Text

License Amendment Request, Implementation and Engineered WCAP-15376, Reactor Trip System Instrumentation Test Times and Engineered Safety Feature Actuation System Instrumentation Test and Completion Times
	ML14133A009
Person / Time
Site:	Millstone
Issue date:	05/08/2014
From:	Mark D. Sartain; Dominion Nuclear Connecticut
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	14-107, WCAP-14333, WCAP-15376
	Download: ML14133A009 (84)
	v • d • e

Dominion Nuclear Connecticut, Inc. "' ei S 5000 Dominion Boulevard, Glen Allen, VA 23060 DominioEn Web Address: www.dom.com May 8, 2014 U.S. Nuclear Regulatory Commission Serial No.14-107 Attention: Document Control Desk NSSL/MAE RO Washington, DC 20555 Docket No. 50-423 License No. NPF-49 DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3 LICENSE AMENDMENT REQUEST, IMPLEMENTATION OF WCAP-14333 AND WCAP-15376. REACTOR TRIP SYSTEM INSTRUMENTATION AND ENGINEERED SAFETY FEATURE ACTUATION SYSTEM INSTRUMENTATION TEST TIMES AND COMPLETION TIMES Pursuant to 10 CFR 50.90, Dominion Nuclear Connecticut, Inc. (DNC) requests amendment to Operating License NPF-49 for Millstone Power Station Unit 3 (MPS3).

The proposed changes will revise TS 3/4.3.1, "Reactor Trip System Instrumentation,"

and TS 3/4.3.2, "Engineered Safety Feature Actuation System Instrumentation." These changes are based on Westinghouse Electric Company LLC topical reports WCAP-14333-P-A, Revision 1, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times," and WCAP-15376-P-A, Revision 1, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times."

These proposed changes are consistent with the NRC-approved Technical Specification Task Force (TSTF) Travelers TSTF-41 1, Revision 1, "Surveillance Test Interval Extension for Components of the Reactor Protection System (WCAP-1 5376-P)" and TSTF-418, Revision 2, "RPS and ESFAS Test Times and Completion Times (WCAP-14333)," except as noted in Attachment 1.

The proposed changes have been reviewed and approved by the Facility Safety Review Committee.

Information provided in the attachments to this letter is summarized below:

Attachment 1 provides Description, Technical Analysis, Regulatory Analysis and Environmental Consideration for the proposed Technical Specifications changes.

As discussed in this attachment, the proposed amendment does not involve a significant hazards consideration pursuant to the provisions of 10 CFR 50.92.

Attachment 2 contains marked-up pages to reflect the proposed changes to the Technical Specifications.

" Attachment 3 contains the applicability determination for WCAP-14333-P-A, Revision 1 and WCAP-15376-P-A, Revision 1.

Aool uzei

Serial No.14-107 Docket No. 50-423 Page 2 of 3

Attachment 4 lists the regulatory commitments associated with this license amendment request.

DNC requests approval of the proposed amendments by April 30, 2015 with a 90-day implementation period.

In accordance with 10 CFR 50.91(b), a copy of this license amendment request, with attachments, is being provided to the designated State of Connecticut official.

If you have any questions regarding this submittal, please contact Wanda Craft at (804) 273-4687.

Sincerely, Mark D. Sartain Vice President - Nuclear Engineering Notary Public I commonwealth of Virginia 140542 COMMONWEALTH OF VIRGINIA ) My Commission Expires May 31, 2014 COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mark D. Sartain, who is Vice President - Nuclear Engineering of Dominion Nuclear Connecticut, Inc. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this day of 1,4V,* 2014.

My Commission Expires: 5 -3//

Notary Public Commitments made in this letter: See Attachment 4

Serial No.14-107 Docket No. 50-423 Page 3 of 3 Attachments:

1. Discussion of Change

2. Marked-up Pages of the Proposed Changes to the Technical Specifications

3. The Applicability Determination for WCAP-14333-P-A, Revision 1 and WCAP-15376-P-A, Revision 1

4. List of Regulatory Commitments cc: U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd Suite 100 King of Prussia, PA 19406-2713 Mohan C. Thadani Senior Project Manager U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 08 B 1 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Millstone Power Station Director, Radiation Division Department of Energy and Environmental Protection 79 Elm Street Hartford, CT 06106-5127

4b Serial No.14-107 Docket No. 50-423 Attachment I Discussion of Change DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 1 of 50

1.0 DESCRIPTION

2.0 BACKGROUND

3.0 PROPOSED CHANGE

S

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/Criteria

6.0 ENVIRONMENTAL CONSIDERATION

7.0 PRECEDENT

8.0 REFERENCES

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 2 of 50

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, Dominion Nuclear Connecticut, Inc. (DNC) requests amendment to Operating License NPF-49 for Millstone Power Station Unit 3 (MPS3).

The proposed amendment would revise Technical Specification (TS) 3.3.1, "Reactor Trip System (RTS) Instrumentation" and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," to adopt Completion Time (CT) and test bypass time changes. These changes have been approved by the NRC in Topical Reports WCAP-14333-P-A, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times," Revision 1 (hereafter referred to as WCAP-14333),

dated October 1998 (Reference 1), and WCAP-1 5376-P-A, "Risk-informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times," Revision 1 (hereafter referred to as WCAP-15376), dated March 2003 (Reference 2).

The proposed changes will:

Increase the CTs for several Required Actions in TS 3.3.1, "Reactor Trip System Instrumentation," and TS 3.3.2, "Engineered Safety Features Actuation Systems Instrumentation ;"

Increase the bypass test times allowed by several Required Actions in TSs 3.3.1 and 3.3.2 These proposed changes are consistent with the NRC-approved Technical Specification Task Force (TSTF) Travelers TSTF-41 1, Revision 1, "Surveillance Test Interval Extension for Components of the Reactor Protection System (WCAP-1 5376-P)," (Reference 3) and TSTF-418, Revision 2, "RPS and ESFAS Test Times and Completion Times (WCAP-14333)" (Reference 4).

The proposed relaxations will allow additional time to perform maintenance and test activities, enhance safety by reducing unnecessary surveillance times and increasing CTs when justified, provide additional operational flexibility, and reduce the potential for forced outages related to compliance with the current RTS and ESFAS instrumentation TSs. Industry information has shown that a significant number of trips that have occurred are related to instrumentation test and maintenance activities, indicating that these activities should be completed with caution, and sufficient time should be available to complete these activities in an orderly and effective manner.

2.0 BACKGROUND

In February 1983, the Westinghouse Owners Group (WOG) submitted Topical Report WCAP-10271-P, "Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Protection System," (hereafter referred to as WCAP-10271), which

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 3 of 50 provided a methodology to be used to justify revisions to a plant's TS. The WOG Technical Specification Optimization Program (TOP) evaluated changes to surveillance test intervals and allowed outage times for the analog channels, logic cabinets, master and slave relays, and reactor trip breakers. The methodology evaluated increasing surveillance intervals, increases in test and maintenance out-of-service times and bypassing portions of the Reactor Protection System (RPS) during test and maintenance. The WOG stated in WCAP-1 0271 that plant staff devote significant time and effort to perform, review, document, and track surveillance activities that, in many instances, may not be required on the basis of the high reliability of the equipment. The justification for the proposed changes included the small impact that the changes had on plant risk.

In WCAP-1 0271, the WOG performed fault tree analyses to calculate the reactor trip unavailability considering surveillance intervals and test and maintenance times. The sensitivity to variations in surveillance intervals and test and maintenance times was also evaluated with respect to maintaining or revising current surveillance intervals.

The WOG concluded that the results of the analyses for the RPS were adequate to justify a revision of the Standard Technical Specifications (STS). The NRC approved WCAP-1 0271-P by Safety Evaluation (SE), with provisions, dated February 21, 1985.

The TSs approved in WCAP-10271 were incorporated into the STS in NUREG-1431, "Standard Technical Specifications, Westinghouse Plants," Revision 0, dated September 1992. The NRC SE for WCAP-10271 approved the following changes for plant-specific TS:

1. Increase the surveillance test intervals (STIs) for RTS analog channel operational tests from once per month to once per quarter;

2. Increase the time in which an inoperable RTS analog channel may be maintained in an untripped condition from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ;

3. Increase the time an inoperable RTS analog channel may be bypassed to allow testing of another channel in the same function from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Also, the channel test may be performed in the bypass mode leaving the inoperable channel in tripped condition; and

4. Allow testing of the RTS analog channels in a bypass condition instead of a tripped condition.

The NRC approved the implementation of these changes at MPS3 in License Amendment 70 (Reference 6). Therefore, the current licensing basis for MPS3 is that of a "TOP" plant.

Subsequent to the NRC-approval of WCAP-10271, the WOG submitted WCAP-14333, Revision 0 for NRC review, including draft TSs, based on NUREG-1431,

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 4 of 50 Revision 1. WCAP-14333 proposed further relaxation of the TS changes approved by WCAP-1 0271 with the following proposed changes to plant TSs:

1. Increase the bypass times and the CTs for both the solid state and relay protection system RPS and ESFAS designs: (i) for the analog channels the CT increased from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , and the bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and (ii) for the logic cabinets, master and slave relay CTs were increased from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

2. Revise the action statement for an inoperable slave relay to increase the CT for maintenance to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , with an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for the mode change.

3. For cases where the logic cabinets and the trip breakers both cause their train to be inoperable when in test or maintenance, allow the reactor trip breakers to be bypassed for the period of time equivalent to the bypass time for the logic cabinets, provided that both are tested at the same time and provided the plant design is such that both the reactor trip breaker and the logic cabinet cause their associated electrical trains (i.e., buses) to be inoperable during test or maintenance.

The WCAP-14333 report indicated that the proposed TS changes resulted in a small increase in core damage frequency, with a maximum increase from pre-TOP values of approximately 3.1% from internal events. The increase in core damage frequency from TOP values, for the same logic configuration, was 1.0%.

On July 15, 1998, the NRC issued an SE approving WCAP-14333 for reference in license applications, subject to the condition that licensees confirm the applicability of the WCAP to their plant, and that licensees address RG 1.177, Tier 2 and Tier 3 analyses, including the incorporation of applicable Configuration Risk Management Program (CRMP) insights.

Southern Nuclear Operating Company submitted a License Amendment Request (LAR) on October 13, 1999, for Vogtle Units 1 and 2 to adopt the relaxations that were generically approved in WCAP-14333. As a result of the NRC review of this application, incremental conditional large early release probability (ICLERP) values were developed generically for the WOG plants. The NRC approved the WCAP-14333 changes for Vogtle Station Units 1 and 2 in License Amendments 116 and 94, respectively.

By letter dated November 8, 2000, the WOG transmitted WCAP-1 5376, Revision 0 to the NRC for review and approval. WCAP-1 5376 expanded upon the groundwork laid by WCAP-14333, but used updated component failure probability data and revised the fault tree models, as discussed in WCAP-1 5376, Section 8.3. With these modifications, the changes previously approved in WCAP-14333 were quantified as

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 5 of 50 the base case for WCAP-15376. Section 8.4 of WCAP-15376 provides the risk metrics for this change and demonstrates that the acceptance criteria of Regulatory Guide (RG) 1.174 and RG 1.177 are satisfied. By letter dated December 20, 2002, the NRC issued an SE approving WCAP-1 5376 for reference in license applications, subject to stated conditions.

The approach used in WCAP-14333 and WCAP-15376 is consistent with the approach established in the TOP program. This includes the fault tree models, signals, component reliability database, and most of the test and maintenance assumptions. The methodology used in the WCAP-10271 studies was applied to a representative set of RTS and ESFAS functions using the Vogtle probabilistic risk assessment (PRA) model and revised unavailability data. The work documented in WCAP-14333 uses a different common cause failure modeling approach for analog channels and includes more realistic assumptions related to the component unavailability due to maintenance activities based on a survey of WOG plants.

Operator actions to either manually trip the reactor or initiate safety injection are also modeled in WCAP-14333. In addition, WCAP-14333 credited the start of the auxiliary feedwater pump from the anticipated transient without scram (ATWS) mitigating system actuation circuitry (AMSAC).

The AMSAC is included in the MPS3 Maintenance Rule Program as a non-risk significant system with an assigned performance criterion. Administrative controls will be put in place to limit activities that would degrade AMSAC availability (see Section 4.2.1).

The relaxations that are justified in WCAP-14333 are summarized below:

TABLE 1 Summary of WCAP-14333 RTS and ESFAS Completion Time and Bypass Test Time Changes for the Solid State Protection System Component Completion Time Bypass Test Time Analog Channels 6 + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Logic Train 6 + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months No relaxation*

Actuation relays 6 + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 + 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months No relaxation*

No relaxation beyond TOP (WCAP-10271 and its supplements)

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 6 of 50 WCAP-1 5376 provides the technical justification for the following RTS Instrumentation (TS 3.3.1) and ESFAS Instrumentation (TS 3.3.2) TS changes:

TABLE 2 Summary of WCAP-15376 RTS and ESFAS Surveillance Test Interval (STI) and Completion Time (CT) Changes for the Solid State Protection System Component Surveillance Test Intervals Completion Times and Bypass Times Logic Train 2 months to 6 months No changes Master Relays 2 months to 6 months No changes Analog Channels 3 months to 6 months No changes Reactor Trip Breakers 2 months to 4 months Allowed Outage Time (AOT): 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; Bypass Time: 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

3.0 PROPOSED CHANGE

S The following categories of changes are proposed for TSs 3.3.1 and 3.3.2:

a) The allowed CT to restore an inoperable RTS or ESFAS analog channel, before it must be placed in the tripped condition, or bypassed condition for Containment Pressure High - 3, is increased from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ;

b) The allowed time for an inoperable RTS or ESFAS analog channel to be bypassed for testing other analog channels is increased from 4 to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ; c) The allowed CT to restore an inoperable train of Solid State Protection System (SSPS) logic (TS 3.3.1 and TS 3.3.2) or actuation relays (TS 3.3.2), before the plant must be shut down, is increased from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; d) The allowed time for one reactor trip breaker (RTB) train to be bypassed for RTB surveillance testing is increased from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ;

e) The allowed CT to restore an inoperable RTB train, before the plant must be shut down, is modified by adding a CT of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; In a letter dated July 5, 2011, DNC submitted a license amendment request to relocate TS surveillance frequencies to a licensee controlled program in accordance with TSTF-425, Revision 3. The July 5, 2011 submittal relocates surveillance frequencies in TS 3.3.1, "Reactor Trip System (RTS)

Instrumentation," Table 4.3-1 and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," Table 4.3-2 to a licensee controlled program.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 7 of 50 On February 25, 2014, the NRC issued amendment No. 258 in response to DNC's submittal.

The proposed changes to surveillance test intervals as addressed in TSTF-41 1, Revision 1, "Surveillance Test Interval Extension for Components of the Reactor Protection System (WCAP-15376-P)," are not being addressed in this current license amendment request. Increasing train bypass time from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and adding 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to the allowed CT to restore an inoperable RTB train, before the plant must be shut down, are the only proposed changes addressed in this current submittal based on TSTF-411 (WCAP-1 5376-P).

Additionally, ACTION 27 in TS Table 3.3-3 which is applicable only to ESFAS functional unit 8.a (Loss of Power, 4 kV Bus Undervoltage - Loss of Voltage), and ESFAS functional unit 8.b (Loss of Power, 4 kV Bus Undervoltage - Grid Degraded Voltage) is not addressed by the scope of the NRC approved Topical Reports WCAP-14333-P-A and TSTF-418, Revision 2. Therefore, no changes are being proposed to ACTION 27.

