRA model) (8) 8.4E-06/yr since the reactor trip signals are not impacted 1.59E-05 (Unit 1);

Total CDF from Internal Events (current PRA model) (9) 5.8E-05/yr 1.48E-05 (Unit 2)

Total CDF from Internal Events (IPE) (10) Not Applicable 1.26E-05/yr Notes for Table 1:

1. Indicate type of logic cabinet: SSPS or Relay (both are included in WCAP-14333-P-A, Rev. 1).
2. Fill in applicable test intervals. If the test intervals are equal to or greater than those used in WCAP-14333-P-A, Rev. 1, the analysis is applicable to your plant.
3. Indicate if channel calibration is done at-power and, if so, fill in the interval. If channel calibrations are not done at-power or if the calibration interval is equal to or greater than that used in WCAP-14333-P-A, Rev. 1, the analysis is applicable to your plant.
4. Fill in the applicable typical maintenance intervals or fill in equal to or greater than or less than. If the maintenance intervals are equal to or greater than those used in WCAP-14333-P-A, Rev. 1, the analysis is applicable to your plant.

5 September 26, 2013

Attachment 3

5. Only corrective maintenance is done on the master and slave relays. The maintenance interval on typical relays is relatively long, that is, experience has shown they do not typically completely fail. Failure of slave relays usually involves failure of individual contacts. Fill in infrequent if this is consistent with your plant experience. If not, fill in the typical maintenance interval. If infrequent slave relay failures are the norm, then the WCAP-14333-P-A, Rev. 1 analysis is applicable to your plant.
6. Indicate if AMSAC will initiate AFW pump start. If yes, then the WCAP-14333-P-A, Rev. 1 analysis is applicable to your plant.
7. Include total frequency for initiators requiring a reactor trip signal to be generated for event mitigation. This is required to assess the importance of ATWS events to CDF. Do not include events initiated by a reactor trip.
8. Fill in the ATWS contribution to core damage frequency (from at-power, internal events). This is required to determine if the ATWS event is a large contributor to CDF.
9. Fill in the total CDF from internal events (including internal flooding) for the most recent PRA model update. This is required for comparison to the NRCs risk-informed CDF acceptance guidelines.
10. Fill in the total CDF from internal events from the IPE model (submitted to the NRC in response to Generic Letter 88-20). If this value differs from the most recent PRA model update CDF provide a concise list of reasons, in bulletized form, describing the differences between the models that account for the change in CDF. The issue being addressed with the list of reasons was to provide to the NRC Staff reviewers an understanding of the difference in CDF from the IPE model to the current PRA model since the last time the plant PRA model was assessed by the NRC for technical adequacy was during the IPE review.

With the peer review process now in place, the NRC gets a more recent understanding of the technical adequacy of the PRA model to support the proposed change via a discussion of the open F&Os that could impact the proposed change.

6 September 26, 2013

Attachment 3 Table 2 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of Analysis, Reactor Trip Actuation Signals Since Table 2 of the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report addressed the reactor trip actuation signals and the master relays and slave relays do not impact reactor trip signals, this table is not required to demonstrate the applicability of the analysis for the proposed changes on master and slave relays.

7 September 26, 2013

Attachment 3 Table 3 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of Analysis, ESFAS a,c 8 September 26, 2013

Attachment 3 Table 3 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of Analysis, ESFAS a,c 9 September 26, 2013

Attachment 3

[

]a,c 10 September 26, 2013

Attachment 3 3.1.2 Tier 2 Limitation The Tier 2 (Avoidance of Risk-Significant Plant Configurations) requires an examination of the need to impose additional restrictions when operating in the proposed CTs in order to avoid risk-significant equipment outage configurations.

In support of Tier 2 limitations, analyses were completed in response to the NRC Request for Additional Information (RAI) (OG-96-110, Reference 6) regarding WCAP-14333-P-A, Rev. 1.

RAI #18 in Reference 6 asked for other risk significant systems or components for the proposed test or maintenance plant configuration. To support the response to this RAI, analyses were completed to determine the system importance for plant configurations with no test or maintenance activities (all components available), and for plant configurations with test or maintenance activities individually on the analog channels, logic cabinets, master relays, and slave relays. A system importance results summary for these configurations is provided in Table Q18.1 of Reference 6. It was observed that the risk significant systems did not change considerably with master relay or slave relay out of service, with respect to the base case (no test or maintenace activities in progress).

In addition, RAI #11 in Reference 6 requested CDFs for the various test and maintenance configurations that the plant would enter for the subject Allowed Outage Time (AOT) extensions.

Conditional core damage frequencies and core damage probabilities were calculated for each of the possible test and maintenance configurations. The summary of results is provided in Table Q11.1 of Reference 6. From the information in Table Q11.1, it was observed that the impact on CDF with the master relay or slave relay in maintenance (out of service) was small, with respect to the base case (no component out for test or maintenance).

Therefore, it is concluded that there are no Tier 2 limitations when a slave relay or master relay is out-of-service.

3.2 Task 2: Develop Monitoring Requirements for WCAP-14333-P-A, Rev. 1 Implementation Monitoring Program:

The purpose of performance monitoring program is to ensure that no unexpected adverse safety degradation occurs because of the proposed change. As stated in RG 1.174, Rev. 2, The staffs principal concern is the possibility that the aggregate impact of changes that affect a large class of SSCs could lead to an unacceptable increase in the number of failures from unanticipated degradation. The monitoring programs should include a means to adequately track the performance of equipment that, when degraded, can affect the conclusions of the licensees engineering evaluation and integrated decision making that support the change to the licensing basis. The program should be capable of trending equipment performance after a change has been implemented to demonstrate that performance is consistent with that assumed in the traditional engineering and probabilistic analyses that were conducted to justify the change. The RG discussion continues The program should be structured such that (1)

SSCs are monitored commensurate with their safety importance, i.e., monitoring for SSCs categorized as having low safety significance may be less rigorous than that for SSCs of high safety significance. Therefore, monitoring requirements need to be developed for parameters of equipment important to the implemented changes and these monitoring requirements can be commensurate with their importance to safety. The monitoring program 11 September 26, 2013

Attachment 3 needs to be directed at the unavailability of the master and slave relays due to the proposed CTs changes.

Key Assumptions in WCAP-14333-P-A, Rev. 1:

The following are the key assumptions in WCAP-14333-P-A, Rev. 1 that are of importance to the monitoring program for the master and slave relays.

Testing on a slave relay impacts only the specific relay.

Maintenance on a slave relay impacts only the specific relay.

Testing of a master relay impacts the train of the protection system (Train A or B) with which it is associated.

Maintenance of a master relay impacts the specific master relay and the slave relays it actuates.

WCAP-14333-P-A, Rev. 1 Unavailability Times:

From Table 5.1 of WCAP-14333-P-A, Rev. 1, the following 18 months unavailability due to test and maintenance are assumed for the master and slave relays:

Master relays (unavailability due to test and maintenance):

Test unavailability = 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> x 9 tests/18 months = 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />s/18 months Maintenance unavailability = very small due to low failure probability of the relays (Relay failure rate is 5.29E-07 failures/hour per page 7-4 of WCAP-14333-P-A, Rev. 1)

Total master relay unavailability = 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />s/18 months (for each master relay)

Slave relays (unavailability due to test and maintenance):

Test unavailability = 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> x 6 tests/18 months = 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s/18 months Maintenance unavailability = very small due to low failure probability of the relays (Relay failure rate is 5.29E-07 failures/hour per page 7-4 of WCAP-14333-P-A, Rev. 1)

Total slave relay unavailability = 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s/18 months (for each slave relay)

Based on the unavailability times calculated above, the suggested monitoring requirements for the master and slave relays over an 18-month rolling window are summarized in Table 4. If these unavailability limits are exceeded, then the reasons for the failures need to be evaluated to determine if the analysis supporting the TS change to extend the CTs from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> remains valid. This can be done via either qualitative methods or a quantitative sensitivity analysis. Note that exceeding these limits on occasion will not invalidate the results, but if these limits are exceeded on a regular basis or by a significant amount during a single monitoring period (18 months), then action should be taken to resolve potential component performance problems.

12 September 26, 2013

Attachment 3 Table 4 Summary of Monitoring Requirements Unavailability Time Component Interval Limit Master Relay 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> 18 months Slave Relay 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 18 months Note that development of monitoring requirements is not specified in the Limitations and Conditions of the Safety Evaluation, but the NRC has requested this information recently from a plant implementing this WCAP.

3.3 Task 3: Assessment of Impact from External Events for WCAP-14333-P-A, Rev. 1 The analysis supporting the changes in WCAP-14333-P-A, Rev. 1 did not include external events. Although this is not an implementation requirement specified in the Limitations and Conditions of the Safety Evaluation, the NRC has requested information on the external event impact from plants recently requesting these changes. The external event assessment is provided in Section 3.6 in conjunction with the WCAP-15376-P-A, Rev. 1 external event assessment.

