ML17313A866
| ML17313A866 | |
| Person / Time | |
|---|---|
| Site: | Palo Verde  |
| Issue date: | 03/23/1999 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML17313A865 | List: |
| References | |
| NUDOCS 9903260259 | |
| Download: ML17313A866 (21) | |
Text
4 yI S II5CO
~
+
0*
OO I
0 I
++*++
UNITED STATES NUCLEAR REGULATORY COIVIMISSION WASHINGTON, D.C. 2055&4001 SAFETY EVALUATIONBYTHE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO CHARGING SYSTEM COMMITMENTCHANGES ARIZONAPUBLIC SERVICE COMPANY PALO VERDE NUCLEAR GENERATING STATION UNITS 1 2 AND 3 DOCKET NOS. STN 50-528 STN 50-529 AND STN 50-530
1.0 INTRODUCTION
Item 3.b of Attachment 1 to Facility Operating License No. NPF-51 for Palo Verde Nuclear Generating Station (PVNGS), Unit 2 required the licensee to submit the following information relative to the proper operation of the charging pumps:
An evaluation and implementation schedule, for staff approval, regarding the long-term solution which considers alternative hardware changes that may be necessary to eliminate the need for venting hydrogen from the suction of the charging pumps.
In its letter dated March 9, 1995, the Arizona Public Service Company (APS or the licensee) informed the NRC that the appropriate long-term solution was to rely on operator action to vent the charging pumps ifnecessary and not to implement additional hardware changes.
The licensee concluded that the additional hardware changes would not provide a safety benefit commensurate with their costs and they are not needed to comply with the license condition.
The licensee further concluded that because of demonstrated system reliability, operator training and procedural controls, and the availability of an alternate method to depressurize the reactor coolant system using the reactor head vent and pressurizer vents, all licensing requirements are currently met.
It is the licensee's position that the intent of the license condition is fulfilledwith the current plant design, and the licensee requested staff concurrence not to implement the charging system modifications committed to in its June 26, 1986, letter.
2.0 BACKGROUND
During a loss-of-load test for the PVNGS Unit 1 on September 12, 1985, the plant did not perform as expected and as a result, all three charging pumps were lost due to gas binding.
Section 5.4.3 of NUREG-0857, "Safety Evaluation Report related to the operation of Palo Verde Nuclear Generating Station, Units 1, 2, and 3," Supplement 9, dated December 1985, provides a more complete discussion of this event and both Supplement 9 and 10 (dated April 1986) detail the analyses, plant modifications and commitments made by licensee to resolve this issue.
As a result of the staff's evaluation, the PVNGS Unit 2 license was conditioned, as noted in the introduction to this safety evaluation, to require a long-term solution to the potential for 9903260259 990323 PDR ADQCK 05000528 p
I I
4 t
I
~
~ gas binding of the charging pumps.
To satisfy this license requirement, the licensee proposed in its June 26, 1986, letter the following modifications to the chemical and volume control system (CVCS) for all three PVNGS units:
(1)
Provide train B of Class 1E power sources to the existing boric acid makeup pumps (BAMPS).
(2)
Provide train B of Class 1E power sources to the BAMP discharge line isolation valve (CH-14) connecting the charging pump suction header.
(3)
Install a new volume control tank (VCT) outlet isolation valve in series with the existing isolation valve (CH-501) for redundancy.
Electric power to the new isolation valve will be supplied from train B of Class 1E sources.
(4)
Cable installation for the above-stated power supplies willnot be designed to meet safety-grade criteria. However, proper isolation devices willbe provided between the Class 1E power sources and the nonsafety-grade electrical cables which supply power to nonsafety-grade pumps and valve operators.
The staff approved the licensee's proposed hardware modifications and implementation schedule in Section 5.4.3 of NUREG-0857, Supplement 11, dated March 1987. The licensee's implementation of these commitments was contingent on the resolution of Unresolved Safety Issue A-45. The final resolution of this issue occurred with the staff's acceptance of the licensee's Individual Plant Examination in its letter dated July 1, 1994. Therefore, implementing the proposed. modifications was scheduled to begin with the September 1995 PVNGS Unit 3 refueling outage.
In its letter dated March 9, 1995, the licensee informed the NRC that the proposed hardware changes associated with the above commitments were not needed to comply with the license condition. Instead, the licensee concluded that the additional hardware changes would not provide a safety benefit commensurate with their costs and they are not needed to meet licensing requirements.