TS mark-ups for the above changes are provided in Attachment 2. The specific changes proposed in Attachment 2 are the following:

1. Revise TS Table 3.3-1, ACTION 2 by extending the CT in ACTION 2.a from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , extend bypass testing time in ACTION 2.b from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , and change the CT for ACTION 2.c from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to a total of 78 hours9.027778e-4 days 0.0217 hours 1.289683e-4 weeks 2.9679e-5 months (the total time for completing ACTIONs 2.a and an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for THERMAL POWER and Power Range Neutron Flux Trip Setpoint changes). The following functional units are affected by these changes:

" Power Range, Neutron Flux - High Setpoint {RTS functional unit 2.a};

" Power Range, Neutron Flux - Low Setpoint {RTS functional unit 2.b};

" Power Range, Neutron Flux - High Positive Rate {RTS functional unit 3};

2. Revise TS Table 3.3-1, ACTION 6 by extending the CT in ACTION 6.a from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and extend bypass testing time in ACTION 6.b from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The following functional units are affected by these changes:

Overtemperature AT {RTS functional unit 7};

Overpower AT {RTS functional unit 8};

" Pressurizer Pressure -Low {RTS functional unit 9};

" Pressurizer Pressure -High {RTS functional unit 10};

Pressurizer Water Level - High {RTS functional unit 11};

" Reactor Coolant Flow-Low, Single Loop (Above P-8) {RTS functional unit 12.a};

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 8 of 50

" Reactor Coolant Flow-Low, Two Loops (Above P-7 and below P-8) {RTS functional unit 12.b};

Steam Generator Water Level--Low-Low {RTS functional unit 13};

Low Shaft Speed--Reactor Coolant Pumps {RTS functional unit 14};

" Turbine Trip, Turbine Stop Valve Closure {RTS functional unit 15.b}.

3. Revise TS Table 3.3-1, ACTION 10 by adding a CT of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for restoring the inoperable channel to operable (this change is contained in NUREG-1431, Rev 3.1). This will effectively change the CT for being in HOT STANDBY from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months in the current TS to a total of 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months (the total time for restoring the inoperable channel to operable and reaching HOT STANDBY conditions). ACTION 10 is also revised by extending bypass testing time from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.3.1.1 provided the other channel is OPERABLE. The following functional unit is affected by these changes:

Reactor Trip Breakers {RTS functional unit 18}.

4. Revise TS Table 3.3-1, ACTION 12 by extending the CT in ACTION 12.a from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and extend bypass testing time in ACTION 12.b from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The following functional unit is affected by these changes:

Turbine Trip - Low Fluid Oil Pressure {RTS functional unit 15.a}.

5. Revise TS Table 3.3-1, ACTION 13A by extending the CT from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The following functional unit is affected by this change:

Automatic Trip and Interlock Logic {RTS functional unit 19}.

6. Revise Table 3.3-3 ACTION 14 by extending the CT from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The following functional units are affected by this change:

Safety Injection (Reactor Trip, Feedwater Isolation, Control Building Isolation (Manual Initiation Only), Start Diesel Generators, and Service Water),

Automatic Actuation Logic and Actuation Relays {ESFAS functional unit 1.b};

Containment Spray (CDA), Automatic Actuation Logic and Actuation Relays

{ESFAS functional unit 2.b};

Containment Isolation, Phase "A" Isolation, Automatic Actuation Logic and Actuation Relays {ESFAS functional unit 3.a.2};

Containment Isolation, Phase "B" Isolation, Automatic Actuation Logic and Actuation Relays {ESFAS functional unit 3.b.2};

" Control Building Isolation, Automatic Actuation Logic and Actuation Relays

{ESFAS functional unit 7.c}.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 9 of 50

7. Revise Table 3.3-3 ACTION 17 by specifying a CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for placing the inoperable channel in the bypassed condition and extending the bypass testing time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The following functional units are affected by this change:

Containment Spray (CDA), Containment Pressure-- High-3 {ESFAS functional unit 2.c};

Containment Isolation, Phase "B" Isolation, Containment Pressure--High-3

{ESFAS functional unit 3.b.3}.

8. Revise TS Table 3.3-3, ACTION 20 by extending the CT in ACTION 20.a from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and extend bypass testing time in ACTION 20.b from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The following functional units are affected by these changes:

" Safety Injection (Reactor Trip, Feedwater Isolation, Control Building Isolation (Manual Initiation Only), Start Diesel Generators, and Service Water),

Containment Pressure--High-1 {ESFAS functional unit 1.c};

Safety Injection (Reactor Trip, Feedwater Isolation, Control Building Isolation (Manual Initiation Only), Start Diesel Generators, and Service Water),

Pressurizer Pressure--Low {ESFAS functional unit 1.d};

" Safety Injection (Reactor Trip, Feedwater Isolation, Control Building Isolation (Manual Initiation Only), Start Diesel Generators, and Service Water), Steam Line Pressure-- Low {ESFAS functional unit 1.e};

" Steam Line Isolation, Containment Pressure-- High-2 {ESFAS functional unit 4.c);

" Steam Line Isolation, Steam Line Pressure-- Low {ESFAS functional unit 4.d};

" Steam Line Isolation, Steam Line Pressure - Negative Rate--High {ESFAS functional unit 4.e};

" Turbine Trip and Feedwater Isolation, Steam Generator Water Level-- High-High (P-14) {ESFAS functional unit 5.b};

" Turbine Trip and Feedwater Isolation, Tave Low Coincident with P-4 {ESFAS functional unit 5.d};

" Auxiliary Feedwater, Steam. Gen. Water Level-- Low-Low, Start Motor- Driven Pumps {ESFAS functional unit 6.c.1};

" Auxiliary Feedwater, Steam. Gen. Water Level-- Low-Low, Start Turbine-Driven Pump {ESFAS functional unit 6.c.2};

" Cold Leg Injection Permissive, P-19 {ESFAS functional unit 11}.

9. Revise Table 3.3-3 ACTION 22 by extending the CT from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The following functional units are affected by this change:

Steam Line Isolation, Automatic Actuation Logic and Actuation Relays {ESFAS functional unit 4.b};

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 10 of 50

" Turbine Trip and Feedwater Isolation, Safety Injection Actuation Logic {ESFAS functional unit 5.c};

" Auxiliary Feedwater, Automatic Actuation Logic and Actuation Relays {ESFAS functional unit 6.b}.

10. Revise Table 3.3-3 ACTION 25 by extending the CT from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The following functional unit is affected by this change:

Turbine Trip and Feedwater Isolation, Automatic Actuation Logic and Actuation Relays {ESFAS functional unit 5.a}.

4.0 TECHNICAL ANALYSIS

WCAP-14333 provides the justification for increasing the bypass times for testing and the CTs in the RTS and ESFAS instrumentation TS. The proposed changes adopt the NRC-approved changes in TSTF-418, Rev. 2, "RPS and ESFAS Test Times and Completion Times (WCAP-14333)," hereafter referred to as TSTF-418.

WCAP-1 5376 provides the justification for increasing the Allowed Outage Time (AOT)/CT and the bypass test time for the reactor trip breakers, and increasing the Surveillance Test Intervals (STI) for the RTBs, master relays, logic cabinets, and analog channels. The proposed changes adopt the NRC-approved TSTF-41 1, Rev.

1, "Surveillance Test Interval Extension for Components of the Reactor Protection System," hereafter referred to as TSTF-41 1, for only the changes related to increasing the AOT/CT and the bypass test time for the reactor trip breakers.

The CT is intended to allow sufficient time to repair failed equipment while minimizing the risk associated with the loss of the component function. An extension of the CT increases the unavailability of a component due to the increased time the component is down for maintenance. The CT risk is reflected in the core damage frequency (CDF) and the large early release frequency (LERF) by adjusting the component unavailability due to maintenance. The proposed extensions for the RTB will provide additional time to complete test and maintenance activities while at power, potentially reducing the number of forced outages related to compliance with reactor trip breaker CTs, and provide consistency with the CTs for the logic cabinets.

In order to model the CTs in the fault trees to determine the impact of the changes on signal unavailabilities, several parameters were specified for component test and maintenance unavailabilities. These are the test frequencies and durations discussed in Section 5.1 of WCAP-14333, the maintenance frequencies and durations discussed in Section 5.2 of WCAP-14333, and the test and maintenance activities discussed in Section 7.2 of WCAP-15376.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 11 of 50 Both WCAP-14333 and WCAP-15376 use probabilistic risk assessment to justify plant-specific changes to the TSs in accordance with RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Bases," dated July 1998, and RG 1.177, "An Approach for Plant- Specific, Risk-Informed Decision-making: Technical Specifications," dated August 1998. In these documents, and in the NRC SEs that approved these documents, there are references to Tier 1, Tier 2, and Tier 3 analyses.

A Tier 1 analysis uses PRA for the plant to assess the impact of the proposed change on the CDF, incremental conditional core damage probability (ICCDP),

LERF, and ICLERP.

A Tier 2 analysis considers potential risk-significant plant operating conditions and addresses the need to preclude potentially risk-significant plant equipment outage configurations should additional equipment outages occur during the required action CT period of time.

A Tier 3 analysis addresses the plant-specific CRMP, including the risk-informed assessment for outages and the Structures, Systems, and Components (SSCs) that are controlled by the program. An acceptable program is one that, during normal plant operations, ensures the risk impact of out-of-service equipment is evaluated prior to performing maintenance and uncovers risk-significant plant equipment outage configurations in a timely manner. Tier 3 confirms that CRMP insights will be incorporated into the station's decision-making process before taking equipment out of service prior to or during the required action CT period of time.

Tier 1 is addressed in the NRC review of, and the SE approval of the two WCAPs.

Tiers 2 and 3 are addressed in the plant specific applications of the WCAPs.

4.1 Tier 1, WCAP-14333 and WCAP-15376 Risk Insights 4.1.1 WCAP-14333 Risk Insights WCAP-14333 originally provided only the impact of the requested changes on core damage frequency (ACDF) for two-out-of-four (2/4) and two-out-of-three (2/3) actuation logic. In response to an NRC request for additional information (RAI) associated with the review of WCAP-14333, the WOG submitted letter OG-96-1 10 (Reference 7). The response to NRC RAI questions 11 and 13 in Reference 7 provided the impact of the requested changes on ICCDP for various components in maintenance and the change in LERF (ALERF) for 2/4 and 2/3 actuation logic. Also, in response to an NRC RAI during the review of Southern Nuclear's amendment request implementing these changes for Vogtle Units 1 and 2, Southern Nuclear provided ICLERPs for various components while in maintenance.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 12 of 50 The impact of the proposed changes on CDF and LERF are provided in TSTF-418, Table 1.3, which presents the same information as that contained in Table 8.4 of WCAP- 14333, TSTF-418, Table 1.4, and in the response to RAI Question 13 in Reference 7. The CDF and LERF values are provided for pre-TOP, TOP, and the WCAP-14333 proposed changes. The ACDF and ALERF values are also provided referenced to pre-TOP and TOP conditions. The results of a sensitivity analysis are also provided. The results of the sensitivity analysis credit a 0.5/year reduction in reactor trip frequency due to fewer analog channel tests (i.e., the trip reduction originally postulated for the WCAP-10271 channel operational test interval increase from monthly to quarterly). The ACDF and ALERF values are provided for both 2/4 and 2/3 logic. The ICCDP and ICLERP values are provided in Table 1.5 of TSTF-418. The ICCDP and ICLERP values are only provided for 2/3 logic, but the results envelop the 2/4 logic.

4.1.2 WCAP-15376 Risk Insights Risk analysis results for WCAP-1 5376 are discussed in Section 8.4 of that topical report. Comparisons are presented in Tables 8.29 (i.e., ACDF) and 8.32 (i.e.,

ALERF) to a base case, which represents the changes previously approved under WCAP-14333. In response to an NRC RAI associated with the review of WCAP-15376, the WOG submitted letter OG-02-002 (Reference 8), which provided the impact of the requested CT (i.e., 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months CT plus 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to reach MODE 3, for a total of 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months ) on ICCDP and ICLERP for a RTB in preventive maintenance (PM),

or in corrective maintenance (CM), with the associated logic train inoperable, for the bounding 2/3 logic. Since these incremental risk metrics are met for a 30-hour maintenance time, they will also be met for a 4-hour bypass test time.

4.1.3 WCAP-14333 and WCAP-15376 Combined Risk Metric Results 4.1.3.1 ICCDP and ICLERP The WCAP-14333 values for ICCDP and ICLERP are situational in nature, depending on the particular component under test or maintenance. As indicated in Table 3 below, the WCAP-14333 values for ICCDP for various cases of equipment in test or maintenance range from 4.4E-07 to 5.5E-1 0, relative to the acceptance criteria of <5.OE-07/year. Similarly, the values for ICLERP range from 3.OE-08/year to 1.1 E-1 1/year, relative to the acceptance criterion of <5.OE-08/year. Therefore, the RG 1.177 acceptance criteria for these incremental risk metrics are satisfied for the changes proposed in WCAP-14333.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 13 of 50 4.1.3.2 ACDF and ALERF The ACDF and ALERF values for implementation of the proposed changes described in WCAP-15376 are cumulative from the current licensing basis for MPS3 (i.e.,

WCAP- 10271).

Based upon the cumulative ALERF values in Table 3 for the change from WCAP-10271 to WCAP-1 5376 (i.e., including the ALERF associated with WCAP-14333), the RG 1.174 acceptance criterion is satisfied (i.e., a cumulative ALERF of 5.1 E-08 for 2/4 logic (i.e., 2.OE-08 plus 3.1E-08) and 7.9E-08/year for 2/3 logic (i.e., 2.2E-08 plus 5.7E-08), relative to the acceptance criterion of <1.OE-07/year).

With respect to ACDF, the cumulative values for 2/4 logic and 2/3 logic are slightly higher than the RG 1.174 acceptance criterion (i.e., a cumulative ACDF of 1.2E-06/year for 2/4 logic and 1.5E-06/year for 2/3 logic, relative to the acceptance criterion of < 1.OE-06/year).

To address this issue, Section 8.4.4 of WCAP-15376 provides an analysis that discusses the cumulative ACDF from pre-TOP to WCAP-15376 conditions, using the sensitivity analysis values from Table 8.4 of WCAP-14333 for 2/4 logic and 2/3 logic, combined with the ACDF values from Table 8.29 of WCAP-15376 for 2/4 and 2/3 logic. The results of this analysis are provided in Table 8.33 of WCAP-15376. Table 8.33 indicates that the cumulative ACDF, for the 2/4 logic, from the pre-TOP condition to the WCAP-1 5376 condition is 5.7E-07/year, which is within the ACDF acceptance criterion of <1.OE-06/year.

WCAP-1 5376, Table 8.33 also indicates that the cumulative ACDF value, for the 2/3 logic, from the pre-TOP condition to the WCAP-1 5376 condition is 1.1 E-06/year.

This value slightly exceeds the ACDF acceptance criterion. However, as indicated above, the ACDF value of 1.1 E-06/year includes the cumulative impact of changing from the pre-TOP to WCAP-1 5376 conditions. Pre-TOP conditions are delineated in Table 1.1 of WCAP-15376. Since MPS3 is changing from TOP to WCAP-15376 conditions, the impact of the proposed CT conditions will result in less of a ACDF than the change from pre-TOP to WCAP-15376 values, thus satisfying the RG 1.174 acceptance criterion. In addition, the avoided shutdown risk associated with the extended CTs that is discussed in Section 8.4 of WCAP-14333 and Section 8.7 of WCAP-1 5376 provides additional justification for the acceptability of the ACDF value.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 14 of 50 TABLE 3 Combined Risk Metric Results Risk Metric RG Change from WCAP- Change from WCAP-1.174/1.177 10271 to WCAP-14333 14333 Acceptance to WCAP-1 5376 Criterion ACDF < 1.0 E-06 2/4 Logic 2/3 Logic 2/4 Logic 2/3 Logic 3.5 E-07 6.1 E-07 8.0 E-07 8.5 E-07 ICCDP < 5.0 E-07 Ranges from 4.4 E-07 RTB in PM: 3.2 E-07 (logic train in RTB in CM: 3.2 E-07 maintenance) to 5.5 E-10 (SG level channel in test)

ALERF < 1.0 E-07 2/4 Logic 2/3 Logic 2/4 Logic 2/3 Logic 2.0 E-08 2.2 E-08 3.1 E-08 5.7 E-08 ICLERP < 5.0 E-08 Ranges from 3.0 E-08 RTB in PM: 2.4 E-08 (logic train in RTB in CM: 2.4 E-08 maintenance) to 1.1 E-1 1 (SG level channel in test) 4.2 Tier 2, Avoidance of Risk Significant Plant Configurations Tier 2 requires an examination of the need to impose additional restrictions when operating under the proposed Completion Times in order to avoid risk-significant equipment outage configurations. The resulting Tier 2 restrictions to be imposed for the two topical reports are very similar.

