Text

Issuance of Amendment No. 200, Revise Technical Specification 3.8.1, AC Sources - Operating, for One-Time Extension of the Diesel Generator Completion Time, Risk-Informed (Emergency Circumstances)
	ML17004A020
Person / Time
Site:	Palo Verde
Issue date:	01/04/2017
From:	Siva Lingam; Plant Licensing Branch IV
To:	Bement R; Arizona Public Service Co
	Singal B, NRR-DORL 415-1564
References
	CAC MF9019
	Download: ML17004A020 (42)
	v • d • e

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 4, 2017 Mr. Robert S. Bement Executive Vice President Nuclear/

Chief Nuclear Officer Mail Station 7602 Arizona Public Service Company P.O. Box 52034 Phoenix, AZ 85072-2034

SUBJECT:

PALO VERDE NUCLEAR GENERATING STATION, UNIT 3- ISSUANCE OF AMENDMENTS RE: REVISION TO TECHNICAL SPECIFICATION 3.8.1, "AC [ALTERNATING CURRENT] SOURCES - OPERATING" (EMERGENCY CIRCUMSTANCES) (CAC NO. MF9019)

Dear Mr. Bement:

The U.S. Nuclear Regulatory Commission has issued the enclosed Amendment No. 200 to Renewed Facility Operating License No. NPF-74 for the Palo Verde Nuclear Generating Station, Unit 3. The amendment consists of changes to the Technical Specifications (TSs) in response to Arizona Public Service Company's (APS's, the licensee's) application dated December 30, 2016, as supplemented by letters dated January 2 and January 4, 2017.

The amendment revises the TSs for a one-time extension of the Unit 3 emergency diesel generator (3B DG) completion time described in TS 3.8.1.B.4. Specifically, the emergency risk-informed amendment would extend, on a one-time basis, the TS required action 3.8.1.B.4 completion time from 21 days to 62 days for the purpose of completing repairs and testing to re-establish operability of the 3B DG.

During surveillance testing on December 15, 2016, the DG suffered a failure of the number nine right cylinder connecting rod and piston. Disassembly and inspection of the damaged 3B DG has been aggressively and continuously pursued since initial failure on December 15, 2016.

APS established an Outage Control Center to schedule, manage, and oversee the work activities needed for the repairs. Multi-discipline teams were formed to assess the extent of damage, inspect and recover parts, and determine the cause of failure. APS has determined that the cause of failure of the 3B DG is attributed to high-cycle fatigue and that the mode of failure is not common to the "A" train DG or the DGs in Units 1 and 2.

The license amendment is issued under emergency circumstances as provided in the provisions of paragraph 50.91 (a)(5) of Title 10 of the Code of Federal Regulations, Part 50 due to the time critical nature of the amendment. In this instance, an emergency situation exists in that the proposed amendment is needed to allow the licensee to preclude a plant shutdown.

R. Bement A copy of the related Safety Evaluation is also enclosed. The safety evaluation describes the emergency circumstances under which the amendment was issued and the final no significant hazards determination. A Notice of Issuance addressing the final no significant hazards determination and opportunity for a hearing associated with the emergency circumstances will be included in the Commission's next biweekly Federal Register notice.

Sincerely,

~<s*~

Siva P. Lingam, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. STN 50-530

Enclosures:

1. Amendment No. 200 to NPF-74

2. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ARIZONA PUBLIC SERVICE COMPANY, ET AL.

DOCKET NO. STN 50-530 PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 200 License No. NPF-74

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Arizona Public Service Company (APS or the licensee) on behalf of itself and the Salt River Project Agricultural Improvement and Power District, El Paso Electric Company, Southern California Edison Company, Public Service Company of New Mexico, Los Angeles Department of Water and Power, and Southern California Public Power Authority dated December 30, 2016, as supplemented by letters dated January 2 and January 4, 2017, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and Paragraphs 2.C(2) and 2.C(5) of Renewed Facility Operating License No. NPF-74 is hereby amended to read as follows:

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 200, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this license. APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(5) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 200, are hereby incorporated into this license. The licensee shall operate the facility in accordance with the Additional Conditions.

3. This license amendment is effective as of the date of issuance and shall be implemented prior to the expiration of the 21-day Technical Specification Completion Time, or January 5, 2017, at 3:56 AM Mountain Time.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-7 4 and Technical Specifications Date of Issuance: January 4, 2017

ATTACHMENT TO LICENSE AMENDMENT NO. 200 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-74 PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 DOCKET NO. STN 50-530 Replace the following pages of the Renewed Facility Operating License No. NPF-7 4, Appendix A - Technical Specifications, and Appendix D -Additional Conditions, with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Renewed Facility Operating License No. NPF-74 REMOVE INSERT 4 4 Appendix A - Technical Specifications REMOVE INSERT 3.8.1-3 3.8.1-3 Appendix D - Additional Conditions REMOVE INSERT (4) Pursuant to the Act and 10 CFR Part 30, 40, and 70, APS to receive, possess, and use in amounts required any byproduct, source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (5) Pursuant to the Act and 10 CFR Parts 30, 40, and 70, APS to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C. This renewed operating license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level Arizona Public Service Company (APS) is authorized to operate the facility at reactor core power levels not in excess of 3990 megawatts thermal (100% power), in accordance with the conditions specified herein.

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 200, and the Environmental Protection Plan contained in Appendix B, are hereby incorporated into this renewed operating license.

APS shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan, except where otherwise stated in specific license conditions.

(3) Antitrust Conditions This renewed operating license is subject to the antitrust conditions delineated in Appendix C to this renewed operating license.

(4) Initial Test Program (Section 14. SER and SSER 2)

Deleted (5) Additional Conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 200, are hereby incorporated into this renewed operating license. The licensee shall operate the facility in accordance with the Additional Conditions.

Renewed Facility Operating License No. NPF-74 Amendment No. 200

AC Sources - Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME B. (continued) B.4 Restore DG ---------NOTE---------

to OPERABLE For the Unit 3 status. Train B DG failure on December 15, 2016, restore the inoperable DG to OPERABLE status within 62 days.

10 days

c. Two required offsite circuits C.1 Declare required feature(s) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from inoperable. inoperable when discovery of Condition its redundant C concurrent with required inoperability of feature(s) is redundant required inoperable. feature(s)

AND C.2 Restore one 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months required offsite circuit to OPERABLE status.

(continued)

PALO VERDE UNITS 1,2,3 3.8.1-3 AMENDMENT NO.~ 200

Amendment Number Additional Conditions Implementation Date 200 1. The following equipment will be protected by The amendment signage/chains for the duration of the extended shall be implemented completion time to prevent inadvertent impact from prior to the expiration walkdowns, inspections, maintenance and of the 21-day potential for transient combustible fires: Technical Specification

a. Both SBOGs Completion Time, or

b. Unit 3 train 'A' DG January 5, 2017, at

c. Unit 3 train 'A' Engineered Safety Features 3:56 AM Mountain (ESF) Switchgear, DC equipment and DC Time.

Battery Rooms

d. Three AC portable diesel generators deployed at Unit 3 and their connections to the train 'B' FLEX 4.16 kV AC connection box

e. Diesel-driven FLEX SG Makeup Pump deployed at Unit 3

f. Turbine driven auxiliary feedwater pump

g. Fire pumps, diesel and electric If any of the protected equipment identified above becomes unavailable, APS will enter MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Unit 3. If restoration is completed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months this action is not required.

2. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the extended allowed outage time.

If at any time APS is notified by the system load dispatcher that a condition in the grid could result in the loss of all power to the switchyard, APS will enter MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Unit 3. If the condition is resolved within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months this action is not required.

3. In case APS determines prior to expiration of the extended completion time, a common failure mode does exist, then APS will shut down Unit 3.

Amendment No. 200

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 200 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-74 ARIZONA PUBLIC SERVICE COMPANY. ET AL.

PALO VERDE NUCLEAR GENERATING STATION, UNIT 3 DOCKET NO. STN 50-530

1.0 INTRODUCTION

By application dated December 30, 2016 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML16365A240), as supplemented by letters dated January 2 and January 4, 2017 (ADAMS Accession Nos. ML17002A001 and ML17004A238, respectively),

Arizona Public Service Company (APS, the licensee) submitted emergency license amendment request (LAR) requesting changes to the Technical Specifications (TSs) for Palo Verde Nuclear Generating Station (PVNGS), Unit 3.

The amendment revises the TSs for a one-time extension of the Unit 3 emergency diesel generator (3B DG) completion time (CT) described in TS 3.8.1.B.4. Specifically, the emergency risk-informed amendment would extend, on a one-time basis, the TS required action 3.8.1.B.4 CT from 21 days to 62 days for the purpose of completing repairs and testing to re-establish operability of the 3B DG.

During surveillance testing on December 15, 2016, the DG suffered a failure of the number nine right cylinder connecting rod and piston. Disassembly and inspection of the damaged 38 DG has been aggressively and continuously pursued since initial failure on December 15, 2016.

APS established an Outage Control Center to schedule, manage and oversee the work activities needed for the repairs. Multi-discipline teams were formed to assess the extent of damage, inspect and recover parts, and determine the cause of failure. APS has determined that the cause of failure of the 38 DG is attributed to high-cycle fatigue and that the mode of failure is not common to the "A" train DG or the DGs in Units 1 and 2.

On December 23, 2016, the NRC staff issued Amendment No. 199 (ADAMS Accession No. ML16358A676) which approved a one-time extension of the 3B DG CT described in TS 3.8.1.B.4. Specifically, the emergency amendment extended the TS required action 3.8.1. B.4 CT from 10 days to 21 days for the purpose of collecting and analyzing data associated with the failure of train B DG and continue with the repair of the DG.

Enclosure 2

2.0 REGULATORY EVALUATION

The U.S. Nuclear Regulatory Commission (NRC) staff reviewed the LAR based on the following regulatory requirements:

General Design Criterion (GDC) 17, "Electric power systems, of Appendix A to Part 50 of Title 10 of the Code of Federal Regulations (10 CFR) requires, in part, that nuclear power plants have onsite and offsite electric power systems to permit the functioning of structures, systems, and components that are important to safety. The onsite system is required to have sufficient independence, redundancy, and testability to perform its safety function, assuming a single failure. The offsite power system is required to be supplied by two physically independent circuits that are designed and located so as to minimize, to the extent practical, the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions.

GDC 18, "Inspection and testing of electric power systems, of Appendix A to 10 CFR Part 50, requires, in part, that electric power systems that are important to safety must be designed to permit appropriate periodic inspection and testing of important areas and features, such as wiring, insulation, connections, and switchboards to assess the continuity of the systems and the condition of their components.