3.4 Task 4: Demonstrate Applicability of WCAP-15376-P-A, Rev. 1 The following demonstrates the applicability of the WCAP-15376-P-A, Rev. 1 analysis and results to SQN Units 1 and 2, and addresses the Conditions and Limitations in the Safety Evaluation. This includes:

Demonstrate the applicability of the analysis and results to SQN Units 1 and 2 (Condition and Limitation 1)

Demonstrate the applicability of the component failure probabilities for the master relays (Condition and Limitation 1)

Address containment failure assessment (Condition and Limitation 1)

Develop Tier 2 limitations (Condition and Limitation 2)

Address concurrent testing of one logic cabinet and associated RTB (Condition and Limitation 3). This requirement was already addressed in the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report and is not applicable to the proposed changes to the surveillance frequency of the master relays in WCAP-15376-P-A, Rev. 1.

Confirm modeling assumptions for human reliability assessment (Condition and Limitation 4) 13 September 26, 2013

Attachment 3 3.4.1 Applicability of WCAP-15376-P-A, Rev. 1 Tables 2, 3 and 5 demonstrate that the WCAP-15376-P-A, Rev. 1 analysis and results are applicable to SQN Units 1 and 2. Note that Tables 2 and 3 are the same for implementation of WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1.

From this the following is concluded for both units:

[

]a,c From this it is concluded that the WCAP-15376-P-A, Rev. 1 analysis is consistent with SQN Units 1 and 2 design and operation, and the master relays test interval change justified in WCAP-15376-P-A, Rev. 1 is applicable to SQN Units 1 and 2.

The calculated increase in CDF for all the changes specified in WCAP-15376-P-A, Rev. 1, as provided in Table 8.29 of the WCAP, is 8.0E-07/yr for plants with predominately 2-of-4 logic requirements and 8.5E-07/yr for plants with predominately 2-of-3 logic. The calculated increase in LERF due to all the changes in WCAP-15376-P-A, Rev. 1, as provided in Table 8.32 of the WCAP, is 3.1E-08/yr for plants with predominately 2-of-4 logic requirements and 5.7E-08/yr for plants with predominately 2-of-3 logic. Note that the CDF and LERF impact are expected to be less than the noted values from WCAP-15376-P-A, Rev. 1 since this specific assessment only addresses changes to the master and slave relays. Per RG 1.174, Rev. 2, for a total CDF of 1E-04/yr, changes to CDF of 1E-06/yr are acceptable; and for a total LERF of 1E-05/yr, changes to LERF of 1E-07/yr are acceptable. The SQN CDFs for internal events are 1.59E-05/yr (Unit 1) and 1.48E-05/yr (Unit 2) and LERFs for internal events are 2.20E-06/yr (Unit 1) and 2.23E-06 (Unit 2); therefore, this is consistent with the guidelines in RG 1.174, Rev. 2 that allows small increases in CDF and LERF.

From this it is concluded that implementing the master relay change justified in WCAP-15376-P-A, Rev. 1 will have an impact on CDF of less than 1.0E-06/yr and on LERF of less than 1.0E-07/yr which meets the guidance in RG 1.174, Rev. 2.

The master relays change in WCAP-15376-P-A, Rev. 1 are applicable to all of the engineered safety feature actuation functional units except for those discussed in the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report.

14 September 26, 2013

Attachment 3 Table 5 WCAP-15376-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters a,c 15 September 26, 2013

Attachment 3 Table 5 WCAP-15376-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters a,c 16 September 26, 2013

Attachment 3

[

]a,c 17 September 26, 2013

Attachment 3 3.4.2 Applicability of the Master Relays Failure Probabilities

[

]a,c The SQN Units 1 and 2 plant-specific information on the master relays were collected from 2004 to 2011. The results showed that over the eight year period, there were 5030 master relays actuations and zero failures recorded. A summary of the experience for the master relays at SQN is provided in Table 6 below.

Table 6 SQN Units 1 and 2 Master Relays Reliability Parameter Master Relays Actuations 5030 Failures 0

[

]a,c 3.4.3 Address Containment Failure Assessment

[

]a,c 18 September 26, 2013

Attachment 3

[

]a,c 19 September 26, 2013

Attachment 3

[

]a,c Therefore, from this conservative calculation, the LERF impact of the increased signal unavailabilities related to DCH is very small. Note that generic values from WCAP-15376-P-A, Rev. 1 were used in this calculation rather than SQN plant specific values to keep this consistent with the WCAP analysis. The applicability of WCAP-15376-P-A, Rev. 1 to SQN has already been demonstrated in earlier sections of this report.

3.4.4 Develop Tier 2 Limitations - Limitation and Condition 2 Since the proposed change in WCAP-15376-P-A, Rev. 1 only extends the master relays STI and does not impact bypass test time or CT, Tier 2 and Tier 3 requirements are not applicable.

3.4.5 Concurrent Testing of One Logic Cabinet and Associated Reactor Trip Breaker -

Limitation and Condition 3 As stated in Section 3.4, this requirement was already addressed in the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report and is not applicable to the proposed changes to the surveillance frequency of the master relays in WCAP-15376-P-A, Rev. 1.

3.4.6 Confirm Modeling Assumptions for Human Reliability Assessment - Limitation and Condition 4 Table 7 provides a summary of the operator actions credited in the WCAP-15376-P-A, Rev. 1 analysis and the ability of these actions to be successful at SQN Units 1 and 2. All actions are credited at both SQN units with plant procedures in place and all actions are effective.

Table 7: WCAP-15376-P-A, Rev. 1 Implementation Guidelines:

Applicability of the Human Reliability Analysis a,c 20 September 26, 2013

Attachment 3 This demonstrates that the WCAP-15376-P-A, Rev. 1 results are applicable to SQN Units 1 and 2.

3.5 Task 5: Develop Monitoring Requirements for WCAP-15376-P-A, Rev. 1 Implementation Monitoring requirements are required on the master relays with an extended STI to ensure the component FP for the extended STI used in the analysis remains applicable. The FP of the master relays used in the WCAP-15376-P-A, Rev. 1 analysis to justify the changes to the master relays STI is 3.30E-05.

The approach used to develop monitoring requirements involved the use of a binomial distribution to calculate an acceptable number of failures that support the FP used in the analysis. Then the actual actuations and failures can be compared to this and assessed if the FP used in the analysis is supported by the plant experience.

Based on this assessment, for the master relays, 0 or 1 failure would be expected depending on the number of actuations.

3.6 Task 6: Assessment of Impact from External Events for WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 The analysis supporting the changes in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 did not include external events. Although this is not an implementation requirement specified in the Limitations and Conditions of the Safety Evaluation, the NRC has requested information on the external event impact from plants previously requesting these changes.

External events assesments have already been addressed in the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report and still remains applicable for this program.

The external event analysis discussed in the Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 summary report considered the potential risk impact of the proposed changes due to seismic, fire, high winds, external flooding, and transportation and nearby facility accidents. The assessment used information from the SQN Individual Plant Examination for External Events (IPEEE). For each of these external events, the risk impact of the increased signal unavailabilities due to the implementation of the proposed changes was assessed and the acceptability of the change determined.

The seismic assessment considered seismically induced events that required actuation signals to initiate safety systems for event mitigation. LOOP and small LOCAs were identified as the events of interest, and the signals of interest were the SI and AFW start signals. It was concluded from this assessment that the impact on CDF and LERF is very small.

The fire assessment was based on the fire areas/rooms that were not screened out in the IPEEE assessment and required a quantitative assessment. The signals required for event mitigation and the increase in signal unavailability for these signals determined. This was then used to calculate the increase in CDF for each fire area/room which were summed for the total CDF impact. The LERF impact was calculated similarly with consideration given to containment 21 September 26, 2013

Attachment 3 bypass, core damage followed by containment isolation failure, and containment pressure challenges. It was concluded from this assessment that the impact on CDF and LERF is small.

The remaining external events were addressed qualitatively. It was concluded that the increase in signal unavailabilities due to the proposed changes has no impact on plant risk due to the low probability of the postulated events, some are not credible hazards, and since the signals play no role in mitigation of these types of events.

Based on this assessment it was concluded that the impact of the proposed change on plant risk from external events was small and meets the acceptance criteria in RG 1.174.

3.7 Task 7: Consistency with Regulatory Guide 1.200, Rev. 2 Only limited information from the SQN PRA model is used in the implementation of WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1. This information is related to:

Total CDF and LERF from internal events - this is required for comparison to the NRCs risk-informed CDF acceptance guidelines in RG 1.174, Rev. 2.

All other information required for implementation of these WCAPs, such as signals available to actuate mitigation equipment for the various initiating events, is based on the plant design and plant procedures. In addition, the applicability of FP for the master relays and the assessment of containment failure mechanisms unique to ice condenser containments are addressed separately in this assessment. Therefore, the assessments are not dependent on the PRA model.

The F&Os from the latest peer review of the SQN Units 1 and 2 PRA models were reviewed along with the TVA resolutions. All of the F&Os have been addressed. As a result, there are no impacts of unresolved peer review F&Os on implementing the proposed changes at SQN.

4.0 Conclusions The following provides a summary of the conclusions of the program:

The master and slave relays TS changes proposed in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 and the supporting analyses are applicable to SQN Units 1 and 2. The applicability of WCAP-15376-P-A, Rev. 1 test interval change is dependent on the required confirmation noted below.

There are no Tier 2 limitations from these proposed changes.

Monitoring requirements related to unavailability were identified for the master and slave relays.

Monitoring requirement related to component reliability was identified for the master relays.

The impact of the proposed changes on risk from external events is very small and will not impact the acceptability of the master and slave relays TS changes justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1.