4.2.1 WCAP-14333 Tier 2 Restrictions Consistent with the guidance in Regulatory Position C.2.3 in RG 1.177, Westinghouse performed an evaluation of equipment according to its contribution to plant risk while the equipment covered by the proposed CT changes is out of service for test or maintenance. This evaluation was documented in the response to RAI Question 18 in Westinghouse letter OG-96-110 (Reference 7). Westinghouse performed an importance analysis for 25 top events in the event trees for each of the test or maintenance configurations associated with the proposed TS changes. This analysis determined the system importances for plant configurations with no ongoing test and maintenance activities (i.e., all components available) and for plant configurations with ongoing test or maintenance activities individually on the analog channels, logic trains, master relays, and slave relays. With test or maintenance activities in progress, the analysis assumed that the corresponding component or

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 15 of 50 train will be unavailable. The system importances for these configurations are provided in Table Q18.1 of Reference 7. The importances were compared between the cases with individual components unavailable and all components available. For the cases of the analog channels, master relays, and slave relays, the importance rankings among the affected systems did not change. For the case of an SSPS logic train in maintenance, several systems had a relatively significant increase in their importance ranking. Those systems were auxiliary feedwater (AFW), reactor trip, high pressure injection, low pressure injection, and containment cooling.

In addition, as discussed in Section 4.1.1 above, the response to RAI Question 11 in Reference 7 documented ICCDP values for thevarious test and maintenance configurations that the plant may enter for the subject CT extensions. This information is provided in Table Q11.1 of Reference 7. The same conclusion is drawn from the information presented in Table Q11.1, i.e., the only configuration that significantly impacts core damage frequency is that with a logic train inoperable.

Based on the information provided in Tables Q11.1 and Table Q18.1 from Reference 7, the only plant configuration with an appreciable impact on CDF or a significant impact on the relative importance of other systems is the configuration with one logic train inoperable. Therefore, the Tier 2 limitations are appropriate only when a logic train is inoperable. There are no Tier 2 limitations when a slave relay, master relay, or analog channel is inoperable.

Consistent with the WCAP-14333 SE requirement to include Tier 2 insights into the decision-making process before taking equipment out of service, restrictions on concurrent removal of certain equipment when a logic train is inoperable for maintenance will be established. These restrictions do not apply when a logic train is being tested under the 4-hour bypass of TS 3.3.2 Action 14, or TS 3.3.2 Action 22.

Entry into these Conditions is not a typical, pre-planned evolution during power operation, other than for surveillance testing.

Since these Actions are typically entered due to equipment failure, it follows that some of the following Tier 2 restrictions may not be met at the time of Action entry. If this situation were to occur during the extended 24-hour CT, the Tier 3 CRMP discussed below will assess the emergent condition and direct activities to restore the inoperable logic train and exit the Action or fully implement the Tier 2 restrictions.

DNC will establish administrative controls at MPS3 to implement the following restrictions during the mode of applicability for the specified equipment. These administrative controls are considered commitments, are noted as such, and are summarized in Attachment 4:

1. To preserve ATWS mitigation capability, activities that degrade the availability of the RCS pressure relief system, the AFW system, AMSAC, or turbine trip

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 16 of 50 should not be scheduled when a logic train is inoperable for maintenance.

[Regulatory Commitment]

2. To preserve Loss of Coolant Accident (LOCA) mitigation capability, one complete Emergency Core Cooling System (ECCS) train that can be actuated automatically must be maintained when a logic train is inoperable for maintenance. [Regulatory Commitment]

3. To preserve reactor trip and safeguards actuation capability, activities that cause RTS and ESFAS master relays or slave relays in the available train to be unavailable and activities that cause RTS and ESFAS analog channels to be unavailable should not be scheduled when a logic train is inoperable for maintenance, with the exception of ESFAS Functional Unit 2.c, "Containment Spray, Containment Pressure High-3," and ESFAS Functional Unit 3.b.3, "Containment Isolation, Phase B Isolation, Containment Pressure High-3." TS 3.3.2, Action 17 requires that both of these functions be placed in bypass when inoperable. [Regulatory Commitment]

4. Activities that result in the inoperability of electrical systems (e.g., AC and DC power) and cooling systems (e.g., service water and component cooling water) that support the RCS pressure relief system, AFW system, AMSAC, turbine trip, one complete train of ECCS, and the available reactor trip and ESFAS actuation functions should not be scheduled when a logic train or an RTB train is inoperable for maintenance. That is, one complete train of a function that supports a complete train of a function noted above must be available.

[Regulatory Commitment]

Note that the containment cooling system was shown to have a relatively significant increase in importance ranking in Table Q18.1 when a logic train is inoperable. At MPS3, containment cooling is comprised of the Quench Spray System (QSS) and Recirculation Spray System (RSS). The QSS provides containment spray during the injection phase of a LOCA; whereas, RSS provides containment spray during the sump recirculation phase of a LOCA. The RSS also performs a core cooling function as the system supplies sump water to the suction of the high head and intermediate head safety injection pumps. Therefore, RSS is considered part of the ECCS train described in restriction 2 listed above. However, per the MPS3 PRA model, QSS has a negligible impact on CDF. As a result, increasing the availability of QSS will not offset or counter the inoperable logic train and no Tier 2 limitations are appropriate for this system.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 17 of 50 4.2.2 WCAP-15376 Tier 2 Restrictions Recommended Tier 2 restrictions for WCAP-1 5376 are provided in Section 8.5 of that topical report when a RTB train is inoperable for maintenance. These restrictions do not apply when a RTB train is being tested under the 4-hour bypass for proposed TS 3.3.1 Actions 10. Entry into this Action is not a typical, pre-planned evolution during power operation, other than for surveillance testing.

Since this Action is typically entered due to equipment failure, it follows that some of the following Tier 2 restrictions may not be met at the time of Condition entry. If this situation were to occur during the extended 24-hour CT, the Tier 3 CRMP discussed below will assess the emergent condition and direct activities to restore the inoperable RTB train and exit the Condition or fully implement the Tier 2 restrictions or perform a plant shutdown, as appropriate from a risk management perspective.

DNC will establish administrative controls at MPS3 to implement the following restrictions. These administrative controls are considered commitments, are noted as such, and are summarized in Attachment 4.

1. The probability of failing to trip the reactor on demand will increase when a RTB train is removed from service, therefore, systems designed for mitigating an ATWS event should be maintained available. Therefore, activities that degrade the availability of the RCS pressure relief system, the AFW auxiliary feedwater system, AMSAC, or turbine trip should not be scheduled when an RTB train is inoperable for maintenance. [Regulatory Commitment]

2. Due to the increased dependence on the available reactor trip train when one logic train or one RTB train is inoperable for maintenance, activities that cause RTS and ESFAS master relays or slave relays in the available train to be unavailable, and activities that cause RTS and ESFAS analog channels to be unavailable, should not be scheduled when an RTB train is inoperable for maintenance, with the exception of ESFAS Functional Unit 2.c, "Containment Spray, Containment Pressure High-3," and ESFAS Functional Unit 3.b.3, "Containment Isolation, Phase B Isolation, Containment Pressure High-3." TS 3.3.2, Action 17 requires that both of these functions be placed in bypass when inoperable. [Regulatory Commitment]

3. Activities that result in the inoperability of electrical systems (e.g., AC and DC power) and cooling systems (e.g., service water and component cooling water) that support the RCS pressure relief system, the AFW system, AMSAC, turbine trip, one complete train of ECCS, and the available reactor trip and ESFAS actuation functions should not be scheduled when a RTB train is inoperable for maintenance. That is, one complete train of a function that supports a complete train of a function noted above must be available.

[Regulatory Commitment]

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 18 of 50 4.3 Tier 3, Risk-Informed Configuration Risk Management Tier 3 requires a proceduralized process to assess the risk associated with both planned and unplanned work activities. The objective of the third tier is to ensure that the risk impact of out-of-service equipment is evaluated prior to performing any maintenance activity. As stated in Section 2.3 of RG 1.177, "a viable program would be one that is able to uncover risk-significant plant equipment outage configurations in a timely manner during normal plant operation." The third-tier requirement is an extension of the second tier requirement, but addresses the limitation of not being able to identify all possible risk-significant plant configurations in the Tier 2 evaluation.

DNC has developed and implemented a CRMP at MPS3. The CRMP is governed by station procedures that ensure the risk impact of out-of-service equipment is appropriately evaluated prior to performing any maintenance activity. This program requires an integrated review to uncover risk-significant plant equipment outage configurations in a timely manner both during the work management process and for emergent conditions during normal plant operation. Appropriate consideration is given to equipment unavailability, operational activities like testing or load dispatching, and weather conditions. MPS3 currently has the capability to perform a configuration dependent assessment of the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service. Risk is re-assessed if an equipment failure/malfunction or emergent condition produces a plant configuration that has not been previously assessed.

For planned maintenance activities, an assessment of the overall risk of the activity on plant safety, including benefits to system reliability and performance, is currently performed prior to scheduled work. The assessment includes the following considerations.

" Maintenance activities that affect redundant and diverse SSCs that provide backup for the same function are minimized.

" The potential for plannpd activities to cause a plant transient are reviewed and work on SSCs that would be required to mitigate the transient are avoided.

" Work is not scheduled that is highly likely to exceed a TS or Technical Requirements Manual (TRM) CT requiring a plant shutdown. For activities that are expected to exceed 50% of a TS CT, compensatory measures and contingency plans are considered to minimize SSC unavailability and maximize SSC reliability.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 19 of 50

For Maintenance Rule high risk significant SSCs, the impact of the planned activity on the unavailability performance criteria is evaluated.

As a final check, a quantitative risk assessment is performed to ensure that the activity does not pose any unacceptable risk. This evaluation is performed using the impact on both CDF and LERF. The results of the risk assessment are classified by a color code based on the increased risk of the activity as shown in Table 4.

TABLE 4 Risk Assessment Classification Scheme RED: ORANGE: YELLOW: GREEN:

High Risk Moderate Risk Low-to-Moderate Risk Low Risk

DO NOT ENTER

REVIEW the " PERFORM

ESTABLISH any RED risk maintenance appropriate pre- risk window without plan to ensure planning to minimize management management that the the configuration's actions if the approval. configuration duration. ACT clock is

UPDATE plant will be cleared

NOTIFY the exceeded. If management of all before the operations shift, if the ACT clock developments clock expires, if warranted. is exceeded, during unplanned possible. " INCREASE risk the unit is in entry.

UPDATE plant awareness. (This "MODERATE"

PERFORM management varies station to risk and an maintenance of all station, but generally ORANGE continuously to developments means that the window is restore the unit to at least once Schedulers, Shift entered.

a lower risk per shift. Technical Advisors configuration.

EVALUATE (STAs) & Operators

" DO NOT REMOVE the feasibility should be aware of any additional of performing emergent equipment from continuous components that service. maintenance become unavailable

" IMPLEMENT risk until the and to immediately management configuration is reevaluate the risk measures to cleared. assessment to see if protect the key " ESTABLISH another component safety functions risk needs to be returned and restore management to available as soon defense-in-depth. actions if the as possible (ASAP.)

RETURN other out clock is

ESTABLISH risk of service (OOS) exceeded. management actions equipment to if the allowed service as quickly configuration time as possible. (ACT) clock is exceeded. If the

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 20 of 50 TABLE 4 Risk Assessment Classification Scheme ACT clock is exceeded, the unit is in "MODERATE" risk and an ORANGE window is entered.

Emergent work is reviewed by shift operations to ensure that the work does not invalidate the assumptions made during the work management process. DNC's PRA risk management procedure has been implemented at MPS3. This procedure defines the requirements for ensuring that the PRA model used to evaluate on-line maintenance activities is an accurate model of the current plant design and operational characteristics. Plant modifications and procedure changes are monitored, assessed, and dispositioned. Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by the qualitative assessment of the impact of the change on the PRA assessment tool.

Dominion employs a structured approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating Dominion nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews.

Maintenance Rule Program The reliability and availability of the RTS and ESFAS instrumentation is monitored under the Maintenance Rule Program. If the pre-established reliability or availability performance criteria is exceeded for an instrumentation component, that component is considered for 10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants," paragraph (a)(1) actions, requiring increased management attention and goal setting in order to restore performance (i.e., reliability and availability) to an acceptable level. The performance criteria are risk-based and, therefore, are a means to manage the overall risk profile of the plant. An accumulation of large core damage probabilities over time is precluded by the performance criteria.

Plant modifications and procedure changes are monitored, assessed and dispositioned. Evaluation of changes in plant configuration or PRA model features are dispositioned by implementing PRA model changes or by qualitatively assessing the impact of the changes on the CRMP assessment tool. Procedures exist for the control and application of CRMP assessment tools, and include a description of the process when the plant configuration of concern is outside the scope of the CRMP assessment tool.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 21 of 50 Change Control The CRMP is referenced and maintained in plant specific procedures. Changes to the plant procedures are subject to the requirements of 10 CFR 50.59, "Changes, Tests, and Experiments." The goals of a CRMP are to ensure that risk-significant plant configurations will not be inadvertently entered for planned maintenance activities, and appropriate actions will be taken should unforeseen events place the plant in a risk-significant configuration during the maintenance activity.

4.4 NRC SE Conditions, WCAP-14333 and WCAP-15376 4.4.1 NRC SE Conditions, WCAP-14333 WCAP-14333 provides justification for (1) an increase in the bypass times for testing and the CTs for both the SSPS and relay protection for RPS and ESFAS instrumentation, and (2) a revised action statement for an inoperable slave relay.

Section 4.0 of the NRC SE that approved WCAP-14333 specified the following conditions and limitations of the applicability of the WCAP on a plant-specific basis:

1. Confirm the applicability of WCAP-14333 analyses to the plant.

2. Address the Tier 2 and Tier 3 analyses:

a. Confirm that the necessary restrictions will be placed on concurrent equipment outages in order to avoid risk significant configurations, and

b. Describe the provisions of the plant's CRMP consistent with the guidance of draft RG 1065 (DG-1065) for assessing risk associated with various planned and unplanned work activities.

4.4.2 NRC SE Conditions, WCAP-15376 WCAP-1 5376 provides justification for an increase in the (1) bypass times for testing and CTs for RTBs, and (2) STIs for components of the RPS. Section 5.0 of the NRC SE that approved WCAP-1 5376 specified the following conditions and limitations on the applicability of the WCAP on a plant-specific basis:

1. Confirm the applicability of the WCAP-1 5376 analysis, including component failure probabilities, to each plant, and perform a plant-specific assessment of containment failures and address any design or performance differences that may affect the proposed changes.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 22 of 50

2. Address the Tier 2 and Tier 3 analyses, including risk significant configuration insights, and confirm that these insights are incorporated into the plant-specific CRMP.

3. Evaluate the risk impact of concurrent testing of one logic cabinet and associated RTB on a plant-specific basis to ensure conformance with WCAP-15376, RG 1.174, and RG 1.177, and confirm the applicability to the plant-specific configuration.

4. To ensure consistency with the reference plant, confirm the applicability of the model assumptions for human reliability in WCAP-1 5376 to the plant-specific configuration.

5. For future digital upgrades with increased scope, integration and architectural differences beyond that of Eagle 21, the NRC staff finds that generic applicability of WCAP-1 5376 to future digital systems not clear and should be considered on a plant specific basis.

In addition to these five NRC SE conditions, the WOG provided a response to an NRC RAI question (i.e., RAI Question 18) in letter OG-01-058 (Reference 9),

indicating that licensees requesting plant-specific application of the WCAP would review the plant specific setpoint calculation methodology and assumptions to determine the impact of extending the STI of the Channel Operational Test (COT) from 92 to 184 days.

4.4.3 WCAP-14333 and WCAP-15376 SE Condition 1, Confirmation of Topical Report Applicability As guidance to address NRC SE Condition 1 for both WCAPs, Westinghouse issued implementation guidelines for licensees to confirm that the WCAP analyses are applicable to a specific plant. A licensee is expected to confirm the applicability of the topical report to their plant, including component failure probabilities, and to perform a plant-specific assessment of containment failures and address any design or performance differences that may affect the proposed changes. This condition is addressed below in three parts. The first part confirms the applicability of the topical reports, the second part addresses the applicability of component failure probabilities, and the third part addresses the containment failure issue.

1. Applicability of the WCAP-14333 and WCAP-1 5376 Analyses To demonstrate the applicability of the WCAP-14333 and WCAP-1 5376 analyses for MPS3, a comparison between the key generic analysis parameters and assumptions, and plant specific parameters and design is provided in Attachment 3. Tables 1

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 23 of 50 through 4 in Attachment 3 provide a list of the key analysis parameters and assumptions along with the plant specific parameters and design.

