Text

Safety Evaluation Supporting Amends 59 & 47 to Licenses NPF-76 & NPF-80,respectively
	ML20067D184
Person / Time
Site:	South Texas
Issue date:	02/17/1994
From:	; Office of Nuclear Reactor Regulation
To:	;
Shared Package
ML20067D177	List: ML20067D175; ML20067D178; ML20067D184;
References
	NUDOCS 9403080084
	Download: ML20067D184 (255)
	v • d • e

}

of,.%%,

es 4

3

'C(

S UNITED STATES i(

NUCLEAR REGULATORY COMMISSION

\\..s < j/

WASHINGTON. D.C. 2055M001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS 59 AND 47 TO FACILITY OPERATING LICENSE NOS NPF-76 AND NPF-80 HOUSTON LIGHTING & POWER COMPANY CITY PI

CERVICE BOARD OF SAN ANTONIO CENTRAL POWER AND LIGHT COMPANY CITY OF AUSTIN. TEXAS DOCKET NOS. 50 '08 AND 50-499 SOUTH TUAS PROJ

.11TS 1 AND 2

1.0 INTRODUCTION

AND EXECUTIVE

SUMMARY

By application dated February 1, 1990, Houston Lighting & Power Company, et.

al., (the licensee) requested changes to the Technical Specifications (Appendix A to Facility Operating License Nos. NPF-76 and NPF-80) for the South Texas Projects, Units 1 and 2 ("9.

The proposed changes would increase the allowed outage time (A01 surveillance test interval (STI) for 22 technical specifications (TS) baseo

.) the impact to core damage frequency.

By letter dated November 27, 1990, the licensee withdrew four proposed changes from the original amendment request, including TS 3/4.7.1.2, Auxiliary Feedwater System; TS 3.7.4, Essential Cooling Water; TS 3/4.8.1.1, Diesel Generators; and TS 3.8.2, DC Electrical Sources.

By letter dated June 5, 1991, the licensee withdrew two additional portions of the amendment request 1

concerning Power Operated Relief Valves (TS 3.4.4) and the Spray Additive System (TS 3.6.2.2).

The TS changes were withdrawn by the licensee on its own or at the staff's request. A meeting was held on July 23, 1992, to discuss the proposed TS amendments, which resulted in a request for additional information (RAI) by letter of August 18, 1992.

The licensee submitted a partial response to the RAI by letter dated November 3,1992, and the final response by letter dated November 11, 1992. The staff issued an additional RAI to HL&P on May 19, 1993, regarding the basis for the proposed changes.

HL&P's response of August 16, 1993. updated the risk-based evaluation of the technical specifications originally submitted in 1990 and showed that the no significant hazards considerations were not affected.

For two of the proposed TS changes (i.e., the proposed extension of the residual heat removal pump and containment spray pump surveillance test interval), the staff recognized that relief from the quarterly ASME Code test requirements was needed before the changes to the inservice testing (IST) of these pumps could be implemented.

By letter dated October 22, 1993, HL&P submitted Relief Requests RR-10, RR-ll 9403080084 940217 PDR ADOCK 0500 8

P

1

. (Units 1 and 2), RR-12, RR-50, and RR-54 for the affected pumps and valves associated with the proposed TS changes.

The ASME Section XI Relief request for the residual heat removal (RHR) and containment spray (CS) pumps eliminated the need for the proposed changes to TS Surveillance Requirements (SR) 4.5.6.1 and 4.6.2.1.b requested in the original submittal. Therefore, HL&P withdrew these proposed changes on November 5, 1993.

In a separate letter dated November 5, 1993, HL&P provided additional information to support the staff's review of their response to the RAI of May 19, 1993. After discussions between HL&P, the NRC and their consultants, it was determined that a 7-day A0T was more appropriate than a 10-day A0T for the first train of out-of-service equipment.

It was also determined that the A0T for the essential chilled water would remain at 3 days, instead of increasing it to 7 days.

HL&P's letter dated November 29, 1993, reflects the 7-day A0Ts and withdraws the request for the Essential Chilled Water A0T (TS 3.7.14).

The supplemental letters provided additional clarifying information, were within the scope of the original application and did not change the original proposed no significant hazards consideration determination.

A list of technical specifications that were acted upon by the staff are listed in Attachment 3 (Table 1) in this safety evaluation.

In forming its dccision to approve the technical specification relaxations, the NRC staff relied upon the conclusions of NRC safety evaluations dated January 21, 1992, and August 31, 1993, in which the staff approved the use of the licensee's PSA methodology for licensing applications.

In summary, the staff approved technical specification amendments which change the following:

The A0T for TS 3.1.2.4 (Chemical and Volume Control) from 3 days to 7 days; The STI for TS 4.3.1 (Reactor Protection) from 62 days to 92 days; j

The STI for TS 4.3.2 (Engineered Safety Features Actuation) from 62 days to f

92 days; The A0T for TS 3.5.1 (Accumulators) from I hour to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ;

=

The A0T for TS 3.5.2 (Emergency Core Cooling) from 3 days to 7 days with a cross-train operability check every 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months ; The A0T for 3/4.5.6 (Residual Heat Removal) from 3 days to 7 days and the STI from 92 days to 184 days with staggered testing; The A0T for TS 3/4.6.2.1 (Containment Spray) from 3 days to 7 days and the STI from 92 days to 184 days with staggered testing;

V o

i The A0T for TS 3/4.6.2.3 (Reactor Containment Fan Coolers) from 3 days to 7 days and the STI from 31 days to 92 days; The A0T for TS 3.7.3 (Component Cooling Water) from 3 days to 7 days; and The A0T for TS 3/4.7.7 (Control Room Heating, Ventilation, and Air Conditioning (HVAC]) for the second inoperable train from 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to 72 i

hours in Modes 1 to 4 and the STI from 31 days to 92 days.

l l

The remaining four of the five proposed TS changes to the A0Ts and STIs were not specifically modeled in the PSA, but had little or no impact on risk. The staff performed a qualitative risk-based analysis on these proposed changes.

The amendments change the following:

The A0T for TS 3.4.2.2 (Pressurizer Safety Valves) from 15 minutes to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ; The STI for TS 4.7.13 (Area Temperature Monitoring) from 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; The A0T for 3.7.1.1. (Steam Generator Safety Relief Valves) from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; and The A0T for TS 3.6.3 (Containment Isolation) from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The proposed change for the STI for TS 4.6.1.7 (Containment Ventilation) from 31 days to 92 days has been denied by the staff, because of inadequate l

justification.

Additionally, the staff has approved six relief requests, which consisted of Pump Relief Request Numbers 11 (Unit 1) and 10 (Unit 2) to test the residual heat removal (RHR) pumps once every six months, Pump Relief Request Numbers 12 (Unit 1) and 11 (Unit 2) to test the containment spray (CS) pumps'once every six months, and Valve Relief Request Numbers 54 (Unit 1) and 50 (Unit 2) to test the RHR pump discharge check valves and RHR minimum-flow check valves once every six months.

]

The staff cautions that you should be constantly aware of any changes to the assessment methodology, assessment results, or modifications to the technical specifications (e.g., changes under the new restructured technical specification program or other changes that conflict with the staff's assumptions or basis) that could adversely impact the conclusions of the staff's safety evaluation.

2.0 EVALVATION 2.1 Backaround HL&P completed the South Texas Probabilistic Safety Assessment (PSA) in May 1989 and submitted it to the NRC.

The results of a review of the internal

l !

events and fire analysis portions of the PSA by Sandia National Laboratories is contained in NUREG/CR-5606, "A Review of the South Texas Project Probabilistic Safety Analysis for Accident Frequency Estimates and Containment Binning" dated January 21, 1992.

Review of the external events portion is contained in a safety evaluation dated August 31, 1993.

The Level 1 models and results for both internal and external events were updated in this examination to incorporate technical insights from (1) NRC and Sandia National Laboratory reviews, (2) revised analysis of fire and interfacing systems LOCA scenarios from that review, (3) plant changes that were made since the STP Level 1 PSA was completed, (4) some plant-specific data on initiating event frequencies, and (5) other model changes deemed to be technically appropriate.

South Texas Units 1 and 2 is in a unique position in that it has three electrically independent and physically separate safety trains.

The current STP technical specifications are generally based on the Standard Westinghouse Technical Specifications which were developed for Westinghouse two-train designs that preceded STP. The current technical specifications have resulted in increased surveillance and preventive maintenance requirements without the benefits of increased outage times.

Based on the results of the PSA, the licensee has determined that extensions of certain A0Ts and STIs will allow acceptable maintenance and surveillance durations necessary for the added equipment of the three-train design while keeping risk to an acceptably low level. The proposed A0T changes will provide additional flexibility to perform unplanned corrective maintenance, however, the licensee does not plan to increase scheduled maintenance durations.

As a result of recent changes to the planned maintenance schedule, the unavailability of equipment due to planned maintenance is expected to decrease.

The changes that would result include the proposed increases in A0Ts and STIs as well as accompanying changes to the planned maintenance program to effect a risk optimization and a more balanced planned maintenance program.

The net risk impact of all these changes is relatively small.

j The licensee proposed ten changes to the technical specifications which are based on changes to the core damage frequency as calculated using the PSA.

These are discussed in Section 2.2.

In addition, the licensee has proposed five changes to the A0Ts and STIs which are not specifically modeled in the PSA, but also have little or no impact on risk. These proposed changes are discussed in Section 2.3.

Section 2.4 contains the review of the six relief requests submitted as a result of two of the proposed TS changes.

2.2 Ouantification of System Technical Specification Chanaes The basis for the staff conclusions regarding the HL&P quantitative analyses are described in the technical evaluation (Attachment 1), as supported by confirmatory analyses and an assessment of the probabilistic analysis methods prepared by the Brookhaven National Laboratory (Attachment 2).

In forming its conclusions (see Table 1; Attachment 3), the staff considered the quantitative analyses in light of deterministic considerations and i

operational experience.

For the essential chilled water (ECW) system, the j

\\

4 l staff concluded that the A0T should not be relaxed because of the relatively I

high risk impact due to the many systems supported by the ECW system.

For the

)

7 proposed A0T relaxations to 10 days, the staff limited the relaxations to 7 days.

The 7-day limit restricts the possibilities of experiencing unpredicted overlapping component outages in accordance with the weekly (7 days) rolling maintenance schedule. As conditions for approval, selected cross-train and staggered testing requirements were added to qualitatively enhance overall system reliability. The balance of the risk-based changes have been accepted

]'

as proposed by the licensee.

Based on the accepted changes, estimated average annual core damage frequencies (AACDF) were re-calculated; these estimates are l

presented in the right side column of Table 1 (Attachment 3).

}

The quantitative basis for the accepted technical specification changes is l

that the related increases in conditional core damage frequency (CCDF) for train combination outages and in the AACDF are very small.

In considering the issue of rolling maintenance, the staff notes that the base-case AACDF estimate of 4.6E-5 per reactor-year does not include the impact of preventive maintenance. Rolling maintenance for specific systems during a given week (a 7 day A0T) could result in some increase in the CCDF estimate; however, this increase is expected to result in a CCDF ratio of less than a normalized factor of two in a given week and less than about a 20 percent increase over a i

24 week cycle.

The staff concludes that, with the minor changes to the proposed increases in the A0Ts or STis reflected in Table 1, the resulting change in the core damage a

frequency is acceptably small.

Furthermore, these technical specification i

changes epresent appropriate consideration of the unique three-train configuration of the South Texas plant design, such that the overall risk of plant operation is comparable to that of the typical design of other plants.

This evaluation also reflects appropriate consideration for the uncertainty in 2

the analysis methods and the application of plant-specific design and operational information.

The staff concludes that the quantitative basis for j

the technical specification changes and relief requests listed in Table 1 (Attachment 3), in conjunction with the deterministic factors considered i

herein (i.e., three electrically independent and physically separate :.fety trains, and the fact that the single failure of an active component typically results in a safety configuration with at least as great a degree of redundancy, and therefore general safety level, as other pressurized water j

reactors without such single active failures), is acceptable.

2.3 Asses" ats Not Reouirina 0uantification The following proposed technical specifications are not specifically addressed in the PSA because they play an insignificant role in mitigating core damage.

None of the proposed A0Ts or STis result in an increase in system unavailability as modeled in the PSA. Therefore, the impacts of the requested i

j changes, when viewed individually and in combination are not expected to significantly affect the safety margin. Only a qualitative risk-based analysis was made for these TS changes. This analysis is similar to the

n system level evaluations of the PSA-based TS changes, but without the numerical estimates of changes in system unavailability.

2.3.1 Pressurizer Safety Valves Technical Specification 3.4.2.2 requires all safety valves to be operable with a lift pressure of 2485 psig 1%.

If one valve is found inoperable, the inoperable valve must be restored within 15 minutes or the plant must be in hot shutdown within the following 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The proposed change would increase the allowed outage time from 15 minutes to one hour.

Maintenance on these valves requires the plant to be shut down since it is not possible to take a safety valve out of service for maintenance while at power.

Therefore, valve maintenance is not modeled in the PSA since the risk of core damage is eliminated by the shutdown requirement. The licensee has determined that 15 minutes is too short to permit an orderly investigation and confirmation of the problem prior to a requirerect to take action that disturbs the plant.

However, an A0T of I hour prwides time for initial diagnostics to confirm the need for valve repairs prior to initiating a forced plant shutdown.

The major impact of the proposed extension is a slightly reduced ability to respond to an ATWS.

In its safety evaluation dated January 21, 1992, the staff accepted the licensee's determination that three of three pressurizer safety valves or both pressurizer power-operated relief valves (PORVs) and one safety valve can effectively minimize the overpressure expected in the primary system in the early part of an ATWS. Therefore, if the P0RVs are available, failure of one safety valve does not increase the likelihood of an initiating event.

In addition, the average annual core damage frequency (CDF) due to ATWS is approximately 1.5 percent of the total CDF reported in the Level 2 PSA.

Because the ATWS contribution is so small, the proposed change would not significantly impact the C0F. The other concern is that a valve could inadvertently open.

This could result in a plant trip which places the plant in a positive situation from a risk perspective.

Based on the fact that allowing one pressurizer safety valve to be inoperable for one hour has an insignificant impact on core damage, this change is acceptable.

2.3.2 Area Temperature Monitoring Technical Specification Surveillance Requirement 4.7.13 requires the temperature in each of the areas shown in Table 3.7-3 to be measured at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to determine whether temperatures are within the specified limit.

The area temperature limitations ensure that safety-related equipment will not be subjected to temperatures in excess of their environmental qualification temperatures, which can lead to degraded equipment and loss of operability.

The temperature limits include an allowance for instrument error of +/-3 degrees F.

The licensee has proposed extending the surveillance test interval from 12 to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

l o The areas shown in Table 3.7-3 are areas requiring temperature monitoring.

The areas numbered 1, 2, 3, and 12 are the relay room, switch gear rooms, electrical penetration spaces and the qualified display processing system rooms, respectively, located in the electrical auxiliary building (EAB).

The number 4 area is the safety injection and containment spray pump cubicles located in the fuel handling building (FHB).

The areas numbered 5, 6, 7, and 8 are the component cooling water pump cubicles, the centrifugal charging pump cubicles, the hydrogen analyzer room, and the boric acid transfer pump cubicles, respectively, located in the mechanical auxiliary building (MAB).

Since the heat loads in these areas are constant during normal operation, a heat rise would indicate an increase in heat load or a decrease in heat removal capacity, specifically, a failure of the HVAC system.

The loss of the essential chilled water system, which provides cooling for each of these areas, or the loss of HVAC fans and dampers, could lead to a failure of the HVAC system causing a decrease in heat removal capacity and subsequent temperature rise.

For example, the EAB HVAC system consists of emergency chilled water (ECH) and EAB HVAC fans.

During normal operation, two of the three EAB HVAC trains are in operation. Upon loss of either an ECH train or a fan train, an alarm sounds in the control room to alert the operators.

If one of the three trains of the ECH system is inoperable, TS 3/4.7.14 requires that three trains must be restored within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The PSA does not specifically model manual recording of temperatures as required by this surveillance.

The EAB HVAC system is divided into three PSA system models and five event tree top events.

The three systems are ECH, fans, and dampers.

In evaluating the operator's response to loss of EAB HVAC, no credit was assumed for the local room temperature reading covered by this technical specification.

Thus, the surveillance interval has no impact on initiating event frequencies.

The PSA assumes that these room temperatures are maintained by having a minimum 450 tons of chilled water capacity (the capacity of one HVAC train) and one train of fans. The licensee presented an analysis in the PSA of the EAB heatup with one closed loop of EAB HVAC operating.

The analysis demonstrates that the use of EAB HVAC in this configuration will be effective in preventing components in the EAB from overheating.

The analysis showed that the average maximum temperature that would result from the use of one train of HVAC operable with 450-ton chiller capacity is 95 degrees. The maximum allowed temperatures given in TS Table 3.7-3 are all greater than 95 degrees except for the relay room and switchgear rooms which are 78 and 85 degrees, respectively.

Since a temperature of 95 degrees requires two trains of HVAC to be out of service, it can be assumed that the operators would be aware of decreased heat removal capability before the TS temperature limits are reached by alarms in the control room.

More recently, the ';icensee found that only 300 tons of capacity is needed to maintain nominal temperatures during normal operations.

Based on the fact that the operators would be alerted if any of the chillers or fans become inoperable, the assumption used in the PSA that the temperatures in the EAB are not exceeded is acceptable.

, The other areas cooled by the essential chilled water system have similar characteristics, although system requirements and values are different.

In any event, no credit is assumed for the local room temperature reading covered by this technical specification, and the surveillance interval has no impact on any initiating event frequencies.

The areas numbered 9, 10 and 11 (the standby diesel generator rooms in the diesel generator building, essential cooling water pump rooms in the essential cooling water intake structure, and the isolation valve cubicles, respectively) are not cooled by the essential chilled water system.

These areas are cooled by forced outside air (fans). These areas do not require the special cooling as the other areas shown on Table 3.7-3 since these areas are generally exposed to ambient temperature conditions and are designed for this l

type of service, In addition, the revised STI still requires someone to physically enter each room daily. Therefore, increasing the surveillance interval from 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months will provide adequate assurance that the temperature limits are being i

1 maintained and is acceptable.

(Although not related to this amendment, the staff has recommended replacing this technical specification (as outlined in the South Texas Project Technical Specifications) during its restructured technical specification program (NUREG-1431).

The staff has recommended a programmatic method to ensure area temperature monitoring is effective and appropriate temperatures are maintained).

2.3.3 Steam Generator Safety Relief Valves Technical Specification 3.7.1.1 requires that all five steam generator safety valves be operable with lift settings as specified in TS Table 3.7-2.

With one or more main steam line safety valves inoperable, operation in Modes 1, 2, i

and 3 may continue provided within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the inoperable valve is restored to operable status or the power range neutron high flux setpoint is reduced.

The licensee has proposed increasing the allowed outage time to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months prior to changing the high flux trip setpoint or shutting down the plant.

The licensee did not model safety valve maintenance in its PSA, but determined that only one of five safety valves and one PORV are required to open for steam generator overpressure protection. The staff accepted this finding in its January 21, 1992, safety evaluation.

Therefore, the failure of a single valve to lift on demand does not increase the likelihood of core damage.

Inadvertent operation of a safety valve could result in a plant trip in which case the plant would be shut down.

Because the PSA has determined that only one safety valve is required for overpressure protection, increasing the A0T from 4 to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months will not significantly decrease the safety margin and is therefore acceptable.

i,

a 4 )

2.3.4 Containment Isolation System Technical Sptcification 3.6.3 requires all containment isolation valves to be operabis in Mcdes 1, 2, 3, and 4.

With one or more isolation valves inoperable, tne TS requires at least one isolation valve be opcrable in each affected penetration that is open and restoration of the valve (s) within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ; isolation of the penetration by a deactivated valve or closed manual valve within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ; or plant shutdown. The licensee has proposed increasing the A0T from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

4 The licensee stated that the majority of valve failures cannot be restored within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and the required plant shutdown represents an unnecessary plant transient.

However, the tt:chnical specifications allow for the affected penetration to be isolated by a deactivated automatic valve or a closed manual valve in lieu of shutting down the plant.

Therefore, valve maintenance will not necessarily result in a plant transient.

It is for this reason that the PSA assumes that isolation valve maintenance puts the plant in a successful state from a risk perspective because the line is isolated.

It can be inferred from this that the licensee plans to perform all maintenance with the line isolated by an additional closed valve, in which case the original specification is met and an amendment is not required.

The staff has evaluated the impact on CDF of containment isolation system failures.

