ML20044G372

Forwards Questions Re Proposed TS Changes in Allowed Outage Times & Surveillance Intervals Based on PRA

ML20044G372
Person / Time
Site:	South Texas
Issue date:	05/19/1993
From:	Kokajko L Office of Nuclear Reactor Regulation
To:	Cottle W HOUSTON LIGHTING & POWER CO.
References
TAC-M76048, TAC-M76049, NUDOCS 9306020416
Download: ML20044G372 (66)

Text

{{#Wiki_filter:. May 19, 1993 Docket Nos. 50-498 and 50-499 Mr. William Cottle Group Vice President, Nuclear Houston Lighting & Power Company P.O. Box 1700 Houston, Texas 77251

SUBJECT:

REQUEST FOR ADDITIONAL INFORMATION REGARDING REVIEW 0F THE PROPOSED CHANGES TO THE SOUTH TEXAS PROJECT TECHNICAL SPECIFICATIONS (TAC NOS. M76048 AND M76049) Enclosed are questions regarding your proposed Technical Specification changes in allowed outage times and surveillance intervals based on probabilistic risk analyses. This request was submitted by letter dated February 1,1990, and supplemented by letters dated November 27, 1990, and June 5, 1991. The questions include items which were presented to members of your staff during a conference call on March 18, 1993. Also enclosed is a draft report prepared by Brookhaven National Laboratory as a result of its review of the submittals listed above. This draft is provided to your staff for guidance in preparing your next submittal. The reporting requirements contained in this letter affect fewer than ten respondents; therefore, OMB clearance is not required under Public Law 96-511. Sincerely, Original Signed By Lawrence E. Kokajko, Senior Project Manager Project Directorate IV-2 Division of Reactor Projects III/IV/V Office of Nuclear Reactor Regulation

Enclosures:

DISTRIBUTION 1.. Request for Additional Information Docket Filq EPeyton 2. Draft Report 'NRC PDR LKokajko Local PDR EJordan cc w/ enclosures: PDIV-2 R/F SBlack See next page OGC MWohl ACRS (10) WJohnson,RGN-IV 0FFICE PDIV-2/LA. PDIV-2/PE PEIF2/PM PDIV-(Mb NAME EPNthn' DSkay av) kokajko SBlack DATE 5/12 93 5//Y /93 5//7/93 5// 9/93 1 / OAnn46 ,, n n g~, i 9306020416 930519 PDR ADDCK 05000498 i P PDR \\ \\

ENCLOSURE NO. 2 l .O = 1 DRAFT LETTER REPORT - TECIINICAL ANALYSIS OF PROPOSED CHANGES TO SOUTH TEXAS PROJECT (STP) TECHNICAL SPECIFICATIONS G. Martinez-Guridi and P. Samanta i Risk & Reliability Analysis Group Engineering Technology Division Department of Nuclear Energy Brookhaven National Laboratory Upton, New York 11973, U.S.A. i May 1993 i i l Prepared for Division of Safety Issues Resolution Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 J i ) Under Contract No. DE-AC02-76CH00016 NRC FIN L-2591 l 1 i l j l j

iR. M F t CONTENTS f.agg ACKNOWLE DG EhiENTS.............................................. vil ~ 1. I NTR O DU CTI O N.............................................. 1 1.1 Backgroun d..............................................

• 1 1.2 Current and Proposed TS for STP Stations.......................

I 1.3 Scope of the Review....................................... 2 1.4 Scope and Outline of the Report.............................. 2 2. REVIEW M ETH O DO LO GY...................................... 4 1 2.1 Issues Addressed in Review.................................. 4 2.2 Reason for Requesting Modification............................ S I 2.3 Appropriate Risk Measures for AOT and STI Modification 6 l 2.4 Modeling of TS Parameters.................................. 7 2.5 Data Used in Support of Analysis............................. 8 2.6 Check on Quantification Performed............................ 9 2.7 Sensitivity and Uncertainty Analysis............................ 10 2.8 Decision Framework (Criteria) Used........................... 11 l 2.9 Presentation o f Results..................................... 11 l 3. REVIEW OF THE STP SUBMITTAL FOR TECHNICAL SPECIFICATION MODIFICATIONS................................ 12 3.1 Main Characteristics of the Submittal........................... 12 3.2 Review Analysis of the Basis for Requesting Modifications........... 13 3.3 Review Analysis of the Risk Measures Calculated in Quantifying Risk Effects of TS Modifications.............................. 14 3.4 Review Analysis of the Adequacy of Modeling TS Parameters in the Risk Model.... 17 3.5 Check on the Correctness of Quantifications Performed............. 18 3.6 Review of Sensitivity and Uncertainty Analyses Performed........... 20 3.7 Analysis of Decision Framework (Criteria) Used................... 22 3.8 Pr esent ation of R esults.................................... 22 3 4.

SUMMARY

23 REFERENCES 24 v SY

.. ~ r CONTENTS (Cont'd) E!!E APPENDIX A: ~ APPENDIX B: 28 APPENDIX C: 30 APPENDIX D: APPENDIX E. .......................................g APPENDIX P. 8 APPE.NDIX G: I . I a 0 t e I t 1 u i I n i "'+,.-..4,, _ I ,s-d 1 2 1 VI I 4.. h- .g

D ?.WY I i ACKNOWLEDGEMENTS i The authors would like to thank Mr. Erulappa Chelliah and Mr. Millard Wohl of USNRC for many discussions and technical support during this project. Mr. Richard Murphy and Mr. Rich Granton of the South Texas Project (STP) staff have been very supportive and cooperative in responding to many requests for information. We also acknowledge very valuable contribution of Dr. William E. Vesely, consultant to the project. He provided many important insights. Ms. J. Penoyar of BNL supported us in computational aspects of this study. i Finally, we thank Ms. Donna Storan for an excellent job in preparing this report. l i t I l e l 4 H N Vii D *Q.WT l

3 9A F 1. INTRODUCTION

1.1 Background

Houston Lighting & Power (HL&P) submitted an amendment to modify the Technical Specifications (TS) of the South Texas Project (STP) Electric Generating Station plants! on February 1, 1990. This amendment proposed changes to 22 Technical Specification items and is based on probabilistic safety assessment (PSA) analysis of the impact of changes to plant risk. U.S. Nuclear Regulatory Commission requested Brookhaven National Laboratory (BNL) to perform a technical evaluation of the analyses performed in support of the changes proposed for STP. The STP consists of two units (STP 1&2), Westinghouse designed pressurized water reactors (PWRs). Unit I and 2 are in operation respectively since August 1988 and June 1989. The plants,in general, have three electrically independent and physically separne safe'y trains. As stated in the STP l submittal, the current TS are generally based on the standard We,stinghouse Technical Specifications which were developed for Westinghouse two-train designs. The proposed changes primarily consist of extending allowed outage times (AOTs) and Surveillance Test inwals (STIs) to take credit of the added safety resulting from the three-train design. The risk-based analysis of STP Technical Specification modifications was performed using the 2 STP probabilistic safety assessment (PSA) completed in May 1989 and reviewed by Sandia National Laboratories for USNRC.3 The STP PSA was performed using the RISKhiAN Computer Code package developed by PLG, Inc..d The review of the STP PSA did not involve any quantitative evaluation using the RISKMAN Computer Code. Subsequent to completion of STP PSA, STP staff proceeded to develop submittal for Individual Plant Examination (IPE)of the plant using the completed PSA. The risk model developed in support of the IPE s different than the original PSA model.2 The core damage frequency 5 estimated in the IPE submittal is about a factor of 4 lower compared to the estimate presented in the May 1989 anlaysis. Similarly, the impact of TS changes evaluated using the STP IPE modelis expected to be different, but is being completed at this time by STP. Following initiation of BNL review of the STP submittal, r.n active interaction was maintained with STP staff to obtain necessary information for review of the TS analyses. The review initiated with the original submittal,1 which was supplemented by STP staff with additional evaluations using the IPE model while the review was in progress. STP also provided an earlier version of the IPE (RISKMAN) model for performing quantitative analyses of TS changes and later an upgraded version of the IPE 6 (RISKMAN) model. Currently, STP is completing a revised submittal that addresses the items that the review team considered necessary to be addressed in addition to those addressed in the original submittal. This revised submittal will also present analyses of TS changes using the completed IPE (RISKMAN) model available to the review team. 1.2 Current and Proposed TS for STP Stations Of the 22 proposed changes evaluated in the original submittal.1 6 were withdrawn by STP. A list of the remaining 16 TS changes, currently under review by the USNRC, is presented in Appendix A which summarizes the specifics of the individual changes. Of this group of 16 TS changes, quantitative evaluations are performed in support of 11 of them using the PSA model of the plant. Qualitative explanations are presented for the remaining 5 to support their extensions. 1 Q R.W-T

3GLWI The TS changes being requested by STP related to two types of changes: a) extending the allowed outage time (AOT) for a single train failure (e.g., from a current limit of 3 days to 10 days), b) extending the surveillance test intervals (e.g., from 31 days (monthly) to 92 days (quarterly)). The TS changes being considered include either one of the above two types of changes (8 only AOT changes,4 only STI changes) or changes to both AOTs and STis (4). Of the 11 changes for which - quantitative evaluations are presented,5 related to only AOT changes,2 related to only STI changes, and the remaining 4 involve both AOT and STI changes. 13 Scope of the Resiew The scope of the review is to perform a technical evaluatioit of the STP submittal to modify the TS requirements. This is to include independent quantitative reassessment, as necessary, of the impact of TS change on the plant risk using the available plant PSA. Since the PSA was performed using the RIS131AN Computer Code package, the review analysis was also to be carried out using the same computer code for comparability of the quantitative results. The review of the STP submittal was focussed on the TS changes for which quantitative assessments were presented, i.e.,11 of the 16 TS changes discussed above.; are reviewed. The remaining 5 TS changes, for which qualitative analyses are presented, were not reviewed at this time. The TS changes being reviewed related to safety systems needed for preventing core damage, and accordingly, core damage frequency (CDF) of the plant was used as the measure for analyzing the impact of TS changes. In other words, Level 1 PSA of the plant was used for reviewing the technical analyses presented in the submittal. The review did not include review of the STP PSA or the RISKMAN Computer Code package used to quantify the risk measures, i.e., in this case, system unavailability, and CDF of the plant. The review team accepted the PSA made available to them by STP. Only selected aspects of the PSA that i directly affect the TS analysis are reviewed. These items are discussed in the report. The STP submittal is to change the TS requirement of both the units. In the analyses presented,' these two units are not treated separately. Neither any interdependencies or cross-connections from TS considerations are addressed. It is not to suggest that these issues have an impact on the evaluation presented in the STP submittal. But, these aspects were not considered in this review. 1.4 Scope and Outline of the Report l This report presents a technical evaluation of the original STP submittal and the associated supporting materials,5.63 and discusses the additional analyses that need to be performed in support of the requested TS changes. As mentioned earlier, STP is currently performing the needed analyses, based on requests from the review team. In that regard, this report should be considered an interim evaluation of the STP submittal for the TS changes. Following the revised submittal including the additional _ analyses, requested to STP and also identified here, the review is expected to resume and complete the technical evaluation. 2 i i

.= D RGT j i I In performing the resiew of the STP submittal, the review team first developed a framework for reviewing risk-based submittal of TS changes. This framework defines the major areas and the issues that will be addressed in the resiew. Following the introduction, Chapter 2 presents this review methodology. I Chapter 3 discusses the technical evaluation of the STP submittal based on the review methodology defined in Chapter 2. Finally Chapter 4 presents a brief summary.. Appendix A presents the proposed ^ l modifications to the Technical Specifications, together with the type of analysis provided by STP to support the modifications. Appendix B presents a brief description of relevant risk measures associated with AOTs and STis for Technical Specifications studies. Appendix C reproduces the list of the items to be addressed in support of the TS changes. Appendix D presents the modeling of relevant alignments for the proposed modification reproduced from Reference 7. Appendix E presents art example of the comparison of parameters with and without the proposed modifications. Appendix F presents the evaluations performed in the South Texas Project submittal. Also presented in the appendix are the results of example evaluations performed by BNL. Finally, Appendix G presents several. miscellaneous items that were detected during the resiew. i t I i a i I l j I 1 e i I l 3 3 e QY\\ j