The information in Tables 1 through 4 is related to plant specific signals that are available to actuate reactor trip and engineered safety features, and test and maintenance information for the components of the reactor protection system.

Information is also provided in Tables 1 and 4 on the current calculated CDF, LERF, and the contribution to CDF from ATWS events for MPS3. The current plant CDF and LERF values are used to show that these values meet the RG 1.174 criteria for determining that small increases in CDF and LERF are acceptable. The ATWS contribution to CDF is necessary to understand the importance of the ATWS event to the plant's risk, since the proposed changes can impact reactor trip signal availability.

2. Applicability of the Component Failure Probabilities In addition to the information provided in Tables 1 through 4 in Attachment 3, the WCAP-1 5376 Implementation Guideline also requires the confirmation that component failure probabilities developed as part of WCAP-1 5376 are applicable to MPS3.

It is necessary to indicate that component failure probabilities developed as part of WCAP-15376 are applicable to MPS3. For Solid State Protection System (SSPS) plants this includes the master relay and safeguards driver card failure probabilities.

The failure probabilities for these components are provided in Table 8.6 of the WCAP. The data that was used to develop these failure rates is provided in Tables 8.2 and 8.4 of the WCAP. One approach for demonstrating the applicability of the failure probabilities is to collect plant specific data on the components and show that the number of failures experienced for the number of tests/actuations that have occurred would be expected. This can be done by engineering judgment or by analysis based on binomial distribution analysis. Note that the plants that provided component failure data in support of the WCAP analysis, as identified in Tables 8.2 and 8.3, can use this information to address this Condition.

Since MPS3 did not provide failure data in support of WCAP-1 5376 development, a review of the Maintenance Rule Functional Failure database was completed to determine the number of unsafe master relay and safeguards driver card failures (those that preclude satisfying the safety function) that have occurred. The review concluded that there have been no master relay failures and one safeguards driver card failure, which occurred on March 31, 2009. Based on the failure data provided in Table 8.3 of the WCAP, one safeguards driver card failure is considered statistically acceptable. Therefore, the plant-specific master relay and safeguards driver card failure probabilities are deemed applicable to the values documented in WCAP-1 5376.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 24 of 50

3. Containment Failure Assessment Containment failure modes typically considered in PRA include containment isolation failure; containment bypasses from ISLOCA, SGTR, and SG tube creep rupture; and containment failure from steam explosion, hydrogen burns, direct containment heating, and containment steam over-pressurization. The significant contributors to LERF for large dry containment and sub-atmospheric designs are typically containment isolation failure and containment bypasses.

The LERF analysis completed to support this program was based on a large dry containment with LERF contributions from containment isolation failure, and containment bypasses from ISLOCA and SGTR events, excluding SG tube creep rupture. Most large dry and sub-atmospheric containment plants should be consistent with the LERF analysis; therefore, the WCAP results should be applicable to these plants. Note that SG tube creep rupture is generally a small contributor to LERF; therefore, the signal unavailability changes will only have a small impact on LERF related to this contributor.

Plants that have not addressed their PRA peer review findings with respect to containment issues may not be consistent with this LERF analysis. For these plants, it is recommended that the PRA peer review findings related to LERF contributors be considered when demonstrating consistency with the LERF analysis and the applicability of WCAP-1 5376.

MPS3 has a large dry containment and has performed a PRA technical adequacy review. The technical adequacy review confirmed that the conclusions of WCAP-14333 and WCAP-1 5376 are applicable to MPS3 and the MPS3 PRA is deemed technically adequate for use in this risk-informed application. Therefore, the WCAP-15376 containment failure assessment is considered applicable.

4.4.4 WCAP-14333 and WCAP-15376 SE Condition 2 NRC SE Condition 2 for both topical reports is addressed in the Tier 2 and Tier 3 discussions provided above in Sections 4.2 and 4.3.

4.4.5 WCAP-15376 SE Condition 3 With respect to the risk impact of concurrent testing of one logic cabinet and associated RTB (i.e., as required by WCAP-1 5376 SE Condition 3), the response to NRC RAI Question 4 in Reference 8 provided the ICCDP for concurrent testing of one logic cabinet and associated RTB for a total time of 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months is comprised of a CT of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months plus 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to reach Mode 3.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 25 of 50 The ICCDP for 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months of unavailability for this configuration is 3.2E-07. This value meets the RG 1.177 acceptance criterion of less than 5E-07. Since this ICCDP value is based on the logic train and reactor trip breaker being out of service for 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months at the same time, bypassing one logic train and associated RTB train for the proposed 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for testing will also meet the RG 1.177 ICCDP criterion. This analysis is addressed on a plant-specific basis by demonstrating that the WCAP-1 5376 analysis is applicable to MPS3. The applicability of WCAP-1 5376 to MPS3 is discussed in Section 4.4.3 above, and is described in Attachment 3.

4.4.6 WCAP-15376 SE Condition 4 DNC has reviewed the key human reliability assumptions for operator actions in WCAP-1 5376 and compared them to operator actions at MPS3. Attachment 3, Table 5, "WCAP-15376 Implementation Guidelines: Applicability of the Human Reliability Analysis," describes the results of this DNC review. Table 5 identifies that plant procedures are in place at MPS3 for operator action that results in a success path (i.e., a backup to the automatic function) prior to the action becoming ineffective for event mitigation. Based on these procedures, DNC has determined that the model assumptions for human reliability in WCAP-1 5376 are applicable to MPS3.

4.4.7 WCAP-15376 SE Condition 5 This condition does not apply to MPS3 at the present time.

4.4.8 WCAP-15376 RAI Question 18 Commitment In a letter dated July 5, 2011, DNC submitted a license amendment request to relocate TS surveillance frequencies to a licensee controlled program in accordance with TSTF-425, revision 3. The July 5, 2011 submittal relocates surveillance frequencies in TS 3.3.1, "Reactor Trip System (RTS) Instrumentation," Table 4.3-1 and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation," Table 4.3-2 to a licensee controlled program. The proposed changes to surveillance test intervals as addressed in TSTF-41 1, Revision 1, "Surveillance Test Interval Extension for Components of the Reactor Protection System (WCAP-1 5376-P)," are not being addressed in this current license amendment request. Adding 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to the allowed CT to restore an inoperable RTB train, before the plant must be shut down, is the only proposed change addressed in this current submittal based on TSTF-411 (WCAP-1 5376-P).

In response to RAI Question 18, the WOG indicated that plant-specific RTS and ESFAS setpoint uncertainty calculations and assumptions, including instrument drift, would be reviewed to determine the impact of extending the Surveillance Frequency of the COT from 92 days to 184 days (Reference 9). Since the proposed changes to surveillance test intervals as addressed in TSTF-41 1, Revision 1, "Surveillance Test

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 26 of 50 Interval Extension for Components of the Reactor Protection System (WCAP-15376-P)," are not addressed in the current license amendment request, discussion of plant-specific RTS and ESFAS setpoint uncertainty calculations and assumptions, including instrument drift area not necessary.

4.5 Technical Adequacy of MPS3 PRA Model 4.5.1 Background The Level 1 and Level 2 MPS3 PRA analyses were originally developed and submitted to the NRC in 1983 as the Plant Safety Study (PSS). In response to Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities

- 10 CFR 50.54(f)," the MPS3 Individual Plant Examination (IPE) and Individual Plant Examination of External Events (IPEEE) were submitted in the same letter to the NRC dated August 31, 1990 (Reference 10). The NRC staff evaluation reports for the IPE (May 5, 1992) (Reference 11) and IPEEE (May 26, 1998) (Reference 12) concluded that the studies meet the intent of Generic Letter 88-20. The MPS3 PRA has been updated many times since the original PSS. A summary of the MPS3 PRA history is listed below.

Table 5, History of Change Date Model Change 08/83 MPS3 PSS submitted 09/83 Amendment 1: Corrected consequence analysis 01/84 Transfer of PSS technology from Westinghouse, the PSS contractor, to the licensee 04/84 Amendment 2: Reanalysis of seismic fragilities by Structural Mechanics Associates 11/84 Amendment 3: Correction of mathematical error in seismic analysis 08/85 Published MPS3 risk evaluation report (NUREG-1 152) 08/87 Amendment 4 (internal): Reanalysis of the Level 1 PRA to account for actual surveillance intervals, main feedwater recovery, etc.

1988 First round of evaluation of projects under internal Integrated Safety Assessment Program (ISAP) 1989 Second round of internal ISAP evaluations 89-90 Transferred PSS from mini-computer to personal computer 05/90 5th update: Correction of math and logic errors discovered in transfer 06/90 6th update: Updated transient frequencies (plant data), revised V sequence model, and coupled the Level 2 PRA to the Level 1 Fall 90 Coupled the Level 3 PRA to Levels 1 and 2; third round of ISAP evaluations 08/90 Submittal of IPE 05/92 NRC staff evaluation report concludes IPE meets the intent of Generic Letter 88-20. The report contains recommendations to explicitly model 1) total loss of

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 27 of 50 Date Model Change service water (SW) initiating event, 2) Heating Ventilation and Air Conditioning (HVAC) dependency, and 3) Direct Current (DC) power dependency 12_95 Model converted from support state to linked fault tree methodology

a. HVAC dependency explicitly modeled

b. DC power dependency explicitly modeled

c. Total loss of SW initiator modeled 02/96 LERF model developed using original PSS model 10/98 Station Blackout (SBO) diesel generator battery limitation modeled

a. Transfer to sump recirculation analyzed using simulator data

b. Plant-specific data update 08/99 Time-dependent SBO model incorporated

a. Loss of ventilation/room heat-up calculation conclusions incorporated 09/99 Westinghouse Owner's Group (WOG) peer review completed 06/00 Incorporated loss of offsite power and offsite power restoration calculations 09/02 NUREG/CR-5750 used as source of general initiating event frequencies

a. Incorporated some of the peer review level A and B findings and observations 2004 Added main feedwater and condensate systems to the secondary cooling function.

2005 MSPI (Mitigating Systems Performance Indicator) Model Update completed

a. plant specific data

b. reliability: 01/01/2000-12/31/2004

c. unavailability:-January, 2002 to December, 2004

d. initiating events: 1990 to 12/31/2004

e. addressed remaining A and B level peer review findings and observations 2006 2005 Mod A Model (M305 Mod A)

a. Revised the cooling dependency for the charging pump oil cooling system (CCE). SW is not required to cool charging pumps if auxiliary building temperatures remain below 90F.

2006 2005 Mod B and C Model (M305 Mod B & C)

a. added internal flooding in Mod B

b. revised junction box flood damage logic in internal flooding model in Mod C

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 28 of 50 Date Model Change 2007 2005 Mod D Model (M305 Mod D)

a. added hot leg recirculation to large loss of coolant accident (LOCA)

b. added new pre-initiator human error probabilities (HEPs)

c. updated Human Reliability Analysis (HRA) using latest methodology:

Cause Based Decision Tree (CBDT), Human Cognitive Reliability Correlation (HCR), Technique for Human Error Rate Prediction (THERP)

d. updated interfacing system LOCA

e. updated Level 2

f. various other changes (e.g., replaced logic that assumed LOCA, steam.

generator tube rupture (SGTR) or steam line break (SLB) occurs in one reactor coolant system (RCS) loop or steam generator) 2008 Model updated to meet RG 1.200 (M308A).

2012 Model update (M310A)

a. updated with plant-specific data

b. addressed several not-met supporting requirements

c. enhanced documentation 4.5.2 Incorporating Plant Changes The MPS3 PRA model of record, M31OA, and associated documentation have been maintained as a living program and the PRA is updated approximately every 3 to 5 years to reflect the as-built, as-operated plant. The M310A PRA model is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the MPS3 PRA is based on the event tree/fault tree methodology, which is a well-known methodology in the industry.

Dominion employs a structured approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating Dominion nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. The following information describes this approach as it applies to the MPS3 PRA.

There are several procedures and Guidance and Reference Documents (GARDs) that govern Dominion's PRA program. The purpose of the NF-AA-PRA GARDs and procedures is to provide information and guidelines for performing PRAs. Procedure NF-AA-PRA-101 controls the maintenance and use of the PRA documentation and the associated NF-AA-PRA procedures and GARDs. These documents define the process to delineate the types of calculations to be performed, the computer codes and models used, and the process (or technique) by which each calculation is

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 29 of 50 performed.

The NF-AA-PRA series of GARDs and procedures provide a detailed description of the methodology necessary to:

" Perform PRA for the Dominion Nuclear Fleet, including Millstone, North Anna and Surry Power Stations.

" Create and maintain products to support licensing and plant operation concerns for the Dominion Nuclear Fleet.

" Provide PRA model configuration control.

Create and maintain configuration risk evaluation tools for the Dominion Nuclear Fleet.

A procedurally controlled process is used to maintain configuration control of the MPS3 PRA models, data, and software. In addition to model control, administrative mechanisms are in place to assure that plant modifications, procedure changes, operator training, system operation changes, and industry operating experiences (OEs) are appropriately screened, dispositioned, and scheduled for incorporation into the model. These processes help assure that the MPS3 PRA reflects the as-built, as-operated plant within the limitations of the PRA methodology.

This process involves a periodic review and update cycle to model any changes in the plant design or operation. Plant modifications and procedure changes are reviewed on an approximate quarterly or more frequent basis to determine if they impact the PRA and if a PRA modeling and/or documentation change is warranted. If any PRA model changes are warranted, they are added to the PRA Configuration Control (PRACC) database for PRA implementation tracking.

The MPS3 PRACC database was reviewed to identify any open (i.e., not yet officially resolved and incorporated into the PRA) PRACC items. The open PRACC items contain identified PRA changes to address plant modifications (as discussed above) as well as changes to correct errors or to enhance the model. Each item was reviewed for applicability with only one item considered relevant. This item pertains to the modeling of the reactor trip breakers, but it is projected to have an insignificant impact on the PRA model results. Specifically, the current PRA only models common cause failure of the two reactor trip breakers, which must both fail in order for the automatic reactor trip function to fail. However, since the common cause failure probability dominates the failure probability of both breakers, the inclusion of the individual breaker failures is considered necessary only for model completeness.

4.5.3 PRA Review Findings The MPS3 PRA model has benefited from the following comprehensive technical PRA peer reviews:

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 30 of 50 NEI PRA Peer Review The MPS3 internal events PRA received a formal industry PRA peer review in 1999 (Referencel 3). The purpose of the PRA peer review process is to provide a method for establishing the technical quality of a PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The PRA peer review process used a team composed of industry PRA and system analysts, each with significant expertise in both PRA development and PRA applications. This team provided both an objective review of the PRA technical elements and a subjective assessment, based on their PRA experience, regarding the acceptability of the PRA elements. The team used a set of checklists as a framework within which to evaluate the scope, comprehensiveness, completeness, and fidelity of the PRA products available. The MPS3 review team used the "Westinghouse Owner's Group (WOG)

Peer Review Process Guidance" as the basis for the review.

The general scope of the implementation of the PRA peer review included a review of eleven main technical elements, using checklist tables (to cover the elements and sub-elements), for an at-power PRA including internal events, internal flooding, and containment performance, with focus on Large Early Release Frequency (LERF).

The findings and observations (F&Os) from the PRA peer review were prioritized into four categories (A through D) based upon importance to the completeness of the model. All F&Os identified during the 1999 WOG peer review have been addressed.

MPS3 PRA Self-Assessment A self-assessment/independent review of the MPS3 PRA against the American Society of Mechanical Engineers (ASME) PRA standard was performed by Dominion (Reference 14) with the support of a contracting company, MARACOR, in late 2007 using guidance provided in NRC RG 1.200, Revision 1, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results from Risk-Informed Activities".

Many of the supporting requirements (SRs) identified in the self-assessment as not meeting Capability Category II were incorporated into the MPS3 2008 PRA model (M308A) revision. Several improvements made to the model involved documenting sources of uncertainty/assumptions, including additional loss of single AC and DC buses initiators, upgrading component boundaries to be consistent with generic data, updating several thermal hydraulic (e.g., MAAP computer code) runs and improving success criteria documentation.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 31 of 50 MPS3 2012 Focused PRA Peer Review The MPS3 PRA model was then updated (M31 OA) to reflect the current plant configuration and accumulation of additional plant operating history and component failure data. In the M31 OA model update, most of the remaining not-met SRs were addressed by further upgrades to the model documentation as well as improvements to the model.