GDC 19, "Control room, of Appendix A to 10 CFR Part 50, requires, in part, that actions can be taken from the control room to maintain the plant in a safe condition under all circumstances.

10 CFR 50.34{f), "Additional TMI [Three-Mile Island] -related requirements."

10 CFR 50.36, "Technical specifications, requires, in part, that the TSs shall be included by applicants for a license authorizing operation of a production or utilization facility. Paragraph 10 CFR 50.36(c) requires that TSs include items in five specific categories related to station operation. These categories are (1) safety limits, limiting safety system settings, and limiting control settings, (2) limiting conditions for operation (LCOs), (3) surveillance requirements, (4) design features, and (5) administrative controls. The proposed change to the PVNGS TS relates to the LCO category.

10 CFR 50.63, "Loss of all alternating current power, requires, in part, that a nuclear power plant shall be able to withstand for a specified duration, and recover from a complete loss of offsite and onsite alternating current (AC) sources (i.e., a station blackout (SBO)).

10 CFR 50.65, "Requirements for monitoring the effectiveness of maintenance at nuclear power plants, requires, in part, that performing maintenance activities shall not reduce the overall availability of the systems, structures, and components (SSCs), which are important to safety of the plant.

10 CFR 50.120, "Training and qualification of nuclear power plant personnel."

The NRC staff also reviewed the LAR based on the following regulatory guidance documents:

Regulatory Guide (RG) 1.93, "Availability of Electric Power Sources," dated March 2012 (ADAMS Accession No. ML090550693), provides guidance with respect to operating restrictions or CT if the number of available AC sources is less than that required by the TS LCO. In particular, this guide recommends a maximum CT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for an inoperable onsite or offsite AC source.

RG 1.155, "Station Blackout," dated August 1988 (ADAMS Accession No. ML003740034), provides guidance for complying with the 10 CFR 50.63 that requires nuclear power plants to be capable of coping with an SBO event for a specified duration.

RG 1.174, Revision 2, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" dated May 2011 (ADAMS Accession No. ML100910006), describes a risk-informed approach acceptable to the NRC for assessing the nature and impact of proposed permanent licensing-basis changes by considering engineering issues and applying risk insights. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such evaluations.

RG 1.177, Revision 1, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," dated May 2011 (ADAMS Accession No. ML100910008), describes an acceptable risk-informed approach specifically for assessing proposed one-time TS changes in CTs. This regulatory guide also provides risk acceptance guidelines for evaluating the results of such assessments. RG 1.177 provides the following three-tiered TS acceptance guidelines specific to one-time only CT changes for evaluating the risk associated with the revised CT:

1. The licensee has demonstrated that implementation of the one-time only TS CT change impact on plant risk is acceptable (Tier 1):

Incremental conditional core damage probability (ICCDP) of less than 1.0x10-5 and an incremental conditional large early release probability (ICLERP) of less than 1.0x1 o-7 , or ICCDP of less than 1.0x10-5 and an ICLERP of less than 1.0x10-5 with effective compensatory measures (commitments) implemented to reduce the sources of increased risk.

2. The licensee has demonstrated that there are appropriate restrictions on dominant risk-significant configurations associated with the change (Tier 2).

3. The licensee has implemented a risk-informed plant configuration control program. The licensee has implemented procedures to utilize, maintain, and control such a program (Tier 3).

RG 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," March 2009 (ADAMS Accession No. ML090410014), describes one acceptable approach for determining whether the quality of the probabilistic risk assessment (PRA), in total or the parts that are used to support an application, is sufficient to provide confidence in the results, such that the PRA can be used in regulatory decisionmaking for light-water reactors.

General guidance for evaluating the technical basis for proposed risk-informed changes is provided in Chapter 19, Section 19.2, "Review of Risk Information Used to Support Permanent Plant-Specific Changes to the Licensing Basis:

General Guidance," of the NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition" (SRP)

(ADAMS Accession No. ML071700658). Guidance on evaluating PRA technical adequacy is provided in Chapter 19, Section 19.1, "Determining the Technical Adequacy of Probabilistic Risk Assessment for Risk-Informed License Amendment Requests After Initial Fuel Load," of the SRP (ADAMS Accession No. ML12193A107). More specific guidance related to risk-informed TS changes is provided in SRP Section 16.1, "Risk-Informed Decisionmaking: Technical Specifications" (ADAMS Accession No. ML070380228), which includes CT changes as part of risk-informed decisionmaking. Chapter 19 of the SRP states that a risk-informed application should be evaluated to ensure that the proposed changes meet the following key principles:

1. The proposed change meets the current regulations, unless it explicitly relates to a requested exemption or rule change.

2. The proposed change is consistent with the defense-in-depth philosophy.

3. The proposed change maintains sufficient safety margins.

4. When proposed changes increase core damage frequency (CDF) or risk, the increase(s) should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.

5. The impact of the proposed change should be monitored using performance measurement strategies.

NUREG-0800, Branch Technical Position (BTP) 8-8, "Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions" (ADAMS Accession No. ML113640138), provides guidance to the NRC staff in reviewing LARs for licensees proposing a one-time or permanent TS change to extend an emergency diesel generator (EOG) allowed outage time beyond 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The BTP 8-8 emphasizes that more defense-in-depth is needed for

S80 scenarios which are more likely to occur as compared to the likely occurrence of the large and medium-size loss-of-coolant accident scenarios (which requires a fast-start EOG).

NUREG-0800, Chapter 18, Revision 2 provides review guidance for "Human Factors Engineering," dated March 2007 (ADAMS Accession No. ML070670253).

NUREG-0700, "Human-System Interface Design Review Guidelines," Revision 2, dated May 2002 (ADAMS Accession No. ML021700373).

NUREG-0711, "Human Factors Engineering Program Review Model,"

Revision 3, dated November 2012 (ADAMS Accession No. ML12324A013).

NUREG-0737, "Clarification of TMI Action Plan Requirements," dated November 1980 (ADAMS Accession No. M051400209).

NUREG-1764, "Guidance for the Review of Changes to Human Actions,"

Revision 1, dated September 2007 (ADAMS Accession No. ML072640419).

Information Notice 97-78, "Crediting Operator Actions in Place of Automatic Actions and Modifications of Operator Actions, Including Response Times," dated October 23, 1997 (ADAMS Accession No. ML031050065).

3.0 TECHNICAL EVALUATION

3.1 Detailed Description 3.1.1 Description of the Proposed Change The LAR proposed a one-time extension of the 38 EOG CT described in TS 3.8.1.8.4.

Specifically, this amendment proposed to extend the TS required action 3.8.1.8.4 CT from 21 days to 62 days for the purpose of completing repairs and testing to re-establish operability of the 38 EOG. During surveillance testing on December 15, 2016, the 38 EOG suffered a failure of the number nine right cylinder connecting rod and piston. Current plans to collect and analyze data associated with the engine failure and continue the repair would exceed the TS required action CT of 21 days. As a result, the licensee requested a one-time, risk-informed license amendment to extend the CT.

3.1.2 Description of the PVNGS, AC Power System In the LAR, the licensee explained that seven physically independent 525 kilovolt (kV) transmission lines of the Western Interconnection are connected to the PVNGS 525 kV switchyard. Three 525 kV tie lines supply power from the switchyard to three startup transformers, which supply power to six 13.8 kV intermediate buses (two per unit). Two physically independent circuits supply offsite {preferred) power to the onsite power system of each PVNGS unit.

The three startup transformers connect to the PVNGS 525 kV switchyard, and feed six 13.8 kV intermediate buses (two per unit). These buses are arranged in three pairs, each pair feeding only one unit. The intermediate buses for PVNGS, Units 1, 2, and 3 are interconnected to the startup transformers so that each unit's buses can access a primary and backup startup transformer winding when all startup transformers are connected to the switchyard. The intermediate buses are connected to the onsite power system by one 13.8 kV transmission line per bus (two per unit).

The safety-related equipment is divided into two load groups per unit. For each unit, either of the associated load groups is capable of providing power for safely shutting down the unit.

Each AC load group consists of one 4.16 kV bus, three 480 Volt (V) load centers, and four 480 V motor control centers (MCCs). Two non-Class 1E MCCs are connected to each load group and are tripped on a safety injection actuation signal.

The standby power supply for each safety-related load group consists of one DG complete with its accessories, fuel storage, and transfer systems. The standby power supply functions as a source of AC power for safe plant shutdown in the event of loss of preferred power and for post-accident operation of engineered safety feature (ESF) loads. Each DG is rated at 5500 kiloWatt (kW) for continuous operation and 6050 kW for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months out of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Each generator is driven by a turbo-charged, four-cycle, 20-cylinder diesel engine.

Each DG is normally connected to a single 4.16 kV safety features bus of a load group.

However, there are provisions for connecting both ESF buses to a single DG during emergency conditions. Each load group is independently capable of safely shutting down the unit or mitigating the consequences of a design basis accident. The components of the standby power supply system, including related controls, required to supply power to ESF and cold shutdown loads conform to the requirements of GDC 17.

3.1.3 Station Blackout In the LAR, the licensee explained that to meet 10 CFR 50.63 requirements, the PVNGS has analyzed an SBO coping duration of 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months . The analysis was submitted to NRC in October 28, 2005, and approved by the NRC in a safety evaluation (SE) dated October 31, 2006 (ADAMS Accession No. ML062910280).

The 16-hour coping strategy analysis assumes that one of the two Station Blackout Generators (SBOGs), which serves as the alternate AC (AAC) for PVNGS, is started and connected to the AC distribution system to supply loads in the respective unit during the first hour to allow the analyzed SBO loads to be powered in accordance with administrative or emergency procedures. Should an SBO occur in any one unit (i.e., a loss of offsite power [LOOP]

coincident with the unavailability of both DGs in that unit), an AAC power source is available to provide the power necessary to cope with an SBO for a minimum of 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months .

The non-safety related AAC power source consists of two 100 percent capacity SBOGs that can be connected to each unit via the primary winding of the ESF transformer that is normally aligned to the train A 4.16 kV bus. One SBOG is analyzed to supply all required SBO loads, which are located on the A train. Each SBOG has a minimum continuous output rating of 3400 kW at 13.8 kV under worst case anticipated site environmental conditions. This rating is

sufficient to provide power to the loads identified as being important for coping with the SBO.

Starting and loading of the AAC power system is performed manually; no autostart or automatic loading capability is provided.