22 September 26, 2013

Attachment 3 The impacts on LERF related to hydrogen combustion and DCH due to the increased signal unavailabilities are negligible.

The human reliability analysis of the WCAP-15376-P-A, Rev. 1 is applicable to SQN Units 1 and 2.

There are no impacts of unresolved peer review F&Os on this application.

Required Confirmation by TVA: One key parameter is the test time for the master relays. The current TS of SQN Units 1 and 2 do not address master relay testing. There are currently no time restrictions for testing or bypass on master relays. In order to maintain applicability of the WCAP-15376-P-A, Rev. 1 analysis to SQN Units 1 and 2, the bypass test time specified in the new SQN TS must be equal to or less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

5.0 References

1. WCAP-14333-P-A, Rev. 1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, October 1998.
2. WCAP-15376-P-A, Rev. 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, March 2003.
3. WOG-98-245, Implementation Guideline for WCAP-14333-P-A, Rev. 1 (Proprietary),

Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times (MUHP-3054), December 2, 1998.

4. WOG-04-233, Transmittal of Revised Implementation Guidelines for WCAP-15376-P-A, Rev. 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times (MUHP-3046), May 6, 2004.
5. Regulatory Guide 1.174, Rev. 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, May 2011.
6. OG-96-110, Transmittal of Response to Request for Additional Information (RAI)

Regarding WCAP-14333-P Entitled Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, December 20, 1996.

7. WCAP-16341-P, Rev. 0, Simplified Level 2 Modeling Guidelines, WOG Project:

PA-RMSC-0088, November 2005.

23 September 26, 2013

WESTINGHOUSE NON-PROPRIETARY CLASS 3 Attachment 4 LTR-RAM-I-13-032, Rev. 1 NP-Attachment

SUMMARY

REPORT REV. 2 Sequoyah Nuclear Plant, Units 1 and 2 Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 Westinghouse Electric Company LLC 1000 Westinghouse Drive Cranberry Township, PA 16066

© 2013 Westinghouse Electric Company LLC All Rights Reserved

Attachment 4 Westinghouse Non-Proprietary Class 3

SUMMARY

REPORT Rev. 2 Sequoyah Nuclear Plant, Units 1 and 2 Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 1.0 Purpose The purpose of the program is to:

Provide the technical justification for implementation of the completion time (CT), bypass test time, and surveillance test interval (STI) changes justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 (References 1 and 2, respectively) for Sequoyah Nuclear Plant (SQN),

Units 1 and 2.

Provide marked-up SQN Technical Specifications (TS) and Bases to reflect the changes justified in the above WCAPs.

2.0 Background Information The NRC approved the following TS changes justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 for the reactor trip actuation signals (TS 3.3.1, RTS Instrumentation) and engineered safety features actuation signals (TS 3.3.2, ESFAS Instrumentation) for a solid state protection system:

WCAP-14333-P-A, Rev. 1 Analog channels:

CT from 6 hrs to 72 hrs Bypass test time from 4 hrs to 12 hrs Although not a TS requirement, at-power channel calibration was evaluated with an unavailability of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> per channel.

Logic Cabinets: CT from 6 hrs to 24 hrs Master Relays: CT from 6 hrs to 24 hrs Slave Relays: CT from 6 hrs to 24 hrs WCAP-15376-P-A, Rev. 1 Analog channels: STI from 3 months to 6 months Logic cabinets: STI from 2 months to 6 months Master Relays: STI from 2 months to 6 months 1 September 26, 2013

Attachment 4 Reactor trip breakers:

CT from 1 hr to 24 hrs Bypass test time from 2 hrs to 4 hrs STI from 2 months to 4 months Implementation of these changes requires the licensee to address the Conditions and Limitations in the NRCs Safety Evaluation for each WCAP. For WCAP-14333-P-A, Rev. 1 this requires:

1. Confirm the applicability of the WCAP-14333-P-A, Rev. 1 analysis to the plant
2. Address Tier 2 and 3 requirements For WCAP-15376-P-A, Rev. 1 this requires:
1. Confirm the applicability of the WCAP-15376-P-A, Rev. 1 analysis to the plant
2. Address Tier 2 and 3 requirements
3. Address concurrent testing of one logic cabinet and associated reactor trip breaker
4. Confirm the modeling assumptions for the human reliability assessment are applicable Implementation Guidelines have previously been developed for each WCAP (References 3 and 4) and were followed in the program.

Tier 2 requirements provide reasonable assurance that risk-significant plant equipment outage configurations will not occur when equipment is out of service. These requirements place limitations on additional equipment that can be removed from service when in one of the risk-informed extended CTs.

Tier 3 ensures that risk significant out-of-service equipment is evaluated prior to performing any maintenance activities. Tier 3 evaluations are addressed by the plants Configuration Risk Management Program used to comply with 10CFR50.65(a)(4) and are out of scope of this program.

An additional commitment included in the Implementation Guidelines for WCAP-15376-P-A, Rev. 1 addresses setpoint uncertainty calculations and assumptions, including instrument drift. Addressing this commitment is also out of scope of this program.

In addition, monitoring requirements for the changes implemented were developed and an assessment of how external events impact the WCAP results was addressed. These are not Conditions or Limitations in the Safety Evaluations, but the NRC has requested this information for plants recently requesting the changes in these two WCAPs.

The scope of this project also includes:

1. An assessment of the Regulatory Guide (RG) 1.200 SQN PRA model peer review level A and B Facts and Observations to determine their potential impact on implementation of the proposed changes.
2. TS mark-ups to reflect the changes made by implementing WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev . 1.

Note that the SQN TS do not contain requirements for master and slave relays. Therefore, changes to the STIs and CTs for these relays are not included in the following.

2 September 26, 2013

Attachment 4 3.0 Summary of Results The following provides a summary of the results for each task in the program. Documents including SQNs Updated Final Safety Analysis Report (UFSAR), TS, system notebooks, and letters from TVA were used to support this program.

3.1 Task 1: Demonstrate Applicability of WCAP-14333-P-A, Rev. 1 and Tier 2 Limitations The following demonstrates the applicability of the WCAP-14333-P-A, Rev. 1 analysis and results to SQN Units 1 and 2 and also provides the Tier 2 limitations.

3.1.1 Applicability of WCAP-14333-P-A, Rev. 1 Tables 1 through 3 demonstrate that the WCAP-14333-P-A, Rev. 1 analysis and results are applicable to SQN Units 1 and 2. Additional explanatory information is provided in the Notes and Explanations at the end of each table as necessary.

From this the following is concluded for both units:

The signals available to actuate reactor trip for the various events are consistent with those credited in the WCAP analysis.

The signals available to actuate safeguards equipment for the various events are consistent with those credited in the WCAP analysis.

The current analog channel, logic cabinet, and reactor trip breaker test intervals are based on WCAP-10271 (with Supplements 1 and 2), which provide the base case in the WCAP analysis, and are consistent with the WCAP analysis.

The analog channel, logic cabinet, and reactor trip breaker maintenance intervals are consistent with those assumed in the WCAP.

From this it is concluded that the WCAP-14333-P-A, Rev. 1 analysis is consistent with SQN Units 1 and 2 design and operation, and the changes in WCAP-14333-P-A, Rev. 1 are applicable to SQN Units 1 and 2.

The calculated increase in core damage frequency (CDF) for all the changes specified in WCAP-14333-P-A, Rev. 1, as provided in Table 8.4 of the WCAP, is 3.5E-07/yr for plants with predominately 2-of-4 logic requirements and 6.1E-07/yr for plants with predominately 2-of-3 logic. The calculated increase in large early release frequency (LERF) due to all the changes in WCAP-14333-P-A, Rev. 1, as provided in Table Q13.1 of the WCAP, is 2.0E-08/yr for plants with predominately 2-of-4 logic requirements and 2.2E-08/yr for plants with predominately 2-of-3 logic. Per Regulatory Guidance (RG) 1.174, Rev. 2 (Reference 5), for a total CDF of 1E-04/yr, changes to CDF of 1E-06/yr are acceptable; and for a total LERF of 1E-05/yr, changes to LERF of 1E-07/yr are acceptable. The updated SQN CDFs for internal events are 1.59E-05/yr (Unit 1) and 1.48E-05/yr (Unit 2), and LERFs for internal events are 2.20E-06/yr (Unit 1) and 2.23E-06 (Unit 2); therefore, this is consistent with the guidelines in RG 1.174, Rev. 2 that allows small increases in CDF and LERF.

From this it is concluded that implementing the changes in the WCAP will have an impact on CDF of less than 1.0E-06/yr and on LERF of less than 1.0E-07/yr which meets the guidance in RG 1.174.

3 September 26, 2013

Attachment 4 The changes in WCAP-14333-P-A, Rev. 1 are applicable to all of the reactor trip and engineered safety feature actuation functional units except for those discussed in Section 3.8.