% u cW~ 2. REVIEW METHODOLOGY The South Texas Project (STP) submittal to modify the Technical Specification (TS) for the nuclear power plant is based on probabilistic analyses that uses the probabilistic safety assessmtat (PSA) of the plant. The resiew methodology is thus focussed on an approach to reviewing PSA-based analysis of TS changes. In recent years,with the increasing emphasis on developing plant-specific PSAs for nuclear power plants, there has been a significant interest in applying PSAs to modify operating practices and regulatory requirements. Technical Specification (TS) requirements have been the focus of rnany of these applications. The review methodology presented here is based on the research carried out in the United States and internationally on this subject. Specifically, the USNRC research projects carried out at Brookhaven National Laboratory, industry sponsored research projects, and activities of the International Atomic Energy Agency (IAEA)were considered in defining the review methodology that is based on the state-of-the-art methodology in this subject area.sAto.11.22 In this section, we present a summary of the review methodology focussing on the technical aspects of a risk-based submittal to modify TS requirements. We first identify the major areas that are reviewed and then provide a brief description of each of the areas summarizing the issues the review will address and seeks answers in the submittal. 2.1 1ssues Addressed in Resiew l The basic objective of a review is to perform a technical evaluation of a) the analyses performed in support of the requested changes, and the assumptions used in the analysis, b) the adequate treatment of the issues arising from the requested changes, c) validity of the quantitative assessment presented, and d) the framework used in developing the requested changes and the acceptability of the changes. Specifically, in performing a review of PSA-based analysis of TS changes, the following areas or issues are to be reviewed. Reasons for requesting modifications Calculation of appropriate risk measures in quantifying risk effects of TS modifications Adequacy of modelling TS parameters in the risk model being used to quantify the effects Data used in support of the analysis Check on the correctness of the quantifications performed M 4 i U4

D RAW Adequacy of sensitivity and uncertainty analyses performed and their use to determine TS modifications Decision framework (criteria) used to decide on the proposed modifications Presentation of results Each of the items is discussed below to present the specific issues the review will address in evaluating the submittal. 2.2 Reason for Requesting Modification The reasons for requesting the modification are to be presented in the submittal. When a number of requirements are requested to be modi 5ed, then it may be necessary to present reasons for changing each of them separately since there may be differences., Based on the anlaysis of the types of applications performed, the reasons for requesting TS modifications may fallinto one or more of the items presented below. Here, we have focussed primarily on the allowed outage time (AOT) and surveillance test interval (STI) requirements. The requested changes in the STP submittal also relate to these two types of requirements. Imrirovement in Or>crational Safety The reason for TS modification may be to seek improvement in operational safety. This may imply improvement or reduction in the plant risk due to the requested change, or reduction in occupational exposure of plant personnelin complyingwith the requirements. It can also be argued that the changes will result in improved allocation of resources resulting in improvement of operational safety. Consistency or Risk-Basis in Reculatory Reauirements The changes in the requirements can be argued based on their risk implications. If the requirement has minimal risk implication, then changes can be suggested to provide a needed flexibility. It must be assured that increased risk due to the change should remain acceptable. TS requirements can be changed to reflect improved design features implemented in a plant. Improvement in design can make a previous requirement unnecessarily stringent or ineffective. Risk-based analyses can be performed to define the needed change and its risk implication. ~ ~_. . Demonstration of Need (burden considerations) In many cases, the change may be needed to reduce the burden in complying with the requirements, based on the operating history of the plant or the industiy,in general. For example, the repair time needed for components in a safety system, may be longer in many instances than the allowed outage time (AOT) defined in the TS. Similarly, the required surveillance may be ineffective in detecting certain failures of an equipment and need not be performed at the prescribed frequency. The reasons for requesting changes can form an important input in the decision to seek the requested changes and define the evaluations necessary to justify the modifications. 5 19MT

ggy- ~ ~ ~ l 23 Appropriate Risk Measures for AOT and STI Modification l In a PSA-based analysis of TS changes, the risk impact of the changes are quantitatively evaluated using the plant-speciSc PSA of the plant. The review effort is directed at assessing whether the appropriate risk measures are calculated in the submittal. The measures to be used for AOT and STI modifications are presented in available NRC publications,88 and a brief description is presented below and in Appendix B. Level of Analysis The impact of TS changes should be evaluated at least at the core damage frequency (CDF) level of the plant, i.e., the measures discussed below are to be calculated in terms of core damage frequency of the plant. In addition, an assessment of whether the high consequence sequences are affected much more strongly compared to the low consequence sequences is needed. For modifying TS on a containment system, a Level Il PRA analysis, i.e., an evaluation of the impact on plant damage states is needed. AOT Risk Anahsis For each of the requested AOT changes, the following measures are to be calculated: l a) Conditional risk during an AOT: the risk (e.g., CDF) measured given that limiting i condition for operations (LCO) has been entered. This measure defines the instantaneous CDF during the entire AOT period. b) Single AOT risk: the integrated risk (e.g., measured at the CDF level) over an AOT l period given that LCO is entered,i.e., the component or the train is unavailable. l c) Yearly AOT risk: the expected risk for the AOT duration due to LCO occurrences over a period of one year. This measure takes into account the frequency of LCO entry, and is essentially the product of this frequency and the single AOT risk. 1 d) Average yearly risk: the expected risk over a period of one year assuming the mean downtime for the duration in the LCO condition. { l 1 l e) Risk of preventive maintenance (PM) schedules: when AOTs are used to perform scheduled PM during power operation, then the risk impact of the PM schedules are to be calculated. For PM schedules, multiple components may be simultaneously 1 l unavailable for PM, and accordingly, the CDFs associated with the PM activities are to be analyzed. f) Risk of simultaneous outages of components: if the changes in AOT may increase the possibility of simultaneous outages of multiple components, then this increased risk and how it is to be avoided during power operation should be analyzed and reviewed. l 6 D9AVT~

DRAF STI Risk Analysis Surveillance tests are performed on safety system components to detect failures that may have occurred in the standby period. In changing the surveillance test interval, the measures to be evaluated l are: i a) increase in CDF due to change in an STI: this can be measured in terms of reibbility importance of the component.s b) impact of adverse effects of surve31ance: when adverse effects of surveillance are considered an important contributor, ar the reason for requesting the changes, then their contributions can be quantified and compared.13 Total Risk imnact i When multiple TS changes are requested, then the total I'mpact of the changes are reviewed. This includes: l a) total impact of all the requested AOT changes together, b) total impact of all the requested STI changes together, and i c) total impact of all the requested AOT and STI changes. In most cases, the totalimpact is not the sum of the individual impacts and accordingly, the plant PSA is to be used to quantify the impact. 2.4 Modeling of TS Parameters t In assessing a PSA-based analysis ofTS changes, the primary question is the adequacy of the PSA model for the TS evaluation. Assuming that the plant PSA is, in general, adequy.e, the review of TS - submittal addresses specific items relating to the requested changes. The components whose TS are i being analyzed for modification are to be explicitly modeled in the PRA. The model also should be i capable of treating alignments for testing and maintenances (scheduled anu anscheduled). Modeline of AOT Risk Analysis The parameters that are important elements of AOT risk analysis tre addressed in the review. These include: .j a) the distribution of maintenance downtimes used in the analysis,'and the mean i maintenance downtimes, b) the maintenance frequency for unscheduled (corrective) and scheduled (preventive) maintenances, and 1 c) the distribution of maintenance downtimes when AOTs are changed and mean downtimes for the changed AOTs. 7 1 i RMY

TVMW _ Modeline of STI Risk Analysis The aspects important to modeling of STI risk are addressed in the review and are summarized as follows: i a) Demand versus standby time-related contribution to component unavailability-If these contributions are separated, then the analysis to justify these separations is reviewed. This separation can influence the assessed STI for a component; for example, in an extreme case,if the component unavailability consists of only the demand contribution, then there is very little justification for performing surveillance tests. b) Test-strategy considerations: If test strategies, e.g., sequential testing, or staggered testing, are assumed, then how they are modeled is reviewed. Typically, PSAs do not assume any specific test strategies. c) Impact on dependent failure mntributions: When STis are modified, the dependent failure contribution for the affected components are also changed. This is because the dependent failure contribution (also called common cause contribution) is directly proportional to the STI. The review will address whether the modeling allows for such effects to be directly assessed when STI changes are being assessed. In many cases, these parameters may be the dominating influence on the overall estimate. l If adverse effects of surveillance testing are quantified, then the modeling of such effects and how l this contribution is used to assess STIs is evaluated. Usually, many adverse effects, namely, test-caused 3 transients, test-caused wear of equipment, are not modeled in a PRA. I j 2.5 Data Used in Support of Analysis For a quantitative analysis of the risk impact of TS changes, the data used in the analysis have an important influence on the results obtained. Typically,in such an analysis, data consist of: a) plant-specific data. b) generic data, and c) projected data for the proposed changes, due to lack of available ) actual data. The review objective in this area is to focus on consistent and adequate analyses and use ] of data in analyzing TS changes. The input data used in the PSA study are not necessarily the focus of i the review, but only relevant portions that have dominant influence on the results of the TS analysis or are added for the analysis are addressed in the review. Use of Plant-Srsecific Data i Request for plant-specific TS changes is expected to include plant-specific data. If the plant-specific data available are not sufficient and are used in combination with generic industry-wide data, then the review focusses on the way plant-specific data are treated. In general, there must be consistency in the treatment of data. For example, when increased risk for a TS change is assessed, the use of plant-specific data shculd be consistent in evaluating both the risk-impact of the existing TS requirement and that of the proposed changed requirement. Specific data items that are relevant for review of TS changes relating to AOTs and STis are discussed below. i j 8 l DDN

DRbW Rer air / Maintenance Data: The repair / maintenance data for the components for which TS changes are being requested are used for calculating the risk measures identified earlier. These include: a) scheduled maintenances performed during power' operations, the frequency of maintenance and the expected duration of the maintenances. The expected duration should' include the waiting period for which the component is unavailable along with the maintenance duration. When plants use a " rolling maintenance" schedule, then this schedule is important in assessing the risk from such a maintenance schedule. b) repair downtimes for unscheduled maintenances performed on the component. Agai'n, the downtime includes the waiting period plus the repair time. Since the repair downtime is a random variable, it can be described in terms of a distribution with a mean value and the associated ranges. c) reconfiguration of other components for maintenances may affect the risk-impact of a maintenance activity and, if credited in the analyses, is to be presented. These reconfigurations typically tend to decrease the risk-impact and can be neglected in the analysis when conservative estimates are adequate. Surveillance Test Data: The surveillance test data needed in analyzing STIs and are reviewed include: a) Detectability of the failure mode: this includes an assessment of whether the failure mode contributing to the plant risk is detected by the surveillance test or not. Typically, as assumed in the PSA, the failure modes modeled in the PSA are assumed to be detected by the surveillance test. b) Component failure rate: :his rate is typically included in a PSA in determining component unavailability. c) Test-caused transient data: this includes errors caused during tests that result in plant transients. These data are needed to assess the adverse impact of testing, and can be used to justify changes to STIs. When such adverse effects of testing are the reason for r seeking STI changes, then these data should be presented. Common-Cause Failures and Human Error Data These contributors in a PSA model can dominate the total core-damage frequency contribution. Conservative estimates of these parameters can minimize the risk associated with TS changes. The review objective is to assure that realistic estimates, as opposed to unnecessarilyconserva tive estimates, for these parameters, are used in the evaluation. 2.6 Check on Quantification Performed One aspect of the review is to assure that the quantifications presented are correct. Usually, these quantifications are performed using an available PSA computer code package. For example, the STP analyses use the RISKMAN computer code package developed by PLO, Inc. of Newport Beach, California. The check on quantification is performed by requantifying the calculations presented in the submittal. This aspect is, however, one of the resource-consuming aspect of the review. At the same i i 9 i l