Although the SBOGs are able to be aligned to Unit 3 train B from a defense-in-depth perspective, for this emergency LAR, the PVNGS SBOGs are not credited to provide power to the 3B Class 1E 4.16 kV bus. The licensee has deployed three portable DGs at Unit 3 connected to the 4.16 kV AC FLEX connection box that can supply the train B 4.16 kV AC class bus to maintain the same level of defense-in-depth as of SBOGs for safe shutdown of the plant.

Based on discussion provided in LAR, Enclosure (Attachment 16), it takes less than 30 minutes to connect the portable DGs to a safety-related bus which has lost power.

3.1.4 Proposed TS Changes The licensee proposed the following specific changes to TS 3.8.1, "AC Sources - Operating," to extend the CT on a one-time basis for the PVNGS Unit 3 B train DG.

Modify NOTE in the Completion Time column, associated with Required Action B.4 of the TS 3.8.1 Action Table, to read as follows:

NOTE For the Unit 3 Train B DG failure on December 15, 2016, restore the inoperable DG to OPERABLE status within 62 days.

In the LAR, the licensee provided the following basis for the proposed change and duration of the CT Extension request:

Need for Proposed Change During routine scheduled surveillance testing on December 15, 2016, the PVNGS Unit 3 B train DG was operating partially loaded when the load suddenly decreased and a low lube oil pressure trip occurred. The physical damage was readily apparent to plant operators when responding to the event. Oil and metal debris were observed on the engine room floor and the number nine right cylinder (9R) crankcase cover was deformed. Physical damage was extensive, including but not limited to the number nine master and articulating rod separating and impacting internal areas of the engine base and block. Both the 9R and 9L pistons, sleeves and associated components were damaged and will require replacement. The counterbalance was also fractured and the crankshaft damaged at this number nine location. There was damage to the number eight master and articulating rod, including the physical fracture of two studs on the rod cap. A counterbalance at the number eight location was also fractured and damaged. The number three bearing seating surface was discovered to be cracked.

Current plans to repair the DG will exceed the TS required action completion time of 21 days approved by license amendment 199. APS has determined the cause

of the 38 DG failure does not represent a common mode failure potential for the Unit 3 train 'A' DG, and has evaluated the operational risk and is requesting an emergency LAR to extend the completion time to allow completion of repair and testing, and restoring to operable status.

Basis for Duration of CT Extension for Repair and Testing Schedule The 38 DG sustained extensive damage as a result of the recent failure. The repairs will require substantial disassembly, investigation, repair and/or replacement of damaged components, reassembly and retests. The requested completion time extension will allow for completion of repairs and testing of the 38 DG. Completed activities include initial visual inspection, damage assessment, parts recovery, removal of the generator, flywheel, and crankshaft, precision alignment checks of the DG internals, removal of pistons, liners and connecting rods, line bore measurements, and block inspection.

Continued repair activities include block repairs and machining, foundation inspection and repairs, installation of a new crankshaft followed by engine, generator, and flywheel re-assemblies, system flushes, startup checks, and retests.

Retest of the 38 DG diesel will begin with several short maintenance runs which include integral monitoring and inspection activities. Then, an over-speed test will be performed followed by a 24-hour loaded run with a 100 percent load reject and a hot restart.

Finally, isochronous load testing will be performed to verify appropriate voltage and frequency response to sequenced loads. The retest activities are scheduled to take approximately 4.5 days.

In Attachment 18 of the LAR, the licensee provided further detail of DG repair activities, which reflect a 56-day duration. The requested CT extension reflects 6 additional days for contingency to address unknowns. The NRC staff finds the need for the proposed TS change, and the duration of CT extension as reasonable, and therefore, acceptable.

3.2 Determination of Common Cause Mode of Failure The licensee stated that the cause of failure of the 38 DG is attributed to a high-cycle fatigue failure on the number 9 master rod ligament, emanating from the crank pin bore and propagated towards the articulated pin bore. The licensee stated that its root cause analysis indicates that

the high-cycle fatigue failure was due to crankshaft bore misalignment. Upon examination of the 38 DG, the licensee found the following:

No overdrilled oil passages were found on the failed master rod.

A pattern of micro-cracking was identified on the failed master rod.

Small patches of fretting had formed on master rods 1, 2, 4, 5, 9, and 10.

A singular microscopic crack was identified on master rods 2 and 4.

The crankshaft bore was measured and found to be misaligned, outside of the manufacturing specification.

The licensee also evaluated vibration data for the 3A and 38 DGs from the first quarter of 2013 to the third quarter of 2016. The licensee stated that the vibration data for 38 DG was more erratic than the vibration data for 3A DG, which supports the claim of a misaligned crankshaft bore. The 3A DG vibration data does not indicate a misaligned crankshaft bore.

The licensee stated that an overdrilled oil passage by the manufacturer caused a master rod failure on EOG 22 at South Texas Project in 1989. Since there were no overdrilled oil passages on the failed master rods of 38 DG, this was not the cause of the 38 DG failure. The licensee stated that 3A DG is not susceptible to a master rod failure caused from an overdrilled oil passage based on over 3,400 hours0.00463 days 0.111 hours 6.613757e-4 weeks 1.522e-4 months of engine service without a failure, and the absence of any industry recurrence of this type of failure.

The licensee identified fretting via visual inspection on the master rod crank pin bore saddles and associated bearing caps on six of the nine connecting rod assemblies. The licensee also identified micro-cracks within the inboard fretting marks on the number 2, number 4, and number 9 master rods near the oil groove in the ligament area. No micro-cracks were identified in any of the inspected outboard fretting marks. The licensee stated that the fretting identified on the outboard portions of the saddle and bearing are considered normal wear. The licensee stated that the fretting resulted from the misaligned crankshaft bore, which concentrated asymmetric forces. The licensee also stated that the 3A DG has not experienced a catastrophic event and, therefore, does not have main crankshaft bore misalignment. Without the misalignment, the stress profile of the 3A DG is consistent with the original design and therefore is not subject to fretting near the oil groove of the master rod ligament. The licensee also stated that micro-cracks would not be expected in engines (3A DG or others) with design features (e.g., fits, tolerances, and alignments) within specifications.

The licensee stated that the crankshaft bore misalignment was induced by either the 1986 38 DG master rod failure, the in situ repairs, or both.

There are 21 Cooper-Bessemer Model KSV 20-cylinder engines in service at five nuclear power plants. There have been five master rod failure events. The licensee stated that there were 19 Model KSV engines in non-nuclear service, and that 15 of them have been retired. Of the four remaining in service, one is a 16-cylinder dual fuel engine, and the other three are 12-cylinder dual fuel engines. These four engines have operated for a combined total of

approximately 25,000 hours0 days 0 hours 0 weeks 0 months without a connecting rod failure. Two of the retired engines experienced connecting rod failures in 1992 and 1993. A fatigue crack initiated at a pit in the connecting rod caused by relatively high lube oil acidity. It was reported that the lube oil had near-zero Total Base Number (TBN) shortly before failure. The licensee has reviewed this failure mode and determined that it is not applicable to the 3B DG failure based on the fact that there are no deviations from the specified TBN at Palo Verde.

The licensee stated that the causal analysis for 3B DG has determined that 3B DG had a misaligned crankshaft bore that resulted from the 1986 failure. The misalignment of the crankshaft bore resulted in sufficient cyclic stresses at the master rod ligament to initiate and propagate a fatigue crack. The licensee believes it is likely that the crankshaft bore misalignment also contributed to the fretting between the master rod crank pin bore and bearing, which contributed to the crack initiation. The crack would then propagate based on the elevated alternating stresses in the engine, which were increased at the crack location due to the crankshaft bore misalignment. The licensee stated that this eventually led to cyclic fatigue failure.

The NRC staff has reviewed the licensee's causal analysis evaluation which states that crankshaft bore misalignment was the cause of the number 9 master rod failure. The NRC staff finds the licensee's assessment to be reasonable. The NRC assessment is based on the vibration variance that the licensee has recorded for 3B DG, and that the misalignment resulted in sufficient cyclic stresses at the master rod ligament to initiate and propagate a fatigue crack.

The NRC staff also finds that 3A DG, as well as DGs 1A, 1B, 2A, and 2B are not susceptible to the same type of failure mechanism because the engines have not had any major mechanical failures, and have not had any major crankshaft repairs. Also, the vibration data for 3A DG has not been erratic, indicating a crankshaft bore that is not misaligned. The causes of previous Cooper-Bessemer Model KSV master rod failures are not applicable to the 3A DG, as well as DGs 1A, 1B, 2A, and 2B. These causes are iron plating manufacturing flaw, machining error manufacturing flaw (drilled an oil passage too deep), and a near-zero TBN for lube oil.

3.3 Review Methodology Per SRP Section 19.1 and Section 16.1, the NRC staff reviewed the submittal using the three-tiered approach and the five key principles of risk-informed decisionmaking presented in RG 1.174 and RG 1.177.

3.3.1 Key Principle 1: Compliance with Current Regulations For the proposed TS change, the licensee continues to comply with 10 CFR 50, Appendix A, GDC 17, GDC 18, GDC 19, 10 CFR 50.34(f), 10 CFR 50.36, 10 CFR 50.63, 10 CFR 50.65, and 10 CFR 50.120.

3.3.2 Key Principle 2: Evaluation of Defense-in-Depth 3.3.2.1 Defense-in-depth for onsite and offsite power sources In license Amendment No. 199 for PVNGS Unit 3 (approved by NRC on December 23, 2016)

(ADAMS Accession No. ML16358A676), the NRC staff evaluated the defense-in-depth aspects

for onsite and offsite power sources. The staff determined that there are multiple, diverse means of supplying electrical power to the safety buses to safely shutdown Unit 3 and maintain the plant in a cold shutdown condition. In addition, the portable DGs have the capacity and capability to support the loads necessary to mitigate a LOOP event and bring the unit to cold shutdown in case of an extended LOOP concurrent with a single failure of the train A DG during plant operation, and meet the intent of BTP 8-8 in achieving a cold shutdown. In the LAR, 7, the licensee stated that three portable DGs are provided with the load sharing control equipment/features to ensure real and reactive power are equally shared across each running generator. Based on the staff's request for additional information, by letter dated January 2, 2017, the licensee also provided details of the protection devices associated with each portable DG. The licensee stated that the protection devices of the portable DGs have been appropriately coordinated with the downstream protection relays/devices. Based on its review of the additional information, the NRC staff finds additional assurance that the portable DGs are suitable for the required additional source of power, if needed.