In June 2012, Science Applications International Corporation (SAIC) performed a focused PRA peer review of model upgrades (Reference 15) incorporated since the 1999 WOG peer review. The purpose of the PRA peer review is to assess whether PRA upgrades, as defined by the ASME/ANS PRA standard, meet the intent of Category II Supporting Requirements.

The scope of this review is defined in Table 6 (Reference 16).

Thbk~ R Sa~nnA nf MPS~ Fn~II~Ad RAvmAw Technical High Level Supporting Comments Element Requirements Requirements (HLRs) (SRs) Covered IE HLR IE-C IE-C8, IE-C9, Focused on support system initiating IE-C10, IE-C11, event fault tree models including Loss of IE-C14 Single AC and DC buses and reactor plant ventilation, and the ISLOCA analysis.

AS HLR AS-A All HLR AS-B All HLR AS-C All SC HLR SC-B All Comprehensive review with attention to revised PORV success criteria for Bleed

& Feed (BAF) for sequences where SG cooling is lost late (after DWST depletion).

SY HLR SY-A SY-A6, SY-A8, Focused on cooling dependency for the SY-A1 1, SY- Charging pump oil cooling system A14, SY-A18 (CCE), ventilation dependencies, and HLR SY-B SY-B5, SY-B6, methodology change from "black box" to SY-B7, SY-B9, component boundaries for the RPS and SY-B10 ESFAS systems.

HR HLR HR-C All Focused on HRA updated to current HLR HR-D All plant procedures and timing, and HLR HR-G All rescreening of pre-initiator HEPs and their updated probabilities using THERP.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 32 of 50 Table 6 Scope of MPS3 Focused Review Technical High Level Supporting Comments Element Requirements Requirements (HLRs) (SRs) Covered DA HLR DA-B All Focused on the changed method for HLR DA-D DA-D5, DA-D6 common cause failures from Multiple Greek Letter (MGL) to the Alpha factor method, and the update to include a systematic approach to grouped CCF treatment.

LE All All IF All All The ASME/ANS PRA standard (Reference 17) contains a total of 316 numbered supporting requirements for internal events and internal flooding in nine technical elements. The focused scope of this review covered a total of 166 supporting requirements. Three (3) of the SRs were determined to be not applicable to the MPS3 PRA model. Of the 163 SRs, 156 SRs, or 95.7%, were rated as SR Met, Capability Category II, or greater and none of the SRs were rated as only Category I.

Seven (7) SRs were rated as Not Met (i.e., technical adequacy gaps). A listing of the Not Met SRs is provided in Table 7.

Table 7 SRs Assessed as Not Met or Category I for the MPS3 PRA Technical Element Not Met SRs Cat I SRs Initiating Event (IE) None None Accident Sequence Analysis (AS) None None Success Criteria (SC) None None Systems Analysis (SY) SY-B6* None Human Reliability Analysis (HR) None None Data Analysis (DA) None None Internal Flooding (IF) IFPP-B2 None IFSO-A4 IFSN-A8 IFEV-A5 IFEV-A7 Large Early Release Frequency (LE) LE-D2 None

Documentation issue that has been resolved following the peer review Gaps to Meeting the ASME/ANS Standard Table 8A provides a list of "gaps" in the technical adequacy of the MPS3 PRA model, M310A. Technical adequacy gaps were identified both during the internal self-

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 33 of 50 assessment and the focused peer review. For each gap, the table provides a gap description, ASME/ANS SR, Current Status/Comment and Importance to Application fields. Modeling gaps are classified as either high risk significant or low risk significant (based on their Fussell-Vesely (FV) importance value using a threshold value of 5E-3), or are classified as no impact to the proposed license amendment.

There were no high risk significant gaps identified.

Table 8B provides a list of "gaps" in the technical adequacy identified both during the internal self-assessment and the focused peer review that have been subsequently addressed. For each gap, the table provides a gap description, ASME/ANS SR, and disposition.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 34 of 50 Table 8A Status of Identified Gaps to Capability Category II of the ASME PRA Standard Title Capability Category II Requirements ASME/ANS Current Status I Comment Importance to Application SR Gap #2 Perform plant walkdowns and SY-A4 A process has been developed and Not Risk Significant interviews with knowledgeable plant implemented to document additional personnel to confirm system analysis information on plant walkdowns and plant Documentation issue only.

correctly reflects the as-built as- personnel interviews within the system operated plant. notebooks. This is an on-going process. No impact to the proposed license amendment.

Walkdowns or interviews have been performed for several systems to confirm that the system analysis correctly reflect the as-built, as operated plant.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 35 of 50 Table 8A Status of Identified GaDs to Capability Cateaorv IIof the ASME PRA Standard Title Capability Category IIRequirements ASME/ANS Current Status I Comment Importance to Application Gap #4 IFor multiple human actions in the

[

I SR HR-G7 There are several numerical I

Low Risk Significant:

same accident sequence or cut set, inconsistencies in the dependency identified in accordance with analysis spreadsheet supporting the A sensitivity study was supporting requirement QU-Cl, human reliability dependency analysis. conducted to determine the risk ASSESS the degree of dependence, significance of this gap. The and calculate a joint human error With an actuation train out of service, dependent HFE probabilities probability that reflects the either due to test or failure, operator that include the operator action dependence. ACCOUNT for the action to manually initiate Safety Injection to manually initiate SI were set influence of success or failure in (SI) is modeled. This action is contained to the probability associated preceding human actions and system in several dependent Human Failure with failing to manually initiate performance on the human event Events (HFEs); whereas, the operator SI (i.e., taking no credit for under consideration including action to trip the reactor given an ATWS other actions within that (a) the time required to complete all is not. dependent HFE beyond actions in relation to the time available manually initiating SI).

to perform the actions (b) factors that could lead to The ACDF was calculated to dependence (e.g., common be 3E-08/yr and ALERF was instrumentation, common procedures, calculated to be 0. The FV increased stress, etc.) values of the affected (c) availability of resources (e.g., dependent HFEs were below personnel) 5E-03 and therefore, this gap is classified as low risk significant.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 36 of 50 Table 8A Status of Identified GaDs to CaDabilitv Cateaorv IIof the ASME PRA Standard Title Capability Category II Requirements ASME/ANS Current Status I Comment Importance to Application SR Gap #5 DOCUMENT the process used to IFPP-B2 Include additional documentation on flood Low Risk Significant identify flood areas. For example, this propagation paths between the two documentation typically includes (a) operating units and the Condensate Internal flooding events that flood areas used in the analysis and Polishing Facility (CPF). For example, it is initiate ATWS or scenarios the reason for eliminating areas from possible for water to propagate from CPF requiring an SI are negligible further analysis (b) any walkdowns to the turbine building. Potential water contributors to core damage performed in support of the plant propagation is bounded by the already frequency.

partitioning. analyzed internal flooding events in the turbine building. Specifically, the amount of water generated during a circulating water pipe break is far greater than the amount of water possibly generated in the CPF.

Gap #6 For each potential source of flooding, IFSO-A4 Need to incorporate internal flooding Low Risk Significant IDENTIFY the flooding mechanisms frequencies associated with non-piping that would result in a release. failures (e.g., expansion joints, bellows, Internal flooding events that INCLUDE overfill, and inadvertent sprinkler initiate ATWS or scenarios (a) failure modes of components such actuation). requiring an SI are negligible as pipes, tanks, gaskets, expansion contributors to core damage joints, fittings, seals, etc. The majority of non-piping components frequency.

(b) human-induced mechanisms that (e.g., pumps, valves, tanks) are identified could lead to overfilling tanks, and included in the internal flooding diversion of flow-through openings analysis. The remaining non-piping created to perform maintenance; failures (expansion joints, bellows and inadvertent actuation of fire- inadvertent actuation of fire protection suppression system system) are bounded by already analyzed (c) other events resulting in a release flow rates. Since the remaining non-piping into the flood area. failures make up a small percentage of the overall system piping failures, any changes in the internal flooding initiating event frequencies will not have a significant impact to the overall CDF/LERF or impact the SFCP.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 37 of 50 Table 8A Status of Identified Gaps to Capability Category IIof the ASME PRA Standard Title Capability Category II Requirements ASME/ANS Current Status / Comment Importance to Application SR Gap #7 COMPARE results and EXPLAIN IE-C12 Perform a reasonableness check of the Low Risk Significant differences in the initiating event expansion joint rupture frequencies analysis with generic data sources to modeled in the internal flooding portion of Internal flooding events that provide a reasonableness check of the the PRA. initiate ATWS or scenarios results. requiring an SI are negligible contributors to core damage frequency.

Gap #8 For each defined flood area and each IFSN-A3 There is a mismatch between some of the Not Risk Significant flood source, IDENTIFY those internal flooding operator actions automatic or operator responses that discussed in PRA Notebooks, Flood Documentation issue only.

have the ability to terminate or contain Scenario Development IF.2 and Recovery the flood propagation. Action Analysis for Internal Flooding No impact to proposed license Events HR. 10. amendment.

Gap #10 DETERMINE the flood initiating event IFEV-A5 In the current PRA model, M310A, the Low Risk Significant frequency for each flood scenario internal flooding initiating events are in group by using the applicable "per calendar year". This is conservative Internal flooding events that requirements in 2-2.1. since the Internal Flooding frequency has initiate ATWS or scenarios not been multiplied by capacity factor. requiring an SI are negligible contributors to core damage I frequency.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 38 of 50 Table 8A Status of Identified Gans to Canabilitv Cateaorv IIof the ASME PRA Standard Title Capability Category IIRequirements ASME/ANS Current Status I Comment Importance to Application SR Gap #11 INCLUDE consideration of human- IFEV-A7 The process used to identify human- Low Risk Significant induced floods during maintenance induced flood scenarios includes an through application of generic data. assumption that only equipment within the Internal flooding events that area that may be affected by spray or jet initiate ATWS or scenarios impingement damage are assumed to fail requiring an SI are negligible and there is no propagation to other areas contributors to core damage and no damage due to submersion. To frequency.

justify this assumption, flooding zones were re-evaluated to augment the modeling of human-induced flooding events during maintenance activities. The review did identify new maintenance-induced flooding events which could potentially occur. When these new events were added to the PRA model, the impact on CDF and LERF was found to be negligible.

Gap #12 EVALUATE the impact of containment LE-D2 An analysis of potential penetration Not Risk Significant seals, penetrations, hatches, drywell failures was performed as part of the heads (BWRs), and vent pipe bellows 1983 MPS3 Plant Safety Study, which is Documentation issue only.

and INCLUDE as potential likely outdated based on research containment challenges, as required. If conducted after 1983. The containment No impact to the proposed generic analyses are used in support capacity analysis should consider license amendment.

of the assessment, JUSTIFY degradation of seal performance at applicability to the plant being elevated temperatures based on newer evaluated, research information.

NUREG/CR-6906 [Ref. 6.14] reports that compression seals and gaskets, electrical penetration assemblies, and personnel airlocks were shown to fail when tested in excess of DBA pressures and temperatures by a factor of 2 to 5. This is consistent with the conclusions in the MPS3 Level 2 Analysis.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 39 of 50 Table 8B Identified Gaps to Capability Category II of the ASME PRA Standard That Have Been Addressed Title Capability Category II Requirements ASME/ANS Disposition SR Gap #1 Interview plant personnel (e.g., IE-A8 Interviews between the PRA staff and Operations staff validated that operations, maintenance, safety potential initiating events have been identified. The interviews satisfy the analysis) to determine if potential requirements of the SR.

initiating events have been overlooked.

Gap #3 When needed, BASE the required time HR-G5 Operator walkthrough/talkthroughs were performed for both significant to complete actions for significant and non-significant human factor events (HFEs). The final analysis Human Failure Events (HFEs) on resulted in no impact to the human error probabilities (HEPs) within the action time measurements in either PRA model.

walkthroughs or talk-throughs of the procedures or simulator observations.

Gap #9 IDENTIFY inter-area propagation IFSN-A8 A review of the inter-area propagation paths did not identify any new through the normal flow path from one flooding events. Revision of the documentation addresses the focused area to another via drain lines; and peer review's findings and no update to the PRA model is planned or areas connected via backflow through necessary.

drain lines involving failed check valves, pipe and cable penetrations (including cable trays), doors, stairwells, hatchways, and HVAC ducts. INCLUDE potential for structural failure (e.g., of doors or walls) due to flooding loads.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 40 of 50 4.5.4 Key Assumptions and Approximations Per Section 4.4.3, the plant-specific master relay and safeguards driver card failure probabilities are deemed applicable to the values documented in WCAP-1 5376.

4.5.5 External Events Considerations The MPS3 PRA is a Level 1 and 2 model that includes internal events and internal floods. For external events such as fire, seismic, extreme winds and other external events, the risk assessments from the IPEEE (Reference 10) can be used for insights.

Fire Risk The IPE fire risk analysis quantified a core damage frequency (CDF) impact by combining the frequency of fires and the probability of detection/suppression failure with the remaining safety function unavailabilities. A systematic approach was used to identify critical fire areas where fires could fail safety functions and pose an increased risk of core damage if other safety functions are unavailable. The CDF due to fire is 4.8E-06/yr, with the dominant risk being fire in the cable spreading room, switchgear rooms, control room, and Charging/CCP zone.

The proposed changes would increase the unavailability of equipment associated with the proposed increased completion and test bypass times. Of the four dominant fire areas listed above, only the switchgear room scenarios may be affected by configuration risk (i.e., fire in the other areas result in loss of both mitigating equipment trains). However, no quantifiable effect on switchgear room contribution is expected based on the following:

" The increase in unavailability time is expected to be minimal based on the nominal increase in completion and bypass time (e.g., SSPS train AOT increased from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

There is a high likelihood of operator recovery with the RPS equipment out of service for testing. The non-response probability used in the current PRA model is 7.9E-04.

Seismic Risk The IPE seismic risk analysis quantified a CDF impact by combining the seismic hazard frequencies with the fragilities of critical structures and components and the safety function unavailabilities to obtain a CDF. The CDF due to seismic events is 9.1 E-06/yr, with the dominant risk being seismic events that result in a loss of offsite power and failure of the EDG enclosures, or collapse of the control building.

The proposed changes would increase the unavailability of equipment associated

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 41 of 50 with the proposed increased completion and test bypass times. Since the dominant seismic CDF scenarios are not affected by configuration risk (i.e., the events result in loss of both mitigating equipment trains), the impact of the proposed changes on seismic risk is small.

Hiah Winds. Floods and Other External Events The risk of other external events such as high winds, aircraft accidents, hazardous materials and turbine missiles was assessed in the MPS3 IPEEE. The IPEEE assessments concluded that the risk of these accidents is negligible primarily due to the low frequency of occurrence that would cause damage to mitigating systems. For example, reinforced concrete structures that provide missile protection during high wind conditions protect all critical safety functions.

4.5.6 Results The MPS3 PRA technical capability evaluations and the maintenance and update processes described above provide a robust basis for concluding that the full power internal events MPS3 PRA is suitable for use in risk-informed processes. In addition, the impact of the proposed changes on fire, seismic, high winds, floods, and other external events is considered small. Table 9 provides a summary of the quantitative impact on CDF and LERF from this risk-informed application, as well as, the other risk-informed applications implemented at MPS3.

Table 9 - Summary of MPS 3 Risk-Informed Applications Estimated Cumulative Risk from Risk-Informed Applications Item No. LAR Calculated Calculated LAR Application ACDF ALERF Date (internal (internal events) events) 1 6/18/1990 2.OE-08 0 Accumulator CT Extension 2 10/1/2001 1.5E-07 2E-10 Emergency Diesel Generator CT Extension 3 5/12/2002 N/A N/A Risk Informed ISI 4 6/14/2006 N/A 1.3E-7 ILRT STI extension (i.e., from once in 10 years to once in

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 42 of 50 Estimated Cumulative Risk from Risk-Informed Applications 15 years) 5 10/4/2012 N/A*** N/A*** Surveillance Frequency Control Program 6 Planned < 1E-06 < 1E-07 RTS/ESFAS CT 2014 Extension

The CDF value prior to implementing the LAR was reported to be 3.6E-05/yr. The CDF value prior to proposing the RTS/ESFAS CT extension is 5.4E-06/yr. The ACDF is estimated to be < 1E-06/yr if the current PRA model is used. Note that the PRA model change history is provided in Section 4.5.1.