%%W i time, it is not necessary to requantify all the calculations presented. The review can selectively perform requantification to assure that the results presented are correct. The review of the quantified results through requantificatioriis not, however, review of the computer code;in this case, the RISKMAN computer code. The qu,antification performed by the code, and its methodology is considered acceptable. The requantification process assures that corresponding to the case analyzed appropriate inputs and assumptions are used in quantifying the results. In essence, the review objective here is to assure that the quantification process has-no error of truncation: in quantifying the core-dama l cut-sets are truncated at a certain value, e.g.,10'l,ge frequency, the acc a) when quantifying the effect of TS changes. However, in many cases, the affected contributors belong to cut-sets that may normally be truncated. It is necessary that adequate precautions are taken to include such cut-sets if they are to influence the results. b) appropriate calculation of conditional risk: the calculation of risk measures needed in analysis of TS changes (AOTs and STIs) involve calculation of conditional risk given that a component or a train is unavailable (i.e., unavailability is equal to 1). In this calculation boolean reduction needs to be performed to obtain correct results. ] 1 2.7 Sensitivity and Uncertainty Analysis In a PSA-based analysis ofTS changes, there are a number of assumptions and uncertainties that impact the results obtained. The quantification of the results discussed above are usually performed in terms of point estimates and are considered adequate for TS risk analysis. However, these analyses should be supplemented by sensitivity and uncertainty analyses. In general, important assumptions are l l handled through sensitivity analysis supplemented by limited uncertainty analysis. This also controls the resources needed to perform these evaluations. Sensithity analyses are expected to address the major issues or assumptions in the submittal that may affect the core damage frequency impacts presented in the analysis. Examples of issues to be addressed in a sensitivity analyses are: j a) impact of variation in repair policy due to AOT changes, b) effect of separation of demand vs. standby time related contribution to component --- unavailability, c) effect of multiple component outages that may be considered likely due to changes in AOTs, and d) impact of variation in common cause and human error contributions. Uncertainty analyses can be used to address the impact of data uncertainties in the calculation of the risk measures used. The main reason for the uncertainty analysis is to determine whether the TS changes will result in much larger uncertainty in the risk of the plant; in this case, as measured in terms of core damage frequency. When multiple TS changes are requested, the impact of uncertaintyin the new core damage frequency incorporating all the requested changes is to be assessed. Uncertainty analyses of individual changes are expected to be covered by the analysis covering all the changes. 10 hr i

D C. A W T ~ 2.8 Decision Framework (Criteria) Used The technical specification modifications to be decided are usually based on a number of factors: a) quantitative risk analyses results, b) qualitative considerations in addition to the quantitative analysis, c) operational benefits to the plant, and d) other available alternatives. The review effort is to address the decision frariework or the criteria used to arrive at the requested TS changes. If the changes { requested in the submittal would mean increased risk during operation, then any proposed measures to control or trade-off the increased risk are also expected to be discussed. 2.9 Presentation of Results The documentation of the analysis which is necessary to support the TS changes is substantial. i Large amount of information being developed and analyzed is to be succinctly presented. This is necessary not only for the reviewers to understand the analysis performed and the assumptions made, but also for future references in regulatory decisions both by the plant staff and the USNRC. The documentation should address all the aspects discussed above. To summarize, this includes: a) reasons for the request, b) identification and discussion of the issues addressed in supporting the requested changes, c) models and data used to perform quantitative analyses, d) assumptions in the analysis, c) presentation of quantitative results with relevant intermediate results, l f) sensitivity / uncertainty analyses, g) decision framework (criteria) used, and h) presentation of any alternatives studied. In addition, a summary of the requested changes, reason for the changes, impact of the changes on plant risk, any changes in plant procedures or activities, and safety and operational benefits to be achieved from the changes, should be presented. i f i i 11 "R*G T

3RAF r 3. REVIEW OF TIIE STP SUBMITTAL FOR TECIINICAL SPECIFICATION MODIFICATIONS This chapter presents the technical review of the STP submittal. First, the general characteristics of the submittal are presented. Then, to what extent each of the issues presented in the previous chapter are addressed in the STP submittal is discussed. The focus of this chapter is to define the additional analyses, based on the review of the submittal, that are to be performed to support the proposed TS modifications. 3.1 Main Characteristics of the Submittal The South Texas Project (STP) submittal for TS modifications, dated February 1,1990, has 3 3 attachments (ST-HL-AE-3283, referred in this chapter as STP 3283). The Attachment 3 of STP 3283 contains the PSA-based analyses of TS changes. The submittal has the following main characteristics: 1. In the STP PSA, the method used to construct the risk model is the "Large Event Tree / Small' Fault Tree" approach.- To construct and solve the plant risk model, the RISKMAN computer code package was used. 2. The computer model provided by STP to BNL has two important differences with the computer model used in the STP 3283: i) It is based on the IPEs model, which was developed subsequent to STP 3283, as discussed earlier. There are a number of changes in the IPE model compared to STP 2 3283 (which is based on the PSA ), ii) It uses a later version of RISKMAN"; a personal computer (PC) version as opposed to the mainframe version used for STP 3283. 5 3. The IPE is considered the base case for estimating the risk-impact of the TS modifications. 4. The risk-impact of the proposed changes are evaluated by modifying the maintenance durations and test intervals, and then calculating the corresponding new system unavailability and core I damage frequency (CDF) for the plant. 5. Point estimates are used to quantify the impact of TS changes, i.e., the poiut estimates of CDFs are calculated using the mean values of the input parameters to obtain the differences in CDFs due to TS changes. 6. Sensitivity analyses are provided to address some of the assumptions in the evaluations. The - uncertainty in the CDF due to the proposed modifications is not evaluated using any formal j uncertainty propagation methods. 7. STP 32S3 incorporates plant-specific data. Most of plant-specific data were neither incorporated 2 in the STP PSA nor in the STP IPE.5 1 12 j ' dew

m__ DUW z ~ 8. Several of the assumptions used in the PSA-based analysis of TS changes are similar to those ~ observed in this type of analysis. For example, the component failure rate, human error of l restoration following test, are assumed independent of the test interval. Similarly, the effect of increased AOT is not credited to reduce the maintenance frequency of a component. Other assumptions in the analysis are discussed in the subsequent sections. 9. The TS changes are basically justified on the basis of" minimal" increase in CDF, as quantified f using the PSA-model of the plant. Each of these items is discussed in the following sections of this chapter. i During the review period, the BNL review team studied the STP submittal and the IPE-based RISKMAN model, and, in parallel, STP was also performing the new IPE-based calculations and providing additionalinformation on an "as requested basis". The review, as discussed before, identified specific items that need to be addressed in support of these TS changes. These include reevaluation of some of the analyses presented in STP 3283, and also, evaluation of additiondt issues. A summary of these items, as submitted to USNRC and STP,is presented in Appendix C. At the end of the discussion of each of the relevant issues presented in the following sections, a reference is made to the corresponding items in Appendix C in the following format: Item Requested: Corresponding number of the item (s) in Appendix C. 3.2 Review Analysis of the Basis for Requesting Modifications The reasons and the justifications for the proposed modifications, as gleaned from the STP 4 submittal 3283, are discussed below. Reasons for the Modifications 'ihe STP reasons for seeking the modifications can be summarized as follows: [ 1. The South Texas Plant consists of safety systems with 3 electrically independent and physically separate trains whereas its TSs are based on standard TSs for plants with 2 train safety systems. This added safety of the 3 train design can be used to modify (or extend) AOTs and STIs for these systems. 2. The TSs relaxations, particularly the AOT relaxations,will allow more effective maintenance to be carried out. 3. Because of the 3 train design, the number of tests and maintenances required for the plant can l be 50'7c more compared to plants with 2 train safety systems. By extending AOTs and STIs, operational flexibility can be achieved, which is expected to have positive influence. The reasons, presented by STP, for seeking the TS modifications are, in general, considered valid. However, these reasons, presented in a generic sense, need to be amplified for individual cases. Accordmg to the review, these reasons do not fully apply in all the cases being proposed for j modifications. For example, the AOT for Chemical and Volume Control System (CVCS) is being proposed for extension, but it has only two charging pumps, and r.at three. Also, as discussed later, L 13 i i WY

MW t AOTs can be used for both scheduled (preventive) and unscheduled (corrective) maintenances. The ~ planned use of the extended AOTs in all the individual cases should be clearly identified. Item Requested: 1 (in Appendix C). Justifications for the Modifications The primary justifications for the modifications can be summarized as: 1. The increases in CDF and system unavailability which are calculated for the proposed TS relaxations are insignificant and are within the PSA uncertainties. 2. The analysis and justification which are presented are similar to other past analyses. These kinds of justifications have been presented to the NRC for TS relaxations for which approval was granted for the proposed relaxations. l The review approach discussed here is to assess the validity of the first justification, i.e., that the increases in CDF are insignificant. These increases in CDF due to AOT/STI changes are systematic increases and are not necessarily comparable to PSA uncertainties which address random variations. 33 Review Analysis of the Risk Measures Calculated in Quantifying Risk Effects ofTS Modifications < Modeline of AOTs: Tvnes of Maintenance There are two different types of maintenance. One is known as corrective or unscheduled maintenance or repair, which is required when an unexpected failure or degradation needing repair is detected. This type of maintenance is called an unscheduled maintenance in this report. The other type of maintenance is known as preventive or scheduled maintenance, which, as it name implies, is maintenance performed on a weil defined and fairly fixed schedule. This type of maintenance, is called scheduled maintenance in this report. Scheduled Maintenance at STP The scheduled maintenance at STP is performed using a rolling maintenance schedule of twelve l weeks, where trains of several systems are taken out of service or placed into a tripped condition for one given week for scheduled maintenance. This means that every week, of the 12-week rolling maintenance schedule, has a different increased risk. These different risks would constitute the riskprofile during the 12-week rolling maintenance schedule. This risk profile was provided to the review team as a supplemental information.7 i The approach of the STP submittal to evaluate the risk impact of the proposed modifications essentially consisted of changing the maintenance duration and the test interval for the relevant systems and their components. Then, an evaluation was performed at two levels for each of the systems for which a modification has been requested. These two levels are the system unavailability and the CDF. This kind of evaluation is comparable to the

• Average Yearly Risk" of the changes, as defined in Section 23 and Appendix B.