3.3.2.2 Risk Management and Commitments The licensee stated that risk would be managed during the extended CT via the Maintenance Rule (10 CFR 50.65(a)(4)) Configuration Risk Management Program, which has been reviewed by NRC in prior risk-informed TS change requests.

In the Attachment 3 of the supplemental letter dated January 4, 2017, the licensee provided following list of License Conditions and Commitments, which will be implemented in accordance with the PVNGS Configuration Risk Management Program.

License Conditions Appendix D, "Adidtional Conditions," to Renewed Facility Operating License No. NPF-74 is hereby amended to add the following new license conditions, designated as Amendment No. 200, to read as follows:

1. The following equipment will be protected by signage/chains for the duration of the extended completion time to prevent inadvertent impact from walkdowns, inspections, maintenance and potential for transient combustible fires:

a. Both SBOGs

b. Unit 3 train 'A' DG

c. Unit 3 train 'A' ESF Switchgear, DC equipment and DC Battery Rooms

d. Three AC portable diesel generators deployed at Unit 3 and their connections to the train 'B' FLEX 4.16 kV AC connection box

e. Diesel-driven FLEX SG Makeup Pump deployed at Unit 3

f. Turbine-driven auxiliary feedwater pump

g. Fire pumps, diesel and electric

If any of the protected equipment identified above becomes unavailable, APS will enter MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Unit 3. If restoration is completed within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months this action is not required.

2. The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the extended allowed outage time.

If at any time APS is notified by the system load dispatcher that a condition in the grid could result in the loss of all power to the switchyard, APS will enter MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Unit 3. If the condition is resolved this action is not required.

3. In case APS determines prior to expiration of the extended completion time, a common failure mode does exist, then APS will shut down the plant.

Commitments

1. The redundant train 'A' DG (along with all of its required systems, subsystems, trains, components, and devices) will be verified OPERABLE (as required by Technical Specification) and no discretionary maintenance activities will be scheduled on the redundant (OPERABLE)

DG.

2. No discretionary maintenance activities will be scheduled on the SBOGs.

3. No discretionary maintenance activities will be scheduled on the startup transformers.

4. No discretionary maintenance activities will be scheduled in the Salt River Project switchyard or the unit's 13.8 kV power supply lines and transformers which could cause a line outage or challenge offsite power availability to the unit utilizing the extended DG completion time.

5. All activity, including access, in the Salt River Project switchyard shall be closely monitored and controlled.

6. The SBOGs will not be used for non-safety functions (i.e., power peaking to the grid).

7. All maintenance activities associated with Unit 3 will be assessed and managed per 10 CFR 50.65(a)(4) (Maintenance Rule). Planned work will be controlled during the extended completion time so that Unit 3 does not voluntarily enter a YELLOW Risk Management Action Level.

8. The OPERABILITY of the steam driven auxiliary feedwater pump will be verified before entering the extended DG completion time.

9. The system dispatcher will be contacted once per day and informed of the DG status, along with the power needs of the facility.

10. Should a severe weather warning be issued for the local area that could affect the Salt River Project switchyard or the offsite power supply during the extended DG completion time, an operator will be available locally at the SBOG should local operation of the SBOG be required as a result of on-site weather related damage.

11. No discretionary maintenance will be allowed on the main and unit auxiliary transformers associated with the unit.

12. APS has provided three portable diesel generators to ensure the ability to bring Unit 3 to cold shutdown in the event of a LOOP during the extended time period that the Unit 3 train 'B' DG is inoperable. The three portable diesel generators operate in parallel as a set. The result is that the three portable diesel generators are sufficient to enable a cold shutdown of Unit 3 in the event of a LOOP with a single failure during the extended time period while the Unit 3 train 'B' DG is inoperable. The three portable diesel generators are deployed and physically connected to the Unit 3 train 'B' 4.16 kV AC FLEX connection box for the duration of the extended DG completion time.

13. The portable DGs will be verified available and functional by the completion of a test run prior to the period of the extended allowable outage time.

14. A diesel-driven FLEX SG Makeup Pump is deployed to its FLEX pad at Unit 3 for the duration of the extended DG completion time.

15. See License Condition 1 above.

16. Establish transient combustible and hot work exclusion zones by procedure and using barriers/signage in the following compartments, and conducting shift walkdowns of these zones by the Fire Marshal or his designee:

a. Fire zones FCCOR2 (120' Corridor Building) and FCCOR2A (120' Corridor Riser Shaft)

b. Fire zones FCTB04 (upper level only, non-class DC Equipment,

[F CTB04-TRAN 1])

c. Fire zone FC86A (train 'A' Seismic Gap, make part of train 'A' Electrical Protected Equipment)

d. Fire zone FCTB100 zone ZT1 G (SW corner, south half of 100' Turbine between columns TA and TC)

17. An additional dedicated auxiliary operator will be added to each shift to implement the auxiliary feedwater cross-tie.

18. A continuous fire watch with a fire extinguisher and training to utilize the extinguisher will be posted in fire zone FCCOR2 (120' Corridor Building).

19. See License Condition 2 above.

20. Component testing or maintenance of safety systems and important non- safety equipment in the offsite power systems that can increase the likelihood of a plant transient (unit trip) or LOOP will be avoided.

21. Discretionary work will be prohibited in the Salt River Project switchyard during the extended Unit 3 train 'B' DG TS 3.8.1 Condition B required action completion time.

22. TS required systems, subsystems, trains, components, and devices that depend on the remaining power sources will be verified to be operable and positive measures will be provided to preclude subsequent testing or maintenance activities on these systems, subsystems, trains, components, and devices.

23. Steam-driven emergency feed water pump will be controlled as protected equipment.

24. Deleted.

25. Availability of the portable DGs will be verified once per shift.

26. Approval of transient combustibles and hot work in Unit 3 will be controlled by the outage control center (OCC).

27. There will be an OCC position responsible for oversight and monitoring of the compensatory measures [Commitments] of Attachment 3 and the actions described in this attachment.

28. See License Condition 3 above.

29. An auxiliary operator (AO) on each shift will be dedicated to perform pre-start checks of the portable generators each shift. This dedicated AO will perform the emergency start of the portable generators when directed and monitor their operation. The dedicated AO will have no other assigned duties during the extended completion time.

30. In the event of a reactor trip with a loss of off-site power, the Area 4 (Control Building) AO, will perform the required electrical system alignments, as directed by the control room, to restore power to the 'B' train Class 1E 4.16 kV bus using the portable generators, in accordance with station procedures.

31. In the event of a reactor trip with a loss of off-site power, one of the on-shift reactor operators will be assigned to perform and direct actions to restore power to the 'B' train Class 1E 4.16 kV bus using the portable generators. During the event, this reactor operator will not be assigned other duties until completion of power restoration.

The NRC staff finds that the above License Conditions and Commitments provide adequate Risk Management for the safety of the plant, and enhance the defense-in-depth aspects of the plant.

3.3.3 Key Principle 3: Evaluation of Safety Margins In the LAR, the licensee stated, in part, that The proposed one-time extension of the Unit 3 train B DG completion time remains consistent with the codes and standards applicable to the PVNGS onsite AC sources and electrical distribution system. A loss of all AC power event would require a loss of all offsite power sources, failure of the train A DG, failure of both SBOGs, and failure of the portable DGs. In addition, with deployment of the diesel-driven FLEX SG Makeup Pump at Unit 3, another backup supply of SG makeup independent of offsite power or the 4.16 kV AC buses is provided to mitigate the most likely scenarios associated with a loss of offsite power event.

Also, PVNGS has installed a cross-connection which allows make-up to SGs from the station fire protection system which provides additional defense-in-depth for the heat removal safety function. Based on realistic thermal hydraulic analysis, PVNGS design now includes six 100 percent capacity steam generator (SG) makeup pumps each supplied by onsite power sources. Only one of these sources is powered by the 3B DG if offsite power is lost. Therefore, there is no significant reduction in the margin of safety.

The NRC staff reviewed whether the proposed TS changes will have any impact on the licensee's compliance with GDC 17, GDC 18, 10 CFR 50.36, 10 CFR 50.63, and 10 CFR 50.65.

The staff did not find any adverse impact on continued compliance with these regulatory requirements. Due to defense-in-depth of onsite and offsite power source, and other supporting FLEX equipment, the staff finds for the more likely scenarios of LOOP, and SBO, the reduction in safety margin will be minimal. Offsite power sources, and one train of onsite power source would continue to be available for the scenario of a loss-of-coolant accident.

3.3.4 Key Principle 4: Change in Risk Consistent with the Commission's Safety Goal Policy Statement The evaluation below addresses the NRC staff's philosophy of risk-informed decision making:

that when the proposed changes result in a change in CDF or risk, the increase should be small and consistent with the intent of the Commission's Safety Goal Policy Statement. The NRC staff evaluation of Key Principle 4 for the proposed one-time TS change is described below.

3.3.4.1 Tier 1: PRA Capability and Insights The first tier evaluates the impact of the proposed change on plant operational risk. The Tier 1 review involves two aspects: (1) evaluation of the technical adequacy of the PVNGS PRA models and their application to the proposed change, and (2) evaluation of the PRA results and insights based on the licensee's proposed change.

PRA Quality RG 1.174 states, in part, that, "[t]he scope, level of detail, and technical adequacy of the PRA are to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process." The technical adequacy of the PRA must be compatible with the safety implications of the TS change being requested and the role that the PRA plays in justifying that change. That is, the more the potential change in risk or the greater the uncertainty in that risk from the requested TS change, or both, the more rigor that must go into ensuring the technical adequacy of the PRA. This applies to Tier 1, and it also applies to Tier 2 and Tier 3 to the extent that a PRA model is used.

RG 1.200, Revision 2, describes one acceptable approach for determining whether the technical adequacy of the PRA, in total or the parts that are used to support an application, is sufficient to provide confidence in the results such that the PRA can be used in regulatory decisionmaking for light-water reactors. RG 1.200, Revision 2, endorses with comments and qualifications the use of the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS)

PRA standard ASME/ANS RA-Sa-2009, "Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications"; Nuclear Energy Institute (NEI) 00-02, Revision 1, "Probabilistic Risk Assessment Peer Review Process Guidance" (ADAMS Accession No. ML061510621); and NEI 05-04, Revision 2, "Process for Performing Internal Events PRA Peer Reviews Using the ASME PRA Standard" (ADAMS Accession No. ML083430462). The ASME/ANS PRA standard provides technical supporting requirements in terms of three Capability Categories (CCs). The intent of the delineation of the Capability Categories within the Supporting Requirements (SRs) is generally that the degree of scope and level of detail, the degree of plant specificity, and the degree of realism increase from CC I to CC Ill. In general, the staff anticipates that current good practice (i.e., CC II of the ASME/ANS standard is adequate for the majority of applications).