- Westinghouse methodology used for this application, which, by definition, poses no risk increase.

NEI 04-10 used for this application, which ensures that the risk changes are small.

4.5.7 Conclusion The conclusions of WCAP-14333 and WCAP-1 5376 are applicable to MPS3 and the MPS3 PRA is deemed technically adequate for use in this risk-informed application.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Pursuant to 10 CFR50.90, Dominion Nuclear Connecticut, Inc. (DNC) requests amendment to Operating License NPF-49 for Millstone Power Station Unit 3 (MPS3).

The proposed amendment would revise Technical Specification (TS) 3.3.1, "Reactor Trip System (RTS) Instrumentation" and TS 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) Instrumentation," to adopt the Completion Times (CTs),

and test bypass times, approved by NRC in WCAP-14333-P-A, Revision 1, October 1998 and WCAP-1 5376-P-A, Revision 1, March 2003. This amendment application is consistent with NRC-approved Technical Specification Task Force (TSTF)

Travelers TSTF-411 Revision 1, "Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-1 5376-P)," and TSTF-418 Revision 2, "RPS and ESFAS Test Times and Completion Times (WCAP-14333)."

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 43 of 50 According to 10 CFR 50.92(c), a proposed amendment to an operating license involves no significant hazards consideration if operation of the facility in accordance with the proposed amendment would not:

1. Involve a significant increase in the probability or consequences of an accident previously evaluated; or

2. Create the possibility of a new or different kind of accident from any accident previously evaluated ; or

3. Involve a significant reduction in a margin of safety.

In support of this determination, an evaluation of each of the three criteria set forth in 10 CFR 50.92 is provided below regarding the proposed license amendment.

1. The proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

Response: No Overall protection system performance will remain within the bounds of the previously performed accident analyses since no hardware changes are proposed. The same RTS and ESFAS instrumentation will continue to be used. The protection systems will continue to function in a manner consistent with the plant design basis. These changes to the TS do not result in a condition where the design, material, and construction standards that were applicable prior to the change are altered.

The proposed changes will not modify any system interface. The proposed changes will not affect the probability of any event initiators. There will be no degradation in the performance of or an increase in the number of challenges imposed on safety-related equipment assumed to function during an accident situation. There will be no change to normal plant operating parameters or accident mitigation performance.

The proposed changes will not alter any assumptions or change any mitigation actions in the radiological consequence evaluations in the Final Safety Analysis Report (FSAR).

The determination that the results of the proposed changes are acceptable was established in the NRC Safety Evaluations prepared for WCAP-14333-P-A, (issued by letter dated July 15, 1998) and for WCAP-1 5376-P-A, (issued by letter dated December 20, 2002). Implementation of the proposed changes will result in an insignificant risk impact. Applicability of these conclusions has been verified through plant-specific reviews and implementation of the generic analysis results in accordance with the respective NRC Safety Evaluation conditions.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 44 of 50 The proposed changes to the CTs, and test bypass times reduce the potential for inadvertent reactor trips and spurious engineered safeguard features actuations, and therefore do not increase the probability of any accident previously evaluated. The proposed changes do not change the response of the plant to any accidents and have an insignificant impact on the reliability of the RTS and ESFAS signals. The RTS and ESFAS will remain highly reliable and the proposed changes will not result in a significant increase in the risk of plant operation. This is demonstrated by showing that the impact on plant safety, as measured by the increase in core damage frequency (CDF) is less than 1.OE-06 per year and the increase in large early release frequency (LERF) is less than 1.OE- 07 per year. In addition, for the CT changes, the incremental conditional core damage probabilities (ICCDP) and incremental conditional large early release probabilities (ICLERP) are less than 5.OE-07 and 5.OE-08, respectively. These changes meet the acceptance criteria in Regulatory Guides (RGs) 1.174 and 1.177. Therefore, since the RTS and ESFAS will continue to perform their functions with high reliability, as originally assumed, and the increase in risk, as measured by ACDF, ALERF, ICCDP, ICLERP risk metrics, is within the acceptance criteria of existing regulatory guidance, there will not be a significant increase in the consequences of any accidents.

The proposed changes do not adversely affect accident initiators or precursors nor alter the design assumptions, conditions, or configuration of the facility or the manner in which the plant is operated and maintained. The proposed changes do not alter or prevent the ability of structures, systems, and components from performing their intended function to mitigate the consequences of an initiating event within the assumed acceptance limits. The proposed changes do not affect the source term, containment isolation, or radiological release assumptions used in evaluating the radiological consequences of any accident previously evaluated. The proposed changes are consistent with safety analysis assumptions and resultant consequences.

Therefore, this change does not significantly increase the probability or consequences of any accident previously evaluated.

2. The proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

Response: No There are no hardware changes nor are there any changes in the method by which any safety-related plant system performs its safety function. The proposed changes will not affect the normal method of plant operation. No performance requirements will be affected or eliminated. The proposed changes will not result in physical alteration to any plant system nor will there be any change in the method by which

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 45 of 50 any safety-related plant system performs its safety function. There will be no setpoint changes or changes to accident analysis assumptions.

No new accident scenarios, transient precursors, failure mechanisms, or limiting single failures are introduced as a result of these changes. There will be no adverse effect or challenges imposed on any safety-related system as a result of these changes.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

3. The proposed changes do not involve a significant reduction in a margin of safety?

Response: No The proposed changes do not affect the acceptance criteria for any analyzed event nor is there a change to any Safety Analysis Limit. There will be no effect on the manner in which safety limits, limiting safety system settings, or limiting conditions for operation are determined nor will there be any effect on those plant systems necessary to assure the accomplishment of protection functions. There will be no impact on the departure from nucleate boiling limits, fuel centerline temperature, or any other margin of safety. The radiological dose consequence acceptance criteria listed in the NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," will continue to be met.

Redundant RTS and ESFAS trains are maintained, and diversity with regard of the signals that provide reactor trip and engineered safety features actuation is also maintained. All signals credited as primary or secondary, and all operator actions credited in the accident analyses will remain the same. The proposed changes will not result in plant operation in a configuration outside the design basis. The calculated impact on risk is insignificant and meets the acceptance criteria contained in RGs 1.174 and 1.177.

Implementation of the proposed changes is expected to result in an overall improvement in safety, as follows:

" Improvements in the effectiveness of the operating staff in monitoring and controlling plant operation will be realized. This is due to less frequent distraction of the operators and shift supervisor to attend to instrumentation Required Actions with short CTs.

" Longer repair times associated with increased CTs will lead to higher quality repairs and improved reliability.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 46 of 50 The CT extensions for the reactor trip breakers will provide additional time to complete test and maintenance activities while at power, potentially reducing the number of forced outages related to compliance with reactor trip breaker CT, and provide consistency with the CT for the logic trains.

Therefore, the proposed changes do not involve a significant reduction in the margin of safety.

Based on the above analysis, DNC has concluded that the proposed amendment involves no significant hazards consideration under the standards set forth in 10 CFR 50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria The regulatory bases and guidance documents associated with the systems discussed in this license amendment request are the following:

General design criteria (GDC) 2 requires that structures, systems, and components important to safety be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without the loss of the capability to perform their safety functions.

GDC 4 requires that structures, systems, and components (SSCs) important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with the normal operation, maintenance, testing, and postulated accidents, including Loss of Coolant Accidents (LOCAs). These SSCs shall be appropriately protected against dynamic effects, including the effects of missiles, pipe whipping, discharging fluids that may result from equipment failures, and from events and conditions outside the nuclear power unit. However, dynamic effects associated with postulated pipe ruptures in nuclear power units may be excluded from the design basis when analyses reviewed and approved by the Commission demonstrate that the probability of fluid system piping rupture is extremely low under conditions consistent with the design basis for the piping.

GDC 13 requires that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 47 of 50 GDC 20 requires that the protection system(s) shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

GDC 21 requires that the protection system(s) shall be designed for high functional reliability and testability.

GDC 22 through GDC 25 and GDC 29 require various design attributes for the protection system(s), including independence, safe failure modes, separation from control systems, requirements for reactivity control malfunctions, and protection against anticipated operational occurrences.

RG 1.22 discusses an acceptable method of satisfying GDC 20 and GDC 21 regarding the periodic testing of protection system actuation functions. These periodic tests should duplicate, as closely as practicable, the performance that is required of the actuation devices in the event of an accident.

10 CFR 50.55a(h) requires that the protection systems meet IEEE 279-1971.

Section 4.2 of IEEE 279-1971 discusses the general functional requirement for protection systems to assure they satisfy the single failure criterion.

There will be no changes to the RTS or ESFAS instrumentation design such that compliance with any of the regulatory requirements and guidance documents above would come into question. The above evaluations confirm that the plant will continue to comply with all applicable regulatory requirements.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

DNC has evaluated this proposed license amendment consistent with the criteria for identification of licensing and regulatory actions requiring environmental assessment in accordance with 10 CFR 51.21, "Criteria for and identification of licensing and regulatory actions requiring environmental assessments." DNC has determined that this proposed change meets the criteria for categorical exclusion set forth in paragraph (c)(9) of 10 CFR 51.22, "Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review," and has determined that no irreversible

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 1, Page 48 of 50 consequences exist in accordance with paragraph (b) of 10 CFR 50.92, "Issuance of amendment." This determination is based on the fact that this change is being processed as an amendment to the license issued pursuant to 10 CFR 50, "Domestic Licensing of Production and Utilization Facilities," which changes a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, "Standards for Protection Against Radiation," or which changes an inspection or surveillance requirement and the amendment meets the following specific criteria :

1. The amendment involves no significant hazards consideration.

As demonstrated in Section 5.1 above, "No Significant Hazards Consideration,"

the proposed change does not involve any significant hazards consideration.

2. There is no significant change in the types or significant increase in the amounts of any effluent that may be released offsite.

The proposed changes will adopt NRC-approved Completion Times (CTs), and test bypass times for the Reactor Trip System instrumentation and Engineered Safeguards Actuation System instrumentation. The proposed changes do not result in an increase in power level, and do not increase the production nor alter the flow path or method of disposal of radioactive waste or byproducts ; thus, there will be no change in the amounts of radiological effluents released offsite.

Based on the above evaluation, the proposed change will not result in a significant change in the types or significant increase in the amounts of any effluent released offsite.

3. There is no significant increase in individual or cumulative occupational radiation exposure.

The proposed change will not result in any changes to the configuration of the facility. The proposed changes to adopt NRC-approved CTs, and test bypass times for the Reactor Trip System instrumentation and Engineered Safeguards Actuation System will not cause a change in the level of controls or methodology used for the processing of radioactive effluents or handling of solid radioactive waste, nor will the proposed amendment result in any change in the normal radiation levels in the plant. Therefore, there will be no increase in individual or cumulative occupational radiation exposure resulting from this change.

7.0 PRECEDENT The proposed license amendment incorporates, into the MPS3 TS, changes that are similar to NRC-approved LARs for the following licensees:

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-1 5376 Attachment 1, Page 49 of 50

" Callaway Plant, Unit 1 on January 31, 2005

Wolf Creek Generating Station on January 31, 2005

" Diablo Canyon Power Plant, Unit No.1 and Unit No.2 on January 31, 2005

" Comanche Peak Steam Electric Station, Units 1 and 2 on January 31, 2005

" D.C. Cook Nuclear Plant, Units 1 and 2 for WCAP-1 5376 changes only on May 23, 2003

" South Texas Project, Units 1 and 2 for WCAP-14333 changes only on March 19, 2002

Vogtle Electric Generating Plant, Units 1 and 2 for WCAP-14333 changes on December 22, 2000 and for WCAP-1 5376 changes on September 1, 2006.

" Byron Station, Units 1 and 2, and Braidwood Station Units 1 and 2 for WCAP-14333 and for WCAP-1 5376 changes on January 29, 2008.

8.0 REFERENCES

1. WCAP-14333-P-A, Revision 1, "Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times," October 1998.

2. WCAP-1 5376-P-A, Revision 1, "Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times," March 2003.

3. Technical Specification Task Force (TSTF) Traveler TSTF-41 1, Revision 1, "Surveillance Test Interval Extension for Components of the Reactor Protection System (WCAP-15376-P)."

4. TSTF-418, Revision 2, "RPS and ESFAS Test Times and Completion Times (WCAP-14333)."

5. Letterfrom J. F. Opeka, Northeast Nuclear Energy Company to NRC, dated March 3, 1992, Transmitting Proposed Revisions to Technical Specifications to Facility Operating License NPF-49, "Increased Surveillance Test Intervals and Allowed Outage Times for the Reactor Protection Systems and Engineered Safety Features Actuation System."

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 1, Page 50 of 50

6. Letter from V. L. Rooney (NRC) to J. F. Opeka (Northeast Nuclear Energy Company) dated November 23, 1992, transmitting Amendment 70 to Facility Operating License NPF-49.

7. Letter from N. J. Stringfellow (Westinghouse Owners Group) to NRC dated December 20, 1996, transmitting Westinghouse Owners Group letter OG 110, Response to Request for Additional Information Regarding WCAP-14333.

8. Letter from R. H. Bryan (Westinghouse Owners Group) to NRC dated January 8, 2002, transmitting Westinghouse Owners Group letter OG-02-002, Response to Request for Additional Information Regarding WCAP-1 5376.

9. Letter from R. H. Bryan (Westinghouse Owners Group) to NRC dated September 28, 2001, transmitting Westinghouse Owners Group letter OG 058.

10. E. J. Mroczka letter to the Nuclear Regulatory Commission, "Millstone Nuclear Power Station, Unit No.3, Response to Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities, Summary Report Submittal,"

dated August 31, 1990

11. V. L. Rooney (NRC) letter to Northeast Nuclear Energy Company, "Staff Evaluation of Millstone 3 Individual Plant Examination, (IPE) -Internal Events, GL 88-20 (TAC No. M74434)," May 5,1992

12. J. W. Andersen (NRC) letter to Northeast Nuclear Energy Company, "Millstone Nuclear Power Station, Unit No. 3 Individual Plant Examination of External Events (TAC No. M83643)," May 26, 1998

13. Millstone Power Station Unit 3 Probabilistic Risk Assessment Peer Review Report, September 1999

14. PRA Model Notebook Appendix A.1, "Internal Events Model Self Assessment," August 2007, Millstone Power Station Unit 3

15. PRA Model Notebook Part IV, Appendix A.3, "Reg Guide 1.200 Peer Review,"

August 2012, Millstone Power Station Unit 3

16. PRA Model Notebook Part IV, Appendix B, "Quality Summary," May 2012, Millstone Power Station Unit 3 17.ASME/ANS RA-S-2008, "Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications" and its 2009 addendum (ASME/ANS RA-Sa-2009)

Serial No.14-107 Docket No. 50-423 Attachment 2 Marked-Up Pages of the Proposed Changes to the Technical Specifications DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

November 3, 2000 3/4.3 INSTRUMENTATION For Information Only, No Change 3/4.3.1 REACTOR TRIP SYSTEM INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.1 As a minimum, the Reactor Trip System instrumentation channels and interlocks of Table 3.3-1 shall be OPERABLE.

APPLICABILITY: As shown in Table 3.3-1.

ACTION:

As shown in Table 3.3-1.

SURVEILLANCE REQUIREMENTS 4.3.1.1 Each Reactor Trip System instrumentation channel and interlock and the automatic trip logic shall be demonstrated OPERABLE by the performance of the Reactor Trip System Instrumentation Surveillance Requirements specified in Table 4.3-1.

4.3.1.2 The REACTOR TRIP SYSTEM RESPONSE TIME of each Reactor trip function shall be verified to be within its limit at least once per 18 months. Neutron detectors and speed sensors are exempt from response time verification. Each verification shall include at least one train such that both trains are verified at least once per 36 months and one channel (to include input relays to both trains) per function such that all channels are verified at least once every N times 18 months where N is the total number of redundant channels in a specific Reactor trip function as shown in the "Total No. of Channels" column of Table 3.3-1.