Failure of the containment isolation system (CIS) has the potential to damage the core because a lower containment back pressure could result in degradation of core cooling.

Based on the licensee's response to the staff's questions, the staff accepted in the January 21, 1992, SE the licensee's statement that, with the failure of the CIS, the peak clad temperature will increase to a temperature of not more than 2510*F.

Because the zirconium phase transition temperature is about 2900*F, beyond which a core damage will be most likely, the staff agreed that successful operation of the low head safety injection system with the failure of the CIS will not result in a severe core damage event.

Therefore, maintenance on containment isolation valves does not adversely impact CDF and the increase in the A0T from 4 to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is acceptable.

2.3.5 Containment Ventilation Technical Specification 4.6.1.7 requires both 18-inch supplementary containment purge supply and exhaust isolation valves to be operable and closed to the maximum extent practicable in Modes 1, 2, 3, and 4.

At least once per 31 days, each supply and e~xhaust isolation valve shall be verified open or closed in accordance with the TS.

The licensee proposes to decrease the surveillance test frequency from monthly to quarterly.

The function of containment ventilation does not relate to core damage risk and therefore, increasing the surveillance interval does not impact CDF.

However, containment purge isolation valves do impact risk of release.

The staff transmitted its position regarding verification of containment isolation in NUREG-0737, " Clarification of TMI Action Plan Requirements" (November

. 1980).

Position 6 of recommendation II.E.4.2 " Containment Isolation Dependability" states that containment purge valves must by sealed closed and must be verified to be closed once every 31 days.

The staff included this recommendation as a result of an evaluation of features needed to improve containment isolation dependability and has not relaxed its position since issuance of NUREG-0737 based on the consequences of an inadvertently open containment purge valve.

The licensee has not demonstrated that South Texas has a unique design or precedures that would ensure containment isolation in place of the monthly surveillance and the staff has not determined that the monthly surveillance represents a hardship to the licensee.

Therefore, the licensee has not provided adequate justification for the staff to approve this change to the technical specifications, and the staff has accordingly denied this portion of the license amendment application.

2.4 Relief Reauests 2.4.1 Introduction Title 10 of the Code of Federal Regulations, Section 50,55a, requires that inservice testing (IST) of certain ASME Code Class 1, 2, and 3 pumps and valves be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code and applicable addenda, except where alternatives are authorized or relief is granted by the Commission pursuant to paragraphs (a)(3)(i), (a)(3)(ii), or (f)(6)(1) of Section 50.55a.

In order to obtain authorization or relief, the licensee must demonstrate that (1) the prep :cu alternatives provide an acceptable level of quality and safety, (2) compliance would result in hardship or unusual difficulty without a compensating increase in the level of quality and safety, or (3) conformance is impractical for its facility.

The South Texas IST Program was developed to the 1983 Edition, Summer 1983 Addenda, of the ASME Section XI, for the first ten-year interval of both Units.

2.4.2

Background

The following inforiation was included in the TS change request (see ST-HL-AE-4544, " Risk Based Evaluation of Technical Specifications") for the residual heat removal (RHR) pumps:

Technical Specification 4.5.6 requires each RHR loop to be demonstrated operable pursuant.to the requirements of Specification 4.0.5 while in Modes 1, 2, and 3.

This requires each RHR pump to be tested on a quarterly basis. Due to the coverage afforded by the Low Head Safety injection and Auxiliary Feedwater Water systems, the RHR system is not as important, from a risk perspective, in mitigating core damage and less emphasis can be placed on testing the RHR system at power.

)

l 4

o 4.9.2 RESIDUAL HEAT REMOVAL SYSTEM UNAVAILABILITY RHR system unavailability is modeled by two top events (i.e., OC and RX) in the PSA.

Top event OC covers the operator actions and hardware requirements, not including the RHR heat exchanger, to establish RHR cooling.

Top event RX covers the availability of the RHR heat exchangers [the RHR heat exchangers are used as a flow path during safety injection and for sump water heat removal during recirculation phases). Again both top events combined represent the total system unavailability but no simple method exists to determine it. Therefore, RHR system unavailability change due to the proposed action is evaluated in part based on top event definitions.

This evaluation is adequate for this application because the total impact on core damage frequency is covered by the plant level evaluation as delineated in Section 2.4.5.

Split fraction OCA represents the likelihood that the operator initiates at least one of the three RHR trains when all support is available. Thecyrentlyestimatedlikelihoodforsplitfraction OCA is 2.564 x 10', as published in the PSA.

The estimated likelihood for split fraction OCA based on the proposed technical specification changes is 2.547 x 10'3 As a result, a 0.7% decrease is observed in OCA and no change in core damage frequency is observed as delineated in Section 2.4.5.

For the RHR system, two top events are defined. Top event OC addresses failure to establish shutdown cooling without the presence of a LOCA (loss-of-coolant accident].

Top event RX addresses recirculation cooling after a LOCA.

For shutdown cooling and for recirculation cooling, at least one of the three trains can provide adequate cooling.

A semiannual test frequency is requested for each RHR loop, as indicated on the marked up copy of Technical Specification 4.5.6 in Appendix A.

The following information was included in the TS change request (see ST-HL-AE-4544, " Risk Based Evaluation of Technical Specifications") for the containment 1

spray (CS) pumps:

l Technical Specification 4.6.2.1 requires each CSS [ containment spray system] loop to be demonstrated operable pursuant to the requirements of Specification 4.0.5 while in Modes 1, 2, 3, and 4.

This requires each CSS pump to be tested on a quarterly basis. Due to the CSS's negligible impact on core damage frequency, less emphasis should be placed on testing.

li4 v

i i-Two top events are defined.in the PSA for CSS.

For accident sequences that require removal of containment heat by spray, two of the three pump trains must be available (i.e., top event CS).

For accident sequences that include failure of low head safety injection (LHSI) and high head safety injection (HHSI), one out of three pump trains is sufficient to inject water into the containment-so that the RWST [ refueling water storage tank] water can be transferred to the containment sumps (i.e., top event WI).

For either condition, spray from one of the spray headers is sufficient.

For the purpose of this discussion, requiring two of the three trains is considered appropriate in evaluating CSS unavailability.

Split fraction CSA represents the CSS unavailability when 3'11.

support is available.

The CSS unavailability is 4.52 x 10, as published in the PSA.

The estimated likelihood for split fraction CSA based op the proposed technical specification change is 6.797 x 10'. As a result, a 50,3% increase is observed in CSS unavailability with no impact on core damage-frequency.

Furthermore, no significant impact on containment release categories is expected due to this change in CSS unavailability.

For CSS, two top events are defined.

For accident sequences that require removal of containment heat by spray, two of the three pump trains must be available.

For accident sequences that include failure of the low head safety injection (LHSI) and high head safety injection (HHSI), one out of three pump trains is sufficient to inject water into the containment so that the RWST water can be transferred to the containment sumps.

For both conditions, spray from one of the spray headers is sufficient.

'2.4.3 Relief Requests RR-11 (Unit 1) and RR-10 (Unit 2)

For the RHR pumps, the licensee has requested relief from the inservice testing requirements of IWP-3400(a) which requires that each pump be tested nominally every three months during normal plant operation, with this testing being maintained during shutdown periods,.if practical.

2.4.3.1 Licensee's Basis for Requesting Relief The licensee stated "STPEGS has three RHR pump trains used only for long-term cooldown events following auxiliary feedwater operation.

The RHR system does I

not serve the LHSI function as they are required to do in standard plants.

l For these reasons, the STPEGS RHR system is not critical to immediate accident l

mitigation.

]

1 Since the RHR system has a negligible impact on core damage frequency, less j

emphasis can be placed on testing the RHR system at power (see ST-HL-AE-4544, l

" Risk-Based Evaluation of Technical Specifications")."

l

fo e

13 -

l 2.4.3.2 Alternative Testing The licensee proposed " Inservice tests will be run on each pump nominally l

every 6 months during normal plant operations.

This test frequency will be i

maintained during shutdown periods if it can reasonably be accomplished."

i 2.4.3.3 Evaluation STPEGS is unique in the design of the RHR system. Whereas two trains are 2

normally installed for redundancy to ensure the availability of at least one train, STPEGS has three trains of RHR. The referenced analysis was reviewed by the NRC with the-assistance of Brookhaven National Laboratory (BNL) to i

check the licensee's 3-train analysis for the percent change in system 4

unavailability and core damage frequency (Section 2.2).

The results of the review indicated that the licensee's proposed changes in the RHR pumps surveillance interval represent an insignificant change in system unavailability and no change in core damage frequency. Therefore, the alternative testing frequency for the IST requirements will provide an i

essentially equivalent level of safety for these pumps.

2.4.3.4 Conclusion Testing the RHR pumps once every six months in lieu of once every three months is authorized pursuant to 10 CFR 50.55(a)(3)(i) based on the proposed 4

alternative providing an acceptable level of quality and safety, 2.4.4 Relief Requests RR-12 (Unit 1) and RR-ll (Unit 2)

For the containment spray (CS) pumps, the licensee has requested relief from the inservice testing requirements of IWP-3400(a) which requires that each pump be tested nominally every three months during normal plant operation, with this testing being maintained during shutdown periods, if practical.

2.4.4.1 Licensee's Basis for Requesting Relief The licensee stated "STPEGS has three CS pump trains used for protecting containment integrity following a core damage event (and) for other events where radiological release is postulated.

Due to the CS's negligible impact on core damage frequency and large early release frequency, -less emphasis should be placed on testing (see ST-HL-AE-4544, " Risk-Based Evaluation of Technical Specifications")."

2.4.4.2 Alternative Testing The licensee proposed " Inservice tests will be run on each pump nominally every 6 months during normal plant operations.

This test frequency will be maintained during shutdown periods if it can reasonably be accomplished.?'

d w

-e

--g- -, --r r. e

-,---a.

-,,r.

~--m----

,-,,.n-

~

n--g-. -ne,

~s

.m,,,,,

4,

2.4.4.3 Evaluation STPEGS is unique in the design of the CS system. Whereas two trains are normally installed for redundancy to ensure the availability of at least one I

train, STPEGS has three trains of CS.

The referenced analysis was reviewed by the NRC with the assistance of Brookhaven National Laboratory (BNL) to compare the 3-train system to a 2-train system for the percent change in system unavailability and core damage frequency (Section 2.2).

The results of the review indicated that though the licensee's proposed changes in the CS pumps surveillance interval represent an increase in system unavailability, the base I

values remain below 6.55E-03 which is an acceptable level for unavailability.

Additionally, the results indicate no change in core damage frequency.

Therefore, the alternative testing frequency for the IST requirements will provide an essentially equivalent level of safety for these pumps.

2.4.4.4 Conclusion Testing the CS pumps once every six months in lieu of once every three months is authorized pursuant to 10 CFR 50.55(a)(3)(i) based on the proposed alternative providing an acceptable level of quality and safety.

2.4.5 Relief Requests RR-54 (Unit 1) and RR-50 (Unit 2)

For the RHR pump discharge check valves and the RHR pump minimum-flow check valves, the licensee requests relief from the requirements of IWV-3521 which states that check valves be exercised at least once every three months, except as provided by IWV-3522 which allows that check valves may be exercised during cold shutdown conditions when it is impractical to exercise during power operations.

(NOTE:

The relief requests references IWV-3411 in error.)

2.4.5.1 Licensee's Basis for Requesting Relief The licensee stated "STPEGS has three RHR pump trains used only for long-term cooldown events following auxiliary feedwater operation.

The RHR system does not serve the LHSI [ low head safety injection) function as they are required to do in standard plants.

For these reasons, the STPEGS RHR system is not critical to immediate accident mitigation.

Since the RHR system has a negligible impact on core damage frequency, less emphasis can be placed on testing the RHR system at power (see ST-HL-AE-4544,

" Risk-Based Evaluation of Technical Specifications")."

2.4.5.2 Alternative Testing The licensee proposed "The RHR Pump Discharge Check Valves (RH-0065A, B, and C) and RHR Pump Miniflow Check Valves (RH-0068A, B, and C) will be stroked during each pump inservice test which will be performed nominally every 6 months during normal plant operations.

This test frequency will be maintained during shutdown periods if it can reasonably be accomplished."

. 2.4.5.3 Evaluation STPEGS is unique in the design of the RHR system.

Whereas two trains are normally installed for redundancy to ensure the availability of at least one train, STPEGS has three trains of RHR.

The referenced analysis was reviewed by the NRC with the assistance of Brookhaven National Laboratory (BNL) to compare the 3-train system to a 2-train system for the percent change in system unavailability and core damage frequency (Section 2.2).

The results of the review indicated that the licensee's proposed changes in the RHR system check valves surveillance interval represent an insignificant change in system unavailability and no change in core damage frequency. Additionally, the Code includes provisions that allow test intervals for valves to be extended to i

cold shutdown where conditions prohibit testing at power conditions. Although this situation does not present an impractical condition, the extension of the testing interval will be similar to a cold shutdown test interval as allowed for other valves.

Therefore, the alternative testing frequency for the IST requirements will provide an essentially equivalent level of safety for these valves.

This will also allow the valves to be tested currently with the RHR pump tests discussed in RR-ll/10 above.

2.4.5.4 Conclusion Testing the RHR pump discharge check valves and RHR pump minimum-flow check valves once every six months in lieu of once every three months is authorized pursuant to 10 CFR 50.55(a)(3)(i) based on the proposed alternative providing an acceptable lav0 of quality and safety.

2.4.6 Conclusion The staff concludes that the relief requests as evaluated by this SE will provide reasonable assurance of the operational readiness of the applicable pumps and valves to perform their safety-related functions.

The staff has determined that authorizing the alternatives pursuant to 10 CFR 50.55a (a)(3)(i) is authorized by law and will not endanger life or property, or the common defense and security and is otherwise in the public interest.

3.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Texas State official was notified of the proposed issuance of the amendment. The State official had no comments.

4.0 ENVIRONMENTAL CONSIDERATION

The amendments change a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20 and changes surveillance requirements. The NRC staff has determined that the amendment involves no significant increase in the amounts, and no significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative j

1 D

0 1 i

occupational radiation exposure.

The Commission has previously issued a proposed finding that the amendment involves no significant hazards i

consideration, and there has been no public comment on such finding (55 FR 10535).

Accordingly, the amendment meets the eligibility criteria for 1

categorical exclusion set forth in 10 CFR 51.22(c)(9).

Pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

5.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that:

(1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be '.nimical to the common defense and security or to the health and safety of the public.

Attachments:

1.

Evaluation of Licensee's Requested PSA-Based Changes to South Texas Project Technical Specifications 2.

Technical Evaluation Report (BNL) 3.

Table 1 Principal Contributors:

Patricia Campbell, NRR David Fischer, NRR Donna Skay, NRR Hillard Wohl, NRR Date:

February 17, 1994 i

l 4

EVALUATION OF LICENSEE'S REQUESTED PSA-BASED CHANGES TO SOUTH TEXAS PROJECT TECHNICAL SPECIFICATIONS

1.0 Background

2.0 Overall Review Process

3.0 Evaluation Findings

3.1 TS-Change Quantification Approach by the Licensee 3.2 BNL's Evaluation Process 3.3 A characterization of initially approved TS changes and bases for approval 3.4 A characterization of initially rejected TS changes and bases for rejection 3.5 Case-by-Case Disposition-A characterization of alternative TS changes for cases of initially rejected TS changes 4.0 Summary Evaluation and Conclusions 5.0 References Table 1-A Summary Of Probabilistic Review status of the Licensee's Proposed TS Changes for the STP Facility Table 2-A Summary of Initial Evaluation of Licensee's Proposed TS-Changes for the STP Facility Table 3-A Summary of Staff's Disposition Findings on Initially Rejected TS Changes for the STP Facility Table 4-A Summary of Final Evaluation Licensee's Proposed TS-Changes for the STP Facility l

EVALUATION OF LICENSEE'S REQUESTED PSA-BASED CHANGES TO SOUTH TEXAS PROJECT TECHNICAL SPECIFICATIONS

1.0 Background

Houston Lighting & Power (HL&P) submitted a license amendment to modify the hchnical Specifications (TS) of the South Texas Project (STP) Electric Generating Station plants on February 1,1990 (Ref.1). This amendment proposed changes (relaxations only) to 22 individual Technical Specifications and is based on Probabilistic Safety Assessmant (PSA) analyses of the impact of proposed changes to plant risk (e.g., core damage frequency).

Subsequently, the licensee issued two lette s (Ref. 2 and 3) to USNRC, withdrawing six of the 22 TS changes proposed in its February 1, 1990 submittal, as it realized an unacceptable level of risk increase due to some of the proposed TS changes.

Due to limited availability of probabilistic review resources, the staff initiated a review of these TS changes during May 1992, and the Office of Nuclear Regulatory Research was requested to assist NRR with this review. As part of the overall review of these TS changes, the Office of Nuclear Reactor Research awarded a contract to Brookhaven National Laboratory to review the risk significance of the licensee's requested TS changes, including the adequacy of the methods, assumptions, and data used by the licensee in estimating the risk significance of the requested TS changes.

The STP facility consists of two units of Westinghouse-designed pressurized water reactors (PWRs). The units have been commercially operated by HL&P since August 1988 and June 1989. The plants were designed and licensed to operate based on a concept of three electrically independent and physically sep0 rated safety trains which will be used in preventing a core damage event fellowing a transient or LOCA event. The current STP TS are based on the standard Westinghouse Technical Specifications which were developed for a Wastinghouse two-train plant.

Due to limited resources (both personnel resources and operating funds) in the operations and maintenance group of the STP facility, the licensee decided to propose changes to the current TS that were issued as part of the operating license (OL) and subsequently amended this request.

The proposed changes primarily consist of extending allowed outage times (A0Ts) and Surveillance Test Intervals (STIs) to take credit for the added safety resulting from the additional third train and other design features. Examples of these design features include the low head safety injection (LHSI) system (instead of the traditional RHR system which is used as a decay heat removal system for the only case of an intact reactor primary system) and the Technical Support Center (TSC) system (a backup diesel generator (DG) power source to the positive displacement pump system (PDPS)).

The risk-based analyses of STP TS modifications were performed by the licensee using the STP PSA which was completed by its contractor, Pickard, Lowe, &

Garrick (PLG) in May 1989 (Ref. 4). This version of the STP PSA was reviewed by the staff with the help of Sandia National Laboratories (SNL).

The evaluation findings of this review were documented in NUREG/CR-5606 (Ref. 5).

I

The STP PSA was performed using the RISKHAN Computer Code package developed by PLG, Inc. (Ref. 6). The review of the STP PSA did not involve a requantification type evaluation using the RISKMAN Computer Code.

Rather, the review focussed on the process by which various models, data, and modeling assumptions were performed, and accordingly evaluation findings were developed and documented in Ref 5.

In parallel with the staff's review of the PSA, the licensee proceeded to develop a submittal for an Individual Plant Examination (IPE) of the STP facility (in response to Generic Letter 88-20) based on review findings of the 1989 version of the PSA.

Subsequently, the licensee i

submitted the STP IPE for the staff's review during the month of September 1993 (Ref. 7).

The risk information developed in support of the IPE covers both level 1 and Level 2 and other critical evaluations related to decay heat removal (DHR) problems and containment performance. improvement (CPI) problems.

The level 1 portion of the IPE (referred to as a logical combination of front-end analysis, human reliability analysis, and DHR problem analysis) has been performed to include the staff's review findings of the 1989 version of the PSA and new information on core cooling success criteria (primarily the 4

success criteria for the Essential Chilled Water system).

Thus, the revised core damage frequency (CDF) for the STP facility is modestly different than i

the original PSA model. The core damage frequency estimated in the IPE submittal (about 4.6 E-5 per RY) is about a factor of 4 lower compared to the i

estimate presented in the May 1989 analysis.

Although the original TS change submittal was based on its 1989 version of the PSA, BNL's evaluation of the licensee's requested STP TS changes was based on a Level 1 RISKMAN model which is based on the Level 1 portion of the IPE PSA model and other refined models for the support system initiating events.

2.0 Overall Review Process t

l Following initiation of the STP TS-change review submittal, technical contact was maintained with the STP staff and the PLG staff to obtain necessary i

information for review of the TS analyses. The review was initiated with the original submittal (Ref.1) and other related documents (Ref.2 thru Ref. 6).

Based on an initial review of this TS change submittal, the BNL staff visited the STP facility on July 23, 1992 (Ref. 8), to familiarize itself with operational features of the STP design and to obtain a full understanding of critical information related to testing and maintenance (T&M) activities.

The staff then issued a first request for additional information (RAI) to the licensee (Ref. 9).