Internal Events PRA (Including Internal Flooding)

The full-power, internal events PRA (IEPRA) and internal flooding PRA (IFPRA) for PVNGS, Unit 3, address both CDF and large early release frequency (LERF). The licensee stated that

its risk management process for maintaining and updating the PRA ensures that the IEPRA and IFPRA accurately reflect the as-built, as-operated plant. The licensee used RG 1.200, Revision 2, to address the technical adequacy of the IEPRA and IFPRA to assure these PRAs are capable of accurately characterizing the risk impact from internal events (including flooding) associated with the TS CT change for 38 EOG. Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluation.

In 1999, the Combustion Engineering Owners Group (CEOG) conducted a peer review of the IEPRA in accordance with NEI 00-02. Attachment 8 of the LAR provided the findings from this peer review and the licensee's disposition of these findings. In 2010, the licensee performed a self-assessment on the IEPRA in accordance with Appendix 8 of RG 1.200, Revision 2, to assess gaps between the CEOG peer review results and the SRs in ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. Attachment 9 of the LAR provided the findings from the self-assessment of the IEPRA for SRs determined not met to CC II and the licensee's disposition of these findings.

In 2010, Westinghouse performed a full-scope peer review of the IFPRA against the SRs of AS ME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. Attachment 10 of the LAR provides the facts and observations (F&Os) from the peer review of the IFPRA for SRs determined not met to CC II and the licensee's disposition to these F&Os. The licensee stated that no changes have been made to the IEPRA and IFPRA subsequent to the peer reviews that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009. Therefore, no additional peer reviews were performed to support the risk evaluation under this LAR.

The NRC staff reviewed the licensee's disposition of the findings and F&Os, as supplemented by Attachment 16 of the LAR, associated with the IEPRA and IFPRA, and concludes that they were properly dispositioned to support the internal events and internal flooding PRA technical adequacy for the proposed one-time CT extension. Also, the LAR risk results (i.e., ICCDP and ICLE RP for the proposed one-time CT extension) for internal events and internal flooding met the RG 1.177 risk acceptance guidelines by a large margin, which provides additional confidence that any uncertainties associated with the IEPRA and IFPRA would not change the conclusions of this assessment.

Fire PRA The PVNGS, Unit 3, internal fire PRA (FPRA) addresses both CDF and LERF. The licensee stated that its risk management process for maintaining and updating the PRA ensures that the FPRA remains an accurate reflection of the as-built and as-operated plant. The licensee used RG 1.200, Revision 2, to address the technical adequacy of the FPRA to ensure that it is capable of accurately characterizing the risk impact from internal fires associated with the TS CT change for 38 EOG. Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluation.

The licensee stated that its FPRA was developed consistent with the guidance in NUREG/CR-6850, "EPRl/NRC-RES Fire PRA Methodology for Nuclear Power Facilities" (ADAMS Accession No. ML052580118), including the frequently asked question guidance

developed for the National Fire Protection Association Standard 805, "Performance Based Standard for Fire Protection for Light Water Reactor Electric Generating Plants." However, some of the more recent endorsed methods have not yet been incorporated into the FPRA model. In December 2012, a full-scope peer review of the FPRA was performed in accordance with NEI 07-12, "Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines,"

against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2.

Subsequently, in December 2014, a focused-scope peer review of the FPRA was conducted in accordance with NEI 07-12 to address ASME/ANS RA-Sa-2009 SRs determined not met to CC II in the first peer review, including a complete re-review of the affected SRs. 2 of the LAR provided the F&Os from the peer reviews of the FPRA for SRs determined not met to CC II and the licensee's disposition to these F&Os. The licensee stated that no changes were made subsequent to the peer reviews that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009. Therefore, no additional peer reviews were performed to support the risk evaluation under this LAR.

The NRC staff evaluated the licensee's disposition of the F&Os associated with the FPRA and concludes these F&Os were properly dispositioned to support the internal FPRA technical adequacy for the proposed one-time CT extension. Also, the licensee performed a sensitivity analysis in Attachment 16 of the LAR that quantitatively evaluated risk associated with the unavailability of 38 EOG for 62 days and credit for the portable DGs. This analysis showed that the internal fire risk results (i.e., ICCDP and ICLERP) meet the RG 1.177 risk acceptance guidelines by a large margin. This provides additional confidence that any uncertainties associated with the FPRA would not change the conclusions of this assessment.

Seismic and Other External Hazards The licensee stated that the PVNGS, Unit 3, seismic PRA (SPRA) addressed both CDF and LERF. The licensee also stated that its risk management process for maintaining and updating the PRA ensured that the SPRA remains an accurate reflection of the as-built and as-operated plant. The licensee used RG 1.200, Revision 2, to address the technical adequacy of the SPRA to assure this PRA is capable of evaluating the risk impact from seismic hazards associated with the TS CT change for 38 EOG. Capability Category II of ASME/ANS RA-Sa-2009 was applied as the standard, and any identified deficiencies to those requirements were assessed further to determine any impacts to the risk evaluation.

In December 2013, a full-scope peer review of the SPRA was performed in accordance with NEI 12-13, "External Hazards PRA Peer Review Process Guidelines," against the SRs of ASME/ANS RA-Sa-2009, as qualified by RG 1.200, Revision 2. Attachment 11 of the LAR provided the F&Os from this peer review for SRs determined not met to CC II and the licensee's disposition to these F&Os. The licensee stated that no changes have been made to the SPRA subsequent to the peer review that would constitute an upgrade as defined by ASME/ANS RA-Sa-2009. Therefore, no additional peer reviews were performed to support the risk evaluation under this LAR.

The NRC staff evaluated the licensee's disposition of the F&Os associated with the SPRA and concludes that they were properly dispositioned to support the seismic PRA technical adequacy for the proposed one-time CT extension. Also, the seismic risk results presented by the

licensee (i.e., ICCOP and ICLE RP for the proposed one-time CT extension) met the RG 1.177 risk acceptance guidelines by a large margin, providing confidence that any uncertainties associated with the SPRA would be unlikely to change the conclusions of this assessment.

Regulatory Position 2.3.2 of RG 1.177 states that the scope of the analysis should include all hazard groups (i.e., internal events, internal flooding, internal fires, seismic events, and other external hazards) unless it can be shown that the contribution from specific hazard groups does not affect the decision. All hazards not addressed using PRA were screened for applicability by a peer-reviewed plant-specific evaluation in accordance with RG 1.200, Revision 2. There were no findings from this peer review. Attachment 13 of the LAR provides the results of the external hazards screening analysis. The NRC staff finds that the licensee followed RG 1.177 by performing quantitative or qualitative bounding analyses of other external hazards and determining that those hazards do not impact this application. In addition, the proposed compensatory actions (commitments) listed in the LAR would reduce any risk associated with these external hazards.

PRA Results and Insights The licensee evaluated the impact of the proposed change on plant risk using the internal events, internal flooding, internal fire, and seismic events PRA models. This risk evaluation is specific to the PVNGS 38 EOG outage with all relevant configurations represented in the PRA models, including:

The 38 EOG was unavailable for the 62-day period.

The increased potential for a common cause failure of 3A EOG was minimal during the 62-day period that 38 EOG was unavailable, based on the 38 EOG failure cause evaluation presented in Attachment 4 of the LAR. The NRC staff's review of this failure cause evaluation is provided in this SE. The sensitivity of calculated risk to this assumption was evaluated in Attachment 16 of the LAR by increasing the common cause failure probability for 3A EOG to the alpha factor value in the NRC common cause database. When crediting the portable OGs, the licensee's sensitivity analysis indicated that ICCOP and ICLERP met the RG 1.177 risk acceptance guidelines by a large margin as discussed in detail later in this SE.

The risk evaluation used a zero test and maintenance model, because the licensee stated that elective maintenance on other risk-significant plant equipment will be prohibited during the 62-day period. The licensee stated that surveillance tests conducted during the 62-day period that will cause the tested equipment to be inoperable can be completed within the specified 4-hour CT specified by TS 3.8.1.8.2. The testing elements that require this equipment to be declared inoperable during testing relate to use of temporary testing instruments or valve alignments that can be quickly restored, if needed. Therefore, the use of the average test and maintenance model was considered conservative based on controls being taken to eliminate unavailability of equipment for planned maintenance, and the low likelihood of corrective maintenance occurring during the 62-day repair period. The sensitivity to this assumption on risk was

evaluated in Attachment 16 of the LAR by using the average test and maintenance PRA model. When crediting the portable DGs, the licensee's sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a large margin as discussed in detail later in this SE.

The risk evaluation did not credit:

The three portable DGs that were deployed at Unit 3 and connected to the 4.16 kV AC FLEX connection box, The diesel-driven FLEX SG makeup pump, and Recovering from the failure of A or B EDGs.

The risk evaluation credited the following compensatory measures (commitments), which were identified as commitments in Attachment 3 of the LAR:

An additional dedicated auxiliary operator was added to each shift to implement the auxiliary feedwater cross-tie function.

A continuous fire watch was posted in fire zone FCCOR2 (120' Corridor Building).

Transient combustible and hot work exclusion zones were established in risk-significant fire zones through use of procedures and barriers/signage.

These zones were walked down each shift.

In response to request for additional information APLA RAl-1 dated January 2, 2017 (ADAMS Accession No. ML17003A018), the licensee explained how the FPRA model was adjusted to credit these three compensatory measures (commitments) (ADAMS Accession No. ML17002A001 ). The NRC staff concludes that these compensatory measures (commitments) are appropriately reflected in the FPRA, because the adjustments are consistent with NRC guidance in NUREG-1921, "EPRl/NRC-RES Fire Human Reliability Analysis Guidelines" (ADAMS Accession No. ML12216A104), NUREG/CR-6850, "EPRl/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology" (ADAMS Accession No. ML052580118), and NUREG/CR-6850, Supplement 1, "Fire Probabilistic Risk Assessment Methods Enhancements" (ADAMS Accession No. ML103090242). Also, the licensee included in the response a sensitivity analysis that quantitatively evaluated the impact of not crediting these three compensatory measures (commitments) during the 38 EOG outage with credit for the portable DGs. This sensitivity analysis indicated that the total ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 1.6 and 5, respectively, providing additional confidence that any uncertainties associated with the modeling of these compensatory measures (commitments) would be unlikely to change the conclusions of this assessment.