The licensee requested staff concurrence in its position that the current plant design and demonstrated plant reliability, with the improvements made in operator training and operating procedures, satisfy the license condition.
3.0 EVALUATION The license condition described in Section 1.0 of this Safety Evaluation was complied with when the licensee submitted the proposed modifications and implementation schedule to the staff in its June 26, 1986, letter. The purpose of this section is to evaluate the licensee's proposed changes to the commitments made in its June 26, 1986, letter and approved in NUREG-0857, Supplement 11.
.Branch Technical Position RSB 5-1 of the Standard Review Plan (NUREG-0800) provides the design requirements for those systems that can be used to take the reactor from normal operating conditions to cold shutdown.
The plant event that occurred on September 12, 1985, demonstrated design weaknesses in the ability of the plant to initiallycool down from normal operating conditions. There were no concerns with the final stages of plant cooldown, when the
I I'l shutdown cooling system (SDC) is placed into operation at 350'F and 410 psia. The objective of the license condition,'therefore, was to assure that the systems available to initiallycool down the reactor complied with the requirements of RSB 5-1.
The plant modifications listed in the background section were intended to meet the functional requirements of RSB 5-1. However, RSB 5-1 provides alternative implementation requirements for plants whose construction permit application was docketed before January 1, 1978, and for which an operating license was expected on or after January 1, 1979. The Palo Verde Station is classified as a Class 2 site using this criterion; for which the Branch Technical Position states that: "Compliance willnot be required if it can be shown that corrections for single failure by manual actions inside or outside of containment, or return to hot standby until manual actions (or repairs) are found to be acceptable for the individual plant." Therefore, the licensee proposes to credit the use of manual operations as permitted by RSB 5-1 in lieu of the modifications originally proposed, which would not have required manual actions by the plant operators to satisfy the single failure criteria during the cooldown operation.
In addition to concluding that the current plant design and operating practices meet the requirements of RSB 5-1, the licensee also concluded that the proposed modifications should not be implemented because they would not provide a safety benefit commensurate with their costs.
The staff's evaluation of each of these two licensee conclusions is detailed below.
3.1 Com liance with RSB 5-1 The analysis presented by the licensee is intended to demonstrate that because of system reliability, operator training, and procedural controls to vent the charging pumps ifnecessary, and the availability of an alternate method to depressurize the reactor coolant system (RCS), all licensing requirements are met.
Miti ation of Char in Pum Gas Bindin Event The licensee has based the mitigation of a charging pump binding event on operator manual action as permitted by RSB 5-1. To this end significant attention is given to the training of plant operators to respond properly to a gas binding event.
The operator actions needed to properly vent the charging pumps should a binding event occur have been identified and proceduralized by the licensee.
Operators undergo training to cope with this type of event. The training consists of plant simulator exercises to verify proper understanding of the appropriate plant procedures and classroom study where the operators are taught how gas binding of the charging pumps could occur and how.the actions required by the plant procedures willcorrect gas binding of the charging pumps.
In view of the emphasis placed on this event in the training of plant operators, the staff concludes that the option permitted for RSB 5-1 Class 2 plants to rely on appropriate manual actions to meet the single failure criteria has been satisfactorily demonstrated by the licensee.
S
Alternate Safe Shutdown Means The objective of PVNGS Unit 2 license condition 3.b is to eliminate the need to manually vent hydrogen gas from the charging pumps as the sole means to satisfy the requirements of RSB 5-1. The licensee has, therefore, identified a redundant diverse and reliable means to achieve plant cooldown to where the SDC system can be placed into operation.
The proposed method involves natural circulation cooldown of the reactor using the safety-grade reactor coolant gas venting system (RCGVS) and the pressurizer vent flow path with the high pressure safety injection (HPSI) pumps (instead of the auxiliary pressurizer spray system (APSS) and the charging makeup).
The licensee states that the use of the RCGVS and the HPSI for depressurization and makeup will be included in the emergency operating procedures (EOPs).
The licensee performed a study which made a qualitative comparison of the existing Palo Verde natural circulation cooldown analysis which credits the CVCS, with analyses from the South Korean Yonggwang 3 and 4 Units (also CE plants) which credit the RCGVS and the HPSI systems.
The methodology employed in the Yonggwang analysis is the same as that used in the evaluation of ABB CE Systems 80+ design, which has been approved by the NRC.