The analysis of this approach is given in the following subsections. 14 'D R Avr

D % A V-T I.evel of Analvsis STP proposed modifications of TSs cover systems that are needed to prevent a core damage and also those relating to prevention of containment failure. The 11 TS items being reviewed at this time relate to systems that are needed to prevent a core damage. Therefore, the review is primarily focussed on assessing the impact on the CDF. The system unavailability analyses are not expected to have significant influence on the decision to change the TSs. However, the impact of a TS change may have an uneven impact on the accident consequences. For example, high consequence core damage sequences may be affected more strongly compared to low consequence core damage sequences. Also, the impact on a particular initiating event category may be larger compared to others. Analyses of these aspects, in addition to the CDF impact, enhance a risk-based submittal of TS changes. The 5 TS items, for which qualitative arguments are presented, relates primarily to systems for the prevention of containment failure. A level 2 PSA analysis is considered appropriate for these types of TS changes. To justify these TS changes, quantitative evaluations can be performed using a Level 2 PSA. As discussed earlier, these TS items were not the focus of this review. 1 Items Requested: 4,7 AOT Risk Analysis The " Average Yearly Risk,' measured in terms of CDF, is the only risk measure that has been provided in the submittal. This measure does not address all the risk-implications of a modification to an AOT. Several other risk measures, as discussed in Chapter 2 and Appendix B, should be calculated. These include the single AOT risk measure, incorporating the conditional CDF given a component or train is unavailable, and the yearly AOT risk measure. The average yearly risk calculated in STP 3283 addressed unscheduled (corrective) maintenances, and not scheduled maintenances. Since STP does not exclude the use of AOTs for scheduled i (preventive) maintenances, the risks associated with performing scheduled (preventive) maintenances during power operation should be adequately addressed. The modeling of scheduled (preventive) maintenance should be presented in detail. From the available information (see Table 1-1,of Appendix D), it appears that " Preventive Maintenance"is not modeled for several of the systems for which a modification has been requested. If AOTs for these systems are not to be used for preventive maintenance during power operation, then it should be stated clearly in the submittal. For a modification to an AOT, the submittal additionally should address the following items-i) There is not a clear distinction of whether the proposed AOT modifications apply to unscheduled or to scheduled maintenances, or to both. ii) It seems that STP plans to use the modified AOT for both scheduled and unscheduled maintenances. However, STP 3283 states that, less than 10% of " repairs" exceed the. current 3 day AOTs. STP 3283, in page 3-7, uses the word ' repairs" to develop the maintenance distribution, and therefore, we infer the distribution developed would apply to unscheduled maintenances only. However,it appears that the primary use of these extended AOTswill be for scheduled maintenances. The STP submittal should state how extended AOTs will be used for scheduled maintenances. 15 RAVT

~'5)%VT j e i iii) Based on the planned use of AOTs for scheduled maintenances, the risk profile of the ~ rolling maintenance schedule could be affected. PLG, on behalf of STP.7 performed a study of the risk prctile for the 12-week rolling maintenance schedule. However, this study does not provide the rolling maintenance schedule risk profile under the conditions of the proposed AOTs. j In addition, in most of the cases, modifications of'AOTs are requested from 3 to 10 days. i This increase to 10 days would mean that the scheduled maintenance could take more than the week assigned to h in the rolling maintenance schedule, in the extreme case i taking up to the full 10 days. This could mean either a misadjustment in the rolling maintenance schedule or a non-aanaged increase in risk, or both. This important issue is not addressed in STP 3283. l Items Requested: 1,Sa,Eb,10a,10b,10c,10d,11. STI Risk Anahsis l For modification of the STIs, the st.bmittal presents an analysis of the change in CDF due to changes in the respective STIs. This analysis presents the impact, of STI changes in a safety system, on i the average CDF for the plant. The STI risk anlaysis should address the risk contribution associated with t cach of the surveillance tests affected by the changed STI. These measures are briefly discussed in j Appendix B and References 8 and 13. Since adverse effects of testing are not used as a reason for extending these STIs, quantification of these aspects are not necessary, and are not presented in STP l 3283. l l Item Requested-Sb. Total Risk Imr.act i When multiple AOTs and STIs are propcsed to be changed, the total risk impact of the changes i should be evaluated. The total risk impact, measured at CDF, is comprised of three items-i a) total impact of all the requested AOT changes together, b) total impact of all the requested STI changes together, and c) total impact of all the requested AOT and STI changes together, The totalimpact is meaningful to assess in terms of the average CDF estimates. These impacts were addressed to some extent by STP 3283 as a seruitivity analysis (appendix B of the 3283). However, the following points need to be addressed, which inck de reevaluation using the IPE model and additional evaluations: 1. Evaluation of items a, b and c using the IPE-based model. 2. The CDF calculations discussed above are to be separated showing the particular contribution from each of the major initiating event catepries (e.g., large loss of coolant accident, loss of offsite power). ) 16 "D %FT' )

D RAW ) l Item Requested: 7. J i 3.4 Review Analysis of the Adequacy of Modeling TS Parameters in the Risk Model The RISKMAN code used in the evaluation can model separately each of the alignments (states) in which a system may be found, such as scheduled maintenance, unscheduled maintenance, and test. Table 1-1 of Reference 7, reproduced in this report in Appendix D presents the alignments modeled in ) the PRA, and therefore in the IPE. There are four columns in this table showing the relevant TS l alignments, two for AOTs: Preventive Maintenance (scheduled maintenance), and Corrective l 4 Maintenance (unscheduled maintenance); and two for STIs: Test Induced Maintenance and Testing. d I This table shows that in several cases only the unscheduled maintenance is modeled. Also, i several relevant alignments for " Testing", and ' Test Induced Maintenance" are not modeled. Therefore, the use of the current risk model may have provided an inaccurate (optimistic) assessment of the risk-impact of the proposed modifications because the modelitself does not contain the elements to evaluate some of the proposed changes. This issue, by itself, is fundamenta'l to STP's p~roposal and needs to be addressed in the new submittal. \\ Item Requested: 1. I To gain insights into the modelling ofTS parameters and the implementation of the modifications i in the RISKMAN code, the BNL review team performed a comparison of the parameters used to j quantify the impact with or without the modifications. As an example, Appendix E presents two types l of comparison performed. First, any difference is mnked by a bracket pointing to the reason for the j modification. Second, all the local variables are shown, with the ones which were modified in bold. To the right of the modifications appear, first, the original value and, then, the modified value together with j the reason for the change. This comparison assisted the reviewers in identifyinghow the TS parameters l l are modeled in quantifying their m1 pacts. Modelinnof AOT Risk Anaksis l With regard to the AOT parameters, three important points are discussed below. n Use of Plant-Stsecific Data i The STP submittal, when assessing the impact of the proposed changes, incorporated plant-i j specific data, along with the change being evaluated, into the RISKMAN model. Since these two l l modifications, which are different in nature, were included simultaneously into the RISKMAN model, the results obtained were a mixture of the etfeet of both kinds of modifications, and are not an evaluation l l of the modification to the TS. l a l A critical example of this situation is the result obtained for the Chemical and Volume Control f system, where a decrease of -2.917c at the system level (see Appendix F) is a contradiction, since, as modeled, any increase in AOT leads to an increase in risk. f 1 To evaluate the risk. impact of the proposed modifications, i.e., when an increase in risk is bemg j estimated, the base model and data used for both the cases should be consistent. If plant-specific data are used, then both cases, with and without the modifications, should treat the data in the same manner, I s I j 5 i DWx

%S.AW [ t Update of Repair Distribution 7 l t In mo t cases, the AOT modification requested was from 3 to 10 days. No STP specific or l industry data are available to estimate the repair distribution for a 10 day AOT. STP 3283 describes the process followed to develop a repair distribution for 10 days. Figures 3-1 to 3-6 of STP 3283 show graphically this process. Essentially, STP us;d the PLG generic data for a 7-day AOT and updated it 4 with its plant-specific data. The PLG generic data represents rnuch more operating experience than the operating experience at STP, and this update was done

• graphically" by shaping the distribution to the i

conditions observed in the limited operating experience at STP. The basis and the assumptions in this process needs to be defined clearly. Because of the assumptions involved, this aspect can be addressed in a sensitivity analysis. A summary of the input parameter values used in CDF quantifications will help discern the assumptions. l Item Requested 2. l inconsistent Use of TS Parameters For evaluating AOT changes, the original risk model used the full duration of the AOT,i.e.,3 days for most of the cases. For the modified case, the submittal used a mean value for the repair l duration corresponding to an AOT of 10 days. The mean value was obtained through hionte Carlo sampling from a repair distribution, as discussed above. However, the result obtained using a mean value from sampling a distribution cannot be compared with the result obtained using the full AOT. Calculations for comparison should be done under the same conditions to actually evaluate the risk-impact of a proposed modification to an AOT. i Modelinn of STI Risk Analysis l For STI changes, STP 3283 originally used a value of f, of 0.3, which meant that from the total number of failures per demand, a fraction of 0.3 was due to ' standby failure" and the remaining 0.7 was due to the " shock" caused by actually demanding the component to operate. However, new analyses provided to BNL use a value of 1.0 for f,. This new value of f, has been implemented in the RISKhiAN model provided to the review team at the level of at least all the systems for which a change is requested. The assumption of using a value of 1.0 for f, gives more weight to the changes to the STIs, as it means that all failures per demand are due to the increase in unavailability as a function of time (test interval).. This assumption results in conservative estimates and is acceptable. Since common cause failures can also be detected by tests, then a modification to the test interval has an impact on the unavailability due to changes in the common-cause contribution. The RISKhiAN model can directly account for this effect if the common-cause term is modeled as a function of the test interval. hiodeling of the common cause terms for the TS items being considered should be discussed to clarify this aspect. Underestimation will result if the effect of test interval on the common cause term is not modeled. Item Requested 2. 3.5 Check on the Correctness of Quantifications Performed i As mentioned earlier in this report, the quantifications presented in STP 3283 are no longer applicable because the base-case PSA model has been changed to the IPE model. Therefore, the IPE IS 7 RAW

DRWT' is the base case with which calculations for modifications of TSs are to be compared. Parallel to this review, the STP PSA group has been performing essentially the same calculations carried out in STP 3283, but with the RISKMAN model corresponding to the IPE. The results of these calculations, provided by STP, are presented in Appendix F. The results presented in appendix F have the following characteristies-a) System Unavailability Level i) Evaluations performed using Monte Carlo Simulation with 5000 iterations providing an uncertainty analysis. ii) Results presented in Appendix F are mean values. b) CDFlevel i) Point estimate evaluations using the mean obtained at the system unavailability level for the split fractions affected by the modifications. L ii) Results presented in Appendix F are point estimates. With the objective of verifying the calculations provided by STP, the BNL review team has performed the same calculations at the system unavailability level. The results of the calmlations done by STP and the BNL review team are identical. As shown in Appendices A and F. STP also performed calculations at the level of CDF for 11 of the proposed changes. The BNL review team performed a calculation at this level for the proposed change to the Residual Heat Removal, again obtaining identical 4 results. Evaluation by the BNL resiew team of some of the risk measures, discussed in Section 2.3, was I also carried out for the CVCS, and are presented in Appendix F. j item Requested 4. l Since the mean of the distribution obtained at the system unavailability level is used for the point estimate calculation at the CDFlevel, the method used to obtain the uncertainty distribution and the + mean value at the system unavailability level must realistically represent the impact due to the proposed changes. A sensitivity analysis performed by BNL for the Component Cooling Water system shows that l the mean obtained is increased by a factor of about 3 when the Latin Hypercube method of sampling is i used. This difference is significant and accordingly, the sampling method used should be justified. If the I sampling method used is expected to affect the results significantly, then this should also be addressed j in a sensitivity analysis. Error of Truncation The quantifications performed at the CDF level calculations, a cut-off value of 10'Igstem unavailability level used complete set of cutse was used. Use of a cut-off value is necessary to manage i the large number of cutsets. In the base case (IPE), the total unaccounted value for the evaluation usmg 4 this cut-off is 4.1 x 10, which is around 1% of the total CDF. The error of truncation becomes important when reinimal cutsets from the base case, truncated f at a certain value, is used to quantify the impact of a TS change. If cutsets are regenerated using the 'i 19 i WT

Q AW \\ i changed inputs due to a TS change, then the error of truncation is minimal. In general, the STP submittal used regenerated cutsets and the truncation did not affect the results. However, since in many l of the cases being evaluated the impact on CDF is less than Wc, the level of truncation and the corresponding contribution of the truncated cutsets should be assessed and presented. j Item Requested-9. Completeness of Ouantifications Quantitative evaluations were provided for 11 systems. For 10 of them, evaluations were l provided for both system unavailability and CDF. However, for the case of the Accumulators, only a quantification at the system unavailability level has been provided, but not at the CDF level. A' l quantification at the CDF levelis required for this system. + Separate Evaluation ofimpact of AOTs and STIs When modifications to both the AOT and the STI for a system are requested,in addition to providing the total risk-impact for both changes taken together, the analysis should include the risk-l impact of the AOT change separately from the risk-impact due to the STI change. i Item Requested: 6. Specification of Ouantifications i One of the proposed modifications (control room HVAC) affects an initiating event in the model. r To estimate the impact of a TS change, the effect on the initiating event should be considered. -[ When the review started, the initiating events were still in a previous version of RISKMAN and I were not incorporated into the computer model provided to BNL Later on, models were provided with l updated versions of the initiating events, but a different naming scheme was used. Therefore, a clear specification regarding the initiating events affected is required stating: i) The names of the initiating events affected by the modifications. ii) The way in which the affected initiating events are incorporated into the complete risk model. iii) The way in which the affected initiating events are modeled, i.e, by an uncertainty distribution or a point estimate. Item Requested 8. 3.6 Review of Sensitivity and Uncertainty Analyses Performed i Sensitivity Anahses Appendix B of STP 3283 presents three sensitivity studies. Since STP 32S3 is based on the PSA and not on the IPE, all the sensitivity analyses presented are not directly applicable. However, they provide certain insights. The insights from each of the sensitivity studies, performed by STP and not repeated by BNI, are discussed in turn in the following subsections. l j 20 a % QAW