4 September 26, 2013

Attachment 4 Table 1 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters WCAP-14333-P-A, Rev. 1 Parameter Plant Specific Parameter Analysis Assumptions Logic Cabinet Type (1) Relay or SSPS Solid State Protection System (SSPS)

Component Test Intervals (2)

Analog channels 3 months 92 days / 3 months 31 days on a Staggered Test Basis /

Logic cabinets (SSPS) 2 months 2 months Logic cabinets (Relay) 1 month Not Applicable Not Required by TS Master Relays (SSPS) 2 months (See Explanation 1)

Master Relays (Relay) 1 month Not Applicable Not Required by TS Slave Relays 3 months (See Explanation 1) 31 days on a Staggered Test Basis /

Reactor trip breakers 2 months 2 months Analog Channel Calibrations (3)

Done at-power Yes Yes Interval 18 months 18 months Typical At-Power Maintenance Intervals (4)

Analog channels 24 months Greater Than Logic cabinets (SSPS) 18 months Greater Than Logic cabinets (Relay) 12 months Not Applicable Master relays (SSPS) Infrequent (5) Infrequent Master relays (Relay) Infrequent (5) Not Applicable Slave relays Infrequent (5) Infrequent Reactor trip breakers 12 months Greater Than Anticipated Transient Without Scram (ATWS) Mitigation Credited for Auxiliary Feedwater Yes System Actuation Circuitry (AMSAC) (6) (AFW) pump start 5 September 26, 2013

Attachment 4 Table 1 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters WCAP-14333-P-A, Rev. 1 Parameter Plant Specific Parameter Analysis Assumptions Total Transient Event Frequency (7) 3.6/yr 6.1E-01/reactor-year (both units) 2.67E-07/yr (Unit 1);

ATWS Contribution to CDF (current PRA model) (8) 8.4E-06/yr 2.84E-07/yr (Unit 2) 1.59E-05/yr (Unit 1);

Total CDF from Internal Events (current PRA model) (9) 5.8E-05/yr 1.48E-05/yr (Unit 2)

Total CDF from Internal Events (IPE) (10) Not Applicable 1.26E-05/yr Notes for Table 1:

1. Indicate type of logic cabinet: SSPS or Relay (both are included in WCAP-14333-P-A, Rev. 1).
2. Fill in applicable test intervals. If the test intervals are equal to or greater than those used in WCAP-14333-P-A, Rev. 1, the analysis is applicable to your plant.
3. Indicate if channel calibration is done at-power and, if so, fill in the interval. If channel calibrations are not done at-power or if the calibration interval is equal to or greater than that used in WCAP-14333-P-A, Rev. 1, the analysis is applicable to your plant.
4. Fill in the applicable typical maintenance intervals or fill in equal to or greater than or less than. If the maintenance intervals are equal to or greater than those used in WCAP-14333-P-A, Rev. 1, the analysis is applicable to your plant.
5. Only corrective maintenance is done on the master and slave relays. The maintenance interval on typical relays is relatively long, that is, experience has shown they do not typically completely fail. Failure of slave relays usually involves failure of individual contacts. Fill in infrequent if this is consistent with your plant experience. If not, fill in the typical maintenance interval. If infrequent slave relay failures are the norm, then the WCAP-14333-P-A, Rev. 1 analysis is applicable to your plant.
6. Indicate if AMSAC will initiate AFW pump start. If yes, then the WCAP-14333-P-A, Rev. 1 analysis is applicable to your plant.
7. Include total frequency for initiators requiring a reactor trip signal to be generated for event mitigation. This is required to assess the importance of ATWS events to CDF. Do not include events initiated by a reactor trip.
8. Fill in the ATWS contribution to core damage frequency (from at-power, internal events). This is required to determine if the ATWS event is a large contributor to CDF.
9. Fill in the total CDF from internal events (including internal flooding) for the most recent PRA model update. This is required for comparison to the NRCs risk-informed CDF acceptance guidelines.
10. Fill in the total CDF from internal events from the IPE model (submitted to the NRC in response to Generic Letter 88-20). If this value differs from the most recent PRA model update CDF provide a concise list of reasons, in bulletized form, describing the differences between the models that account for the change in CDF.

6 September 26, 2013

Attachment 4 Explanation 1 SQN Units 1 and 2 are not currently required to test master and slave relays by their TS. STIs and CTs for the master and slave relays are not included in the SQN TS; therefore, this will not affect the applicability of WCAP-14333-P-A, Rev. 1.

7 September 26, 2013

Attachment 4 Table 2 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of Analysis, Reactor Trip Actuation Signals a,c 8 September 26, 2013

Attachment 4

[

]a,c 9 September 26, 2013

Attachment 4

[

]a,c 10 September 26, 2013

Attachment 4 Table 3 WCAP-14333-P-A, Rev. 1 Implementation Guidelines: Applicability of Analysis, Engineered Safety Features Actuation Signals a,c 11 September 26, 2013

Attachment 4

[

]a,c 12 September 26, 2013

Attachment 4

[

]a,c 13 September 26, 2013

Attachment 4 3.1.2 Tier 2 Limitation Tier 2 limitations are only appropriate when a logic cabinet is out of service. There are no Tier 2 limitations when an analog channel is out of service. This is based on an assessment of the importance of other mitigating systems when analog channels are out of service. The Tier 2 restrictions when a logic cabinet is out of service are:

To preserve ATWS mitigation capability, activities that degrade the availability of the AFW system, Reactor Coolant System (RCS) pressure relief system (pressurizer power operated relief valves (PORVs) and safety valves), AMSAC, or Turbine Trip should not be scheduled when a logic cabinet is unavailable.

To preserve LOCA mitigation capability, one complete Emergency Core Cooling System (ECCS) train that can be actuated automatically must be maintained.

To preserve reactor trip and safeguards actuation capability, activities that cause analog channels to be unavailable should not be scheduled when a logic cabinet is unavailable.

Activities on electrical systems (e.g., AC and DC power) and cooling systems (e.g.,

Emergency Raw Cooling Water System (ERCWS) and Component Cooling Water System (CCWS) that support the systems or functions listed in the first three bullets should not be scheduled when a logic cabinet is unavailable. That is, one complete train of a function that supports a complete train of a function noted above must be available.

3.2 Task 2: Develop Monitoring Requirements for WCAP-14333-P-A, Rev. 1 Implementation The monitoring program needs to be directed at the unavailability of the components associated with the completion time and bypass test time changes. These include:

Analog channels (which includes the sensors to the bistables)

Logic Cabinets As discussed in RG 1.174, Section 2.3, monitoring programs should include a means to adequately track the performance of equipment that, when degraded, can affect the conclusions of the licensees engineering evaluation and integrated decision-making that support the change to the licensing basis. The program should be capable of trending equipment performance after a change has been implemented to demonstrate that performance is consistent with that assumed in the traditional engineering and probabilistic analyses that were conducted to justify the change. The RG discussion continues, The program should be structured such that (1)

SSCs are monitored commensurate with their safety importance, i.e., monitoring for SSCs categorized as having low safety significance may be less rigorous than that for SSCs of high safety significance Therefore, monitoring requirements need to be developed for parameters of equipment important to the implemented changes and these monitoring requirements can be commensurate with their importance to safety.

The analog channels are typically associated with m of n logic. This is, if there are n channels only m of those channels are required to trip to initiate a safety function, such as reactor trip or emergency core cooling. Therefore, redundancy is built into the design. In addition, the safety 14 September 26, 2013

Attachment 4 equipment for event mitigation for the majority of the events that are postulated to occur can be actuated by more than one set of analog channels. This is referred to as analog channel diversity and this provides diversity in the design. Furthermore, the safety equipment can be manually actuated by operator action for most events which provides a backup to the automatic actuation signals. This redundancy and diversity for analog channels reduces the safety importance of the channels and changes in component reliability can be absorbed without impacting the licensing basis change. From this it is concluded that the analog channels can be eliminated from the monitoring program. The remaining components do not have similar redundancy and/or diversity, therefore monitoring requirements will be developed for these components.

Key Assumptions in the WCAP The following are the key assumptions in the WCAP analysis related to the logic cabinets that are of importance to the monitoring program:

Testing of a logic cabinet impacts the train of the protection system (Train A or B) with which it is associated.

Maintenance of a logic cabinet impacts the train of the protection system (Train A or B) with which it is associated.

WCAP Unavailability Times Based on the WCAP, the following 18 month unavailability times are assumed in the analysis (from Table 5.1 of WCAP-14333-P-A, Rev. 1):

Logic cabinets (unavailability due to test and maintenance)

Test unavailability = 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> x 9 tests/18 months = 36 hour4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />s/18 months Maintenance unavailability = 30 hour3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />s/18 months Total logic cabinet unavailability = (36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> + 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />)/18 months = 66 hour7.638889e-4 days <br />0.0183 hours <br />1.09127e-4 weeks <br />2.5113e-5 months <br />s/18 months (for each logic cabinet)

The suggested monitoring requirements are provided in Table 4.

Table 4:

Summary of Monitoring Requirements on an Individual Component Basis Component Unavailability Time Interval Logic Cabinets(1) 66 hours7.638889e-4 days <br />0.0183 hours <br />1.09127e-4 weeks <br />2.5113e-5 months <br /> 18 months (1) Since WCAP-15376-P-A, Rev. 1 is also being implemented, the monitoring requirements in Section 3.5.2 are applicable Note that development of monitoring requirements is not specified in the Limitations and Conditions of the Safety Evaluation, but the NRC has requested this information recently from a plant implementing this WCAP.

15 September 26, 2013

Attachment 4 3.3 Task 3: Assessment of Impact from External Events for WCAP-14333-P-A, Rev. 1 The analysis supporting the changes in WCAP-14333-P-A, Rev. 1 did not include external events. Although this is not an implementation requirement specified in the Limitations and Conditions of the Safety Evaluation, the NRC has requested information on the external event impact from plants recently requesting these changes. The external event assessment is provided in Section 3.6 in conjunction with the WCAP-15376-P-A, Rev. 1 external event assessment.