The licensee provided its responses to the above RAI on November 11, 1992 (Ref. 10),

it also provided an earlier version of the RISKMAN model (ref. 7) needed to perform quantitative analyses of the licensee's requested TS changes, and an upgraded version of the IPE (RISXMAN) model at a later time.

Subsequently, on December 7, 1992, the staff and the j

BNL staff performed an audit of the licensee's RISKMAN calculations at the STP site (Ref. 11) in order to understand the details of the RISKMAN quantification process. During the audit review, the BNL staff was also provided by the STP staff with additional TS evaluation results using the IPE model.

With the information gathered through the first RAI process, and an onsite audit review process, the staff and BNL developed a second set of RAI to complete the review of the requested TS changes.

The second set of RAI 2

+

v focussed on the modeling adequacy of the licensee's T&M practices and the results of appropriate sensitivity and/or uncertainty analyses. This second set of RAI was issued to the licensee on May 19, 1993 (Ref. 12). The licensee provided its responses (a three volume report) to the above RAI on August 16, 1993 (Ref. 13). Additional responses were also provided by the licensee to the staff on November 5,1993 (Ref.14).

BNL completed a review of these responses (Ref.13 and 14), developed a draft Technical Evaluation Report (TER) and submitted it to the staff on November 9,1993 (Ref.15). The staff provided its comments on l'NL's draft TER, and BNL submitted a final TER to the staff on December 10, 1993. A summary of staff's evaluation findings related to the requested TS-changes is provided below:

3.0 Evaluation Findings

Of the 22 proposed TS system changes in the original submittal (Ref.1), 6 were withdrawn by HL&P.

A list of the remaining 16 TS changes is presented in Table 1.

Of this group of 16 TS changes, quantitative evaluations were performed in support of 11 of them using the Level 1 portion of the PSA model of the plant.

The TS changes being requested by HL&P are related to two types of changes:

a) extending the allowed outage time (A0T) for a single train failure (e.g., from a current limit of 3 days to 10 days),

b) extending the surveillance test intervals (e.g., from 31 days (monthly) to 92 days (quarterly)).

The staff has reviewed the licensee's submittals provided as part of Ref. 1, 2, 3, 10, 13, 14 and the BNL TER.

The staff's specific evaluation findings are provided below:

3.1 TS-Change Quantification Approach by the Licensee The HL&P submittal for TS changes is applicable to both units of the STP

facility, in the probabilistic analyses presented, these two units are not treated separately.

Neither any interdependencies nor cross-connections are addressed since they do not exist. The licensee made use of recently developed IPE models for the STP facility along with some PSA modifications to quantify the impact of changes of requested A0Ts and STis.

As part of this PSA application activity, it made use of both STP-specific data and generic data on train-related maintenance outage events and test-related failures as documented in Ref. 2-2 and 2-7 of Ref. 12.

The RISKMAN code, Version 3.08, was used as part of the i

quantification of the impact of TS change-related parameters.

The licensee's quantification of TS changes included STP-specific T&M practices, which included planned maintenance (PM) activities (per the maintenance rule) for many safety systems, surveillance tests (STs) for a few standby systems, and corrective maintenance (cms) for all applicable systems.

The cms include unplanned maintenance (which is identified during standby system testing and PM-related testing) and 3

o planned (preventive) maintenance.

The licensee is currently implementing all appitcable T&M activities through a pre-planned Rolling Haintenance Program (RMP) which is based on a 24-week cycle maintenance period.

Each week of the RMP, a certain combination of trains of safety systems is taken out of service for T&M.

It has quantified the TS i

changes (both A0T and STI changes) according to the provisions

Jministered by the STP-specific RMP.

l Specifically, the quantification of A0T changes included the estimation of the change in core damage frequency due to the revised maintenance duration associated with each of the requested A0T changes. The licensee made use of both average annual core damage frequency (AACDF) and conditional core damage frequency (CCDF) as the risk measures for the A0T-change evaluation activities.

It also characterized sources of uncertainty affecting the quantified results of TS-changes. These sources include: (1) indirect effects on reactor-trips (due to controlled shutdown), (2) risk of controlled shutdown given an LCO action statement having been entered for a safety train, and (3) risk benefit of the potential reduction in inadvertent reactor trips associated with longer A0Ts for some systems.

The quantification of STI changes included the estimation of the change in core damage frequency due to the use of revised STIs for estimating (1) demand failures that could occur during testing, and time-related standby failures, (2) unavailability due to test realignments, and (3) unavailability due to icst-related CM.

The licensee made use of AACDF as the risk measure for *.he STI-change evaluation activities.

It also characterized sources of uncertainty affecting the quantified results of TS-changes. These sources include: (1) the risk due to not testing train-related components for a prolonged period associated with the requested STI change, and (2) the risk due to test-caused component degradation of the trains for which the RMP-based PM is not implemented (e.g., the LHS! trains and the DG trains).

The staff finds the licensee's overall TS-change evaluation approach to be acceptable.

It also finds that two items were not addressed by the licensee as part of the TS-change quantification process. These two items are changes in post-T&M errors associated with the change in A0Ts, and the need for revised testing procedures and/or improved T&M-related training, if any, to accommodate the requested TS-changes, and the impact of these on the AACDF.

The licensee should address these two items as part of its future "Living PSA" (LPSA) program 3.2 BNL's Evaluation Process The overall review objective was to obtain the overall risk impact of the proposed changes in A0Ts and Sils for all applicable systems (a total of 9 systems) at the STP facility. This included a detailed review and evaluation of the proposed 11 individual TS changes and performance of a selected number of independent quantitative calculations using the industry-developed RISKMAN code package (Version 3.08).

The review also developed two risk measures (the AAC0F and the 4

a CCDF) that should be used in evaluating the significance of the quantitative impact of the proposed changes. As part of the licensee's methodology evaluation, BNL made use of related research work and results performed as part of Ref. 16,,17, 18 and 19. These referenced reports were also used as part of its quantitative evaluation of the TS changes.

BNL's review of the STP submittal was focussed on TS changes for which quantitative assessments were presented (that is, 11 individual TS changes) by the licensee in its submittals. The 11 TS changes were found by the licensee to have a noticeable impact on operability of the systems that are needed in preventing a core damage event following a postulated LOCA or an anticipated transient event.

Thus, the Level 1 portion of the STP PSA model was used by BNL for reviewing and evaluating the technical analyses and results presented in the licensee's submittal. The staff notes that, for the TS-change evaluation purposes, the BNL review team basically accepted the version of the STP PSA that was made available to them by the licensee.

BNL recognized that the PSA version provided for the TS review team has incorporated previous staff review findings documented in Ref. 5.

In addition to the above, many selected aspects of the PSA that directly affect the TS analyses were evaluated.

This additional evaluation finding resulted in two rounds of RAls.

BNL also conducted one audit review of the licensee's RISKMAN TS-related calculations at the STP facility.

The licensee's three sets of responses to two rounds of RAls and the findings from one audit review have formed the integrated information source basis for the BNL's overall evaluation of the licensee's 11 TS changes.

BNL's evaluation findings of the 11 individual TS-changes, including their risk significance, have been documented in Ref. 15, 3.3 Characterization of initially approved TS changes and bases for approval Four proposed TS changes are approved based on an insignificant increase in two risk measures established for the STP facility. These approved TS changes are individual TS changes for the RPS (4.3.1; STI change only), the ESFAS (4.3.2; STI change only), the AS (3.5.1; A0T change only), and the CRHVACS (3/4.7.7; STI only). The approved specific changes for each of these four TS changes are shown in Table 1.

The bases for approval for these changes include considerations for the impact of an insignificant increase in conditional core damage frequency due to A0Ts for train outage combinations and the overall increase in average annual CDF (AACDF).

The individual impact on the conditional core damage frequency (CCDF) due to each A0T change and the individual impact on the AAC0F due to each of these four TS changes are provided in Table 2.

Other critical evaluation factors were also considered in approving these four TS changes. A summary of the bases for approval of the above four TS changes is:

1.

As part of its request for TS changes, the licensee has proposed to implement T&M activities for all applicable trains of TS-i 5

l s

4 systems through a preplanned Rolling Maintenance Program (RMP) which includes primarily PM activities (in addition to CH activities to be performed on an as-needed basis) for selected trains of safety systems during a given week of a 24-week-basei RMP cycle for the STP's 18 month refuel cycle.

The staff notes that the base case AACDF estimate of 4.6E-5 per RY does not include the impact of PM activities.

Inclusion of the impact of 1

PM for applicable systems during a given week could result in a some level of increase in the CCDF estimate, and this increase should be expected to be well below 1E-4 per RY in a given week.

The staff's review of the licensee's estimated CCDF risk (Table 2) for the weeks during which the above trains could be taken out for T&M, indicates that this conditional risk will be expected to be lower than 1 E-4 (that is, a normalized factor less than 2).

4 2.

Both the licensee's estimates and BNL's estimates for the individual impact on the AACDF due to each of the four approved TS changes were reviewed. These estimates (Table 2) indicate that the increase due to these changes (individually) are expected to be lower than 1 E-4 per RY.

3.

The licensee's sensitivity analyses and results were reviewed.

)

These results indicate that the increase in CCDF due to the A0T changes (including the approved A0T change) are expected to be insignificant.

4.

The variations in train failure rate associated with the increase in test intervals is expected to be minimal for cases of approved STIs (proposed STIs for RPS, ESFAS and CRHVAC). The expected increase in AACDF should not exceed 1 E-4.

The licensee's future updates to the STP PSA (referred to as a living PSA) should include considerations for trending actual train failures and for validating the estimates of time-dependent train-related failures (standby failures and demand failures) used in the current STP T&M models. The staff believes that this future activity by the licensee is essential to keep the current level of risk (including the risk increase due to approved STIs for the three system trains) at a fairly constant level.

3.4 A characterization of initially rejected TS changes and bases for rejection i

Regarding A0T requests, six proposed TS changes were initially rejected in their originally submitted form because of an unacceptable increase in both the CCDF and AACDF risk measures.

Details of these rejected TS changes are provided in Table 2.

The bases for rejection are:

1.

In Section 3.3.1 of the revised TS submittal, the licensee has provided the results of a sensitivity analysis related to risk profiles of the RMP for the STP facility.

It acknowledged that a potential overlapping of outages of two trains of the above three systems due to the nature of the RMP implementation (particularly 6

4 during the first, sixth and eleventh week of the RMP cycle) could result in an increase of CCDF well beyond IE-4.

Thus, the increase in CCDF due to potential overlapping of outages of two trains of one of these six systems beyond a seven day period (out of a proposed ten day A0T period, if approved) due to unexpected prolonged cms (an event of finite probability) is also expected to be higher than 1 E-4 per RY.

2.

The base case AACDF estimate of 4.6E-5 per RY does not include the impact of prolonged cms for which the current A0T could be used for the above trains. Also, as part of its request for an A0T change, the licensee has not provided an estimate of the impact of the prolonged cms (that is a full use of proposed A0Ts) for these six system trains. On a collective basis, inclusion of the impact of prolonged cms for these system trains could significantly increase the AACDF well above 1 E-4.

Regarding STI change requests, one proposed STI change was initially rejected because of a potentially unacceptable increase in AACDF measure.

This rejected TS change is the STI change for the RHR system from a 3 month interval to 6 month interval (3/4.5.6). The basis for rejection is:

The variation (primarily increase) in train failure rate associated with the proposed increase in test interval (a 6 month interval) is expected to be significant. The expected increase in AACDF could exceed 1 E-4.

In particular, the licensee's use of a i

linear time-dependent failure rate for the proposed 6 month test period as part of its risk impact of the STI change request is questionable and is not accepted as part of the STI change request for the RHRS.

Aasnt supporting justification, the staff believes that use of this iinear time-dependent failure rate model is valid only for a limited period of two months or !ess.

However, the licensee's future Living PSA conld be used in verifying or validating the use of linear time-dependen; failure rate models for assumed longer STIs by trending actual train failures (both standby failures and demand failures) at the STP facility and validating the estimates of time-dependent train-related failures used in the current STP T&M models for this system. The staff also believes that such verification activity by the licensee could provide, in the future, a firmer basis for potential relaxation of STIs for many systems, including the RHR system.

3.5 Case-by-Case Disposition-A characterization of alternative TS changes for cases of initially rejected TS changes The estimates for the CCDF and. AACDF measures documented in Table 2 for each of the initially rejected TS changes have been closely reviewed as part of the disposition process. Three of six rejected A0T changes (CVCS, CCWS, and RHRS) were further considered for approval of a limited extension (or relaxation) of the current A0T period by the licensee in the future.

The staff judged that the impact of changing the AGT period 7

l t

l l

for the three system trains (CVCS, CCWS, and RHRS) from 3 days to 7 days (instead of 10 days) through the provisions of the RMP should result in an insignificant increase in the CCDF, and the AACDF will not exceed IE-4.

After making this judgement, the staff made a phone inquiry to the licensee.

In response to the staff's phone RAI, the licensee provided a summary response (Ref.14) related to calculations of the total cumulative AACDF risk of applicable systems (based on a two round of 24-week RMP cycles) when these systems undergo the proposed PM (using a maximum A0T of 7 days). A review of this summary response indicates that the cumulative CCDF risk due to the CCWS (only one of the three systems that will be subjected to PM) will be insignificant (i.e., a normalized factor less than 2). Thus, a final licensee's request for revised TS changes (extending to only 7 days instead of 10 days) for these three systems was submitted (Ref.14) for immediate approval by the staff. The specific basis for the disposition is:

The RMP implementation is based on a seven day cyclic period.

During this period, a group of independent trains of various similar systems could be taken out of service for T&M activities.

Thus, the licensee's future proposed use of the full 10 day A0T for a given CM activity for any one train of the above three systems could easily result in a situation of overlapping of outages of two trains of a similar system. The probability of creating this scenario beyond a seven day period (out of a 10 day A0T period) would be expected to be higher than that during the initial seven day period due to the nature of the RMP.

For example, use of more than a 7 day A0T period could be due to the inadequacy of the onsite Master Part List (MPL) program as evidenced in the NRC's recent inspection program conducted during the month of April 1993.

The other two of six initially rejected A0T changes (A0T for the ECCS and the ECHS) were further considered for approval of a limited extension of the current A0T period.

Ref.14, related to the calculations of the total cumulative risk of these systems, indicates that the cumulative CC0F risk due to the ECCS will be insignificant (a normalized factor less than 2).

But, the cumulative risk due to the ECHS is found to be significantly high (a normalized factor more than 6). Thus, a consideration for the 7 day A0T relaxation (from the 3 day A0T) for the ECHS is also rejected as part of the disposition process.

Subsequently, the licensee decided to withdraw this A0T relaxation for the ECHS (Ref. 14).

The current A0T period for the CRHVACS is 7 days.

Therefore, the disposition process is not applicable for the rejected case of the CRHVACS.

The only rejected STI change was further considered for approval of a limited extension of current STI by the licensee. The staff judged that the impact of changing the STI for each of the RHR system trains from 3 months to 2 months (on a staggered basis) through the provisions of a revised RMP will not result in significant increase in AACDF risk, and 8

._-.m_.--

the increase in AACDF will not exceed IE-4. Thus, a future-licensee's request for revised TS change for the RHR system (staggering each train on a 2 month interval through the 24-week RMP cycle) along with the supporting calculations could be submitted for immediate approval by the staff. The specific basis for the disposition is:

The variations (primarily increase) in train failure rate associated with a short period of STI-(one or two months)'is expected to be insignificant. Thus, the expected increase.in AACDF will not exceed 1 E-4.

The staff believes that use of a small linear time-dependent failure rate model for the purpose of estimating the risk impact of the STI change request is also valid for shorter STIs such as a period of two months or less. Also, for future STI-change requests, the licensee's future Living PSA could verify the use of linear time-dependent failure rates for any assumed longer STIs by trending actual train failures and validating the estimates of time-dependent train-related failures used in the current STP's T&M models for this system. The staff also believes that such verification activity by the licensee could provide an updated basis for a refined relaxation of STIs.

Table 3 provides the results of the disposition process of the initially rejected TS changes. A summary of the final evaluation of all approved and altered (dispositioned) A0T and STI changes for the STP facility is provided in Table 4.

9

a d

4 4.0 Summary Evaluation and Conclusions As part of its PSA-use activity in regulatory compliance, the licensee provided for the staff's review a TS-change submittal based on a current probabilistic methodology used in analyzing and evaluating TS provisions.

It made use of STP-specific T&M practices along with STP-specific T&M data particularly in the areas of corrective maintenances (cms). The staff finds the licensee's overall TS-evaluation approach, including the use of data and employment of applicable assumptions, to be acceptable.

In summary, a total of 22 individual TS-changes were submitted by the licensee for the staff's review. A total of 6 changes were withdrawn by the licensee. Another 5 changes were not evaluated by our review due to limitations of the current STP PSA models. The-remaining 11 changes were probabilistically evaluated using the STP PSA.

Our review concludes that a total of 4 proposed TS-changes (3 STis and 1 A0T) are approved based on probabilistic evaluation. The remaining 7 of the 11 changes evaluated are not accepted as initially proposed, based on current licensee's TS submittals and its responses to the staff's RAls. These 7 changes were further considered by the staff as part of the disposition process which was adopted in developing bases for a limited relaxation of 7 rejected changes.

For S of the initially 7 rejected changes, a limited relaxation of TS changes is approved by the staff based on the findings of the disposition process.

For one system (CRHVACS), a limited relaxation is not applicable and is not considered.

Finally, for one system (ECHS), a limited relaxation of current TS requirements is found to be unacceptable based on a disproportionate increase in two risk measures evaluated for the STP facility.

As part of the TS evaluation process and the TS disposition process of TS-changes, the staff identified a desirability to develop a living PSA (LPSA) for the STP facility by the licensee. The licensee's development of the LPSA should include revised technical bases e.g., an updated human reliability analysis, as they develop in time. These bases should support potential relaxation of STis for the rejected cases, refined relaxation of STis, and an approach to keep the current level of risk at a fairly constant level. Supporting arguments for the need for a LPSA development have been developed and documented in Section 3.3, 3.4, and 3.5 of this DSER.

~

I 10 l

i j=

5.0 References 1.

Letter from Houston Lighting & Power (HL & P) to USNRC, " Proposed Amendment to the Unit 1 and Unit 2 Technical Specifications Based on Probabilistic Risk Analyses", Document ST-HL-AE-3283, February 1, 1990.

2.

Letter from HL & P to USNRC, " Design Specification based on Probabilistic Risk Analyses", Document ST-HL-AE-3639, November, 27, 1990.

3.

Letter from HL & P'to USNRC, " Withdrawal of Proposed Technical Specifications Based on Probabilistic Risk Analyses" Document ST-HL-AE-3791, June 5, 1991.

4 Pickard, Lowe and Garrick, Inc., " South Texas Project Probabilistic Safety Assessment", PLG-0675, May 1989.

5.

Wheeler, T.

A., et al, "A Review of the South Texas Project Probabilistic Safety Analysis for Accident Frequency Estimates and Containment Binning", NUREG/CR-5605, August 1991.

6.

Pickard, Lowe and Garrick, Inc., "RISKMAN 3 Computer Co'de User Manual", Version 3.08, August 1993.

7.

Letter from HL & P to USNRC, " South Texas Project Electric Generating Station Level 2 Probabilistic Safety Assessment and Individual Plant Examination", November S,1993.

8.

Process review meeting conducted at the HL & P's STP facEfty on July 23, 1992.

9.

Letter from USNRC to D.P. Hall of HL & P, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical Specifications", August 18, 1992.

10.

Letter from HL & P to USNRC, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical Specifications", Document ST-HL-AE-4261, November 11, 1992.

11.

Audit review meeting conducted at the HL & P's STP facility on Dec. 7, 1993.

12.

Letter from USNRC to W. Cottle, HL & P, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical. Specifications", May 19, 1993.

13.

Letter from HL & P to USNRC, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical Specifications", Document ST-HL-AE-4544, August 16, 1993.

11 i

l I

i

l-i 14.

Letter from HL & P to USNRC, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical Specifications (Document ST-HL-AE-4544),"

Document ST-HL-AE-4620, November,5, 1993.

15.

Letter from BNL to PRAB/USNRC, " Draft Technical Evaluation of i

i Technical Specifications Modifications for South Texas Project,"

November, 9, 1993.

Letter from BNL to PRAB/USNRC, " Final Technical Evaluation of Technical Specifications Modifications for South Texas Project,"

December 10, 1993.

16.

