Text

License Amendment Request to Revise TS 3.8.1.1, A.C. Sources - Operating, to Support Maintenance and Replacement of the Millstone Unit 3 a Reserve Station Service Transformer and 345 Kv South Bus Switchyard Components
	ML19234A111
Person / Time
Site:	Millstone
Issue date:	08/14/2019
From:	Mark D. Sartain; Dominion Energy Nuclear Connecticut
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	19-282
	Download: ML19234A111 (97)
	v • d • e

Dominion Energy Nuclear Connecticut, Inc.

5000 Dominion Boulevard, G*len Allen, VA 23060 Dominion Energy.com August14,2019 U.S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

~

i.@ ? Dominion

f: a,, Energy Serial No NRA/SS Docket No.

License No.19-282 RO 5.0-336 DPR-65 LICENSE AMENDMENT REQUEST TO REVISE TS 3.8.1.1, "A. C. SOURCES -

OPERATING," TO SUPPORT MAINTENANCE AND REPLACEMENT OF THE MILLSTONE UNIT 3 'A' RESERVE STATION SERVICE TRANSFORMER AND 345 KV SOUTH BUS SWITCHYARD COMPONENTS Pursuant to 10 CFR 50.90, Dominion Energy Nuclear Connecticut, Inc. (DENC) hereby requests an amendment to Facility Operating License No. DPR-65 for Millstone Power Station Unit 2 (MPS2). The proposed amendment would revise Technical Specification (TS) 3.8.1.1, "A. C. Sources - Operating," to add a permanent Required Action (a.3) that provides an option to extend the allowed outage time (AOT) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days for one inoperable offsite circuit. This new Required Actibn is needed to complete periodic maintenance and testing of the Millstone Power Station Unit 3 (MPS3) 'A' Reserve Station Service Transformer (RSST) and other 345 kilovolt (kV) south bus switchyard components.

Since periodic maintenance and testing of these components cannot typically be completed within the current 72-hour AOT, adoption of an extended AOT reduces: 1) the number of switching evolutions required to complete the work, 2) equipment unavailability time, and 3) potential for equipment failures or human performance events. Use of this 10-day AOT will be limited to no more than once per 18 month refueling interval for MPS3.

DENC also proposes a one-time exception to the new proposed Required Action a.3 that would extend the AOT to 35 days for one inoperable offsite circuit. Use of the 35-day AOT would allow replacement of the MPS3 'A' RSST, its associated equipment, and other 345 kV south bus switchyard components that are nearing the end of their dependable service life. This work is planned to take place no later than the fall 2023 outage for MPS3 (3R22). Replacement of these components is necessary to ensure continued safe and dependable generation of electric power.

These proposed changes have been deterministically evaluated in accordance with the guidance of NUREG-0800, Branch Technical Position (BTP) 8-8, "Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions," dated February 2012.

Deviations from the deterministic criteria provided in BTP 8-8 that require supplemental risk information are supported by an evaluation consistent with Regulatory Guide (RG) 1.17 4, Rev. 3 and RG 1.177, Rev. 1.

Serial No: 19-282 Docket No. 50-336 Page 2 of 3 BTP 8-8.

Attachments 2 and 3 provide the marked-up TS and TS Bases pages, respectively. The marked-up TS Bases pages are provided for information only. The changes to the affected TS Bases pages will be incorporated in accordance with the TS Bases Control Program when this amendment request is approved. A summary of the risk management actions for the new proposed permanent TS Required Action and one-time exception is provided in Attachment 4.

An evaluation of Probabilistic Risk Assessment Model Quality is provided in Attachment 5. An External Hazards Screening is provided in Attachment 6 and a Progressive Screening Approach for Addressing External Hazards is provided in Attachment 7.

DENC has reviewed the three criteria set forth in 10 CFR 50.92(c) and determined that the proposed amendment does not involve a significant hazards consideration.

The Facility Safety Review Committee has reviewed and concurred with the determinations herein.

Issuance of this amendment is requested by August 31, 2020 with the amendment to be implemented within 60 days following NRC approval.

In accordance with 10 CFR 50.91 (b), a copy of this request is being provided to the State of Connecticut.

Should you have any questions in regard to this submittal, please contact Shayan Sinha at (804) 273-4687.

Sincerely, t~-

Mark D. Sartain Vice President - Nuclear Engineering and Fleet Support COMMONWEAL TH OF VIRGINIA COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mark D. Sartain, who is Vice President -

Nuclear Engineering and Fleet Support of Dominion Energy Nuclear Connecticut, Inc. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statements in the document are true to the best of his knowledge and belief.

Acknowledged before me this lLl~ day of A~1s+

'2019.

My Commission Expires: )V\\ard, 31, 20 2 l DIANE E. AITKEN NOTARY PUBLIC REG. #7763114 COMMONWEALTH OF VIRGINIA MY COMMISSION EXPIRES MARCH 31, 2022

~t~

Notary Public

Commitments: None Attachments:

1. Description and Evaluation of Proposed License Amendment Request

2. Mark-Up of Proposed Technical Specification Changes Serial No: 19-282 Docket No. 50-336 Page 3 of 3

3. Mark-Up of Proposed Technical Specification Bases Changes - For Information Only

4. Risk Management Action Summary

5. Probabilistic Risk Assessment Model Quality

6. External Hazards Screening

7. Progressive Screening Approach for Addressing External Hazards cc:

U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd, Suite 100 King of Prussia, PA 19406-2713 R. V. Guzman NRC Senior Project Manager U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 08 C2 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Millstone Power Station Director, Radiation Division Department of Energy and Environmental Protection 79 Elm Street Hartford, CT 06106-5127

ATTACHMENT 1 Serial No: 19-282 Docket Nos. 50-336 DESCRIPTION AND EVALUATION OF PROPOSED LICENSE AMENDMENT REQUEST DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

y Serial No: 19-282 Docket Nos. 50-336, Page 1 of 58 ATTACHMENT 1 TABLE OF CONTENTS 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION 2.1 Proposed License Amendment Request 2.2 Reason for Proposed Change _

3.0 ELECTRICAL POWER DISTRIBUTION SYSTEM DESCRIPTION 3.1 345 kV Switchyard 4.0 3.2 MPS2 to Offsite Power Sources 3.3 MPS2 Onsite AC Power System 3.4 MPS3 Onsite AC Power System 3.5 MPS2 Emergency AC Power System 3.6 MPS2 Emergency Diesel Generators 3.7 MPS2 Station Blackout (SBO) 3.8 MPS2 Appendix R 3.9 MPS2 FLEX Strategy 3.10 Switch yard Breaker 13T Background TECHNICAL EVALUATION 4.1 Selection of Extended AOT Durations 4.1.1 Permanent TS Required Action with Extended AOT (10 Day) 4.1.2 One-Time TS Required Action Exception with Extended AOT (35 Day) 4.2 Supplemental Power Source (SPS) for Extended AOTs 4.2.1 General Description 4.2.2 Initial Conditions - Electrical Power Configuration (for 1 O-Day/35-Day AOTs) 4.2.3 Initial Event Selection and Description (for 1 O-Day/35-Day AOTs) 4.2.4 Operator Actions (for 1 O-Day/35-Day AOTs) 4.2.5 SPS Sizing 4.2.6 SPS Physical Connection to MPS2 4.2.7 SPS Testing Capability 4.2.8 SPS Staffing 4.2.9 MPS2 GDC-17 Coping Capability (for 1 O-Day/35-Day AOTs) 4.2.10 MPS2 LOOP Coping Capability (for 1 O-Day/35-Day AOTs) 4.2.11 MPS2 SBO Coping Capability (for 1 O-Day/35-Day AOTs) 4.2.12 MPS2 Appendix R Coping Capability (for 10-Day/35-Day AOTs) 4.2.13 Training 4.2.14 Work Management 4.2.15 Conformance with MPS3 TS and MPS2/3 Technical Requirements

4.3 Assessment Against Draft Branch Technical Position 8-8 4.4 Plant Specific Probabilistic Risk Analysis 4.4.1 Methodology 4.4.2 Summary of Plant Specific Risk Assessment Results 4.5 Conclusions 4.5.1 Defense-in-Depth and Safety Margins Serial No: 19-282 Docket Nos. 50-336, Page 2 of 58 4.5.2 Reassessment of Cross-Tie LAR USQ #2 Conclusion (13T Position) 4.5.3 Final Conclusions

5.0 REGULATORY EVALUATION

5.1 Applicable Regulatory Requirements/Criteria 5.2 No Significant Hazards Consideration

5.3 Precedents

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

Serial No: 19-282 Docket Nos. 50-336, Page 3 of 58 Description and Evaluation of Proposed License Amendment Request 1.0

SUMMARY

DESCRIPTION Pursuant to 10 CFR 50.90, Dominion Energy Nuclear Connecticut, Inc. (DENC) hereby requests an amendment to Facility Operating License No. DPR-65 for Millstone Power Station Unit 2 (MPS2).

The proposed license amendment request (LAR) would revise Technical Specification (TS) 3.8.1.1, "A. C. Sources - Operating," to add a new permanent Required Action a.3, which provides an option to extend the allowed outage time (AOT) from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days for one inoperable offsite circuit. This new Required Action is needed to complete periodic maintenance and testing of the Millstone Power Station Unit 3 (MPS3) 'A' Reserve Station Service Transformer (RSST) and other 345 kilovolt (kV) south bus switchyard components. Since periodic maintenance and testing of these components cannot typically be completed within the current 72-hour AOT, adoption of an extended AOT reduces: 1) the number of switching evolutions required to complete the work, 2) unavailability time for the equipment, and 3) potential for equipment failures or human performance events. Use of this 10-day AOT will be limited to no more than once per 18 month refueling interval for MPS3.

DENC also proposes a one-time exception to the new proposed Required Action a.3 that would extend the AOT to 35 days for one inoperable offsite' circuit. Use of the 35-day AOT would permit replacement of the MPS3 'A' RSST, its associated equipment, and other 345 kV south bus switchyard components that are nearing the end of their dependable service life. This work is planned to take place no later than the fall 2023 outage (3R22) for MPS3.

Replacement of these components is necessary to ensure continued safe and dependable generation of electric power.

The permanent 10-day AOT and one time 35-day AOT will only be entered if the conditions specified in TS Required Action a.3 are met. Additionally, certain compensatory and risk management actions will be met during both the permanent 10-day AOT and the one-time 35-day AOT which are provided in the TS Bases (and also summarized in Attachment 4) in support of this amendment request.

2.0 DETAILED DESCRIPTION 2.1 Proposed License Amendment Request Currently Required Action a.2 of TS 3.8.1.1 "A. C. Sources - Operating," allows 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore an inoperable offsite circuit to operable status. When crediting the MPS3 Normal Station Service Transformer (NSST) as a second offsite circuit, breaker 13T and its associated disconnect switches are required to be open.

DENC proposes to revise TS 3.8.1.1, "A. C. Sources - Operating," to add a new permanent Required Action a.3, which provides an option to extend the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days to allow periodic maintenance and testing of the MPS3 'A' RSST and 345 kV south bus switchyard components.

Specifically, DENC intends to perform these maintenance activities with

Serial No: 19-282 Docket Nos. 50-336, Page 4 of 58 switchyard breaker 13T closed. The proposed TS changes are shown below (added text is italicized and balded).

a.2 Restore the inoperable offsite circuit to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (within 10 days if Required ACTION a.3 is met) or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

AND a.3 With the MPS3 'A' RSST inoperable and the MPS3 ~' NSST energized with breaker 15G-13T-2 (13T) and associated disconnect switches closed, restore either offsite circuit to OPERABLE status within 10 days* if the following requirements are met:

Within 30 days prior to entering the 10-day AOT, the availability of the supplemental power sources shall be verified.

During the 10-day AOT, the availability of the supplemental power source shall be checked once per shift.

If the supplemental power source becomes unavailable at any time during the 10-day AOT, restore to available status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

A footnote, denoted by an asterisk, will also be added as a one-time exception to the new proposed Required Action a.3 that would extend the AOT to 35 days to allow replacement of the MPS3 'A' RSST and 345 kV south bus switchyard components.

To facilitate replacement of the MPS3 'A' RSST and associated equipment, use of a one-time 35-day allowed outage time is permitted provided the requirements of Required ACTION a.3 are met. The work shall be completed no later than the end of MPS3 Refueling Outage 22 (fall 2023).

Opening breaker 13T and its associated disconnect switches results in exiting either Required Action a.2 or a.3, since this action restores the MPS3 'A' NSST to operable status as an offsite circuit.

A mark-up of TS 3.8.1.1 for the proposed changes is provided in Attachment 2.

A revision to the associated TS Bases section is provided in Attachment 3. The marked-up TS Bases pages are provided for information only. The changes to the affected TS Bases pages will be incorporated in accordance with the TS Bases Control Program after this amendment request is approved.

Serial No: 19-282 Docket Nos. 50-336, Page 5 of 58 2.2 Reason for Proposed Change To meet the requirements of General Design Criteria (GDC) 17, "Electric Power Systems,"

MPS2 uses the MPS3 'A' RSST or the MPS3 'A' NSST as its alternate offsite power source.

Therefore, when the MPS3 'A' RSST is taken out of service for required maintenance and testing, MPS2 must credit the MPS3 'A' NSST for GDC-17 compliance.

As such, switchyard breaker 13T must be open to provide adequate separation between MPS2's two offsite power sources.

Figure 1 shows the current configuration of the Millstone Power Station (MPS) offsite power sources, along with the switchyard breaker arrangement. When 13T is closed, a failure of the 13T breaker or a fault in the offsite power supply (e.g., fault on north bus) coincident with failure of the 13T breaker to trip open would cause a simultaneous loss of both MPS2 offsite circuits. For this reason, the Bases for TS 3.8.1.1 require breaker 13T to be open for the MPS3 'A' NSST to be considered an operable offsite power source for MPS2. This requirement for breaker 13T was established in the amendment for the cross-tie between MPS2 and MPS3 (Reference 1-24).

However, opening breaker 13T when MPS3 is shut down represents a degradation in the reliability of the offsite supply for MPS3. A failure such as a fault on the 345 kV line that connects to the transmission network at a point between breakers 14T and 15T (348 line circuit) would cause a loss of offsite power for MPS3 if breaker 13T is open. If breaker 13T is closed and a fault occurs on this 345 kV line, the MPS3 'A' NSST would remain energized by the north bus. Therefore, opening the 13T breaker to allow MPS2 to meet GDC-17 requirements increases the probability of a loss of offsite power at MPS3 when shut down.

Since the amendment for the MPS2/3 cross-tie, the station's sensitivity to operating at elevated shutdown risk levels has increased. The MPS3 Shutdown Risk Management program classifies risk colors of Green, Yellow, Orange and Red for key safety functions (KSF). At a high level, the risk colors are summarized as:

Green: KSF is satisfied Yellow: Some reduction exists for KSF Orange: KSF is considered degraded below normally acceptable levels Red: Margin of safety provided by KSF is lost.

In the years following the MPS2/3 cross-tie amendment, the MPS3 Shutdown Risk Management program has reassessed the configuration where the MPS3 'A' RSST is removed from service with switchyard breaker 13T open, and now characterizes it as risk color Orange.

Also, in accordance with the MPS3 shutdown risk procedure (Reference 1-27), one of the following conditions must be satisfied to open 13T with the MPS3 'A' RSST out of service:

Refueling cavity full RCS capable of being pressurized with at least two steam generators able to maintain decay heat removal capability MPS3 is defueled

Serial No: 19-282 Docket Nos. 50-336, Page 6 of 58 It should be noted that it would not be necessary to satisfy any of these conditions with the MPS3 'A' RSST out of service, if 13T is closed. Consequently, since opening 13T during MPS3 'A' RSST outages is prohibited during Mode 5 or 6 decreased inventory windows, the time to conduct necessary transformer maintenance is limited. Therefore, the proposed permanent TS Required Action and one-time exception increase the time available to conduct MPS3 *'A' RSST maintenance while minimizing operational risk at MPS2 and shutdown risk at MPS3. This results in a better overall risk management for the station and provides better defense-in-depth for MPS3 while shutdown.

Also, since the amendment for the MPS2/3 cross-tie, DENC's experience at MPS indicates that a fault on a transmission line would be a more likely event precursor than a spurious breaker internal fault. DENG has had multiple transmission line outages over the five year span preceding the submittal of this amendment request. Corrective actions have been initiated to prevent future reoccurrences of the outages, however many of the outages are related to external factors (including storm conditions, bird interactions, etc.). On the other hand, a corrective action review revealed that there have been zero spurious breaker internal faults at MPS.

The industry data compiled by the NRC in NUREG/CR-6928 (Reference 1-34) and updated through 2015 also indicates that the spurious operation failure rate of a high voltage circuit breaker is low (4.83E-07/hr).

Performing maintenance activities with breaker 13T closed (in accordance with the proposed permanent TS Required Action and one-time exception) precludes entering a configuration with an elevated shutdown risk for MPS3, while only resulting in a very small increase in the risk metrics for MPS2 (as concluded in Section 4.4).

Furthermore, the requirement to maintain a supplemental power source while in the alignment for the proposed TS Required Action and one-time exception provides additional mitigation capability in the very low likelihood event that a passive failure disables both MPS2 offsite power sources (and assuming that both EDGs fail).

Currently, with one inoperable offsite circuit (which would include aligning MPS3 'A' NSST with switchyard breaker 13T closed), MPS2 TS 3.8.1.1, Required Action a.2 requires the offsite circuit to be restored to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the unit must be placed in hot standby within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and cold shutdown within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The total amount of time required for the complete evolution to perform preventative maintenance (PMs) on the MPS3 'A' RSST and its associated components significantly exceeds 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (as discussed in Section 4.1 ).

Therefore, this LAR proposes a new permanent TS Required Action and a one-time exception with extended AOTs, which will adequately support replacement and continuous maintenance activities (and associated testing) with breaker 13T closed.

The proposed changes provide alternatives to TS Required Actions that place unnecessary administrative burdens on plant personnel that are not justified by the safety significance of the TS Required Action.

Serial No: 19-282 Docket Nos. 50-336, Page 7 of 58 3.0 ELECTRICAL POWER DISTRIBUTION SYSTEM DESCRIPTION MPS is a three unit site with two operating reactors.

Millstone Power Station Unit 1 (MPS1 ), which received its provisional operating license on October 7, 1970, was permanently shut down on July 21, 1998. MPS2, which received its initial operating license on September 26, 1975, has a licensed reactor power output of 2700 megawatts thermal (MWt) with a gross electrical output of approximately 935 megawatts electric (MWe).

MPS3, which received its initial operating license on January 31, 1986, has a licensed reactor power output of 3650 MWt with a gross electrical output of approximately 1296 MWe.

3.1 345 kV Switchyard MPS is connected to the transmission system by four 345 kV circuits (see Figure 1 ). The four 345 kV transmission lines which terminate at the Millstone switchyard are:

Line Number 348: Haddam Line Number 310: Manchester Line Number 371: Montville Line Number 383: Card The 345 kV switchyard, which is configured in a combination breaker-and-a-half and double breaker-double bus arrangement, buses together four 345 kV transmission line circuits, two generator circuits and two station service circuits. The MPS1 generator and station service circuits are no longer in service. The breaker arrangement allows the isolation of any of the four transmission lines without affecting the integrity of the switchyard.

G 348 Line North Bus South Bus Figure 1 Millstone Station AC Power System 310 Line 371 Line 383 Line Millstone 345kV Switchyard

~

MP3SBODG 3EDGA MP3 Main Generator To SBODG Load Bank 3EDGB 2EDGA C:::::::::::::: MP3 to MP2 Cross-Tie MPS3

(

MPS2

)

Serial No: 19-282 Docket Nos. 50-336, Page 8 of 58 B

MP2 RSST 2EDGB MP2 Main Generator

3.2 MPS2 to Offsite Power Sources Serial No: 19-282 Docket Nos. 50-336, Page 9 of 58 Refer to Figure 1 for current configuration of offsite power sources to MPS2.

The MPS2 design provides two offsite circuits between the switchyard and the 4160 volt (V)

Class 1 E buses. The immediately available offsite supply is the.MPS2 RSST while the alternate supply is the MPS3 'A' NSST or 'A' RSST from bus 34A or 348 via the MPS3 to MPS2 cross-tie.

The normal supply to MPS2 with the unit online is the MPS2 NSST. If this source is lost due to a plant trip, a fast bus transfer scheme connects the plant electrical system (6900 V and 4160 V) to the MPS2 RSST.

The second or alternate source of offsite power is available by manual controls to MPS3 bus 34A or 348 for 4160 V power.

This power source directly feeds bus 24E which can then be directed to either bus 24C or 240.

The MPS2 load requirement for the alternate offsite source (GDC-17) is approximately 3 MVA (Reference 1-10).

Physical separation of the offsite power sources, switchyard protection, redundancy, and the transmission system design based on load flow and stability analyses minimize the possibility of simultaneous failure of all power sources (reserve station service supply, MPS2/3 standby alternating current (AC) emergency diesel generators (EDGs), and MPS3 bus 34A or 348).

3.3 MPS2 Onsite AC Power System The 6900 V system (not shown in Figure 1) is a reliable source of power for the reactor coolant and condensate pumps. The system consists of two buses, 25A and 258 each capable of being fed from the 6900 V winding of either MPS2's NSST or RSST. The 6900 V winding of each transformer is sized to supply the full-load requirements of both buses.