%W AOT Sensitivity A sensitivity analysis was performed where the entire proposed AOT duration was used to estimate the impact on CDF. This sensitivity study can essentially be consider'ed the yearly AOT risk, i and is to be estimated using the IPE model (as discussed in Section 3.3). i j In addition, as mentioned before, several relevant maintenance alignments are not modeled and, therefore, the CDF is less sensitive to increases to the AOTs. For example, for the Component Cooling Water, an increase of 5.3% is reported as a result of the sensitivity study. However, from its three trains, only one has alignments corresponding to scheduled and unscheduled maintenances.. The other two trains do not have any of these alignments, and therefore, are completely unsensitive to changes of the A O T. i i STI Sensithity A sensithity analysis was performed by changing the factor f, from 0.3 to 1.0. Since the value of f, equal to 1.0 has been standardly used in the IPE-based calculations submitted by STP (those ghen in appendix F), then this sensitivity study is no longer required. J Combined AOT and STI Sensithity a 3 The sensithity of selected combinations of proposed AOTs and STIs on the CDF was studied. The combinations were chosen from the original 22 TS items, which included 6 items later withdrawn from consideration. Most of the combinations analyzed include one of these 6 items and the sensithiry l j study is no longer useful. ] Section 3.4,' Total Risk Impact", of this report has previously identified the requirements on this i j aspect, and the item requested in Appendix C is repeated below for clarity and completeness. j Item Requested-7. i ] Additional Sensitivity Anahses l As discussed above, the sensitivity analyses presented in STP 3283 are covered as the risk 1 a measures to be calculated in risk-based analyses of AOT and STI modifications. For example, the sensithity study when full AOTis used as the maintenance duration corresponds to the yearly AOT risk l discussed earlier. However, there are other important assumptions in quantifying AOT and ST) risk impacts that should be addressed using sensitivity analyses. In general, sensitivity analyses should address l major assumptions in the methodology that impact the assessed risk impacts. Examples of such issues are: a) impact of repair policy due to AOT changes: this may affect the repair distribution and { ) the mean repair time, resulting in different risk impact for modified AOTs. l b) impact of variation in common cause and human error contributions-in many cases, these contributions may mask the impact of TS changes. These contributions are associated with larger uncertainties, and can be changed to observe if the TS risk impact 1 is substantially altered. l 21 ) 1 MRWT

%CAF Item Requested: 12. Uncertainty Anahses The risk-impact of the proposed changes, at the CDF level, is calculated in terms of point estimates. No uncertainty analysis at the level of CDFwas provided. An uncertainty analysis of the new estimate of CDF given all the proposed changes should be calculated for comparison with the base case uncertainty analyses. The uncertainty analysis at the CDF level performed by RISKMAN is based on the Importint Sequence Model. For the case of the STP plant, this model accounts for about 80% of the total CDF. The effect on the estimation of the uncertainty distribution of the CDF due to the elimination of the non-dominant accident sequences accounting for the remaining 20% of the mean CDF should be discussed. Item Requested 13. 3.7 Analysis of Dectsion Framework (Criteria) Used The primary decision criteria used by STP is that the increase in average CDF due to the 73 change is minimal. Presumably, because of this criterion,6 of the 22 changes, proposed in the original STP submittal, were withdrawn. No alternatives to the modifications presented are evaluated or presented. A decision framework that addresses the important considerations in identifying the TS modifications needed in plant operation and supported by risk analyses can strengthen the request for such modifications. 3.8 Presentation of Results STP submittal 3283 along with the RISKMAN Computer model of the plant provides significant amount of information. Supplemented by the additional analyses requested in this report, the documented information for the TS changes is substantial. The presentation of results can follow a similar order as that presented in this teport in discussing the submittal. l 22 b%W 1

RWT t 4.0

SUMMARY

nis report presents a framework to review a probabilistic safety assessmcat (PSA)-based analysis of modifications to aspects of Technical Specifications (TS) requirements for nuclear power plants. The aspects of TS discussed are allowed outage times (AOTs) and surveillance test intervals (STis). Using the framework, a technical analysis was performed of the South Texas Project (STP) submittal to modify 11 of their AOT/STI requirements. The technical analysis of the STP submittal included quantitative reassessment of the risk hnpact of TS changes. RISKMAN computer code package, the same package used for STP submittal, was used for the review analyses. The technical analyses has identified specific issues that need to be addressed and additional evaluations that are to be performed in support cf the proposed changes. ~ a i WT

1 ~~b9JW \\ l REFERENCES 1. Houston Lighting & Power, " Proposed Amendment to the Unit I and Unit 2 Technical Specifications Based on Probabilistic Risk Analyses", Document ST-HL-AE-3283. February 1, 1990. 2. Pickard,1. owe and Garrick, Inc.,

• South Texas Project Probabilistic Safety Assessment", PLG-0675, hiay 1989.

3. Wheeler, T. A., et al,"A Review of the South Texas Project Probabilistic Safety Analysis for Accident Frequency Estimates and Containment Binning", NUREG/CR-5606, August 1991. 4. Pickard, Lowe and Garrick, Inc., "RISKhiAN 3 Computer Code User Manual", Revision 0/Vhi, PLG-0M4, August 1988. 5. Houston Lighting & Power Company,

• South Texas Proje'ct Electric Generating Station Level 2 Probabilistic Safety Assessment and Individual Plant Examination", August 1992 6.

Houston Lighting & Power, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical Specifications", Document ST-HL AE-4261, November 11,1992. 4 7. Fleming, K,N., Loh, W.T., " Risk Impact of hiaintenance Configurations at South Texas Electric Generating Station", Draft, March 10,1993. 8. P.K. Samanta, S.M. Wong, and J. Carbonaro,

• Evaluation of Risk Associated with AOT and STI Requirements at the ANO-1 Nuclear Power Plant," NUREG/CR-5200, BNL-NUREG-52024, August 1988.

9. W.E. Vesely," Evaluation of Allowed Outage Times from a Risk and Reliability Standpoint," NUREG/Cli-5425, BNL-NUREG-52213, August 1989. 10. P.K. Samanta, W.E. Vesely, l.S. Kim, " Study of Operational Risk-Based Configuration Control," NUREG/CR-5641, BNL-NUREG-52261, August 1991. j 11. D. Wagner, W.E. Vesely, and LA. Minton," Risk-Based Evaluation of Technical Specifications," EPRI-NP-4317, Electric Power Research Institute, March 1987. 12. Draft I AEA-TECDOC," Risk-Based Application of Nuclear Power Plant Technical Specification Improvements, September 1992. 13. I.S. Kim, S. Martorell, W.E. Vesely, and P.K. Samanta, " Quantitative Evaluation of Surveillance Test Intervals including Test Caused Risks," NUREG/CR-5775, BNL-NUREG-52296, February 1992. 14. Pickard, l. owe and Garrick, Inc., *RISKMAN, PRA Workstation Software", Release 3.0. 24 T h W. lo

RAW Appendix A Proposed Modifications to the South Texas Project (STP) Technical Specifications This appendix presents the proposed modifications to the Technical Specifications, together with the type of analysis p;ovided by STP to support the modifications. The list presented contains 16 of the modifications proposed by STP in their submittal. As discussed in the main body of the report,11 of these modifications were analyzed quantitatively and are reviewed in this report. 1 i l ] f j t 25 R.M T~

d p Proposed Modifications to the Technical Specifications System Proposed Modifications Type of Analysis lr Donc by STP AOT (Days) STI (Days) Chemical and Volume Control 3 -- > 10 N/C' System, Core Damage (i.e., Charging Pumps) Reactor Protection N/C 62 -> 92 System, Core Damage Engineered Safeguard Featurcs N/C 62 --> 92 System, Core Damage Actuation i Pressurizer Safety Valves 15 min --> 1 hr N/C Oualitative Accumulators I hr --> 12 hrs N/C System Emergency Core Cooling 3 --> 10 N/C System, Core Damage y Residual IIcat Removal 3 --> 10 92 --> 184 System, Core Damage Containment Ventilation N/C 31 --> 92 Oualitative Containment Spray 3 -- > 10 92 -> 184 System. Core Damage Reactor Containment Fan 3 -- > 10 31 --> 92 System, Core Damage Coolers Containment Isolation 4 hrs --> 24 hrs N/C Oualitative tr Steam Generator Safety Relief 4 hrs --> 24 hrs N/C Qualitative Valves I L l Component Cooling water 3 --> 10 N/C System, Core Damage Control Room IIVAC 7 d (1 t),24 hr (2 t) --> 31 --> 92 System, Core Damage 10 d (1 t),72 hr (2 t)" S e p.._._.._--...-...-...... - - - - ^ - - - - - - - ^ ~

f P 1 C Proposed Modifications to the Technical Specifications (Cont *d) - System Proposed Modifications Type of Analysis AOT (Days) STI (Days) EIcetrical Auxiliary Building N/C 12 hrs -> 24 hrs Qualitative llVAC Essential Chilled Water 3 --> 10 N/C System, Core Damage Notes: N/C means No Change Requested (1 t) = "irst inoperable Train (2 t) = Second Train of Three O 9 s M ..._-_._.___._._________._-_,__mm__mm .-m . ----e s--,, - -, w- -n.-. c%--

DRA6 Appendix B Definition of Risk Measures for Technical Specifications Studies This appendix presents a brief description of relevant risk measures associated with AOTs and ~ ~ l STis for Technical Specifications studies. A) AOT Risk Measures l 1

1. Conditional CDF due to an AOT. CDF given the system has entered the state of AOT. When a component (train) is out of service, the CDF will, in principle, increase by a certain amount. This 1

increased CDFis called the " instantaneous CDF' given that that component (tuin)is out.of service, and j may be called the " conditional CDF due to an AOT". This conditional CDF is not a function of the actual duration of the AOT, but is simply the new average CDF the plant is operating under, given that the component (train)in question is not operable. This conditional CDF is in itself an indication of the impact of an AOT.

2. Single AOT risk. In order to obtain a risk measure related directly to the duration of an AOT, the

" conditional CDF due to an AOT"is multiplied by the actual duration of the AOT, for example 3 or 10 i days.. This risk measure is mentioned in chapter 2, and is called the " Single AOT risk". The single AOT i risk can be calculated for the current AOT and for the proposed AOT, using the total AOT for each j case. Note that risk measures 1 and 2 are not affected by the frequency of maintenance. i

3. Average Yearly CDF. This measure takes into account the frequency of maintenance and is the product of the frequency of maintenance and the mean maintenance duration and the conditional CDF..

j Since the proposed modifications are assumed to affect the duration of maintenance only, the frequency i of maintenance is kept the same. The mean duration of maintenance, however, is given by a maintenance distribution for corresponding AOTs.

4. Conditional CDF Proille During Rolling Maintenance. CDF given that the systems are in one of the configurations of the Rolling Maintenance Schedule. This schedule has 12 different configurations, and, therefore, the profile consists o' the twelve configurations, each characterized by its respective CDF.