D. Wagner, W.E. Vesely, and L. A. Hinton, " Risk-Based Evaluation of Technical Specifications," EPRI-NP-4317, March 1987.

17.

P.K. Samanta, S.M. Wong, and J. Carbonaro, " Evaluation of Risk Associated with A0T and STI Requirements at the ANO-1 Nuclear Power Plant," NUREG/CR-5200, August 1988.

18.

W.E. Vesely, " Evaluation of Allowed Outage Times from a Risk and Reliability Standpoint," NUREG/CR-5425, August 1989.

19.

1.5. Kim, S. Martorell, W.E. Vesely, and P.K. Samanta,

" Quantitative Evaluation of Surveillance Test Intervals Including Test Caused Risks," NUREG/CR-5775, February 1992.

12

^

Table 1-A Sumary Of Probabilistic Review status of the Licensee's Proposed TS Changes for the STP Facility i

System STP TS A0T A0T STI STI Probabilistic 1/

Ref. No Pre.

Pro.

Pre.

Pro. Review 1/

1/

Status 1.

CVCS 3.1.2.4 03D 10D N/A N/A Evaluated 2.

RPS 4.3.1 N/A N/A 62D 92D Evaluated 3.

ESFAS 4.3.2 N/A N/A 62D 92D Evaluated 4.

PSYS 3.4.2.2 15M 60M N/A N/A 1/

5.

AS 3.5.1 01H 12H N/A N/A Evaluated 6.

ECCS 3.5.2 03D 10D N/A N/A Evaluated 7.

RHRS 3/4.5.6 03D 100 92D 184D Evaluated 8.

CVS 4.6.1.7.4 N/A N/A 31D 920 1/

9.

CSS 3/4.6.2.1 03D 10D 92D 184D 1/,3/

10.

RCFCS 3/4.6.2.3 03D 10D 31D 92D 2/, 3/

11.

CIS 3.6.3 04H 24H N/A N/A 1/,1/

12 SGSRVS 3.7.1.1 04H 24H N/A N/A 1/

13.

CCWS 3.7.3 030 10D N/A N/A Evaluated 14.

CRHVACS 3/4/7.7 07D 10D 31D 92D Evaluated 1/

15.

EABHVACS 3.7.13 N/A N/A 12H 24H 1/

16.

ECHS 3.7.14

.03D 10D N/A N/A Evaluated NOTE:

1/

Either the TS-change for this system was not probabilistically evaluated using the current CDF risk models and profiles, or the appropriate CDF risk model does not exist currently.

1/

The TS-change for this system was not evaluated in detail due to the unavailability of the appropriate containment failure models including uncertainty evaluation models.

3/

The TS-change for this system was not evaluated using the CDF models and profiles.

4/

Only the STI change is approved (see Table 2),

}/

Pre.-

Current TS requirement as approved as part of operating license (OL)

Pro.-

A requested TS-change for future amendment to the OL i

13

~,

Table 1-A Sumary Of Probabilistic Review status of the Licensee's Proposed TS Changes for the STP Facility (Continued.)

Note (Continued.)

6/

Abbreviations used for the name of the systems are:

CVCS-Chemical Volume and Control system RPS-Reactor Protection system ESFAS-Engineered Safety Features Actuation system l

PSVS-Primary Safety Valve system AS-Accumulators system ECCS-Emergency Core Cooling system RHRS-Residual Heat Removal system l

CVS-Containment Ventilation system CSS-Containment Spray system RCFCS-Reactor Containment Fan Cooler system i

CIS-Containment Isolation system SGSRVS-Steam Generator Safety Relief Valve system CCWS-Component Cooling Water system j

CRHVACS-Control Room Heating Ventilation & Air Conditioning system EABHVACS-Electrical Auxiliary Building Heating Ventilation & Air Conditioning system l

ECHS-Essential Chilled Water system

~

14 l

L

s d

Table 2-A Sumary of Initial Evaluation of Licensee's Proposed TS-Changes for the STP Facility 8

1 System TS-Pre.

Pro.

Risk Measure 1/

Quantitative Change 1/

1/

Evaluation Req.

CCDF Inc CDF Findings Risk (E-7/RY) 1.

CVCS A0T 03d 10d 1.00 Neg.

REJECTED 3/

,l 2.

RPS STI 62d 92d N/A 2.70 APPROVED 3.

ESFAS STI 62d 92d N/A 0.49 APPROVED 4.

AS A0T 01h 12h Neg. Neg.

APPROVED 5.

ECCS A0T 03d 10d 2.50 14.00 REJECTED 3/

6.

RHRS A0T 03d 10d 1.20 0.34 REJECTED 2/

7.

RHRS STI 92d 184d N/A 0.34 REJECTED 4/

8.

CCWS A0T 03d 10d 1.00 16.00 REJECTED 3/

9.

CRHVACS A0T 07d 10d 1.60 13.00 REJECTED 1/, }/

10.

CRHVACS STI 31d 92d N/A 13.00 APPROVED 11.

ECHS A0T 03d 10d 2.80 29.00 REJECTED 3/

NOTE:

1/

CCDF-Conditional risk (expressed as a normalized factor over the current level of CDF) given a train of the system is taken out during a RMP week Inc. CDF-Increase in average annual CDF (AACDF) due to the initially proposed TS change (expressed as a percentage over the current level of AACDF risk)

Pre.-

Current TS requirement as approved as part of operating license (0L)

Pro.-

A requested TS-change for future amendment to the OL 2/

This system was not evaluated using the STP CDF profiles.

It has been probabilistically evaluated using limits on the allowed increase in release frequency guidelines for approval purposes.

3/

This TS change was rejected in its initially proposed form due to the potential overlapping outage issue and the lack of an enhanced diagnostic evaluation program in assuring the operability of the second train, given a train is taken out for T&M activity.

L 15

1 l>

Table 2-A Summary of Initial Evaluation of Licensee's Proposed TS-Changes for j

the STP Facility (Continued.)

NOTE: (Continued.)

4/

This initially proposed TS-change has been rejected due to the use of inadequate model and test data inadequacies, 3i 5/

An A0T change from seven days to ten days for the first inoperable train 1

has been requested.

Given the first inoperable train, an A0T change from 24 Hours to 72 Hours for the second inoperable trains has also t,9en

)j requested.

i i

?

l a

i 1

7 l

l i

i i

s I

16 I

i i

Jo Table 3-A Summary of Staff's Disposition Findings on Initially Rejected TS Changes for the STP Facility System TS Pre.

Pro. Alt. Disposition Change 1/

1/

Findings.

Rea.

i 1.

CVCS A0T 03d lod 07d Approved 1/

5.

ECCS A0T 03d 10d 07d

' Approved 1/, 1/

6.

RHRS A0T 03d lod 07d Approved 1/

7.

RHRS STI 92d-184d 61d Approved 4/

8.

CCWS A0T 03d 10d 07d Approved 1/

9.

CRHVACS A0T 07d 10d N/A N/A 11.

ECHS A0T 03d lod 03d -Rejected 3/

NOTE:

1/

The alternate TS-change as part lof the disposition process is approved based on the insignificant level of risk increase documented in Table 2.

2/

The licensee's additional information documented in Ref.14 provided additional basis for approval.

3/

The alternate TS-change as part of the' disposition process is further rejected based on the disproportionate-level of risk increase documented in Table 2.

The licensee's additional information' documented in Ref. 14 provided additional basis for rejection.

4/

The alternate TS-change as part of the disposition process is approved.

However, the present test scheme for the RHRS regardless of the STI'is rejected. A two months staggered test for each train of the RHRS had been consider / as part of the disposition process in order to limit the increase in tisk due to test failures that could occur due to extended j.

STI as proposed by the licensee.

}/

Pre.-

Current TS requirement as approved as part of operating license (OL)

Pro.-

A requested TS-change for future amendment to the OL Alt.-

An alternate TS-change considered as part of the disposition process 17

e TABtt 4 A Sunmary of Final Evaluatton of t teensee's Proposed TS-Changes for the STP Factitty TECHNICAL SYSTEe4 CURR[NI APPROVED NEW CURRENT APPROVED NEW SPEC.

AOI A0T*

STI STI 3.1.2.4 Chemical and Volume 3 days 7 days N/A N/A Control (Charging Pumps) 4.3.1 Reactor Protection N/A N/A 62 days 92 days System 4.3.2 ESFAS N/A N/A 62 days 92 days 3.5.1 Accumulators I hour 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months N/A N/A 3.E.2 ECCS 3 days 7 days 3;/A N/A w/xtr ck' 3/4.5.6 RHR 3 days 7 days 92 days 184 days' w/ stag tst 3.7.3 C aponent Cooling Water 3 days 7 days N/A N/A 3/4.7.7 Control Room HVAC:

One train inoperable.

7 days 7 days 31 days 92 days Two trains inoperable.

24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 72 hours 3.7.14 Essential Chilled Water 3 days 3 days N/A N/A 3/4.6.2.1 Contalment Spray 3 days 7 days 92 days 184 days' w/ stag tst Reactor Containment 3 days 7 days l31 days l3/4.6.2.3 92 days Fan Coolers NOTES:

1.

A0T extensions were Ilmited to 7 days for two reasons:

To avoid an overlap, and potentially unanalyzed multiple conponent or system outages, because of the STP rolling maintenance schedule.

To confom to the improved STS standard A0is (cts):

3. 7. 14 days.

2.

Two of the proposed ACT relaxations made net-negItglble contributions to the increase in CDF. Therefore, the extenstons were granted provided the licensee vertfled that the remaining redundant trains were operable prior to exceeding a 3 day outage.

.3.

Because of a general engineering judgment concern about the ef fect that 6 months between survel!* Nes would have on the material condition of the equipment, a staggered testing program will provide early detection of conmon cause standby failures while allowing the licensee to capture operating erperience data on the six month surveillance interval.

18

o Technical Evaluation Report 1

TECIINICAL EVALUATION OF SOUTH TEXAS PROJECT (STP) ANALYSIS POR TECHNICAL SPECIRCATION MODIFICATIONS P. Samanta. G. Martinez-Guridi, and W. Vesely Risk and Reliability Analysis Group Engineering Technology Division Department of Advanced Technology Brookhaven National Laboratory Upton, New York 11973 December 1993 Prepared for Division of Safety Issues Resolution Of6cc of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Under Contract No. DE-ACD2 76CH00016 NRC FIN L2591

o CONTENTS Page AC KN OW LE DG E MENTS..............................................

v 1.

I NTR O D U CTI O N..............................................

1 1

1.1 Background...

1.2 Current and Ptoposed TS for STP Stations.......................

2 1.3 Sco pe o f t h e R evi ew.......................................

2 1.4 Scope and Outline of the Report..............................

3 2.

METHODOLOGY OF THE REVIEW.............................

4 2.1 Issues Addressed in Review..................................

4 2.2 Reason for Requesting Modification...................

5 2.3 Appropriate Risk Measures for AOT and STI Modification 5

2.4 Modeling of TS Parameters..........................

7 2.5 Data Used in Support of Analysis S

2.6 Check on Quantification Performed...

9 2.7 Sensiti ity and Uncertainty Analysis............................

10 2.8 Decision Framework (Criteria) Used.........

11 2.9 Presentation of Results.....................................

11 3.

REVIEW OF STP METHODOLOGY FOR PROPOSED TECHNICAL SPECIFICATION MODIFICATIONS..........................

12 3.1 Basis Presented for the Proposed Technical Specifications Extensions...

12 3.2 Assessment of the STP Methodology Used to Calculate the AOT Risk Contributions..................................

13 3.3 Assessment of the STP Methodology Used to Calculate STI Risk Co nt ribu t io n s............................................

14 4.

ANALYSES OF REQUESTED TECHNICAL SPECIFICATION CHANGES 1

AN D R E CO M M EN DATI ON S................................

15 4.1 Overview of the Review Approach.............................

15 4.2 Oeneral Observations Regarding STP Submittal Impacting Review of the Requested Technical Specification Changes 15 4.3 Categorization of Proposed Changes in STP Submittal Based on the Impact on Average Plant CDF.............................

18 4.4 Analysis of TS Changes with Negligible CDF Impacts...............

19 4.5 Analysis of TS Changes with Non. Negligible impact on Average P l a n t C D F.............'.................................

22 4.6 Analysis of TS Changes Involving Containment Systems.............

23 4.7 Summary Analysis of Technical Review Conclusions................

24 in

r e

CONTENTS (Cont'd.)

Page 5.

SUMMARY

25 REFERENCES 27 Appendix A: Proposed Modifications to the STP Technical SpecI6 cations...........

A1 Appendix B:- Review Analyses of Individual Technical Speci6 cation Changes.........

B-1 l

Appendix C: List of Speci6c items Requested As Additional Information...........

C-1 l

l l

I l

i i

l IV l

l

,,., -.. ~,,...

l 3

q i

ACKNOWLEDGEMENTS i

l The authors would like to thank Erul Chelliah, Millard Wohl, and Mark Reinhart of the U.S.

i Nuclear Regulatory Commission for many discussions and technical support during this project. Richard l

Murphy and Rick Grantom of the South Texas Project (STP) staff have been very cooperative in responding to many requests for information. We also thank our colleagues Adele DiBiasio, Robert j

Hall, and James Higgins for their review of the report and valuable comments.

Finally, we thank Kathleen Nasta and Ellie Karlund for an excellent job in preparing this report, 1

I l

l 4

{

)

v 1

o 4

1.

INTRODUCTION 1.1 Bachround Houston Lighting & Power (HL&P) submitted an amendment to modify the Technical Specifications (TS) of the South Texas Project (STP) Electric Generating Station plants! on February 1,1990. This amendment proposed changes to 22 Technical Specification items and is based on probabilistic safety assessment (PSA) analysis of the impact of changes to plant risk. The U.S. Nuclear Regulatory Commission (USNRC) requested Brookhaven National Laboratory (BNL) to evaluate the

)

analyses made in support of the changes proposed for STP.

The STP consists of two units (STP 1&2), Westinghouse designed pressurized water reactors (PWRs). Unit 1 and 2 are in commercial operation, respectively, since August 1988 and June 1989. The plants, in general, have three electrically independent and physically separate safety trains. As stated in l

the STP submittal, the current TSs are generally based on the Standard Westinghouse Technical Specifications which were developed for Westinghouse two-train designs. The proposed changes primarily consist of extending allowed outage times (AOTs) and Surveillance Test Intervals (STis) to take 1

credit for the added safety resulting from the three-train design.

The risk based analysis of STP Technical Specification modificationsid was performed using the STP probabilistic safety assessment (PSA) completed in May 1989 and reviewed by Sandia National 2

Laboratories for the USNRC.) The STP PSA was performed using the RISKMAN Computer Code package developed by PLG, Inc..'

The review of the STP PSA by Sandia did not involve any 3

quantitative evaluation using the RISKMAN Computer Code. After completing the STP PSA, STP staff developed a submittal for Individual Plant Examination (IPE) of the plant using the com The risk model developed in support of the IPE is different than the original PSA model.pleted 5

The core.

damage frequency estimated in the IPE submittalis about a factor of 4 lower than the estimate presented in the May 1989 analysis. Similarly, the impact of TS changes evaluated using the STP IPE model is different, and was reassessed by STP in August 1993.7 This analysis, based on the STP IPE model, was considered to represent the best estimate of the impact of the proposed TS changes and is used in reviewing the requested modifications.

Following the start of the BNL review of the STP submittal, a technical contact was maintained with STP staff to obtain necessary information for reviewing the TS analyses. The review was initiated with the original submittal,' which was supplemented by STP staff with additional evaluations using the IPE model while the review was in progress. STP also provided an earlier version of the IPE 5

(RISKMAN) model which was used for performing quantitative analyses of TS changes and later provided an upgraded version of the IPE (RISKMAN) model. The first phase review findings, requesting additional evaluations to be completed in support of the proposed TS changes, were summarized in question form and were submitted to STP.8' The STP revised submittal which was issued in response, 7

and which included reassessments, is reviewed here. The STP revised submittal was also supplemented 3

with additional information during the final review process. The additional information provided was 8

related to the questions raised in the review of the original submittal. This information was also considered in the review.

1

. ~.

4 1.2 Current and Proposed TS for STP Stations Of the 22 proposed changes contained in the original submittal,8 six were withdrawn by STP. A list of the remaining 16 TS changes, currently under review by the USNRC,is presented in Appendix A which summarizes the specifics of the proposed individual changes.

Of the 16 proposed TS changes, quantitative evaluations are performed by STP in support of 11 of them using the PSA model of the plant. Qualitative explanations are presented by STP for the remaining 5 to support their proposed extensions.

The TS changes being requested by STP are of two types:

a) extending the allowed outage time (AOT) for a single train failure (e.g., from a current limit of 3 days to 10 days),

b) extending the surveillance test intervals (STI) (e.g., from 31 days (monthly) to 92 days l

(quarterly)).

The TS changes are either one of the two types (8 only AOT changes,4 only STI changes) or both (4). Of the 11 changes for which PSA quantitative evaluations are presented,5 relate to AOT changes only,2 relate to STI changes only, and the remaining 4 involve both AOT and STI changes.

1.3 Scope of the Review l

The scope of the review is to technically evaluate the STP submittal requesting modification of the TS requirements. This technical evaluation is to include independent quantitative reassessment, as necessary, of the impact of the proposed TS changes on the plant risk using the available plant PSA.

Because the PSA was performed using the RISKMAN Computer Code package, the review was also l

carried out with the same computer code for comparability of the quantitative results. The review of the i

original submittal completed in May 1993' included requantification of selected aspects. Additionally, l

the core-damage frequency impact of the technical review conclusions was quantitatively assessed using the STP PSA model and the RISKMAN computer code.

The review of the STP submittal focussed on the TS changes for which quantitative assessments are presented, i.e., the 11 TS changes indicated above. The remaining 5 TS changes, for which qualitative analyses are presented, were not reviewed. The Level 1 internal event PSA of the plant was used for reviewing the technical analyses presented in the submittal.

The review did not include a comprehensive review of the basic STP PSA (STP PSA of May 8

1989,2 STP IPE, August 1992 ) nor of the RISKMAN Computer Code package used to quantify the risk measures. The review team accepted the PSA made available to them by STP. The review instead focussed on the selected aspects of the PSA that directly affect the TS analysis. These aspects are discussed in the report.

The STP submittal proposes to change the TS requirement of both the units. In the STP analyses l

presented, these two units are not treated separately. No interdependencies or cross-connections are j

identified in the STP evaluation that would cause the units to be separately analyzed. Therefore, the units are not separately treated in the review.

2

~.

1.4 Scope and Outline of the Report This report presents a technical evaluation of STP analyses of requested TS changes. The STP analyses are spread over multiple submittals,2^'- and for review purposes, the latest submittals were l

considered to contain analyses superseding previous analyses of the same aspects.

j In the review, first, a framework is presented for reviewing risk-based submittal of TS changes.

The framework defines the major areas and issues that need to be addressed. Following the introduction, Chapter 2 presents this framework. Chapter 3 presents a review of the PSA methodology used in the STP submittal to support the proposed TS changes. Chapter 4 analyzes the requested TS changes and presents review recommendations on the requested changes. Finally, Chapter 5 presents a brief summary of the findings.

Appendix A lists the STP proposed modifications to the Technical Specifications, together with the type of analysis prodded by STP to support the modifications. Appendix B presents the detailed review analysis of each of the requested changes, and Appendix C reproduces the list of the items requested to be addressed following review of the original submittal. These listed items were the results of the first-phase review completed in May 1993."

3

2.

METilODOLOGY OF Tile REVIEW The South Texas Project (STP) submittal to modify the Technical Specification (TS)is based on applications of probabilistic analyses that uses the probabilistic safety assessment (PSA) of the plant. The review methodology is thus focussed on the issues which need to be addressed in reviewing PSA-based analysis of TS changes.

In recent years, with the increasing emphasis on developing plant-specific PSAs for nuclear power plants, there has been a significant interest in applying PSAs to improve operating practices and regulatory requirements. TS requirements have been the focus of many of these applications. The review methodology presented here is based on research carried out in the United States and internationally. Specifically, the USNRC research projects on risk-based TS evaluations at Brookhaven National Laboratory, industry sponsored research projects on TS applications, and the activities of the International Atomic Energy Agency (IAEA) on risk-based TS were considered in defining the methodology in this chapter.

'2' In this section,we summarize the methodology focussing on the technical aspects of a risk-based submittal to modify TS requirements. We Srst identify the major areas that are reviewed and then briefly describe each of them, summarizing the issues the review will address and seek answers to in the submittal.

