ML17311B358

Joint Applications Rept for Low Pressure Safety Injection Sys AOT Extension

ML17311B358
Person / Time
Site:	Arkansas Nuclear
Issue date:	05/31/1995
From:	ABB COMBUSTION ENGINEERING NUCLEAR FUEL (FORMERLY, ASEA BROWN BOVERI, INC.
To:
Shared Package
ML17311B359	List: 2CAN059502, TS Change Request for Amend to License NPF-6,re AOT Extension for Low Pressure Safety Injection Train ML17311B358 ML20083Q950
References
CE-NPSD-995, NUDOCS 9505260267
Download: ML17311B358 (54)

Text

COMBUSTION ENGINEERING OWNERS GROUP CE NPSD-995 Joint Applications Report for Final Report GEOG TASK 836 prepared for the C-E OWNERS GROUP May 1995 o Copyright 1995 Combustion Engineering, Inc. All rights reserved ABB Combustion Engineering Nuclear Operations Lll UDOD EFQODQD

LEGALNOTICE This report was preparei$ as an account of work sponsored

'by the Combustion Engineering Owners Group and ABB Combustion Engiineeriing.

Neither Combust.ion Engineering, Inc. nor any person acting on its behalf:

A.

makes any warranty or representation, express or implied iincluding the warranties of fjitness fair a piarticular purpose or merchantabiliiy, with respect to the accuracy, completeness, or usefulness of the information contained"in this report, or that the use of a:ny information, apparatus, method,:or process, disclosed iin this report may not infringe privately owned'ights; or B.

assumes any liabilities with respect to the'use of, or for damages resulting from the use of, any information; apparatus, method or process disclosed in tlxis report.

0 Combustioia Engineering, Inc.

TABLEOF CONTIWXS Section Page LIST OF TABLES 1.0 PURPOSE 2.0 SCOPE OF PROPOSED CHANGES TO TECHNICALSPECIFICATIONS 1

3.0 4.0

SUMMARY

OF APPLICABLETECHNICALSPECIFICATIONS 4.1 Standard Technical Specifications 4.2 "Customized" Technical Specifications SYSTEM DESCRIP'IKON AND OPERATING EXPERIENCE' 4.

6.0

5.1 System Description

5.2 Operating Experience 5.2.1 Preventive Maintenance 5.2.2 SurveiHance/Testing of LPSI System Valves 5.2.3 Corrective Maintenance 5.2.4 Related Licensing Actions TECHNICALJUSTIFICATIONFOR AOT EPCZENSION 6.1 Statement of Need 6.2 Assessment of Deterministic Factors 6.2.1 Thermal-Hydraulic Considerations 6.2.2 Radiological Release Considerations'0 10 11 11 14

~O 0

Section TABLEOF CONTERIS (cont'd)

Page 6.3 Assessment of Risk 15 6.3.1 6.3.2 6.3.3 6.3.4 6.3.5 6.3.6 Overview Assessment of "AtPower" Risk Assessment of Transition Risk Assessment of Shutdown Risk Assessment of Large Early Release Summary ofRisk Assessment 15 16 24 28 30 31 6.4 Compensatory Measures 32 7.0 8.0 TECHNICALJUSTIFICATIONFOR STI &CTENSION PROPOSED MODIFICATIONSTO NUREG-1432 SUM!~YAND CONCLUSIGNS REFERENCES 33 35 ATTACHMENTA "Mark-up" of NUREG-1432 SECTIONS 3.5.2 8c B 3.5.2 A'-1

0

Table 4.2-1 5.2-1'.2.1'-1 LIST OF TABLES COMPARISON OF LPSI SYSTEM AOTs AMONG CE PWRs WXIHCUSTOMIZED TECHNICALSPECIFICATIONS COMPARISON OF hQQNTENANCE REPAIR TIMES FOR LPSI SYSTEM COMPONENTS COMPARISON OF SECONDARY SIDE HEAT REMOVAL CAPABILITY Page 13 6.3.2-1 6.3.2-2 CEOG AOT CONDITIONALCDF CONTRIBUTIONS FOR LPSI - CM 21 CEOG AOT CONDITIONALCDF CONTRIBUTIONS FOR LPSI - PM 22 6.3.2-3 6.3.3-1 6.3.4-1

~

~

~

CEOG PROPOSED AVERAGE CDFs TRANSITIONRISK CONIRIBUTIONS FOR LPSI SYSTEM CM EFFECTS OF IMPROVED LPSI RELIABILITYAT SHUTDOWN 23 27 29 111

Cl ill

LPSI System AOT Extension 1.0 PURPOSE This report provides the results of an evaluation of the extension of the Allowed Outage Time (AOT) for a single Low Pressure Safety Injection (LPSI) train from its present value (24 or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />), to seven days.

The AOT is contained within current technical specifications for each licensed CE NSSS.

This AOT extension is sought to provide needed flexibility in the performance of both corrective and preventive maintenance during power operation.

Justification ofthis request is based on an integrated review and assessment ofplant operations, deteriniiiisticldesign basis factors and plant risk. Results of this study demonstrate that the proposed AOT extension provides plant operational flexibilitywhile simultaneously reducing overall plant risk.

This request for AOT extension is consistent 'with the objectives and the 'intent of the Maintenance Rule (Reference 1). The Maintenance Rule willbe the vehicle which controls the actual maintenance cycle by defining unavailability performance criteria and assessing maintenance risk. The AOT extension willallow efficient scheduling ofmaintenance within the boundaries established by implementing the Maintenance Rule. The CE plants are in the process of implementing the Maintenance Rule, and are presently setting targets for unavailability of systems and trains.

Therefore, this effort is seen as timely, supportive and integral to the Maintenance Rule program.

2.0 SCOPE OF PROPOSED CHANGES TO TECHNICALSPECIFICATIONS The proposed technical specification change addresses revising the existing AOT requirement for the operation ofthe LowPressure Safety Injection (LPSI) subsystems ofthe Emergency Core Cooling System (ECCS).

Specifically, itis proposed that the AOT for a single INOPERABLE LPSI train be extended from its present value (24 or 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, depending on the plant) to 7 days (168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />).

For the purposes of this report, a LPSI train is defined as one pump, and two injection flowpaths, including motor-operated valves (MOVs) operated by a common ACpower source.

3.0 BACKGROUND

In response to the NRC's initiative to improve planti safe@ while granting relief to utilitiels &oml those requirements tjiiatare m irgiml.to safety the CEOG has'undertaken a program ofobtaidingi relief from overly restrictive technical.yeMcations.

-As part of this program, several'echmcal'pecification AOTs and STIs were iidentified forjoint actionl This report provides support for modifying Technics Specifi'cationh concerning the Emergency Core Cooling System in order to provide an AOT fod up to 7 days for one "INOPERABLE"'PSI train. The intent of this AOT extension is to enhance overall plant safety by'voiding potential unscheduled p'lant shutdowns, and providing for increased flexibility.in schedtdixlg and'erforming mainten;wee and suiveiillz~ce activities.

This effort $s being pursued as a joint CEOG activity.

This report provides generi.c information supporting 'these Chatiges, as well as the necessary phnt specific information to demonstrate the impact of them changes on an individual plant basis.

The supporting/analytical rnaterM contained within the document is considered appliable to all CEOG member utilities regardless of the category bf tiheit Plant Technical Specifications.

4.0

SUMMARY

OF APPLICABLETECHNICALSPECIFICATIONS There are three distinct categories of Technical Specifications at CE NSSS plants.

The first category is called the Standard Technical Specifications.

Through February 1995, NUREG-0212, Revision 03, commonly referred to as "Standard Technical Speci6cations," has provided a model for the general structure and content of the approved technical specifications many of the domestic CE NSSS plants.

The second category corresponds to the Improved Standard Technical Specifications (ISTS) guidance that is provided in NMkEG-1432, Revision 0, dated September 1992.

A licensing amendment submittal to change the Technical Specifications for San Onofre Nuclear Generation Station Units 2 & 3 so as to implement this guidance was submitted to the NRC in December 1993.

Additionally, licensing amendment submittals are being developed'that willmodify the technical specifications for Palisades to implement the ISTS guidance.

The third category includes those technical specifications (TSs) that have structures other than those that are outlined in either NUTMEG-0212 (Reference 2) or NUREG-1432'Reference 3).

These TSs are generally referred to.as "customized" technical specifications and are associated with the early CE PWRs.'he CE NSSS plants that currently have "customized" technical specifications are: Palisades, Maine Yankee, and Ft. Calhoun Station.

Each of these three categories of Technical Specifications includes operating requirements for the Low Pressure Safety Injection (LPSI) subsystems.

4.1 Standard Technical Specifications The requirements for LPSI subsystems during power operations are embedded in the requirements for Emergency Core Cooling trains/subsystems in the standard technical specifications of NUTMEG-0212, Revision 03 and NUREG 1432, Revision 0. In LCO 3.5.2 of NUTMEG-0212, Revision 03, each OPERABLE independent Emergency Core Cooling System subsystem includes one OPERABLE low-pressure safety injection pump.

LCO 3.5.2 of NUTMEG-1432 addresses two redundant, 100% capacity ECCS trains, each consisting of high pressure safety injection (HPSI), low pressure safety injection (LPSI), and charging subsystems.

Hence, any maintenance, repair or surveillance test that would render a LPSI subsystem inoperable would also result in the INOPERABILITY of the corresponding ECCS train/subsystem of the standard technical specifications.

The requirements ofthese same standard technical specifications allow the continuation ofpower operations with one inoperable ECCS train/subsystem for a maximum of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Hence, if a single ECCS train is rendered inoperable due to a set. of factors that includes on-line

maintenance or repair of the components ofa I2'SI subsystem, the O]PKMBIIZI'Yofthat ECCS

,'rain must be restored within 7i. hours (Iincluding the OPERABIXZI'Y of the affected LPSI, subsystem); or the plant must be shutdown and depressurized below the shutoffhei ofthe HPSI pumps.