The licensee states that a qualitative comparison of the Yonggwang study with existing Palo Verde cooldown studies proves to a high degree of confidence that the proposed alternate cooling down method is valid. However, the Yonggwang study was performed to provide a training exercise to the plant operators and there is no discussion about the calculational rigor of the Yonggwang study.
In addition there are a number of differences between the two plants which do not allow a direct comparison.
For example the reactor power ratio between the two plants is 1.35 but the venting capability of the RCGVS is declared to be the same.
In addition, while the reactor power ratio is 1.35, the pressurizer volumes are the same (1800 gallons). The study contains a large number of engineering assumptions and extrapolations which are not fullyjustified. As a result the technical level of the study is not high.
The central issues considered important by the staff in the cooldown study are:
(1) whether adequate depressurization capability is provided by the reactor vessel upper head gas vent valves and the pressurizer vent valves, (2) whether adequate make-up can be provided by the high pressure injection pumps, (3) whether the cooldown of the reactor can be accomplished with equipment satisfying the requirements of RSB 5-1, and (4) whether the cooldown can be accomplished using the available water (300,000 gallons) in the condensate storage tank.
The licensee's initial submittal dated March 9, 1995, as supplemented by letter dated May 21, 1996, did not provide the staff with sufficient information to properly evaluate the issues identified above.
In its letter dated August 22, 1997, the licensee responded to the staffs request for additional information dated June 19, 1997.
In addition, the licensee responded in a letter dated December 11, 1998, to questions identified by the staff during a phone conference on September 8, 1998.
The licensee used the computer code LTC to model the natural circulation phenomena.
The model assumed that depressurization and cooldown is accomplished using the HPSI and RCGVS, which is the proposed alternate means to satisfy the criteria of RSB 5-1. The systems involved are diverse, redundant and safety-related.
The most limiting single failure assumed in
the analysis is the failure of one of the emergency diesel generators which disables one HPSI train.
The input assumptions and the evolution of the transient as computed by the LTC code are as follows:
1.
The plant power level is assumed to be 3876 MWth which represents the current nominal full power level. The assumed loss of offsite power occurs at time t = zero and results in loss of power to the reactor coolant pumps and a low flowtrip. Steam generator (SG) pressure willincrease and the main steam safety valves willcycle open and close to control SG pressure.
2.
At time t = 300 seconds the operator starts using the atmospheric dump valves (ADVs) to control SG pressure and establishes emergency feedwater flowof at least 500 gpm.
3.
Hot standby conditions are maintained for four hours (as required by RSB 5-1). At the end of the four hour period the RCS pressure is at 1735 psia and the SG level is stabilized at 60 percent.
4.
At time t = 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> the cooldown is initiated at the rate of 50 F/hr by using one ADVper SG and adjusting the emergency feedwater flow.
During the cooldown process pressure and pressurizer level decrease and the operator uses the HPSI to maintain pressurizer level. (The HPSI was used three times during this stage; however, the intervals between usage were longer than the 45 minutes required by the HPSI pump manufacturer's specifications.)
6.
At about t = 4.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> RCS pressure falls below the saturation point, and a steam bubble forms in the upper vessel head.
7.
At about t = 8.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> the RCS temperature approaches SDC entry conditions and the operator begins to depressurize the RCS using the RCGVS.
8.
The RCS coo!down continues until t = 9.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. At this time TQ7 320'F and.is decreasing; well within the SDC entry conditions.
4 9.
At time t = 10.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> the operator closes the pressurizer vent and opens the reactor vessel gas vent valve to collapse the steam bubble. At this point RCS pressure is 625 psia.
10.
At time t = 10.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> the operator closes the vessel gas vent but the steam bubble continues to collapse due to the cold loop water entering the vessel.
The pressurizer level continues to decrease and the operator restarts HPSI to stabilize pressurizer level.
At about t = 10.66 hours7.638889e-4 days <br />0.0183 hours <br />1.09127e-4 weeks <br />2.5113e-5 months <br /> the operator stops HPSI flowto the RCS.
11.
Shortly thereafter, at approximately t = 10.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> the steam void has collapsed completely and the operator opens the pressurizer vents to complete the
depressurization.
At t = 11.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> the RCS p'ressure is 350 psia and the depressurization is complete.
12.
At this time (t = 11.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />) initial plant cooldown is completed and the plant is at T>>, =
325'F and RCS pressure at 350 psia, ready for SDC operations to begin. Total use of condensate water is calculated to be 216,400 gallons compared with the tank capacity of 300,000 gallons.
13.