The 4160 V system, shown in Figure 1, consists of five buses, 24A, 248, 24C, 240, and 24E, each consisting of a metal-clad switchgear assembly with vertical lift air circuit breakers. The 4160 V system provides a reliable source of power to large AC motors and to 480 V load centers. During plant operation, power is supplied to buses 24A and 248 from the MPS2 NSST.

Bus ties connect buses 24A and 248 to buses 24C and 240, respectively. During other periods, such as startup and shutdown when the MPS2 NSST is not used, power is supplied from the MPS2 RSST directly to buses 24C and 240 and via bus ties to buses 24A and 248. The 24E bus may be fed from either bus 24C or 240, or from MPS3's 'A' RSST or 'A' NSST via the MPS3 to MPS2 cross-tie. All auxiliary loads (other than the 6900 V motors detailed above) are supplied from the 4160 V buses. Motors of 250 horsepower and larger are connected directly to the 4160 V system, while other loads are supplied at 480 V from 4160-480 V unit substations, and 120/208 V sources are available by stepping down from 480 V.

Buses 24C, 240, and 24E are emergency buses that supply power to equipment required for a loss-of-coolant accident (LOCA) or other transients and conform to the requirements for Class 1 E equipment.

Serial No: 19-282 Docket Nos. 50-336, Page 1 O of 58 An automatic transfer scheme is provided to ensure continuity of auxiliary power from the preferred source. The transfer scheme will sense conditions resulting in, or leading to, a loss of voltage from the MPS2 NSST and will initiate a transfer for conditions such as a turbine or generator trip.

The transfer is high speed and considered simultaneous. It is not a supervised scheme.

That is, the secondary breakers for both the MPS2's NSST and RSST receive essentially simultaneous signals to open and close, respectively.

3.4 MPS3 Onsite AC Power System The MPS3 Class 1 E 4160 V system, shown on Figure 1, consists of two redundant emergency buses 34C and 340. Each bus can be supplied from the MPS3 'A' NSST, MPS3 'A' RSST, or an MPS3 EOG.

The MPS3 'A' NSST supplies power to emergency 4160 V buses 34C and 340 via normal buses 34A and 34B, respectively. During normal operation, power is supplied through the MPS3 'A' NSST from the unit generator with the generator breaker closed. The MPS3 'A' NSST has the capacity to supply 4160 V normal auxiliaries and those emergency auxiliaries (both load groups) required during normal operation up to the full output of the main generator plus the capacity to supply MPS2 GDC 17 requirements as an alternate offsite source for minimum post-accident loads.

3.5 MPS2 Emergency AC Power System The emergency power system includes that electrical distribution equipment required to support the safe shutdown and post-accident operations for MPS2.

Included in the emergency power system are the EDGs, emergency 4160 V switchgear and all extensions except those going to the normal switchgear and the MPS2 RSST. The emergency power system and equipment are Class 1 E and safety related.

Redundant safety-related loads are divided between trains so that the loss of either train does not impair fulfillment of the minimum shutdown safety requirements. There are no automatic connections between Class IE buses and loads of redundant trains.

3.6 MPS2 Emergency Diesel Generators Two physically and electrically separate, quick starting, skid-mounted EDGs are provided.

Each EOG set has the capability to initiate the engineered safety features (ESF) in rapid succession, and to supply continuously the sum of the loads needed to be powered at any one time for a LOCA. Each EOG is rated as follows:

2750 kW Continuous 3000 kW 2000 hours0.0231 days 0.556 hours 0.00331 weeks 7.61e-4 months 3250 kW 300 hours0.00347 days 0.0833 hours 4.960317e-4 weeks 1.1415e-4 months The predicted loads are within the continuous rating of the EOG.

Serial No: 19-282 Docket Nos. 50-336, Page 11 of 58 Each EOG is tied to a 4160 V emergency bus through a circuit breaker. MPS2 EOG A feeds bus 24C, while MPS2 EOG B feeds bus 240.

The EOG associated with a 4160 V emergency bus receives an automatic start signal under either of the following conditions:

a. Engineered Safety Features Actuation System (ESAS) Safety Injection Actuation Signal (SIAS)

b. ESAS Level 1 Undervoltage Actuation from the associated 4160 V emergency bus Additionally, failure of a single active component or train associated with one EOG does not result in the inability of the redundant EOG to provide the emergency standby power.

Diesel fuel oil for the EDGs is stored in an above ground diesel oil storage tank (T-148),

with an approximate capacity of 25,000 gallons. The fuel oil is transferred from the storage tank by two 25 gpm diesel fuel oil transfer pumps to the two Class I, diesel oil supply tanks (T-48A and T-48B) which are located in the structure that houses the associated EOG. The diesel oil supply tanks each have an approximate capacity of 13,500 gallons. A minimum of 12,000 gallons of fuel oil is stored in each above ground diesel oil supply tank.

3. 7 MPS2 Station Blackout (580)

MPS2 has the ability to cope with a loss of preferred and emergency on-site AC power sources for up to eight hours. MPS2 must maintain decay heat removal capability during the event. It is assumed that there will be no AC power available during the first hour of the SBO except for battery backed power supplies (i.e., vital 120 V). Within the first hour, MPS2 will have an alternate AC power source available from the MPS3 Alternate AC (SBO) diesel generator via the MPS3 to MPS2 cross-tie.

MPS2 and MPS3 each have two EDGs in addition to the SBO diesel generator. In accordance with the SBO Rule and NUMARC 87-00, one of the four EDGs would be available and a station blackout is postulated to occur at one unit only at any one time. In the event of a MPS2 station blackout, the SBO diesel will be made available within one hour by MPS3 operator action and connected to MPS2 Bus 24E by operator action.

The SBO diesel generator and its support equipment (battery, inverter, computer, ventilation, etc.) is adequately sized to power equipment required to maintain MPS2 in a safe condition in the event both the offsite power system and standby power system are unavailable for up to eight hours.

The MPS2 load requirements for the alignment to the MPS3 SBO diesel generator is less than 1.3 MVA with a maximum duration of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months (Reference 1-11 ).

Serial No: 19-282 Docket Nos. 50-336, Page 12 of 58 3.8 MPS2 Appendix R For an Appendix R fire in certain areas, MPS2 relies on MPS3 to provide power for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to the safe shutdown loads via the MPS3 to MPS2 cross-tie. MPS2 Appendix R requires that AC power for the safe shutdown loads be available within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

During an Appendix R fire at MPS2, no SBO event is assumed to occur simultaneously at MPS3.

Therefore, the SBO diesel generator will be made available within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months by MPS3 operator action and connected to MPS2 Bus 24E by MPS2 operator action.

The MPS2 load requirements for the alignment to the MPS3 SBO diesel generator for a MPS2 Appendix R scenario is less than 2.3 MVA with a maximum duration of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (Reference 1-12).

3.9 MPS2 FLEX Strategy As part of the response for EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigating Strategies for Beyond Design-Basis External Events" (Reference 1-14), MPS2 has implemented a FLEX strategy that has made available the following onsite portable diesel generators for powering ESF equipment for extended loss of AC power (ELAP), loss of ultimate heat sink (LUHS) and beyond design basis (BOB) external events (BDBEE):

Three (3) FLEX diesel generators 23.5 kW 120 V Three (3) FLEX diesel generators 500 kW 480 V (one per unit and one spare)

Any onsite 500 kW 480 V FLEX diesel generator can be used for quick connection to power emergency motor control centers for transitional phase (Phase 2) with sufficient power for a charging pump, battery charger, vital instrumentation and required ventilation in the event of a total loss of offsite and onsite AC power.

The FLEX diesel generators are independent from the MPS2 EDGs. The onsite FLEX equipment is located in the BOB storage building inside the owner controlled area but outside the existing power block. The FLEX diesel generators are of a different model and design from the MPS2 EDGs, so a common mode failure is not applicable.

For additional defense-in-depth features, there are three redundant 480 V FLEX diesel generators (only one is required per unit). Furthermore, there are three FLEX 120 V diesel generators (stored in the BOB storage building) available to power vital instrumentation panels in the event of failure to re-power 480 V bus 22F. Repowering bus 22F will allow the restoration of the following loads:

Battery Charger 201 B-1 or 201 B-2, which will repower the following:

125 voe bus 201 B via 125VDC battery 201 B Inverter 2 or 4 which will repower vital 120 V instrument panels VA20 and VA40

Charging pump P188 or P18C Boric acid pump P19A or P198 Containment air recirculation fan, F14B or F14D "B" spent fuel pool cooling pump Serial No: 19-282 Docket Nos. 50-336, Page 13 of 58 Various ventilation equipment to support HVAC area requirements for required equipment operability Regarding the onsite fuel storage capability for FLEX diesel generators, DENG uses a fuel tanker truck to provide fuel to each of the FLEX diesel powered generators. Procedure FLEX Support Guideline (FSG)-05, "Initial Assessment and FLEX Equipment Staging,"

(Reference 1-17) directs the operating crew to provide diesel fuel sources and refueling means to support the continuous operation of applicable FLEX equipment for an indefinite period. The 120 V generators have 72 gallon tanks. The 480 V generators have 500 gallon tanks, stored at a level of 75%-87.5% full.

Additionally, two portable 1 MW 4160 V generators are available from an offsite storage facility to power the 4160 V safety buses for a longer term (Phase 3 loads). The FLEX diesel generators include connecting devices and plant implementing procedures.

For the 4160 V generators, National SAFER Response Center (NSRC) stores nine units at their Memphis facility, of which MPS2 needs two (2) generators. Therefore, if any external event disabled the connected and operating 480 V FLEX diesel generator, suitable onsite 480 V diesel generators (one for each unit in the BOB storage building) and offsite 4160 V generators backups are available. The 4160 V generators are deployed from NSRC. Two 4160 V generators are required for an ELAP to power bus 240 at MPS2. By re-powering the 4160 V 240 bus, these generators can power the following equipment:

"B" or "C" service water pump, P5B or P5C "C" low pressure safety injection pump, P42B "C" containment spray pump, P43B "C" reactor building component cooling pump, P11 C "B" or "C" high pressure safety injection pump, P41 B or P41 C During the proposed permanent TS Required Action and one-time exception, DENG will utilize the FLEX diesel generators as a supplemental power source to the inoperable offsite power source. The technical evaluation to support this approach is provided in Section 4.0.

3.10 Switchyard Breaker 13T Background As shown in Figure 1, breaker 13T can be positioned to align or isolate the north bus from the line to the MPS3 Main Generator. Breaker 13T is equipped with two disconnect switches. Switch 15G-13T-4 is located between 13T and the north bus, and switch 15G-13T-8 is located between breakers 13T and 14T. The arrangement detail is illustrated in

Serial No: 19-282 Docket Nos. 50-336, Page 14 of 58 MPS2 Updated Final Safety Analysis Report (UFSAR) Figure 8.1-1 D. As stated in MPS2 UFSAR Subsection 8.1.2.2, bullet d., faults can be manually isolated with appropriate disconnect switches in less than eight hours.

MPS2 utilizes either the MPS3 'A' RSST or the MPS3 'A' NSST to meet the requirements of GDC-17 (i.e., alternate offsite source in addition to the MPS2 RSST). If the MPS3 'A' RSST is not available, MPS2 must credit the MPS3 'A' NSST, as the second offsite power supply for GDC-17 compliance. The connection for the MPS3 'A' NSST is between 345 kV breakers 13T and 14T. This connection point provides one breaker separation (i.e., 13T) between the MPS2 RSST and the MPS3 'A' NSST as the MPS2 RSST is directly tied to the north bus. If breaker 13T is closed, this alignment does not provide adequate separation between the two offsite sources to meet the GDC-17 requirement for physically independent circuits. An internal fault of the 13T breaker or a fault in the offsite power supply (e.g., fault on north bus) coincident with failure of the 13T breaker to trip open would cause a simultaneous loss of both MPS2 offsite circuits. A 13T breaker fault would result in a loss of the MPS3 'A' NSST and the north bus being stripped (i.e., breakers 7T, 4T, and 1T opening), which results in de-energizing the MPS2 RSST and renders MPS2 with no offsite sources.

To prevent this from occurring, the current MPS2 TSs require that breaker 13T be opened when the MPS3 'A' RSST is out of service to restore the required separation between the two MPS2 offsite sources. If breaker 13T is closed, MPS2 is not able to credit the MPS3

'A' NSST as the second offsite source, as defined in the MPS2 TS Bases. Per TS 3.8.1.1, maintaining 13T closed with the MPS3 'A' RSST out of service results in MPS2 declaring one offsite circuit inoperable, which currently has an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . MPS3 TS 3.8.1.1 has a 72-hour AOT when one offsite circuit is inoperable (i.e., MPS3 'A' RSST or 'A' NSST) in Mode 1-4.

As a result, 13T remains closed during MPS3 'A' RSST maintenance evolutions performed when MPS3 is in operation and both MPS2 and MPS3 would be in a 72-hour TS Required Action statement. Therefore, 13T is opened only during extended maintenance evolutions where the MPS3 'A' RSST is not required to be operable per MPS3 TS (i.e., Mode 5, 6, or defueled).

As documented in License Amendments 252 (MPS2) and 190 (MPS3) which approved the design for the cross-tie between MPS2 and MPS3 (Reference 1-24), the Nuclear Regulatory Commission (NRC) staff reviewed the proposed change and found it acceptable to increase the probability of a LOOP at MPS3, due to a fault on the offsite distribution network being considered a low probability event. The safety evaluation concluded: "The average failure rate for a single unit LOP [loss of offsite power] event occurring in the United States of America is 3.2 x 10-2 per reactor-year. When combined with the expected frequency of removing the MPS3 ['A'] RSST from service of once per MPS3 refueling outage, the probability of a LOP at MPS3 when shut down as a result of breaker 13T being open is acceptably low."

Although maintaining 13T closed does not allow the MPS3 'A' NSST to be considered an operable offsite power source for MPS2 per the description in the TS Bases, it is noted that aligning breaker 13T in this position has no adverse impact on the ability of the MPS3 'A' NSST to supply power to the 4160 V buses for MPS2/3. The requirement to consider the

Serial No: 19-282 Docket Nos. 50-336, Page 15 of 58 MPS3 'A' NSST inoperable when 13T is closed is only due to the sensitivity to loss of independence at a single point (breaker 13T).

4.0 TECHNICAL EVALUATION

4.1 Selection of Extended AOT Durations 4.1.1 Permanent TS Required Action with Extended AOT (10 Day)

During typical MPS3 outage work involving the MPS3 'A' RSST or south bus, breaker 13T is closed to minimize LOOP risk to MPS3.

However, this requires entering MPS2 TS 3.8.1.1 Required Action a.2, which limits the amount of time that breaker 13T can be closed to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . For example, during 3R 18 (fall 2017) with switchyard breaker 13T closed, MPS3 'A' RSST PM activities were broken down into two windows (each less than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ) and not all planned PM activities could be completed. Utilizing an extended AOT period reduces the number of switching evolutions, which in turn decreases the total unavailability time and limits the potential for equipment failures and human performance events.

The requested 10-day AOT will allow DENG to perform the preventative maintenance and testing on the MPS3 'A' RSST and/or the south bus components within the proposed AOT window, with breaker 13T closed.

Since the MPS3 'A' RSST ties directly into the south bus, repair work that requires removing the south bus from service also makes the MPS3 'A' RSST inoperable. Because DENG intends to perform this maintenance with breaker 13T closed, the MPS3 'A' RSST and south bus maintenance work is performed concurrently, in an effort to minimize entries into LCO 3.8.1.1. The south bus work scope includes non-discretionary continuous life-cycle maintenance activities that are greater in duration than 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . Configuration risk for removal of the south bus will be assessed and managed in accordance with the requirements of 10 CFR 50.65(a)(4).

A breakdown of the PM activities associated with a typical MPS3 'A' RSST outage is provided in Table 1-1 below. Although a three-day contingency has been added to the schedule for weather-related impacts, DENG would return the MPS3 'A' RSST to operable status as soon as practical.

1 2

3 Table 1-1 Normal Preventative Maintenance Schedule for MPS3 'A' RSST Activ.ity. D,esir:i ptipn:. C.

~"'

Enter 10-day AOT Tagout Testing of transformer, relays, disconnect switches, cables, voltage transformers, and lightning arrestors Activity D~ration

.: :.. *'(oa\\1s)

1 5

Elapsed Time

, ***(oavsl 0

1 6

4 Clear tags 5

Contingency for weather impacts on testing 1

3 Serial No: 19-282 Docket Nos. 50-336, Page 16 of 58 7

10 4.1.2 One-Time TS Required Action Exception with Extended AOT (35 Day)

The MPS3 'A' RSST and other switchyard components are reaching the end of their dependable service life. Replacement of the MPS3 'A' RSST and the 345kV switchyard south bus components will ensure continued dependable and safe generation of electrical power. The proposed one-time 35-day AOT is needed to allow sufficient time to replace the MPS3 'A' RSST and the 345 kV switchyard south bus components while permitting MPS2 to maintain normal power operation and to preclude the unnecessary transient of shutting down MPS2.

The same rationale for using an extended AOT would apply during the MPS3 'A' RSST replacement project, however the nature of the work requires a longer duration than 10 days. An evaluation of the proposed MPS3 'A' RSST replacement activities determined that 35 days is sufficient time to complete these activities with margin.

A one-time south bus repair project will be conducted for the replacement and upgrading of switches and insulators as part of life cycle management.

There are also additional components being replaced. The duration of the south bus work is greater than 10 days, but is expected to be bounded by the duration of the MPS3 'A' RSST replacement project.

The activity schedule supporting the one-time 35-day AOT is provided in Table 1-2 below.

The requested one-time 35-day AOT will be implemented by no later than MPS3 Refueling Outage 22 (fall 2023).

Table 1-2 Activity Schedule for Replacement of MPS3 RSST Activity Activity Description Activity Duration Elapsed Time No.

(Days)

(Days) 1 Enter one-time 35-day AOT 0

2 Tagout 1

1 3

Prepare 'A' RSST for removal from foundation 3

4 4

Remove 'A' RSST from foundation 2

6 5

Install new 'A' RSST on foundation 2

8 6

Prepare new 'A' RSST for vendor site 4

12 acceptance testing 7

Perform vendor site acceptance testing 3

15

Complete external connections to the 'A' RSST 8

Note: Some of these activities may be initiated in parallel to activities noted above but must be completed prior to testing 9

Perform 'A' RSST pre-energization testing 10 Clear tags 11 Perform 'A' RSST energization testing and clear tags 12 Coordination of work activities, testing and restoration of 'B' RSST and contingencies (l) 8 3

1 1

7 Serial No: 19-282 Docket Nos. 50-336, Page 17 of 58 23 26 27 28 35 (1)

MPS3 6900 V transformer 'B' RSST to be replaced along with the 4160 V transformer RSST 'A' Based on the above, DENC is requesting NRC approval for TS changes to:

1. Modify TS 3.8.1.1 Required Action a.2 to add an option to extend the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days. Use of the 10-day AOT option would allow normal maintenance and testing activities to be performed with MPS2 operating and with breaker 13T closed.

2. Add a new permanent TS 3.8.1.1 Required Action a.3 that specifies the requirements for use of a 10-day AOT option.

3. Add a one-time exception to the proposed Required Action a.3 that would extend the AOT to 35 days.

Use of the 35-day AOT would allow the MPS3 'A' RSST, its associated equipment, and 345 kV south bus switchyard components to be replaced with MPS2 operating and with breaker 13T closed.

A supplemental power source must be verified to be available before entering either the proposed permanent TS action or one-time exception, and the availability must also be periodically checked throughout the duration of the extended AOTs. Additionally, certain compensatory and risk management actions will be met during both the permanent 10-day AOT and the one-time 35-day AOT.

4.2 Supplemental Power Source (SPS) for Extended AOTs 4.2.1 General Description NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition," Branch Technical Position (BTP) 8-8, "Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions," dated February 2012 (Reference 1-5) provides deterministic guidance related

Serial No: 19-282 Docket Nos. 50-336, Page 18 of 58 to proposed AOT extensions for offsite power sources. A subsequent DRAFT of BTP-8-8 (Revision 1) was published in March 2018 (Reference 1-35).

DENC proposes to use the onsite 480 V FLEX diesel generators as the supplemental power source for the inoperable offsite circuit, to mitigate a postulated LOOP event. The FLEX diesel generators are selected as the supplemental power source because the MPS2 EDGs (which are the first line of defense) cannot be credited. DRAFT Revision 1 of BTP 8-8 lists FLEX power as an example of a source that can be credited as a supplemental power source. Other than additional testing and monitoring, the FLEX generators would not be used differently than they already are for supporting the EA-12-049 Order.

Use of FLEX power sources and FLEX strategies to maintain the defense-in-depth design philosophy of the electrical system to meet its intended safety function has been evaluated by DENC. This evaluation is detailed in the remainder of Sections 4.2 and 4.3.

4.2.2 Initial Conditions - Electrical Power Configuration (for 1 O-Day/35-Day AOTs)

In evaluating the use of a 480 V FLEX diesel generator as a supplemental power source, the initial.conditions for both the permanent 10-day and one-time 35-day AOT, are as follows:

MPS2 is assumed to be at full power operation.

MPS3 is in cold shutdown or refueling mode.

MPS3 'A' RSST is unavailable ("Path 2" on Figure 1 ).