4.2 "Customized" TechnIicall SpecIifications Customized technica]l specific Cons for the I3?SI Sy,stem differ from the STS in the duration of the specified AOT, the linage between the LPSI and other ECCS AOTs and the details of the subsequent ACTIOhl statements.For plants with Customized bmhnical specifications, Ithe'efined AOTs for U?SI system out of Seance (OOS) are presented in the Table 4.2-1.

Table 4.2-1 COMPAIUS~ON O]F I.3?SI SYSTEM AOTs AMONG CE PWIh WITH CUSTOMIZED TECHlQCAI. S'PECIFICATIONS T'IJMi['t.

Calhoun Station Maine Yankee Palisades AIZ.GrVea OUTAGE TIME (HRS) 2',4 72 2',4 0

5.0 SYSTEM DESCRDPTION AND OPERATING EXP3~~~22CE

5.1 System Description

The LPSI System provides inventory to the RCS following a large Loss of Coolant Accident (LOCA). This inventory injection supplements the RCS inventory, addition due to the SITs and aids in ensuring core cooling during the early stages of a large LOCA. In addition, many components of the LPSI System are shared with the shutdown cooling system. In that capacity, the LPSI pump and selected components serve to circulate water through the RCS and support long term core decay heat removal.

Safety Injection and Recirculation During an accident, the LPSI system is actuated by a Safety Injection Actuation Signal (SIAS).

The SIAS is automatically initiated upon a coincident two-out-of-four Pressurizer Pressure Low Signals or two-out-of-four Containment Pressure High Signals.

Safety-Injection can also be manually initiated. Vpon SIAS, the two LPSI pumps are automatically started and the injection valves are opened.

The LPSI pump then recirculates the Safety Injection water through the minimum recirculation valves until the RCS pressure becomes low enough to aaow flow into the RCS.

During the injection mode, the LPSI pumps take suction from a borated water source.

The pumps discharge flowinto the lowpressure injection header which is connected to the RCS cold legs.

The valve connecting the LPSI pump discharge to the shutdown cooling heat exchangers is locked closed during normal operation and remains closed during the safety injection mode.

Shutdown Cooling System During normal shutdown mode operation (Modes 4, 5 and 6), the components of the.LPSI System are realigned to configure the Shutdown Cooling System (SDCS). In this configuration, the LPSI pump takes suction from the RCS hot leg, transports the hot.RCS liquid through the SDC heat exchanger and discharges cooler water into the RCS cold leg.

For all CE PWRs, the containment spray pump can be used in place of an inoperable LPSI pump for the function of shutdown cooling.

This would depend upon the accident / plant operating mode and would require a manual alignment.

5.2 Operating E~.riencie

$.2.1 Preventive kfaintenance P'llllj In order to perform preventive maintenance during yoeeri operation, the plant must voluntarily enter into a LimitingCcindition fair Operation (LCO)'ction statement.

The NRC has ken awlarel

,of this practice and has issued. an NRC Inspection Manual! (Reference 4), providing the general.

safety principles that the.'NRC inslxxtors, are: to use in assessing the appropriateness of the utilities "on-line" maintenance activities and to ensurie that~ proper use is made of the plant AOTs.

In response to the NRC technical guidance statement, many nuclear utili.ties have voluntarily adopted admijaistrati.ve guidelines for voluntary enhy

.into an LCO iACTION statement.

This adrr6nistrative guid mce gyicallyrequires that a phd must exist for Wmpletlmg the associated maint nance within a period that is considerably shorter. than the duration of the

'llowed outage time (AOT).pacific:in the LCO ACTION statement.

In addition, the risk associated with such mnntenance is also assessed.

'perating experience him demonstrated that many tylpes ofpreventive maintenance on LPSI train components (includhzg post-maintenance verifications and ltests) require a period of'ess than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Typical activities associated with preventive maintenance for a LPSI pump include:

- change of oil

- lubr'ication

- reph~ment/tighteniing ofpacking bearing replacement Preventive maintemxce aciivities (PMs) associated with valves within the LPSI system include:

- -valve overhaul

- valve ayackijzg Typically, pump PMs require less than'24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to complete and valve PMs can generally'be'erformed in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or less.

When performed properly, preventive maintenance on single LPSI System components cm be completed within the 3 day AOT which is amitie to most CE:. NSSS PWJRs.

Howievdr, the AOT extension would allow for moie flexibilityin both grforming and scheduling oil'hk PA.

This willhave a positive influent+ in li,mitingplant risk by:

(2) reducing the number ofentries iintoLCO ACTIONstatements by allowing a. more complete miuntenance program during a single AOT, I

reducing the nevi for simultaneous cdmnhod system PM operations so as to'allow'xpeditious retorn of the, system to on-line status in the event ofa site emergency,

(3) reducing time stress on the maintenance staff during shutdown by allowing adequate time to perform LPSI maintenance at power.

Preventive maintenance on LPSI.subsystems that is postponed until the plant is in shutdown mode can limitthe availability ofoperable standby SDC trains during a plant outage.,

Since the LPSI pump provides the primary motive force for core cooling during shutdown, the risk associated with this unavailability can exceed that associated with performing the equivalent maintenance at power.

This issue is addressed in Section 6.3.

5.2.2 Surveillance/Testing ofLPSI System Valves The technical specifications require'testing of several motor operated valves within the LPSI system.

This testing may be performed either at power or during a plant shutdown.

Surveillance testing of the MOVs at power requires that the MOV operating torque and flow characteristics be within a specified band.

Testing times can vary from under one hour to more than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

Since this test can be performed so as to minimally disable a portion ofthe LPSI System, its actual impact on risk is negligible.

This results from the fact that during most of the duration of the test (with the exception of the several minute stroke test) the valve position can be maintained in its emergency position.

Ifthere were a longer AOT, a larger block of valves could be tested in a defined time frame.

With longer AOTs, this concentration oftesting can be performed in a more orderly fashion and with fewer individual entries into the plant LCO ACTIONstatements.

An extended AOT will also provide sufficient time to correct any problems found as a result of the surveillance.

5."2.3 Corrective Maintenance (CMj Corrective maintenance in the LPSI System involves both pump and valve repair. In practice, the term corrective maintenance is typically used for the repair of a component resulting from an observable malfunction which may or may not compromise the ability of the system or component to perform its safety function.

This terminology typically lumps corrective maintenance on LPSI pumps due to small oiUwater leaks. (which do not necessarily impair pump function) into the same category as more extreme failures such as a debilitating pump motor failures.

Allutilities involved in this task have indicated mean LPSI pump repair times of'under 24'hours with the longer repairs taking up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (See Table 5.2-1). Itis expected that failures that render the LPSI pump non-functional will be skewed to the higher repair times.

Parts accessibility may further stretch the repair.

Since many existing failures will be diagnosed followinga component surveillance, insufficient time may be available in the AOT,to assure task completion, prior to exceeding the AOT.

Another class ofLPSI System components that requires surveill mcI: and periodic repair are the Motor Operated Valves (MOVs).

Surveillance lof thW valves involv'es detailed testing procedures.

During the testing, ihe AOT is entered &d t4e Valve 'ss declared INOPERABLE.

In order for the valve to be, considered OPERABLE, the valve characteristics must 'be measured to be within a specified band of torque, and:flow. ~Ifthese parameters fall outside thb defile~'ands, the MOVis bmhnic Qly considered INOPERABLEand must be repaired in the remainder of the AOT. Failuze to rgeir and re~gnose the valve as OPERABLE would result in the applicability ofother LCO actiion requirements to bring th6 phnt'to a safe shutdown mode within a relatively short pleiad of time or development of a Justification for Contmued Opcmtion (JCO).

Past testing h m nsulted in the:identification of a ma2functioniing MOV wlhich was repaired and declared OPERABLE withm one hour ofthe expiration ofthe 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOV.

ITable 5.2-1 provides the comparison of mskmtenance repair times for LPSI c'omponents.

These examples illustrate tlat there:is ai need for a longer AOT.'.2.4 Related Licensizzg Actions Over the past two yam the industry h;m been applying results from PRA sensitivity Studies as a basis for eliminating requirements that are marginal to safety.

Elimination of xnyurements marginal to safety includes,, among many other things, ke kehxatiori ofTechnical Specifications (TS). Recently South Texas Project (STP) proposed 22 'technical Specification changes to the NRC for relaxation (Re,ference 5).

The TS changes requested by STP were of two +es:

extendijng allowed outage time (AOT) and extending Surv6lhmee Test, Intervals (STI).

Of the 22 proposed TS changes, 6 were withdrawn by STP.

Of the remaining 16 proposed

changes, qreniitaiive evaluations were performed by STP in support of 1.1 ofthem using the plant PSA model. Qualitative explanations're presented by S'IP for the remaimj~g 5 to support the proposed extensions.

The ECCS, including LPSI, HPSI and SIT, was among the systems for which TS relaxation was sought.

The AOT for the ECCS was requested to be extended from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to I days;.the NRC'ranted the extension to 7 days.

Table 5.2-1 COMPARISON OF MABVIKNANCEREPAIR TREF) FOR LPSI SYSTEM COMPONENTS Ft. Calhoun Station Maine Yankee Palisades Calvert Cliffs 1 &2 Millstone 2 St. Lucie 1 & 2 ANO-2 Waterford 3 San Onofre 2 & 3 Palo Verde 1, 2 & 3 Generic MEANTIMETO REPAIR (HR) 13 hrs 16.8 hrs 11.8 hrs 4.7 hrs 10.69 hrs 17.6 hrs 3.6 hrs 11.1 hrs RANGE OF 'REPAIR TIMES 1hr-23 hrs 1.5 hrs - 32 hrs 3-27hrs not available

( 1hr-72hrs 16.0 - 20.8 hrs 1.6 - 46.5 hrs

• Plant specific data is not available.

Repair experience is expected to be similar to that ofother CE PWRs.