The simulation,was continued for one more hour, which is the time needed to line up SDC.
The depressurization demands made on the RCGVS are not excessive; therefore, the staff finds that the scenario outlined above is acceptable.
The licensee relied on the results of the LTC code to demonstrate that the systems used for reactor cooldown and depressurization satisfy the requirements of RSB 5-1. Therefore, the staff's review effort was directed toward establishing that the LTC code is acceptable for licensing actions and that the requirements of RSB 5-1 are satisfied. Although the results of the calculation are being used to satisfy a license condition, the licensee states that the calculation has been designated as not containing safety-related design input. Similarly, the LTC code itself has not been certified to comply with the quality assurance requirements of 10 CFR 50 Appendix B.
The licensee states that the LTC code has undergone extensive modification since it was originally benchmarked and approved by the NRC (version 3.0), although there have been no significant changes to the major models in the code. These changes resulted in the code version 3.07 which has not been benchmarked.
The licensee states that the code is used to simulate plant operations and that the results have been satisfactory.
However, the examples that were presented from such simulations were for relatively very short time periods (up to 250 seconds) compared to the cooldown time of 13 to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />.
Therefore, the staff has not been able to conclude that the licensee has presented an adequate benchmarking of the LTC code as applied to the present license modification request.
The staffs basis for accepting the licensee's use of the LTC code is discussed below.
Code Benchmarkin Neither the licensee nor the owner of the LTC code (ABB-CE) conducted a specific benchmarking calculation to assess the ability of the LTC code to model this particular scenario.
However, the licensee's December 11, 1998, submittal compiled the available evidence regarding LTC's ability to track the plant's performance, and a review of the submitted information gives a sense of the overall code capabilities.
This approach is acceptable because the physical phenomena expected to take place during the cooldown process are well known and understood.
In addition, in comparisons of early transient analyses to the corresponding plant data (when difficultto simulate rapid changes take place) the code exhibits excellent predictive capabilities.
The licensee also states that the heat transfer and SG/ADV models have not been changed in any substantive way in the code changes between version 3.0 and version 3.7. Version 3.0 was tested against a cooldown transient and this also adds to the supporting information for the validity of the code.
Finally the staff notes the licensee's
statement that the code has been continually used in plant transient analyses (but not specifically for benchmarking) and its performance has been acceptable.
The December 11, 1998, letter reports eight transients for which experimental data are available for extended time periods and seven calculated transients.
Experimental data are available for three transients:
(1) 20% to 25% power increase; (2) 25% to 29% power increase; and (3) 30% steady operation.
Similarly LTC simulation results are available for two cases at 25% steady power and one case of 25% to 30% power. The data were recorded and the simulations were run during an investigation of SG instability. Thus, there is no exact correspondence of power variation between the experimental data and the simulations.
The staff selected a 4% average power run data and a 5% steady power simulation results for comparison as the closest to a cooldown transient.
The duration of the experimental record is one hour while the simulated data are given for one and two hours.
In the experimental run a main feedwater pump is switched on at 4% power which occurs at about 30 minutes into the test. The calculated and measured reactor system parameters behave as follows:
Reactor power: The measured power level increases linearly from about 3% to 5%
within one hour. The simulated power exhibits an oscillatory behavior with 5% as the lower bound and 6% as the upper bound with a period of about 17 minutes.
2.
T T: The measured values of Tand T
~ exhibit minor oscillations until the pump is turned on. The oscillations increase for a few minutes and then stabilize at about one degree F higher than before. The calculated values also show the onset of oscillations at about 30 minutes which is probably triggered by the power oscillation at 30 minutes.
3.
RCS pressure:
Both the measured and calculated values stabilize at about 2250 psia for the first 30 minutes. Afterthe pump is turned on, the experimental values show a minor disturbance and stabilize in a few minutes.
The simulated values extend the disturbance for two hours.
(The amplitude of this oscillation is small, about a15 psia.)
4.
Pressurizer level:
In both instances it is stable at about 35%.
5.
SG-1 water level: The measured values exhibit an oscillatory behavior which is amplified when the feedwater pump starts and then dampens out in a few minutes.
Contrary to the measured values, the simulated values seem to diverge after the pump starts.
6.
SG-1 feedwater flowrate: The flowrate behaves in a manner similar to the water level.
The experimental values indicate what is intuitively expected:
the plant operates in a stable mode at low power and that disturbances quickly die out. The calculated transient, which incorporates a power oscillation, seems to lead into diverging oscillations in feedwater level and SG level. However, this run was part of a study to identify the causes of such oscillations and determine suitable plant modifications. The code then is indeed able to followsevere changes in plant parameters.