3.4 Task 4: Demonstrate Applicability of WCAP-15376-P-A, Rev. 1 The following demonstrates the applicability of the WCAP-15376-P-A, Rev. 1 analysis and results to SQN Units 1 and 2, and addresses the Conditions and Limitations in the Safety Evaluation. This includes:

Demonstrate the applicability of the analysis and results to SQN Units 1 and 2 (Condition and Limitation 1)

Demonstrate the applicability of the component failure probabilities for the safeguards driver cards (Condition and Limitation 1)

Address containment failure assessment (Condition and Limitation 1)

Develop Tier 2 limitations (Condition and Limitation 2)

Address concurrent testing of one logic cabinet and associated reactor trip breaker (Condition and Limitation 3)

Confirm modeling assumptions for human reliability assessment (Condition and Limitation 4) 3.4.1 Applicability of WCAP-15376-P-A, Rev. 1 Tables 2, 3 and 5 demonstrate that the WCAP-15376-P-A, Rev. 1 analysis and results are applicable to SQN Units 1 and 2. Note that Tables 2 and 3 are the same for implementation of WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1.

From this the following is concluded for both units:

[

]a,c From this it is concluded that the WCAP-15376-P-A, Rev. 1 analysis is consistent with SQN Units 1 and 2 design and operation, and the changes in WCAP-15376-P-A, Rev. 1 are applicable to SQN Units 1 and 2.

The calculated increase in CDF for all the changes specified in WCAP-15376-P-A, Rev. 1, as provided in Table 8.29 of the WCAP, is 8.0E-07/yr for plants with predominately 2-of-4 logic requirements and 8.5E-07/yr for plants with predominately 2-of-3 logic. The calculated increase 16 September 26, 2013

Attachment 4 in LERF due to all the changes in WCAP-15376-P-A, Rev. 1, as provided in Table 8.32 of the WCAP, is 3.1E-08/yr for plants with predominately 2-of-4 logic requirements and 5.7E-08/yr for plants with predominately 2-of-3 logic. Per RG 1.174, Rev. 2, for a total CDF of 1E-04/yr, changes to CDF of 1E-06/yr are acceptable; and for a total LERF of 1E-05/yr, changes to LERF of 1E-07/yr are acceptable. The SQN CDFs for internal events are 1.59E-05/yr (Unit 1) and 1.48E-05/yr (Unit 2), and LERFs for internal events are 2.20E-06/yr (Unit 1) and 2.23E-06 (Unit 2); therefore, this is consistent with the guidelines in RG 1.174, Rev. 2 that allows small increases in CDF and LERF.

From this it is concluded that implementing the changes in the WCAP will have an impact on CDF of less than 1.0E-06/yr and on LERF of less than 1.0E-07/yr which meets the guidance in RG 1.174.

The changes in WCAP-15376-P-A, Rev. 1 are applicable to all reactor trip and engineered safety feature actuation functional units except for those discussed in Section 3.8.

17 September 26, 2013

Attachment 4 Table 5 WCAP-15376-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters a,c 18 September 26, 2013

Attachment 4 Table 5 WCAP-15376-P-A, Rev. 1 Implementation Guidelines: Applicability of the Analysis, General Parameters a,c 19 September 26, 2013

Attachment 4

[

]a,c 20 September 26, 2013

Attachment 4 3.4.2 Applicability of the Safeguards Driver Card Failure Probabilities

[

]a,c A summary of the experience for these components at SQN from 2004 to 2012 is provided in the table below.

Table 6: SQN Safeguards Reliability Safeguards Driver Cards Parameter Unit 1 and Unit 2 Actuations 772 Failures 0

[

]a,c 3.4.3 Address Containment Failure Assessment

[

]a,c 21 September 26, 2013

Attachment 4

[

]a,c 22 September 26, 2013

Attachment 4

[

]a,c Therefore, from this conservative calculation, the LERF impact of the increased signal unavailabilities related to DCH is very small.

3.4.4 Develop Tier 2 Limitations - Limitation and Condition 2 Recommended Tier 2 requirements, or restrictions, are provided in Section 8.5 of WCAP-15376-P-A, Rev. 1. These are:

The probability of failing to trip the reactor on demand will increase when a reactor trip breaker (RTB) is removed from service; therefore, systems designed for mitigating an ATWS event should be maintained available. RCS pressure relief, AFW flow (for RCS heat removal), AMSAC, and turbine trip are important to alternate ATWS mitigation. Therefore, activities that degrade the availability of the AFW system, RCS pressure relief system (pressurizer PORVs and safety valves), AMSAC, or turbine trip should not be scheduled when a RTB is out of service.

Due to the increased dependence on the available reactor trip train when one logic cabinet is removed from service, activities that degrade other components of the RPS, including master and slave relays, and activities that cause analog channels to be unavailable should not be scheduled when a RTB is unavailable.

23 September 26, 2013

Attachment 4 Activities on electrical systems (e.g., AC and DC power) that support the systems or functions listed in the first two bullets should not be scheduled when a RTB is unavailable.

As previously noted, Tier 3 analysis is outside the scope of this program. This is addressed through the plants Maintenance Rule Program.

3.4.5 Concurrent Testing of One Logic Cabinet and Associated Reactor Trip Breaker -

Limitation and Condition 3 The risk impact of concurrent testing of one logic cabinet and the associated RTB is addressed by demonstrating that the WCAP-15376-P-A, Rev. 1 analysis is applicable to SQN Units 1 and

2. The WCAP analysis assumes that if a RTB is out of service its associated logic train is also out of service. Therefore, concurrent testing is addressed in the WCAP analysis.

3.4.6 Confirm Modeling Assumptions for Human Reliability Assessment - Limitation and Condition 4 Table 7 provides a summary of the operator actions credited in the WCAP analysis and the ability of these actions to be successful at SQN Units 1 and 2. All actions are credited at both SQN units with plant procedures in place and all actions are effective.

Table 7: WCAP-15376-P-A, Rev. 1 Implementation Guidelines:

Applicability of the Human Reliability Analysis a,c This demonstrates that the WCAP results are applicable to both units.

24 September 26, 2013

Attachment 4 3.5 Task 5: Develop Monitoring Requirements for WCAP-15376-P-A, Rev. 1 Implementation The monitoring program needs to be directed at the following components as noted:

Analog channels (which includes the sensors to the bistables) - STI extension Logic Cabinets - STI extension RTB - STI extensions RTB - Completion time and bypass test time changes As discussed in Section 3.2, it is not necessary to develop monitoring requirements for the analog channels.

3.5.1 Monitoring Requirements - Component Failure Probabilities Monitoring requirements are required on the components with an extended STI to ensure the component failure probabilities for the extended STIs used in the analysis remain applicable.

The failure probabilities of the components used in the analysis to justify the changes to the STIs are provided in Table 8.

Table 8: Component Failure Probabilities Component Failure Probability (for the extended STI)

Universal logic cards 1.15E-03 Undervoltage driver cards 1.01E-03 Safeguards driver cards 1.77E-03 Reactor trip breakers 7.40E-05 The approach used to develop monitoring requirements involved the use of a binomial distribution to calculate an acceptable number of failures that support the failure probability used in the analysis. Then the actual actuations and failures can be compared to this and assessed if the failure probability used in the analysis is supported by the plant experience.

Based on this assessment, for components with a failure probability of ~2E-03 (such as the undervoltage driver cards, safeguards driver cards, and universal logic cards), 0, 1, or 2 failures would be expected depending on the number of actuations. For components with a failure probability of ~1E-04 (such as reactor trip breakers), 0 or 1 failure would be expected, again depending on the number of actuations.

3.5.2 Monitoring Requirements - Component Unavailability Component unavailability monitoring requirements are required for the reactor trip breakers and logic cabinets since these are the components in the WCAP-15376-P-A, Rev. 1 analysis that resulted in an extended test interval, completion time, and/or bypass time that could impact component availability. Since both WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 are being implemented, the monitoring requirements provided below supersede the monitoring requirements provided in Section 3.2 of this summary report for logic cabinets. As previously discussed, monitoring requirements for the analog channels are not necessary.

25 September 26, 2013

Attachment 4 The following 18 month unavailability times are assumed in the WCAP (from Table 8.7 of WCAP 15376-P-A, Rev. 1):

Reactor trip breakers (unavailability due to test and maintenance)

Test unavailability = 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> x 3 tests/yr = 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s/yr per RTB or 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />s/18 months per RTB Maintenance unavailability = 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> x 1 maintenance event/yr = 30 hour3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />s/yr or 45 hour5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />s/18 months per RTB Total unavailability = 45 hour5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />s/18 months + 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />s/18 months = 63 hour7.291667e-4 days <br />0.0175 hours <br />1.041667e-4 weeks <br />2.39715e-5 months <br />s/18 months per RTB Logic cabinets (unavailability due to test and maintenance)

Test unavailability = 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> x 3 tests/18 months = 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s/18 months Maintenance unavailability = 30 hour3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />s/18 months Total logic cabinet unavailability = (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> + 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />)/18 months = 42 hour4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br />s/18 months per logic cabinet)

The suggested monitoring requirements are provided in Table 9.