3 3/4 3-1 Amendment No. 4-5, 79, 91, 1-00, 187 AMILLSTONE - UNIT

t-4 cj~ TABLE 3.3-1 H

0 REACTOR TRIP SYSTEM INSTRUMENTATION z~11 MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION H

1. Manual Reactor Trip 2 I 2 1,2 1

-n 2 1 2 3*, 4*, 5* 11

2. Power Range, Neutron Flux 0

a. High Setpoint 2 3 1,2 2

b. Low Setpoint 2 3 1###, 2 2 0

3. Power Range, Neutron Flux 2-)

High Positive Rate 2 3 1,2 2

4. Deleted

5. Intermediate Range, Neutron Flux 1 2 1###, 2 3 CD

6. Source Range, Neutron Flux

a. STARTUP 1 2 4 I 0 b. Shutdown 1 2 3*, 4*, 5* 11

7. Overtemperature AT 2 3 1,2 6

8. Overpower AT 2 3 1,2 6

9. Pressurizer Pressure--Low 2 3 1** 6 (1)

10. Pressurizer Pressure--High 2 3 1,2 6 (1) -t 01 L'J 11. Pressurizer Water Level--High 2 2 1** 6

TABLE 3.3-1 (Continued)

REA4CTOR TRIP SYSTEM INSTRUMENTATION H

0 MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE

!FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

12. Reactor Coolant Flow--Low

a. Single Loop (Above P-8) 3/loop 2/loop 2/loop 1 6

b. Two Loops (Above P-7 and 3/loop 2/loop in two 2/loop 1 6 below P-8) operating loops -n 0

13. Steam Generator Water 4/stm. gen. 2/stm. gen. 3/stm. gen. 1,2 6(1)

Level--Low-Low

, 14. Low Shaft Speed--Reactor 4-1/pump 2 3 6 Coolant Pumps 0

15. Turbine Trip

a. Low Fluid Oil Pressure 3 2 2 1"** 12

b. Turbine Stop Valve Closure 4 4 4 6 z 0

16. Deleted

> 17. Reactor Trip System Interlocks

a. Intermediate Range 2 1 2 8 CD Neutron Flux, P-6

b. Low Power Reactor Z

0 Trips Block, P-7 Power Range Neutron Flux, 4 2 3 1 8 I P- 10 Input or C4 Turbine Impulse Chamber 2 1 2 I CD

ý1 Pressure, P- 13 Input CD 07 8 0D 0O

TABLE 3.3-1 (Continued) cj~ REACTOR TRIP SYSTEM INSTRUMENTATION H

0 z MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION -n 0

H 17. Reactor Trip System Interlocks "3 (Continued) 0

c. Power Range Neutron 4 2 3 8 Flux, P-8 0

d. Power Range Neutron 4 2 3 8 0

Flux, P-9

e. Power Range Neutron 4 2 3 1,2 8 Flux, P-10

18. Reactor Trip Breakers (2) 2 2 1,2 10, 13 2 1 2 3*, 4*, 5* 11 1 CD

19. Automatic Trip and Interlock 2 2 1,2 13A Logic 2 2 3*, 4*, 5* 11

20. DELETED I

21. DELETED 0

0L z 0 CD E9 CD

Dzzcrnber 10, 2003 TABLE 3.3-1 (Continued)

TABLE NOTATIONS When the Reactor Trip System breakers are in the closed position and the Control Rod Drive System is capable of rod withdrawal.

Above the P-7 (At Power) Setpoint.

Above the P-9 (Reactor Trip/Turbine Trip Interlock) Setpoint.

1. Below the P-6 (Intermediate Range Neutron Flux Interlock) Setpoint.

1. 1. Below the P-10 (Low Setpoint Power Range Neutron Flux Interlock) Setpoint.

(1) The applicable MODES and ACTION statements for these channels noted in Table 3.3-3 are more restrictive and, therefore, applicable.

0(2) Including any reactor trip bypass breakers that are racked in and closed for bypassing a reactor trip breaker.

ACTION STATEMENTS ACTION 1 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION 2 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6-hours,

b. The Minimum Channels OPERABLE require met; however, the inoperable channel may be bypassed for up to-4-hours for surveillance testing of other channels per Specification 4.3.1.1, and

c. Either, THERMAL POWER is restricted to less than or equal to 75%

of RATED THERMAL POWER and the Power Range Neutron Flux *"

Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within-4-hours; or, the QUADRANT POWER TILT RATIO is monitored at 1Ikst once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months per Specification 4.2.4.2.

MILLSTONE - UNIT 3 3/4 3-5 Amendment No. 7, 60, 93-, 4-64, 24-7,.

467ý2ý TABLE 3.3-1 (Continued)

ACTION STATEMENTS (Continued)

ACTION 3 - With the number of channels OPERABLE one less than the Minimum Channels OPERABLE requirement and with the THERMAL POWER level:

a. Below the P-6 (Intermediate Range Neutron Flux Interlock)

Setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint, and

b. Above the P-6 (Intermediate Range Neutron Flux Interlock)

Setpoint but below 10% of RATED THERMAL POWER, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above 10% of RATED THERMAL POWER.

ACTION 4 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, suspend all operations involving positive reactivity additions.*

ACTION 5 - (Not used)

ACTION 6 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within j---- hours, and 12

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 7hours for surveillance testing of other channels per Specification 4.3.1.1.

ACTION 7 - (Not used)

ACTION 8 - With less than the Minimum Number of Channels OPERABLE, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or apply Specification 3.0.3.

Limited plant cooldown or boron dilution is allowed provided the change is accounted for in the calculated SDM.

MILLSTONE - UNIT 3 3/4 3-6 Amendment No. 7,60, 4-3+, 4-64, 2-0-,

M4arceh 16, 20-0-6 TABLE 3.3-1 (Continued)

ACTION STATEMENTS (Continued)

ACTION 9- (Not used) restore the inoperable channel to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or ACTION 10- With the number of OPERABLE ch s one less than the Minimum Channels OPERABLE requirement,?e in at least HOT STANDBY within Ithe nexFt 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; however, one channel may be bypassed for up to-2-hours for surveillance testing per Specification 4.3.1.1, provided the r channel is OPERABLE. jri ACTION 11- With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or open the Reactor Trip System breakers within the next hour.

ACTION 12- With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within-6--

hours, and

b. When the Minimum Channels OPERABLE req1ement is met, the inoperable channel may be bypassed for up to-4-hours for surveillance testing of the Turbine Control Valves.

ACTION 13- With one of the diverse trip features (undervoltage or shunt trip attachments) inoperable, restore it to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or declare the breaker inoperable and apply ACTION 10. The breaker shall not be bypassed while one of the diverse trip features is inoperable except for the time required for performing maintenance to restore the breaker to OPERABLE status.

ACTION 13A- With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable Channel to OPERABLE status within-6 hours or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; however, Le channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Spe~ification 4.3.1.1, provided the other channel is OPERABLE.

MILLSTONE - UNIT 3 3/4 3-7 Amendment No. 70, 89, -9,

5/26/98 INSTRUMENTATION For Information Only, No Change I 3/4.3.2 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION LIMITING CONDITION FOR OPERATION 3.3.2 The Engineered Safety Features Actuation System (ESFAS) instrumentation channels and interlocks shown in Table 3.3-3 shall be OPERABLE with their Trip Setpoints set consistent with the values shown in the Nominal Trip Setpoint column of Table 3.3-4.

APPLICABILITY: As shown in Table 3.3-3.

ACTION:

a. With an ESFAS Instrumentation Channel or Interlock Channel Nominal Trip Setpoint inconsistent with the value shown in the Nominal Trip Setpoint column of Table 3.3-4, adjust the Setpoint consistent with the Nominal Trip Setpoint value.

b. With an ESFAS Instrumentation Channel or Interlock Channel found to be inoperable, declare the channel inoperable and apply the applicable ACTION statement requirements of Table 3.3-3 until the channel is restored to OPERABLE status.

MILLSTONE - UNIT 3 3/4 3-15 Amendment No. 9-1-, 159

November 3, 2000 INSTRUMENTATION For Information Only, No Change SURVEILLANCE REQUIREMENTS 4.3.2.1 Each ESFAS instrumentation channel and interlock and the automatic actuation logic and relays shall be demonstrated OPERABLE by performance of the ESFAS Instrumentation Surveillance Requirements specified in Table 4.3-2.

4.3.2.2 The ENGINEERED SAFETY FEATURES RESPONSE TIME* of each ESFAS function shall be verified to be within the limit at least once per 18 months. Each verification shall include at least one train such that both trains are verified at least once per 36 months and one channel (to include input relays to both trains) per function such that all channels are verified at least once per N times 18 months where N is the total number of redundant channels in a specific ESFAS function as shown in the "Total No. of Channels" column of Table 3.3-3.

The provisions of Specification 4.0.4 are not applicable for response time verification of steam line isolation for entry into MODE 4 and MODE 3 and turbine driven auxiliary feedwater pump for entry into MODE 3.

MILLSTONE - UNIT 3 3/4 3-16 Amendment No. 4-5, 79, 96, 4-00, 187

rJ TABLE 3.3-3 0 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION 0

-1 MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE

, FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

1. Safety Injection (Reactor 0 Trip, Feedwater Isolation, 0 Control Building Isolation (Manual Initiation Only), z 0

Start Diesel Generators, C) and Service Water).

0D

a. Manual Initiation 2 1 2 1,2,3,4 19

b. Automatic Actuation 2 1 2 1,2,3,4 14 Logic and Actuation Relays

c. Containment - 3 2 2 1,2,3 20 Pressure--High- I CD 0-s

d. Pressurizer 4 2 3 1,2, 3# 20 Pressure--Low CD e. Steam Line Pressure-- 3/steam line in 2/steam line in 2/steam line in 1,2, 3# 20 Low each operating any operating each operating loop loop loop Z

0

2. Containment Spray (CDA)

-t

a. Manual Initiation 2 1 with 2 1,2,3,4 19 2 coincident switches

Cd) TABLE 3.3-3 (Continued)

H 0 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION z

MINIMUM TOTAL NO.

CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION

2. Containment Spray (CDA) (Continued)

b. Automatic Actuation 2 I 2 1,2,3,4 14 -n Logic and Actuation 0 Relays

c. Containment Pressure-- 4 2 3 1,2,3,4 17 P, High-3 00 3. Containment Isolation 0

a. Phase "A" Isolation z0

1) Manual Initiation 2 1 2 1,2,3,4 19

2) Automatic Actuation 2 1 2 1,2,3,4 14 Logic and Actuation Relays CD

3) Safety Injection See Item 1. ab,ove for all Safety Injection initiating functions and requirements.

b. Phase "B" Isolation

1) Manual Initiation 2 I with 2 1,2,3,4 19 2 coincident 0D switches ~17 z

2) Automatic Actuation 2 1 2 1,2,3,4 14 CD Logic and Actuation C0 Relays

rJ) TABLE 3.3-3 (Continued)

H 0 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION z

MINIMUM TOTAL NO. CHANNELS CHANNELS APPLICABLE FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION H

3. Containment Isolation (Continued)

3. Containment 4 2 3 1,2,3,4 17 Pressure--High-3

c. DELETED I

4. Steam Line Isolation 0"1

a. Manual Initiation ET

1. Individual 1/steam line 1/steam line 1/operating 1,2,3,4 24 3'--,

steam line

2. System 2 1 2 1,2,3,4 23

b. Automatic Actuation 2 1 2 1,2,3,4 22 0 Logic and Actuation CD Relays z0 z c. Containment 3 2 2 1,2,3,4 20 (0

Pressure-- =r 0 High-2

d. Steam Line Pressure-- 3/steam line in 2/steam line in 2/steam line in 1,2,3# 20 Low each operating any operating each operating loop loop loop

e. Steam Line Pressure - 3/steam line in 2/steam line in 2/steam line in 3 *I*** 20

&egative Rate--High each operating any operating each operating t, loop loop loop 0*

I TABLE 3.3-3 (Continued) 0 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION z

MINIMUM H

TOTAL NO. CHANNELS CHANNELS APPLICABLE 0

FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION -4,

5. Turbine Trip and Feedwater Isolation

a. Automatic Actuation 2 I 2 1,2 25 Logic and Actuaion 0CD Relays

b. Steam Generator 4/stm. gen. 2/stm. gen. 3/stm. gen. 1,2,3 20,21 z0 Water Level-- in each in any in each 0

High-High (P-14) operating loop operating loop operating loop

c. Safety Injection 2 1 2 1,2 22 cc Actuation Logic

d. Tave Low Coincident 1 T ave/Ioop I Tave in any two 1 Tave in any 1,2 20 with P-4 loops three loops z 0 0

0 0

~1 0

I"J 0

0

TABLE 3.3-3 (Continued) o ENGI[NEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION z

MINIMUM 0 TOTAL NO. CHANNELS CHANNELS APPLICABLE I FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION -9

6. Auxiliary Feedwater 30

a. Manual Initiation 2 1 2 1,2,3 23 1 0

b. Automatic Actuation 2 2 1,2,3 22 Logic and Actuation z

Relays 0 0

c. Stm. Gen. Water Level--

Low-Low (a CD

1) Start Motor- 4/stm. gen. 2/stm. gen. in any 3/stm. gen. in 1,2,3 20 Driven Pumps operating stm. each operating gen. stm. gen.

2) Start Turbine- 4/stm. gen. 2/stm. gen. in any 3/stm. gen. in 1,2,3 20 Driven Pump 2 operating stm. each operating gen. stm. gen.

d. Safety Injection See Item 1. above for all Safety Injection initiating functions and requirements.

Start Motor-Driven Pumps a e. Loss-of-Offsite Power 2 1 2 1,2,3 19 Start Motor-Driven 0 0

Pumps a

CLg z ~JI P

0

TABLE 3.3-3 (Continued) o z ENGINEERED SAI ?ETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM T( )TAL NO. CHANNELS CHANNELS APPLICABLE

- FUNCTIONAL UNIT 01FCHANNELS TO TRIP OPERABLE MODES ACTION

-n

6. Auxiliary Feedwater (Continued) 0

f. Containment Depres- See Item 2. above for all CDA functions and requirements.

surization Actuation 0

(CDA) Start Motor-Driven Pumps 0

7. Control Building Isolation z

a. Manual Actuation 2 1 2 19 Z 1,2,3,4

b. Manual Safety 2 1 2 19 Injection Actuation 1,2,3,4

c. Automatic Actuation 2 I 2 14 Co Logic and Actuation Relays

d. Containment Pressure-- 3 2 2 1,2,3 16 High-1

e. Control Building Inlet 2/i ntake 1 2/intake 18 z Ventilation Radiation an

8. Loss of Power CD

a. 4 kV Bus Under- 4/1 us 2/bus 3/bus 1,2,3,4 27 IC3 voltage-Loss of Voltage CD

b. 4 kV Bus Undervoltage- 4/1 us 2/bus 3/bus 1,2,3,4 27 0D Grid Degraded Voltage

TABLE 3.3-3 (Continued) r_11 ENGINEERED SAFETY FEATURES ACTUATION SYSTEM INSTRUMENTATION MINIMUM

-n, TOTAL NO. CHANNELS CHANNELS APPLICABLE 0 FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION 0

9. Engineering Safety Features Actuation System Interlocks 5.

a. Pressurizer Pressure, 3 2 2 1,2,3 21 P-11 0

b. Low-Low Tavg, P-12 4 2 3 1,2,3 21 z 0

c. Reactor Trip, P-4 2 2 2 1,2,3 23 0

10. Emergency Generator 2 1 2 1,2,3,4 15 Load Sequencer CD

11. Cold Leg Injection 4 2 3 1,2,3 20 Permissive, P-19 S

Cb 0-S z0 00

September 18, 2008 TABLE 3.3-3 (Continued)

TABLE NOTATIONS

The Steamline Isolation Logic and Safety Injection Logic for this trip function may be blocked in this MODE below the P- Il (Pressurizer Pressure Interlock) Setpoint.

MODES 1, 2, 3, and 4.#

During movement of recently irradiated fuel assemblies.

- - - Trip function automatically blocked above P- I1 and may be blocked below P- 11 when Safety Injection on low steam line pressure is not blocked.

24 ACTION STATEMENTS ACTION 14- With the number o PERABLE channels one less than the Minimum Channels OPERABL uirement, restore the inoperable channel to OPERABLE status within-6-hours or be in' at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months ; however, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE.

ACTION 15 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable'channel to OPERABLE status within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months ; however, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.3.2.1, provided the other channel is OPERABLE.