The licensee calculated total ICCDP and ICLERP based on the entire 62-day CT for 38 EOG.

These risk values are presented below.

ICCDP =9.8 x 10-5 (RG 1.177 Acceptance Guideline: < 1 x 10-5 with effective compensatory measures (commitments) implemented to reduce the sources of increased risk)

IC LE RP = 2.8 x 10-7 (RG 1.177 Acceptance Guideline: < 1 x 10-5 with effective compensatory measures (commitments) implemented to reduce the sources of increased risk)

The NRC staff finds that the licensee met the appropriate risk measures specific to one-time only CT changes considering the compensatory measures (commitments) discussed later in this SE, and is, therefore, acceptable.

Sensitivity and Uncertainty Analyses Regulatory Position 2.3.5 of RG 1.177 states that the risk resulting from TS CT changes is often relatively insensitive to uncertainties, because uncertainties associated with CT changes tend to similarly affect the base case and the change case. Section 4.3.3, Attachment 15, and 6 of the LAR presented the uncertainty and sensitivity analyses associated with the risk evaluation for this proposed change.

Model uncertainties and related assumptions for the PVNGS PRAs were identified using guidance in NUREG-1855, "Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making," (ADAMS Accession No. ML090970525), and EPRI TR-1016737, "Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments," December 2008. In Attachment 15 of the LAR, the licensee demonstrated that no additional sensitivity analyses were required to address these model uncertainties and related assumptions. To address potential uncertainties associated with the risk estimates for the proposed change, the licensee discussed numerous conservatisms of the PRA models, including:

Firewater cross-connect to auxiliary feedwater was not credited in the Unit 3 IEPRA and IFPRA. This modification was only credited in the Unit 3 FPRA.

Temporary equipment such as the three portable DGs and FLEX SG makeup pump were not credited in the PRAs. The DGs were only credited in the sensitivity analyses in Attachment 16 of the LAR.

Fire events were assumed to, at a minimum, cause a loss of main feedwater and subsequent reactor trip.

Simplified relay fragility analyses were performed that resulted in higher failure probabilities than if detailed fragility analyses had been performed. This over-estimates the failure probability of an EOG during seismic events.

Hot shorts were conservatively assumed to occur with enough electrical contact to impose full voltage on the "target conductor."

Non-rated fire barriers were always assumed to fail.

The main control room ventilation system was assumed unavailable or isolated during a fire event. This assumption was conservative since the use of the smoke purge system would remove heat and smoke from the room, improving habitability.

It was assumed that containment isolation fails during all fire scenarios that necessitate main control room abandonment.

In response to NRC technical concerns, the licensee provided in Attachment 16 of the LAR the following sensitivity analyses associated with the proposed change:

The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the zero test and maintenance model. The portable DGs were conservatively credited in the FPRA and not credited in the IEPRA, IFPRA, and SPRA. Failure data used for the portable DGs was dominated by human error probability (0.322) to start the DGs. The only fire scenarios credited for portable DGs were those that allowed sufficient time to restore power to the Class 1E bus in order to recover safety functions and mitigate the event. The licensee stated that:

Operators have been trained on the procedures for loss of offsite power that specify use of alternate power sources, including the portable DGs.

Training, briefings, and walkdowns have been provided to the operators responsible for operating the portable DGs.

Designated operators were made familiar with instructions for starting and operating the portable DGs.

It should be noted that use of the FLEX SG makeup pump was not credited in this sensitivity analysis. The sensitivity analysis indicated that ICCDP and ICLE RP met the RG 1.177 risk acceptance guidelines by a factor of 3. 7 and 8.3, respectively.

The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the average test and maintenance model. The portable DGs were modeled in the same manner as the first sensitivity analysis and use of the FLEX SG makeup pump was not credited. This sensitivity analysis indicated that ICCDP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 1.5 and 5, respectively.

The licensee performed a sensitivity analysis of the proposed change that credited the portable DGs using the zero test and maintenance model, and the common cause failure rate for 3A EOG was set to the alpha factor value (this represents common mode failure of the 38 EOG). The portable DGs were

modeled the same as described in the first sensitivity analysis, and use of the FLEX SG makeup pump was not credited. The sensitivity analysis indicated that ICCOP and ICLERP met the RG 1.177 risk acceptance guidelines by a factor of 3.4 and 7.7, respectively.

Based on the margin by which the sensitivity analyses met the RG 1.177 risk acceptance guidelines and the multiple compensatory measures (commitments) that the licensee committed to implement (or has already implemented), the NRC staff concludes that PRA model uncertainties are not sufficient to change the conclusions of the LAR. The LAR described how the PRA models were sufficiently complete and no new initiating events or failure modes were introduced by the proposed change and, therefore, the PRA models were able to adequately predict the change in COF and LERF for the one-time CT extension. Based on the discussion above, the NRC staff finds that the licensee's assessment of sensitivity and uncertainty meets the guidance in RG 1.177.

3.3.4.2 Tier 2: Avoidance of Risk-Significant Plant Configurations Under the Tier 2 acceptance guideline in RG 1.177, the licensee should provide reasonable assurance that risk-significant plant equipment outage configurations would not occur when specific plant equipment is taken out of service in accordance with the proposed TS change.

Based on configuration-specific risk insights provided by the PVNGS IEPRA, IFPRA, FPRA, and SPRA, and as part of the PVNGS configuration risk management program, the licensee identified risk-significant combinations of equipment that if out-of-service during the 3B EOG outage would significantly increase risk. Next, the licensee identified further compensatory actions and restrictions to avoid these high-risk equipment outage combinations. Attachment 3 of the LAR discussed in detail these license conditions and commitments that would be implemented during the 3B EOG outage to ensure the risk impacts are acceptably low.

The NRC staff finds that the licensee provided an acceptable (i.e., consistent with RG 1.177)

Tier 2 analysis of potential risk-significant configurations that could occur during the 3B EOG outage and used these risk insights to identify compensatory measures (commitments) to preclude their occurrence. The staff notes that the licensee performed this Tier 2 analysis using PRA models of the appropriate scope, level of detail, and technical adequacy as discussed under the "PRA Quality" section of this SE. The staff also notes that the licensee's Tier 2 analysis used the base PRA, which conservatively does not credit FLEX equipment. The licensee used an approach consistent with RG 1.177, which provides reasonable assurance that risk-significant plant equipment outage configurations will not occur during the 3B EOG outage.

3.3.4.3 Tier 3: Risk-Informed Configuration Risk Management RG 1.177 states that Tier 3 is the establishment of an overall configuration risk management program to ensure that other potentially lower probability, but nonetheless risk-significant, configurations resulting from maintenance and other operational activities are identified and managed. RG 1.177 further states that the licensee's program for compliance with 10 CFR 50.65(a)(4) ensures that the risk impact of out-of-service equipment is appropriately assessed and managed.

The licensee stated in Section 4.3.3 of the LAR that PVNGS has an established configuration risk management program that implements 10 CFR 50.65(a)(4) requirements. The licensee stated that all maintenance activities associated with Unit 3 are assessed and managed per 10 CFR 50.65(a)(4) (Maintenance Rule) to evaluate the overall impact on risk of proposed plant configurations prior to, and during, the performance of maintenance activities that remove equipment from service.

Based on the above, the NRC staff finds the licensee's Tier 3 program for complying with 10 CFR 50.65(a)(4) is consistent with the guidance of Section 16.1 of the SRP and RG 1.177 and, thus, is acceptable.

3.3.4.4 Summary of Key Principle 4 The licensee has demonstrated that the scope, level of detail, and technical adequacy of its PRA models are sufficient to support the proposed one-time CT change to TS 3.8.1.B.4. The risk metrics used to support the LAR are consistent with RG 1.177. The NRC staff finds that the licensee has followed the three-tiered approach outlined in RG 1.177 to evaluate the risk associated with the proposed change and, therefore, the proposed change satisfies the fourth key safety principle of RG 1.177.

3.3.5 Key Principle 5: Performance Measurement Strategies - Implementation and Monitoring Program RG 1.174 and RG 1.177 establish the need for an implementation and monitoring program to ensure that no adverse safety degradation occurs because of the changes to the TS. An implementation and monitoring program is intended to ensure that the impact of the proposed TS change continues to reflect the reliability and availability of SSCs impacted by the change.

RG 1.177 states that the licensee is to use a three-tiered approach in implementing the proposed TS CT change. Application of the three-tiered approach is in keeping with the fundamental principle that the proposed change is consistent with the defense-in-depth philosophy. Application of the three-tiered approach provides assurance that defense-in-depth will not be significantly impacted by the proposed change. Furthermore, RG 1.177 states that to ensure that extension of a TS CT does not degrade operational safety over time, the licensee should ensure, as part of its Maintenance Rule program (10 CFR 50.65), that when equipment does not meet its performance criteria, the evaluation required under the Maintenance Rule includes prior related TS changes in its scope.

The licensee provided a brief evaluation of the proposed TS change against the three tiered approach in the LAR. In addition, the 38 EOG is monitored under the PVNGS Maintenance Rule Program. If the pre-established reliability or availability performance criteria for the 38 EOG is exceeded, they are evaluated for 10 CFR 50.65(a)(1) actions, which requires increased management attention and goal setting in order to restore their performance to an acceptable level. Furthermore, the licensee described additional post maintenance monitoring and re-testing activities (e.g., isochronous load testing, 24-hour loaded run with 100 percent load reject) that will provide assurance that the long-term reliability of the SSC impacted by the change (i.e., the 38 EOG) is not degraded.

The NRC staff concludes that the implementation and monitoring program for the proposed TS change described by the licensee satisfies the fifth key safety principle of RG 1.177.

3.4 Human Factors 3.4.1 Description of Operator Action(s) and Assessed Safety Significance The licensee stated in its December 30, 2016, submittal that during the extended unavailability period of the 38 DG, APS will continue to deploy portable DGs connected to the 4.16 kV AC FLEX connection box that can supply the 'B' train 4.16 kV Class 1E bus, as approved by the NRC license Amendment No. 199 for PVNGS Unit 3, dated December 23, 2016.