Table 9: Summary of Monitoring Requirements on an Individual Component Basis Component Unavailability Time Interval Reactor Trip Breakers 63 hours7.291667e-4 days <br />0.0175 hours <br />1.041667e-4 weeks <br />2.39715e-5 months <br /> 18 months Logic Cabinets 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> 18 months Note that development of monitoring requirements is not specified in the Limitations and Conditions of the Safety Evaluation, but the NRC has requested this information recently from a plant implementing the changes in WCAP-14333-P-A, Rev. 1.

3.6 Task 6: Assessment of Impact from External Events for WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 The analysis supporting the changes in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 did not include external events. Although this is not an implementation requirement specified in the Limitations and Conditions of the Safety Evaluation, the NRC has requested information on the external event impact from plants recently requesting these changes.

The risk related to seismic, fire, high winds, external flooding external events, and transportation and nearby facility accidents is assessed using information from the SQN Individual Plant Examinations of External Events (IPEEE) provided by TVA. The SQN IPEEE was created in response to the NRCs Generic Letter (GL) 88-20, Supplement 4. For each of these external events, the risk impact of increased signal unavailabilities due to the implementation of the TS changes justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev.1 is assessed, and the acceptability of the changes determined.

26 September 26, 2013

Attachment 4 3.6.1 Seismic The following provides the discussion of the impact of seismic events on the risk assessment as related to signal unavailability changes for the proposed TS changes. The seismic events that need to be considered are those that cause a loss of offsite power (LOOP) or a small break LOCA. Each of these events is discussed in the following with respect to the proposed TS changes. Note that larger seismic events will cause larger LOCAs, secondary side breaks, failure of support systems, etc., and also adversely impact the systems required for mitigation including the RPS. Therefore, small changes to the availability of the signals have no impact on seismic plant risk for these larger seismic events.

LOOP Events For a LOOP event, the DGs are required to start and run, AFW is required to start and run, and the seal injection system or component cooling water to the thermal barrier heat exchanger needs to continue (actually, load shed and then load back on the DG). The only signal required for this that is impacted by the proposed TS changes is the AFW pump start signal. If this signal fails, the AFW pumps can also be started by the ATWS mitigation system actuation circuitry (AMSAC). In addition, operators can start AFW pumps manually. Therefore, the impact on seismic CDF from the increased signal unavailability can be determined by:

CDF = Seismic LOOP Initiating Event (IE) Frequency x Unavailability of ESFAS signal x Operator Action (OA) failure probability x AMSAC failure where:

Seismic LOOP IE frequency = 4.77E-04/yr (based on the ceramic insulators being the limiting component which leads to a loss of offsite power)

Unavailability of ESFAS signal = 7.93E-04 (based on WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1)

Operator action to initiate AFW failure probability = 2.70E-05 (from the SQN HRA notebook)

AMSAC failure probability = 0.01 (from WCAP-15831-P-A, Rev. 2, Reference 6)

This results in a CDF increase of 1.02E-13/yr, which is an extremely small impact on CDF. If it is very conservatively assumed that the total CDF increase results in a large early release, then the LERF impact is also very small.

Small Break LOCA Events With a small break LOCA, the Emergency Core Cooling System (ECCS) is required to provide inventory control via coolant injection, and then recirculation. Since the ceramic insulators on the off-site power supplies are the seismically limiting component, if a seismically induced small LOCA occurs, then offsite power will also be lost. That is, a higher level seismic event is required to cause a small LOCA than a LOOP. The level of the seismic event would also need to be low enough not to fail any mitigating equipment. If the level of the seismic event is high enough such that all trains of mitigating systems fail, such as the ECCS or DGs, then the event is assumed to proceed to core damage. Under this higher seismic level scenario, implementing the proposed changes does not result in an increase in risk since the mitigation systems fail whether or not they are available. But for the scenario in which a seismic event causes a small break LOCA and LOOP, but does not fail any mitigation equipment, the availability of the SI signal needs to be considered and the proposed TS changes can result in a change in plant risk 27 September 26, 2013

Attachment 4 from seismically initiated small LOCAs. This risk change, in terms of CDF, can be calculated as follows:

CDF = Seismic Induced Small LOCA IE Freq x Unavailability of SI signal w/OA x OA failure probability (via individual components)

The value for the Unavailability of SI signal w/OA parameter improves, that is, the unavailability decreases with the proposed changes. This is based on signal unavailabilities provided in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1. Therefore, the CDF assessment will show a CDF reduction. It is not necessary to determine the other parameters in the CDF equation since this provides a benefit. Since the CDF is reduced, the LERF impact will also be very small.

From this it is concluded that the CDF and LERF changes are small and meet the acceptance criteria in RG 1.174.

3.6.2 Fire TVA applied the EPRI FIVE methodology to assess the fire aspect of the Individual Plant Examination for Fires at the SQN. A screening process was used to assess and identify the areas important to fire risk for quantitative evaluation. These steps are:

1. Fire Compartment Interaction Analysis
2. Ignition Source Data Sheets
3. Safe Shutdown Path Unavailability
4. Zone of Influence
5. Detailed PSA Evaluation During each phase, fire areas/rooms were screened out of further evaluation. Document SQN-IPEEE-005 provides the quantitative assessment of the areas/rooms not screened out.

Fifty-nine areas/rooms required a quantitative assessment. These are:

Turbine Building - 1 Room ERCW Intake Pumping Station - 5 Rooms Fuel Area Transfer Room - 1 Room Diesel Generator Rooms - 4 Rooms Auxiliary Building - 37 rooms Control Building - 11 rooms General Approach Step 1: Identify the rooms (listed above) as required for this quantitative analysis and determine the fire IE frequency.

Step 2: Determine the actuation signals required for event mitigation for this evaluation.

Step 3: Determine the increase in signal unavailability for the signals identified in Step 2.

Following this, the CDF impact is determined by multiplying the fire area/room frequency by the increase in signal unavailability. Finally, each individual CDF value is added to determine the fire CDF increase.

28 September 26, 2013

Attachment 4 The actuation signals required, as determined in Step 2, are for AFW start for decay heat removal and reactor trip for reactivity control. These are discussed in the following.

Decay Heat Removal One important function for mitigating a transient event initiated by a fire event is decay heat removal. Decay heat removal can be performed by recovery of the main feedwater system if it is lost, AFW, and feed and bleed. Main feedwater is not credited following a fire event since there is a relatively large amount of equipment required which could be lost due to the fire, so conservatively it is not credited. AFW and feed and bleed are credited. Since this assessment is directed at increased signal unavailabilities related to the proposed TS changes, the following discusses the alternate methods to start the AFW system and the backup to the AFW system, in case the signals fail, for decay heat removal.

AFW Start: For a transient event in which main feedwater is lost, most transient events, AFW will be started on steam generator level low-low. If this signal fails and the event degrades, then other signals may be available to actuate AFW, such as an SI signal. AFW can also be started by operator action from the control room and by AMSAC.

If AFW fails to start due to failure of the above signals, or due to failure of the AFW system itself, then operators can initiate feed and bleed for decay heat removal.

CDF = Fire IE Frequency x Unavailability of ESFAS signal x OA to initiate AFW failure probability x AMSAC and feed and bleed failure probability Where:

Fire IE frequency = 1.43E-01/yr for areas crediting 2 ESFAS trains and 2.47E-01/yr for areas crediting 1 ESFAS train (based on 59 fire areas/rooms provided. Fires in the ERCW Intake Pumping Station, Fuel Area Transfer Room, and Diesel Generator Rooms will not impact the RPS or power to the RPS. Fires in the Turbine Building, Auxiliary Building Areas, and Control Building could contain electrical components or cable routing that could impact the RPS. It is conservatively assumed that only one ESFAS train will be available for fires in buildings that could impact the ESFAS or RPS. As a result, fire events in the Turbine Building, Auxiliary Building, and Control Building can only credit one train of ESFAS equipment. Fires in the ERCW Intake Pumping Station, Fuel Transfer Area, and Diesel Generator Rooms can credit both trains of ESFAS equipment)

Unavailability of ESFAS signal = 7.93E-04 for 2/3 logic with 2 trains and 1.00E-03 for 2/3 logic with 1 train (based on WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1)

Operator action to initiate AFW failure probability = 2.70E-05 AMSAC and feed and bleed failure probability = 0.1 (conservative value)

The total increase in fire CDF due to the proposed change related to decay heat removal is 9.73E-10/yr.

With regard to the LERF impact, consideration was given for the following contributors:

Steam generator tube rupture (SGTR) bypass events Interfacing systems LOCA bypass events Core damage event followed by failure of containment isolation Containment pressure challenges via hydrogen burns or direct containment heating 29 September 26, 2013

Attachment 4 SGTR events related to reactor coolant system over-pressurization This assessment resulted in a LERF increase, related to decay heat removal, of 1.94E-12/yr.

Reactivity Control For a fire event, reactivity control requires a reactor trip. The reactor trip requires either an automatic actuation signal or an operator action to trip the reactor if the automatic signal fails and the control rods fail to insert. Since fire events are addressed as a transient event, the reactor trip signal will be provided by a diverse set of signals (analog channels) with an operator action backup to trip the reactor from the control room.