2.1 Issues Addressed in Review The basic objective of a review is to technically evaluate a) the analyses performed to support the requested changes, and the assumptions used in the analysis, b) the adequate treatment of issues arising from the requested changes, c) the validity of the quantitative assessment, and d) the framework used to develop the changes and the acceptability of the changes.

Specifically, the following items are focussed on:

Reasons for requesting the modifications Calculation of appropriate risk measures in quantifying the risk effects of TS modifica-tions Adequacy of modelling the TS parameters in the risk model used to quantify the effects Data used to support the analysis Correctness of the quantifications performed Adequacy of the sensitivity and uncertainty analyses and their use to justify TS modifications 4

a 1

Decision framework (criteria) used to decide on the modifications Presentation of results with sufficient details to allow their reconstruction.

Each of the items is discussed below to describe the specific issues that the review needs to address in evaluating the submittal.

2.2 Reason for Requestine Modification t

It is beneficial if the reasons for requesting the modification are to be presented in the submittal.

When several requirements are requested to be modified, then it may be necessary to give reasons separately for changing each of them because there may be differences. From an analysis of the types of applications submitted, the reasons for requesting TS modi 6 cations may fall into one or more of the items presented below. Here, we focussed primarily on the allowed outage time (AOT) and surveillance 4

test interval (STI), as in the STP submittal.

Improvement in Operational Safety 1

The reason for TS modification may be to improve operational safety. This may imply an j

improvement or reduction in the plant risk, or a reduction in occupational exposure of plant personnel in complying with the requirements. It also can be argued that the changes will improve the allocation of resources, so improving operational safety.

Consistency or Risk-Basis in Regulatory Requirements The changes requested in the requirements can be argued based on their risk implications. If j

the requirement has minimal risk implication, then the changes may provide a needed flexibility. It must be assured that resulting risk due to the change should remain acceptable. TS requirements can be changed to reflect improved design features implemented in a plant that make a previous requirement unnecessarily stringent or ineffective. Risk based analyses can justify the needed change and its risk implication.

4 Demonstration of Need (hurden considerations) e In certain cases, the change may be needed to reduce the burden in complying with the requirements, based on the operating history of the plant or the industry,in general. For example, the repair time needed for components in a safety system may be longer, in specific instances, than the allowed outage time (AOT) defined in the TS. Similarly, the required surveillance may be ineffective in detecting certain failures of an equipment and need not be performed at the prescribed frequency.

The reasons for requesting changes can form an important input in the decision to seek the requested changes and de6ne the evaluations necessary to justify the modifications.

2.3 Appropriate Risk Measures for AOT and STI Modification In a PSA based analysis of TS changes, the risk impact is quantitatively evaluated using the plant-specific PSA. An important part of the review effort is directed at assessing whether the appropriate risk measures are calculated in the submittal. The measures to be used for AOT and STI modifications are S

4

l given in NRC publications."" A brief description of the risk measures and analyses required to support these measures is presented below.

Level of Analysis The impact of TS changes should be evaluated, where feasible, at least at the core damage frequency (CDF) level of the plant,i.e., the measures discussed below are to be calculated in terms of core-damage frequency. In addition, an assessment is needed of whether the high consequence sequences are affected much more strongly than the low consequence sequences. For modifying TS on a containment. system, a Level 2 PSA analysis, i.e., an evaluation of the impact on release frequencies is needed.

t AOT Risk Analysis For each of the requested AOT changes, the following risk measures need to be calculated to provide a comprehensive description of the risk impacts:

a)

Conditional risk during an AOT: the risk level (e.g., CDF) given that limiting condition for operation (LCO) has been entered. This measure defines the instantaneous CDF during the AOT period.

b)

Single AOT risk: the integrated risk (e.g., measured in terms of core-damage probability (CDP)) over an AOT period given that LCO is entered, i.e., the component or the train is unavailable. The CDP contribution is estimated as the product of the conditional CDF and the AOT. The increase in risk due an AOT is measured when the increase in CDF (difference between the conditional CDF and the baseline CDF)is used to estimate the CDP contribution.

c)

Yearly AOT risk: the expected risk for the AOT duration due to LCO occurrences over one year. This measure takes into account the frequency of LCO entry, and is essentially the product of this frequency and the single AOT risk.

d)

Average yearly downtime risk: the expected risk over one year assuming the mean downtime for the duration in the LCO condition. Note that the above single AOT risk and yearly AOT risk in b) and c) use the entire AOT and not the average downtime.

e)

Risk level due to preventive maintenance (PM) schedule: when AOTs are used for scheduled PM during power operation, then the risk impact of the PM schedule is to be calculated. For PM schedules, multiple components may be simultaneously unavailable for PM, and accordingly, the CDFs associated with the PM activities are to be analyzed.

f)

Increased risk due to simultaneous outages of components: if the changes in AOT may increase the possibility of simultaneous outages of multiple components, then this increased risk and how it is to be avoided during power operation should be analyzed and reviewed.

6

a e

i STI Risk Analysis Suiveillance tests are performed on safety system components to detect failures that may have occurred during standby. In changing the surveillance test interval, the measures to be evaluated are:

a) increase in CDF due to change in an STI: this can be calculated as a function of the risk importance of the component and the reliability of the component using PSAs."

b) impact of adverse effects of surveillance: when they are considered an important contributor, or an important reason for requesting the changes, then their contributions need to be quantified and assessed. The particular calculations which need to be carried out involve standard reliability evaluations."

. Total Risk Impact When multiple TS changes are requested, then the total collective risk impact from all the changes need to be reviewed. This includes:

a) the total impact of all the requested AOT changes, b) the totalimpact of all the requested STI changes, and c) the totalimpact of all the requested AOT and STI changes.

In most cases, the total impact is not the sum of the individual impacts, and accordingly, the plant PSA is to be used to quantify the impact.

2A Modeline of TS Parameters in assessing a PSA based analysis of TS changes, the primary question is the adequacy of the specific PSA model aspects for the TS evaluation. Assuming that the plant PSA is adequate, the resiew of the TS submittal focusses on those specific modeling items relating to the requested changes. The components whose TS are being analyzed for modification need to be explicitly modeled in the PRA.

The model also should be capable of treating alignments of components when testing and maintenances (scheduled and unscheduled) are carried out.

Modeline of AOT Risk Analysis The following parameters that are important elements in determining the AOT risk contributions are addressed in the review:

a) the increased risk level (e.g., increased CDF level) when the component is down and the assurance that the PSA is properly used in its calculation, b) the distribution of maintenance downtimes used in the analysis, and their mean downtimes, and c) the frequency for unscheduled (corrective) and scheduled (preventive) maintenances.

In items b) and c), it is particularly important that the basis for the extrapolated new mean dowmtimes and frequencies corresponding to the new proposed AOTs be reviewed.

7

~

a v

Modeline of STI Risk Analysis The following aspects important to modeling of STI risk need to be addressed in the review:

j l

a)

The basis for separation of demand versus standby time contribution to component unavailability: This conesponds to the separation of the component failure rate into a demand related (cyclic related) and time-related failure rate contribution. Only the time.

related contribution is affected by the changes in the STI. The STI risk contribution can be underestimated if there is little basis for the assumption of a demand related contribu.

tion.

b)

Test strategy considerations: If test strategies, e.g., sequential testing, or staggered testing, are assumed, then how they are modeled is reviewed. Typically, PSAs do not assume any specific test strategies.

c)

Assessmen, of common cause failure contributions: When STIs are modified, then the common-cause failure contribution for the affected components are also changed. This is because the common-cause contribution is directly proportional to the ST1. The review will address whether the modeling correctly evaluates such effects.

1 If the adverse effects of surveillance testing are quantified, then the modeling of such effects and how this contribution is used to assess STIs is evaluated. Usually, many adverse effects of testing, namely, test-caused transients, and wear of equipment, are not modeled in a PSA.

25 Data Used in Support of Analysis For a quantitative analysis of the risk impact of TS changes, the data used have an important influence on the results obtained. Typically, data consist of: a) plant-specific data, b) generic data, and c) projected data for the proposed caanges (due to lack of actual data). The review objective in this area is to focus on consistent and adequate analyses, and the use of data in analyzing TS changes. The complete set ofinput data used in the PSA studyis not necessarily the focus of the review; only relevant portions that have influence on the results of the TS analysis.

Use of Plant Specific Data A request for plant-specific TS changes is expected to include plant specific data, if such data

]

are insufficient and are used in combination with generic industry-wide data, then the review focusses on the way plant specific data are treated. In general, there must be consistency. For example, when the increased risk for a TS change is assessed, plant specific data should be used consistently in evaluating both the risk impact of the existing TS requirement and that of the proposed changed requirement.

1 Specific data items that are relevant for reviewing TS changes relating to AOTs and STIs are discussed below.

Repair /Afaintenance Data: The repair /maintena'nce data for the components for which AOT changes are being requested are used for calculating the risk measures identified earlier:

8

l I

a)

Scheduled maintenance data for scheduled maintenances performed during power operations: These data include the frequency and expected duration of the maintenanc-es. The expected duration should include the waiting period for which the component is unavailable, along with the actual duration of maintenance. When plants use a " rolling maintenance" schedule, then this schedule is important in assessing the risk from possible overlapping downtimes, b)

Unscheduled maintenance data: These include repair downtimes for unscheduled maintenances performed on the component. Again, the downtime should include the waiting period plus the repair time. The repair downtime data can be described in terms of a distribution with a mean value and associated ranges.

[

c)

Reconfiguration data during maintenance: Reconfiguration of other components for maintenances may affect the risk impact of a maintenance activity and,if credited in the l

analyses, is to be presented. These reconfigurations typically tend to decrease the risk-impact and can be neglected when conservative estimates are adequate.

I i

Surveillance Test Data: The following surveillance test data are needed in analyzing STis and are reviewed:

l a)

Detectability of the failure mode by the test: this includes an assessment of whether or not the failure mode contributing to the plant risk is detected by the surveillance test.

l Typically, the failure modes modeled in the PSA are assumed to be detected by the l

surveillance test. However,if only a fraction of the failures are detected, then the failure rate should be multiplied by this fraction to evaluate the STI risk. The remainder of the failure rate should be treated as being non-detectable.

b)

Component failure rate: this rate is typically included in a PSA in determining component unavailability. This data includes any separation of per demand (cycle) and l

time-related contributions, as discussed earlier.

c)

Test caused transient data: this includes errors caused during tests that result in plant transients. These data are needed to assess the adverse impact of testing, and can be used to justify increases in STis. When such adverse effects are the reason for seeking STI changes, then these data should be presented.

Common Cause Failures and Human Error Data Common-cause failure and human error contributors in a PSA model can dominate the total CDF. Conservative estimates of these parameters can minimize and shadow the risk associated with TS changes. The review objective is to assure that realistic estimates for these parameters, as opposed to unnecessarily conservative estimates, are used in the evaluation.

2.6 Check on Ouantification Performed One aspect of the review is to assure that the quantifications presented are correct. Usually, these quantifications are performed using a PSA computer code package. For example, the STP analyses use the RISKhiAN computer code package" developed by PLO, Inc. of Newport Beach, California.

Ouantification is checked by repeating the calculations in the submittal. However, this is one of the most resource consuming aspects of the review. At the same time, it is not necessary to repeat all the calculations; selected ones can be requantified to assure that the results are correct.

9

l l*

t i

Such a review is not, however, a review of the computer code used; in this case, the RISKMAN j

computer code. The quantification performed by the code, and its methodology is considered acceptable, j

If the code is to be checked, then an independent code review or quantification needs to be carried out.

The requanti6 cation process assures that corresponding to the case analyzed, appropriate inputs and 4

j assumptions are used in quantifying the results. In essence, the review objective here is to assure that j

the quantification process has:

l a) no error of truncation: in quantifying the CDF, the accident sequence cut sets are l

truncated at a certain value, e.g.,10", when quantif%ng the effect of TS changes.

However, in many cases, the affected contributors belong to cut sets that may normally l

be truncated. This will be particularly true if low risk contributors are being used for

{

proposed TS extensions. It is necessary that adequate precautions are taken to include l

such cut sets if they are to in0uence the results.

b) appropriate calculation of conditional risk: the calculation of risk measures needed in analysis of TS changes (AOTs and STis) involve calculation of conditional risk given that j

a component or a train is unavailable (i.e., unavailability is equal to 1), in this conditional calculation, Boolean teduction needs to be performed to obtain correct l

results.

2.7 Sensitivity and Uncertainty Analysis i

j In a PSA based analysis of TS changes, there are a number of assumptions and uncertainties that

{

affect the results. The quantification of the results discussed above are usually performed in terms of

{

mean estimates and are considered adequate for TS risk analysis. However, these analyses should be supplemented by sensitivity and uncertainty analyses. In general, important assumptions are handled l

through sensitivity analysis supplemented by limited uncertainty analysis. This also controls the resources j

needed for these evaluations.

i Sensitivity analyses are expected to address the major issues or assumptions in the submittal that i

may affect the estimated core damage frequency. Issues to be addressed in a sensitivity analyses are:

a) impact of variation in repair policy due to AOT changes, b) impact of variation in assumed mean downtimes or frequencies, c) effect of separation of demand vs. standby time related contribution to component unavailability, 4

d) effect of multiple component outages that may be considered likely due to changes in AOTs,and e) impact of variation in i:ommon cause and human error contributions.

e d

10

i i

Uncertainty analyses can be used to address the impact of data uncertainties in the calculation i

of the risk measures used. Their main function is to determine whether the TS changes will result in much larger uncertainty in the risk of the plantt in this case, measured in terms of CDF. When multiple TS changes are requested, the impact of uncertainty in the new CDF incorporating all the requested changes is to be assessed.

2.8 Decision Framework (Criteria) Used The decision of the acceptability of the requested TS modifications is usually based on a number of factors: a) quantitative risk analyses results, b) qualitative considerations in addition to the quantitative analysis, c) operational benefits to the plant, and d) other available alternatives. The review 4

effort should address the criteria used to arrive at the requested TS changes and the justifications proposed for their acceptability, if the changes requested in the submittal would mean increased risk during operation, then proposed measures to control or trade-off the increased risk should be discussed.

i i

2.9 Presentation of Results The documentation of the detailed analysis supporting the TS changes is necessary. The information developed and analyzed should be succinctly presented. This is necessary not only for the reviewers to understand the analysis performed and the assumptions made, but also for future references in regulatory decisions both by the plant staff and the USNRC. The documentation should address all the aspects discussed above:

a) reasons for the request, b) identification and discussion of the issues supponing the requested changes, c) models and data used for quantitative analyses, d) assumptions in the analysis, e) presentation of quantitative results with relevant intermediate results, f) sensitivity / uncertainty analyses, g) decision framework (criteria) used, and h) presentation of any alternatives studied.

l In addition, a summary should be given of the requested changes, reason for the changes, impact of the changes on plant risk, any changes in plant procedures or activities, and the safety and operational i

benefits to be achieved from the changes.

11 i

3.

REVIEW OF STP METi!ODOLOGY FOR PROPOSED TECllNICAL SPECIFICATION MODIFICATIONS V

This chapter reviews the risk methodology that is used in the South Texas Project (STP) submittal to justify the TS extensions which are requested. Only those proposed TS extensions are reviewed for which risk evaluations are performed in the STP submittal. The proposals based on a qualitative assessment have not been reviewed here. The review of the methodology in this chapter starts with the basis given in the submittal for the proposed TS extensions on which the methodology is developed. The review then assesses the models and calculations that are used in the STP subnitt41.

i.

The conclusion from these reviews is that the basic methodology which is used in th: subrnittal is generally valid. However, a number of calculations were omitted which were subsequently presented in response to review requests. In addition, the sensitivity and uncertainty analyses presented for the assumptions in the analysis cannot be considered to be complete.

3.1 Basis Presented for the Proposed Technical Specifleation Extensions The methodology which is used in the STP submittal starts with the premise that the present Westinghouse M) Standard Technical Specifications (STSs) do not give adequate credit for the three separate safety train design of STP. Consequently, the methodology then focuses on demonstrating that the proposed TS extensions cause negligible risk increases, i.e., negligible CDF increases and negligible system unavailability increases. Thus, the focus is not on the burdens associated with the present technical specifications nor on cost-benefit or trade-off analyses, but on negligible risk contributions. To help initially Lstify the position that the three train STP design results in lower risk than two train designs, for vnich it is argued that the Westinghouse STSs were intended, a comparison of the current CDF for STP witt the CDFs of two train plants is presented in the submittal. The presented comparison is shown below. Only two train plants analyzed by PLO, Inc., are. compared, i.e., Three Mile Island, Midland, Seahook, Diablo Canyon. As seen below, this comparison does show that the mean CDF for STP (4.4 x 10*yr) ranges from a factor 4.5 to a factor of 12.5 lower than the mean CDFs for the two train plantt However, it should also be noted that the mean CDF of 4.4 x 10'8/yr for STP is not an exceeding y Icw CDF but tends to lie in the middle of the range of CDFs when a wider range of types of plants and analyses are considered as described in NUREG 1150." When focussed on W-designed plants and similar types of PSAs, then the differences in CDFs are minimal.

Probabilistic Safety Assessments (PSAs)

Assessed Core Damage Frequency (per reactor year)

Three Mile Island (B&W) 5.5 x 10" Midland (B&W) 3.1 x 10" Seabrook M) 2.7 x 10" Diablo Canyon M) 2.0 x 10" STP PSA' M) 1.7 x 10" S

5 STP PSA/IPE 3) 4.4 x 10 12

is l

3.2 Assessment of the STP Methodolocy Used to Calculate the AOT Risk Contributions l

The STP submittal utilized a valid, general methodology to calculate the risk contributions which are associated with the proposed AOTs. This general methodology is described in NUREG/CR 5200,"

NUREG/CR 5425,"and NUREG/CR 5775." However, in the application of the methodology there are j

inadequacies in the STP submittal in two areas. They are:

i i

1.

CDF contributions associated with an AOT, and 5

l 2.

The uncertainties and ranges on the possible sizes of the CDF contributions from the j

proposed AOTs.

CDF Contributions Associated With an AOT There are two CDF contributions associated with an AOT. One contribution is the average CDF i

contribution associated with the AOT which is calculated in the PSA. The second c intribution is the probability of having a core damage (CD)when the component is down for the downtime associated with the AOT. This second contribution is sometimes called the single AOT contribution. The average CDF contribution calculated in the PSA is the single AOT contribution multiplied by the expected frequency j

of occurrence of the AOT.

4 j

The STP submittal primarily calculates and justifies changes to AOTs based on the average CDF

{

contribution for the proposed AOTs. STP, however, but provided calculations for the single AOT contribution in response to review requests. The STP submittal argues that the single AOT contribution j

is not relevant in determining the risk acceptability of the AOT. This is not necessarily true sino the single AOT contribution gives the increased probability of having a core damage (CD) accident during the period tt.e component is down for the AOT. The single AOT contribution is directly proportional to the AOT downtime. The potential importance of the single AOT contribution in assessing the acceptability of the AOT is described in NUREG/CR 5425."

i If the single AOT contribution is too high, i.e.,if the CD probability is too high, then the AOT is unacceptable. For example, if the CD probabilityis 0.1 for the AOT downtime then the AOT is clearly unacceptable. Note these single AOT contributions are probabilities and not frequencies and their sizes must be assessed on a probability scale. The average CDF contribution could still be low if the frequency l

of the AOT occurring is low. For example, if the frequency of the AOT occurrence is 1 x 10" per year 1

then the average CDF contribution is 1 x 10" per year x 0.1 = 1 x 10 per year. Thus, both contributions 4

]

are needed to determine the acceptability of the AOT and both contributions should be low.

]

The IJncertainties and Ranges on the Possible Sizes of the CDF Contributions i

The STP submittal only calculates the mean estimates for the CDF contributions for the proposed j

AOTs. Uncertainties in the CDF estimates due to uncertainties in the data are not calculated. Also, variations in the CDF contributions due to variations in the downtirne am not calculated.- Variations in the downtime can be particularly significant because of the assumptions used in the STP submittal.

1 1

The STP submittal assumes that only 1/6 of the propos.d AOT would be used on the average in any downtime. This assumption is not based on any directly applicable plant specific data. Instead, j

it is based on extrapolations from generic downtime data for sm 211er AOTs, i.e.,3-day AOTs as opposed to the 10-day AOTs which are generally requested.

1 13 4

a 1

l m.