At steady state, full-power operation, the 4160 VAC portable generators will be staged and connected to train 'B.' In the event of the loss of offsite power (LOOP), SBO, and/or loss of power to Class 1E bus PBB-S04, Train 'B' EOG is unavailable, and SBOGs fail to either start or load, operators will have to take manual actions to start the 4160 VAC portable generators, to provide power to PBB-S04 and start an auxiliary feedwater pump. Prior to any need to start the 4160 VAC portable generators, power will be supplied to the portable generator jacket water heaters, which will allow a fast start of 10 seconds or less. In the event of loss of all feedwater (main feedwater, auxiliary feedwater, and alternate feedwater), the operators will be required to cross-connect fire protection (FP) system and auxiliary feedwater (AF) system, in order to successfully feed the steam generator, to provide cooling to at least one steam generator, within 75 minutes following the start of a loss of all feedwater accident.

In accordance with the generic risk categories established in NUREG-1764, these actions are considered "risk-important' due to the fact that their failure could potentially complicate a LOOP, SBO, or loss of all feedwater accident by challenging the heat removal capability needed to put Unit 3 in a safe shutdown condition. Because of its high-risk importance, the NRC staff performed a "Level One" review (i.e., the most stringent of the graded reviews possible under the guidance of NUREG-1764.)

3.4.2 Operating Experience Review The licensee stated in its submittal dated December 30, 2016 that they will deploy three portable DGs at Unit 3 connected to the 4.16 kV FLEX connection box that can supply the train 'B' 4.16 kV AC Class 1E bus, for the extended duration of TS CT. The operations staff have received training for operation of the FLEX 1 and FLEX 2 DGs, as they were installed (pre-staged, on-site) in 2016. However, the licensee does not possess actual operating experience using the FLEX DGs.

Since the proposed temporary configuration with the use of FLEX DGs is an unanticipated condition, due the failure of 38 DG, it is not reasonable to expect that the licensee would have actual operating experience using the portable DGs for purposes other than mitigation of beyond design basis accidents. Therefore, this element was not reviewed further by the NRC staff.

3.4.3 Functional Requirements Analysis and Function Allocation The functions that must be performed to satisfy PVNGS Unit 3 power generation and safety goals are not affected by the change described in the proposed LAR. Therefore, no additional functional requirements analysis or function allocation are necessary. The NRC staff finds this position to be acceptable.

3.4.4 Task Analysis Most of the task requirements described in the licensee's original task analysis remain unchanged. New tasks associated with the changes described in the proposed LAR include pre-start checks of the portable generators (to be performed once per shift, each shift), starting the portable generators and performing the required electrical system alignments, as directed by the control room operators, to restore the power to the 'B' train Class 1E 4.16 kV bus using portable generators, and monitoring the operation of portable generators. These new tasks will be performed by an additional, dedicated auxiliary operator (AO) on each shift, who will not have any other duties assigned during the extended CT. As such, no additional operational or cognitive burden is expected for the control room operations staff, other than occasional communication with the dedicated AO, as needed.

The NRC staff concludes that with the use of additional dedicated AO, the additional workload to the operators will be minimal and will not prevent them from accomplishing their tasks. The staff finds this aspect of the proposed LAR to be acceptable.

3.4.5 Staffing The licensee stated in its December 30, 2016, submittal, and further clarified in its response to APHB RAl-2, that an additional, dedicated AO will be added to each shift, to implement the modification that cross-ties fire water to the train 'N' auxiliary feedwater system. The additional AO on each shift will also perform pre-start check of the portable generators each shift. This dedicated AO will perform the emergency start of the portable generators, when directed, and monitor their operation. The dedicated AO will have no other assigned duties during the extended CT.

In the event of a reactor trip with a loss of off-site power, the Area 4 (Control Building) AO will perform the required electrical system alignments, as directed by the control room, to restore power to the 'B' train Class 1E 4.16 kV bus using the portable generators, in accordance with station procedures.

In the event of a reactor trip with a loss of off-site power, one of the on-shift reactor operators will be assigned to perform and direct actions to restore power to the 'B' train Class 1E 4.16 kV bus using the portable generators. During the event, this reactor operator will not be assigned other duties until completion of power restoration.

The licensee provided additional information regarding the total number of trained personnel that will be available to perform the duties of dedicated AO for the duration of the extended TS CT; for more information, see Section 3.4.8 of this SE.

There are no other changes to operator staffing proposed by the licensee, in connection with the subject LAR. The NRC staff concludes that the addition of a dedicated AO, with the duties limited to those as described above, to be adequate for the purpose of ensuring that, in the event of an accident involving the loss of preferred power, sufficient trained personnel will be available to perform the time-critical manual action. The staff finds this aspect of the proposed LAR to be acceptable.

3.4.6 Human-System Interface Design There are no changes to the control room Human-System Interface (HSI) design required in connection with the proposed LAR. Therefore, no further evaluation of review element is necessary. The NRC staff finds this position to be acceptable.

3.4. 7 Procedure Design In response to APHB RAl-1.a, the licensee stated that the following three emergency operating procedures (EOPs) were revised, in order to improve efficiency and clarity of procedure guidance on the use of compensatory measures (commitments), such as the use of portable DGs and FP to AF system cross-connect. The revised procedures were identified as follows:

40MT-9ZZ01, Operations Maintenance Activities, was revised to improve operator response.

40EP-9E006, Loss of All Feedwater, step 6.1 was revised to direct use of Functional Recovery Procedure, 40EP-E009, Standard Appendix 118, to facilitate more timely restoration of feedwater when the FP to AF cross-connection is needed.

40EP-9E010, Standard Appendices - Standard Appendix 118, Cross-connect FP to AF, was revised to provide comprehensive guidance on how to align the flow path and establish the feedwater flow from the fire protection header, including steps to align the feedwater system, select and depressurize a steam generator, establish a makeup to the reactor coolant system (RCS), start FP system pumps, and control bands for the steam generator water level and pressure. This change streamlines the actions by bringing all necessary guidance to establish feedwater from the FP header into one appendix, allowing different sections of the appendix to be executed concurrently, if required.

The licensee further noted that procedure 40EP-9E009, Functional Recovery Procedure, could also be implemented during this event, however, a revision to the procedure was not required because it already contains direction for use of Standard Appendix 118.

The NRC staff reviewed the information provided by the licensee regarding the revisions made to the affected procedures. The staff finds the changes are appropriate as they adequately address the changes in the use of portable DGs for the duration of the extended CT and the associated manual operator actions. Therefore, the staff finds this aspect of the proposed LAR to be acceptable.

3.4.8 Training Program Design Section 4.5, Operator Training, in the Enclosure to the APS submittal dated December 30, 2016, the licensee stated that operators are trained on the strategies and hierarchy of procedures for LOOP that specify the use of alternate power sources, including the portable DGs. Further, in Section 4.3.1, the licensee stated that the use of cross-connect is proceduralized in the EOPs and is further described in the Unit 3 Operations Night Order, to emphasize the importance of timely use of this success path, if necessary to prevent core damage.

In its response to APHB RAl-2, the licensee stated that Night Orders are part of the formal shift turnover process and are required to be reviewed by the control room staff, at each shift.

The Night Order process was selected as one of the methods to communicate important background information to on-shift operations personnel regarding the use of compensatory measures (commitments) during the extended CT, while 38 DG is out of service. Each dedicated AO will be required to complete a physical walkdown with the shift manager or designee, prior to assuming the dedicated FLEX DG watch. The walkdown will be performed in the field using operating instructions. Also, at the beginning of each shift, the shift manager will discuss the content of the Night Order and required compensatory actions with the dedicated operators and other operations staff. Each dedicated operator will be required to review the specific guidance document for the assigned compensatory actions, to ensure that no changes have been made and to ensure adequate understanding of actions. Each dedicated AO will performed a walkdown of their assigned equipment, verify equipment configuration, and perform pre-start checks for the portable DGs.

In its response to APHB RAl-3, the licensee stated that as of January 1, 2017, 4 7 A Os have received the initial briefing and focused walkdown with a shift manager or designee, and are proficient to perform the responsibilities of the dedicated portable DG operator position.

Additional operators will become proficient when they complete the briefings and focused walkdowns, as additional operations crews rotate in accordance with the five-week operations crew rotation schedule. The briefings and focused walkdowns performed to ensure AO proficiency with the configuration of portable DG equipment as described in the proposed LAR included the FLEX 1 and 2 DGs, as well as the rental DG (as shown in Figure 4 in the Enclosure to the letter dated December 30, 2016). The licensee further stated that all three DGs have similar controls and hard card instructions, and use an automatic synchronization feature. The actions required to start the diesel engine and close the output breaker on each of the three DGs are the same.

In its response to APHB RAl-4, the licensee stated that, based on the nature of the operator actions needed in the event of a loss of feedwater or loss of all power, the implementation of

'continual focus' (i.e., discussing, reviewing, and walking down important actions every shift) was chosen, in lieu of a one-time training activity, such as a Job Performance Measure (JPM).

The licensee further stated that this was done to provide additional rigor and maintain a heightened state of readiness to promptly initiate the assigned compensatory actions, throughout the 62-day extended CT.

The NRC staff concludes that the training on the use of compensatory measures (commitments), including the implementation of 'continual focus' strategy with shift briefings and

the use of Night Orders, for the duration of the extended CT is appropriate, and that sufficient number of operations staff have received the requisite training. Therefore, the staff finds this aspect of the proposed LAR to be acceptable.

3.4.9 Human Factors Verification and Validation In its response to APHB RAl-1.b, the licensee stated that two simulator sessions were used to evaluate and validate proposed changes to the EOPs. The first simulator session was staffed with shift operations personnel, and the second simulator session was staffed with shift operations and operations training personnel. Based on the results of the simulator sessions, additional enhancements were made to the procedures, to improve recovery time.

Additional operator walkthroughs of procedure 40MT-9ZZ01 were conducted in December 2016, and further enhancements were made to the procedure, based on the walkthrough results. The maximum observed implementation time for the enhanced 40MT-9ZZ01 procedure during operator walkthroughs conducted in December 2016 was 23 minutes.

The NRC staff concludes that the use of simulator runs, operator walkthroughs, and the use of iterative process to implement further enhancements following operator briefings is appropriate.

The staff finds that this process for verification and validation of operator actions is acceptable.

3.4.10 Human Performance Monitoring Strategy The change proposed by the licensee is a one-time, temporary extension of the TS required action 3.8.1.B.4 CT, from 21 days to 62 days. Because 3B DG would not be expected to be operated under normal, non-accident conditions, and during the period of unavailability of 3B DG, the FLEX portable DGs are also not expected to be operated, except for in case of an accident, long-term human performance monitoring strategy is considered to be neither viable nor necessary. The NRC staff finds this position to be acceptable.