6.0 TECHNICALJIUSTIFICATIONFOR AOT EXTENSION This section presents an integrabxl asmmsrnent of the proposed AOT extensiionThe focus of the assessment includes motivation and need for technical specification change, the imy'act'of the'hange on the plant design basis event ancl a probabiTistic risk assessment.

0 Section 6.1 presents a summary statement of the net for'th6 AGT'xtension.

The supporting information for this section has been previously prmentecl in Section 5.

Section 6.2 provides an assessment of deterirunistic factors, particularly those associated with the plant design baOs.

The following secticms generally follow the NRC guidance set forth in Reference 6 for risk~

based justification of: changes to the technical specifications.

The yrobabilistic risk assessment for this AOT extension is containecl in Section 6.3, iriclifdiitgcunsideratioini of'isks of mode transition and plant shutdown Compensatory actions tjmt inay be applicable to this AGT'extension are summai zed in Section 6.4.

6.1 Statement of Neecl The primary role of LPSI trains duiing power operation is to contiibute to the mitigktioh of a'arge LOCA. Its value:in the post-LOCA core cooling process is established by a conservative set ofrules set forth in 10,CFR 50.46.

The frequency bf the barf;e LOCA event is on the~ order~

of 10 per year.

In contrast, during shutdo~m, the operability of at est one 12'SI pump and subtrain are required at 81 tiimes f'or RC'S heat removaL Thus, in this macroscopic

'view,'erforming preventive and corrective maintenance "at yower on LPSI trains contributel to an overall enhancement in plant safety 'by increasing the availability of LPSI pumps for shutdown cooling during Modes 3 through 6.

Much of the maintemnc~ performed on a LPSI subtrai6 ~itires the subtrain to be tagged out for periods of less Qen one day.

However,.in some instances, corrective maintenance of the LPSI pump and valves and tesiing of valve. may require taking one subtrain of the I2'Sl System out of service for more than several days.

Recent eIpeden'ce has resulted in a MGV repair completed within one hour of the, existing AOT. Thus, repair within the existing AGT cannot be guaranteed and may result in-an unscheduled plant shutdown, or request for a h:mporary exemption to allow continued plant operation.

To avoid these outcomes, a less restrictive AGT is required.

From a practical viewpoint, a 7-day AOT would allow the m;untenance st;W Qexibilityto more safely schedule maintenance and prceeiuria.

3ased on a review of the maintenance requirements on the LPSI System for CE PXVRs it was determined that a 7-day AOT would provide sufficient margin to effect most anticipated yrevendve, and corrective maintenarice activities and "on-line" LPSI System valve surveillance tests.

10 i~

62 Assessment ofDeterministic Factors

~

~

6.2.I'7sennal-Hydmulic Considemtions LOCd.

In the early 1970's, the NRC defined deterministic acceptance criteria (10CFR50.46) and prescriptive guidance (Appendix K to 10CFR50) for evaluating the performance of the Emergency Core Cooling System (ECCS) following a loss of coolant accident (LOCA).

r The Emergency Core Cooling System (ECCS) acceptance criteria.from 10 CFR 50.46 are the following:

ao Maximum fuel element cladding temperature is < 2200 Degrees Fahrenheit; b.

Maximum cladding oxidation is ( 0. 17 times the total cladding thickness before oxidation; C.

d.

Maximum hydrogen generation from a zirconium water reaction is ( 0.01 times the hypothetical amount that would be generated ifall ofthe metal in the cladding cylinders surrounding the fuel, excluding. the cladding surrounding the plenum volume, were to react; and The core, is maintained in a eoolable geometry.

In order to meet these acceptance criteria, the dmgns of CE NSSS Emergency Core Cooling Systems have included the following elements:

1)

Ahigh pressure safety injection capability forproviding delivery of.coolant to the RCS during the early phase of the blowdown process, and matching boil-offto maintain inventory during the later phases following reflooding of the core; 2)

A,passive safety injection capability provided via Safety Injection Tanks (SITs) providing a one time, rapid inventory injection, into the RCS as the RCS depressurizes below a low pressure setpoint; and 3)

A low pressure coolant injection capability for providing high mass Qow to the RCS at low RCS pressures.

These design elements and the corresponding system operability requirements in the Technical Specifications have been based on a limiting design. basis accident scenario.

This limiting scenario has been a large break LOCA in combination with a loss of offsite.power and the "worst" single equipment failure.

11

To cope with the large loss ofRCS inventory during'a large LOCA an Emergency Core Cooling System consisting of a triad of water injection systems was devisei.

For CE PWRs, the I

components ofthe ECCS gyicallyincluded 4 passively actual SITs, two HPSI pumps and two LPSI pumps. The SITs were deigned with the task of xapidly providing liquid inventory to reflood a voided core. The role ofthe HPSI pumps was primarily to supply inventory for sgallter LOCAs and provide long terra inventory control fear the large break LOCAs.

The results of analysis using prescriptive

methods, defined in Aippendix K to 10CFR50, showed that the anticipated performance of HPSI and SITs 1!id not result in meeting the ECCS perforinance criteria.

These analyses indimtcxi, a short lived need for an additional high volumetric flow pump. A major function ofthis pump was to replenish inventory conservatively predic,ted to be

,lost within the Appendix K framework.

Recent best estimate an;Qyms for a typ.ical. PWR, Reference 7, confirmed that for large

'break'OCAs, incipient core melt can be prevenbR by operation ofcombinations ofECCS su'bsystems other than those that are cmmntly defined in EN CS Operability requirements.

In particular, the, results of Reference 7 demons~ted that the operati'on 'of 'a single LPSI pump or the operation of one High Pressure Safety Injection (IHPSI) pump and a single SIT could maintaiin the Appendix K criteria during a redesign base large LOCA WnaHo,'dditionally, new determiiiistic analysis of large break I.OCA initiating events (up to break areas of 5 square feet) were performed for one plant in support of the Individiial Plant Exaniination (IPE)/Brobabilistiic Safety Analyst (PSA), Reference 8. These arialyses, performed using the CENTS cade, showed that L'PSI triins Wre ndt nleeded 'to successMly mitigate the consequences of such scemirios.

Steam Generator Tid~e Rupture (SGTR) Events Another role for the LPSI is in defining the end! state fod a design basis SGTR event with or without a concurrent lo. s of off-.z~te power.

En the delight bus construction of this eve~t, the HPSI functions to maintain the core covered at. all times and the LPSI is required to effect shutdown cooling (SDC) and thereby terminate the 6ve!nt.

SDC is initiatei after the break has

'een isolated and the, radioactive relmsiw have been controlled.

In the event that one LPSI i.s out of service and the second LPSI fails, the operator mn continue to control the event by steaining of the unaffected steam'enerator.

This cooling mechanism can be maintained indefinitelyprovided condensate is available to the unaffected generator.

Without considering condensate storage tank refill, CE plalnts halve sufficient inventory to steam the affected steam generator for between six to more than 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />. Allplants have provisions in procedures for continued makeup to the condensa>

tank to prevent the depletion of the CST inventory.

Many of the plants on multiple umt sites also have 1~he ablility to cross-connect'ondensate tanks for th.e various units.

A summary of estimate ti,mes for CST inventory depletion following a SGTiR without SDC is provided in Table 6.2.1-1.

CE PWPa also have the ability to realign the containment spray pumps to provide RCS shutdown cooling capability.

12

Table 6.2.1-1 COMPARISON OF SECONDARY SIDE HEAT REMOVALCAPABILITY PLANT Ft. Calhoun Station Palisades Maine Yankee Calvert Cliffs 1 dt 2 St. Lucie 1 St. Lucie 2 Millstone 2 ANO-2 Waterford 3 Palo Verde 1, 2 8t 3 San Onofre 2 dt, 3 THERMAL POWER RATING 1500 MWt 2530 MWt 2700 MWt 2700 Mwt 2700 Mwt 2700 Mwt 2700 Mwt 2815 Mwt 3410 Mwt 3800 Mwt 3410 Mwt CONDENSATE STORAGB CAPACITY 350,000 gal (maximum useable) 100,000 gal (T.S. minimum) 159,975 gal (maximum useable) 150,000 gal per unit (T.S.

minimum) - 300,000 gal shared 116,000 gal (T.S. minimum) 307,000 gal (I',S. minimum) 150,000 gal (T.S. minimum) 160,000 gal (T.S. minimum) 400,000 (maximum) - EFW Q suction source is Service Water and this source is infinite 170,000 gal (T.S. minimum) 300,000 gal (T.S. minimum) 424,000 gal (T.S. minimum)

CONDENSATB STORAGE DBPLBTIONTMB 45 hrs. w/o credit for refillof BFWST or CST 8 hrs 5+ hrs 525 gpm BFW flow

> or equal to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> approx. 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />

> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 10 hrs at 300 gpm 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 485 gpm (for T.S.

minimum)

> 30 hrs (for maximum volume) 9 hrs w/o backup water sources

> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> PROCEDURES TO'EPLENISH CONDBNSATB STORAGB yes (to refill CST or BFWST) yes (to refillDWST) yes yes yes yes yes yes yes CSTs OF MULTIPLB UNIT SITES CAN BB CROSS-CONNECTED N/A N/A N/A yes yes available but not required no yes N/A 13

6'.2.2 Radiologica/ R.'elease Considenrdons LOCA The design basis calculation of radiolo1pc;d. consequences, of, the large LOCA are basedi on a i

combination of very cainservative assumptions.

The design basis for radiological releases following a LOCA is set forth in 10 CFR 1(6, "Reactor Site Criteria", and detaBed in SRP 15.6.5, Reference 9.

Ea practice the 1.0 LFR 100 racliattion release criteria are achieved M reliance on the 1962 "source term" outlined m the Atomic Energy ConUnission 'I'echnical

'nformation Document, TID-14844"Calculation of iDistance Factors for Power and Test Reactors" (Reference 10). This "Sour+: Term" was not consistent with the low level of core damage expected with a Large LOCA. instead, the Source Term was vny conservatively based on a substantial meltdown of the core, and the fission product release to the containment.