,.w..

r-

.--,.~w

-,_y,_,

,_.n.--,

a As explained in NUREG/CR 5425, the CDF contributions for the AOT are directly proportional to the assumed fraction of AOT used. Thus, the CDF contributions can be a factor of 6 times higher than the values calculated in the STP submittal. Since there is little hard basis for the 1/6 assumption used in the STP submittal, these maximum CDF contributions should also be calculated in assessing the AOT risks. These maximum contributions also represent the maximum risk allowed by the AOT when the total AOT is used for repair or maintenance. These maximum values were evaluated in the review and were incorporated in categorizing the risk impacts from the proposed AOTs as indicated in Tables 4.2 and 43 in the following chapter.

The maximum CDF contributions also serve to account for uncertainties associated with the estimated mean CDF contributions. The factor uncertainty in the PSA calculated CDF is of the order-of a factor of 2 or 3 based on NUREG/CR 5200 as well as NUREG 1150 PSAs. Thus,if the assumed mean fraction of 1/6 has a factor of uncertainty of 2, which is characteristic of mean dowmtime uncertainty estimates, the overall factor uncertainty in the mean CDF contribution is of the order of a factor of 5 to 6.

When tradeoffs in risk contributions are made, such as in decreasing certain AOTs and increasing others, these variations and uncertainties tend to cancel. However, in attempting to show negligible risk increases, as the STP submittal does, then the variations and uncertainties need to be considered. This is particularly important when there is no direct data to support the assumptions as in the case of the STP assumptions.

3.3 Assessment of the STP Methodology Used to Calculate STI Risk Contributions The STP submittal utilized a valid, general methodology to calculate the risk contributions from the proposed extended STis. The component failure rates are treated as being standby time-related totally (on a per-hour basis) which maximizes the risk contributions associated with the proposed STis.

Lacking any data to separate the demand failure contribution and standby time-related contribution, this treatment of component failure rate is appropriate. The general STI methodology which covers these considerations is described in NUREG/CR 5200" and NUREG/CR 5775.

The STP submittal again is not entirely complete in its application of the methodology particularly in assessing the uncertainties associated with the STI risk contributions. These contributions are not explicitly evaluated, though they are generally small.

The STP submittal did not specifically evaluate uncertainties for the CDF contributions for the proposed STis. However, the submittal did assume a total per hour failure rate which maximizes the CDF contribution with regard to different failure rate models. The remaining uncertainties in the CDF contribution for the STIs are due to PSA uncertainties. These uncertainties are generally on the order of a factor of 2 or 3 based on NUREG/CR 5200, as well as NUREG 1150 PSA evaluations. Since the submittal evaluations use standard assumptions, these general uncertainty factors should apply. These uncertainties should not affect the assessments of the CDF impacts associated with the proposed STis or the categorization of these impacts performed in the review, as presented in the following chapter.

l 14

-. - l

4 4.

ANALYSES OF REQUESTED TECilNICAL SPECIFICATION CilANGES AND j

RECOMMENDATIONS In this section, we present an evaluation of the risk based analysis presented in the STP submittal to justify the requested TS changes. Here, we summarize the relevant considerations in analyzing the l

detailed quantitative assessments, the important observations and issues from the review considerations, and the categorization of the requested changes based on their risk impacts. Recommendations regarding l

the requested TS changes are also provided. Appendix B separately discusses each of the requested TS l

changes and reviews the analyses performed in support of the requested changes.

I l

l 4.1 OverMew of the Redew Approach The review of the STP submittal for TS changes followed the review methodology discussed in l

Chapter 2. Because of the nature of the STP submittal, and the manner in which different aspects of l

the submittalwere received, a number of assumptions are made in the review process. Following the l

general review of the methodology used in the risk-based analysis andjustification of the STP TS changes l

(presented in the previous chapter), specific risk Irr. pacts for the requested TS changes are reviewed in l

this chapter. The assumptions made in this process are discussed below:

Each of the requested TS changes was reviewed indisidually first, and then an assessment was made based on the combined effect of the overall impact. The intent in such an approach is to focus on the risk impacts of the individual proposed changes and then evaluate the overall risk impact, noting the importances of the individual contributions.

In reviewing the STP analyses, the quantitative analyses presented in the submittal are considered valid and correct. As mentioned brie 0y in the introduction, during the first phase of the review, which resulted in the request for additional evaluations, selected requantification was performed. (Additional evaluations requested to be performed following Srst phase of the review are presented in Appendix C.) In all cases, when l

requantification was performed by BNL using the same RISKMAN computer code package and the STP PSA model, the same numerical results were reproduced.

However, the review could have benefitted from quantitative assessment of additional aspects relating to sensitivity and uncertainty analyses not presented in the submittal, but, because of time and resource constraints, such evaluations were not performed.

As presented later in this chapter, the TS changes reviewed were categorized into those having negligible impact on plant risk and those whose impacts are not necessarily negligible. Following this initial screening, many additional aspects were judged qualitatively. For example, the total impact of the group of the TS changes whose individual impact on the average CDF is negligible, is also assessed to be negligible.

4.2 General Obwrvations Recardine STP Submittalimpactine Redew of the Requested TS Chances in this section, we present some general observations relating to the CDF impacts prc:,ented in the STP submittal that should be considered in assessing the requested TS changes for the plants. Many of these observations involve considerations of the risk level in the plant and the effect of plan: practices.

15 l

a

/

Baseline Core Damage Freauency (CDF) Level of the Plant The baseline CDF for the STP plant used for the analysis is 4.4 x 10'8 (mean, point estimate) with a range factor (e.g., ratio of 959c and 507c estimates of CDF) of around 2.5. This estimate is referred to as the STP PSMPE estimate. This mean CDF for the STP plant is not an exceedingly low CDF, but tends to lie in the middle of the ranges of CDFs when wider ranges of plants and analyses are considered, as evident from IPE submittals of many operating nuclear power plants. In other words, the three train design of the STP plant did not result in a particularly low CDF compared to two train designs.

The comparison of the CDF estimates of different plant PSAs (performed by PLO,Inc.), as discussed in Section 3.1, shows that STP mean CDF is not significantly different. Assuming that STP i

4 Level 1 PSA (mean CDF of 1.7 x 10 ) had comparable methodology and database as the other plants, j

the mean CDF is slightly lower, but not significantly lower requiring a different approach to TS changes.

Reduction in the STP CDF Estimate The executive summary of the STP submittal presents a table showing the history of the calculated CDF; STP PSA (1989)2 STP PSMPE (1992)5 Current Evaluation (1993)7 1.7E-04 yr'!

4.4E 05 yr8 3.6E 5 yr'!

It is important to note that none of these decreases is due to the proposed TS changes. These changes, as discussed in different parts of the submittal, are due to a combination of reasons. The decrease in Level 2 PSMPE estimate from the level 1 PSA estimate is primarily due to: (1) improvement in the RISKMAN computer code,(2) removing conservatism in the PSA model, and (3) implementation of limited plant specific data.

The decrease in Current Evaluation (1993) from the Level 2 PSMPE is due to changes in the planned maintenance practices at the plant. This evaluation reflects a change to a semiannual maintenance as opposed to quarterly maintenance for emergency diesel generators, auxiliary feedwater and essential chilled water systems. This decrease in maintenance and the corresponding decrease in maintenance unavailability is the primary reason for the decrease in CDF from the 1992 PSMPE assessment. This decrease in CDF is also only due to the decrease in maintenance downtime from doing less maintenance and does not take into account any potential increases in CDF from doing less maintenance. As analyzed in the STP submittal, the TS changes being considered increase the CDF.

The increase in the average CDF for the requested TS changes is approximately 67c (at least 109c when the impact on initiating events is included) when only a mean repair time is assumed, i.e., on the average if only 1/6 of the proposed new AOTs are actually used. When the entire AOT is used, the increases in the CDF can be significantly higher, as discussed later in Section 4.3.

Impact of the "Rolline Maintenance" at the Plant As stated in the STP submittal, the allo'wed outage time (AOT)in the STP TS is used to perform planned maintenance during power operation using a rolling maintenance schedule. A "12 week rolling maintenance schedule"is used at the STP plant. In each of these 12 week periods, all corrective / planned maintenance activities are scheduled, together with any required surveillance testing according to a predetermined schedule, in such a schedule, each week, a defined set of equipment (i.e., safety trains) 16

i

o s

J is taken out-of-service. This schedule repeats every 12 weeks. It appears that the impact of this planned rolling maintenance is not included in the base case PSA model. The planned rolling maintenance has dual effects: (1) improving the reliability of the equipment, which decreases the average plant CDF in i

the long run, and (2) increasing the downtime associated with maintenance, which increases the plant CDF. Typically,in PSA models, a conservative approach is taken, i.e., only the second effect is included.

As analyzed in the submittal, the planned maintenance increases the CDF by about 47%, based on i

current TS requirements and considering only the maintenance downtime. If AOTs are increased based on the STP submittal and the increased AOTs are used to perform longer maintenances, then the CDF increase will be higher than the value determined in the STP submittal.

Surveillance Testine and Preventive Maintenance j

j As stated in the STP submittal, the surveillance testing at the STP plant "is acmmplished at the conclusion of the planned maintenance period to prove the equipment operable." The coordination of the surveillance testing and preventive maintenance is desirable to reduce the equipment downtime due to such activities. However, when surveillance testing intervals are increased to a value equal to or larger than the planned maintenance interval, and if such testing are performed at the conclusion of the planned j

maintenance, then the purpose of the surveillance testing, i.e., to detect any failure during the standby period, may be lost. In other words, planned maintenance may correct many failures and the component reliability measured from the results of surveillance testing may be unrealistically high for actual demands on the component.

Assessment of the Impact of Chancine Surveillance Test Intervals a

1 The impact of changes in the surveillance test intervals (STIs) is incorporated in th. c impoc at j

unavailability model used in the PSA where an increase in STI increases the component uc vallahity 3

and consequently, the CDF. However, the component failure rate (X) used in the corur.nent unavailability model can be a function of the STI and a significant increase in STI may increase the A, j

for example, due to aging. In PSA analyses, changes in A are not modeled since it is considered that STIs are not being changed beyond the point where it may affect A. Although the relation between A and STI for different components is not known, caution should be taken when significant changes are proposed for STIs based on risk analyses results showing negligible increases where A is assumed to remain constant for larger extrapolations. It can be useful to monitor the performance of these j

components, for example, by establishing a reliability monitoring program, to assure that there are no deleterious effects from the STI extension.

Total impact of the Requested TS Chances The total risk impact of the proposed AOT and STI changes are summarized in Table 4.1. As shown in the table, the expected risk increases are not significant, but are not necessarily negligible. The maximum increases which occur if the total AOT is used are appreciable in size.

1 2

The STP analysis calculated the system contributions to the CDF for the proposed STI and AOT changes. This allowed the CDF increases by system to be evaluated which, in turn, identified the subset of system proposed changes which resulted in~ negligible CDF increase and those which did not. The 4

same system breakdown can be used to analyze the increases in the frequency oflarge early containment failure and the frequency of small early containment failure. This breakdown is important since the large early containment failure frequency is calculated by STP to increase on average by 35% and the small early containment failure frequency to increase on average by 18% from the proposed STI changes.

17

.~..

e Table 4.1. Summary of the Risk Increases Due to the Proposed AOT and STI increases Release Frequency (per year)

Major Release Group Expected Current Proposed Change Core Damage With AOTs & STis AOT & STI Qianges (Percent)

I.

Large Early Containment 9.9E 07 13E-06 35 l

Failure or Bypass I

II. Small Early Containment 6.7E-06 7.9E-06 18 Failure or Bypass 111. Late Containment Failure 1.1E-05 1.1E-05 0

IV. Intact Containment 2.6E-05 2.7E 05 5

l Total Core Damage:

4.4E-05 4.7E 05 (>4.85E-05*)

6 (>10*)

Value including the impact of changes in Essential Chilled Water System on the initiating event frequency (see Table 3.1.1, page 3.1.6 of Reference 7).

As presented, the average CDF is increased by 6% (10% when the impact of changes ofinitiating event frequency is included).' Since the entire AOT may be used, although infrequently, the impact of individual TSs using the entire AOT should also be included in assessments of the risk impacts.

Limited Plant-Specific Experience Data The risk-based analysis of TS changes in the STP submittal includes limited plant specific experience data. For example, the corrective maintenance durations used in the STP submittal are from generic industry databases (except for one case) and do not necessarily reflect STP plant experience. The primary reason for this is that the plants have been in operation for a relatively short time (approximately five years). However, the submittal presented analyses of the planned maintenance at the plant using plant-specific information for the STP plant presumably because of the greater availability of planned maintenance data.

43 Cateeorization of Proposed Chances in STP Submittal Based on the impact on Averare Plant CDF The STP submittal takes the position that the calculated risk impacts from all the proposed TS extensions are negligible. However, based on the review of the sizes of the risk impacts, the proposed TS extensions in the STP submittal can be more accurately grouped into three categories:

1.

Proposed TS extensions which result in basically zero or near zero CDF increases.

tBased on our assessments, the impact of TS changes on the initiating event (IE) frequency should be included in the CDF impact and should not be treated separately. The STP analysis did not provide an evaluation of the CDF impact considering all the proposed changes where the impact on IE frequency for changes in Essential Chilled Water System is included. The review analysis did not precisely quantify this contribution, but only placed a lower bound on the value as indicated in Table 4.1.

18

2.

Proposed TS extensions which result in CDF increases which are not necessarily negligible.

3.

Proposed TS extensions !nvoking containment systems where impact on release frequencies need to be assessed (PSA Level 2 Analyses).

The categorizations of the specific proposed TS extensions are shown in the three tables on the following pages. Category 1 proposed TS extensions basically only affect the CDF and cause zero to near zero CDFincreases for the expected CDFincrease and for the maximum CDFincrease (Table 4.2). The expected CDF increase corresponds to STP's assumption that only 1/6 of the extended AOT will actually be used on average. The maximum CDFincrease corresponds to the case where the total extended AOT is used because oflonger repairs required. When the AOT risk contribution is a dominant contribution to CDF, then the CDF increase is directly proportional to the assumed fraction of the AOT used. The CDF increases for the HVAC, at the bottom of the Category 1 table, are 3% (maximum increase may be as large as 18%) and are borderline in t.1eir negligibility. One reason for including Control room HVAC system in Category 1 is that the conditional CDF given a failure in the system is a factor of 1.6 larger than the baseline CDF. Greater than factor 2 increase in conditional CDF is calculated for Category 2 items. Category 2 proposed TS extensions produce expected CDF increases and maximum CDF increases which are not necessarily negligible, especially for the maximum CDF increases, as evidenced in Table 4.3. Since there is no direct data supporting the assumption of 1/6 of the AOT being used, the maximum AOT risks need to be considered to bound the maximum increase in risk. The maximum AOT risks also serve to account for uncertainties in the PSA calculations. Category 3 proposed TS extensions were additionally evaluated for their impact on large, early release frequency contributions using PSA Level 2 analyses (Table 4.4).

4.4 Analysis of TS Chances with Neclicible CDF Imtincts The requested TS changes with negligible CDF impacts were additionally assessed for the following aspects to further assess their impacts. These assessments were bounding in nature, based on the quantitative assessment presented in the submittal.

Conditionat risk due to use o/ACT: 'he increase in conditional risk (increase in conditional core damage frequency multiplied by the requested AOT) for each of the TS changes was assessed to be small. The conditional CDF calculated for each of the LCO for which TS changes are being requested was assessed to be less than a factor of 2.

l Impact on individualinitiating event category: The impact on CDF due to each of the individual initiating l

event category (e.g., loss of coolant accident (LOCA), Station Blackout)is not expected to be significantly altered by this subset of TS changes. The STP submittal has presented the impact of all the 11 requested TS changes on each of the major initiating event categories. A similar analysis for this subset of TS changes is expected to show that there is no significant alteration of relative contribution of the categories.

I 19 l

l

4 Table 4.2. Category 1 Proposed TS Extensions Which Result in Zero to Near Zero CDF Increases Proposed Expected Maximum System TS Change CDF Change CDF Change (Percent (Percent) l Chemical and Volume Control System AOT

~ 0.0 *

- 0.0 "

(CVCS) 3 -+ 10 Days Accumulators (ACC)

AOT

- 0.0 *

~ 0.0

1 hr - 12 hr Engineered Safety Feature Actuation STI 0.1 0.1

_ System (ESFAS) 2 mo - 3 mo l

Residual Heat Removal (RHR)

AOT 0.1 0.6 l

3 -.10 Days STI 3 mo -+ 6 mo Reactor Protection (RPS)

STI 0.6 0.6 2 mo -+ 3 mo Component Cooling Water (CCW)

AOT 3 -+ 10 Days Control Room Heating, Ventilation, STI 3

<18 and Air Conditioning (HVAC) 1 mo - 3 mo AOT 7 -+ 10 Days (1st Train) 24 -+ 72 hrs (2nd Train)

Based on negligible system unavailability increases calculated.

Actually negative because of PSA modeling changes, but not due to the AOT change.

Expected CDF change presented in the STP Submittalincludes interaction not applicable to the STP plant (verbal communication with STP). The single AOT risk based on conditional CDF calculation for this LCO, provided by STP,is negligible.

i Table 4.3. Category 2 Proposed TS Extensions Resulting in CDF Increases not Necessarily Negligible Proposed Expected Maximum System TS Change CDF Change ('/e)

CDF Change (%)

Emergency Core Cooling (ECC)

AOT 3.3 20 3 -.10 Days Essential Chilled Water (ECH)

AOT 10t 60t 3 - 10 Days t including the impact on IE frequency, as presented in Table 3.1.1 of the submittal.'

20

i Table 4.4. Category 3 Proposed TS Extensions involving Containment Systems Expected Maximum Contribution to Large, Proposed CDF Change CDF Chan,;c Early, Release Frequency System TS Change

(%)

(LERF) Change' Containment AOT 0.0 0.0 0.0 Spray (CS) 3 - 10 Days STI 3 mo -. 6 mo Reactor Contain-AOT 0.0 0.0 0.3 ment Fan Cooler 3 -.10 Days (RCFC)

STI 1 mo -+ 3 mo CS and RCFC 0.3

Accounts for approximately 80 percent of the total LERF.

Simultaneous outages of multiple components: With the increase in AOTs, there is an increasing likelihood of multiple components being simultaneously out-of-service for maintenance. The planned maintenance performed using a rolling maintenance schedule results in new equipment being taken out-of service every seven days. With a 10-day AOT, for instance, there would have to be a controlin place disallowing the start of planned of maintenance of the following week, if any unanticipated problem is encountered during the first week resulting in maintenance beyond seven days, as would be allowed by the changed AOT of 10 days. The risk impact of simultaneous outages of different trains can, in many cases, be significant, but this aspect was not addressed quantitatively. To climinate this possibility, AOTs 1

of seven days can be an appropriate alternative, which still provides a signiGcant portion of the requested extensions.

Totaloperating risk impact of this subset of TS changes: The total impact af this subset af TS changes was not evaluated separately, but based on the evaluations presented, this impact is also expected to te negligible.

Risk ofshutting down theplant: The risk of shutting down the plant with the proposed changes to TS was not evaluated. This aspect does not need to be addressed in most cases. However, for residual heat removal (RHR) systems, the change in test interval from 3 to 6 months can affect the risk of shutting down adversely. (It is noted that in the STP plant, the importance of RHR systems is less compared to other plants.) In addition, as discussed earlier, this large test interval can change the component failure rate and the overall train unavailability can be large.

Test Strategy Considerations: The proposed STI changes in the STP submittal do not discuss the test strategy (e.g., sequential, staggered) for these tests. Staggered testing reduces the risk impact compared to sequential testing, and the risk increase due to increases in STis can be compensated using a staggered test strategy". One important reason for the risk benefit of staggered testing is that common cause failure of multiple trains will be detected earlier. In a staggered test strategy, for a n-train system with test interval T, each train is tested at T/n time units apart. For example, in a 3-train system with a STI of 6 months, using a staggered test strategy at least one train is tested every 2 months. Since the effect of a large test interval (e.g.,6 months for RHR System) on component failure rate and common cause 21

R l

l t

q failure parameter is not known, a staggered testing is recommended for these types of changes to STis.

Staggered testing will result in early detection of failures in this system if this large STI results in any adverse effects.

Impact of Changes on Large, Eady Release Frequency (LERF) Contribution: The STP submittal presents a single evaluation of the impact to major release groups combining all the AOT and STI changes requested in the submittal. The LERF increases by 35 percent due to the requested changes, with the total LERF absolute contribution being 1.3E 06. The evaluation shows that the increase in the LERF contribution is almost entirely due to Control room HVAC AOT and STI changes. Because of this large relative impact on LERF, there is questionable basis for the proposed AOT extension for the first train failure in control room HVAC.