Switchyard breaker 13T is closed The south bus is de-energized and 345 kV line 310 is assumed to be out of service.

Whenever the switchyard south bus is removed from service, the 310 line will also be removed from service to reduce the plant trip risk to MPS2 due to a fault on this line causing an MPS2 load rejection.

Additional rationale for this alignment and selection as the bounding case is provided in Section 4.2.3.

Both MPS2 offsite power sources will be energized through two separate paths (as highlighted on Figure 1) and available for use as follows:

- Preferred offsite power supply-powered from the MPS2 RSST ("Path 1" on Figure 1 ).

- Alternate offsite power supply-from MPS3 to MPS2 cross-tie powered from MPS3 'A' NSST ("Path 3" on Figure 1 ).

Although two power sources are available to be energized, the TS 3.8.1.1 Condition

a. for one inoperable offsite circuit is entered, due to sensitivity to loss of independence at a single point (breaker 13T).

MPS3 SBO diesel generator is available for connection within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

MPS2 4160 V system (including emergency buses 24C, 240 and 24E) are powered from the MPS2 NSST.

Serial No: 19-282 Docket Nos. 50-336, Page 19 of 58 MPS2 EDGs will be operable (except when required to perform surveillance testing) and protected.

MPS2 turbine driven auxiliary feedwater pump (TDAFW) will be operable and protected.

FLEX 120 V portable generators stored in the BOB storage building are available for connection to MPS2 120 V vital panels VA20 and VA40 (to provide backup capability for vital instrumentation).

FLEX 480 V portable generators stored in the BOB storage building are available for connection to MPS2 480 V bus 22F.

- As required by the new proposed permanent TS Required Action and one-time exception, the availability of the supplemental power source (two 480 V FLEX diesel generators) shall be verified within 30 days prior to entering the configuration, and then checked once per shift (detailed further in Section 4.3).

FLEX 4160 V portable generators are stored offsite but are available for connection to MPS2 4160 V bus 240.

4.2.3 Initial Event Selection and Description (for 1 O-Day/35-Day AOTs)

The scenario being evaluated in detail is a postulated fault on switchyard breaker 13T, while in the proposed permanent TS Required Action and one-time exception (with 10-day and 35-day AOTs respectively), with the MPS3 'A' RSST unavailable.

The bounding scenario is also based on the south bus and the 310 line being out of service. Three cases are discussed below to provide explanation for how the bounding scenario was selected.

Case 1 In Case 1, the MPS3 'A' RSST is unavailable and the south bus is in service. A postulated breaker 13T fault would result in loss of both TS-required offsite sources to MPS2.

Specifically, the opening of breaker 14T disables MPS3 'A' NSST, and the opening of breakers 1T, 4T, and 7T disables the MPS2 RSST. However, MPS2 would not experience a reactor trip or a LOOP since power is supplied from the MPS2 NSST (which is not considered an offsite power source per MPS2 TS 3.8.1.1 ).

Case 2 In Case 2, the MPS3 'A' RSST is unavailable, the south bus is out of service and the 310 line is in service. In this configuration, all of MPS2 output goes through breaker ST, as 9T will already be open to isolate the south bus. A breaker 13T failure in this configuration would not result in an MPS2 reactor trip or LOOP, since power is supplied from the MPS2 NSST (similar to Case 1 ). However, this alignment exposes MPS2 to a reactor trip from a fault on the 310 line, which results in the opening of breakers ST and 7T to clear the fault.

This fault would result in MPS2 having no path to the transmission network, and which causes a load rejection reactor trip. In this scenario, the north bus and the MPS2 RSST will

Serial No: 19-282 Docket Nos. 50-336, Page 20 of 58 remain energized, and the 4160 and 6900 V loads would fast transfer to the MPS2 RSST after the MPS2 load rejection trip.

Case 3 In Case 3, the MPS3 'A' RSST is unavailable, the south bus is out of service and the 310 line is out of service.

The 310 line is removed from service by opening *a manual disconnect switch 310-15G-5 (as shown on MPS2 UFSAR Figure 8.1-1D) and keeping breakers ST and 7T closed.

In this configuration, the possibility of a 310 line trip and opening of ST and 7T is eliminated and therefore, trip risk from spurious 310 line fault (from storm conditions, bird interactions, etc.) is reduced. A postulated 13T breaker fault for this configuration would result in both a reactor trip and LOOP for MPS2. This breaker fault would de-energize the north bus, resulting in a load rejection, and would de-energize the MPS2 RSST and the MPS3 'A' NSST.

Removing the 310 line from service with the south bus out of service exposes MPS2 to a LOOP after a 13T fault. However, removing the 310 line eliminates exposure to a reactor trip from a fault on this line. As previously noted, DENC's experience at MPS indicates that a fault on a transmission line would be a more likely event precursor than a spurious

'breaker internal fault. Therefore, removing the 310 line is considered an appropriate risk management action.

Because DENC intends to remove the 310 line from service whenever the south bus is out of service, Case 3 is considered to be the bounding case for detailed evaluation for a postulated breaker 13T fault. As the remainder of Section 4.2 demonstrates, MPS2 has sufficient capability to mitigate a 13T fault under the Case 3 configuration.

Following the occurrence of the LOOP event in the Case 3 configuration, the reactor will trip, and the plant will initially stabilize at slightly higher than no-load RCS temperature and pressure conditions, with decay heat removal via steam release to the atmosphere through the steam generator safety valves and/or atmospheric dump valves (ADVs).

Natural circulation of the reactor coolant system (RCS) will develop to provide core cooling and the TDAFW pump will provide flow from the condensate storage tank to the steam generators to make up for steam release.

4.2.4 Operator Actions (for 1 O-Day/35-Day AOTs)

Table 1-3 below provides a bounding ELAP timeline of operator actions to restore AC power, under the scenario where a fault on switchyard breaker 13T occurs while in the proposed permanent TS Required Action or one-time exception (with 10-day and 35-day AOTs respectively). The timeline also assumes that the south bus and the 310 line are taken out of service (as defined in Case 3 of Section 4.2.3).

It should be noted that the MPS2 EDGs would be the first line of defense for mitigating the event by providing power to the 4160 V buses to bring MPS2 to safe shutdown conditions.

The EDGs are expected to be available (except when required to perform surveillance testing) per MPS2 Limiting Condition for Operation (LCO) 3.8.1.1, which states that two

Serial No: 19-282 Docket Nos. 50-336, Page 21 of 58 EOGs shall be operable in modes 1, 2, 3, and 4.

A risk management action is also included in the TS Bases to monitor MPS2 EOG status once per shift while in the proposed permanent TS Required Action (with a 10-day) and the one-time exception (with a 35-day AOT). Plant operators will perform routine logs and monitoring at least every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure that EOG parameters and conditions are normal and will support operation.

Additionally, alarms in the control room will alert operators to abnormal conditions with the EOGs.

However, this evaluation assumes that both EOG fail and that the SBO diesel generator cannot be used, to demonstrate the additional defense-in-depth capability of the FLEX equipment to mitigate the event.

Table 1-3 Timeline of Operator Action to Restore AC Power Ill Activity Time Activity Description Start Duration Sensitive No.

Y/N 1

Event starts/EOPs entered 0

2 Start and throttle the TDAFW pump. Verify AFW 5 to 35 min Requires y

is established on-going control 3

Deploy TA-312 battery-operated field phones 14 min 30 min N

4 Deploy Rapidcasel2l for offsite communications 26 min 90 min N

5 Verify RCS isolation 20 min 10 min N

6 ELAP condition recognized and declared 45 min y

7 Initiate load stripping from 125 VDC buses 45 min 45 min y

8 Augmented staff arrive onsite 6 hrs N

9 Deploy FLEX 480 V generator and energize bus 8.5 hrs 4 hrs y

22F for repower of 120 V vital buses.

10 Deploy Rapidcom13l for offsite communications 10 hrs 2 hrs N

11 Repower 'B' or 'C' charging pumps from the 480 V 13.5 hrs 2 hrs y

power supply 12 Restore control room air conditioning 16 hrs 1 hr N

13 Deploy 4160 V NSRC generator and energize bus When N

requested 24D (1) Transmission operator will isolate faulted 13T breaker with local disconnect switches and restore offsite power to MPS2 within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Deployment of FLEX generators provides AC power defense-in-depth.

(2) Rapidcase is a portable satellite dish antenna that is powered from an Uninterruptible Power Source.

(3) Rapidcom is a portable communications trailer that is deployed from the BDB Storage Building.

Operators will respond to the LOOP event in accordance with emergency operating procedures (EOPs) to confirm RCS, secondary system, and containment conditions, and to diagnose an ELAP event. The EOPs direct operators to isolate of RCS letdown pathways,

Serial No: 19-282 Docket Nos. 50-336, Page 22 of 58 confirm natural circulation cooling, verify containment isolation, reduce DC loads on the unit's batteries, and establish electrical equipment alignment in preparation for eventual power restoration. The operators control auxiliary feedwater flow to the steam generators, establish local manual control of the steam generator AbVs, and stabilize the RCS at no-load cold leg temperature.

The operators would then be instructed to request power from MPS3, including the SBO EOG. However, the criteria of BTP 8-8 do not specifically allow the MPS3 SBO diesel generator to be credited as a supplemental power source because it does not have excess capacity to meet MPS2's LOOP safe shutdown loads and have spare capacity to support bringing MPS3 to safe and stable conditions.

For this reason, the remainder of this evaluation proceeds under the assumption that the request for power from MPS3 is denied.

The faulted 13T breaker could be isolated by opening the 13T-4 and 13T-8 disconnect switches. Opening 13T-4 allows repowering the north bus and MPS2 RSST.

Opening 13T-8 allows repowering the MPS3 terminal (from the 348 line) and the MPS3 'A' NSST which can then provide power to MPS2 via the 4160 V cross-tie (Reference 1-1 ).

As previously noted, faults can be manually isolated with appropriate disconnect switches*.in less than eight hours, which would preclude the need for aligning the 480 V or 4160 -V FLEX generators. In parallel, DENG would be deploying and connecting a 480 V FLEX diesel generator to the MPS2 electrical system if restoring power to the 345 kV switchyard north bus or the MPS3 'A' NSST were unsuccessful.

FLEX strategies are implemented in accordance with FSGs in support of the EOP 2530 "Station Blackout" (Reference 1-18) response to the event based on symptoms of the LOOP event (i.e., AC power is not expected to be restored from offsite sources or permanently installed onsite power generators for an extended period of time).

Reducing DC loads as described in the FSG procedure, extends battery life to 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months (Reference 1-37). This allows ample time to implement the primary strategy of deploying a 480 V FLEX generator (stored in the BOB storage building) for connection to 480 V bus 22F via a quick connection point. Per the FLEX strategy, the 480 V diesel generators do not need to be deployed until 8.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the event is initiated and the action is assumed to have a duration of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The action to repower the charging pumps does not need to begin until 13.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months after the event and is assumed to have a duration of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . RCS inventory makeup to prevent loss of natural circulation and reactivity control is not required for steam generator pressures greater than 120 psig, which is expected to be the case for no less than 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after initiation of the event (Reference 1-26). Therefore, the timeline contained in the existing FLEX strategy provides sufficient assurance that the RCS makeup will be functioning when required, without a need to pre-stage the FLEX 480 V diesel generators.

Repowering bus 22F will allow the restoration of the loads described in Section 3.9. The capacity of the 480 V FLEX generator is sufficient to allow the operator to place MPS2 in a safe condition in hot shutdown. Equating a safe shutdown condition with hot shutdown aligns with other MPS2 design considerations, such as high energy line break (HELB) evaluations (MPS2 UFSAR Subsection 6.1.4.1.1.4) and the control panel design criteria for

Serial No: 19-282 Docket Nos. 50-336, Page 23 of 58 the main control room (MPS2 UFSAR Subsection 7.6.4). Completion of the actions within the timeline provided in Table 1-3 (activity items 1 through 13) will allow the operators to place MPS2 in a safe shutdown conditions, using the 480 V FLEX generator.

If restoration of offsite power is unsuccessful and both MPS2 EDGs remain unavailable, DENC will contact NSRC and request delivery of the 4160 V generators and its associated control equipment to MPS and proceed to restore power using the FLEX generators. As part of the FLEX program, the 4160 V portable generators are delivered to the station from a NSRC location, when requested, to provide additional power to bring the unit to cold shutdown.

4.2.5 SPS Sizing Millstone calculation 2013-ENG-04383E2, "Millstone Station Unit 2 Beyond Design Basis -

FLEX Electrical 4160V, 480V and 120V AC System Loading Analysis" (Reference 1-9) documents the 500kW 480 V generator are adequately sized for the required loading to place MPS2 in safe shutdown conditions after a LOOP has occurred. Additionally, the two 1.1 MW 4160 V generators are adequately sized to place MPS2 in cold shutdown conditions, and can be aligned if the alternative actions are unable to restore power.

4.2.6 SPS Physical Connection to MPS2 Refer to Figures 2, 3 and 4 for the following discussion describing the physical connection points between MPS2 and the FLEX generators.

Once a 480 V FLEX generator has been deployed, it is moved from the BOB storage building to the east courtyard between MPS1 and MPS2 or its alternate location on the south side of the MPS1 radwaste building. Cables are run from the portable generator through two penetrations in the east exterior wall of the MPS1 cable vault. The cables are connected to the plug-in connection box located on the MPS1 cable vault interior wall. The connection box is permanently connected to 480 V bus 22F.

If needed, the 4160 V portable FLEX generators are deployed from the NSRC and placed east of the 'B' EOG room. Color coded cables are run from the portable generator through the exterior door of the 'B' EOG room.

The cables are connected to the diesel output terminal in cabinet C39 in place of the lifted leads from the 'B' EOG. The diesel would then be started and, when stabilized, the breakers are aligned to power 4160 V bus 240.

J Figure 2 BDB Electrical Connections 120/240 V, 480 V and 4160 V General Layout

--- I i1 1D I J I

(

o -

~\\

UNIT 2 EAST 480 SWGR RM 4160 Vl>C. GENEAAT

'r1 ALTERNATE 120 VACGEN LOCATION 4160 Vl>C DIST PANB..

120 VN:; GD.IOll.TOR D.C.ROOM

'A' D.C. R'.X)M

__i, VA20 ALTERNATE 480 VAC GEN LOCATION UNIT 1

/

BOB 4etN IECEPT1CAL

e* -~r*

~--1------'-----------'

BUS 2-40 Serial No: 19-282 Docket Nos. 50-336, Page 24 of 58

Figure 3 480 V FLEX Electrical Connections 480V LOAO CE TEF BUS 2ZF (806l EMERGENCY (6':!U

'-41JJCI l ~lil:JB !

l~iUAl

<~0~Dl 89M4

!!003'5

~ei;

~

}

8ll608 EAST 41:l0V SW ITCHG_E:A'R.

UNI T 2 CABLE \\!~

1 BKR I

I I

48i,V POfH A&E I

1 _6£~~!.fA__.'.' J. - - j_

UN[ f 1 CAat.E -~AULT OUTSIOE:

KE'!!

.c:::J BO OOIF[CATION Serial No: 19-282 Docket Nos. 50-336, Page 25 of 58

Figure 4 4160 V FLEX Electrical Connections 4160~ 8 ~S 240 2ftl}8;A

]MW I

I I

l I

416klV POAi Aal. E 1 1

I GE:NERATOR

--- ----.:::i._

~ 1.5(; 13U 2

':J::1 C 5

A 4 I J PANEi.. C :JG "9" E.OG ROO,

4I60V PORTA:B E DIS TA ! BUT I cm PANE L

~JOH'

Tha Two 11./NJ 41 & JV Ganar.>1ori. amd th<> 41 &JV Pert%JID Oi,atnb'Jhc.n Pan<H ore PTovid,od by the N ationol SAFE R Regionol Cenbcr ond Cor neded to Pane-I C".l,9 Serial No: 19-282 Docket Nos. 50-336, Page 26 of 58

4.2.7 SPS Testing Capability Serial No: 19-282 Docket Nos. 50-336, Page 27 of 58 The equipment described above, including the connecting cables and connection points, are part of the FLEX program. The FLEX program requires FLEX equipment (including connection points) to be periodically maintained and tested in accordance with Nuclear Energy Institute (NEI) guidance document 12-06 (Reference 1-19) and Institute of Nuclear Power Operations (INPO) AP 913 (Reference 1-13) to verify proper function. The onsite FLEX support equipment required to support the actions described in this LAR will have the required testing performed within 30 days of entering either the 10-day or 35-day extended AOT and will be checked for availability once during each 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months shift.

The offsite FLEX equipment will be tested and maintained in accordance with the FLEX program.

4.2.8 SPS Staffing The FLEX program has been designed to ensure that sufficient onsite staff is available to perform Phase 1 activities (defined in the FLEX program as time-sensitive actions).

Augmented staff will begin to arrive 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after the event starts to perform additional duties, as required by the FLEX program. Station personnel have been trained to perform the required duties.

4.2.9 MPS2 GDC-17 Coping Capability (for 1 O-Day/35-Day AOTs)

Per GDC-17 requirements, the alternate offsite circuit must be available in sufficient time to ensure an orderly shutdown and cooldown without any requirement to postulate a design basis accident condition.

During either extended AOT, the MPS3 to MPS2 cross-tie will remain capable of being energized from the MPS3 'A' NSST. This line is monitored and alarmed in the MPS2 control room for an undervoltage condition.

If an alarm is received, operators will determine the cause of the undervoltage condition and restore 4160 V bus 24E from an available source.

4.2.10 MPS2 LOOP Coping Capability (for 1 O-Day/35-Day AOTs)

The onsite emergency AC power system is not impacted by the plant electrical line-up configuration while in either the 10-day or 35-day extended AOT.

Both ED Gs will be operable (except when required to perform surveillance testing) and the capability to bring MPS2 to a cold shutdown condition, is not impacted. Therefore, MPS2's response to a LOOP will be unaffected when in either the 10-day or 35-day extended AOT.

4.2.11 MPS2 SBO Coping Capability (for 1 O-Oay/35-0ay AOTs)

Serial No: 19-282 Docket Nos. 50-336, Page 28 of 58 MPS2 utilizes existing EOPs to guide the control room operators through the appropriate steps to systematically cope with a total loss of AC power (i.e., SBO).

If the entry conditions for the LOOP-related EOPs are not met, the plant will transition to the SBO-related EOPs.

With MPS2 in either the 10-day or 35-day extended AOT, the MPS3 to MPS2 cross-tie will remain capable of being energized with the FLEX equipment being available in the BOB storage building. In the event of a MPS2 SBO event requiring the SBO diesel to provide power to MPS2, the standby FLEX equipment would not prevent the SBO diesel generator from being started by MPS3 operator action and connected to MPS2 bus 24E by MPS2 operator action within one hour, as presently required. The MPS3 SBO diesel generator would be available to MPS2 as long as MPS3 has one power source (EOG or offsite circuit) available.

MPS3 LCO 3.8.1.2 requires one MPS3 EOG and one offsite circuit to be operable when the unit is in mode 5 or 6.

4.2.12 MPS2 Appendix R Coping Capability (for 1 O-Oay/35-0ay AOTs)

While MPS2 is in either the 10-day or 35-day extended AOT configuration, the MPS3 to MPS2 cross-tie will remain capable of being energized with the FLEX equipment being available in the BOB storage building, from the offsite and onsite power systems.

Maintaining the FLEX equipment in standby would not prevent the SBO diesel generator from being started by MPS3 operator action and connected to MPS2 bus 24E by MPS2 operator action within three hours, as presently required.

4.2.13 Training Per the FLEX program, training is provided to the site emergency response team on emergency response strategies and implementing guidelines to respond to the ELAP event.

Personnel assigned to direct the execution of mitigation strategies for the ELAP event are required to receive the necessary training to ensure familiarity with the associated tasks and mitigating strategy time constraints.

Prior to entering either proposed permanent TS Required Action or one-time exception, pre-job briefs would be conducted to increase awareness of the risk sensitivity associated with the activity.

4.2.14 Work Management The MPS work management program ensures the configuration of plant equipment is appropriately monitored during the extended AOTs.

The Work Management program is designed to minimize risk though a blended approach of quantitative and qualitative risk assessment.

The quantitative risk assessment is

Serial No: 19-282 Docket Nos. 50-336, Page 29 of 58 performed by a risk monitor that includes quantitative insights from PRA. The qualitative risk assessment evaluates the impact of maintenance activities on KSFs by:

Identifying KSFs affected by the system, structure or component (SSC) planned for removal from service.

Considering the degree to which removing the SSC from service will impact the KSFs.

Considering the degree of redundancy and duration of the out-of-service condition.

Identifying appropriate compensatory measures, contingencies, or protective actions that could be taken for the activity under consideration, if appropriate.

For power operation, key plant safety functions are those that:

Ensure the integrity of the reactor coolant pressure boundary.

Ensure the capability to shut down.

Maintain the reactor in a safe shutdown condition.

Ensure the capability to prevent or mitigate the consequences of accidents that could result in potentially significant offsite exposures.

Examples of these key plant safety features include Containment Integrity, Reactivity Control, Reactor Coolant Heat Removal System, Reactor Coolant System Inventory Control, and Power Availability.

Work management of the transmission operator in the MPS switchyard is integrated into the MPS work control process and controls are in place for DENC to provide work task oversight when the transmission operator is performing risk activities.

4.2.15 Conformance with MPS3 TS and MPS2/3 Technical Requirements The proposed revisions to the MPS2 TSs do not necessitate any changes to the MPS3 TSs.