Based on a reactor trip signal unavailability increase of 2.5E-06 (from WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1), a fire frequency of 3.9E-01/yr (SQN IPEEE), and SQN ATWS conditional core damage probability (CCDP) of 9.44E-02, an increase in ATWS CDF related to the proposed changes is 9.2E-08/yr.

A LERF assessment, similar to that discussed above for the decay heat assessment, provides an increase in LERF of 1.83E-10/yr.

Summing the CDF and LERF contributions from decay heat removal and reactivity control provides CDF and LERF increases of 9.3E-08/yr and 1.85E-10/yr, respectively. From this it is concluded that the CDF and LERF changes are small and meet the acceptance criteria in RG 1.174.

3.6.3 Other External Events The SQN IPEEE was reviewed to identify vulnerabilities from external events including high winds, external flooding, and transportation and nearby facility accidents. Other external events such as lightning, severe temperature transients, severe weather storms, and external fires, were also considered. These were eliminated from further consideration since they were either already accounted for in the internal events PRA model, the relatively slow development of the event, or due to spatial considerations. For the external events not initially eliminated, the importance of reactor trip and engineered safety features actuation signals was assessed.

These are discussed in the following.

3.6.4 High Winds High winds were screened out based on a qualitative assessment of the design of SQN with regard to tornado resistance. Vulnerabilities were identified as the openings on the roof of the diesel generator building. A bounding analysis was completed to assess potential CDF from tornado generated missiles on the diesel generator building. The probability of missiles entering the diesel generator building through the opening and causing sufficient damage to equipment was conservatively determined to be less than 1E-06/yr. Since the tornado could also cause loss of offsite power, the plant could be in a station blackout situation for a significant length of time. Reactor trip and ESF actuation signals play no role in this core damage scenario; therefore, it is concluded that the small increases in signal unavailabilities have no impact on plant risk due to high wind events.

30 September 26, 2013

Attachment 4 3.6.5 External Flooding A qualitative external flooding assessment examined the maximum water levels predicted due to external floods. Due to plant design features all equipment required for operation in the flood mode is either above the design basis flood level or designed for submerged operation.

Therefore, due to the Flood Protection Plan which combines the flood warning and design of certain systems and equipment to function under submerged conditions, external flooding was screened from further consideration. It is concluded from this that the small increases in reactor trip and ESF actuation signal unavailabilities have no impact on plant risk since these actuation systems play no role in protecting the plant against external floods.

3.6.6 Transportation and Nearby Facility Accidents The SQN IPEEE assessed the conformance of SQN to the IPEEE criteria. Key to these external events are plant siting and design. These hazards were previously evaluated during the plant licensing stage. Due to spatial considerations, distance from the plant to hazards, and conformance with applicable regulatory guides and standard review plans, it was concluded that there are no credible hazards posed to the plant from transportation or nearby facility accidents.

Therefore, it is concluded that the small increases in reactor trip and ESF actuation signal unavailabilities have no impact on plant risk since these actuation systems play no role in protecting the plant against transportation and nearby facility accidents.

3.7 Task 7: Consistency with Regulatory Guide 1.200 Assessment of Impact of F&Os on Implementation of WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 Only limited information from the SQN PRA model is used in the implementation of WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1. This information is related to:

Total transient event frequency - this is required to assess the importance of ATWS events to CDF.

ATWS contribution to CDF - this is required to determine if the ATWS event is a large contributor to CDF.

Total CDF and LERF from internal events - this is required for comparison to the NRCs risk-informed CDF acceptance guidelines in RG 1.174.

All other information required for implementation of these WCAPs, such as signals available to actuate mitigation equipment for the various initiating events, is based on the plant design and plant procedures. In addition, the applicability of failure probabilities for SSPS boards and the assessment of containment failure mechanisms unique to ice condenser containments are addressed separately in this assessment, i.e., the assessments are not dependent on the PRA model.

The Findings and Observations (A and B level) from the SQN PRA Peer Review were reviewed along with the TVA resolution. The following was concluded:

31 September 26, 2013

Attachment 4 Total transient event frequency - There were findings directed at the loss of component cooling system and loss of essential raw cooling water, in addition to documentation. None of these findings impact the transient event frequency. One additional finding was related to the vintage of the generic database used. TVA responded that NUREG/CR-5750 was used which is consistent with the recommended solution from the Peer Review Team.

ATWS contribution to CDF - No findings impacted this parameter.

Total CDF and LERF from internal events - A number of the findings could impact the internal events CDF. TVA responded to the F&Os that either changes were implemented in the model to address the findings, or concluded the findings will not have a significant impact on total CDF or it provided a conservative assessment.

Based on the review, it is concluded that none of the F&Os will impact implementation of the proposed TS changes.

3.8 SQN TS Sections 3.3.1 and 3.3.2 Signals / Instrumentation Not Addressed by the WCAPs TS 3.3.1 and 3.3.2 were reviewed to identify the functions addressed and not addressed in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1. The following lists the signals that were not evaluated in the WCAPs. A brief reason why they were not evaluated is provided.

TS 3.3.1: Reactor Trip System Instrumentation

14. Main Steam Generator Level - low-low A. SG Water Level - low-low (Adverse)

B. SG Water Level - low-low (EAM)

C. RCS Loop T D. Containment Pressure (EAM)

Reason - WCAPs evaluated changes to SG water level without modifiers (Adverse, EAM, TTD).

19. Safety Injection Input from ESF Reason - Need to assess the specific component that provides the signal to the RTBs.

TS 3.3.2: Engineered Safety Features Actuation System Instrumentation 3.c. Containment Isolation - Containment Ventilation Isolation

3) Containment Purge Air Exhaust Monitor Radioactivity - High Reason - Exhaust monitor radioactivity not explicitly modeled in the WCAPs
6. Auxiliary Feedwater c.i. Main Steam Generator Level - low-low - Start Motor-Driven Pumps c.i.a. SG Water Level - low-low (Adverse) c.i.b. SG Water Level - low-low (EAM) c.i.c. RCS Loop T 32 September 26, 2013

Attachment 4 c.i.d. Containment Pressure (EAM) c.ii. Main Steam Generator Level - low-low - Start Turbine-Driven Pumps c.ii.a. SG Water Level - low-low (Adverse) c.ii.b. SG Water Level - low-low (EAM) c.ii.c. RCS Loop T c.ii.d. Containment Pressure (EAM)

Reason - WCAPs evaluated changes to SG water level without modifiers (Adverse, EAM, TTD).

6.e. Loss of Power Start

1. Voltage Sensors Reason - Not clear why the STI is monthly.
9. Automatic Switchover to Containment Sump
a. RWST Level - Low coincident with Containment Sump Level - High and SI
b. Automatic Actuation Logic Reason - Switchover was not addressed for any configuration.

4.0 Conclusions The following provides a summary of the conclusions of the program:

The changes proposed in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1 and the supporting analyses are applicable to SQN Units 1 and 2.

Tier 2 limitations are only required when a logic cabinet or a RTB is out of service.

Monitoring requirements related to unavailability were identified for the RTBs and logic cabinets.

Monitoring requirements related to component reliability were identified for the undervoltage driver cards, safeguards driver cards, universal logic cards, and reactor trip breakers.

No monitoring requirements were identified for the analog channels.

The impact of the proposed changes on risk from external events is very small and will not impact the acceptability of the changes proposed in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1.

5.0 References

1. WCAP-14333-P-A, Rev. 1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, October 1998.
2. WCAP-15376-P-A, Rev. 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, March 2003.
3. WOG-98-245, Implementation Guideline for WCAP-14333-P-A, Rev. 1 (Proprietary),

Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, December 2, 1998.

4. WOG-04-233, Transmittal of Revised Implementation Guidelines for WCAP-15376-P-A, Rev. 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, May 6, 2004.

33 September 26, 2013

Attachment 4

5. Regulatory Guide 1.174, Rev. 2, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, May 2011.
6. WCAP-15831-P-A, Rev. 2, WOG Risk-Informed ATWS Assessment and Licensing Implementation Process, August 2007.

34 September 26, 2013

Attachment 5

  • Westinghouse Westinghouse Electric Company Engineering, Equipment and Major Projects 1000 Westinghouse Drive Cranberry Township, Pennsylvania 16066 USA u.s. Nuclear Regulatory Commission Direct tel: (412) 374-4643 Document Control Desk Direct fax: (724) 720-0754 11555 Rockville Pike e-mail: greshaja@westinghouse.com Rockville, MD 20852 Project letter: TV A-13-64 CAW-13-3823 September 26, 2013 APPLICATION FOR WITHHOLDING PROPRIETARY INFORMA TION FROM PUBLIC DISCLOSURE

Subject:

LTR-RAM-I-13-032, Rev. 1 P-Attachments:

1) Summary Report Revision 1 "Sequoyah Nuclear Plant Units 1 and 2 - Implementation of Master and Slave Relays Technical Specification Changes Justified in WCAP-14333-P-A, Rev.

1 and WCAP-15376-P-A, Rev. 1" (Proprietary)

2) Summary Report Revision 2 "Sequoyah Nuclear Plant Units 1 and 2 - Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1" (Proprietary)

The proprietary information for which withholding is being requested in the above-referenced report is further identified in Affidavit CAW-13-3823 signed by the owner of the proprietary information, Westinghouse Electric Company LLC. The affidavit, which accompanies this letter, sets forth the basis on which the information may be withheld from public disclosure by the Commission and addresses with specificity the considerations listed in paragraph (b)(4) of 10 CFR Section 2.390 ofthe Commission's regulations.