Over the past 30 ye irs, substantial inforniation has been developed updating our knowledge about fission product reieue and transport during P%R severe acci'dents; This information~ is

~

reflected in the new NRC source term defined in NORM-1465,(Reference 11).

Assimilation of this information suggests that even when the dichOtolny'of a core melt driven source term is

retained, the TID-14844 estimate of the Large LOCA. fission product releases considerably

'verpredicts the severity of the fission product release to the public.

This conclusion is based on the following:

1)

Existing licensing methods Liume 5ssi'on products are re'leased to the containment immediately upon the onset of the LOCA.

In fact, only gases residing withinthe fuel gap (approximately 5',% ofthe total volatile fission product inventory) will'be relmsni at the point of clad rupture (early in the transient).

The remainder of the fission products willenter the containment over the period of one hailf hour or more.

2)

Existing licenshig methods assume the co@position'of the iodine entering the i

containment iis predominantly element. (itis now believed to be in the particulate form). Sprays are les.s effective in. re.moving elemental iodiine than iodine in the

'articulate form. Itis our current understanding that the iodine is predominantly (greater tihan 95%) released into the'contaiininent in the form of CsI which is

~

particulate.

Thus, spray effectiveness and 'gravitational settling would be

'nhanced and airborne releases from containment would decrease.

Thus, even ifa Large LOCA were to cecur in the presence of a compromised ECCS'i.'e. no

'PSI),

core melting would not be expected and the actual fission product releases would remain within the existing 10 CFR 100 criteria.

Tliis issue is further considered in a probabilistic framework in Section 6.3.5; 14

Steam Generator Tube Ruptures (SGTRs)

Following a SGTR, the plant can be mamtained in a stable condition provided the affected steam generator is isolated, and the APW system along with a supply of condensate is available to the intact steam generator.

Under these conditions, core uncovery is not expected and radiological releases willnot exceed that defined by the existing design basis.

Obviously this can be done without the LPSI System being available.

6.3 Assessment ofRisk 6'.3.I Overview The purpose of this section is to provide an integrated assessment of the overall plant xisk associated with the adoption ofthe proposed AOT extension.

The methodology used to evaluate the LPSI System AOT extension was based in part on a draft version of the "Handbook of Methods for Risk-Based Analyses ofTechnical Specifications", Reference 6 and related industry guidance.

As guidance for the acceptability ofa Technical Specification modification, Reference 6 noted that any proposed Technical Specification change (and,the ultimate change package) should either:

(1) be risk neutral, OR (2) result in a decrease in plant risk (via "risk trade-off considerations"),

OR (3) result in a negligible (to small) increase in plant risk.

(4) be needed by the utility to more efficiently and / or more safely manage plant operations.

A statement of need has been provided in Section 6.1.

This section addresses the risk aspects of the proposed AOT extension.

In this evaluation, a risk assessment of the LPSI System AOT extension is performed with respect to consideration of associated "at power", "transition" and "shutdown" risks.

Section 6.3.2 provides an assessment of the increased risk associated with continued operation with a single LPSI train out of service (OOS). The evaluation of the "at power" risk increment resulting from the extended LPSI System AOT were evaluated on a plant specific basis using the most current individual plant's ProbabiTistic Safety Analysis (PSA) as their respective baselines.

Plant specific evaluations were performed by each participating utility. Results of these evaluations were then compared using appropriate risk measures as prescribed in Reference

'5

Section 6.3.3 piovides an assessment ofzisk oftransitioning the plant from Mode 1 into a lower'ode (e.g. Mode 4).

The "at power" Mk asse.sment presented in Section 6.3.2 provides an evaluation, of continued oi ection of the plant with an <mtended LPSI System AOT for the purpose ofperforming cuzm1ive mainten ace on the I1M? Sgsb',m, However, that assessment provides only one AMofthe plant risk. For this evaluation, continuation ofat power operation'ithin the LCO ACTI~ON statement is compared with the zisk of proceeding with a plant shutdown.

A conseprative lower bound estimate of this risk was evaluated by modifying the'eactor trip core melt scenazio for a representative CH PWR.

Ba: ed on. this analysis, a core damage probability for the plant shutdown was established and compared to the single AOTrisk associated with,co'ntinu~xi operation.

The zisk comparison of LYSI System PM for "at power" and "at shutdown" conditions is provided in Section 6.3.4. Recent experience has shown that the risk ofmamtaining the rector'n a shutdown condition c ui be sigrufimnt in compiaziKn wi'th that of power operation.

This'observation has resulted in a need to reassess m&6~6'zactice to more appdopHatHy apportion maintenance between power and shutdown operatio~.

One goal ofthis particular AOT extension is to,-allow preventive mainbmnce and extended surveillances of'he LPSK System'hile the plant is at power.

Thiis is a logical. request in that man/ LPSI System components support the shutdown cceling system (which, in the lower modes, is the primly means of heat'emoval from the RCS).

The: role of the LPSI System at power is limited to responding to a large break LOCA or providing an alternate decay hMt ri'.meal path (in conjunction with the'uxiliary feedwater system).

For completeness, the impact of the extended AOT*on the plant large early release fiction is qualitatively assessed,.

The as!essment includes an evaluation ofthe events leading to large early fission product releases,.and the role of the LPSI System in the initiation and/or mitigation of

.those events.

This assessment is prmejited in Section 6.3.5.

6'.3.2 Assessment of "At Pox er'" 2bsk Methodology This section provides an assessment of'he increased zisk associated-with continued opezation'ith a single LPSI train out of service (OOS). The evaluation of the "at power" risk increment resulting from the extended LI?SI System AOT was evaluated on a plant specific basis using the most current individual phuit's ProbabiTistic Safety Analysis. (PSA) model for their respective baselines.

Plant specific evaluati'.ons were perform(xi by,each participating utility. Results of these evaluations were then compared using the followingrisk measures (from Reference 6):

Avenge Core Damage, R~egnen;cy (CD+r The average CDF represents the &equency

'f core-damage occurring.

In a, P.lA, the CDF is'obtained using mean unavaiiabilities

'or all standby-system components.

16

Core Damage Probabi7ity (CDP): The CDP represents the probability of core-da?nage occumng.

Cormlamage probability is approximated by multiplying core-damage frequency by a time period.

CondMonal Core-Damage Erequency (CCDQ:

The Conditional CDF is the Core Damage Frequency (CDF) conditional upon. some

event, such as the outage of equipment.

It is calculated by re-quantifying the cutsets after adjusting the unavailabilities of those basic events associated with the inoperable equipment.

Tncrease in Core Damage Frequency (hCDE):

The increase in CDF represents the difference between the CCDF evaluated for one train ofequipment y~nm~il? I~1 minus the CCDF evaluated for one train of equipment n t ou f r r maintenance

. For the LPSI System:

hCDE = Conditional CD'

~~~>

-. Conditional CDFe rzsr~ sotoatfor Ti?4 where CDF = Core Damage Frequency (per year)

Single AOTRisk Contribution: The Single AOT Risk contribution is the increment in risk associated with a train being unavailable over a period of time (evaluated over either the fullAOT, or over the actual maintenance duration).

In. terms of core damage, the Single AOT Risk Contribution is the increase in probability of core-damage occurring during the AOT, or outage time, given a train is unavailable from when the train is not out for test or maintenance.

The value is obtained by multiplying the increase in the CDF by the AOT or outage time.

Single AOT Risk = hCDF x ~

where, rLCDF = Increase in Core Damage Frequency (per year), and

~ = fullAOT or actual maintenance duration. (years)

Yearly AOT Risk Contnbution:

The Yearly'AOT risk.contribution is the increase in average yearly risk.from a train being unavailable accounting for the average yearly frequency ofthe AOT. Itis the frequency of core-damage occurring per year due to the average number of entries into the LCO Action Statement per year.

The value is estimated as the product of the Single AOT Risk Contribution and the average yearly frequency (f) of entering the associated LCO Action Statement.

Therefore:

Yearly AOT Risk = Single AOT Risk x f where f = frequency (events/year) 17

Incremental changes in these parameters are assessed to establish the risk impact ofthe Technical Specification change.

Calculation ofConditional CZ)F, Single ted;Fearly A0T.Risk Contributions Hach-CEOG utility used its nurent Probabijiistic Safety Analysis (PSA) model to assess

the, Conditional CDF ba~xxi on the: conditio'n'hat one LPSI,train is unavailable.

Each plant verified that the appropriate basic events are contamed in the PSA cutsets used to determine ltd ADT risk contributions.

This verificatiion was performed as the first task iin calculating the Conditional CDFs. Ifbasic events had been filtered outl of the PSA cutsets, one of the two methods described below were used to ensure the calculation of Conditional CDF was correct or conservative:

1.

Select the basic event for the failure mode of the component with the highest failure probability to represent the train ifthe test/aiainteamn: failure mode of the component had been filtered out; jor-2.

Retrieve cutsets containing xelevant basic events at the sequence level and merge, them with the final PSA cutsets.

The Conditional CDF given 1 LPSI train.is ~n~v4hlz jwac obtained by performing the following steps:

Set the basic event probability for the failure mode for the selected component in the unaviulalble LPSI train equ 8 to 1I.O.

Cl 2.

Set.any basic event probabilities for other failure modes for that train equal to 0.0.

3.

Set the basic event probability for'he other I2'SI train unavailable due to test/maintenance equal to 0.0.

4.

For the case where the LCO Action Stateinent was prompted by need for Corrective. Maintenance (CM) (i.e., eqiiipinent faihire), adjust the basic event common cause faiilure iuiavaijability corresponding to the train remaining in service to the probability of failure given one traiin has failed (i.e., equal to'the beta factor,. p, for the Multiple Greek L'etter Method).

5.

For Preventive Maintenance (PM) (i.e., no equipment failure), set the failure rate of the ~un reniauiing iiji service, to the total Mg,le.'train failure rate (lincludiing both independent and common cause failute data).

6.

Requantify-the PSA cutsets.

18

This Conditional CDF was therefore assessed for both CM and PM. The difference'between the two values is a result of the aforementioned difference in treating common cause failure.

It should be noted that the definition of CM for use in the PSA is considerable more stringent than the pragmatic TAGGED INOPERABLE definition of CM used in Section 5.

In this context, CMrefers to maintenance performed on a component that cannot otherwise perform its safety function.

The Conditional CDF given 1 LPSI train is r

r m 'n n

was obtained by setting the basic event probability for the failure mode for one LPSI train equal to 0.0 and requantifying the PSA cutsets. No adjustment was made to common cause failure from the value used in the baseline PSA modeL This Conditional CDF was effectively equal to the baseline CDF (i.e., the CDF resulting from the plant's current PSA model) for the LPSI System for all CE plants.

It was expected that the results would be symmetric for selecting either LPSI train to be out for maintenance.

However, in cases where different modeling assumptions or data were associated with each LPSI train, the Conditional CDFs were evaluated 'for each train, and the most conservative result was used.

The Conditional CDF was then used to calculate the increase in CDF. The Single AOT Risk Contribution for each plant was calculated for the following cases:

- Current fullAOT,

- Proposed fullAOT,

- Mean downtime for CM, and

- Mean downtime for PM.

A value of 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />s/event was assumed as an upper bound for the mean duration for a LPSI train CM (see Table 5.2-1). Avalue of 112 hour0.0013 days <br />0.0311 hours <br />1.851852e-4 weeks <br />4.2616e-5 months <br />s/event (2/3 ofAOT) was assumed as an upper bound for the mean duration for a LPSI train PM unless actual plant data was available.

The mean downtimes are presented in Table 6.3.2-1 and 6.3.2-2 for each plant.

The Single AOT Risk Contributions were then used to calculate the Yearly AOT Risk Contributions (Single AOT Risk x frequency), based on each plant's actual frequency of entry into the LCO Action Statement, for both CM and PM. Plant specific frequencies were used in this calculation for CM and PM. When detailed CM and PM breakdowns were not available, a split of the frequency was assumed to be 10%/90% for CM/PM, respectively.

This split is based on actual data from a representative CE PWR which shows that about 10% of the total entries into the LPSI System LCO ACTIONstatement were due to equipment failure, the other 90% were preventive.

The overall Yearly AOT Risk Contribution is assumed to be the sum of the Yearly AOT Risk Contribution due to CM and the Yearly AOTRisk.Contribution due to PM. Tables 6.3.2-1 and 19

6.3.2-2 provide the Conditiorel CDFs and the Single and Yearly AGT Risk Contributions for each plant for CM and PM, respectively.

Calculation ofAverage CZ)F In order to calculate the Average CDF for the extended LPSI System AGT, a new tvalhe forl LPSI train unavailability due to hmt/maintenance wals &ta&lished'. This unavailability was based on a maintenance duration of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for performing on-Hne corrective maintenance (conservatively estirnabxi based on actual plant data for CE P%Rs from T'able 5.2-1), and a preventive maintenance program equal to the equivalent ofa fullproposed AGTof7 days (one-half the AOT twice a yern). For plants with a maintenance schedule already in place or defined,,

then actual plant data was umi in liieu of the above assumptiion's.

The impact on the PSA model was tlien calculated to obtain the Average CDF for this new LPSI System unavailability. Thjis new Average CDF was then compared. to the,'base case value from the plant's PSA model. Table 6.3.2-3 pirovides the proposed Average CDF and the base average CDF for each plant.

The results from each pilant were ammilated, and the Single AGT and Yearly AOT Risks were calculated for each plant.

Tables 63.2-1 through 6.3)2-3 p&ent the results. of these cases, on, a plant specific basis, and summarizes the LPSI System AGT CDF contributions for each plant.

These risk contributions include the Conditional CDFs, Increase in CDFSingle AGT and Yearly AGT risks for both CM and. PM, based on ifuH AGT~ and mean downtime, and current'verage CDF and pirogemi Average CDF.

The Single AGT Risk.,Contri'bution for the f'ull prbpolsed AOT for all CE P%Rs varies from negligible to 2.40E-Q6 for CM condition,s and is has' maximum value of 2.1E-07 for PM.

Maximum increases of thi:s le,vel are small.

As willbe sho~ in the following sections,, these risks are offset by reductions in transition and shutdown irisks.

Changes in the Average CDF due to increasing the LPSI AGT are insignifi.cant (< 3%).

20

Table 6.3.2-1 CEOG AOT CONDITIONALCDF CONTRIBUTIONS FOR LPSI SYSTEM - Corrective Maintenance PARAMETER ANO-2 Calvcxt Cliffs 1 dc2 Foxt Calhoun

. Maino Yankee Millstono 2

Palo San Vexde Onofm 1,2, dc3 28c,3 St. Lucio 1

St. Lucio 2

Watcxfoxd 3

LPSI System Success Criteria Cuxxent AOT, days Pmposcd AOT, days 1 of2 1 of2 1 of2 1 of2*

1 of2 1 of2 1 of2 1 of2 1 of2 1 of2 1 of2 Conditional CDF, pcr yr (1 LPSI train unavailable)

Conditional CDF, per yr (1 LPSI tmin not out for T/M) 4.80845 2.21844 1.18E-OS 3.28845 2.11E44 1.18E45 1.52844 7AOE45 1.59844 5.15E45 7.00845 3.41E45 5.15E45 4.74E45 1.08E44 9.0845 9.1E45 2.74E45 2.14845 2.35E45 3.70845 1.54845 Incxeaso in CDF, pcr yr Single AOT Risk (Current fullAOT) i:.siiiglk':,:AoT-,.;Rxxsk':,(Pxo~';f~BlA'OT)".x:

Downtime Fxcquency, events/yr/txain 1.52E45 1.00E45 negligiblo 1.25847 8.22E48 ncgligiblo

~jQ'92847gj P<':3'>92E4$

'Llncgh'gal'i}"'i 0.33 0.92 0.33 7.80845 6.41847

"-"'.-'1!SOS'46.~<

0.32 0.33 0.33 1,25844 negligible 2.26845 6.84E47 negligiblo 1.86847 0.06 0.5 0.5 8.06845 6.9E45 6.8E45 6.62E47 5.7E47 5.6E47

.:::4.55846.:,

'j';.'";.l9846'..", '~,."':k"3845;h 2.16E45 1.78E47

~<-,4';148~@

0.33 Yearly AOT Risk (Cuxxent fullAtyi),

pcr yf Yearly AOT Risk (Pmposed full AOT), per yr Mean Duration, hxs/event<<<<

Single AOT Risk (for Mean Duxation)

Yearly AOT Risk (for Mean Duration), pcr yr 8,25E48 1.51847 negligible 1.93E47 3.53E47 negligible 4.17848 2.74E48 negligible 2.75848 5.04848 negligible 2.56E48 5.98848 2.14847 8.55849 4.3 8E47 ncgligiblo 1.23E47 1.53E46 ncgligiblo 2.86847 3.42E47 ncgligiblo 6.19E48 2.19E47 ncgligiblo 4.09E48 7.29E48 5,7E47 5.6E47 1.70847 1.3846 1.3846 2.21E47, 1.9E47 1.9E47 2.43E48 1.9E47 1.9E47 1.17E47 2.73E47 28 6,90E48 4.56848

• In addition to 2 LPSI trains, Maine Yankee uses a awing pump which is not modeled in tho PSA

<<<<24 hours is assumed to bo a bounding value basod on historic data (seo Tablo 5.2-1) 21

Table 6.3.2-2 CEOG AOT CONDITIONALCDF CONTRIBUTIONS FOR LPSI SYSTEM - Preventive Maintenance PARAMETER ANO-2 Calvert Cliffs

-. I dc2 Maine Yankco Millstono Palisades 2

Palo San Verde Onofre 1,2, dt3 2Ec3 St. Lucia I

St. Lucia 2

Watexfold 3

LPSI System Success Criteria Current AOI', days I of2 I of2 I of2 I of2*

3 I

3 I of2 I of2 I of2 I of2 I of2 I of2 I of2 Proposed AOT, days 7

Conditional CDFr per yr (I LPSI train unavailable) 3.70E45 2.18E44 1.18E45 7.94E45 4,35E45