The proposed permanent Required Action and one-time exception can only be entered when MPS3 is shut down. Thus, MPS3 will be in MODE 5 or 6 and TS LCO 3.8.1.2 would be applicable.

MPS3 LCO 3.8.1.2 requires only one circuit between the offsite transmission network and the Onsite Class 1 E Distribution System to be operable, which would be fulfilled by the MPS3 'A' NSST. The operability of the MPS3 'A' NSST as an offsite power source for MPS3 does not require switchyard breaker 13T to be open.

MPS2 Technical Requirement (TR) 3.8.1.2 requires that the offsite lines to the MPS switchyard (310, 348, 371 and 383) be functional, when the electrical output at MPS exceeds 1650 MWe net. MPS3 TR 3.8.1 has identical requirements. As previously noted, whenever the switchyard south bus is taken out of service during a MPS3 'A' RSST outage, the 310 line will also be taken out of service (to reduce the risk to MPS2 for a plant trip due to a fault on this line causing an MPS2 load rejection). Extended inoperability of the MPS3

Serial No: 19-282 Docket Nos. 50-336, Page 30 of 58

'A' RSST (which would occur when the south bus is removed from service) is only allowed when MPS3 is in shutdown modes, per MPS3 TS 3.8.1.1. Therefore, MPS2 TR 3.8.1.2 and MPS3 TR 3.8.1, "Offsite Line Power Sources," would not be applicable (with MPS electrical output less than 1650 MWe net), which allows the offsite line 310 to be non-functional.

4.3 Assessment Against Branch Technical Position 8-8 The purpose of BTP 8-8 (Reference 1-5) is to provide guidance from a deterministic perspective in reviewing amendment requests for one-time or permanent AOT extensions for the EDGs and offsite power sources. Typically these amendment requests relate to performing online maintenance of EDGs and offsite power sources. BTP 8-8 states that a supplemental power source should be available as a backup to the inoperable EOG or offsite power source, to maintain the defense-in-depth design philosophy of the electrical system to meet its intended safety function.

DENC intends to perform maintenance of switchyard components with breaker 13T closed.

As previously noted, aligning breaker 13T in this position has no adverse impact on the ability of the MPS3 'A' NSST to supply power to the 4160 V buses. The requirement to consider the MPS3 'A' NSST inoperable when 13T is open is only due to loss of independence of both MPS2 offsite sources at a single point (breaker 13T). Both offsite sources are energized and available during the extended AOTs.

However, DENC has conservatively considered and assessed the criteria of BTP 8-8 for the proposed 10-day and 35-day extended AOTs.

The following is a list of criteria outlined in the initial revision of BTP 8-8 dated February 2012 (Reference 1-5) for an extended AOT.

Deviations from the deterministic criteria provided in the BTP 8-8 that require supplemental risk information are supported by an evaluation consistent with RG 1.174, Rev. 3 and RG 1.177, Rev. 1. The results of the risk assessments are provided in Section 4.4 and are acceptable in accordance with RG 1.17 4 and RG 1.177 criteria.

a)

The supplemental source must have the capacity to bring a unit to safe shutdown (cold shutdown) in case of a loss of offsite power (LOOP) concurrent with a single failure during plant operation (Mode 1 ).

Permanent AOT Request to 10 Days As described in Section 4.2.5 (on SPS sizing), the 480 V FLEX generators have sufficient capacity to bring MPS2 to safe shutdown in case of loss of the MPS2 preferred offsite power source and the MPS2 EDGs.

The term "cold shutdown" is supplemented in this BTP 8-8 criterion by a note stating:

"By "cold shutdown" it is not implied that the plant needs to go to cold shutdown during LOOP. The unit can remain in either hot shutdown or hot standby in accordance with its licensing basis for the short term. However if the offsite power is not recovered in a timely manner it may become necessary for the unit to go to cold shutdown, therefore

Serial No: 19-282 Docket Nos. 50-336, Page 31 of 58 the supplemental or AAC power source must have the capacity and capability to accomplish this function if needed."

As noted in Section 4.2.1, equating a safe shutdown condition with hot shutdown aligns with other MPS2 design considerations, such as HELB evaluations (MPS2 UFSAR Subsection 6.1.4.1.1.4) and the control panel design criteria for the main control room (MPS2 UFSAR Subsection 7.6.4).

DRAFT Revision 1 of BTP 8-8 revises the term "cold shutdown" to "safe and stable state," which is more consistent with the MPS2 UFSAR.

As stated in MPS2 UFSAR Subsection 8.1.2.2, bullet d., faults can be manually isolated with appropriate disconnect switches in less than eight hours.

Successful isolation of breaker 13T within eight hours would restore power, and preclude the need for aligning the 480 V or 4160 V FLEX generators.

Two 4160 V generators are stored offsite in the NSRC storage facility. These 4160 V generators would be used (as requested) to allow operators to place the unit in cold shutdown, if the alternative actions are unable to restore power. Therefore, the intent of this criterion is met.

One-Time AOT Request to 35 Days Same as above.

b)

The permanent or temporary power source can be either a diesel generator, gas or combustion turbine, or power from nearby hydro units. This source can be credited as a supplemental source, that can be substituted for an inoperable EOG during the period of extended AOT in the event of a LOOP, provided the risk-informed and deterministic evaluation supports the proposed AOT and the power source has enough capacity to carry all LOOP loads to bring the unit to cold shutdown.

Permanent AOT Request to 10 Days The supplemental power source will be the FLEX diesel generators. DRAFT Revision 1 of BTP 8-8 lists FLEX power as an example of a source that can be credited as a supplemental power source. Precedent also exists for amendments being granted for extended EOG AOTs that cite FLEX generators as a supplemental power source. One example is the Amendments 110 and 5 for Watts Bar Units 1 & 2 respectively, dated January 13, 2017 (Reference 1-36).

The 480 V FLEX diesel generators are stored onsite in the BOB storage building. The 480 V generators have sufficient capacity to bring MPS2 to a safe and stable shutdown condition. Two 4160 V generators from the NSRC storage facility would be used (as requested) to allow operators to place the unit in cold shutdown, if the alternative actions are unable to restore power. Therefore, the intent of this criterion is met One-Time AOT Request to 35 Days Same as above.

Serial No: 19-282 Docket Nos. 50-336, Page 32 of 58 c)

For plants using Alternate Alternating Current (AAC) or supplemental power sources discussed above, the time to make the AA C or supplemental power source available, including accomplishing the cross-connection, should be approximately one hour to enable restoration of battery chargers and control reactor coolant system inventory.

Permanent AOT Request to 10 Days The deployment of the 480 V FLEX diesel generator and re-powering 480 V bus 22F within the timeline described in Table 1-3 will allow operators (as directed by the appropriate FSG procedure) to restore power to recharge the battery prior to depletion and to maintain RCS inventory. However, the onsite 480 V FLEX diesel generator will be connected to MPS2 480 V bus 22F within 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months rather than one hour. Stripping of non-required DC and vital 120 V instrument loads shows that battery life is extended to 29 hours3.356481e-4 days 0.00806 hours 4.794974e-5 weeks 1.10345e-5 months (Reference 1-37), well beyond the time battery charging will be restored via repowering 480 V bus 22F. Power to charging pumps will be restored within 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months to provide RCS makeup and avoid reflux cooling per the FLEX program.

Since the battery chargers will be restored and inventory will be controlled at the time when these functions are needed per the FLEX program, the intent of this criterion is met.

One-Time AOT Request to 35 Days Same as above.

d)

The availability of AAC or supplemental power source should be verified within the last 30 days before entering extended AOT by operating or bringing the power source to its rated voltage and frequency for 5 minutes and ensuring all its auxiliary support systems are available or operational.

Permanent AOT Request to 10 Days The onsite FLEX diesel generators will be tested within 30 days prior to entering the extended AOT by bringing the power source to its rated voltage and frequency for more than 5 minutes and ensuring all its auxiliary support systems are available or operational.

The proposed Required Action a.3 includes this verification as a requirement for entry.

As noted previously, MPS2 can be placed in a safe hot shutdown condition using the 480 V FLEX diesel generators. The intent of the criterion is met, because the necessary verification is performed on the equipment needed to place MPS2 in a safe and stable state.

The offsite 4160 V generators are maintained in a ready state for shipment, as required by the FLEX program. The 4160 V generators would be used (as requested) to allow operators to place the unit in cold shutdown if the alternative actions are unable to restore power.

Therefore, no additional testing outside of the FLEX program is necessary.

One-Time AOT Request to 35 Days Same as above.

Serial No: 19-282 Docket Nos. 50-336, Page 33 of 58 e)

The plant should have formal engineering calculations for equipment s1zmg and protection and have approved procedures for connecting the AAC or supplemental power sources to the safety buses.

Permanent AOT Request to 10 Days MPS2 calculation, "Millstone Station Unit 2 Beyond Design Basis-FLEX Electrical 4160 V, 480 V and 120 V AC System Loading Analysis" (Reference 1-9) confirms the FLEX generators meet the shutdown load requirements.

Approved MPS2 FSG procedures under the umbrella of EOP-2530 "Station Blackout" (Reference 1-18) provide direction to operators for connecting the FLEX diesel generators to the MPS2 electrical system.

One-Time AOT Request to 35 Days Same as above.

f)

The EOG or offsite power AOT should be limited to 14 days to perform maintenance activities. The licensee must provide justification for the duration of the requested AOT (actual hours plus margin based on plant-specific past operating experience).

Permanent AOT Request to 10 Days DENG is requesting a permanent TS Required Action with an AOT of 10 days in order to perform required maintenance to retain the MPS3 'A' RSST and other switchyard south bus components in good operating condition. An analysis determined that 10 days (see Table 1-1) is needed (assuming a reasonable amount of time for contingency) to perform these maintenance activities.

One-Time AOT Request to 35 Days DENG is requesting a one-time AOT of 35 days in order to replace the MPS3 'A' RSST because the replacement cannot be completed within the proposed permanent 10-day AOT. An analysis determined that 35 days (see Table 1-2) is needed to complete the MPS3 'A' RSST replacement. This 35-day AOT is greater than the 14 day criterion provided in BTP 8-8.

It is listed as an exception in Table 1-4.

Additional risk information in accordance with Regulatory Guide (RG) 1.17 4 and RG 1.177 is provided in Section 4.4 to further justify this request and demonstrate that the risk is acceptably low for this one time AOT extension.

g)

The TS must contain Required Actions and Completion Times to verify that the supplemental AC source is available before entering extended AOT.

Permanent AOT Request to 10 Days The proposed permanent TS Required Action will require DENG to validate the onsite FLEX diesel generators availability by starting and loading the onsite FLEX diesel

Serial No: 19-282 Docket Nos. 50-336, Page 34 of 58 generators via a temporary load bank within 30 days prior to entering the AOT. The proposed TS Required Action also requires the availability of the onsite FLEX diesel generators to be checked once per shift.

In addition, the fuel sources for the FLEX generators used for the FLEX strategies of an ELAP event are provided from the following onsite fuel sources:

Two seismically-installed, missile-protected storage tanks located on the 38'6" elevation in the MPS2 Auxiliary Building, each with a TS minimum capacity of 12,000 gallons.

Two below-ground fuel oil (FO) storage tanks located outside the MPS3 EOG facility, each with a capacity of 32,760 gallons.

Diesel fuel in the FO storage tanks is routinely sampled and tested to assure FO quality is maintained to American Society for Testing and Materials (ASTM) standards.

As noted previously, MPS2 can be placed in a safe hot shutdown condition using the 480 V FLEX diesel generators. The intent of the criterion is met, because the specified verification is performed on the equipment needed to place MPS2 in a safe and stable state.

The offsite 4160 V generators are maintained in a ready state for shipment, as required by the FLEX program. The 4160 V generators would be used (as requested) to allow operators to place the unit in cold shutdown if the alternative actions are unable to restore power.

Therefore, no additional testing outside of the FLEX program is necessary.

One-Time AOT Request to 35 Days Same as above.

h)

The availability of the AAC or supplemental power source shall be checked every 8-12 hours (once per shift).

Permanent AOT Request to 10 Days The proposed Required Action a.3 includes a once per shift check of the supplemental power source availability as a requirement for remaining within the 10-day extended AOT. This check includes visually inspecting the 480 V FLEX diesel generators for signs of leakage, and verifying the louvres are clean and the "READY" light is illuminated. The trailer for the generators is also visually inspected to ensure it is in working condition. As noted previously, MPS2 can be placed in a safe hot shutdown condition using the 480 V FLEX diesel generators. The intent of the criterion is met, because the specified check is performed on the equipment needed to place MPS2 in a safe and stable state.

The offsite 4160 V generators are maintained in a ready state for shipment as required by the FLEX program. The 4160 V generators would be used (as requested) to allow

Serial No: 19-282 Docket Nos. 50-336, Page 35 of 58 operators to place the unit in cold shutdown if the alternative actions are unable to restore power.

Therefore, no additional checks outside of the FLEX program are necessary.

One-Time AOT Request to 35 Days Same as above.

i)

The extended AOT will be used no more than once in a 24-month period (or refueling interval) on a per diesel basis to perform EOG maintenance activities, or any major maintenance on offsite power transformer or bus.

Permanent AOT Request to 10 Days A permanent AOT of 10 days is requested to allow required preventative maintenance on the MPS3 'A' RSST and other switchyard south bus components to ensure their good operating condition no more frequently than once per 18 month refueling interval for MPS3. A risk management action is included in the TS Bases to ensure that the necessary actions are taken for future extended AOT entries.

One-Time AOT Request to 35 Days The planned one-time extended 35-day AOT will be used once for replacing the MPS3

'A' RSST and 345 kV south bus components and no later than the MPS3 refueling outage 22 (fall 2023).

j)

The pre-planned maintenance will not be scheduled if severe weather conditions are anticipated.

Permanent AOT Request to 10 Days Weather conditions will be evaluated prior to entering the extended 10-day AOT will not be entered if official weather forecasts predict severe weather conditions (i.e., tornado or hurricane warnings). Operators will monitor weather forecasts each shift during the extended AOT. If severe weather or grid instability is expected after the extended AOT begins, station managers will assess the conditions and determine the best course for returning the MPS2 alternate offsite power source to an operable status.

A risk management action is included in the TS Bases to ensure that the necessary actions are taken for future extended AOT entries.

One-Time AOT Request to 35 Days Same as above.

k)

The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or generation outage) are expected during the extended AOT.

Permanent AOT Request to 10 Days The system load dispatcher will be contacted once per day to ensure no significant grid perturbations (high grid loading unable to withstand a single contingency of line or

Serial No: 19-282 Docket Nos. 50-336, Page 36 of 58 generation outage) are expected during the extended AOT. A risk management action is included in the TS Bases to ensure that the necessary actions are taken for future extended AOT entries.

One-Time AOT Request to 35 Days Same as above.

I)

Component testing or maintenance of safety systems and important non-safety equipment in the offsite power systems that can increase the likelihood of a plant transient (unit trip) or LOOP* will be avoided. In addition, no discretionary switch yard maintenance will be performed.

Permanent AOT Request to 10 Days As part of the work management program, MPS2 will not conduct non-surveillance discretionary testing or maintenance of safety systems.

However during this AOT, work may be performed on the 345 kV switchyard south bus which requires the south bus to be taken out of service.

As described in Section 4.2.3, removing the 310 line from service with the south bus out of service exposes MPS2 to a LOOP if 13T experiences a fault.

However, removing the 310 line also eliminates exposure to a reactor trip from a fault on that line.

Performing the switchyard work during the.extended AOT as described above is a deviation from the guidance provided in BTP 8-8. It is listed as an exception in Table 1-4. Additional risk information in accordance with Regulatory Guide (RG) 1.174 and RG 1.177 is provided in Section 4.4 to further justify this request and demonstrate that the risk is acceptably low for this permanent AOT extension.

A risk management action is included in the TS Bases to ensure that the necessary actions are taken (considering the noted deviation) for future extended AOT entries.

One-Time AOT Request to 35 Days Same as above except the longer AOT is required to allow replacing the MPS3 'A' RSST and south bus switchyard components. This activity will require longer than 10 days to complete.

m) TS required systems, subsystems, trains, components, and devices that depend on the remaining power sources will be verified to be operable and positive measures will be provided to preclude subsequent testing or maintenance activities on these systems, subsystems, trains, components, and devices.

Permanent AOT Request to 10 Days Selected plant equipment will be protected during the proposed permanent TS change, based on the Tier 2 assessment in Section 4.4. DENG will continue to operate MPS2

Serial No: 19-282 Docket Nos. 50-336, Page 37 of 58 in accordance with the approved TS. A risk management action is included in the TS Bases to ensure that the necessary actions are taken for future extended AOT entries.

One-Time AOT Request to 35 Days Same as above.

n)

Steam-driven emergency feedwater pump(s) (in the case of PWR units) will be controlled as protected equipment".

Permanent AOT Request to 10 Days MPS2 will control the TDAFW pump as "protected equipment."

A risk management action is included in the TS Bases to ensure that the necessary actions are taken for future extended AOT entries.

One-Time AOT Request to 35 Days Same as above.

No.

1 2

Table 1-4 Serial No: 19-282 Docket Nos. 50-336, Page 38 of 58 Deviations from Branch Technical Position 8-8 Requiring Supplemental Risk Information BTP 8-8 Criterion Deviation Justification The EOG or offsite power AOT should be A one-time AOT of 35 days is being RG 1.174 and RG 1.177 risk information addressing this deviation is limited to 14 days.

requested.

provided in Section 4.4.

Component testing or maintenance of safety A risk management action for RG 1.174 and RG 1.177 risk information addressing this deviation is systems and important non-safety equipment performing work on the south bus with provided in Section 4.4.

in the offsite power systems that can increase line 310 out of service during the the likelihood of a plant transient (unit trip) or permanent 10-day or one-time 35-day LOOP will be avoided. In addition, no AOT is included.

discretionary switchyard maintenance will be performed.

4.4 Plant Specific Probabilistic Risk Analysis Serial No: 19-282 Docket Nos. 50-336, Page 39 of 58 Branch Technical Position (BTP) 8-8 (Reference 1-5) states that it is expected that applications for extended AOTs will contain a PRA assessment.

The risk assessment supporting this amendment request is detailed in NOTEBK-PRA-MPS2-RA.Ll.004, "PRA Input to Proposed Technical Specification 3.8.1.1 Change" (Reference 1-38), and summarized in this Section.

The risk analysis was performed in accordance with the Regulatory Guide (RG) 1.177 (Reference 1-21) risk-informed approach for evaluating TS changes.

The assessment focused on evaluating deviations from BTP 8-8 criteria that require supplemental risk information, as identified in Section 4.3.

4.4.1 Methodology RG 1.177 identifies a three-tiered approach as described below:

Tier 1: Probabilistic Risk Assessment Capability and Insights Tier 1 assesses the impact of the proposed amendment request on Core Damage Frequency (CDF), Incremental Conditional Core Damage Probability (ICCDP), Large Early Release Frequency (LERF), and Incremental Conditional Large Early Release Probability (ICLERP). To support this assessment, two aspects are considered: (1) the acceptability of the PRA and (2) the PRA insights and findings.

PRA insights and findings are generated by determining the impact of the proposed amendment request on plant risk. The scope of the PRA model used to assess the risk impact should include all hazard groups (i.e., internal events, internal flood, internal fires, seismic events, high winds, transportation events, and other external hazards) unless it can be shown that the contribution from specific hazard groups does not affect the decision.

PRA Insights and Findings Model Scope The proposed amendment request introduces a Required Action for maintaining switchyard breaker 13T closed coincident with the MPS3 'A' RSST out of service. This configuration increases the MPS2 offsite power circuit failure probability and ultimately the LOOP frequency.

The determination of hazard groups affected by the proposed amendment request and thus, the PRA model scope used for this application, is provided below:

Internal Events and Internal Flood The offsite power sources are credited with mitigating internal events and internal floods.

The MPS2-R05g model (Reference 1-28) was used to calculate the risk impact on internal events and internal floods.

The truncation limits were established in accordance with American Society of Mechanical Engineers (ASME) PRA Standard RA-Sa-2009 (per

Serial No: 19-282 Docket Nos. 50-336, Page 40 of 58 References 1-29 & 1-30). The truncation value used to calculate GDF is 1 E-11; whereas, the value used for LERF is 5E-13.

Shutdown/Refueling The proposed permanent Required Action and one-time exception are not applicable to shutdown modes (i.e., 5, 6, and defueled) since, per MPS2 TS (Reference 1-2), only one offsite circuit is required to be operable in these modes and maintaining 13T closed only affects the operability of the second offsite circuit. Consequently, there is no shutdown risk impact associated with the proposed amendment request.

Seismic MPS2 does not have a seismic PRA model and therefore, the risk impact for this hazard group will be assessed qualitatively. Per Reference 1-31, the offsite power sources [i.e.,

MPS2 RSST and MPS3 'A' NSST (or 'A' RSST)] are not listed on the seismic Safe Shutdown Equipment List (SSEL) and therefore, are not considered seismic risk mitigation equipment. Since the insulators on switchyard components have relatively high seismic fragility, a loss of offsite power is considered likely during seismic events. Therefore, the conditional seismic risk of unavailability of offsite power sources associated with the proposed amendment request is considered negligible.

Internal Fires MPS2 does not have an internal fire PRA model and therefore, the risk impact for this hazard group will be assessed qualitatively.