Therefore, we conclude that the code is capable of predicting the slower transient of a cooldown.
t Ade uac of the RCGVS None of the transients described in the submittal addressed any direct experimental verification of the adequacy of the reactor coolant gas vent. However, a test was performed on January 24-25, 1986 (see Section 5.4.3 of NUREG-0857, Supplement 10) in which the RCGVS and the high pressure safety injection were used to depressurize the RCS. The test was witnessed by NRC personnel.
Therefore, the staff concludes that the RCGVS is capable of depressurizing the vessel in the context and time frame of a cooldown event.
Summa of Com liance with RSB 5-1 From the preceding review the staff concludes that, although the licensee did not submit a strict benchmarking calculation of the cooldown scenario, the aggregate of the available information on the performance of the LTC code leads to the conclusion that the code is acceptable for cooldown calculations and the plant willoperate in a manner which is consistent with the.
analyses.
Therefore, the alternate method proposed by the licensee that can be used in the cooldown of the reactor vessel satisfies the requirements of Branch Technical Position RSB 5-1 and is acceptable.
3.2 Probabilistic Risk Anal sis The licensee's March 9, 1995, submittal included probabilistic risk assessments of the charging system to compare the unavailability of the charging system with and without the proposed modifications contained in the licensee's June 26, 1986, submittal. The licensee concluded that, although implementing the proposed modifications would provide a small increase in charging system reliability, there would be virtually no effect on the overall plant core damage frequency.
The licensee further concluded that the cost of the proposed modifications far outweighed the safety benefits.
In its letter dated September 16, 1997, the licerisee responded to the staff's request for additional information dated July 14, 1997, on the risk models and assumptions used to arrive at these conclusions.
Auxilia Pressurizer S ra S stem APSS Reliabilit Evaluation The APSS provides spray to the steam space in the pressurizer for maintaining operator control of RCS pressure when the normal spray is unavailable.
The APSS is used in normal operation during the final stages of shutdown and during emergency operations when the reactor coolant pumps have been tripped.
The APSS is normally supplied from the VCT via the charging pumps.
Ifthe VCT is unavailable, the charging pump suction may be supplied from the refueling water tank (RWT),
by either the boric acid makeup pumps (BAMPs), or via the RWT gravity feed line isolation valve (CHE-HV536).
The licensee performed calculations to evaluate the reliability of the past, present, and previously committed future system configurations of the auxiliary pressurizer spray system (APSS). The original design was installed in 1985.
The current configuration (as of 1994) includes upgrades consisting of train A Class 1E power to valves CH-501 (VCT outlet isolation valve) and CH-536 (RWT gravity feed line isolation valve). This modification provided power to the valves that is not automatically shed from the Class 1E bus on a safety injection actuation signal and is automatically sequenced onto the Emergency Train A bus following a loss of offsite power. The current configuration also includes enhanced automatic realignment to the reactor water tank (RWT). This modificatio changed the automatic lo-lo volume control tank (VCT) level indication realignment to the RWT gravity feed path when power is unavailable to the BAMPs and BAMP discharge isolation valve.
The current design includes more reliable VCT level instrumentation than that of the original design.
This modification installed separate reference legs, one wet and one dry, on the existing level transmitters.
In addition, a signal comparator was added to alarm in the control room ifthere was a difference in level indication between the two instruments.
Three fault tree models were developed to depict the reliabilityof the original (1985), the current (as of 1994), and the proposed modifications (described in Section 2.0 of this Safety Evaluation) of the auxiliary pressurizer spray system.
The fault tree models considered system faults that result in an inadequate borated water flowto the charging pump suction header.
The licensee limited the scope of the fault tree analysis to the charging pump suction because the proposed modifications only affect the reliability of the suction supply to the charging pumps.
In the Palo Verde Individual Plant Examination (IPE), APSS is only credited during a steam generator tube rupture (SGTR) event when reactor coolant pumps are unavailable to control and reduce RCS pressure to mitigate the primary-to-secondary leak. For an SGTR, the RCS must be depressurized to reduce the primary-to-secondary leak rate and get the plant on
~ shutdown cooling so that the SGs are not required for heat removal.
However, because either pressurizer vents or APSS can be utilized to control pressure to achieving safe shutdown conditions following an SGTR, it was considered that there is negligible decrease in SGTR-induced core damage frequency (CDF) ifAPSS reliability is improved.