3.5 Comparison with Regulatory Guidance As discussed in detail in this SE, the licensee's proposed change is consistent with RG 1.174, RG 1.177, and SRP Sections 19.1 and 16.1. In addition, the licensee's proposed change meets guidance provided in NUREG-1764, NUREG-0700, NUREG-0711, and NUREG-0737.

3.6 Summary of Technical Evaluation The NRC staff finds that the risk impact of the licensee's request for a one-time extension of the CT of TS 3.8.1.B.4 from 21 days to 62 days, as estimated by ICCDP and ICLERP, is consistent with the acceptance guidelines specified in RG 1.177 and the staff guidance outlined in Sections 19.1 and 16.1 of NUREG-0800. The licensee's methodology for assessing the risk impact is accomplished using PRA models of sufficient scope and technical adequacy. For external hazards not explicitly modeled by PRA, the licensee used qualitative or bounding analyses. The NRC staff finds that the licensee has followed the three-tiered approach and performance monitoring programs outlined in RG 1.177.

Based on the statements provided by the licensee that: ( 1) an additional auxiliary operator will be dedicated on each shift to start the portable generators, if required, perform the required electrical system alignments, and monitor the performance of portable generators; (2) the appropriate emergency operating procedures were revised to reflect the use of portable generators in lieu of 3B DG, during the extended CT; (3) sufficient number of operations staff' received adequate training on the use of the revised emergency operating procedures; and (4) the licensee performed sufficient number of operator walk-throughs with revised procedures to verify that the required actions can be accomplished within the allowable time frame, the NRC staff finds the licensee's proposed LAR acceptable.

The NRC staff finds that the proposed TS change will have no or minimal adverse impact on the licensee's compliance with the regulations addressed in Section 3.3.1.

The NRC staff has reviewed the licensee's proposed temporary, one-time change to TS 3.8.1.B.4 to extend the CT for an inoperable 3B EOG from the current 21 days to 62 days.

Based on the above evaluation, the staff concludes that the proposed change satisfies all of the applicable regulatory requirements identified in Section 2.0 and will continue to provide reasonable assurance of adequate protection to public health and safety.

4.0 EMERGENCY CIRCUMSTANCES In its letter dated December 30, 2016, as supplemented by letter dated January 2, 2017, the licensee requests that the amendment be treated as an emergency amendment.

The proposed change is required due to an emergent equipment failure and is necessary to prevent shutdown of PVNGS Unit 3. The change is needed sooner than can be issued under normal or exigent circumstances and this license amendment request is timely considering the unplanned nature of the DG failure.

During a surveillance test on December 15, 2016, the 3B DG experienced a failure and APS will not be able to complete the repair and restore operability within the current 21-day CT. The 21-day CT was approved in Amendment 199 to enable APS to collect and analyze data and continue the repair in order to perform the causal evaluation needed for a subsequent risk-informed license amendment. Disassembly and inspection of the damaged 3B DG has been aggressively and continuously pursued since the December 15, 2016 event.

After the 3B DG failure, APS promptly established a fully staffed Outage Control Center to schedule, manage and oversee the work activities for the repair. Several cross organizational teams were formed and maintenance is being worked on the 3B DG on a 24-hour per day schedule until completed. The causal evaluation needed to support that the failure of the 3B DG was not a common mode failure potential for the 3A DG was completed on December 30, 2016.

APS could not have reasonably anticipated or foreseen the failure of the 3B DG and could not have determined the causal evaluation without the needed disassembly and inspection. APS has made a good faith effort to submit the license amendment request in a timely manner and requests that the amendment be processed under emergency circumstances pursuant to

10 CFR 50.91 (a)(5) to avoid a shutdown in accordance with TS 3.8.1 required action B.4 at the expiration of its CT of 21 days (approved in Amendment 199).

At the expiration of the CT of TS 3.8.1 required action 8.4, a shutdown is required to be in Mode 3 in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to Mode 5 is 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months in accordance with TS 3.8.1, condition H.

The NRC staff reviewed the licensee's explanation and found it acceptable because the condition was due to the recent unexpected failure of Unit 3 EOG 8 while performing the surveillance test, and therefore, the emergency situation could not have been avoided.

5.0 FINAL NO SIGNIFICANT HAZARDS CONSIDERATION

The Commission may issue a license amendment before the expiration of the 60-day period provided that its final determination is that the amendment involves no significant hazards consideration. This amendment is being issued prior to the expiration of the 60-day period.

Therefore, a final finding of no significant hazards consideration follows.

The Commission has made a final determination that the amendment request involves no significant hazards consideration. Under the Commission's regulations in 10 CFR 50.92, this means that operation of the facility in accordance with the proposed amendment does not (1) involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) involve a significant reduction in a margin of safety.

As required by 10 CFR 50.91(a}, in its letter dated December 30, 2016, the licensee has provided its analysis of the issue of no significant hazards consideration, which is presented below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change is a risk-informed extension of the Unit 3 'B' train emergency diesel generator (38 DG) Technical Specification (TS) completion time from 21-days to 62-days. The Palo Verde Nuclear Generating Station (PVNGS) 38 DG provides onsite electrical power to vital systems should offsite electrical power be interrupted. It is not an initiator to any accident previously evaluated. Therefore, this extended period of operation with the '8' train DG out-of-service will not increase the probability of an accident previously evaluated.

The DGs act to mitigate the consequences of design basis accidents that assume a loss of offsite power. For that purpose, redundant DGs are provided to protect against a single-failure and the consequences of a loss of offsite power have already been evaluated. During the current TS 21-day required action completion time for the 38 DG, an operating unit is allowed by the TS to remove one of the DGs from service, thereby losing

this single-failure protection. This operating condition is considered acceptable. The consequences of a design basis accident coincident with a failure of the redundant DG during the proposed extended completion time are the same as those during the existing 21-day TS completion time. Therefore, during the period of the proposed extended required action completion time, there is no significant increase in the consequences of an accident previously evaluated.

Therefore, the proposed change will not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change is a risk-informed extension of the 38 DG TS completion time from 21-days to 62-days. The PVNGS 38 DG provides onsite electrical power to vital systems should offsite electrical power be interrupted. There are no new failure modes or mechanisms created due to plant operation for the extended period to complete repair and to perform testing of the PVNGS 38 DG. Extended operation with an inoperable DG does not involve any modification in the operational limits or physical design of existing plant systems. There are no new accident precursors generated due to the extended required action completion time.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The proposed change is a risk-informed extension of the 38 DG TS completion time from 21-days to 62-days. The PVNGS 38 DG provides onsite electrical power to vital systems should offsite electrical power be interrupted. During the extended completion time, sufficient compensatory measures including supplemental power sources have been established to maintain the defense-in-depth design philosophy to ensure the electrical power system meets its design safety function. The supplemental source has the capacity to bring the unit to cold shutdown in case of a loss of offsite power concurrent with a single failure during plant operation.

Therefore, the proposed change does not involve a significant reduction in a margin of safety as defined in the basis for any TS.

Based on its review of the licensee's no significant hazards consideration analysis quoted above, the NRC staff has determined that the proposed amendment involves no significant hazards consideration.

Accordingly, the Commission has determined that this amendment involves no significant hazards information.

6.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Arizona State official was notified of the proposed issuance of the amendment. The State official had no comments.

7.0 ENVIRONMENTAL CONSIDERATION

The amendment changes a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) the amendment does not (a) involve a significant increase in the probability or consequences of an accident previously evaluated; or (b) create the possibility of a new or different kind of accident from any accident previously evaluated; or (c) involve a significant reduction in a margin of safety; (2) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (3) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (4) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributors: T. Hilsmeier, NRR/DRA/APLA V. Goel, NRR/DE/EEEB R. Wolfgang, NRR/DE/EPNB V. Huckabay, NRR/DRA/APHB Date: January 4, 2017

R. Bement A copy of the related Safety Evaluation is also enclosed. The safety evaluation describes the emergency circumstances under which the amendment was issued and the final no significant hazards determination. A Notice of Issuance addressing the final no significant hazards determination and opportunity for a hearing associated with the emergency circumstances will be included in the Commission's next biweekly Federal Register notice.

Sincerely, IRA!

Siva P. Lingam, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. STN 50-530

Enclosures:

1. Amendment No. 200 to NPF-7 4

2. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION:

PUBLIC RidsNrrDssStsb Resource RWolfgang, NRR LPL4 r/f RidsNrrLAPBlechman Resource VHuckabay, NRR RidsACRS_MailCTR Resource RidsNrrPMPaloVerde Resource MChernoff, NRR RidsNrrDeEeeb Resource RidsRgn4MailCenter Resource PSnyder, NRR RidsNrrDorllpl4 Resource VGoel, NRR MHamm, NRR RidsNrrDraAphb Resource SSom,NRR DWoodyatt, NRR RidsNrrDraApla Resource THilsmeier, NRR RidsNrrDeEpnb Resource RidsNrrDssSrxb Resource CFong, NRR ADAMS A ccess1on No.: ML17004A020

b1y e-ma1*1 **SE d ated OFFICE NRR/DORL/LPL4/PM NRR/DORL/LPL4/LA NRR/DRA/APLA/BC NRR/DE/EEEB/BC NAME Slingam PBlechman (JBurkhardt for) SRosenberg** JZimmerman**

DATE 1/4/17 1/4/17 1/3/17 1/3/17 OFFICE NRR/DE/EPNB/BC NRR/DRA/APHB/BC NRR/DSS/STSB/BC NRR/DSS/SRXB/BC NAME DAiiey* SWeerakkody** AKlein* EOesterle*

DATE 1/4/17 1/3/17 1/3/17 1/4/17 OFFICE OGC- NLO NRR/DORL/LPL4/BC NRR/DORL/LPL4/PM NAME BMizuno RPascarelli Slingam DATE 1/4/17 1/4/17 1/4/17 OFFICIAL AGENCY RECORD

v t e Letter Sequence Approval
CAC:MF9019, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5B (Approved, Closed)
Initiation Request, Request, Request Acceptance... Administration Meeting, Meeting Questions 2 January 2017 Answers 2 January 2017 Results Approval, Approval, Approval, Approval Other:
MONTHYEAR2016-12-30 [Table View]

ML17004A020

Text

SUBJECT:

Dear Mr. Bement:

Enclosures:

Attachment:

1.0 INTRODUCTION

2.0 REGULATORY EVALUATION

3.0 TECHNICAL EVALUATION

5.0 FINAL NO SIGNIFICANT HAZARDS CONSIDERATION

6.0 STATE CONSULTATION

7.0 ENVIRONMENTAL CONSIDERATION

8.0 CONCLUSION

Enclosures:

Navigation menu

Search