Per the Appendix R Compliance Report (Reference 1-32), the offsite power sources [i.e., MPS2 RSST and MPS3 'A' NSST (or RSST)] are not listed on the fire SSEL and therefore are not considered fire safe shutdown equipment.

For risk significant fire areas (including the control room, cable vault and switchgear rooms), the proceduralized fire mitigation strategy (e. g. Reference 1-16) de-energizes the MPS2 RSST to ensure that the reactor coolant pumps (RCPs) are stopped to prevent a catastrophic RCP seal failure, and to ensure that spurious operations do not result in unexpected loss of coolant from the RCS. Therefore, the conditional fire risk of unavailability of offsite power sources associated with the proposed amendment request is considered negligible.

Other External Events All other external hazard groups (i.e., not seismic or internal fire) were screened for applicability to the proposed amendment request in accordance with Generic Letter 88-20 (Reference 1-33) and updated to use the criteria in ASME PRA Standard RA-Sa-2009. provides a summary of the other external hazards screening results. provides a summary of the progressive screening approach for external hazards.

Serial No: 19-282 Docket Nos. 50-336, Page 41 of 58 In summary, the PRA model scope for the proposed amendment request includes internal events and internal floods. The risk impact will be quantitatively assessed using the MPS2-R05g model. An assessment of the quality of the PRA model is provided in Attachment 5.

Acceptance Criteria The acceptance criteria for the permanent and one-time TS changes are as follows:

Permanent Change Criteria LlCDF less than 1 E-06/yr (Reference 1-20)

LlLERF less than 1 E-07 /yr (Reference 1-20)

ICCDP less than 1 E-06 (Reference 1-21)

ICLERP less than 1 E-07 (Reference 1-21)

One-time Change Criteria ICCDP less than 1 E-06 and ICLERP less than 1 E-07 OR ICCDP less than 1 E-05 and ICLERP less than 1 E-06 with effective compensatory measures implemented to reduce the sources of increased risk Quantitative Risk Assessment The proposed permanent TS Required Action and one-time exception request maintaining switchyard breaker 13T closed coincident with the MPS3 'A' RSST removed from service.

With 13T closed and the MPS3 'A' RSST out of service, a 13T fault or a fault that de-energizes the north bus coincident with 13T failing to open results in disabling the two available MPS2 offsite power sources (i.e., the MPS2 RSST and MPS3 'A' NSST). Given successful fault isolation, MPS2 would remain online since its main generator is tied in between breakers 8T and 9T, which would both remain closed if breaker 7T opens as designed. Therefore, in this configuration, a MPS2 LOOP would only occur if an additional equipment failure caused a reactor trip.

However, the potential exists to perform maintenance on the south bus while entered into the proposed permanent TS Required Action and one-time exception configuration. To de-energize the south bus, switchyard breakers 2T, 5T, 9T, and 15T are opened. With 9T open, all the MPS2 power output would be transmitted via breaker ST.

Since the 310 transmission line ties in between breakers 7T and 8T, an interruption of that line would open the 8T breaker causing a MPS2 reactor trip. Consequently, if the south bus is de-energized coincident with the MPS3 'A' RSST out of service and 13T closed, the 310 line would also be de-energized to minimize MPS2 reactor trip risk. With the south bus and 310 line de-energized coincident with the MPS3 'A' RSST out and 13T closed, a 13T fault or a fault that de-energizes the north bus coincident with 13T failing to open results in loss of both switchyard buses and thus, a MPS2 reactor trip coupled with a LOOP.

Serial No: 19-282 Docket Nos. 50-336, Page 42 of 58 Therefore, since the consequences of a 13T fault are more severe if the configuration includes a south bus and 310 line outage, the plant configuration analyzed in the risk assessment is:

MPS3 in Mode 5, 6, or defueled MPS3 'A' RSST out of service Switchyard breaker 13T closed South bus de-energized 310 line de-energized The impact of this configuration on MPS2-R05g PRA model (Reference 1-28) inputs is assessed below:

LOOP frequency The analyzed configuration results in an increase in LOOP frequency. Four types of LOOP events are modeled in the PRA: Plant-centered, grid-related, weather-related, and consequential, which are differentiated by event severity (i.e., offsite power non-recovery probability).

The LOOP type impacted by the analyzed configuration is considered grid-related since a 13T fault would result in loss of both switchyard buses (i.e., power to the entire site) and power could not be restored for several hours. It should be noted that a 13T fault is expected to be isolated and offsite power restored to MPS2 within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months as described in MPS2 UFSAR section 8.1.2.2.d (Reference 1-1 ).

MPS3 offsite power source availability The PRA model credits one of the two MPS3 offsite power sources, either the 'A' NSST or 'A' RSST, with mitigating a plant-centered MPS2 LOOP (e.g., Reactor trip coincident with MPS2 RSST failure).

Since the MPS3 'A' NSST will be energized during the analyzed configuration, it remains capable of mitigating a plant-centered MPS2 LOOP.

Therefore, the MPS3 'A' NSST is credited within the risk assessment.

As a result, the only PRA model input affected by the proposed amendment request is the grid-related LOOP frequency, LOOPGR.

The ~LOOPGR was calculated using the following equation:

flLOOPGR = A13r fault + A.Fault & 13T fails to open

Where, A.Fault & 13T fails to open = ( A.North Bus fault + A7r fault + A4r fault + Air fault +

AMPS2 RSST fault + AMPS3 NSST fault + AMPS3 MainXFORMERs) * (P13r fails to open)

It should be noted that MPS3 will not be operating during the proposed permanent TS Required Action and one-time exception configurations. Consequently, main generator

Serial No: 19-282 Docket Nos. 50-336, Page 43 of 58 output breaker, 15G-3U-2, will be open and therefore, a fault of the output breaker is not a potential failure mechanism.

Based on industry data originally compiled by the NRC in NUREG/CR-6928 (Reference 1-34) and updated through 2015, the spurious operation failure rate of a high voltage circuit breaker is 4.83E-07/hr, the bus fails to operate failure rate is 9.55E-07/hr, the transformer fails to operate failure rate is 2.89E-06/hr, and the fail to open failure rate of a high voltage breaker is 2.83E-03/demand.

Substituting the industry failure rates into the above equation yields the following:

LlLOOPGR = 4.72E-03/yr The risk impact of the proposed permanent and one-time TS changes was then calculated by executing the MPS2-R05g PRA model as described below.

Permanent TS Change Risk Metrics (10-day AOT)

To calculate LiCDF and LlLERF, a yearly average duration of 10 days will be used based on the assumption that the proposed permanent 10-day AOT will be used no more than once per refueling interval.

For this calculation, a yearly fraction, 10/365, is applied to the LiLOOPGR calculated above yielding a value of 1.29E-04/yr. This LiLOOPGR value was then added to the baseline LOOPGR value of 1.59E-02/yr, yielding a LOOPGR frequency of 1.60E-02/yr. Substituting this value into the model yields the following:

CDFPermanent TS= 1.953548E-05/yr LE RF Permanent TS = 1.330808E-06/yr The MPS2-R05g model baseline CDF and LERF values are 1.953361 E-05/yr and 1.330591 E-06/yr, respectively. Therefore, the LlCDF and LlLERF values are:

.LlCDF = 1.87E-09/yr LlLERF = 2.17E-10/yr Per RG 1.177 (Reference 1-21 ), ICCDP and ICLERP are defined as follows:

ICCDP = [(Conditional CDF with subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) -

(baseline CDF with nominal expected equipment unavailabilities)] * [Total duration of single AOT under consideration]

ICLERP = [(Conditional LERF with subject equipment out of service and nominal expected equipment unavailabilities for other equipment permitted to be out of service by the TS) -

(baseline LERF with nominal expected equipment unavailabilities)] * [Total duration of single AOT under consideration]

Serial No: 19-282 Docket Nos. 50-336, Page 44 of 58 To calculate Conditional CDF and Conditional LERF and ultimately ICCDP and ICLERP, the baseline LOOPGR value of 1.59E-02/yr was added to the LlLOOPGR value of 4.72E-03/yr yielding a LOOPGR frequency of 2.06E-02/yr. Substituting this value into the model yields the following:

Conditional CDFProposed TS= 1.962232E-05/yr Conditional LERFProposed TS = 1.341264E-06/yr Therefore, the ICCDP and ICLERP are calculated as follows:

ICCDP = (1.962232E-05/yr - 1.953361 E-05/yr) * (10/365) yr ICCDP = 2.43E-09 ICLERP = (1.341264E-06/yr-1.330591E-06/yr) * (10/365) yr ICLERP = 2.92E-10 In summary, the proposed permanent TS change risk metrics are listed below:

LlCDF = 1.87E-09/yr LlLERF = 2.17E-10/yr ICCDP = 2.43E-09 ICLERP = 2.92E-10 Although the same configuration duration was used for the calculations, slight differences are noted between the related metrics. The difference is attributed to additional cutsets surviving the truncation value for the conditional CDF/LERF quantifications which set the component failure probability to 1.0.

These values are well below the acceptance criteria listed previously.

The proposed permanent TS change results in a very small risk increase as defined by RG 1.17 4.

One-time TS Change Risk Metrics (35-day AOT)

The only difference between the proposed permanent TS change and the one-time TS change is the AOT duration. The ICCDP and ICLERP for the one-time 35-day AOT change are calculated as follows:

ICCDP = (1.962232E-05/yr _. 1.953361 E-05/yr) * (35/365) yr ICCDP = 8.51 E-09 ICLERP = (1.341264E-06/yr - 1.330591 E-06/yr) * (35/365) yr ICLERP = 1.02E-09 These values are well below the acceptance criteria listed previously.

Tier 2: Avoidance of Risk-Significant Plant Configurations Serial No: 19-282 Docket Nos. 50-336, Page 45 of 58 Tier 2 provides reasonable assurance that risk-significant plant equipment outage configurations will not occur when specific plant equipment is out of service consistent with the proposed amendment request.

A review of the quantification results was conducted to identify significant equipment outage contributors to GDF and LERF given a grid-related LOOP. Based on the review, the following equipment should be protected during the proposed permanent and one-time TS change:

MPS2 EDGs H7 A, H7B MPS3 SBO Diesel Generator 3BGS-EG1 MPS3 Diesel-driven Fire Water Pump M7-7 (which is common to MPS2 and MPS3)

MPS2 Service Water Pumps P5A, P5B, P5C MPS2 Auxiliary Feedwater Pumps P9A, P9B, P4 MPS2 High Pressure Safety Injection (HPSI) Pumps P41A, P41 B, P41 C (and associated equipment)

The identified equipment is protected in accordance with the Protected Equipment procedures for MPS2 and MPS3.

These procedures provide instructions for usage of barriers, signs, logs, walkdowns, and other considerations for protecting equipment.

The list of equipment above is a subset of a new risk management actions bullet (item 6) that is being added to the Bases for MPS2 TS 3.8.1.1, to provide additional defense-in depth during the 10-day and 35-day AOTs.

Tier 3: Risk-Informed Configuration Risk Management Tier 3 confirms compliance with 10 CFR 50.65(a)(4), which ensures that the risk impact of out of service equipment is appropriately assessed and managed.

When entered into the proposed permanent Required Action and one-time exception, configuration risk will be assessed and managed in accordance with the requirements of 1 O CFR 50.65(a)(4). DENG has implemented real-time risk assessment technology utilizing EPRl-developed software. The software is run continuously with a unit at-power by the on-shift Shift Technical Advisor to ensure that risk is appropriately managed prior to entering any plant configuration and when emergent equipment failures occur. Configurations that approach or exceed the limits defined in NUMARC 93-01 are identified and risk management actions specified as required.

Emergent equipment failures are promptly analyzed in accordance with program requirements by the on-shift staff.

4.4.2 Summary of Plant Specific Risk Assessment Results The risk assessment results for the proposed permanent and one-time TS change are provided below. These values are well below the acceptance criteria.

Table 1-5 Serial No: 19-282 Docket Nos. 50-336, Page 46 of 58 Risk Metric Result Comparison to Acceptance Criteria for 10 day AOT 10-day Permanent AOT Extension Risk Metric Value Acceptance Criteria LiCDF 1.87E-09/yr

< 1.0E-06/yr LiLERF 2.17E-10/yr

< 1.0E-07 /yr ICCDP 2.43E-09

< 1.0E-06 ICLERP 2.92E-10

< 1.0E-07 Table 1-6 Risk Metric Result Comparison to Acceptance Criteria for 35 day AOT 35-day One-Time AOT Extension Risk Metric Value Acceptance Criteria ICCDP 8.51E-09

< 1.0E-06 ICLERP 1.02E-09

< 1.0E-07 The risk assessment concludes the following:

The proposed permanent and one-time TS changes result in a very small risk increase that satisfy the acceptance criteria of RG 1.17 4 and RG 1.177.

The proposed permanent Required Action and one-time exception configurations maintain two available MPS2 offsite sources which provide adequate defense-in-depth. The failure scenario that would disable the available offsite sources involves a very low likelihood passive failure, which has been demonstrated by the quantitative assessment to be an insignificant contributor to MPS2 risk.

The proposed amendment request primarily impacts risk associated with the internal events hazard group. The offsite power sources are not credited in the seismic safe shutdown and fire safe shutdown strategies. The proposed amendment request is considered to have negligible risk impact associated with external hazards including seismic and fire.

--- -~-- --------*

Bas-ed--c.,-n-tne-Tier -aSS8SSm8rlt 1

- -lh-8 -fOrtOwing equipment should b8 -protected during the proposed permanent and one-time TS change:

o MPS2 EDGs H7A, H7B o MPS3 SBO Diesel Generator 3BGS-EG1 o MPS3 Diesel-driven Fire Water Pump M7-7 o MPS2 Service Water Pumps P5A, P5B, P5C o MPS2 Auxiliary Feedwater Pumps P9A, P9B, P4 o MPS2 HPSI Pumps P41A, P41B, P41C The proposed Tier 2 restrictions are not credited within the quantitative risk assessment and therefore, the risk metrics are considered to be conservative.

4.5 Conclusions 4.5.1 Defense-in-Depth and Safety Margins Serial No: 19-282 Docket Nos. 50-336, Page 4 7 of 58 Defense-in-Depth for Mitigating a 13T Failure While in the Extended AOTs As detailed in Section 4.2 of this LAR, the 480 V FLEX diesel generators can be deployed in the event that the MPS2 preferred offsite power source and all MPS2 EDGs are lost.

These diesel generators can be connected to the MPS2 electrical system in a timely manner to bring MPS2 to a safe and stable shutdown. However, during this postulated event, additional alternate means to mitigate the event could be reasonably expected to be available to the operator. These capabilities are summarized as follows:

The MPS2 EDGs would be the first line of defense for mitigating the event. Either MPS2 EOG can provide power to a 4160 V bus (24C or 240), to bring MPS2 to a safe and stable shutdown condition. The MPS2 EDGs are expected to be available (except when required to perform surveillance testing) per MPS2 LCO 3.8.1.1, which states that two EDGs shall be operable in modes 1, 2, 3, and 4. A risk management action is also included in the TS Bases to monitor MPS2 EOG status once per shift.

However, the evaluation in Section 4.2 of this LAR assumes that both EOG fail, in order to demonstrate the additional capability of the FLEX equipment.

In parallel with aligning the EOG or 480 V FLEX diesel generators, the operator would initiate action to isolate the faulted 13T breaker. This is accomplished by opening the 13T-4 and 13T-8 disconnect switches.

o Opening the 13T-4 allows repowering the north bus and MPS2 RSST.

o Opening 13T-8 allows repowering the MPS3 terminal (from 348 line) and the MPS3 'A' NSST, which can then provide power to MPS2 via the 4160 V cross-tie.

As stated in MPS2 UFSAR Subsection 8.1.2.2, bullet d., faults can be manually isolated with appropriate disconnect switches in less than eight hours. Successful isolation of breaker 13T within eight hours would preclude the need for aligning the 480 V or 4160 V FLEX generators.

The MPS3 SBO diesel generator would be available to provide 4160 V power to the MPS2 electrical system to maintain MPS2 in a safe condition in the event both the offsite power system and standby power system are unavailable for up to eight hours. The MPS3 SBO diesel generator would be available to MPS2 as long as MPS3 has one power source (EOG or offsite circuit) available. MPS3 LCO 3.8.1.2 requires one MPS3 EOG and one offsite circuit to be OPERABLE when the unit is in MODES 5 and 6. It should be noted that the criteria of BTP 8-8 do not specifically allow the MPS3 SBO diesel generator to be credited as a supplemental power source, because it does not have capacity to meet both MPS2's LOOP safe shutdown loads and have spare capacity to support bringing MPS3 to a safe and stable condition.

Serial No: 19-282 Docket Nos. 50-336, Page 48 of 58 The 4160 V generators from the NSRC location can provide the capability to allow operators to place MPS2 in cold shutdown, if the alternative actions are unable to restore power.

Safety Margins DENG proposes to revise TS 3.8.1.1, "A. C. Sources - Operating," to add a new permanent Required Action a.3, which provides an option to extend the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days (with a one-time 35 day exception) to allow periodic maintenance and testing of MPS3 'A' RSST and switchyard components.

Specifically, DENG intends to perform this maintenance with breaker 13T closed. As previously noted, aligning breaker 13T in this position has no adverse impact on the ability of the MPS3 'A' NSST to supply power to the 4160 V buses. The requirement to consider the MPS3 'A' NSST inoperable when 13T is open is only due to loss of independence of both MPS2 offsite sources at a single point (breaker 13T).

Therefore, two offsite sources are energized and available as required during the extended AOTs. If breaker 13T fails (which would result in loss of both offsite sources), the breaker can be manually isolated with appropriate disconnect switches. As stated in MPS2 UFSAR Subsection 8.1.2.2, bullet d., breaker faults can be isolated in less than eight hours.

Successful isolation of breaker 13T within eight hours would restore power, and preclude the need for aligning the 480 V or 4160 V FLEX generators.

A loss of all AC power event would require a loss of both offsite power circuits and also the loss of both onsite EDGs.

Power supply defense-in-depth is provided with the existing FLEX program, which includes equipment, procedures, and training.

Therefore, safety margins are maintained during the extended AOTs.

4.5.2 Reassessment of Cross-Tie LAR USQ #2 Conclusion (13T Position)

A LAR (Reference 1-25) was submitted on August 25, 2000 related to the replacement of the existing MPS1 to MPS2 4160 V cross-tie with a new MPS3 to MPS2 4160 V cross-tie.

This modification was needed to support decommissioning of MPS1.

While the modification was considered to be safe, the associated 10 CFR 50.59 review identified four unreviewed safety questions (USQs). For this reason, a LAR was submitted to request that the NRC review and approve the USQs.

USQ #2 of the previous LAR related to positioning of switchyard breaker 13T. The LAR notes that opening breaker 13T when MPS3 is shut down represents a degradation in the reliability of the offsite supply for MPS3. A failure such as a fault on the 345 kV line that connects between breakers 14T and 15T (348 line circuit) would cause a loss of offsite power for MPS3 if breaker 13T is open. If breaker 13T is closed and a fault occurs in the 345 kV line, the MPS3 'A' NSST would remain energized by the north bus. Therefore, opening the 13T breaker to allow MPS2 to meet GDC-17 requirements increases the probability of a loss of offsite power at MPS3 when shut down.

This increases the probability of a malfunction of equipment important to safety at MPS3.

Serial No: 19-282 Docket Nos. 50-336, Page 49 of 58 The previous LAR also states in evaluation of USQ #2, that a loss of offsite power at MPS3 due to a fault in the offsite distribution network is a low probability event. When combined with the expected frequency of removing the MPS3 'A' RSST from service of once per MPS3 refueling outage, the probability of a loss of offsite power at MPS3 when shut down as a result of breaker 13T being open is low. In addition, the MPS3 shutdown risk program will evaluate the impact of removing the MPS3 'A' RSST from service and plan accordingly.

This will ensure the MPS3 'A' RSST will be removed from service when the shutdown risk is determined to be acceptably low. If the MPS3 'A' RSST must be removed from service, and plant conditions do not support opening breaker 13T, it will be necessary for MPS2 to enter the Required Actions of LCO 3.8.1.1 for one inoperable offsite circuit.

This will require restoration of the inoperable offsite circuit within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , or MPS2 will be required to shut down. Therefore, operation of MPS3 with 13T open to allow MPS2 compliance with GDC-17 requirements is safe.

The NRC staff reviewed and approved the design for the cross-tie between MPS2 and MPS3 (Reference 1-24) in License Amendments 252 (MPS2) and 190 (MPS3). The NRC staff concurred that opening the 13T breaker to allow MPS2 to meet GDC-17 requirements increases the probability of a LOOP at MPS3 when shut down but found the change acceptable because the increase in the probability of a LOOP at MPS3 due to a fault in the offsite distribution network is considered a low probability event. The safety evaluation concluded: "The average failure rate for a single unit LOP [loss of offsite power] event occurring in the United States of America is 3.2 x 10-2 per reactor-year. When combined with the expected frequency of removing the MPS3 ['A'] RSST from service of once per MPS3 refueling outage, the probability of a LOP at MPS3 when shut down as a result of breaker 13T being open is acceptably low." Additionally, the NRC staff noted that the licensee has an MPS3 shutdown risk program that will evaluate the impact of removing the MPS3 'A' RSST from service, and plan accordingly.