$ 1$E45 4,80P45 3r3 IE45 3 2E45 3 7PJK 1 KIPJlC Conditional CDF, per yr (I LPSI bain not out forT/M) 3.28E45 2.11E44 1.18E4$

7AQE45 3.41E4$

5.15E4$

4.74E45 2.74E45 2.14E45 2,35E45 Increaso in CDF, per yr Slnoln hOT Rlslr r&irrrntfiillAOTI 4.20E46 3 45P48 7.00E46 ncgligiblo 5.40E46 5 75E48 rv otlrojhlrr 4 44E48 9.40E46 C tCP~

v Jvrvv negligible aar tlo:ht

~rverlelvrv A o1'c no r rvl v7 A KQP ho irvvrJ vv op no o

LB'.00E47 5.70E46 I.IE4$

8.5E46 c rrc'c nn IM~

4sutglo,"/ttJJ iltisK';{tIOpOscd:;.full<AIJL );;:

Downtime Fluency, cvcnts/yr/tmin 1.50

"'I,jj3rtP+/'; 'j>>ncgliglula',

"."lr'lREr0/,.i 4.00 1.50 0.67 v&n ver r4

,"I'18upApo.;

2.88 o<~n<i~Mgp'.>>>'"

~ncgligibfa"";

1.50

+>:r>'>>r>>rv>>r.r

,"."I;15g48;;:.

1.50

~;lr09847.:,,".,

0.52 r'.",2'I847.

i;-::I'.6E4r74l g%l",34E48.<g 1.50 Yearly AOT Risk (Current fullAOT),

pef yr Yearly AOI'isk(Proposed full AOTJ, per yr 1.04E47 4.60E47 negligible 5.95E48 2.42E47 1.07E46 negligiblo 1.39E47 2.97E47 negligiblo 1.04E46 ncgligiblo 1.48E48 4.83E48 3.6E47 3.45E48 I;13E47 8.4E47 2.8E47 6.5E47 1.73E48 Proposed Downtimo, tus/yr/tmin Mean Dumtion, hrs/event**

Sinoli hOT Rrlsk (for MrrulDrrrsiilonr 168 112 5 37F48 336 168 168 84 112 112 6 71F48 ncoligihle 6 9Q'P48

168, 112 1 2QE47 168 112

~uotlo:hto

~ ev+lvlv 168 112' rr7C~

~ v r ~ VI

'168 112 7 rte& rm r harv vv 112

~ Alt lr7 r nri vl 112

~ tn M r lrivl 115 n intr nn Prl7WV7 zcarly &VIKisk (Ior Mean Dumtion), per yr 1.6iE47 537E47 negligibio 9.25E48 ncgligiblo 2.30E48 7.5IE48 5.6E47 4.3E47 2.76E48

> In addition to 2 LPSI trains, Maine Yankco uses a swing pump which is not modeled in the PSA e* A mean duration of 112 hrs/event was conservatively assumed (2/3'of proposed AOI) unless actual plant data availablo

Table 6.3.2-3 CEOG PROPOSED AVERAGE CDFS PARAMETER ANO-2 Calvert Fort ClilTs Calhoun 1&2 Maino Yanho Millstono 2

Palo Verde 1,2,&3 San Onofro 2&3 St. Lucio 1

St. Lucio 2

LPSI System Success Criteria Present AOT, days Proposed AOI', days Proposed Downtime, hrs/yr/train 1 of2 1 of2 I of2 I of2+

1 3

7 7

192 192 1 of2 1 of2 2

1 7

7 192 192 1 of2 1 of2 3

3 7

7 192 192 1 of2 276 1 of2 1 of2 3

3 7

7 276 200 Average CDF (bee), pcr yr Proposed Average CDF, per yr 3.28E45 2.11E44 1.18845 7AOE45 3.29E45 2.11E44 1.18E45 7.40845 3.41E45 5.15845 4.74E45 2.74E45 3.45E45

5. 15E45 4.74E45 2.78845

2. 14E45 2.35845 1.54845 2.2845 2.4845 1.55845

• In addition to 2 LPSI tnuns, Maino Yankee uses a swing pump which is not modclcd in tho PSA 23

6.3.3 Assessment of1hursihbn Risk For any given AOT exten!non, there is theoretically an. "at power" increase in risk associated with it. This increase may be negligible or'significant. A complete appzoach to assessing the change in risk accounts for the effects of avoided shutdown, or "transition risk". position Risk represents the risk associated with reducing power and going to hot or cold shutdown following equipment failure, in this case, one LPSI train being inoperable.

Transition zisk is'f interest in understanchng the tradeoff between shutting down the plant and restoring thd. LPSI train to operability while the plant continues opezation.

The risk of transitioning from "at power" to a shutdown mode must be balanced against the risk of continued operation Md performing corrective mau>ter!ance while 1he plant is at paw1:r.

To illustrate this point, a repri~ntalive CE PWR has performed an az!alysis foz tzansitialn zlisk associated with one inoperable LYSI Mm. The methodolbgg and results obtained by this plant're presented below and are considered geneiically~ applicable t6 the other CE plants>

The philosophy beMnd the tzansitiion rL~k analysis is that if a plant component beCor1zes unavailable, the CDF will increme since less equipment is n.ow available to respond to a transient ifone were to occur.

However, as long as 1he plant remains at power, thi's CDP is'onstant.

At the point:in 1ime tlat a decision is made to sh>zt down, the CDF increases since a "transient" (manual shutdown) has now occurred, and the equipment is sti!ii out of!++rice.

The Core Damage Probability (CDP) associated with the xhsk ofplant transition from plant full power operation to shutdown is obtained by modifying the "uncornplicalml reactor trip

~ cOre damage scenario in the PSA model. In this evaluation the incremental risk is domijnabxi by the increased likelihood of loss of mam feeiwater and the reliance on auxiliary (andlor eNerg,envy) feedwater to avert a core d mage event., A cutset editor~ used to adjust cutsets representing manual shutdown or miscellaneous pl;mt trilps to reflect the CDP associated with a forced shutdown assuming one I2'SI tzaijz is out of smvic'e and requantifying the PSA'losets.'onservatisms that had been included in the base PSA model were deleted to reflect the greater control that the plant staff lm in the shutdown process.

Specifically, the baseline PSA assumed total loss of main feedwater (LMV)witlun 30 minus ofreactor trip. In tlhe transition 'analysis,

'FW was assumed to be am vezable followingfailure ofAuxiTi~FeAwater. A human. error

'robability (value of 0. 1) was added to cutsets that contained no basic events, including humm actions, that would cause MFW to be iuiavaH.able.

The duration of the transition process was assumed to be 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to hot. stmdlby and 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to hot shutdown).

Additional human errors tlat would be a!mociated with a detailed portrayal of'he shutdown process and the entzy into shutdown cceling wc:re not included m order to establish a

conservative lower bound assessment of the transition risk.

Ezrors of commission, sulch as

'iversion of RCS flow during SDC valve alignment, are also not considered in this analysis. 0

Such errors would add to the disadvantages ofthe shutdown alternative, and therefore, to include them would be non-conservative for the purpose of this comparison.

Based on the above methodology the CDP associated with the lower mode transition was calculated for the representative plant to be 1.00E-06.

Results of transition risk analyses can be generalized for the other CE PWRs by assuming that the ratio ofthe CDP forTransition Risk to the baseline Average CDF is constant for all plants.

The baseline CDFs were selected rather than the Conditional CDFs for the ratio between the other CE plants because the analysis for the representative plant indicated that transition risk was more a function of Loss of MFW rather than a function of the specific equipment out of service.

That is,

~ CDPmg

= (CDF~CDF~g

• ~CDPmr~~~

where:

hCDP~~

CDF~

CDF~~

CD'orrep~

Incremental risk due to mode transition forplant Baseline CDF for plant Representative plant baseline CDF Incremental risk due to mode transition for representative plant The transition risk may be used to evaluate the relative risks ofperforming LPSI repair at power to that ofperforming the same repair at some lower mode.

The risk ofcontinued operation for the fullduration of the AOT is bounded by the single AOT risk for CM (ifa common cause failure is suspected) and by the single AOT risk for PM when common cause failure can be ruled out.

The comparable risk of the alternate maintenance option involves consideration of four distinct risk components:

(1)

Risk of remaining at power prior to initiating the lower mode transition.

This risk willvary depending on the ability of the staff to diagnose the LPSI fault and the confidence of the operating staff to expeditiously complete the repair.

The time interval for power operation with a degraded component, prior to mode transition will vary from one to several days.

(2) Risk of lower mode transition.

This risk is accumulated over a short time interval (approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />).

(3)

Risk of contxnued lower mode operation with an itnpaired LPSI component.

In this mode, the i+actor is shutdown and the core is generating demy power only.

However, ris.ks in tjus mode rerrein si~mficant. Depending on the paiScular operatio:nal mode, resources to cope withplant transients willtypicallybe less than at power. These modes are characterized by decry% restrictions on system operability, longer tUnes for operator recovery actions lower initiating frequency for pre'ssure driven initiators'such's LOCA) and

a. greater frequency for plantl ~sidney such'as those mitiated by loss of offsite power and loss of main feedwater.

(4)

Risk of return to power The power ascension procedure is a well controlled transient.

Reference 6 conceptually discusses that risks associate with this titration are greater tlian those associated with at power operati,onbut significantly below 'that associated with the initial lower mode transition (item 2).

The analysis of transition risk presented in this reporti quantifies only the risk of lower, mode transition (item 2).

Table 6.3.3-1 presents the risk assm6ated with transitioning the plant to a lower mode for each plant. The numbers in the table represent only the lower inde transition risk component of the transition sequence.(item 2).

The, risk associated with the transition portion represents a~

significant fraction of the risk tlat would be incurred for a e:ven day "at power" (Smgle AGT Risk from Tables 6.3.2-1 and 6.3.2-2) LPSI train maintenance period,.

When the risk at power and the risk at the lower mode of operation are comparable, then thine results indicate that perfornung a 7 day LPS!I: train maintenance activity "at power" would be risk beneficial.

26 0

Table 6.3.3-1 TRANSITIONRISK CONTRIBUTIONS FOR LPSI CM PLANT ANO-2 Calvert Cliffs 1 &2 Fort Calhoun Station Maine Yankee Millstone 2 Palisades Palo Verde 1, 2 & 3 San Onofre 2 & 3 St. Lucie 1 St. Lucie 2 Waterford 3 Transition Risk Contribution (6CDP) 6.92E-07 4.45E-06 2.49E-07 1.56E-06 7.19E-07 1.09E-06 1.00E-06 5.78E-07 4.51E-07 4.96E-07 3.25E-07 27

tf.9.4 Assessment ofShutdown Risk The risk tradeoff for performing PM on the LPSI pump at pOwer versus during shutdown was assessed by compaiing the risk at s'.hutdown associated with LPSI pump operation with incremental improvements in reliabilityassociated with perfoi~ng majmtenance at power. The essence of this assessment was to perform a sensitivity aiialy'sis'which evaluated the impact'f'mproved reliabilityofthe LPBIpump entering shutdown conditions'iven that mainten'ance was'erformed on the LPSI train at power prior to shutdown.

A's data is not available to quanta the improvement in reliability,, sensitivity studies were chosen as the vehicle to quantify the risk associated with LPSI rrmatenance duiing shutdown.