B) STI Risk Measure i

1. Average Core Damage Frequency Contribution Detected bv a Test, as given by:

Rp= AT(R -R) 2 o 1 [ t 28 P

. ~.. %wAV \\ I a where 1 = is the constant failure rate of the component j Rg = CDF with the component down Ro = CDF with the component up T is the test interval I i } 2 e O ? I r t i i 4 L t' S-M N G 29

DRAVT I f Appendix C Summary of Specific Items to be included in the STP Submittal ? This appendix reproduces the list of the frems to be addressed in support of the TS changes. - t i I f 9 4 0 9 4 I a l 30 4 6

' BRA 6

SUMMARY

OF SPECIFIC ITEMS TO BE INCLUDED IN THE STP SUDMITTAL - REASON FOR REOUESTING TS MODIFICATIONS

1. For the requested modifications (AOTs and STIs), present the reason for seeking the changes. Also present, how the changed AOTis planned to be used (for planned maintenance only, for unplanned or unscheduled maintenance only, or for both)? Discuss how these aspects are modeled or accounted for in assessing the impact of changing AOTs.

USE OF INPUT DATA IN OUANTIFICATION OF IMPACT OF TS CHANGES

2. Provide a I:st of basic input parameters for the components for which AOT and STI modifications are being requested. The list should include failure rate ofimportant components in the train l

maintenance frequency (unplanned and planned) mean maintenance duration test interval human error of restoration in test / maintenance (if included) demand failure contribution (if used) total train unavailability common cause failure parameters Indicate the parameters changed and changed values used for calculating the impact of TS changes. Indicate which of the parameters include plant-specific data and where generic data are used. When plant-specific data are used, please provide a summary of the data base and the method used to derive parameters for use in the analysis. SYSTEM FAULT TREES l

3. Please provide a hard copy of the fault trees used in the evaluations.

QUANTIFICATION OF RISK IMPACT OF TS CHANGES

4. Requantification of base case and increases in average CDF for each of the TS changes using the model provided to BNL, i.e., the IPE (PC) model on which the submittal is now being based. Please also provide the relative contribution of dominant initiating event categories to the average CDF for all the cases quantified.

5. Conditional CDF calculation to facilitate evaluation of single AOT risk and risk of surveillance tests.

a) Conditional CDF given the component, for which AOT is being changed, is in LCO condition, i.e., unavailable. In other words, CDF when component unavailability is equal to one. b) Conditional CDF when the component is available (i.e., unavailability is equal to zero) and when .i component is unavailable (unavailability is equal to 1). These measures are calculated in 31 1 \\MY

DRWI i ~ determining risk achievement worths and risk reduction worths. This conditional CDF may be different from (a) above, because in (a) any realignment for maintenance of the component may be included.

6. Separate evaluation of impact of AOT and STI changes, when both AOT and STI changes are requested.- For example, both AOT and STI are requested to be modified in the RHR system, but only the total impact is provided. Alongwith this total impact, the impact of changing AOT and STIs should be provided separately.

3

7. Present an evaluation of the total CDF impact of a) all the proposed AOT changes, b) all the proposed STI changes, and c) all the proposed AOT and STI changes. For these evaluations, also present the relative contribution of the dominant initiating event categories.

8. For the proposed changes that affect initiating events, please provide a list of TS changes and the corresponding initiating events that are affected.

9. For the quantifications performed (i.e., base case, effect of changing TS, conditional CDF, etc.),

please provide the cut-off values used. RISK IMPAN OF ' ROLLING MAINTENANCES" AND h1ULTIPLE COMPONENT OUTAGES 10. Risk impact of " rolling maintenance schedule" that is implemented under' AOT should be presented. This should include a) New ' Rolling Maintenance Profile

• Including the proposed changes.

b) Discussion on how rolling maintenance is incorporated in the base case. .l c) Risk profile or the core damage frequency levels associated with the rolling maintenance schedule, i.e., week to week variation in CDF due to maintenance being performed. l d) Increase in average CDF due to rolling maintenance. l 11. Assessment of simultaneous outages of multiple components during operation due to extension of AOTs and ro!!ing maintenance. Due to the extension of many AOTs from 3 days to 10 days, as requested in the submittal, and since a rolling maintenance schedule may allow components to be unavailable for a week, there are possibilities i for simultaneous outages of multiple components that may have large risk impact. Supporting risk i calculations and analyses are to be provided addressing this aspect. I SENSITIVITY AND UNCERTAINTY ANALYSIS 12. Present a selected sensitivity analysis of the major issues that can impact the increased CDF j calculation for TS changes. J \\ 13. Considering all the changes being proposed, calculate the uncertainty in the CDF for the plant. This implies only one calculation that takes into account all the changes, and not uncertainty calculation for each of TS change cases. This calculation should take into account sufficient 1 32 i

thYT number of cutset to obtain an appropriate estimate of the uncertainty ranges. A discussion should be presented on the_ effect in the estimation due to the climination of non-dominant accident sequences and the corresponding cut sets (which may account for as much as 20% of L the mean CDF). 1 I 6 4 + 33 l l D kOT. i

DW. AV 1 Appendix D Modeling of Test, Maintenance and Normal Alignments in STP PSA This appendix reproduces table 1-1 of reference 7. The modeling of relevant alignments for the proposed modifications is presented in this table. '- _ ~ ~ _ l 34 bhW

n e 7 il d Table 1-1. Modelina of Test. Maintenance and Normal Alionments in STP PSA_ System Top Status Preventive Corrective Test Induced Testing Remark Event maintenance Maintenance Maintenance ECW WA Run No No No No WB Off Yes Yes Yes No PM accounts for concurrent maint-enance on DG, ECW, and ECH WC Stdby No No No No CCW KA Run No No No No KB Off Yes Yes Yes No KC Stdby No No No No ECCS PA Stdby -Yes Yes Yes No Mairitonance and Testing Activities (Common) Affecting all Train A ECCS equip. l PB Stdby Yes Yes Yes No Maintenance and Testing Activities Affecting all! Train B ECCS equip. I PZ Stdby Yes Yes Yes No Maintenance and Testing Activities Affecting all Train C ECCS equip. ECCS RA Stdby No Yes Yes No Sump Recirculation Valve (Recir) RB Stdby No Yes Yes No Sump Recirculation Valve RC Stdby No Yes Yes No Sump Recirculation Valve ECCS HA Stdby No Yes Yes No (HHSI) g HB Stdby No Yes Yes No Pr 4

d A System Top Status Preventive Corrective Test Induced Testing Remark l Event maintenance Maintenance Maintenance f HC Stdby No YES - YES NO l I EAB HVAC FA Run No No No No FB Run No No No No FC Stdby No Yes No No ) DM(A) Stdby No Yes No No DM(B) Stdby No Yes No No l DM(C) Stdby No Yes No No RCFCs CF(A) Run No Yes No No CF(B) Run No Yes No No CF(C) Stdby No Yes No No i AFW ~ CD(A) Stdby Yes Yes No No .MD Pump train ,AF(A) CD(B), Stdby Yes-Yes No No MD, Pump train AF(B) CD(C) Stdby Yes Yes No No MD Pump train .AF(C) CD(D) ' Stdby Yes Yes. No No TD Pump train - l - ECCS(LHSI) LA Stdby. No Yes-No Yes Test for RHR HX train A q. LB Stdby No Yes-No Yes Test for RHR HX train B i LC Stdby ~ No' Yes No' Yes Test for RHR HX train C i O 4 mg ,v.-. ...m_... -,.,, _ _... -,_,.-...w.u-d.. -,.m. -..r-m . m - --,.____._ ~....-- m.

T d ^ N P T System Top Status Preventive Corrective Test Induced Testing Remark Event maintenance Maintononce Maintenance ECCS(RHR) RX(A) Stdby No Yes No No ,0C(A ) RX(B), Stdby No Yes No No OC(B) RX(C) Stdby No Yes No No ,0C(C ) CS CS(A) Stdby No Yes No Yes Test for full flow pump test CS(B) Stdby No Yes No Yes Test for full flow pump test CS(C) Stdby No Yes No Yes Test for full flow pump test ECH CL(A) Run No No No No Cooling water from ECW train A with train B as a backup;PM Modeled in ECW 1 CL(B) Run No No No No Cooling water from ECW train A with train B as a backup;PM modeled in ECW CL(C) Stdby. No Yes No No Cooling water from ECW train C only: PM modeled in ECW CVCS CH(A) Stdby No Yes No Yes Testing on CCW train C CH(B) Run No No No No PD Stdby 'No Yes No No includes maintenance on PD pump and TSC diesel generator DGS GA Stdby No Yes No Yes PM modeled in ECW -fi d

N System Top Status Preventive Corrective Test induced Testing Remark Event maintenance Maintenance Maintenance GB Stdby No Yes t'o Yes PM modeled in ECW GC Stdby No Yes No Yes PM modeled in ECW DC Power DA Stdby No Yes No No Maintenance on charger DB Stdby No Yes No No Maintenance on char 0er DC Stdby No Yes No No Maintenance on charger ESFAS, Vital lA Stdby No Yes No Yes AC, ODPS IB Stdby No Yes No Yes IC Stdby No Yes j Yes M SSPS .SS(R) Stdby No Yes ((. Yes SS(S) Stdby No Yes No Yes t 6 9 p p 4 O a

• g e

.+, .e r

'D E A F'T~ Appendix E ) Example of the Comparison of Parameters With and Without the Proposed Modifications 1 This appendix presents an example of the comparison of parameters with and without the proposed modifications. The CVCS system is used for this example, but the changes shown are typical of those carried out by STP for the systems for which an AOT extension is proposed. The appendix is comprised of two parts. In the first part the parameters that have been changed are grouped by,a bracket, which 1 in turn points to the reason for the modification. In the second part all the parameters of the local variables are shown,with the changed parameters in bold. To tl.e right of the description of the changed parameter is the original value. In the rightmost column is the modified value, together with the reason for the change. 1 h J f a F I 39 I DDYY

DRAFT Comparison CVCS

• "" Original Model i

MODEL Name: CVCS i

• • • • • Modified Model l

MODEL Name: TESTCVCS .......u n............... TOP EVENT CH1

• * * * * " " " " * " " * * * * * * = * *
• ~**** Original Model 15:35:14 16 FEB 1993 Page 10
  • • • • Modified Model 15:36:51 16 FEB 1993 Page 10
    • " Original Model

@CVPDP LATENT FAILURE FRACTION FOR PDP 0.0 ""* Modified Model f, = 1.0 @CVPDP LATENT FAILURE FRACTION FOR PDP 1.0

• • • • • Original Model 1

GCVDGS LATENT FAILURE FRACTION FOR TSC DIESEL 0.0

• • • " Modified Moda.1 f, = 1.0

@CVDGS LATENT FAILURE FRACTION FOR TSC DIESEL 1.0 40 D9)cVT"

.DRW\\ t a

• "" Original Model

~ @CVCBI LATENT FAILURE FRACTION FOR 0.0 CIRCUIT BREAKERS ""* Modified Model f, = 1.0 @CVCBI LATENT FAILURE FRACTION FOR 1.0 l CIRCUIT BREAKERS ...e.