Since the submittal of the LAR for the MPS2/3 cross-tie, the station's sensitivity to operating at elevated shutdown risk levels has increased. DENC's experience at the MPS indicates that a fault on a transmission line would be more likely event precursor than a spurious breaker internal fault.

A quantitative risk assessment of the likelihood of such an event was not included as part of the previously submitted LAR.

As part of the justification for this LAR, DENC has evaluated the grogosed germanent TS Reguired Action and one-time excegtion (.~w~h~ic~h~~~~

model the fault of an initially closed breaker 13T) and has found that the results satisfy the acceptance criteria of RG 1.17 4 and RG 1.177.

The conclusion from the NRC staff's safety evaluation on the previously submitted LAR remains valid, in stating that operation of MPS3 with 13T open is safe.

However, performing maintenance activities with breaker 13T closed (in accordance with the proposed permanent TS Required Action and one-time exception) precludes entering a configuration with an elevated shutdown risk for MPS3, while only resulting in a very small increase in the risk metrics for MPS2.

Furthermore, the requirement to maintain a supplemental power source while in the alignment for the proposed permanent TS Required Action and one-time exception provides additional mitigation capability in the very low likelihood event that a passive failure disables both MPS2 offsite power sources.

4.5.3 Final Conclusions Serial No: 19-282 Docket Nos. 50-336, Page 50 of 58 The proposed permanent TS Required Action and one-time exception require the 480 V FLEX diesel generators to be available as supplemental power sources. The availability of the 480 V FLEX diesel generators to connect to the MPS2 electrical distribution system within the required time frame will ensure a reasonable balance is preserved between prevention of core damage, prevention of containment failure and consequence mitigation while in the proposed permanent TS Required Action and one-time exception.

The proposed permanent TS Required Action and the one-time exception will not significantly reduce the effectiveness of any of the layers of defense that exist in the MPS2 plant design.

The proposed change will not adversely impact MPS2's response to LOOP, SBO, or Appendix R events.

Performing maintenance activities with breaker 13T closed (in accordance with the proposed permanent TS Required Action and one-time exception) precludes entering a configuration with an elevated shutdown risk for MPS3, and only results in a very small risk increase for MPS2 that satisfies the acceptance criteria of RG 1.17 4 and RG 1.177. The proposed amendment request primarily impacts risk associated with the internal events hazard group. The offsite power sources are not credited in the seismic safe shutdown and fire safe shutdown strategies. The proposed amendment request is considered to have negligible risk impact associated with external hazards including Seismic and Fire. The configuration associated with the proposed permanent TS Required Action and one-time exception maintains two available MPS2 offsite sources which provide adequate defense-in-depth. The failure scenario that would disable the available offsite sources involves a very low likelihood passive failure, which has been demonstrated by the quantitative assessment to be an insignificant contributor to MPS2 risk.

Furthermore, the requirement to establish and maintain a supplemental power source while in the alignment for the proposed permanent TS Required Action and one-time exception provides additional mitigation capability, in the very low likelihood of a passive failure.

MPS2 and MPS3 also have several alternate means to mitigate a postulated passive breaker failure. These capabilities would be reasonably expected to be available to the operator, and result in additional defense-in-depth.

5-;0~REGH~A-"F0R¥-EV-AH:.IA-"Fl0N--------------------

5.1 Applicable Regulatory Requirements/Criteria On February 20, 1971, the Atomic Energy Commission published in the Federal Register the General Design Criteria [GDC] for Nuclear Power Plants.

The GDC, which are contained in Appendix A of 10 CFR 50, establish minimum requirements for the principal design criteria for water-cooled nuclear power plants. Although MPS2 was designed and licensed to the GDC, as issued on July 11, 1967, DENG has attempted to comply with the intent of the newer GDC to the extent possible, recognizing previous design commitments.

Serial No: 19-282 Docket Nos. 50-336, Page 51 of 58 The current regulatory requirements of 10 CFR 50, Appendix A, applicable to the proposed license amendment are:

GDC-5, Sharing of Structures, Systems, and Components GDC-17, Electric Power Systems GDC-18, Inspection and Testing of Electric Power System MPS2 is designed and licensed to IEEE Standard 308-1971.

GDC-5, Sharing of Structures, Systems and Components The offsite power system switchyard is common to both Units 2 and 3. This was previously evaluated in the MPS3 SER and determined to be acceptable by the NRC based on GDC-17 allowance of a common switchyard between units.

GDC-17, Electric Power Systems GDC-17 requires an onsite electric power system and an offsite electric power system shall be provided to permit the functioning of structures, systems, and components important to safety. The safety function for each system (assuming other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limit and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The onsite electric power supplies, including the batteries and the onsite electric distribution system shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Electric power from the transmission network to the onsite electric distribution systems shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits

sbalLbe_designed_to_b_e_a:y_aiJabJeJo__sufficient time following a loss of all onsite alternating *----

current power supplies and other offsite electric power circuit, to assure the specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity and other vital safety functions are maintained. Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with the loss of power generated by the nuclear power unit, the loss from the transmission network, or the loss of power from the onsite power supplies.

GDC-18, Inspection and Testing of Electric Power System Serial No: 19-282 Docket Nos. 50-336, Page 52 of 58 GDC-18 requires electric power systems important to safety be designed to permit appropriate periodic inspection and testing to assess the continuity of the systems and condition of their components.

5.2 No Significant Hazards Consideration Pursuant to 10 CFR 50.90, Dominion Energy Nuclear Connecticut, Inc. (DENC) is requesting an amendment to Operating License DPR-65 for Millstone Power Station Unit 2 (MPS2). The proposed amendment would revise Technical Specification (TS) 3.8.1.1, "A.

C. Sources - Operating," to:

1.

Modify TS 3.8.1.1 Required Action a.2 to add an option to extend the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days. Use of the 10-day AOT option would allow normal maintenance and testing activities to be performed with MPS2 operating and with breaker 13T closed.

2.

Add a new permanent TS Required Action a.3 that specifies the requirements for use of a 10 day AOT option. This option is needed to complete periodic maintenance and testing of the Millstone Power Station Unit 3 (MPS3) 'A' Reserve Station Service Transformer (RSST) and other 345 kV south bus switchyard components.

Since periodic maintenance and testing of these components cannot be completed within the current 72-hour AOT, use of an extended AOT reduces: the number of switching evolutions required to complete the work, equipment unavailability time, and potential for equipment failures or human performance events. Use of this 10-day AOT will be limited to no more than once per 18 month refueling interval for MPS3.

3.

Add a one-time exception to the proposed Required Action a.3 that would extend the AOT to 35 days AOT for one inoperable offsite circuit. Use of the 35-day AOT would allow replacement of the MPS3 'A' RSST, its associated equipment, and other 345 kV south bus switchyard components that are nearing the end of their dependable service life. This work is planned to take place no later than the fall 2023 outage (3R22).

Replacement of these components is necessary to assure continued safe and dependable generation of electric power.

DENC has determined that the proposed amendment does not involve a significa,n~t~~~~

hazards consideration under the standards set forth in 10 CFR 50.92(c). Specifically, a proposed amendment to an operating license involves no significant hazards consideration if operation of the facility in accordance with the proposed amendment would not:

1. Involve a significant increase in the probability or consequences of an accident previously evaluated; or

2. Create the possibility of a new or different kind of accident from any accident previously evaluated; or

3. Involve a significant reduction in a margin of safety.

Serial No: 19-282 Docket Nos. 50-336, Page 53 of 58 In support of this determination, an evaluation of each of the three criteria set forth in 10 CFR 50.92(c) is provided below regarding the proposed license amendment.

Criterion 1 Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No Currently, MPS2 TS 3.8.1.1 provides an AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for the configuration where switchyard breaker 13T is closed coincident with the MPS3 'A' RSST out of service. The proposed amendment would add a new permanent TS Required Action that provides an option to extend the AOT from 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to 10 days and a one-time exception to extend the AOT to 35 days to support MPS3 'A' RSST and south bus switchyard component replacement activities no later than fall 2023 (3R22).

For both AOTs, the design basis accidents will remain the same postulated events described in the MPS2 Updated Final Safety Analysis Report (UFSAR).

The proposed amendment would improve shutdown safety by reducing the likelihood of a loss of offsite power event at MPS3 while limiting the MPS2 core damage frequency increase to a very small value that meets the requirements of Regulatory Guide (RG) 1.174, Revision 3 and RG 1.177, Revision 1 for the bounding postulated failure.

In addition, adding a permanent TS Required Action with an extended AOT of 10 days and a one-time AOT of 35 days will not impact the consequences of an accident previously evaluated. The consequences of previously evaluated accidents are the same during the proposed 10-day and 35-day AOTs as during the current 72-hour AOT. The ability of the remaining onsite AC sources to mitigate the consequences of an accident will not be affected since no additional failures are postulated while MPS2 is in the TS AOT. The remaining AC sources are sufficient to mitigate the consequences of any design basis accident.

The proposed change will not adversely impact MPS2's response to LOOP, SBO, or Appendix R events.

Therefore, the proposed change does not involve a significant increase in the probability or

~----------=c::....::o___:__nc..::_sequences of an accident previously evaluated.

Criterion 2 Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed amendment does not affect the configuration or operation of the plant, or the manner in which the electrical distribution subsystems provide plant protection.

The proposed amendment only provides an option to extend the time period that one of the offsite circuits can be inoperable. The proposed permanent TS Required Action and one-

Serial No: 19-282 Docket Nos. 50-336, Page 54 of 58 time exception with extended time durations for one offsite circuit being inoperable have no direct physical impact on the plant and does not create any new accident initiators. Other sources of onsite AC power remain available. The possible impacts that the inoperable equipment may have on supported systems was previously analyzed in the UFSAR. The impacts of inoperable support systems were also previously assessed, and any accident initiators created by the inoperable systems were evaluated.

Adding a proposed new Required Action and a one-time exception for MPS2 TS 3.8.1.1 does not create any additional accident initiators for the plant.

The proposed amendment would improve shutdown safety by reducing the likelihood of a loss of offsite power event at MPS3 while limiting the MPS2 core damage frequency increase to an acceptably small value that meets the requirements of RG 1.174, Revision 3 and RG 1.177, Revision 1.

The proposed amendment does not change any existing accident scenarios, nor create any new or different kind of accident.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

Criterion 3 Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No The existing AOT of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for one inoperable offsite circuit was established to ensure that sufficient safety-related equipment is available for response to all accident conditions and that sufficient decay heat removal capability is available for a Loss of Coolant Accident (LOCA) coincident with a Loss of Offsite Power (LOOP) on one unit and simultaneous safe shutdown of the other unit. Although a very slight reduction in the margin of safety may be incurred during the proposed permanent Required Action and one-time exception with extended AOTs (permanent 10-day and one-time 35-day), this slight reduction is not significant due to the low probability of an event occurring during the extended period.

Other sources of onsite AC power remain available and operable during the extended AOTs. The small reduction in safety margin resulting from using tne 1-0-aay an-d-35-day----

AOTs is not significant because the remaining operable EDGs, the station blackout diesel, and the FLEX diesel generators are available and provide sufficient defense-in-depth to support the station's electrical configurations during the extended AOTs.

The proposed amendment does not affect the acceptance criteria for any analyzed event nor is there a change to any safety limit.

The proposed change does not affect any structures, systems or components or their capability to perform their intended functions.

The proposed change does not alter the manner in which safety limits, limiting safety system settings, or limiting conditions for operation are determined.

Neither the safety analyses nor the safety analysis acceptance criteria are affected by this change.

The

Serial No: 19-282 Docket Nos. 50-336, Page 55 of 58 proposed amendment will not result in plant operation in a configuration outside the current design basis.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Conclusion Based upon evaluation of these criteria, DENG concludes that the proposed amendment presents no significant hazards under the standards set forth in 10 CFR 50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.3 Precedents The use of a one-time offsite power source AOT greater than 14 days is similar in fundamental aspects to those referenced in this NRG Safety Evaluation Report:

Surry Power Station, Unit Nos. 1 and 2 -

Issuance of Amendment Regarding Technical Specifications Section 3.16, "Emergency Power System," for a Temporary 21-Day Allowed Outage Time (EPID L-2017-LLA-0380)," dated October 5, 2018, ADAMS Accession# ML18261A099 The use of FLEX generators as a supplemental power source for an extended emergency diesel generator AOT is similar in fundamental aspects to those referenced in this NRG Safety Evaluation Report:

Watts Bar Nuclear Plant, Unit Nos. 2 and 3 - Issuance of Amendment Regarding Extension of Completion Time for Inoperable Diesel Generator (CAC Nos. MF7147 and MF7148)," dated January, 13, 2017, ADAMS Accession# ML17006A271

6.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with

_____ resp_e_cLto installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement*-.----

However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure.

Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

7.0 REFERENCES

Serial No: 19-282 Docket Nos. 50-336, Page 56 of 58 1-1.

Millstone Power Station Unit 2 Final Safety Analysis Report, Rev. 36.3 Section 8.1.2.2.d.4.

1-2.

Millstone Power Station Unit 2 Technical Specifications, Including Change No. 397.

1-3.

GDC 5, "Sharing of Structures, Systems and Components."

1-4.

GDC 17, "Electric Power Systems."

1-5.

NRG Standard Review Plan Branch Technical Position 8-8, "Onsite (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions,"

Initial, February 2012, ADAMS Accession# ML113640138 1-6.

Regulatory Guide 1.93, "Availability of Electric Power Sources."

1-7.

Regulatory Guide 1.55, "Station Blackout."

1-8.

Millstone Calculation No. 97-ENG-01775E2, "Battery 201 Band Charger Associated Cable Device Electrical Verification Calculation," Rev. 3 through Addendum H.

1-9.

Millstone Calculation No. 2013-ENG-04383E2, "Millstone Station Unit 2 Beyond Design Basis-FLEX Electrical 4160V, 480V and 120V AC System Loading Analysis,"

Rev. 2.

1-10. Calculation No. PA079-126-01027E2, "MPS2 EOG Loading" Rev. 03 through Addendum K.

1-11. Calculation No.MPS2-ENG-ETAP-04014E2, "MPS2 Electrical Distribution System Analysis," Rev. 3 through Addendum P.

1-12. Calculation No. 98-ENG-02132E2, "Appendix R Loading," Rev. 01 through Change No. 4.

1-13. INPO AP 913, Revision 3, Equipment Reliability Process Description, Institute of Nuclear Power Operations, March 2011.

1-14. EA-12-049, "Order Modifying Licenses with Regard to Requirements for Mitigating Strategies for Beyond Design-Basis External Events."

1-15. EOP-2528, "Loss of Offsite Power/Loss of Forced Circulation," Millstone Power i~------~S=ta'""'t.._._,.io"--'--n-'---=U_._._n~it--=2'-"E=-'-m~ergency Operating Procedure, Rev. 21.

1-16. MP-PROC-OPS-AOP2579A Rev. 12, "Fire Procedure for Hot Standby Appendix R Fire Area R-1."

1-17. FLEX Procedure EOP 25 FSG-05, "Initial Assessment and FLEX Equipment Staging," Rev. 5.

1-18. EOP 2530, "Station Blackout", Millstone Power Station Unit 2 Emergency Operating Procedure, Rev. 17.

1-19. NEI, "Diverse and Flexible Coping Strategies (FLEX) Implementation Guide", NEI 12-06, Revision 0, August 2012.

1-20. Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis", Rev. 3.

Serial No: 19-282 Docket Nos. 50-336, Page 57 of 58 1-21. Regulatory Guide 1.177, "An Approach for Plant-Specific, Risk-Informed Decision Making: Technical Specifications," Rev. 1.

1-22. NRC Letter Dated September 20, 2018 to Mr. David Crawley, "UPDATED STAFF ASSESSMENT OF NATIONAL SAFER RESPONSE CENTERS ESTABLISHED IN RESPONSE TO ORDER EA-12-049" 1-23. FLEX Procedure EOP 25 FSG-04, "ELAP DC Bus Load Shed/Management," Rev. 1.

1-24. Millstone Nuclear Power Station, Unit Nos. 2 and 3 - Issuance of Amendment Re:

4160-Volt Electrical Cross-Tie Line (TAC Nos. MA9853 and MA9855)," dated December 21, 2000, ADAMS Accession# ML003779587.

1-25.

Millstone Nuclear Power Station, Unit Nos. 2 and 3, License Amendment Request "Proposed Revision to Final Safety Analysis Reports - 4160 Volt Cross-Tie of MP3 to MP2," dated August 25, 2000, ADAMS Accession# ML003743841-26. ETE-CPR-2014-1008, "Millstone Power Station Unit 2 & 3 Beyond Design Basis FLEX Validation for Time Sensitive Actions (TSA's)"

1-27. OU-M3-201, "Shutdown Safety Assessment Checklist," Revision 26 1-28. NOTEBK-PRA-MPS2-MC.1, "MPS2-R05g Interim Model Development," Revision 3 1-29. NOTEBK-PRA-MPS2-RA.029, "Interim Model MPS2-R05g PRA Quantification Notebook," Revision 0 1-30. NOTEBK-PRA-MPS2-LE.1, "Level 2 Analysis," Revision 7 1-31. Millstone Unit 2 SQUG Project, Safe Shutdown Equipment List (SSEL), Report No:

03-0240-1367, Revision 4 (MP2 Calculation 03-0240-1367, Rev 4, US A-46 Safe Shutdown Paths.pdf) 1-32. 25203-SP-M2-SU-1046, "MP2 Appendix R Compliance Report," Revision 1 1-33. Generic Letter 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities - 10 CFR 50.54(f), Supplement 4," USNRC, June 1991 1-34. NUREG/CR-6928, "Industry-Average Performance for Components and Initiating Events at U.S. Commercial Nuclear Power Plants," Component Reliability 2010, February 2012 1-35. NRC Standard Review Plan DRAFT Branch Technical~Posifiof18=-8-, "Ons,te (Emergency Diesel Generators) and Offsite Power Sources Allowed Outage Time Extensions," Revision 1, March 2018, ADAMS Accession #ML18169A214 1-36. Watts Bar Nuclear Plant, Unit Nos. 2 and 3 - Issuance of Amendment Regarding Extension of Completion Time for Inoperable Diesel Generator (CAC Nos. MF7147 and MF7148)," dated January, 13, 2017, ADAMS Accession# ML17006A271 1-37. ETE-CEE-2012-1001, "Millstone Beyond Design Basis DC Load Shedding Strategy and Analysis for extended SBO Event" 1-38. NOTEBK-PRA-MPS2-RA.Ll.004, "PRA Input to Proposed Technical Specification 3.8.1.1 Change" Revision 2

Serial No: 19-282 Docket Nos. 50-336, Page 58 of 58 1-39. Surry Power Station, Unit Nos. 1 and 2 -

Issuance of Amendment Regarding Technical Specifications Section 3.16, "Emergency Power System," for a Temporary 21-Day Allowed Outage Time (EPID L-2017-LLA-0380)," dated October 5, 2018, ADAMS Accession# ML18261A099

~

---- -- ~-- ---

-- --- --~-- ---- ~-- -- - ~

ATTACHMENT 2 Serial No: 19-282 Docket No. 50-336 MARK-UP OF PROPOSED TECHNICAL SPECIFICATION CHANGES DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

Serial No: 19-282 Docket Nos. 50-336, Page 1 of 1

!-*----------------------------- ------------------~~-~--~--

1 AND Mareh Hi, 2006 3/4.8 ELECTRICAL POWER SYSTEMS 3/4.8.1 A.C. SOURCES OPERATING LIMITING CONDITION FOR OPERATION

3. 8.1.1 As a minimum, the following A.C. electrical power sources shall be OPERABLE:

a.

Two physically independent circuits between the offsite transmission network and the onsite Class IE distribution system, and

b.

Two separate and independent diesel generators each with a separate fuel oil supply tank containing a minimum of 12,000 gallons of fuel.

APPLICABILITY:

MODES I, 2, 3 and 4.

ACTION:

Inoperable Equipment

a.

One offsite circuit a.I Required ACTION Perfonn Surveillance Requirement 4.8.1.1.1 for remaining oifsite circuit within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to or after entering this condition, and at least once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereaftllr.

(within 10 days if Required AND ACTION a.3 is met) a.2 Restore the inoperable site circuit to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or be in HOT STANDBY within the ne:-..i 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

a.3 With the MPS3 'A'.RSST inoperable and the MPS3 'A' NSST energized with breaker 15G-13T-2 (13T) and associated disconnect switches closed, restore either offsite circuit to OPERABLE status within 10 days' if the following requirements are met:

- Within 30 days prior to entering the 10-day AOT, the availability of the supplemental power source shall be verified.

- During the 10-day AOT, the availability of the supplemental power source shall be checked once per shift. If the supplemental power source becomes unavailable at any time during the 10-day AOT, restore to available status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months .

I To facilitate replacement of the MPS3 'A' RSST and associated equipment, use of a one*Ume 35-day allowed outage time is permitted provided the requirements ofl Required ACTION a.3 are met. The 'Mlrk shall be completed no later than the end of MPS3 Refueling Outage 22 (fall 2023).