In summary, the requested AOT and STI changes for the seven TS items discussed above are assessed to have negligible risk impacts with the following restrictions:

AOT of 7 days should be used instead of 10 days to minimize simultaneous outages, and Staggered testing requirement when changing STI to 6 months for the RHR System to minimize the risk impacts of the extended STis.

The chaages to this group of TS items are consequently assessed to involve negligible risk impact and in addition, are expected to provide the operational flexibilitywhere resources can be spent on risk-significant aspects.

4.5 Analysis of TS Chances with Non-Nectic1ble Impact on Averace Plant CDF Two of the requested TS changes, as summarized in Table 4.3, are considered to have non-negligible impact on plant risk. In both of the cases, the requested TS change involves increasing AOT from 3 to 10 days. The impact of changing AOTs for these systems, based on the quantitative assessment provided in the submittal, can have the following implications:

As stated in Chapter 2,in defining AOT, not only the average impact on plant CDF, but also the l

risk contribution for a given LCO should also be evaluated. The conditional CDF when the component is down for an AOT is approximately increased by a factor of 2 to 3; and if the entire AOT is used, the core damage probability (CDP) contribution will be in the range 2 x 10

to 4 x 10'*, i.e., approximately 5 to 10Fc of the base CDP contribution for the year. It is acknowl-edged that every time the LCO is entered, the entire AOT is not expected to be used; nevertheless, this measure is important since the entire AOT may be used and such contributions may be incurred.

The impact discussed above is due to unplanned maintenances. In addition, the planned maintenances for these systems contribute additional risk. As discussed in the STP submittal, the 12-week maintenance cycle can increase the baseline CDF by 479c. A good portion of this increase is contributed by the maintenance of these specific systems. The proposed extended AOTs for these systems will not necessarily be restricted to unplanned maintenances, and if these extended AOTs are used to increase the duration of planned maintenances, then non negligible additional increase in risk will be incurred.

22

i*

4 Basid on the information in the STP submittal, these specific systems are taken out-of-service frequently; on the average, one train of each of the system is maintained once every month in a 12 week maintenance cycle. A 24-week maintenance cycle willimply maintenance of one train r

o the Essential Chilled Water System once every 2 months. The maintenance downtime contribution for these systems is, thus, already significant, l

There is no strong evidence presented in the submittal to justify the increase in the AOT,in spite of the non-negligible risk impact of these requirements.

The alternatives considered by the reviewers in recommending changes to the requirements for j

these two systems are as follows:

Require a cross-train check of one of the redundant trains to assure its availability before the AOT is to be used to perform an unplanned maintenance, i.e., repair a failure. This will reduce the impact of the downtime.

Allow a longer AOT only for unplanned (or unscheduled) maintenances; i.e., a different TS requirement for planned and unplanned maintenances.

Justify that adequate repair cannot be completed within the current AOT and the risk of shutting down the plant is equal or larger than that of continued operation.

s In summary, the conclusions from the review are:

a) the requested change in the AOT for the Essential Chilled Water (ECW) System involves a non-negligible risk increase and the alternatives considered are not at alyzed l

sufficiently to justify the proposed or an alternate change.

b)

The AOT for the Emergency Core Cooling System (ECCS) can be extenoul to 7 days with minimal risk impacts if a cross-train check of a redundant train is instituted before an unplanned maintenance, i.e., to repair a failure.

4.6 Analyses of TS Chances invobine Containment Systems The TS changes invobing containment systems minimally impact the large, early release frequency (LERF) of the plant (Table 4.4). The reason for this small impact on LERF is attributed to i

the speciSc design feature of the STP containment. The containment building at the STP is a post.

tensioned concrete cylinder with a steel liner and a domed top. The internal diameter is 150 feet, the walls are 3 to 4 feet thick, and the steel liner is 3/8 of an inch thick. During the review, no PSA Level 2 evaluation was performed. The review assessment did not find any signi6 cant issues in STP analysis showing minimal impact on LERF, as presented in Table 4.4.

Using reasonings similar to that discussed for other TS items, the assessments for these TS items are, thus, as follows:

Negligible risk impacts will result if the AOT for the Containment Spray (CS) System is extended from 3 days to 7 days. If staggered testing is performed, then the STI can be extended to 6 months with minimalimpacts.

23 1

=

The proposed AOT and STI extensions for reactor containment fan cooler (RCFC) system also involve negligible risk impacts.

4.7 Summary Analysis of Technical Review Conclusions As discussed above, the technical review conclusions for each of the TS items, judged on individual risk impacts, were further assessed in terms of their total integrated impact. The technical review conclusions (see Table 5.1) include a signl6 cant portion (but not all) of the requested changes and some additional requirements. The impact of these changes on the CDF was quantitatively assessed.

With these changes, the mean CDF is calculated to increase by 4.5%, i.e., the baseline mean CDF will increase from 4.4 x 10~8/yr to 4.6 x 108/yr. As presented in Table 4.1, the impact of the STP proposed changes would have been greater than 10%.

24

i 5.

SUMMARY

The report presents a technical evaluation of the South Texas Project (STP) Electric Generating Station submittal to modify 11 items in their Technical Specification (TS). These TS items involve changes to AOT and ST1 requirements; 5 related to only AOT extensions,2 related to only STI extensions, and the remaining 4 involved both AOT and STI extensions. The STP submittal to justify these changes uses a probabilistic safety assessment (PSA)-based analysis. To perform a roiew of the STP submittal, this report presents a framework to review a PSA based analysis of modifications to aspects of TS for a nuclear power plant. This review framework is then used to evaluate the requested modification to the STP TS items.

The technical roiew of the STP analyses in support of the TS changes included detailed reviews of the issues addressed and selected quantitative reassessment of the risk impact of the requested changes. The RISIGiAN Computer code package, the same package used for the STP submittal, was used for the review analyses. The first phase of the technical review identified specific issues that need to be addressed and additional evaluations that are to be performed in support of the proposed changes.

Based on these findings, additional evaluations were performed by the STP and the original submittal was supplemented with the additional information supplied.

The technical evaluation of the 11 TS items roiewed concludes that there are negligible or minor risk impacts for a number of the proposed changes to these TS requirements. A summary of the review assessments is presented in Table 5.1.

The TS changes to the STP which have negligible or minor risk impacts consist of the following:

For 6 systems, a 7-day AOT has negligible to minor risk impacts. For these systems, the STP submittal requested a change in AOT to 10 days from the current limit of 3 days. For one of these systems, carrying out a cross-train check of a redundant train along with the recommended AOT change will result in minimal risk impacts. Another request of AOT change from I hour to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months will also have negligible to minor risk impacts. In 2 systems, the requested AOT changes (one request from 3 to 10 days, and another from 7 to 10 days) will not have negligible to minor risk impacts.

Requested STI changes involved three types: from 31 days to 92 days, from 61 days to 92 days, and from 92 days to 184 days. The STI changes in general will have negligible to minor risk impacts with the condition that staggered testing is used when STI is being increased to 184 days (or 6 months).

Table 5.1. Summary of the Technical Review Conclus:ons for Proposed Changes to the STP TSs Technical Redew System Proposed TS Change Conclusion Chemical and Volume Control (CVCS)

AOT AOT (i.e., Charging Pumps) 3 - 10 days 3 -. 7 days Reactor Protection (RPS)

STI STI i

2 mo - 3 mo 2 mo -. 3 mo Engineered Safeguard Features STI STI Actuation (ESFAS) 2 mo -. 3 mo 2 mo - 3 mo Accumulators (ACC)

AOT AOT 1 hr - 12 hrs I hr - 12 hr Emergency Core Cooling (ECCS)

AOT AOT 3 -.10 days 3 -. 7 days (with cross-train check)

Residual Heat Removal (RHR)

AOT AOT 3 - 10 days 3 - 7 days STI STI 3 mo - 6 mo 3 mo - 6 mo (staggered testing)

Containment Spray (CS)

AOT AOT 3 - 10 days 3 - 7 days STI STI 3 mo - 6 mo 3 mo - 6 mo (staggered testing)

Reactor Containment Fan Coolers AOT AOT (RCFC) 3 -.10 days 3 - 7 days STI STI 1 mo - 3 mo I mo - 3 mo Component Cooling Water (CCW)

AOT AOT 3 - 10 days 3 -. 7 days Control Room HVAC AOT AOT 7 -.10 days 7 days (1st Train)

(1st Train) 24 -. 72 hrs 24 -. 72 hrs (2nd Train)

(2nd Train)

STI STI I mo - 3 mo i mo - 3 mo Essential Chilled Water (ECW)

AOT AOT 3 -.10 days 3 days 26

REFERENCES 1.

Houston Lighting & Power, " Proposed Amendment to the Unit I and Unit 2 Technical Speci6 cations Based on Probabilistic Analyses," Document ST HL AE 3283, February 1,1990.

2.

Pickard, Lowe and Garrick,Inc.," South Texas Project Probabilistic Safety Assessment,' PLG-0675, May 1989.

3.

Wheeler, T. A., Darby, J. L, Lambright, J. A. "A Review of the South Texas Project Probabilistic Safety Analysis for Accident Frequency Estimates and Containment Binning," NUREG/CR-5606, August 1991.

4.

Pickard,1 ewe and Garrick, Inc.,'RISKMAN 3 Computer Code User Manual," Revision O/VM, PLG-0644, PLG Inc., Newport Beach, CA, August 1988.

5.

Houston Lighting & Power Company," South Texas Project Electric Generating Station Level 2 Probabilistic Safety Assessment and Individual Plant Examination," Document ST HL-AE-4193, August 1992.

6.

Houston Lighting & Power," Response to Request for Additional Information Regarding Resiew of the Proposed Changes to the South Texas Project Technical Specifications," Document ST-HL-AE-4261, November 11,1992.

7.

Houston Lighting and Power," Response to Request for AdditionalInformation Regarding Resiew of the Proposed Changes to the South Texas Project Technical Specifications," Document ST HL-AE-4544, August 16,1993.

8.

Letter from Lawrence E. Kokajko to William Cottle, " Request for Additional Information Regarding Review of the Proposed Changes to the South Texas Project Technical Specifications,"

U.S. Nuclear Regulatory Commission, May 19,1993.

9.

G. Martinez and P. Samanta, " Technical Analyses of the Proposed Changes to the South Texas Project (STP) Technical Specifications," Letter Report, Brookhaven National Laboratory, May 1993.

10.

Houston Lighting & Power, " Additional Information in Support of the Proposed Changes to the South Texas Project Technical Specifications," Document ST HL AE-4620, November 5,1993.

11.

P. K. Samanta, S. M. Wong, and J. Carbonaro, " Evaluation of Risk Associated with AOT and STI Requirements at the ANO 1 Nuclear Power Plant," NUREG/CR-5200, BNL-NUREG 52024, August 1988.

12.

W. E. Vesely, " Evaluation of Allowed Outage Times from a Risk and Reliability Standpoint,"

NUREG/CR 5425, BNL-NUREG 52213, August 1989.

13.

P. K. Samanta, W. E. Vesely, I. S. Kim,' Study of Operational Risk Based Configuration Control,"

NUREG/CR-5641, BNL NUREG 52261, August 1991.

27

i

?*

j 14.

D. Wagner, W. E. Vesely, and L A. Minton," Risk Based Evaluation of Technical Speci6 cations,"

EPRI NP 4317, Electric Power Research Institute, March 1987.

t i

q 15.

T. Mankamo and P. Samanta, Draft IAEA TECDOC," Risk Based Application of Nuclear Power i

Plant Technical Specification improvements," International Atomic Energy Agency, Vienna,

- Austria, September 1992.

16.

1. S. Kim, S. Martorell, W. E. Vesely, and P. K. Samanta, " Quantitative Evaluation of Surveillance Test Intervals including Test Caused Risks," NUREG/CR 5775, BNL-NUREG 522%, February 1992.

17, Pickard, Lowe and Garrick, Inc., *RISKMAN, PRA Workstation Software," Release 3.0.

(Proprietary),1992, 18.

U.S. Nuclear Regulatory Commission, " Severe Accident Risks: An Assessment of Five U.S.

Nuclear Power Plants," NUREG 1150, January 1991, 19.

P. Samanta, T. Ginzburg, and W. Vesely," Consideration of Test Strategy in Defining Surveillance Test Intervals," BNL Technical Report A 3859, October 1988.

l 1

28 1

I

e APPENDIX A i

Proposed Modifications to the South Texas Project (STP) Technical Specifications I

l This appendix presents the proposed modi 0 cations to the Technical Speci0 cations, together with 1

the type of analysis provided by STP to support the modifications. The list contains 16 of the modifications proposed in their submittal: 11 of these were analyzed quantitatively and are reviewed in this report.

J i

l 4

1 4

I 1

i

)

i h

i 4

)

l 2

A1

Propowd Modifications to the Technical Specifications System Propowd Modifications Type of Analysis AOT (Days)

STI (Days)

Chemical and Volume Control 3 - > 10 N/C*

System, Core Damage (i.e., Charging Pumps)

Reactor Protection N/C 62 -- > 92 System, Core Damage Engineered Safeguard Features N/C 62 - > 92 System, Core Damage Actuation Pressurizer Safety Valves 15 min --> I hr N/C Qualitative Accumulators I hr -/ 12 hrs N/C System Emergency Core Cooling 3 -- > 10 N/C System, Core Damage

{

Residual Heat Removal 3 -- > 10 92 - > 184 System, Core Damage Containment Ventilation N/C 31 -> 92 Qualitative Containment Spray 3->

10 92 -- > 184 System, Core Damage, Release Frequency Reactor Containment Fan Coolers 3->

10 31 -- > 92 System, Core Damage, Release Fm+_-:y Containment Isolation 4 hrs -- > 24 hrs N/C Qualitative Steam Generator Safety Relief 4 hrs -- > 24 hrs N/C Qualitative Valves Component Cooling water 3->

10 N/C System, Core Damage Control Room liVAC 7 d (I t),24 hr (2 t) ->

31 -> 92 System, Core Damage 10 d (I t),72 hr (2 t)**

A Proposed Modifications to the Technical Specifiestions (Cont'd) t System Proposed Modifications Type of Analysis l

AOT (Days)

STI (Days)

Electrical Auxiliary Building N/C 12 hrs --> 24 hrs Qualitative IIVAC 4

Essential Chilled Water 3->

10 N/C System, Core Damage l

Notes:

N/C means No Change Requested j

(I t) = First inoperable Train

~

>c.

(2 t) = Second Train of Three 4

L I

i

+

I l

i

APPENDIX B l

Resiew Analyses of Individual Technical Specification Changes This appendix presents a summary of the detailed analyses for each of the requested TS changes.

These detailed analyses are used in support of the categorization presented in Chapter 4 of the main report.

i l

l

(

i l

l l

l B-1

l o

l l

Name of System Chemical Volume and Control System (CVCS)

Technical Specification 3.1.2.4 I

Item Description Comments Modification Requested AOT: 3 days to 10 days Type of System Core integrity i

System Unavailability There is consistency between the type of system Level of Evaluation

CDF and the level of evaluation Impact on mean CDF Provided Conditional CDF given the LCO (CCDF)

Provided Risk Measures Reviewed (one train of the CVCS is out of service) m Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDF provided 4

(increase in CDP contribution over an AOT) 1 Modelling of TS AOT: Repair distribution for proposed AOT.

Uses subjectivejudgment to define the Parameters in the Risk distribution.

Model

b Name of System Chemical Volume and Control System (CVCS)

Technical Specification 3.1.2.4 Item Description Comments System Unavailability: 2.8%

Uses Monte Carlo simulation. Use of Latin Ilypercube sampling will provide slightly higher increase.

CDF: ~ 0%

The calculated negative impact is due to PSA Impact of Modification modeling assumptions. The increase in mean at Level of Evaluation CDF due to AOT changes is judged to be small.

CCDF : 4.4 X 10rs impact Negligible (Factor increase from base case = 1.0)

~

SAOTR: ~0 The single AOT risk contribution is small.

toe Overall Comments

AOT: There is a negligible impact to risk due to the proposed change.

4 Name of System Reactor Protection System Technical Specification 4.3.1 Item Description Comments Modification Requested STI (62 to 92 days)

Type of System Core integrity Reactor Trip Breakers have only two trains: S and R i

System unavailability (SU)

There is consistency between the type of system and Level of Evaluation

CDF the level of evaluation Individual component Change of test interval for relays not incorporated in unavailability model the model. However, this is not expected to Modelling of Relevant Element (s) significantly alter the results obtained.

in PRA Model Common cause failure Impact of STI change on common cause failure

[

contribution contribution is included in STP analysis.

STI:

Demand versus standby Assumes only standby time related failures. Valid, Modell.ing of TS Parameters in time related failure conservative assumption when lacking any data to the Risk Model contribution (f, = 1.0) justify such data partition.

Impact of Modification at Level System unavailability: 45.8%

System unavailability impact is not negligible.

of Evaluation CDF: 0.6%

Negligible Impact Overall Comments

STI:

The impact of the change is considered negligible.

i l

O t

l s

Name of System Engineered Safety Features Actuation System (ESFAS)

Technical Specification 4.3.2 Item Description Comments Modification Requested STI:

62 to 92 days Type of System Core integrity Three symmetrical trains f

Level of Evaluation

System Unavailability (SU)

There is consistency between the type of system and

CDF the level of evaluation j

Modelling of Relevant Element (s)

Common cause failure Impact of change of STI on common cause failure in PRA Model contribution contribution is included in STP analysis.

STI:

Demand versus standby STI:

Assumes only standby time related failures.

el n o S { ammeters in time related failure Valid, conservative assumption when lacking p

tp contribution (f, = 1.0) any data to justify such data partition.

u Impact of Modification at Level System Unavailability: 20.4%

System unavailability impact is considered small.

of Evaluation CDF: 0.1 %

Negligible impact.

Overall Comments

STI: The impact of the change is considered negligible.

b t

I 4

A Name of System Accumulators Technical Specification 3.5.1 Item Description Comments Modification Requested AOT: I hour to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Type of System Core integrity

System Unavailability

The unavailability is not quantified in the base case PSA.

Level of Evaluation

For the TS submittal, a system unavailability calculation was provided l

The system has not been incorporated in the event trees i

Additional Risk Measures

"" E'

^

"E ** "*E

E*#

cp accumulators on CDF cannot be quantified.

Modelling of TS Parameters in A OT: Full duration of AOT is A OT: Conservative but valid assumption.

the Risk Model used System Unavailability: 24.7%

Increase in system unavailability is considered Impact of Modification at Izvel small.

of Evaluation

The impact on CDP was judged to be negligible.

Overall Comments

AOT: Even though there is no evaluation at CDF level, the proposed change is not expected to significantly increase the risk of the plant.

M WMV l

i A

Name of System Emergency Core Cooling (ECC)

Technical Specification 3.5.2 I

Item Description Comments t

Modification Requested A OT: 3 days to 10 days Type of System Core integrity l

Level of Evaluation ys em na a

y ere c ns s eng wem type of l

CDF system and the level of evaluation Impact on mean CDF Provided Conditional CDF given the LCO (CCDF)

Provided Risk Measures Reviewed (one train of the ECC is out of service)

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDF provided i

{

(increase in CDP contribution over an AOT)

Modelling of TS AOT: Repair distribution for proposed A OT: Uses subjective judgment to define the Parameters in the Risk AOT.

distribution.

Model System Unavailability: 11.2%

Uses Monte Carlo simulation. Use of Litin flypercube sampling will provide slightly higher mcrease.

CDF: 3.3%

The increase in mean CDF due to AOT changes Impact of Modification is not necessarily negligible.

at Level of Evaluation CCDF: 1.15 x 10d Impact not necessarily negligible (Factor increase from base case = 2.5)

SAOTR: 3.15 x 104 (evaluated at 10 days)

The single AOT risk contribution is not necessarily negligible

1 l

6 4

l

.e lb ig i

l s

g tn e

e n

m y

l m

ir o

a C

ssec

)

e C

n C

t E

o

(

n g

s i

n e

i lo gn o

a C

2 hc e

5 r

d o

3 e

l C

so y

p c

o r

n p

eg e

r h

e t

m o

t E

eu d

n k

o s

i i

t r

p n

ir i

cs e

e sa D

e rcn i

e hT

TOA no i

ta s

c t

i n

m f

e i

e c

m m

t e

s p

e m

t y

S I

S oC l

f a

o c

l i

l e

n a

m h

r c

e a

e v

N T

O l

=

r Name of System Residual IIeat Removal System (RIIR)

Technical Specification 3/4.5.6 Item Description Comments AOT: 3 days to 10 days Modification Requested STI: 92 to 184 days Change of STI to 184 days implies a relatively long period of time without testing.