Given the fact that the frequency of requiring LPSI at power is on. the order of 1 x 10 per y~ '(the frequency of a Large AVOCA event), whereas the frequency of requiiing LPSI operability during shutdown is 1.0 gr cycle,

't is intuitive that improving the reliabiiIityof the LPSI systeni during shutdown should iinprove'verall plant safety.

In summary, the premise underlying this study is that +rforining Preventive LPSI maintenance at power would improve the reEkilityof the LPSI pump entering shutdown.

This sensitivity study was performed for a representative CE plant and evaluatoi the impact on Core Damage Probability (CDP) over a seven day interval at the iiiitiationof plant shutdown.

'uring this period the core is resident within the ieactor. vessel and reduced inventory shutdown operation (including "Mid-'leep'") is likely,.

To evaluate ask benefits associated with maintenance, improvements in LlSI pump reliability of 1%, 5% and 10% were paranhetijicaBy evaluated.

The CDP was then compared to the baselin~'. CDP to obtain the change in risk from the base reliability.

Additional benefits ofperforming LPSI system maintenance at power, but not quantified in this effort are:

(1)

Increased avaijlability of maIhtenance stVf~ for risk significant shutdown maintenance repairs, and (2)

Reduced potentIial for errors ofcommission. that may induce LPSI systeni failure during shutdown.

Assumptions For this analysis, the baseline Core Damage Probability.(CDP~J is defined as the CDP associated with the present situation where main>naIice oII the LPSI train is don8 during shutdown.

The Preventive Maintenance Core Damage Probability (CDPIM) is defined as the CDP associated with the proposed sibiation where L'PSI train maintenance is performed at power.

0

The analysis assumes that as shutdown cooling is first initiated followingreactor shutdown, two operating LPSI pumps are available for Shutdown Cooling (SDC). The evaluation is artificially restricted to a single 7 day reduced inventory period following shutdown entry.

During this period core uncovery and core damage would occur shortly after loss of SDC. The only event leading to core damage was that. resulting from a loss of SDC via failure of a LPSI pump.

No credit for recovery of pumps or use of backup pumps was assumed for this analysis.

In addition, the analysis assumes that the firstLPSI pump fails while operating halfway through the mission time (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />); therefore, the second pump has a mission time equal to one-half that of the first pump (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />). 'he base reliability of the LPSI pump P,) of S.OE45/hr was selected as representative ofCE PWRs.

Consistent with the parametric evaluation, the improved X, was varied from 5.0E-05/hr to 4.5E-OS/hr.

Conclusion Results of this study are presented in Table 6.3.4-1 below. The conclusion of the study is that CDP due to LPSI train unavailability is sensitive to even small changes in LPSI pump reliability.

The results showed that for a 1% improvement in pump reliability, the net CDP (CDP~-

CDP~ decmises by 8.61E-07. Itis therefore concluded that the net impact ofLPSI train PM at power is risk beneficial.

Table 6.3.4-1 EFFECTS OF IMPROVED LPSI RELIABILITYAT SHUTDOWN BASE X = S.OE-S/hr 1%

CHANGE IN X 5%

10%

SHUTDOWN CDP (7 day interval) delta CDP (CDP~ - CDPppg) 5.06E-OS 4.97E-OS 8.61E-07 4.63E-OS

~ 4.23E46 4.23E-OS 8.28E-06 29

6.3.$

Assessment ofi~pe.Emmy.Kel'ease A review. oflarge early rel.ease scenarios for the CB P%Rs indicates Qmt early releases atise as a result of one of the following class of scenarios:

1.

Containment Bypass.Events These events:include interfacing system LOCAs and steam generator tube ruptures (Si37Rs) with a concomitant loss of SG isolation (e.g.

stuck open MSSV).

2.

Severe Accidents accompanied by loss of containment isolation These events includhe any severe accident in conjunction with an initially unisolated containment.

3.

Containment Failure associated with Energetic events in the Containment.

Events cau!ung Contain!ment failure include those associahd: with the High Pressure MeltEjection (HPME) phenomena'including direct containment beating'(DCH))

and hydrogen coriflagrationsldetonaticins.

Of the three release categoric!l, Class 1 tends to represent a large early release with potentially~

direct, unscrubbed fission products, to the environrnen't.

'Chss 2 events encompass a range of releases varying from early to late that may or may not be scrubbed.

Class 3.events result in a high pressure failure of the containment,, typically immediately upon or slightly after reactor vessel failure. Detailed Level 2 analyses f'or the plant condition with one LPSI train inoperable are not performed.

However, asgssment of the expected change in the large arly release fraction was made by assezing the:impact of the availability of the: LPSI System on the

'above'vent categories.

0 Containment Bypass Events

.Events contained in this category that may rely on the LPSI for event mitigation. include the~

Large Interfacing Syste~rn LOCA (i.e. failure of an SDC line). Testing and or maintenance of'ontainment isolation valves @aiding in the LPSI System are governed under the plant technical specifications.

Arguments provided in tlus report ate not intended to justify "at pow'er"'aintenance of these vzLives.

Thus, no change in the ISLOCA frequency is expectedI.

ISLOCAs are characterized by a continuous and unreplenished loss of RCS inventory and'akeup.

In these scen zios, core damage ultimately results following the depletion of reactor~

coolant.

Thus, provided that a contijnuous independent water supply is not avaihble during the accident, the ISLOCA willprogress into early core ~damage regardless of the LPSI av&ability.

30 0

Severe Accidents accompanied by Loss ofContainment Isolation Another event contributing to large early fission product releases could occur when an unmitigated large LOCA occurs in conjunction with an initially unisolated containment.

Significant fission product releases would not occur unless the containment atmosphere is unscrubbed (that is sprays are inoperable).

This later'combination of events is considered of very low probability and would not significantly increase with a decrease in LPSI pump availability.

Containment Failure associated with Energetic events in the Containment.

Class 3 events are dominated by RCS transients that occur at high pressure.

These events exclude those where LPSI System performance would be called for and therefore LPSI status is not a contributor to this event category. Itis therefore concluded that increased unavailability ofthe LPSI System (as could potentially result as a consequence ofan increased AOT) willhave a negligible impact on the large early release fraction for CE PWRs.

6.3.6 Summary ofRisk Assessment The proposed increase in the LPSI System AOT to 7 days was evaluated from the perspective ofvarious risks associated with plant operation.

For the plants evaluated, incorporation of the extended AOT into the technical specification can potentially result in negligible to small increases in the "at power" risk. However, when the fullscope ofplant risk is considered, the risks incurred by extending the AOT for either corrective or preventive maintenance willbe substantially offset by plant benefits associated withavoiding unnecessary plant transitions and/or by reducing risks during plant shutdown operations.

The unavailability of one train of LPSI was found to not significantly impact the three classes of events that give rise to large early releases.

These include containment bypass sequences, severe accidents accompanied by loss of containment isolation, and containment failure due to energetic events in the containment.

It is therefore concluded that increased unavailability of the LPSI System (as requested via Section 2) willresult in a negligible impact on the large early release probability for CE PWRs.

Itis therefore concluded that the overall plant impact willbe either risk beneficial or, at the very least, risk neutraL 31

6.4 Compensatory Mmarres As part ofimplemeniing the hhintezme~ Rule, each CE PWR utilityhas developed or is in the, process of developing a method for corrfigura,tion control during maintenance. Ifmaintenance is:performed on a sy stein/iraija concurrent with other maintenance, the impact on risk willbe evaluated prior to perforrzmg maintenance.

Some plants achieve this via procedures which require that "PSA evaluation is, performed prior to performing maintenance.

Other plants'have a matrix showing the risk animated with different combinations of systems/trains unavailable due to maintenance.

Thus matrix is used in planrnng the rolling maintenance schedule which is part of implementing the %maintenance Rule.

A qualitative review of potentiial interactions between the LPSI System and other plant sQteins that could amplify the:impact of LPSI System unavailability was performed.

Based on this review, implementatiion of.exixaordinary compensatory actions was not found necessary

~when LPSI train is out of service for maintenance.

However, for any "at power" maintenance, the goals should be expediency and safety.

Typic;d. actions to be 6Qcen during "at power" LPSI tr<<m maintenance and/or testing of LPSI valves are:

1.

Verifythat related eqruprnent is not o)rt df~ce which would amplify the ~effect

~

of the unavaih&i]ity of the LPSI System.

'IMs could include restricting

'aintenance to.times when:

a.

all SITs are operable b.

when aH AFW-sources are available Since the AOT for SITs is short, rratricting the LPSI Sy. tern maintenance during the time that any single SIT is in rep~ should not be burdensome.

Components of the LPSI system also support the shutdown cooling system> Itis therefore,,

ii~mmended. tlrat preventiVe m~t'enance not be scheduled

'to

'imultaneously compromise the heat removal capability of both the AFW and SDC System; 2.

Verify that-am alternate flowpath is available at the same time to accomplish the LPSI unction,,including support systems.

3.

Conduct a briefing with appropriate plant pctrsonnel to ensure that they aire hw~

of the impact associated with unavailable components and:flowpaths.

4.

Ifa m6nten ace action or ayaiir is td b0 performed on the LPSI, pre-stage parts and tools to mirnmize outage time.

5.

Consider actions which. could be taken to return the affected LPSI tr<<<<n to functional use,:if not:fuH operabiliity, ifthe need arises.

32 iO

6.

In repairing/testing components (particularly valves), define. the appropriate valve position (open/closed) that provides the greater level of safety and "ifpractical" establish that position for the repair.