1 MILLSTONE - UNIT 2 3/4 8-1 Amendment No.#, 77-, ~' ~,

2-:H-, 26-+/--, 29+

ATTACHMENT 3 Serial No: 19-282 Docket No. 50-336 MARK-UP OF PROPOSED TECHNICAL SPECIFICATION BASES CHANGES FOR INFORMATION ONLY DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

Serial No: 19-282 Docket No. 50-336, Page 1 of 4 LBDCR 11 MP2 012 December 21, 2011 3/4.8 ELECTRICAL POWER SYSTEMS BASES 1110 OPERABILITY of the A.C. and D.C. power sources and associated distribution systems during operation ensures that sufficient power will be available to supply the safety related equipment required for l) the safe shutdown of the facility and 2) the mitigation and control of accident conditions within the facility. The minimum specified independent and redundant A.C. and D.C. power sources and distribution systems satisfy the requirements of General Design Criteria 17 of Appendix "A" to 10 CFR 50.

The required circuits between the offsite transmission network and the onsite Class lE distribution system (Station Busses 24C, 24D, and 24E) that satisfy Technical Specification 3.8.1.1.a (MODES 1, 2, 3, and 4) consist of the following circuits from the switchyard to the onsite electrical distribution system:

a.

b.

Station safeguards busses 24C and 24D via the Unit 2 Reserve Station Service Transfonner; and r@

~

Station bus 24E via the Unit 3\\eserve Station Service Transfonner or Unit 3 Nonna[ Station Service Transfonner ( energized with breaker l 5G-13T-2 ( 13T) and associated disconnect switches open) and bus 34A or 34B.

~

When taking credit for the Unit 3 Nonna! Station Service Transfonner as a second offsite circuit, breaker 13T and its associated disconnect switches are required to be open. This removes the potential for a single failure (that of breaker 13T) to cause a simultaneous loss of both offsite circuits. Should the other offsite circuit (i.e., the Unit 2 Reserve Station Service Transfom1er) already be inoperable, the requirement for maintaining breaker 13T and its associated disconnect switches open is no longer applicable.

,.fAlA'

'A' NI~

If the plant configmation will not allo Unit 3 to supply power to Unit 2 from the Unit 3 Reserve Station Service Transfonner or Unit Nonna! Station Service Transfonner within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months , Unit 2 must consider the second offsite source inoperable and enter the appropriate ACTION statement ofTeclmical Specification 3.8.1.1 for an inoperable offsite circuit.

This is consistent with the GDC 17 requirement for two offsite sources. Each offsite circuit is required to be available in sufficient time following a loss of all onsite alternating cun-ent power supplies and the other offsite electric power circuit to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded.

1110 first source is required to be available within a few seconds to supply power to safety related equipment following a loss of coolant accident. TI1e second source is not required to be available immediately and no accident is assumed to occur concun-ently with the need to use the second source. However, the second source is required to be available in sufficient time to assure the reactor remains in a safe condition The 3 hour3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months time period is based on the Millstone Unit No. 2 Appendix R analysis. This analysis has demonstrated that the reactor will remain in a safe condition (i.e., the pressurizer will not empty) if charging is restored within 3 hours3.472222e-5 days 8.333333e-4 hours 4.960317e-6 weeks 1.1415e-6 months .

MILLSTONE - UNIT 2 B 3/4 8-1 Amendment No. MS, 92, ~.

Serial No: 19-282 Docket No. 50-336, Page 2 of 4 LBDCR 11 MP2 012 Deeemeer 21, 2011 3/4.8 ELECTRICAL POWER SYSTEMS BASES In MODES 1 through 4 (Teclmical Specification 3.8.1.1), the Unit 2 Nonna! Station Service Transformer can be used as the second offsite source after the main generator disconnect links have been removed and the backfeed lineup established.

The required circuit between the offsite transmission network and the onsite Class lE distribution system (Station Busses 24C, 24D, and 24E) that satisfies Technical Specification 3.8.1.2.a (MODES 5 and 6) consists of the following circuit from the switchyard to the onsite electrical distribution system:

a.

b.

C.

Station safeguards bus 24C or 24D via the Unit 2 Reserve Station Service Transfom1er; or Station safeguards bus 24C or 24D via the Unit 2 Normal Station Service Transfonner and bus 24A or 24B after the main generator disconnect links have been removed and the backfeed lineup established; or

.r-fA'l

~

Station bus 24E via the Unit 3~e~e Station Service Transfonner or Unit 3 Nonna! Station Service Transfonner and bus 34A or 34B.

When the plant is operating with the main generator connected to the grid, the output of the main generator will normally be used to supply the onsite Class lE distribution system.

During this time the required offsite circuits will be in standby, ready to supply power to the onsite Class lE distribution system if the main generator is not available. When shut down, only one of the off site circuits will nonnally be used to supply the onsite Class 1 E distribution system.

111e other offsite circuit, if required, will be in standby. Verification of the required offsite circuits consists of checking control power to the breakers (breaker indicating lights), proper breaker position for the current plant configuration, and voltage indication as appropriate for the current plant configuration.

The ACTION requirements specified for the levels of degradation of the power sources provide restriction upon continued facility operation commensurate with the level of degradation.

111e OPERABILITY of the power sources are consistent with the initial condition assumptions of the accident analyses and are based upon maintaining at least one of each of the onsite A.C. and D.C. power sources and associated distribution systems OPERABLE during accident conditions coincident with an assumed loss of offsite power and single failure of the other onsite A.C.

source.

MILLSTONE - UNIT 2 B 3/4 8-2 Amendment No. +8-8, ~. ;B+,

f

MPS2 TS Bases Insert Serial No: 19-282 Docket No. 50-336, Page 3 of 4 Required Action a.3 provides an option that can be entered for the configuration where the Millstone Unit 3 'A' RSST is inoperable and the Millstone Unit 3 'A' NSST is energized with breaker 15G-13T-2 closed. This option to extend 10-day AOT allows for performance of Millstone Unit 3 'A' RSST and/or 345 kV south bus switchyard component maintenance and repair activities in this configuration while Millstone Unit 2 is operating.

Required Action a.3 can only be entered if the availability of a supplemental power source, which consists of two 480 V FLEX diesel generators, has been verified by testing within 30 days prior to entering the extended AOT. The verification testing is performed by bringing the 480 V FLEX diesel generators to their rated voltage and frequency for more than 5 minutes and ensuring all its auxiliary support systems are available or operational. While in the Required Action, the availability of supplemental power source must also be checked once per shift. This check consists of visually inspecting the 480 V FLEX diesel generators for signs of leakage, and verifying the louvres are clean and the battery charger "READY" light is illuminated. The trailer for the generators is also visually inspected to ensure it is in working condition.

To provide additional defense-in-depth during the 10-day AOT, the following risk management actions are taken:

1. The AOT will be used no more than once every 18 month refueling interval for Unit 3 to perform maintenance on the Millstone Unit 3 'A' RSST and/or 345 kV south bus switchyard components.

2. The AOT will not be scheduled when adverse or inclement weather and/or unstable grid conditions are predicted or present.

3. The load dispatcher will be contacted once per day to ensure no significant grid perturbations are expected during the AOT.

4. Component testing or maintenance of safety systems and important non-safety equipment in the offsite power systems that can increase the likelihood of a plant trip will be avoided.

No elective maintenance within the switchyard that could challenge offsite power availability will be scheduled, other than 345 kV south bus switchyard maintenance and repairs as permitted in action 5.

5. During concurrent maintenance and repair activities on 345 kV south bus switchyard components, 345 kV line 310 (Millstone to Manchester line) will be removed from service to prevent a loss of load trip of Unit 2 from a 310 line fault.

6. TS required systems, subsystems, trains, components, and devices that depend on the remaining power sources will be verified to be operable and positive measures will be provided to preclude subsequent testing or maintenance activities on these systems, subsystems, trains, components, and devices.

7. The Unit 2 turbine-driven auxiliary feedwater pump will be controlled as protected equipment.

Serial No: 19-282 Docket No. 50-336, Page 4 of 4

8. The status of the Unit 2 EDGs will be monitored once per shift.

If the supplemental power source becomes unavailable at any time during the 10-day AOT, it shall be restored to available status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or be in HOT STANDBY within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and COLD SHUTDOWN within the following 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . Opening breaker 13T and its associated disconnect switches results in exiting the Required ACTION with the 10-day AOT, because this would restore the Millstone Unit 3 'A' NSST to OPERABLE status as an offsite circuit.

To facilitate replacement of the Unit 3 'A' RSST and associated equipment, use of a one-time 35-day AOT is permitted provided the supplemental power source requirements of the Required ACTION for the 10-day AOT are met, and the related risk management actions are taken. The work shall be completed no later than the end of Unit 3 Refueling Outage 22 (fall 2023).

ATTACHMENT 4 RISK MANAGEMENT ACTION

SUMMARY

Serial No: 19-282 Docket No. 50-336 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

No.

1 2

3 4

5 6

7 8

Risk Management Action The AOT will be used no more than once every 18 month refueling interval for MPS3 to perform maintenance on the MPS3 'A' RSST and/or 345 kV south bus switchyard components.

Serial No: 19-282 Docket No. 50-336, Page 1 of 1 Due Date/Event During the time MPS3 'A' RSST is inoperable and breaker 13T is closed.

The AOT will not be scheduled when adverse or inclement weather During the time MPS3 'A' RSST is inoperable and and/or unstable grid conditions are predicted or present.

breaker 13T is closed.

The load dispatcher will be contacted once per day to ensure no During the time MPS3 'A' significant grid perturbations are expected during the AOT.

RSST is inoperable and breaker 13T is closed.

Component testing or maintenance of safety systems and important non-safety equipment in the offsite power systems that During the time MPS3 'A' can increase the likelihood of a plant trip will be avoided. No elective maintenance within the switchyard that could challenge RSST is inoperable and offsite power availability will be scheduled, other than 345 kV breaker 13T is closed.

south bus switchyard maintenance and repairs.

During concurrent maintenance and repair activities on 345 kV During the time MPS3 'A' south bus switchyard components, the 345 kV offsite line 310 will be removed from service, to prevent a loss of load trip of M PS2 RSST is inoperable and from a 310 line fault.

breaker 13T is closed.

TS required systems, subsystems, trains, components, and devices that depend on the remaining power sources will be verified to be During the time MPS3 'A' operable and positive measures will be provided to preclude RSST is inoperable and subsequent testing or maintenance activities on these systems, breaker 13T is closed.

subsystems, trains, components, and devices.

The MPS2 turbine-driven auxiliary feedwater pump will be During the time MPS3 'A' controlled as protected equipment.

RSST is inoperable and breaker 13T is closed.

During the time MPS3 'A' The status of the MPS2 EDGs will be verified once per shift.

RSST is inoperable and breaker 13T is closed.

ATTACHMENT 5 PROBABILISTIC RISK ASSESSMENT QUALITY Serial No: 19-282 Docket No. 50-336 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

Probabilistic Risk Assessment Quality Serial No: 19-282 Docket No. 50-336, Page 1 of 13 The following information demonstrates that the probabilistic risk assessment (PRA) model used to support the proposed risk-informed Technical Specification (TS) change is acceptable. All technical elements of the MPS2-R05g model have been peer reviewed consistent with American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) RA-Sa-2009, as endorsed by Regulatory Guide (RG) 1.200, Revision 2 and all PRA upgrades have been peer reviewed. The MPS2-R05g model is the same one described in the Millstone Power Station Unit 2 (MPS2) license amendment request (LAR) to implement the provisions of 10 CFR 50.69 (Reference 5-1 ).

Previously, the Nuclear Regulatory Commission (NRC) had reviewed the MPS2-R05g model acceptability for revising the integrated leak rate test (ILRT) Type A and Type C test intervals (Reference 5-2).

The following table provides a recent history of MPS2 internal events and internal flooding PRA model versions and associated applications submitted to NRC:

Table 5-1 MPS2 Internal Events and Internal Flooding PRA Model Versions Model Baseline CDF Baseline LERF Comments M209A, July 2012 Focused Scope Peer Review Against RG 1.200 Rev. 2 (Reference 5-3}

MPS2 Integrated MPS2-R05e {initial ILRT LAR Reference 5-4)

Model for MPS2-R05f, March 2018 Upgrade and F&O Closure Internal Events and Internal 1.95 E-05/yr 1.27E-06/yr Peer Review Against RG 1.200 Rev. 2 Flooding Hazards MPS2-R05g, July 2018, Focused Scope Peer

- CAFTA MPS2-ROSg, April 2018 Reviews {ILRT amendment Reference 5-2}

The above peer reviews cover all ASME/ANS PRA Standard RA-Sa-2009 supporting requirements conducted in accordance with RG 1.200, Revision 2.

The internal events PRA model, including internal flooding, was subject to several focused scope peer reviews covering all supporting requirements that were conducted in accordance with RG 1.200, Revision 2 in September 2012, March 2018, and July 2018. No PRA upgrades as defined by the ASME PRA Standard RA-Sa-2009 have been made to the Internal Events PRA model since the July 2018 focused scope peer review.

Serial No: 19-282 Docket No. 50-336, Page 2 of 13 A finding closure review was conducted on the identified PRA models the week of March 19, 2018. Resolved findings were reviewed and closed using the process documented in Appendix X to Nuclear Energy Institute (NEI) 05-04, NEI 07-12 and NEI 12-16, "Close-out of Facts and Observations" (F&Os) [Reference 5-5] as accepted by the NRC in the letter dated May 3, 2017 (Reference 5-6). The results of this review have been documented and are available for NRC audit.

Table 5-2 provides a summary of the remaining open peer review findings, including:

Open findings and disposition with respect to the proposed amendment request.

Identification of and basis for any sensitivity analysis needed to address open findings.

Based on Table 5-2, no sensitivity studies are required to address open peer review findings.

The MPS2-R05g PRA model is deemed acceptable to use in support of the proposed risk-informed TS change.

Sensitivity and Uncertainty Analyses Risk-informed analyses of TS changes can be affected by numerous uncertainties regarding the assumptions made during PRA model development and application.

There are three general types of probabilistic risk assessment uncertainty:

1. Parameter uncertainty -

The parameters subject to uncertainty for the proposed amendment request are the point estimate failure rates used to calculate the increase in grid-related Loss of Offsite Power (LOOP) frequency. To account for this uncertainty, Sensitivity Study 1 will be performed to increase the failure rates by a factor of 3 (parameters listed below):

Switchyard bus failure rate Offsite power transformer failure rate Switchyard breaker failure rate

2. Model uncertainty -

This pertains to uncertainty associated with assumptions made during PRA model development. To account for this uncertainty, the list of MPS2 PRA model assumptions and sources of uncertainty were reviewed to identify those significant to this application.

If the MPS2 PRA model used a non-conservative treatment, or methods that are not commonly accepted, the underlying assumption or source of uncertainty was reviewed to determine its impact on this application. Only those assumptions or sources of uncertainty that could significantly impact the risk calculations were considered key for this application.

Based on this review, one potentially significant source of uncertainty was identified regarding LOOP non-recovery probabilities.

To assess this uncertainty, Sensitivity Study 2 will be performed to increase the LOOP recovery probabilities by a factor of 3.

L Serial No: 19-282 Docket No. 50-336, Page 3 of 13 In addition to specific modeling assumptions, truncation limits are considered a source of model uncertainty. To assess this uncertainty, Sensitivity Study 3 will be performed to reduce the Core Damage Frequency (CDF) truncation value by an order of magnitude.

3. Completeness Uncertainty - Compliance with the ASME PRA Standard and RG 1.200 provides confidence in model completeness. Therefore, completeness uncertainty is associated with peer review findings since they identify gaps to meeting the ASME PRA standard. The open peer review findings are dispositioned in Table 5-2 concluding that no model completeness sensitivity studies are deemed necessary.

In summary, three sensitivity studies were performed. The description and results for each study are provided below:

Sensitivity Study 1: Parameter Uncertainty This sensitivity study increased the switchyard component failure rates by a factor of 3 and re-calculated the LiLOOPGR to be 1.71 E-02/yr. This LiLOOPGR value was then added to the baseline grid-related LOOP frequency modeled in MPS2-R05g, 1.59E-02/yr, yielding a LOOPGR frequency of 3.30E-02/yr.

Substituting this value into the model yields the following values for CDF and Large Early Release Frequency (LERF):

Conditional CDFProposed TS= 1.986376E-05/yr Conditional LERFProposed TS= 1.370160E-06/yr Subsequently, the one-time TS change risk metrics for Incremental Conditional Core Damage Probability (ICCDP) and Incremental Conditional Large Early Release Probability (ICLERP) are calculated to be:

ICCDP = (1.986376E-05/yr - 1.953361 E-05/yr)

35/365 yr ICCDP = 3.17E-08 ICLERP = (1.370160E-06/yr-1.330591 E-06/yr)

35/365 yr ICLERP = 3.79E-09 These values remain well below the acceptance criteria listed previously. Consequently, the results indicate that the base case is not sensitive to parameter uncertainty.

Sensitivity Study 2: Model Uncertainty This sensitivity study increased the LOOP recovery probabilities by a factor of 3 for the base case and conditional cases with the conditional cases also factoring in the increase in grid-related LOOP frequency due to the proposed TS change. The results are as follows:

CDFsAsE = 2.009595E-05/yr LERFsAsE = 1.402934E-06/yr

Conditional GDF Proposed TS= 2.022246E-05/yr Conditional LERFProposed TS = 1.419787E-06/yr Serial No: 19-282 Docket No. 50-336, Page 4 of 13 Subsequently, the one-time TS change risk metrics are calculated to be:

ICCDP = (2.022246E-05/yr - 2.009595E-05/yr)

35/365 yr ICCDP = 1.21E-08 ICLERP = (1.419787E-06/yr - 1.402934E-06/yr)

35/365 yr ICLERP = 1.62E-09 These values remain well below the acceptance criteria listed previously. Since there was only a factor of 1.5 increase from the nominal one-time change risk metrics and given the margin available to the acceptance criteria, this study indicates that the risk assessment conclusion is not sensitive to model uncertainty.

Sensitivity Study 3: Truncation Limits This sensitivity study reduced the GDF truncation value for the base case and conditional case by an order of magnitude (i.e., from 1 E-11 to 1 E-12). The results are as follows:

CDFsAsE = 1.998168E-05/yr Conditional GDF Proposed TS= 2.005007E-05/yr Subsequently, the one-time TS change ICCDP was calculated to be:

ICCDP = (2.005007E-05/yr-1.998168E-05/yr)

35/365 yr ICCDP = 6.56E-09 This value remains well below the acceptance criteria listed previously and is actually less than the value calculated at the higher truncation value. This study indicates that the risk assessment conclusion is not sensitive to truncation limits.

Furthermore, the results of these sensitivity studies substantiate the following RG 1.177 statements:

"Previous sensitivity analyses performed for risk-informed TS changes have shown that the risk resulting from TS CT [completion time] changes is relatively insensitive to uncertainties (compared, for example, to the effect on risk from uncertainties in assumptions regarding plant design changes or regarding significant changes to plant operating procedures). This is because the uncertainties associated with CT changes tend to similarly affect the base case (i.e., before the change) and the changed case (i.e., with the change in place). That is, the risks result from similar causes in both cases (i.e., no new initiating transients or subsequent failure modes are likely to have been introduced by relatively minor CT changes)."

Serial No: 19-282 Docket No. 50-336, Page 5 of 13 Therefore, no further sensitivity studies related to model uncertainty (e.g., pending PRA model changes) were conducted. The MPS2-R05g PRA model is deemed acceptable to use in support of the proposed risk-informed TS change.

REFERENCES FOR ATTACHMENT 5 5-1.

Millstone Power Station, Unit 2 - Application to Adopt 1 OCFR50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors," January 17, 2019, ML19023A427 5-2.

"Millstone Power Station, Unit No. 2 - Issuance of Amendment No. 335 Regarding Revision to the Integrated Leak Rate Type A and Type C Test Intervals (EPID L-2017-LLA-0316," September 25, 2018, ML18246A007 5-3.

"Millstone Power Station, Unit No. 2 - Issuance of Amendment RE: Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, Adoption of TSTF-425, Revision 3 (TAC No.

MF5096)," October 29, 2015, ML15280A242 5-4.

"Proposed License Amendment Request to Revise Integrated Leak Rate Test (Type A) and Type C Test Intervals," October 4, 2017, ML17284A179 5-5.

NEI Letter to NRG, "Final Revision of Appendix X to NEI 05-04/07-12/12-16, Close-out of Facts and Observations (F&Os)," February 21, 2017, ML17086A431 5-6.

NRG Letter to Mr. Greg Krueger (NEI), "U.S. Nuclear Regulatory Commission Acceptance on Nuclear Energy Institute Appendix X to Guidance 05-04, 7-12, and 12-6, Close Out of Facts and Observations (F&Os)," May 3, 2017, ML17079A427

Finding Number LE-C3-01 (2012)

Serial No: 19-282 Docket No. 50-336, Page 6 of 13 Table 5 Disposition and Resolution of Open Peer Review Findings Supporting Requirement(s)

LE-C3 Capability Category (CC}

Met Description 2012 Peer Review Comment:

MPS2 did not review significant accident progression sequences resulting in a large early release to determine if repair of equipment can be credited. To move up to CCII, perform and document a

review of significant accident progression sequences resulting in a large early release to determine if repair of equipment can be credited. If any such actions are identified, provide the basis for their feasibility.

Dominion disposition of 2012 Comment:

MPS2 LE.1 RS Significant accident progression sequences have now been reviewed to determine if repair can help reduce LERF. However, no credit for repair is taken.

2018 Peer Review Comment:

The section has been provided and assessment performed to address the F&O. However, the current documentation does not address the current model results and is not completely closed.