Type of System Core integrity This system has three trains

System unavailability (SU)

There is consistency between the type of

CDF system and the level of evaluation 12 vel of Evaluation

A more complete evaluation would require a shutdown PSA.

g Impact on mean CDF Provided Individual impact of AOT on CDF Separate impact of AOT on system unavailability is presented. However, the separate impact of AOT on CDF is not presented.

Individual impact of STI on CDF Separate impact of STI on system unavailability is presented. However, the separate impact of Risk Measures Reviewed STI on CDF is not presented.

Conditional CDF given the LCO (CCDF)

Provided (one train of the RHR is out of service)

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDF provided (increase in CDP contribution over an AOT)

Change in average unavailability of a RHR Estimated from the STP PSA data.

train (AT/2) due to STI change.

s Name of System Residual lleat Removal System (RHR)

Technical Specification 3/4.5.6 Item Description Comments Modelling of Relevant Common cause failure contribution Impact of change of STI on common-cause Element (s) in PRA failure contribution is included in STP analysis.

Model A OT: Repair distribution for proposed AOT.

Uses subjective judgment to define the Modelling of TS distribution.

Parameters in the Risk STI: Demand versus standby time related Assumes only standby time related failures.

Model failure contribution (f, = 1.0)

Valid, conservative assumption when lacking any data to justify such data partition.

m System unavailability: 3.1 %

Uses Monte Car!c, Simulation. Use of Latin g

Hypercube sampling will provide slightly higher increase.

CDF: 0.1 %

Negligible impact Separate impact of STI (SU): ~ 4%

No evaluation at CDF level Separate impact of AOT (SU): - 0%

No evaluation at CDF level ve fE i

CCDF: 5.52 x 10-5 Negligible impact (Factor increase from base case = 1.2)

SAOTR: 1.51 x 104 (evaluated at 10 days)

Negligible impact Change in average unavailability (AT/2) :

The new AT/2 is not very large, but staggered From 9.62 x 10' to 2.02 x 10 2 testing is recommended.

I

Name of System Residual IIcat Removal System (RIIR) l l

Technical Specification 3/4.5.6 i

Item Description Comments

Both changes:

There is a negligible impact to risk due to the proposed changes.

Overall Comments Ilowever, since the change of STI to 184 days implies a relatively long period of time without testing and can affect the assumptions in the PSA, staggered testing is recommended.

+

Name of System Containment Spray Technical Specification 3/4.6.2.1 I

Item Description Comments A OT: 3 days to 10 days Modification Requested STI:

92 to 184 days Change of STI to 184 days implies a relatively long period of time without testing Type of System Containment integrity

System Unavailability (SU)

There is consistency between the type of Level of Evaluation

CDF system and the level of evaluation

LERF i

Impact on mean CDF Provided tn Individual impact of AOT on CDF Separate impact of AOT on system unavailability is presented. However, the separate impact of AOT on CDF is not presented.

Individual impact of STI on CDF Separate impact of STI on system unavailability is presented. However, the separate impact of Risk Measures Reviewed STI on CDF is not presented.

Conditional CDF given the LCO (CCDF)

Provided. However, a conditional evaluation at (one train of the Cont. Spray is out of containment level given a train of Containment service)

Spray is out of service is not provided.

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDP provided (increase in CDP contribution over an AOT)

Impact on mean LERF

LERF addresses impact at containment level.

Name of System Containment Spray Technical Specification 3/4.6.2.1 Item Description Comments Modelling of Relevant Common cause failure contribution Impact of change of STI on common cause Element (s) in PRA failure contribution is included.

Model A OT: Repair distribution for proposed Uses subjective judgment to define the AOT.

distribution Modelling of TS Parameters in the Risk STI:

Demand versus standby time related Assumes only standby time related failures.

Model failure contribution (f, = 1.0)

Valid, conservative assumption when lacking any data to justify such data partition.

System Unavailability: 46%

Uses Monte Carlo Simulation. Use of Latin E

Ilypercube sampling will provide slightly higher increase.

CDF: 0.0%

Negligible impact Separate impact of STI (SU): ~ 40%

No evaluation at CDF or LERF level Impact of Modification at Izvel of Evaluation Separate impact of AOT (SU) : - 0%

No evaluation at CDF or LERF level CCDF: 4.4 x 104 Negligible impact (Factor increase from base case = 1.0)

SAOTR: 0 Negligib!e impact LERF: 0%

Negligible impact i

I L

E 4

Name of System Containment Spray Technical Specification 3/4.6.2.1 Item Description Comment

Both changes:

There is a negligible impact to risk due to the proposed changes.

Overall Comments Ilowever, since the change of STi to 184 days implies a relatively long period of time without testing and can affect the assumptions in the PSA, staggered testing is recommended.

I

Name of System Reactor Containment Fan Coolers (RCFC)

Technical Specification 3/4.6.2.3 Item Description Comments A OT: 3 days to 10 days Modification Requested STI:

31 to 92 days Type of System Core and Containment integrity

System Unavailability (SU)

There is consistency between the type of Ixvel of Evaluation

CDF system and the level of evaluation

LERF Impact on mean CDF Provided Individual impact of AOT on CDF Separate impact of AOT on system unavailability eg is presented. However, the separate impact of AOT on CDF is not presented.

Individual impact of STI on CDF Separate impact of STI on system unavailability is presented. However, the separate impact of Risk Measures Reviewed STI on CDF is not presented.

Conditional CDF given the LCO (CCDF)

Provided. However, a conditional evaluation at (one train of the RCFC is out of service) containment level given a train of RCFC is out of service is not provided.

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDF provided (increase in CDP contribution over an AOT)

Impact on mean LERF LERF addresses impact at containment level.

s

(

)

Name of System Reactor Containment Fan Coolers (RCFC)

Technical Specification 3/4.6.2.3 Item Description Comments Modelling of Relevant Common cause failure contribution Impact of chan;;e of STI on common cause Element (s) in PRA failure contribution is included.

Model A OT: Repair distribution for proposed Uses subjective judgment to define the AOT.

distribution Modelling of TS Parameters in the Risk STI:

Demand versus standby time related Assumes only standby time related failures.

Model failure contribution (f, = 1.0)

Valid, conservative assumption when lacking any data to justify such data partition.

System Unavailability: 568.5%

The change in SU is large but does not affect g

CDF or LERF.

Uses Monte Carlo Simulation. Use of Latin Hypercube sampling will provide slightly higher increase.

CDF: 0.0%

Negligible impact Impact of Modification Separate impact of STI (SU): ~ 543%

No evaluation at CDF or LERF level at Level of Evaluation Separate impact of AOT (SU) : ~ 0%

No evaluation at CDF or LERF level 4

CCDF: 4.4 x 10 Negligible impact (Factor increase from base case = 1.0)

SAOTR: 0 Negligible impact LERF: 0.3%

Negligible impact Overail Comments

Both changes:

There is a negligible impact to risk due to the proposed changes.

hj i

6 Name of System Component Cooling Water (CCW)

Technical Specification 3.7.3 Item Description Comments Modification Requested AOT: 3 days to 10 days Type of System Core integrity

Initiating Event

There is consistency between the type of system and Level of Evaluation

System Unavailability the level of evaluation

CDF Impact on mean CDF Provided Conditional CDF given the LCO Provided (CCDF) (one train of the CCW is out Risk Measures Reviewed of service)

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDF provided

.(increase in CDP contribution over an AOT)

Modelling of TS AOT: Repair distribution for proposed Uses subjectivejudgment to defm' e the distribution.

Parameters in the Risk AOT.

Model t

a

o

+

)

Name of System Component Cooling Water (CCW)

Technical Specification 3.7.3 Item Description Comments Initiating Event: 156 %

Initiating Event and System Unavailability: Use Monte System Unavailability: 13%

Carlo simulation. Use of Latin Hypercube sampling will provide slightly higher increase.

CDF: - 3.5%

This increase is not necessarily negligible. However, following a telephonic communication with STP staff, we were told that this calculation include dependencies which are not applicable to the STP plant. CCDF was Impact of Modification calculated eliminating these dependencies from the PSA at Level of Evaluation model. CCDF shows no change from the base case CDF. This implies that the impact on mean CDF will tp be negligible when the dependencies in the PSA model e

are corrected.

CCDF: 4.4 x 10 5 Negligible Impact.

(Factor increase from base case = 1.0)

SAOTR: 0 T'le single AOT risk contribution is negligible.

Overall Comments

AOT: The increase in risk due to the proposed change is negligible.

A

?

k.

3 Name of System Control Room IIcating, Ventilating, and Air Conditioning (CR IIVAC)

Technical Specification 3/4.7.7 Item Description Comments AOT': 7 days (1 t),24 hr (2 t) to 10 days (1 Modification Requested t),72 hr (2 t)

STI:

31 to 92 days Type of System Core integrity

Initiating Event

There is consistency between the type of Level of Evaluat. ion

CDF system and the level of evaluation Impact on mean CDF Provided Individual impact of AOT on CDF Separate impact of AOT on the initiating event is 2

presented. However, the separate impact of AOT on CDF is not presented.

Individual impact of STI on CDF Separate impact of STI on the initiating event is Risk Measures Reviewed presented. However, the separate impact of STI on CDF is not presented.

Conditional CDF given the LCO (CCDF)

Provided (one train of the CR HVAC is out of service)

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDP provided (increase in CDP contribution over an AOT)

(1 t) = first inoperable train (2 t) = second train of three

~

1)

Name of System Control Room IIcating, Ventilating, and Air Conditioning (CR IIVAC)

Technical Specification 3/4.7.7 Item Description Comments Modelling of Relevant Common cause failure contribution Impact of change of STI on common cause Element (s) in PRA failure contribution is included.

Model A OT: Repair distribution for proposed Uses subjective judgment to define the AOT.

distribution Modelling of TS Parameters in the Risk STI:

Demand versus standby time related Assumes only standby time related failures.

Model failure contribution (f, = 1.0)

Valid, conservative assumption when lacking any data to justify such data partition.

Initiating Event: 132 %

Uses Monte Carlo Simulation. Use of 12 tin Hypercube sampling will provide slightly higher increase.

CDF: 3%

Impact not necessarily negligible.

Impact of Modification Separate impact of STI (IE): - 6.3%

No evaluation at CDF level at Level of Evaluation Separate impact of AOT only: ~ 132%

No evaluation at CDF level 4

CCDF: 7.4 x 10 Impact not necessarily negligible.

(Factor increase from base case = 1.6)

SAOTR: 2.0 x 104 Impact not necessarily negligible.

The risk increase is almost entirely due to the change of AOT.

Overall Comments

AOT: The impact to risk is not necessarily negligible.

STI: The impact to risk is negligible.

1 h

Name of System Essential Chilled Water (ECIO Technical Specification 3.7.14 Item Description Comments Modification Requested A OT: 3 days to 10 days Type of System Core integrity

Initiating Event

There is consistency between the type of Level of Evaluation

System Unavailability system and the level of evaluation

CDF

The CDF impact including the effect of an initiating event is considered applicable.

Impact on mean CDF Provided Conditional CDF given the LCO (CCDF)

Provided Risk Measures Reviewed (one train of the ECII is out of service)

Single AOT risk contribution (SAOTR)

Calculated by BNL from the CCDP provided -

(increase in CDP contribution over an AOT)

Modelling of TS A OT: Repair distribution for proposed Uses subjectivejudgment to define the Parameters in the Risk AOT.

distribution.

Model

- _ _ - - - _ - - _ - _ _ - - - _ _ _ - - - - - _ _ _ - - - - - _ - - _ - _ - _ - - _ - _ - _ _ -------------------------j Name of System Essential Chilled Water (ECII)

Technical Specification 3.7.14 Item Description Comments I

Initiating Event: -13.2%

Initiating Event and System Unavailability: Use

System Unavailability: 95.3%

Monte Carlo simulation. Use of I.atin Hypercube sampling will provide slightly higher increase.

Impact of Modification CDF: 6.5% (10% when assumption is

This increase is not necessarily negligible.

at Level of Evaluation relaxed).

Impact on initiating event is included.

CCDF: 1.3 x 10' Impact is not necessarily negligible.

(Factor increase from base case = 2.8)

SAOTR: 3.5 x 10-8 The single AOT risk contribution is not tp necessarily negligible Is Overall Comments

AOT: The impact to risk due to the proposed change is not necessarily negligible.

I/

l l

APPENDIX C i

l IJst of Specific itene Requested As Additional Information During the review, technical analyses of the STP submittalidentified specific issues to be addressed and additional evaluations that are to be performed in support of the proposed changes. This appendix summarizes the items in the request for additional information (Letter from L Kokajko to W. Cottle, May 1993). The revised STP submittal, dated August 1993, addresses these items.

C-1

I/

ENCLOSURE A Recuest for Additional Information on the Review of the EroDosed Channes to the South Texas Proiect (STP)

Technical Specification (TS) 1.

For the requested technical specifications (TS) modifications such as the allowed outage times (AOTs) and surveillance intervals (STIs), present the reason for seeking the changes.

Also, describe how the changed ACT is planned to be used (for planned or preventive maintenance only, for unplanned or unscheduled maintenance only, or for both).

Discuss how these aspects are modeled or accounted for in assessing the impact of changing AOTs on the overall core damage frequency (CDF).

2.

Provide a list of basic input parameters for the components for which AOT and STI modifications are being requested.

This list should include the following:

A.

Failure rate of important components in the train B.

Maintenance frequency of a train (planned and unscheduled)

C.

Mean maintenance duration (based on plant-specific or generic)

D.

Test interval for a train E.

Human error of restoration in test / maintenance (if included)

F.

Demand failure contributi..n (if used)

G.

Common cause failure 0".iameter modeled H.

Total Train unavailability Indicate the parameters changed for each TS change and changed values used for calculating the impact of the TS change.

Also, indicate which of the parameters. include plant-specific data and where generic data are used' including their applicabilities.

When plant-specific data are used, please provide a summary of the data base and the method used to derive parameters for use in the analysis.

3.

Provide a hard copy of the fault trees used in the evaluations of the TS changes.

4.

Provide a requantification of the base case mean CDF and increases in the mean CDF for each of the TS changes using the model provided to the staff, i.e., the IPE (PC) model on which the revised TS change submittal is now being based.

Also, provide the relative contribution of the dominant initiating event (IE) categories (including LOCAs) to the mean CDF for all the cases quantified.

5.

Provide individual evaluations (both individual and combined C.2

l 2

l total evaluations) of the impact of ACT and STI changes, l

when changes in both the AOT and the STI for a particular system are being requested.

For example, both AOT and STI i

are requested to be modified for the RHR system, but only the total impact for this system is provided.

Along with this total impact, the impact of changing the AOT and STI for the RHR system should be provided individually.

6.

Provide an evaluation of the total CDF impact of (a) all the proptsed AOT changes, (b) all the proposed STI changes, and (c) all the proposed AOT and STI changes.

For these total evaluations, also provide the relative contribution of the dominant event categories.

7.

For the proposed changes that affect IEs, provide a list of TS. changes and the corresponding IEs that are affected.

8.

Provide conditional CDF calculations to facilitate the evaluation of risks (for all applicable modes) due to a single train AOT and surveillance tests (STs).

These calculations include:

(a)

The conditional CDF given that one (or two) train for which the AOT is being changed, is in LCO condition, i.e.,

unavailable (or inoperable).

In otherwords, the CDF when the train unavailability is equal to one.

(b)

The conditional CDFs when one (or two) train is available (i.e., unavailability is zero) and when one (or two) train is unavailable (i.e.,

unavailability is equal to one).

These measures are calculated in RISKMAN code package as part of determining risk achievement worths and risk reduction worths.

These conditional CDFs may be different from (a) above, because in (a) any realignment for maintenance.of,the component may be included.

9.

For all cases of risk quantifications performed (i.e.,

base case, effect of changing AOTs and STIs, conditional CDFs, etc.,), provide the probability (frequency) cutoff values used.

10.

Provide a discussion related to the " Rolling Maintenance Program (RMP)" that has be.en developed and implemented by the licensee.

This should include:

(a)

The schedule profile and personnel profile of the RMP that incorporates the AOTs and STIs of all TS-related trains including the proposed TS changes requested (b)

A discussion on how the RMP is incorporated into the base case IPE model C-3

p.

3 (c)

The CDF risk profile of the RMP over the 13 calendar week period in a calendar quarter (d)

The overall change in current CDF estimate due to the RMP implementation over this 13 calendar week period 11.

Provide an assessment of simultaneous outages of multiple trains (two or three' trains), if any, during plant operation due to the' implementation-of the RMP (e.g.,

overlapping of one train AOT from one week into another train AoT during the next week).

Due to the extension of many single train AOTs from 3 days to 10 days, as requested in the TS change submittal, and since a RMP schedule may allow any one train to be unavailable for a maximum of one week (seven calendar days), there are possibilities for simultaneous outages of two trains that could have a large risk impact.

The

~

estimate of the impact of such simultaneous outages of multiple trains should include identification of possible overlapping of multiple trains of a same system during any given day.

Indirect overlapping of three train LCO'during.

any given day is absolutely prohibited.

12.

Provide a list of major issues selected for sensitivity analyses that are performed as part of determining the overall CDF_ impact of all changes to the current version of the TS.

Also,-provide such sensitivity analyses and their results.

13.

Considering all the TS changes (including the implementation of the RMP) being proposed, estimate the uncertainty in the i

overall CDF for the plant.

This implies only one l

calculation that takes into account all the TS changes, and not uncertainty calculation for each of the TS change. cases.

l This calculation should take into account a sufficient number of cutsets to obtain an appropriate measure,of the l

uncertainty ranges.

A discussion should be provided on the l

effect on the estimation due to the elimination of non-dominant sequences and the corresponding cut sets which may account for as much as 20% of the mean CDP.

l I

C4 e,,.,

4m..

lk Table 1: Summary of Approved Technical Specification Changes o

Current Technical Approved Technical CDF Technical System Specifications Specifications Change Specification AOT STI AOT STI 3.1.2.4 Chemical & Volume Control System (CVCS) 3 days 7 days' 0.0 Charging Pumps 4.3.1 Reactor Protection 62 days 92 days 0.6 4.3.2 Engineered Safety Feature Actuation System 62 days 92 days 0.1 (ESFAS) 3.4.2.2 Pressurizer Safety Valves 15 min 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 0

3.5.1 Accumulators 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 12 hours 0.0 3.5.2 Emergency Core Cooling System (ECCS) 3 days 7 days

1.6 2

3/4.5.6 Residual Heat Removal (RHR) 3 days 92 days 7 days 184 days' O.0 3/4.6.2.1 Containment Spray 3 days 92 days 7 days' 184 days' O.0 3/4.6.2.3 Reactor Containment Fan Cooler (RCFCl 3 days 31 days 7 days' 92 days 0.0 3.6.3 Containment isolation 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 24 hours Q

3.7.1.1 Steam Generator Safety Relief Valves 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months 24 hours 0

3.7.3 Component Cooling Water (CCW) 3 days 7 days' 1.9 3/4.7.7 Control Room Heating, Ventilation, and Air 7 days 31 7 days' 92 days 1.6 Conditioning (CR-HVAC) 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ' 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ' Area Temperature Monitoring 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 24 hours Q

4.7.13 N

~

1.

The estimate of the percentage increase in the average annual core damage frequency, based on proportionality analysis using the impact of TS changes on system unavailability and initiating event frequency. No separate quantitative evaluation at the CDF level was performed. O designates those changes approved on a qualitative basis.

2.

The licensee originally requested 10-day AOTs, whicl' were subsequently reduced to 7-day AOTs to minimize overlapping.

3.

With a cross-train operability check every 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

4 With staggered testing. These relaxations constitute: relief to the ASME Boiler and Pressure Vessel Code.

5.

Seven days for the first inoperable train, and 72 hot rs for the second of three trains in Modes 1 to 4.

ML20067D184

Contents

Text

1.0 INTRODUCTION

SUMMARY

Background

3.0 STATE CONSULTATION

4.0 ENVIRONMENTAL CONSIDERATION

5.0 CONCLUSION

1.0 Background

3.0 Evaluation Findings

1.0 Background

3.0 Evaluation Findings

SUMMARY

SUMMARY

Navigation menu

ML20067D184

Text

1.0 INTRODUCTION

SUMMARY

Background

3.0 STATE CONSULTATION

4.0 ENVIRONMENTAL CONSIDERATION

5.0 CONCLUSION

1.0 Background

3.0 Evaluation Findings

1.0 Background

3.0 Evaluation Findings

SUMMARY

SUMMARY

Navigation menu

Search