Accordingly, this letter authorizes the utilization of the accompanying affidavit by Tennessee Valley Authority (TV A).

Correspondence with respect to the proprietary aspects of the application for withholding or the Westinghouse affidavit should reference CAW-13-3823 and should be addressed to James A. Gresham, Manager, Regulatory Compliance, Westinghouse Electric Company, Suite 310, 1000 Westinghouse Drive, Cranberry Township, Pennsylvania 16066.

Very truly yours, James A. Gresham, Manager Regulatory Compliance Enclosures

Attachment 5 cAw-13-3923 AFFIDAVIT COMMONWEALTH OF PENNSYLVANIA  :

COI.JNTY OF BUTLER:

Beforc me, the undersigned authority, personally appearcd James A. Gresham, who, being by me duly sworn according to law, deposes and says that hc is authorized to executc this Affidavit on behalf of Westinghouse Electric Company LLC (Westinghouse), and that the averments of fact set fortlr in this Affidavit are true and conect to the best of his knowledge, information, and beliefi Jarnes A. Gresham, Manager Regulatory Compliance

$worn to and subscribed before me this 26th day of Septem Notary Public s{!4oilWzuTrf oF PENNSYwAT{IA tlEtfE[R, tt

Attachment 5 2 CA W-13-3823 (I) I am Manager, Regulatory Compliance, in Engineering, Equipment and Major Projects, Westinghouse Electric Company LLC (Westinghouse), and as such, I have been specifically delegated the function of reviewing the proprietary information sought to be withheld from public disclosure in connection with nuclear power plant licensing and rule making proceedings, and am authorized to apply for its withholding on behalf of Westinghouse.

(2) I am making this Affidavit in conformance with the provisions of 10 CFR Section 2.390 of the Commission's regulations and in conjunction with the Westinghouse Application for Withholding Proprietary Information from Public Disclosure accompanying this Affidavit.

(3) I have personal knowledge ofthe criteria and procedures utilized by Westinghouse in designating information as a trade secret, privileged or as confidential commercial or financial information.

(4) Pursuant to the provisions of paragraph (b )(4) of Section 2.390 ofthe Commission's regulations, the following is furnished for consideration by the Commission in determining whether the information sought to be withheld from public disclosure should be withheld.

(i) The information sought to be withheld from public disclosure is owned and has been held in confidence by Westinghouse.

(ii) The information is ofa type customarily held in confidence by Westinghouse and not customarily disclosed to the public. Westinghouse has a rational basis for determining the types of information customarily held in confidence by it and, in that connection, utilizes a system to determine when and whether to hold certain types of information in confidence. The application of that system and the substance of that system constitutes Westinghouse policy and provides the rational basis required.

Under that system, information is held in confidence if it falls in one or more of several types, the release of which might result in the loss of an existing or potential competitive advantage, as follows:

(a) The information reveals the distinguishing aspects of a process (or component, structure, tool, method, etc.) where prevention of its use by any of

Attachment 5 3 CA W-13-3823 Westinghouse's competitors without license from Westinghouse constitutes a competitive economic advantage over other companies.

(b) It consists of supporting data, including test data, relative to a process (or component, structure, tool, method, etc.), the application of which data secures a competitive economic advantage, e.g., by optimization or improved marketability.

(c) Its use by a competitor would reduce his expenditure of resources or improve his competitive position in the design, manufacture, shipment, installation, assurance of quality, or licensing a similar product.

(d) It reveals cost or price information, production capacities, budget levels, or commercial strategies of Westinghouse, its customers or suppliers.

(e) It reveals aspects of past, present, or future Westinghouse or customer funded development plans and programs of potential commercial value to Westinghouse.

(f) It contains patentable ideas, for which patent protection may be desirable.

(iii) There are sound policy reasons behind the Westinghouse system which include the following:

(a) The use of such information by Westinghouse gives Westinghouse a competitive advantage over its competitors. It is, therefore, withheld from disclosure to protect the Westinghouse competitive position.

(b) It is information that is marketable in many ways. The extent to which such information is available to competitors diminishes the Westinghouse ability to sell products and services involving the use of the information.

(c) Use by our competitor would put Westinghouse at a competitive disadvantage by reducing his expenditure of resources at our expense.

Attachment 5 4 CAW-13-3823 (d) Each component of proprietary information pertinent to a particular competitive advantage is potentially as valuable as the total competitive advantage. If competitors acquire components of proprietary information, anyone component may be the key to the entire puzzle, thereby depriving Westinghouse of a competitive advantage.

(e) Unrestricted disclosure would jeopardize the position of prominence of Westinghouse in the world market, and thereby give a market advantage to the competition of those countries.

(f) The Westinghouse capacity to invest corporate assets in research and development depends upon the success in obtaining and maintaining a competitive advantage.

(iv) The information is being transmitted to the Commission in confidence and, under the provisions of 10 CFR Section 2.390, it is to be received in confidence by the Commission.

(v) The information sought to be protected is not available in public sources or available information has not been previously employed in the same original manner or method to the best of our knowledge and belief.

(vi) The proprietary information sought to be withheld in this submittal is that which is appropriately marked in LTR-RAM-I-13-032, Rev. 1 P-Attachments:

1) Summary Report Revision 1 "Sequoyah Nuclear Plant Units 1 and 2 - Implementation of Master and Slave Relays Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1" (Proprietary)
2) Summary Report Revision 2 "Sequoyah Nuclear Plant Units 1 and 2 - Implementation of Technical Specification Changes Justified in WCAP-14333-P-A, Rev. 1 and WCAP-15376-P-A, Rev. 1" (Proprietary) for submittal to the Commission, being transmitted by TV A letter and Application for Withholding Proprietary Information from Public Disclosure, to the Document Control Desk. The proprietary information as submitted by Westinghouse is that associated with TVA's request for NRC approval of Technical Specification surveillance test intervals,

Attachment 5 5 CA W-I3-3823 completion times, and bypass test times justified in WCAP-I4333-P-A, Rev. 1 and WCAP-I5376-P-A, Rev. 1 for the Sequoyah Units 1 and 2, and may be used only for that purpose.

(a) This information is part of that which will enable Westinghouse to:

(i) Demonstrate the applicability of Technical Specification changes to surveillance test intervals, completion times, and bypass test times based on solid state process protection systems.

(ii) Provide licensing defense services.

(b) Further this information has substantial commercial value as follows:

(i) Westinghouse plans to sell the use of similar information to its customers for the purpose of justifying Technical Specification changes to surveillance test intervals, completion times, and bypass test times based on solid state protection systems.

(ii) Westinghouse can sell support and defense of Technical Specification parameters.

(iii) The information requested to be withheld reveals the distinguishing aspects of a methodology which was developed by Westinghouse.

Public disclosure of this proprietary information is likely to cause substantial harm to the competitive position of Westinghouse because it would enhance the ability of competitors to provide similar technical evaluation justifications and licensing defense services for commercial power reactors without commensurate expenses. Also, public disclosure of the information would enable others to use the information to meet NRC requirements for licensing documentation without purchasing the right to use the information.

Attachment 5 6 CA W-13-3823 The development of the technology described in part by the information is the result of applying the results of many years of experience in an intensive Westinghouse effort and the expenditure of a considerable sum of money.

In order for competitors of Westinghouse to duplicate this information, similar technical programs would have to be performed and a significant manpower effort, having the requisite talent and experience, would have to be expended.

Further the deponent sayeth not.

Attachment 5 Proprietary Information Notice Transmitted herewith are proprietary and/or non-proprietary versions of documents furnished to the NRC in connection with requests for generic and/or plant-specific review and approval.

In order to conform to the requirements of 10 CFR 2.390 of the Commission's regulations concerning the protection of proprietary information so submitted to the NRC, the information which is proprietary in the proprietary versions is contained within brackets, and where the proprietary information has been deleted in the non-proprietary versions, only the brackets remain (the information that was contained within the brackets in the proprietary versions having been deleted). The justification for claiming the information so designated as proprietary is indicated in both versions by means of lower case letters (a) through (f) located as a superscript immediately following the brackets enclosing each item of information being identified as proprietary or in the margin opposite such information. These lower case letters refer to the types of information Westinghouse customarily holds in confidence identified in Sections (4)(ii)(a) through (4)(ii)(t) of the affidavit accompanying this transmittal pursuant to 10 CFR 2.390(b)(l).

Copyright Notice The reports transmitted herewith each bear a Westinghouse copyright notice. The NRC is permitted to make the number of copies of the information contained in these reports which are necessary for its internal use in connection with generic and plant-specific reviews and approvals as well as the issuance, denial, amendment, transfer, renewal, modification, suspension, revocation, or violation of a license, permit, order, or regulation subject to the requirements of 10 CFR 2.390 regarding restrictions on public disclosure to the extent such information has been identified as proprietary by Westinghouse, copyright protection notwithstanding. With respect to the non-proprietary versions of these reports, the NRC is permitted to make the number of copies beyond those necessary for its internal use which are necessary in order to have one copy available for public viewing in the appropriate docket files in the public document room in Washington, DC and in local public document rooms as may be required by NRC regulations if the number of copies submitted is insufficient for this purpose. Copies made by the NRC must include the copyright notice in all instances and the proprietary notice if the original was identified as proprietary.