The process developed is sufficient to meet Category II for SR LE-C3.

Disposition Resolved.

The significant accident progression sequences for the current model, MPS2-R05g, have been reviewed and documented in the LERF documentation to determine if repair can be credited to reduce LERF. Resolution does not impact the proposed LAR.

Finding Number LE-C12-01 (2012)

Supporting Requirement(s)

LE-C12 Capability Category (CC}

Met Description Proposed Resolution:

To close this F&O, the documentation of each interim update should include an evaluation that concludes that the current Model of Record results documentation reasonably represents the results documentation expected for the current interim model. The evaluation should also conclude that there are no new insights or conclusions to be obtained based on the changes that would otherwise require fully documenting the results to meet the necessary SRs.

Serial No: 19-282 Docket No. 50-336, Page 7 of 13 Disposition

2012 Peer Review Comment:

Resolved There is no evidence that MPS2 performed a review of accident progression accident sequences to determine if it was possible for continued operation of equipment or personnel that would reduce LERF.

Dominion disposition of 2012 Comment:

Significant accident progression sequences have now been reviewed to determine if continued equipment operation or operator actions after containment failure can help reduce LERF. The review is documented (see above referenced PRA notebooks).

However, no credit is taken for additional equipment or operator actions because the significant LERF contributors are bypass scenarios, not a failure of containment isolation.

The significant accident progression sequences for the current model, MPS2-R05g, have been reviewed and documented in the LERF documentation for continued operation of equipment or personnel that would reduce LERF.

Resolution does not impact the proposed LAR.

Finding Number LE-Fl-01

{2012)

Supporting Requirement(s)

LE-Fl Capability Category (CC)

Met Description 2018 Peer Review Comment:

Documentation is provided and addresses the F&O by adding the appropriate Section and at that time there was a discussion addressing the top 97% of contributions to LERF. This process is still pending for the most current interim release, but the process exists and therefore the F&O as generated is considered partially closed. The associated SR LE-C12 requires an approach to be developed and is considered now met.

Proposed Resolution:

To close this F&O, the documentation of each interim update should include an evaluation that concludes that the current Model of Record results documentation reasonably represents the results documentation expected for the current interim model. The evaluation should also conclude that there are no new insights or conclusions to be obtained based on the changes that would otherwise require fully documenting the results to meet the necessary SRs.

Serial No: 19-282 Docket No. 50-336, Page 8 of 13 Disposition 2012 Peer Review Comment:

Resolved.

QU.2 Section 2.3.2 provided LERF by initiating event, Section 2.3.6 presented the dominant LERF cutsets, Section 2.3.9 presents the LERF importance

analysis, and Table 15 presents the system The LERF documentation has been updated for the current model, MPS2-R05g, to include

Finding Number LE-F2-01 (2012)

Supporting Requirement(s)

LE-F2 Capability Category (CC)

Not Met Description contribution to LERF. Attachment 4 to QU.2 also presents the containment failure mode contribution to LERF. However, there is no identification of the contributors to LERF by plant damage states.

2018 Peer Review Comment:

N/A Proposed Resolution:

MPS2 needs to calculate and present the dominant LERF contributors to LERF by plant damage state.

2012 Peer Review Comment:

There is no evidence that MPS2 reviewed the LERF contributors for reasonableness. While MPS2 did group and present the LERF results by initiating event, system contribution and containment failure mode, there is no evidence that MPS2 reviewed the results for reasonableness.

2018 Peer Review Comment:

N/A Proposed Resolution:

MPS2 needs to perform and document a review of the LERF results to show that they are explainable based on what would be expected for the plant.

Serial No: 19-282 Docket No. 50-336, Page 9 of 13 Disposition the relative contribution to LERF from the plant damage states. Resolution does not impact the proposed LAR.

Resolved to meet Capability Category 1/11/111.

The LERF contributors for the current model, MPS2-R05g, were reviewed for reasonableness and documented in the PRA LERF documentation.

Resolution does not impact the proposed LAR.

Finding Number LE-GS-01 (2012}

Supporting Requirement(s)

LE-GS Capability

. Category (CC}

Not Met Description 2012 Peer Review Comment:

MPS2 has not reviewed their Level 2 analysis to identify any limitations that may have the potential to impact applications. MPS2 needs to review their Level 2 analysis to identify any limitations that may have the potential to impact applications. MPS2 should document the process used for the review and the results of the review. If no limitations are identified, this needs to be clearly stated.

Dominion disposition of 2012 Comment:

MPS2 LE.1 RS, section 7.0 PRA Notebook MPS2 LE.1 has been updated to include documentation of LERF limitations in Section 7.0 of the notebook.

2018 Peer Review Comment:

The current section provides only general discussion and does not provide any support for limitations when applying the LERF model. Limitations in MAAP should be included as well as any plant-specific modeling considerations. The SR LE-GS remains not met.

Proposed Resolution:

The current section on limitations should be updated to reflect any new or additional limitations identified for the current model of record and the Serial No: 19-282 Docket No. 50-336, Page 10 of 13 Disposition Resolved to meet Capability Category 1/11/111.

This issue is associated with identifying the limitations associated with the LERF analysis for applications.

Limitations identified have for the been LERF analysis, including applicable modes, the scope of hazards, and limitations with use of MAAP for Level 2. The Level 2 analysis contains sufficient scope and detail for this application, including consideration of various containment failure modes and plant damage state modeling, which allows the core damage sequences to be binned to the EPRI accident classes.

A more thorough documentation of LERF analysis limitations that accounts for the items identified in the proposed

Finding Number SC-AS-01 (July 2018)

Supporting Requirement(s)

SC-AS Capability Category {CC)

Met

Description quantification results. The documentation should capture the insights gained from the uncertainty and sensitivity section and highlight possible limitations with respect to the use of the PRA for applications.

Serial No: 19-282 Docket No. 50-336, Page 11 of 13 Disposition resolution would not impact the conclusions of this assessment. Resolution does not impact the proposed LAR.

2018 Peer Review Comment:

Open The success path for SGTR includes throttling HPSI to maintain RWST inventory until SOC can be achieved for safe and stable conditions and requires 32 hours3.703704e-4 days 0.00889 hours 5.291005e-5 weeks 1.2176e-5 months to achieve. The PRA model is based on a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months mission time. Also, it is not clear how long the RWST can provide inventory Assessment Basis MPS2-SC.1 identifies the base mission time as safe and stable within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . No events were identified requiring longer than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , however MPS2-SC.2 identifies that one SGTR sequence requires 32h to reach safe and stable and includes an evaluation that the impact on CDF is not significant.

Proposed Resolution Provide additional analysis to demonstrate that safe and stable conditions can be achieved by 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , revise the model to account for the extra time, or add a recovery action such as refilling the RWST.

The proposed amendment request affects the grid-related LOOP accident sequence.

Since the finding affects the SGTR accident sequence, there is no impact on the proposed LAR.

Therefore, a sensitivity study is not required to address this finding.

Finding Number IFQU-A7-1 (March 2018)

QU-F2-02 (March 2018)

Supporting Requirement(s)

IFQU-A7 IFQU-Bl QU-F2 QU-F3 Capability Category (CC)

Met Met Met Met Description 2018 Peer Review Comment:

Detailed quantification notebook is not available for the MC documentation. To meet this requirement, a detailed QU notebook will be required.

Assessment Basis:

The quantification process met the requirements of QU SR groups A-E. Because these results were not contained in the model update documentation, a finding was given to create a detailed QU that addresses HLR F SRs.

Proposed Resolution:

Generate a detailed QU notebook either for the integrated PRA model or for the flooding specific model that meets the requirements of IFQU and QU of the standard.

2018 Peer Review Comment:

Dominions' PRA update process periodically creates a new "model of record" that addresses the requirements of QU-F2 & QU-F3. However interim updates are performed to maintain the PRA consistent with the as-built/as-operated plant that do not address all of requirements of QU-F2 & QU-F3 to document sensitivities, uncertainty assessments and significant contributors.

Resolved.

Serial No: 19-282 Docket No. 50-336, Page 12 of 13 Disposition The MPS2 PRA documentation has been updated to address the supporting requirements in IFQU-A7 and IFQU-Bl based on the latest model, MPS2-R05g.

Resolution does not impact the proposed LAR.

Resolved.

The MPS2 PRA documentation has been updated to address the supporting requirements in QU-F2 and QU-F3 based on the latest model, MPS2-R05g.

Resolution does not impact the proposed LAR.

Finding Supporting Capability Number Requirement(s)

Category (CC)

I Description ProQosed Resolution:

The full quantification analysis, which addresses the SRs for QU-F2 and QU-F3, should be updated to for use with risk informed submittals or peer reviews, or justification should be included in the documentation for the interim quantification results detailing why elements of the previous quantification analysis still apply to the interim model results.

Serial No: 19-282 Docket No. 50-336, Page 13 of 13 Disposition

ATTACHMENT 6 EXTERNAL HAZARDS SCREENING Serial No: 19-282 Docket No. 50-336 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

External Hazard

"" ",\\(,~ <f>,Y

Aircraft Impact Avalanche Biological Event Coastal Erosion Drought Serial No: 19-282 Docket No. 50-336, Page 1 of 8 External Hazards Screening y

y y

Screening Result Comi:nent Screening

.., Cri.ter:ion

... (N9t~:c:1t..

PS2 C3 C1, C5 C5 C1, C5 Airport hazard meets 1975 SRP requirements. Airports, military installations and flight corridors around MPS2 (including Groton Airport) have been considered.

Evaluations of aircraft impact associated with these facilities find that it does not pose a significant hazard.

Not applicable to site because of topology. MPS2 is located on the Long Island Sound with no hilly or mountainous terrain near the site.

Avalanches are not a viable external initiator.

Plant design accounts for biological growth. Slowly developing growth can be detected and mitigated by surveillance. The circulating water system intake structure incorporates several features to control biological fouling including trash racks and traveling screens, a cutoff wall to prevent ecologically rich surface water from entering the system, exit passages for fish are provided, vertical guides allow individual channels to be drained and a chlorination system for biocide treatments.

Slowly developing event can be detected and mitigated by surveillance.

Plant design eliminates drought as a concern and event is slowly developing. The Ultimate Heat Sink UHS is the Lon Island Sound

Extern~lHa~arcf,

External Flooding Extreme Wind or Tornado

'1" Screened?

,1(Y/N),

y y

Screening:

. OritertQ'1r1,,

(Note.a.) :

None C1, PS4 Serial No: 19-282 Docket No. 50-336, Page 2 of 8 which is unaffected by drought since it communicates with the Atlantic Ocean.

Offsite power is expected to be lost as a result of a storm surge that introduces external flooding risk to MPS2. Consequently, there is no external flood risk impact associated with the proposed amendment request.

The wind loadings for all structures are based on American Society of Civil Engineers Paper 3269, "Wind Forces on Structures". The basic design wind velocity for MPS2 Class 1 structures is 115 mph with gusts up to 140 mph.

MPS2 structures are designed for tornados having a maximum rotational velocity of 300 mph and a maximum translational velocity of 60 mph. This design basis tornado has a frequency less than 1 E-6/yr at MPS2.

Failure of a service water pump due to missile strike is bounded by 1 E-6/yr. Failure of both diesels due to missile strike is bounded by 1 E-6/yr.

Failure of the EOG Room ventilation due to tornado is bounded by 1 E-6/yr. CDF due to tornado-induced failure of the East 480V Switchgear Room ventilation is bounded by 1 E-6/yr. Control Room ventilation failure is not a significant contributor to risk because of alternate means of Control Room coolin and the

Exterr1al Hazard Fog Forest or Range Fire Frost Hail High Summer Temperature Serial No: 19-282 Docket No. 50-336, Page 3 of 8 sScreen1ngResult"'*

. Screen.ed.? Screening (Y/N}

"Criterion x.i

,(Note ai}t **

y PS2, C1 y

C3 y

C4 y

C2 y

C1, C5

comment*

ability to shut down outside the Control Room.

Fog can be a contributor to transportation accidents.

Transportation accidents meet the criteria of the 1975 SRP.

Deep draft boats must stay at least 2 miles offshore to avoid running aground on Bartlett Reef.

Therefore, a boat that could cause significant damage to the Intake Structure is highly unlikely to collide with the Intake Structure and would, most likely, run aground first.

Site is cleared preventing fire from propagating onto the site and is not located in forested or grassland area.

Frost is covered under snow and ice hazards.

Loss of offsite power (LOOP) events associated with hail are addressed in the Internal Events PRA and the occurrence frequency is enveloped by the frequency of weather-induced LOOP events.

Limited occurrence and bounded by other events for which the plant is designed.

Plant is designed for this hazard.

Ventilation systems provide conditioned air in the plant to cool equipment. Weather-induced LOOP events are considered in the Internal Events PRA. Effects on the UHS are slow to develo if the

External 'Plazarcj

Screening Criterion':.x

/,(Ne'.te a)*

High Tide, Lake y

C4 Level, or River Stage Hurricane y

C4 Ice Cover y

C1, C4 Industrial or Military y

PS2 Facility Accident Internal Flooding N

None Internal Fire N

None Landslide y

C3 Lightning y

C1, C4 Serial No: 19-282 Docket No. 50-336, Page 4 of 8 Comment develop at all because of the size of the Long Island Sound.

High tide is covered by external flooding considering storm surge.

Hurricane is covered by external flooding and high winds or tornado.

Plant is designed against freezing temperatures. Protection against ice blocking of roof penetrations will be demonstrated by Dominion. Ice blockage causing flooding is covered under external flooding.

Explosive hazard impacts and control room habitability impacts meet 1975 SRP requirements (RG

1. 78 and 1.91 ). Industrial facilities are too distant to pose a hazard to the safe operation of the plant.

Nearby military facilities do not conduct operations that could potentially pose a hazard to the safe operation of the plant.

MPS2 has an internal flooding PRA model.

Addressed in Attachment 1 Section 4.4.

Not applicable to the site because of topography.

Lightning strikes causing loss of offsite power or turbine trip are contributors to the initiating event frequencies for these events.

However, other causes are included. The impacts are no reater than those alread modeled

External Hazard Low Lake Level or River Stage Low Winter Temperature Meteorite or Satellite Impact Pipeline Accident Release of Chemicals in Onsite Storage y

y y

C3 C1, C5 C2, PS4 C3 PS2 Serial No: 19-282 Docket No. 50-336, Page 5 of 8 in the internal events PRA.

Additionally, MPS2 does not have a specific vulnerability to lightning and does not have unique features that would create a high likelihood of failing safety-related systems, structures, or components concurrent with a LOOP.

Not applicable to site because of location. MPS2 is located on the coast of the Long Island Sound which is virtually unaffected by lack of precipitation.

Plant is designed for this hazard.

Potential pipe freezing is addressed by a requirement for heat tracing operability during cold weather.

Impacts on the UHS are slow to develop, if it all, due to the size and salinity of the Long Island Sound.

Event occurrence frequency of meteorites greater than 100 lb.

striking the plant is 7E-9/yr. This frequency is very low in absolute terms and lower than aircraft impacts. Aircraft impact damage envelops meteorite/satellite impact damage. Site is no more likely to be struck by meteorite/satellite than any other site.

Pipelines are not close enough to significantly impact plant structures.

Plant storage of chemicals meets 1975 SRP requirements (RG 1. 78 and 1.91 ). Control room habitability during postulated chemical releases has been evaluated and it has been determined that habitabilit is not threatened b this

:'i Exte.rnal Hazard.

Screened?

'o.i\\1 1:,,

(Y/N~

River Diversion y

Sand or Dust Storm y

Seiche y

Seismic Activity N

Snow y

Soil Shrink-Swell y

Consolidation 1

Serial No: 19-282 Docket No. 50-336, Page 6 of 8

,1(

*:y"'*...

.... >,..Scr:eening,;.Res.ult 1

<<z,

t',",,,,'}:')',:

Screening

.**

Cfit~~jqn...

Comment

'{, \\< ?\\0:i'",,

,,'(,:,'

(Note a)**

hazard.

Not applicable to the site because of location. There are no diversions C3 near MPS2. Cooling water is supplied directly from the Long Island Sound.

Not applicable to the site because C3 of location. MPS2 is not subject to sand or dust storms.

Not applicable to the site because of location. Seiche in the Long Island Sound or the discharge C3 basin was evaluated not to be a hazard for these bodies of water because of their geometry and locations relative to seiche inducing phenomena.

None Addressed in Attachment 1 Section 4.4.

Event damage potential is less than other events for which the plant is C1, C4 designed. Potential flooding impacts covered under external flooding.

Plant is designed for this hazard.

The MPS2 UFSAR Chapter 2.7 describes the characteristics of the area geology, soil conditions, C1 testing, foundations and backfill.

Allowable bearing pressures for soil-supported structures are greater than contact pressures as determined by backfill testing. The potential for this hazard is low.

~xt~rnal Hazard Storm Surge Toxic Gas Transportation Accident Serial No: 19-282 Docket No. 50-336, Page 7 of 8

$creening Result sc'reehed?

Screening

<r;(Y/N)

. Criterion (Note cl) y C4 y

C4 Storm surge is covered by external flooding.

Toxic gas is covered by industrial or military facility accident, release of chemicals in on-site storage, and transportation accident. Control room habitability during postulated chemical releases has been evaluated and it has been determined that habitability is not threatened by this hazard.

Potential hazards meet the 1975 SRP requirements. The hazards resulting from potential transportation accidents (i.e.,

highway, waterway, railroad, and air) were found to not contribute significantly to plant risk.

Highway-The distance to the nearest highway exceeds the RG 1.91 safe distance criterion.

Waterway - Most ships passing MPS2 are deep draft and must remain at least 2 miles offshore to y

PS2, C4 avoid running aground.

Railroad - Hazardous materials are transported about 0.25 miles from the protected area. Most of the transported hazardous materials (chlorine, anhydrous ammonia, carbon dioxide and carbon disulfide) meet the RG 1.78 screening criterion for low transport frequency. The remaining transported hazardous material (propane) presents negligible potential for damage due to explosion and is not a threat to control room habitabilit due to

. Externa:I.Hazard Tsunami Turbine-Generated Missiles Volcanic Activity Waves

. Screened?'.* S~teJriing

fYIN~

Criterion, *

'(Not~:a)

y C4 y

PS4 y

C3 y

C4 Serial No: 19-282 Docket No. 50-336, Page 8 of 8 toxic gas plume.

Air - Covered under aircraft impact.

Covered under external flooding.

Bounding analysis is used to show CDF for turbine generated missiles is less than 1 E-6/yr.

Not applicable to the site because of location. There are no volcanos within the vicinity of MPS2.

Waves are covered under external flooding.

Note a - See Attachment 7 for descriptions of the screening criteria.

ATTACHMENT 7 Serial No: 19-282 Docket No. 50-336 PROGRESSIVE SCREENING APPROACH FOR ADDRESSING EXTERNAL HAZARDS DOMINION ENERGY NUCLEAR CONNECTICUT, INC.

MILLSTONE POWER STATION UNIT 2

Serial No: 19-282 Docket No. 50-336, Page 1 of 2 Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion source*

Comments

.\\,

G 1. Event damage NUREG/GR-2300 Initial Preliminary and ASME/ANS Screening potential is < events for Standard RA-Sa-which plant is designed.

2009 G2. Event has lower mean NUREG/GR-2300 frequency and no worse and ASME/ANS consequences than other Standard RA-Sa-events analyzed.

2009 G3. Event cannot occur NUREG/GR-2300 close enough to the plant and ASME/ANS Standard RA-Sa-to affect it.

2009 G4. Event is included in NUREG/GR-2300 Not used to the definition of another and ASME/ANS screen. Used only event.

Standard RA-Sa-to include within 2009 another event.

G5. Event develops ASME/ANS slowly, allowing adequate Standard RA-Sa-time to eliminate or 2009 mitigate the threat.

Progressive PS1. Design basis hazard ASME/ANS cannot cause a core Standard RA-Sa-Screening damage accident.

2009 PS2. Design basis for the NUREG-1407 and event meets the criteria in ASME/ANS the NRG 1975 Standard Standard RA-Sa-Review Plan (SRP).

2009 PS3. Design basis event NUREG-1407 as mean frequency is< 1 E-modified in 5/y and the mean ASME/ANS conditional core damage Standard RA-Sa-probability is < 0.1.

2009 NUREG-1407 and PS4. Bounding mean GDF ASME/ANS is< 1 E-6/y.

Standard RA-Sa-2009

Detailed PRA Screening not successful.

PRA needs to meet requirements in the ASME/ANS PRA Standard.

Serial No: 19-282 Docket No. 50-336, Page 2 of 2 NUREG-1407 and ASME/ANS Standard RA-Sa-2009

v t e Letter Sequence Request
EPID:L-2019-LLA-0177, TSTF-425, TSTF-425 (Approved, Closed)
Initiation Request, Request, Request Acceptance, Acceptance Supplement, Supplement Administration Questions 23 December 2019 23 January 2020 19 February 2020 Answers 3 October 2019 11 February 2020 19 March 2020 Results Approval, Approval Other:
MONTHYEAR2019-09-26 [Table View]

ML19234A111

Text

SUMMARY

5.0 REGULATORY EVALUATION

5.3 Precedents

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

SUMMARY

4.0 TECHNICAL EVALUATION

6.0 ENVIRONMENTAL CONSIDERATION

7.0 REFERENCES

SUMMARY

Navigation menu

Search