• • "* Original Model

@CVPMS CCP LATENT FAILURE FRACTION 0.0

• "" Modified Model f, = 1.0

@CVPMS CCP LATENT FAILURE FRACTION 1.0 .n.. i

• "" Original Model

@CVFNS LC/DG CIRCUIT BREAKER 0.0 LATENT FAILURE FRACTION ="** Modified Model f, = 1.0 @CVFNS LC/DG CIRCUIT BREAKER 1.0 LATENT FAILURE FRACTION "*" Original Model @CVVCO CHECK VALVE LATENT FAILURE FRACTION 0.0

• "" ModiDed Model

, f, = 1.0. @CVVCO CHECK VALVE LATENT FAILURE FRACTION 1.0 41 i i b

TVPT ~ ""* Original Model 15:35:16 16 FEB 1993 Page'l1

• • "* Modified Model 15:36:52 16 FEB 1993 Page 11

""* Odginal Model @CVVMO MOV LATENT FAILURE FRACTION 0.0 "*" Modified Model f, = 1.0 @CVVMO MOV LATENT FAILURE FRACTION 1.0

• • • " Original Model

@CVVMC MOV LATENT FAILURE FRACTION b.9 "*** Modified Model f, = 1.0 @CVVMC MOV LATENT FAILURE FRACTION 1.0 .n.. '"** Original Model @ZUNAV MAINTENANCE UNAVAILABLILITY OF 72.0*ZMPCGF CCP BASED ON TS LCO OF 72

• • • " Modified Model

@ZUNAV MAINTENANCE UNAVAILABLILITY OF ZMD10D*ZMPCGF CCP BASED ON TS LCO OF 72 72.0 to ZMD10D: 10-Day AOT Distribution .k. 1 42 RAW

DRM:T a

• • "* Original Model 15:35:17 16 FEB 1993 Page 12

""* Modified Model 15:36:54 16 FEB 1993 i Page 12 ...n ""* Original Model @MNTI CHARGING PUMP @ZUNAV +ZMFCGF*ZMFCGD MAINTENANCE "*** Modified Model @MNTI CHARGING PUMP @ZUNAV+ZMFCGF*ZMD10D MAINTENANCE ZMFCGD to ZMD10D: 10-Day AOT D'istribution ""* Original Model 15:35:17 16 FEB 1993 - Page 13 ""** Modified Model 15:36:54 16 FEB 1993 Page 13 ..n. "*** Original Model ZMFCGD -l "*" Modified Model ZMD10D ZMFCGD to ZMD10D: 10-Day AOT Distribution j 43 DRAVT

' 1 WT f - :i l f ................................. TOP EV ENT CH "******""*"""*""* r "*" Original Model 15:35:34 16 FEB 1993 Page 24 - ""* Modified Model 15:37:11 16 FEB 1993-Page 24' i

• • • " Original Model j

@CVPDP LATENT FAILURE FRACTION FOR 0.0 t PD PUMP i "*** Modified Model-f, = 1.0 - l -i @CVPDP LATENT FAILURE FRACTION FOR 1.0 PD PUMP i i l 1 ""* Original Model @CVDGS LATENT FAILURE FRACTION FOR 0.0 TSC DIESEL f I

• • • " Modified Model f, = 1.0

@CVDGS LATENT FAILURE FRACTION FOR 1.0 ' I TSC DIESEL l !i q "*" Original Model l @CVCBI-LATENT FAILURE FRACTION FOR 0.0 CIRCUIT BREAKERS t

• • • • • Modified Model

- f, = 1.0 i @CVCB1 LATENT FAILURE FRACTION FOR 1.0 CIRCUIT BREAKERS { ""* Original Model \\ 44 l l l ['

h ATT' A. i @CVPMS CCP LATENT FAILURE FRACTION 0.0

• • "* Modified Model f, = 1.0 l

@CVPMS """ LATENT FAILURE FRACTION 1.0 ""* Original Model @CVFNS LC/DG CIRCUIT BREAKER 0.0 LATENT FAILURE FRACTION .i l

• "" Modified Model f, = 1.0 CCVFNS LC/DG CIRCUIT BREAKER 1.0 LATENT FAILURE FRACTION n...

I "*" Original Model @CVVCO CHECK VALVE 0.0 LATENT FAILURE FRACTION ^

• "" Modified Model f, = 1.0 6CVVCO CHECK VALVE 1.0 LATENT FAILURE FRACTION

""" Original Model 15:35:35 16 FEB 1993 I Page 25 ""* Modified Model l 15:37:12 16 FEB 1993 Page 25 t b 45 RAF

'DqAFT i

• "" Original Model

@CVVMO MOV LATENT FAILURE FRACTION - 0.0 """ Modified Model f, = 1.0 @CVVMO MOV LATENT FAILURE FRACTION 1.0 P """ Original Model @CVVMC MOV LATENT FAILURE FRACTION 0.0 '"" Modified Model f, = 1.0 @CVVMC MOV LATENT FAILURE FRACTION 1.0 i 6 """ Original Model e @ZUNAV MAINTENANCE UNAVAILABLILITY OF 72*ZMPCGF CCP BASED ON TS LCO OF 72 i "*** Modified Model @ZUNAV MAINTENANCE UNAVAILABLILITY OF ZMD10D*ZMPCGF CCP BASED ON TS LCO OF 72 .__L j .- - l 72 to ZMDIOD: 10-Day AOT Distribution. """ Original Model 15:35:37 16 FEB 1993 Page 26

• • • " Modified Model 15:37:13 16 FEB 1993 Page 26 46 DRAF

MW \\

• "" Original Model

@MNTI CHARGING PUMP @7.UNAV + 7_MFCGF*ZMFCGD MAINTENANCE "*" Modified Model CMNTI CHARGING PUMP @ZUNAV+ZMFCGF*ZMDIOD MAINTENANCE ZMFCGD to ZMD10D: 10-Day AOT Distribution '"" Original Model 15:35:37 16 FEB 1993 Page 27 "*" Modi 5ed Model 15:37:14 16 FEB 1993 Page 27 """ Original Model ZMFCGD """ Modi 5ed Model ZMDIOD ZMFCGD to ZMD10D: 10-Day AOT Distribution 47 %AWT

MODEL Name: CVCS d Basic Event Report for Top Event CHI 15:35:14 16 FEB 1993 Page 10 local Variables Description Equation @Tl FIRST FLOUR 1.0 @T23 LAST 23 IlOURS 23.0 @T24 MISSION TIME 24.0 @CVPDP LATENT FAILURE FRACTION FOR PDP 0.0 1.0 f, = 1.0 @CVDGS LATENT FAILURE FRACTION FOR 0.0 1.0 A TSC DIESEL f, = 1.0 @CVCB1 LATENT FAILURE FRACTION FOR 0.0 1.0 CIRCUIT BREAKERS f, = 1.0 @TCVPD TEST INTERVAL FOR PDP 92*24 @TRFPD REFERENCE INTERVAL FOR PDP 92*24 @TCVDG TEST INTERVAL FOR TSC DIESEL. 92*24 @TRFDG REFERENCE INTERVAL-FOR TSC DIESEL 92*24- - hl @TCVCB TEST INTERVAL FOR CIRCUIT BREAKERS , 92*24 h"1 @TRFCB REFERENCE INTERVAL FOR CIRCUIT BREAKERS 92*24 11dl y 4 4 y

.g ( 9. Local Variabics Description Equation @CVPMS CCP LATENT FAILURE FRACTION 0.0 1.0 f, = 1.0 @TCVPM CCP TEST INTERVAL 92*24 @TRFPM CCP REFERENCE INTERVAL 92*24 @CVFNS LC/DG CIRCUIT llREAKER LATENT 0.0 1.0 FAILURE FRACTION f, = 1.0 @TCVFN LC/DG CIRCUIT BREAKER TEST INTERVAL 92*24 @TRFFN LC/D3 CIRCUIT BREAKER 92*24 REFERENCE INTERVAL @CVVCO CIIECK VALVE LATENT FAILURE 0.0 1.0 FRACTION f, = 1.0 @TCVVC CHECK VALVE TEST INTERVAL 92*24 @TRFVC CHECK VALVE REFERENCE INTERVAL 92*24 @CVVMO MOV LATENT FAILURE FRACTION 0.0 1.0 f, = 1.0 @TCVVM MOV TEST INTERVAL 92*24 @TRFVM MOV TEST INTERVAL 92*24 MOV REFERENCE INTERVAL @CVVMC MOV LATENT FAILURE FRACTION 0.0 1.0 f, = 1.0 o '1 1 /

Local Variables Description Equation @TCVM3 RWST SUCTION MOV TEST INTERVAL 18*31*24 @TRF18 18 MONTH TEST INTERVAL 18*31*24 @TCVM4 VCT OUTLET MOV TEST INTERVAL 18*31*24 @TCVCl RWST SUCTION CIIECK VALVE 18*31*24 TEST INTERVAL @XPMOS LATENT SHOCK TERM FOR PUMPS l-@CVPMS+@CVPMS*@TCVPM/@TRFPM @XFN25 LATENT SHOCK TERM FOR FANS 1-@CVFNS+@CVFNS*@TCVFN/@TRFFN @XVCOO LATENT SHOCK TERM FOR CHECK VALVES 1-@CVVCO+@CVVCO*@TCVVC/@TRFVC @XVMOD LATENT SHOCK TERM FOR MOTOR OPERATED VALVES 1-@CVVMO+@CVVMO*@TCVVM/@TRFVM @XVMCI LATENT SHOCK TERM FOR MOTOR OPERATED VALVES 8 1-@CVVMC+@CVVMC*@TCVM3/@TRF18 @XVMO2 LATENT SHOCK TERM FOR MOTOR OPERATED VALVES 1-@CVVMC+@CVVMC*@TCVM4/@TRFI8 @XVCO2 LATENT SHOCK TERM FOR CHECK VALVES l 1-@CVVCO+@CVVCO*@TCVC1/@TRF18 @XVCOI LATENT SHOCK TERM FOR CliECK 1-@CVVCO VALVES @SCCPF CCP TEST FREQUENCY 1/(92*24) @SCCPD CCP TEST DURATION 15/60 (d @ZUNAV MAINTENANCE UNAVAILABLILITY OF 72.0*ZMPCGF ZMD10D*ZMPCGF CCP BASED ON TS LCO OF 72 IIOURS STP Plant-Specific Maintenance d Duration for AOT of 10 Days. e

. d ~ Local Variables Description Equation a @XPMSS LATENT SHOCK TERM FOR PDP 1-@CVPDP+@CVPDP*@TCVPD/@TRFPD @XDGSS LATENT SHOCK TERM FOR TSC DIESEL l-@CVDGS+@CVDGS*@TCVDG/@TPFDG @XCBIC LATENT SHOCK TERM FOR CIRCUIT BREAKERS 1-@CVCBl+@CVCBl*@TCVCB/@TRFCB @MNT1 CIIARGING PUMP @ZUNAV+ZMFCGF*ZMFCGD @ZUNAV+ZMFCGF*ZMD10D MALNTENANCE STP Plant-Specific Maintenance Duration for AOT of 10 Days @TSTI CHARGING PUMP TEST @SCCPF*@SCCPD @MNT2 PDP MAINTENANCE ZUNAV2 @MNT3 TSC DIESEL MAINTENANCE ZMDGSFSZMDGSD 9 ds M i a r . f ,r_ ,r. e .,,_-.c

hn T MODEL Name: CVCS Basic Event Report for Top Event CHI 15:35:17 16 FEB 1993 Page 13 Database Variables HECHO1 ZGVCC1 ZTFN2R ZTVMOT HECH03 ZMDGSD ZTFN2S ZTXR2R HECH04 ZMDGSF ZTHXRB ZUNAV2 HERA6 ZMFCGD ZTPCGR HEftC6 ZMFCGF ZTPCGS i ZBFCGR ZMPCGF ZTPPCR ZBFCGS ZTBSIR ZTPPCS 7.BPCGR ZTCBIC ZTRMXB I ZBPCGS ZTCBIT ZTVCOD hg< ZBVCCI ZTDGSI ZTVCOP 1 ZBVMC2 ZTDGS2 ZTVHOT ZBVMC3 ZTDGSS ZTVMOD h ~ t ---[ S 68 e 3" --mm - u I .z ..s-m r-e ~