ACTION 16- With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed until performance of the next required ANALOG CHANNEL OPERATIONAL TEST provided the inoperable channel is placed in the tripped condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ACTION 17- With the number of OPERABLE channels one less than the Total Number of Channels, operation may proceed provided the inoperable channel is placed in the bypassed condition and the Minimum Channels OPERABLE requirement is met. One additional channel may be bypassed for up to4-hours for surveillance testing per Specification 4.3.2.1.

ACTION 18 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 7 days.

After 7 days, or if no channels are OPERABLE, immediately suspend movement of recently irradiated fuel assemblies, if applicable, and be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

ACTION 19- With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

MILLSTONE - UNIT 3 3/4 3-24 Amendment No. -57,qO, 89, 4-29, 203, 24-9,224, -24, 24-,

hMareh 17, 2004 TABLE 3.3-3 (Continued)

ACTION STATEMENTS (Continued)

ACTION 20 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied: / M

a. The inoperable channel is placed in the tripped condition within-6-hours, and

b. the Minimum Channels OPERABLE requirem t; however, the inoperable channel may be bypassed for up to +hours for surveillance testing of other channels per Specification 4.3.2.1.

ACTION 21 - With less than the Minimum Number of Channels OPERABLE, within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months determine by observation of the associated permissive annunciator window(s) that the interlock is in its required state for the existing plant condition, or apply Specification 3.0.3.

ACTION 22 - With the number of OPERABL annels one less than the Minimum Channels OPERABLE requ ent, restore the inoperable channel to OPERABLE status within-6-hours or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in at least HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; however, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE.

ACTION 23 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or be in at least HOT STANDBY within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in at least HOT SHUTDOWN within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

ACTION 24 - With the number of OPERABLE channels one less than the Total Number of Channels, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months or declare the associated valve inoperable and take the ACTION required by Specification 3.7.1.5. 24 ACTION 25 - With the number of OPERABLE annels one less than the Minimum Channels OPERABLE requ* ent, restore the inoperable channel to OPERABLE status within-6-hours or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ; however, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing per Specification 4.3.2.1 provided the other channel is OPERABLE.

ACTION 26 - DELETED 1411 MILLSTONE - UNIT 3 3/4 3-25 Amendment No. 70, 4-29, 4++-

Serial No.14-107 Docket No. 50-423 Attachment 3 The Applicability Determination for WCAP-14333-P-A, Revision I and WCAP-15376-P-A, Revision I DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 1 of 7 Table I WCAP-14333 Implementation Guidelines: Applicability of the Analysis General Parameters Parameter WCAP-14333 Analysis Assumptions Plant Specific Parameter Logic Cabinet Type (1) Relay and SSPS SSPS Component Test Intervals (2)

" Analog channels 3 months 3 months

" Logic cabinets (SSPS) 2 months 2 months

" Logic cabinets (Relay) 1 month N/A

Master Relays (SSPS) 2 months 2 months

Master Relays (Relay) 1 month N/A

Slave Relays 3 months 3 months 18 months for Potter &

Brumfield MDR series relays per WCAP-13900

" Reactor trip breakers 2 months 2 months Analog Channel Calibrations (3)

Done at-power yes yes

Interval 18 months 18 months Typical At-Power Maintenance Intervals (4)

" Analog channels 24 months 24 months

" Logic cabinets (SSPS) 18 months 18 months

" Logic cabinets (Relay) 12 months N/A

Master relays (SSPS) infrequent (5) infrequent

" Master relays (Relay) infrequent (5) N/A

Slave relays infrequent (5) infrequent 0 Reactor trip breakers 12 months 18 months

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 2 of 7 Parameter WCAP-14333 Analysis Assumptions Plant Specific Parameter AMSAC (6) Credited for AFW pump start Yes Total Transient Event Frequency (7) 3.6 0.641 ATWS Contribution to CDF (current PRA model) (8) 8.4E-06/yr 9.6E-08/yr Total CDF from Internal Events (current PRA model) (9) 5.8E-05/yr 4.2E-06/yr Total CDF from Internal Events (IPE) (10) Not Applicable 5.52E-05/yr Notes for Table I

1. Indicate type of logic cabinet; SSPS or Relay (both are included in WCAP-14333).

2. Fill in applicable test intervals. If the test intervals are equal to or greater than those used in WCAP-14333, the analysis is applicable to your plant.

3. Indicate if channel calibration is done at-power and, if so, fill in the interval. If channel calibrations are not done at-power or if the calibration interval is equal to or greater than that used in WCAP-14333, the analysis is applicable to your plant.

4. Fill in the applicable typical maintenance intervals or fill in "equal to or greater than" or "less than". If the maintenance intervals are equal to or greater than those used in WCAP-14333, the analysis is applicable to your plant.

5. Only corrective maintenance is done on the master and slave relays. The maintenance interval on typical relays is relatively long, that is, experience has shown they do not typically completely fail. Failure of slave relays usually involve failure of individual contacts. Fill in "infrequent" if this is consistent with your plant experience. If not, fill in the typical maintenance interval. If "infrequent" slave relay failures are the norm, then the WCAP-14333 analysis is applicable to your plant.

6. Indicate if AMSAC will initiate AFW pump start. If yes, then the WCAP-14333 analysis is applicable to your plant.

7. Include total frequency for initiators requiring a reactor trip signal to be generated for event mitigation. This is required to assess the importance of ATWS events to CDF. Do not include events initiated by a reactor trip.

8. Fill in the ATWS contribution to core damage frequency (from at-power, internal events). This is required to determine if the ATWS event is a large contributor to CDF.

9. Fill in the total CDF from internal events (including internal flooding) for the most recent PRA model update. This is required for comparison to the NRC's risk-informed CDF acceptance guidelines.

10. Fill in the total CDF from internal events from the IPE model (submitted to the NRC in response to Generic Letter 88-20). If this value differs from the most recent PRA model update CDF provide a concise list of reasons, in bulletized form, describing the differences between the models that account for the change in CDF.

11. If your analog channel test interval is 1 month, the STI increase justified and approved by the NRC in WCAP-1 0271 has not been implemented in your plant, even so, this analysis still remains applicable.

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 3 of 7 Table 2 WCAP-14333, WCAP-15376 Implementation Guidelines: Applicability of Analysis Reactor Trip Actuation Signals Event WCAP-14333/15376 Analysis Plant Specific Parameter Assumption (1)

Large LOCA Not Required Agree Medium LOCA Not Required Agree Small LOCA Nondiverse (2) w/OA (3) Agree Steam Generator Tube Rupture Nondiverse w/OA Agree Interfacing System LOCA Not Required Agree Reactor Vessel Rupture Not Required Agree Secondary Side Breaks Nondiverse w/OA Agree Transient Events, such as: Diverse (4) w/OA Agree

- Positive Reactivity Insertion

- Loss of Reactor Coolant Flow

- Total or Partial Loss of Main Feedwater

- Loss of Condenser

- Turbine Trip

- Loss of DC Bus

- Loss of Vital AC Bus

- Loss of Instrument Air

- Spurious Safety Injection

- Inadvertent Opening of a Steam Valve Reactor Trip Generated by RPS Agree Loss of Offsite Power Not Required by RPS Agree Station Blackout Not Required by RPS Agree Loss of Service Water or Component Cooling Water Nondiverse w/OA Agree Notes:

1. Fill in "agree" if your plant design and operation is consistent with this analysis, that is, the noted reactor trip signals are available at a minimum. If not, explain the difference. If "agree" is listed for each event, then the WCAP-14333 analysis is applicable to your plant.

2. Nondiverse means that (at least) one signal will be generated to initiate reactor trip for the event.

3. OA indicates that an operator could take action to initiate reactor trip for the event, that is, there is sufficient time for action and procedures are in place that will instruct the operator to take action.

4. Diverse means that (at least) two signals will be generated to initiate reactor trip for the event.

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 4 of 7 Table 3 WCAP-14333, WCAP-15376 Implementation Guidelines: Applicability of Analysis Engineered Safety Features Actuation Signals Safety Function Event WCAP-14333115376 Analysis Assumption Plant Specific Parameter (1)

Safety Injection Large LOCA Nondiverse (2) Agree Medium LOCA Nondiverse, OA (3) by SI switch on main control Agree board Small LOCA Nondiverse, OA by SI switch on main control Agree board, OA of individual components Interfacing Systems Nondiverse, OA by SI switch on main control Agree LOCA board, OA of individual components SG Tube Rupture Nondiverse, OA by SI switch on main control Agree board, OA of individual components Secondary Side Breaks Nondiverse, OA by SI switch on main control Agree board, OA of individual components Auxiliary Feedwater Events generating SI Pump actuation on SI signal Agree Pump Start signal Transient events Nondiverse, AMSAC, operator action Main Feedwater Secondary Side Breaks Nondiverse Agree Isolation Steamline Isolation Secondary Side Breaks Nondiverse Agree Containment Spray All events Nondiverse signal Agree Actuation Containment Isolation All events From SI signal Agree Containment Cooling All events From SI signal Agree Notes:

1. Fill in "agree" if your plant design and operation is consistent with this analysis, that is, the noted engineered safety features actuation signals are available at a minimum. If not, explain the difference. If "agree" is listed for each event, then the WCAP-14333 analysis is applicable to your plant.

2. Nondiverse means that (at least) one signal will be generated to initiate the engineered safety feature noted for the event.

3. OA indicates that an operator could take action to initiate the engineered safety feature for the event, that is, there is sufficient time for action and procedures are in place that will instruct the operator to take action.

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 5 of 7 Table 4 WCAP-15376 Implementation Guidelines:

Applicability of the Analysis General Parameters Parameter WCAP-15376 Analysis (Plant) Specific Parameter Assumption Logic Cabinet Type 1 (SSPS or Relay) SSPS 2

Component Bypass Test Time

Analog channels 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months

Logic cabinets (SSPS or Relay Protection System) (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for SSPS or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for Relay Protection System)

" Master Relay (SSPS or Relay Protection System) (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for SSPS or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for Relay Protection System)

" Reactor trip breakers 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 3

Component Test Interval

Reactor trip breakers 2 months 2 months 4

Typical At-Power Maintenance Intervals 0 Reactor trip breakers 12 months 18 months 5

Plant procedures are in place for the following operator actions

Reactor trip from the main control board switches Credited Yes Reactor trip by interrupting power to the motor-generator sets Credited Yes

Insertion of the control rods via the rod control system Credited Yes

Safety injection actuation from the main control board Credited Yes switches

Safety injection by actuation of individual components Credited Yes

Auxiliary feedwater pump start Credited Yes AMSAC 6 Credited for AFW pump start Yes Total Transient Event Frequency 7 3.6 0.641 ATWS Contribution to CDF (current PRA model)5 1.06E-06/yr 9.6E-08/yr Total CDF from Internal Events (current PRA model) 9 -- 4.2E-06/yr

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 6 of 7 Parameter WCAP-15376 Analysis (Plant) Specific Parameter 9 Assumption Total LERF from Internal Events (current PRA model) -- 6.9E-08/yr Notes for Table 4

1. Indicate type of logic cabinet; SSPS or Relay (both are included in WCAP-1 5376).

2. Fill in the current Tech Spec bypass test times. If the current Tech Spec bypass test times are equal to or less than those used in WCAP-1 5376, the analysis is applicable to your plant.

3. Fill in the current Tech Spec test interval. If the current Tech Spec test interval is equal to or greater than that used in WCAP-15376, the analysis is applicable to your plant.

4. Fill in the typical maintenance intervals or fill in "equal to or greater than" or "less than". If the maintenance intervals are equal to or greater than those used in WCAP-1 5376, the analysis is applicable to your plant.

5. Indicate if plant procedures are in place to perform these actions. If plant procedures are in place, the WCAP-15376 analysis is applicable to your plant.

6. Indicate if AMSAC will initiate AFW pump start. if AMSAC will initiate AFW pump start, then the WCAP-15376 analysis is applicable to your plant.

7. Include the total frequency for initiators requiring a reactor trip signal to be generated for event mitigation. This is required to assess the importance of ATWS events to CDF. Do not include events initiated by a reactor trip. If the plant specific value is less than the WCAP-1 5376 value, then this analysis is applicable to your plant.

8. Fill in the ATWS contribution to core damage frequency (from at-power, internal events). This is required to determine if the ATWS event is a large contributor to CDF.

9. Fill in the total CDF and LERF from internal events (including internal flooding) for the most recent PRA model update. This is required for comparison to the NRC's risk-informed CDF and LERF acceptance guidelines in Regulatory Guide 1.174.

Serial No.14-107 Docket No. 50-423 Attachment 3, Page 7 of 7 Table 5 WCAP-15376 Implementation Guidelines:

Applicability of the Human Reliability Analysis Operator Action Is Sufficient Time Available for Are Plant Procedures in the Operators to Take the Place for the Action? 1 Action? 1 Reactor trip from the main control board switches Yes Yes Reactor trip by interrupting power to the motor-generator sets Yes Yes Insertion of the control rods via the rod control system Yes Yes Safety injection actuation from the main control board switches Yes Yes Safety injection by actuation of individual components Yes Yes Auxiliary feedwater pump start Yes Yes Note for Table 5

1. Fill in "yes" or "no". If "yes" is filled in for both questions, then the analysis is applicable to your plant with respect to that operator action.

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 4 List of Regulatory Commitments DOMINION NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 3

It

.6 Serial No.14-107 Docket No. 50-423 Implementation of WCAP-1 4333 and WCAP-1 5376 Attachment 4, Page 1 of 2 List of Regulatory Commitments Dominion Nuclear Connecticut (DNC) will establish administrative controls at Millstone Power Station Unit 3 (MPS3) to implement the following restrictions during the mode of applicability for the specified equipment. The establishments of these administrative controls are considered commitments. The following table identifies those actions committed to by DNC for MPS3 as part of the License Amendment Request. Any other statements in this submittal are provided for information purposes and are not regulatory commitments.

Number Commitment Committed Due Date/Event Date One- Programmatic Time (Yes/No)

Action (Yes/No)

DNC will implement Administrative Yes Yes administrative controls to controls in place ensure that activities that within 120 days degrade the availability of the of NRC RCS pressure relief system, approval.

the auxiliary feedwater system, AMSAC, or turbine trip should not be scheduled when a logic train or an RTB train is inoperable for maintenance.

2 DNC will implement Administrative Yes Yes administrative controls to controls in place ensure that one complete within 120 days ECCS train that can be of NRC actuated automatically must be approval.

maintained when a logic train is inoperable for maintenance.

3 DNC will implement Administrative Yes Yes administrative controls to controls in place ensure that activities that within 120 days cause RTS and ESFAS master of NRC relays or slave relays in the approval.

available train to be unavailable, and activities that cause RTS and ESFAS analog channels to be unavailable, should not be scheduled when a logic train or an RTB train is

Serial No.14-107 Docket No. 50-423 Implementation of WCAP-14333 and WCAP-15376 Attachment 4, Page 2 of 2 Number Commitment Committed Due Date/Event Date One- Programmatic Time (Yes/No)

Action (Yes/No) inoperable for maintenance, with the exception of ESFAS Functions 2.c and 3.b.(3).

4 DNC will implement Administrative Yes Yes administrative controls to controls in place ensure that activities that result within 120 days in the inoperability of electrical of NRC systems (e.g., AC and DC approval.

power) and cooling systems (e.g., service water and component cooling water) that support the RCS pressure relief system, the AFW system, AMSAC, turbine trip, one complete train of ECCS, and the available reactor trip and ESFAS actuation functions should not be scheduled when a logic train or an RTB train is inoperable for maintenance.

That is, one complete train of a function that supports a complete train of a function noted above must be available.

ML14133A009

Contents

Text

1.0 DESCRIPTION

2.0 BACKGROUND

3.0 PROPOSED CHANGE

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

8.0 REFERENCES

1.0 DESCRIPTION

2.0 BACKGROUND

3.0 PROPOSED CHANGE

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

8.0 REFERENCES

Navigation menu

ML14133A009

Text

1.0 DESCRIPTION

2.0 BACKGROUND

3.0 PROPOSED CHANGE

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

8.0 REFERENCES

1.0 DESCRIPTION

2.0 BACKGROUND

3.0 PROPOSED CHANGE

4.0 TECHNICAL ANALYSIS

5.0 REGULATORY ANALYSIS

6.0 ENVIRONMENTAL CONSIDERATION

8.0 REFERENCES

Navigation menu

Search