On the other hand, the licensee did consider the loss of offsite power e'vents in their analysis.
A primary safety function of the APSS is to depressurize the RCS to shutdown cooling entry conditions following a loss of offsite power event. APSS is also needed ifoffsite power is available but normal pressurizer spray fails. Ifan extended loss of offsite power should occur and APSS fails, CST inventory would eventually be depleted and core damage could result.
Several conservative modeling assumptions were made by the licensee in its analysis.
The letdown system is assumed to fail to maintain flowto the charging/APSS suction header.
No credit is taken for the safety injection system cross-connect maintaining flowto the charging/APSS suction header.
When air operated valve CH-532 transfers closed (spurious transfer), no credit is taken for operator action to correct the condition.
The results of the analysis showed that the estimated APSS unavailability of the original design, the current design, and with the proposed modifications are 0.11, 0.018, and 0.00437, respectively.
These results showed that the reliability of the present APSS design improved significantly from the original design, as shown by the unavailability of 0.11 for the original design and 0.018 for the current configuration.
However, the effect of the proposed modifications on APSS reliability is small in comparison with the reliability of the current configuration.
II P
I The staff has reviewed the fault tree models and concludes that the models depicting each of the three configurations are acceptable.
Furthermore, our calculations using the licensee's fault tree models and the associated data showed that our unavailability estimates agreed with the licensee's results.
Im actonPlant Core Dama e Fre uenc The licensee conducted a further analysis to relate the improved APSS reliabilityto a reduction in plant CDF. Ifan extended loss of offsite power should occur and APSS fails, CST inventory which supplies water to the auxiliary feedwater pumps would eventually be depleted and core damage could result.
In order to estimate the benefit attained by improving APSS reliability, the licensee performed a scoping analysis.
This analysis estimated the frequency of a long-term loss of offsite power which would deplete all available CST inventory. The frequency of an extended loss of offsite power threatening the availability of CST inventory availability was estimated to be about 1.2E-5/year.
The CDF contribution was then estimated by calculating the product of this frequency and the APSS unavailability estimate.
For the current APSS configuration, the CDF contribution was estimated at 2.16E-7/year.
The CDF contribution for the proposed modifications of the APSS was estimated at 5.28 E-8/year. Thus, the CDF reduction attained by reducing the APSS unavailability by 0.014 (from 0.018 to 0.0044) can be estimated as 1.6E-7/Year.
The staff considers the estimated CDF reduction attained from the more reliable design of the proposed modification to the APSS to be very small in accordance with the acceptance guideline presented in Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."
ualit ofthe PRA The staff has reviewed the fault trees depicting each of the three APSS configurations and concludes that they are modeled adequately.
The fault tree analysis included a sufficient level of detail to model the impact of the changes from the original design and also the proposed modifications to the APSS. The staff has also reviewed the event tree modeling, the impact of the various APSS configurations and loss of offsite power events leading to CDF estimation, and finds the event tree analysis to have adequately modeled the sequences leading to core damage.
The staff has also reviewed the data used in the analysis and finds them to be consistent with the data used in the licensee's Ingividual Plant Examination (IPE). The staff had concluded that the licensee's IPE met the intent of Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities," for internal events.
As noted previously, the staffs independent analysis of the APSS reliability using the licensee's models and data showed that our APSS unavailability estimates agreed with the licensee's results.
Summa of Probabilistic Risk Anal sis Review The CDF reduction attained by reducing the APSS unavailability by from 0.018 to 0.0044 was estimated to be about 1.6E-7/Year.
The staff considers this estimate to be very small with the acceptance guidelines of Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis."
Therefore, the staff concludes that although implementing the proposed modifications would provide a small increase in APSS system reliability, the impact on the overall CDF is expected to result in very small safety benefit.
4.0 CONCLUSION
Based on the discussion in the previous section, the staff concludes that because of demonstrated system reliability, operator training and procedural controls, and the availability of an alternate method to depressurize the reactor coolant system using the reactor head vent and pressurizer vents, all licensing requirements are met with the current plant design.
The staff also concludes that implementation of the proposed modifications would result in a very small safety benefit. Therefore, the staff finds the licensee's request to not implement the charging system modifications committed to in its June 26, 1986, letter acceptable.
Principal Contributors:
L. Lois, SRXB/NRR S. Lee, SPSB/NRR Date:
March 23, 1999
t II