With the longer AOTs now available, an effort should be made to avoid inefficientlyconducted multiple maintenance tasks on the same system that would result in a decreased ability to re-establish the system should it be necessary to do so.

7.0 TECHNICALJUSTIFICATIONFOR STI EXTENSION LPSI System STI extensions are not within the scope of this effort.

8.0 PROPOSED MODIFICATIONSTO NUREG-1432 Attachment A includes proposed changes to NUREG-1432 Sections 3.5.2 and B 3.5.2 that correspond to the findings of this report.

33

9.0:SUlVMXRYA16) CONCLUSIONS This report provides the adults of an evaluation of'he extension of the Allowed Outage Time, (AOT) for a single Low Pressure Safety Injection (LPSI) Train contained within the current CE plant technical specifications, from its print value, to seven days.

This AOT extension is sought to provide needed flexibility in the performance of both corrective and preventive maintenance during power operation.

Justification< of~this request was:based on an integrated review and assessment of plant operations, deterministic/design basis. factors and plant risk.

Results of this study demonstrate that the proposed AOT extension provides plant. o+Ntiohal flexibilitywhile si'multaneously reducing overall plant risk.

The proposed increase in the-LPSI System AOT to~7 days was evaluated from-the perspective of-various risks associated with plant operation.

For the plants evaluated, incorporation of the extended AOT into the technical spxificatiorn potentially results in negligible mcreases in the "at power" risk. However, when the Ml!ape ofplant ri'sk is c'onsidered, the risks incurred, by, extending the AOT for either co~@ective or preventive maintenance willbe substantially offset by associated plant benefit amaeiated wi.th avoiding unnectm.uy pl.mt transitions and/or by reducing risks during plant shutdown operations The unavailability, of one trauma ofLPSI was found to not significantly, impact the three classes of ev'ents that give rise to large early releases.

These include containment bypass sequences, severe accidents ace>mpanied.by

-loss of containment isolation, and containment failure due to energetic events in the contaijnment It is concluded that increased unavailability of the LYSI System (as requested via Section 2) willresult in a neglig:ible impact on the large early release'robability for CE PWRs.

It is the overall conclusion of this evaluation that the gl~t impact for the requested AOT extension would be iM:benefici 6.

34

~

~

~

~

~

10.0 R1MHKKCES 1.

10 CFR 50.65, Appendix A, "The Maintenance Rule".

2.

3.

MBA-0212, "Revision 3,

"Standard Technical Specifications for Combustion Engineering Pressurized Water Reactors", July 9, 1982.

NUTMEG-1432, "Standard Technical Specifications:

Combustion Engineering Units",

September 1992.

NRC Inspection Manual Part 9900 Technical Guidance, "Maintenance-Voluntary Entry into Limiting Conditions for Operation Action Statements to Perform Maintenance",

1991.

5.

"Technical Evaluation ofSouth Texas Project (STP) Analysis for Technical Specification Modifications", P. Samanta, G. Martinez-Guridi, and W. Vesely, Technical Report ¹L-2591, dated 1-11-94.

6.

NUREG/CR-6141, BNL-NUTMEG-52398, "Handbook of Methods for Risk-Based Analyses ofTechnical Specifications", P. K. Samanta, L S. Kim, T. Mankaino, and W.

E. Vesely, Published December 1994.

~

~

~

~

~

7.

LWW-02-094, Letter L. Ward (INEL) to Dr. F. Eltawila (NRC),

Subject:

"Use of MAAPto Support UtilityIPE In-Vessel and Ex-Vessel Accident Success Criteria, June 1994.

8.

Fort Calhoun Station IPE Submittal Report, December 1993.

9.

NUTMEG 0800, USNRC Standard Review Plan, Rev.2, July 1981.

10.

TID 14844, "Calculation of Distance Factors for Power Reactor Sites", USAEC, 1962.

11.,NUREG-1465, "Accident Source Terms forLightWater Reactors" (Final Draft), August, 1994.

35

Ci 4l 1

ATTACHMENTA "Mark-up" ofM)REG-1432 SECTIONS 3.5.2 &B 3.52

~O

~O iO

ECCS-Operating 3.5.2 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 3.5.2 ECCS Operating LCO 3.5.2 Two ECCS trains shall be OPERABLE.

APPLICABILITY:

MODES 1 and 2, MODE 3 with pressurizer pressure

~ t1700] psia.

ACTIONS CONDITION REQUIRED ACTION'OMPLETION TIME ZtlQK7

~mr 6

A.

bne or more trains ino rable.

AND At lea 100~ f the ECC low equiv nt t

a single OPERA A.l GJbt~ +

Restore '<zan~ to OPERABLE status.

7 c4$ s Required Action and

~

~

~

~

~

associated Completion Time not met.

C P'.1 Be in NODE 3.

AND

.2 Reduce pressurizer pressure to

< {1700] psia.

6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> 12 hours CEOG STS 3.5-4 Rev.

0, 09/28/92

INSERT A One LPSI subtrain inoperable.

INSERT B B.

One or more ECCS trains inoperable due to condition(s) other than Condition A.

B.1 Restore ECCS train(s) to OPERABLE status.

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AND At least 100% of the ECCS Qow equivalent to a single OPEI'MELEE ECCS train available.

ECCS-Operating B 3.5.2 BASES ACTIONS A.1 con inued)

OPERABLE sta 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The ompletion Time is based on an NRC s 4

using a reliabi,lity evaluation an easonable amount o

feet many An ECCS train is inoperable if it delivering the design flow to the components are inoperable if they performing-their design function, are not available.

is not capable of RCS.

The individual are not capable of or if supporting systems The LCO requires the OPERABILITY of a number of independent subsystems.

Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function.

Neither does the inoperability. of two different components, each in a different train, necessaril result in a loss of function for the ECCS.

The: inten f

to maintain a combination of OPERABLE equipment such that 1008 of the. ECCS flow equivalent to 1008 of a single OPERABLE train remains available.

This allows increased flexibilityin plant operations when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an emergency DG can disable one ECCS'rain until power is restored.

A reliability analysis (Ref'. 4) has shown that the impact with one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

M5ERT RC in a conditi e the acci en must be imnediatel "entered.-

Therefore, c

.1 and

.2 Reference 5 describes situations in which one component, such as a shutdown cooling total flow control valve, can disable both ECCS trains.

i one or more compon in h that 100< of the e u ow to a single OPERABLE available, the facility is If the inoperable train cannot be restored to 'OPERABLE status within the associated Completion Time, the plant must (continued)

CEOG STS B 3.5-15 Rev.

0, 09/28/92

INSERT AA each of Condition A and Condition B a~re INSERT AB Each of Condition A and Condition B inchides a combination of OPERABLE equipment such that at least 100% of the ECCS Qow equivalent to a sixigl@

OPERABLE ECCS train. remains available.

Condition A addresses the spe66c condition inhere the only affected ECCS subsystem is a single ICOSI subtraiu.

The availability of at, least 100% of the ECCS Qow equivalent to a single OPEPA33LE ECCS train i's iniplicitin th'e

'eQnition of Condition A.

IfLCO 3 'i2 requirements are not met due only to the existence of Condition A, then the inoperable LPSI subtrain, components niust be returned to OPERABLE status within seven (7) days of discover of Condition A. This seven (7) day Completion anne is, based on the Gndin'gs of the'etermiiiistic and probabiEstic

'nalysis that are discussed in Reference 6.

Seven (7} days is a reasonable amount of time to perform many corrective and preventative maintenance items'n'. th'e affected LPSI subtrain.

Reference 6 concluded that the overall risk impact of this Completion Time was either risk-beneQcial or risk-iievtraL Condition B addresses other scenrarios where the availability of at least 100% of the ECCS Qow equivalent to a single OPERABI.Z ECCS train exists but 6e AQ1'equirements of LCO 35.2 are not met. IfD)ndition B exists, then mogierable components must be restored such that Condition B does not exist. with 72 holirs

'f discovery.

The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Tijxie is b'ase',d on an NRC rehability study (Ref. 4) and is a reasonable amount of )ime ttr effect many repair..

INSERT AC With one or more components inoperable such that 100% of: the equivalent Qow to a single OE ERABLE ECCS is not available, the facilityis in a condition outside of the accident azjalyses.

I'n such a'situation, LCG 3.03 must be immediately entered.

ECCS-Operating B 3.5.2 BASES ACTIONS

.I and

.2 (continued) be brought to a HOOE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least HODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and pressurizer pressure reduced to

( 1700 psia within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems.

SURVEILLANCE REQUIREMENTS SR 3.5.2.1 Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained.

Hisalignment of these valves could render both ECCS.trains inoperable.

Securing these valves in position by removing power or by key locking the control in the correct position ensures that the valves cannot be inadvertently misaligned or change position as the result of an active failure.

These valves are of the type described in Reference 5, which can disable the function of both ECCS trains and invalidate fhe accident analysis.

A 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> Frequency is considered reasonable in view of other administrative controls ensuring that a mispositioned valve is an unlikely possibility.

SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing.,

A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve automatically repositions within the proper stroke time.

This Surveillance does not require any testing or valve manipulation.

Rather, it involves verification that those valves capable of being mispositioned are in the correct position.

(continued)

GEOG STS

'B 3.5-16 Rev.

0, 09/28/92

ECCS-Operating B 3.5.2 BASES SURVEILLANCE REQUIREMENTS SR 3.5.2.]l0 (continued)

outage, on the need to have access to the the potential for unplanned transients if were performed with the reactor at power.

sufficient to detect abnorma1l degradation by operating experience.

location, and on the Survei:llance.

'This Frequency is and is confirmed REFERENCES

~ScRT RD

.1.

10 CFIR 50,.Apper>dix A, GDC 35.

2.

10 CF;R 5i0.46.

3.

FSAR, Chapter Pi].

4, NRC Memorandum to V. Stello, Jr.,

from R. L. Baer, "Recomnended Interim Revisions to LCOs for ECCFi Components,"

December 1, 1975.

'5.

IE Information Notice No. 87-01, Jlanuary 6, 1987.

0 GEOG STS B 3.5-19 0

Rev.

0, 09/28/92

INSERT AD 6.

CE NPSD-995, "CEOG Joint Applications Report for Low Pressure Safety Injection System AOT Extension," April'995.

0 ma

~O

~O 0