---

+c.-.-

a ws +W,

g~' p P MODEL Name: CVCS Basic Event Report for Top Event CH 15:35:34 16 FEB 1993 Page 24 Local Variables Description Equation @T1 FIRST HOUR 1.0 @T23 LAST 23 HOURS 23.0 @T24 MISSION TIME 24.0 @CVPDP LATENT FAILURE FRACTION FOR PD 0.0 1.0 PUMP f, = 1.0 g @CVDGS LATENT FAILURE FRACTION FOR 0.0 1.0 TSC DIESEL f, = 1.0 @CVCBI LATENT FAILURE FRACTION FOR 0.0 1.0 CIRCUIT BREAKERS f, = 1.0 @TCVPD. TEST INTERVAL FOR PDP 92*24 @TRFPD REFERENCE INTERVAL FOR PDP 92*24 @TCVDG TEST INTERVAL FOR TSC DIESEL 92*24 @TRFDG REFERENCE IN'ERVAL FOR TSC DIESEL 92*24 @TCVCB TEST INTERVAL FOR CIRCUIT 92*24 BREAKERS @TRFCB REFERENCE INTERVAL FOR CIRCUIT - 92*24 BREAKERSj f)e i y 11 I -{ i

dny Local Variables Description Equation / @CVPMS CCP LATENT FAILURE FRACTION 0.0 1.0 f, = 1.0 @TCVPM CCP TEST INTERVAL 92*24 @TRFPM CCP REFERENCE INTERVAL 92*24 @CVFNS LC/DG CIRCUIT BREAKER LATENT 0.0 1.0 FAILURE FRACTION f, = 1.0 @TCVFN LC/DG CIRCUIT BREAKER TEST 92*24 INTERVAL @TRFFN LC/DG CIRCUIT BREAKER 92*24 REFERENCE INTERVAL @CVVCO CIIECK VALVE LATENT FAILURE 0.0 1.0 FRACTION f, = 1.0 @TCVVC CHECK VALVE TEST INTERVAL 92*24 @TRFVC CHECK VALVE REFERENCE INTERVAL 92*24 @CVVMO MOV LATENT FAILURE FRACTION 0.0 1.0 f, = 1.0 @TCVVM .MOV TEST INTERVAL 92*24 @TRFVM MOV REFERENCE INTERVAL 92*24 7 @CVVMC MOV LATENT FAILURE FRACTION 0.0 1.0 f, = 1.0 'l 9 ._r 1

d 4

Local Variables Description Equation @TCVM3 RWST SUCTION MOV TEST INTERVAL 18*31*24 @TRF18 18 MONTH INTERVAL 18*31*24 @TCVM4 VCT OUTLET TEST INTERVAL 18*31*24 @TCVCl RWST SUCTION CHECK VALVE TEST 18*31*24 INTERVAL @XPMOS LATENT SHOCK TERM FOR PUMPS 1-@CVPMS+@CVPMS*@TCVPM/@TRFPM @XFN2S LATENT SHOCK TERM FOR FANS 1-@CVFNS +@CVFNS*@TCVFN/@TRFFN @XVCOO LATENT SHOCK TERM FOR CHECK VALVES 1-@CVVCO+@CVVCO*@TCVVC/@TRFVC @XVMOD LATENT SHOCK TERM FOR MOTOR OPERATED VALVES 1-@CVVMO+@CVVMO*@TCVVM/@TRFVM @XVMCI LATENT SHOCK TERM FOR MOTOR u OPERATED VALVES l-@CVVMC+@CVVMC*@TCVM3/@TRF18 ' @XVMO2 LATENT SHOCK TERM FOR MOTOR OPERATED VALVES 1-@CVVMC+@CVVMC*@TCVM4/@TRF18 @XVCO2 LATENT SHOCK TERM FOR CHECK VALVES 1-@CVVCO+@CVVCO*@TCVC1/@TRF18 @'XVCOI LATENT SHOCK TERM FOR CHECK 1-@CVVCO VALVES @SCCPF CCP TEST FREQUENCY 1/(92*24) @SCCPD CCP TEST DURATION 15/60 ($ P ..n-w ~ m e,w--,- -e,--s- ,w ~-~w w r v -..-v v -w ,n-.

d 4 1 Iscal Variables Description Equaius @ZUNAV MAINTENANCE UNAVAILAVLILITY OF 72*ZMPCGF ZMD10D*ZMPCGF CCP HASED ON TS LCO OF 72 IlvURS STP Plant-Specific Maintenance Duration for AOT of 10 Days @XPMSS LATENT SHOCK TERM FOR PDP l-@CVPDP+@CVPDP*@TCVPD/@TRFPD @XCBIC LATENT SHOCK TERM FOR CIRCUIT BREAKERS 1-@CVCBl+@CVCBl*@TCVCB/@TRFCB @XDGSS LATENT SHOCK TERM FOR TSC DIESEL l-@CVDGS +@CVDGS*@TCVDG/@TRFDG @MNT1 CIIARGING PUMP @ZUNAV+ZMFCGF*ZMFCGD @ZUNAV+7MFCGF*ZMD10D MAINTENANCE STP Plant-Specific Maintenance Duration for AOT of 10 Days M @TSTI CHARGING PUMP TEST @SCCPF*@SCCPD @MNT2 PDP MAINTENANCE ZUNAV2 @MNT3 TSC DIESEL MAINTENANCE ZMDGSF*ZMDGSD 9m l O e 9 7 00 G -,e-- e .,,,, - ~,, ,r,,- v,, n,- -e,- + - - - w

g P MODEL Name: CVCS Basic Event Report for Top Event CH 15:35:37 16 FEB 1993 Page 27 Database Variables HECH01 ZBVMC3 ZTDGS2 ZTVCOP HECH03 ZGVCC1 ZTDGSS ZTVHOT HECH04 ZMDs 1D ZTFN2R ZTVMOD HERA6 ZMDGSF ZTFN2S ZTVMOT HERC6 ZMFCGD ZTHXRB ZTXR2R ZBFCGR ZMFCGF ZTPCGR ZUNAV2 ZBFCGS ZMPCGF ZTPCGS ZBPCGR ZTBSIR ZTPPCR ZBPCGS ZTCBIC ZTPPCS ZBVCCI ZTCBIT ZTRMXB ZBVMC2 ZTDGS1 ZTVCOD y$ = 4 .,,--,s r ~, - -, ---av. n, e-- < - - - - ~*w -n- = + ~ ~ ~ - - * ~ * " ' ' ' - ~ - - - - ' ' - " - - - - - - - - ^ -

• D R.W T f

Appendix F Risk-Impact Evaluations of the Proposed Modifications to the Technical Specifications This appendix presents the evaluatiorn performed by the South Texas Project staff. Results are provided at the system unavailability level and at the Core Damage Frequency level. They are not the same as those provided in the STP 3283 because the results provided in this appendix are based on the IPE model and those presented in the STP 3283 are based on the PSA. J Also presented in this appendix are the results of example evaluations performed by BNL As noted, the reassessment of STP analyses produced identical results. In addition, an example analysis is presented for additional risk measures to be calculated for AOT modification. This include the Conditional CDF given that a train is out of service and the Single AOT Risk for the Chemical and Volume Control system (CVCS). i s 1 l i l i 1 j i j a ~ I i e f e 58

1 o.. o j T; Table F.1 Risk-Impact livaluations of the Proposed Mmlifications to the Technical Specifications-South Texas Pmject Proposed Modificatkms System Unavailability Core Dacuge Frequency System AOT(Days) RTI (Days) Ilase Case For ilNL's Percent Itase For Pertent l Case - Proposed Change (IPi!) Pmposed Verification G ange t . Sg g3 or (IPI) 'Is Change Proposed C, Change 1 S/ Changes C) t (517 IINL) Chemical and Volume 3 -- > 10 NE* 1.1 E-04 1.1 E-04 1.1E-04 -2.91 4.4E-05 4.411-05 -0.97 Control (i.e., Charging Pumps) Reactor Protection NC 62 -> 92 1.8E-04 2.6E4)4 2.6E-04 45.77 4.4E-05 4.5 E-05 0.62 Engineered Safeguard NC 62 -> 92 2.5E-06 3.04E-06 3.0l!-06 2039 4.4E-05 4.4E-05 0.11 g Features Actuation Pressurizer Safety Valves 15 min --> NC OA** OA OA OA OA OA 1 hr Accumulators I hr -> 12 NC 1.8E-03 2.2E-03 2.2E-03 24.65 MA*** NA NA 1 hrs Emergency Core Cooling 3 -> 10 NC 1.6 E-06 1.8E-06 1.8E-06 11.17 4.4E-05 4.6E-05 3.25 Residuallicat Removal 3 -> 10 92 -> 2.4E-03 2.4E-03 2.4E-03 3.10 4.4E-05 4.4E 0.08 184 4.4E-05 Containment Ventilation NC 31 -> 92 QA QA QA OA-OA QA Containment Spray 3 --> 10 92 --> 4.5 E-03 6.6E-03 6.6E-03 46.01 4.4E-05 4.4 E-05 0.00 4 184 5.6E-04 7.3E-04 7.31!-04 31.34 Reactor Containment Fan 3 -> 10 31 -> 92 2.8E-04 1.9E-03 1.9E-03 568.54 4.4 E-05 4.4E-05 0.00 Coolers l g f>PT / i

---

.-o.

, - ~ ~ - - .m.

Tabic F.1 Risk-Impact Evaluations of the Proposed Modifications to the Technical Specifications-South Texas Project (Cont'd) Proposed Modifications System Unavailability Core Damar;e Frequency l System - AOT(Days) 'STI (Days) Ilase Case For llN11s - Pertent Base For Percent l Case Proposed G ange t (IPE) Piuice - Verification Change Si TS of (IQ9 h ' Change Proposed Cg_ Change - Sl Changes Cl t (SIT ITNL) Containment Isolation 4 hrs --> N/C QA QA QA QA QA QA 24 hrs Steam Generator Safety 4 hrs -> N/C QA QA QA QA QA QA Relief Valves 24 hrs Component Cooling water 3 --> 10 N/C 1.7E-06 1.9E-06 1.9E-06 12.98 4.4E-05 4.6E-05 3.54 8 Control Room IIVAC 7 d (1 t),24 31 -> 92 1.6E45 3.8E-05 IEt 132.39 4.4E-05 4.6E-05 2.99 hr (2 t) -> 10 d (1 t),72 hr (2 t)8 Electrical Auxiliary Building N/C 12 hrs --> QA QA QA QA QA QA IIVAC 24 hrs EssentialChilled Water 3 --> 10 N/C 1.9E-06 3.6E-06 3.6E-06 95.26 4.4E-05 4.7E-05 6.51 N/C means No Change acquested f Notes: QA means Qualitative Analysis y X Percent Change is calculated as: X* x 100 I t Rounded to first decimal 3 4 =* M M-*vg*u

• '9r--

T 'uN -9 97-P9? e "'*r T'* "9'T"F'*"9 ""P""9' N "**7 1'W VMP1F M'1'

[. 'c9Avi s ? Table F.2 Example Calculation for AOT Risk Analysis: CVCS Case Value Base Case 4.4 E-05* Conditional CDF for a Single Train Out 4.5E-05 of Senice (AOT condition) Single AOT Risk for an AOT = 3 days 3.7E-07 Engle AOT Risk for an AOT = 10 1.2E-06 days Increase (Difference)in Single AOT 8.6E-07 between 3 and 10 days

• Base Case of the Newest RISKMAN model provided to BNL l

1 15' d Single A0T 10 p flisk p 7 (<10 ) 5 3 4 5 6 7 8 9 10 A0T Duration [Daysj Figure F.1 Single AOT Risk as a function of AOT (CVCS) 61 DRAW

%e, AFT' d I ., 1 n Appendix G Miscellaneous Findings Several miscellaneous items were detected during the resiew. They are presented below. G.1 Missing Elements The STP 3283, as received at Brookhaven National Laboratory, had some pages and tables missing. These are: i Pages: 1-4,3-14 and B-2. Tabics: 1-1 1 G.2 Missing Background Information The PSA information about each of the relevant systems included in the PSA is given in a section of the PSA report called " System Notebooks". The PSA, as received at Brookhaven National Laboratory, did not include any system notebook. Following discussions with STP,it was decided that the Updated Final Analysis Safety Report (UFASR) will be used as the source ofinformation for the review. However, two proNems were encountered-i) The fault trees are not included in the UFASR. They can be obtained from the RISKMAN code, but this approach resulted to be ineffective and resource-consuming. A hardcopy of the fault trees has been requested to be included in the new submittal. ii) The diagrams given in the UFASR are not consistent with the level of detail used in the PSA models, j because they are either mere detailed or lacking enough detail. l Therefore, the system notebooks, for the systems for which a change is requested, are also to be provided i along with the new submittal. Item Requested 3. ) 67 i DEbI}}