ML20079K424
| ML20079K424 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 03/19/2020 |
| From: | Mark D. Sartain Dominion Energy Nuclear Connecticut |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| 20-070 | |
| Download: ML20079K424 (21) | |
Text
Dominion Energy Nuclear Connecticut, Inc.
5000 Dominion Boulevard, Glen Allen, VA 23060 Dominion Energy.com March 19, 2020 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555 DOMINION ENERGY NUCLEAR CONNECTICUT, INC.
MILLSTONE POWER STATION UNIT 2
!ii; Dominion
- iiii" Energy Serial No.
NRA/SS Docket No.
License No.20-070 RO 50-336 DPR-65 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION FOR LICENSE AMENDMENT REQUEST TO REVISE TS 3.8.1.1, "A.C. SOURCES - OPERATING,"
TO SUPPORT MAINTENANCE AND REPLACEMENT OF THE MILLSTONE UNIT 3
'A' RESERVE STATION SERVICE TRANSFORMER AND 345 KV SOUTH BUS SWITCHYARD COMPONENTS By letter dated August 17, 2019 (ADAMS Accession No. ML19234A111), and supplemented by letter dated October 22, 2019 (ADAMS Accession No. ML19304A294), Dominion Energy Nuclear Connecticut, Inc. (DENC) submitted a license amendment request (LAR) to revise Millstone Power Station Unit 2 (MPS2)
Technical Specifications (TS). The LAR proposes to revise TS 3.8.1.1, "A.C. Sources -
Operating," to add a new Required Action a.3 that provides an option to extend the allowed outage time (AOT) from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 10 days for one inoperable offsite circuit.
The LAR also proposes a one-time allowance to the new proposed Required Action a.3 that extends the AOT to 35 days for one inoperable offsite circuit. This one-time allowance is needed for replacement of the Millstone Power Station Unit 3 (MPS3) 'A' reserve station service transformer, its associated equipment, and other 345 kV south bus switchyard components that are nearing the end of their dependable service life.
The LAR includes a risk-informed request for the proposed permanent 10-day and one time 35-day extension following the guidance in Regulatory Guide 1.177, Revision 1.
In an email dated February 13, 2020, the Nuclear Regulatory Commission (NRC) issued a draft request for additional information (RAI) related to the proposed changes to TS 3.8.1.1. The draft RAI was initially provided via e-mail dated December 23, 2019 (ADAMS Accession No. ML19361A038) in support of the NRC staff's audit using an online reference portal (as requested on January 21, 2020, ADAMS Accession No. ML20028C195). On February 6, 2020, the NRC staff conducted a conference call with the licensee staff to clarify the request. On February 17, DENC agreed to respond to the RAI by March 20, 2020. In an email dated February 19, 2020, the NRC transmitted the final version of the RAI.
The attachment provides DENC's response to the RAI.
Serial No: 20-070 Docket No. 50-336 Page 2 of 3 Should you have any questions in regard to this submittal, please contact Shayan Sinha at (804) 273-4687.
Sincerely,
-
Mark D. Sartain Vice President - Nuclear Engineering & Fleet Support COMMONWEAL TH OF VIRGINIA COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Mark D. Sartain, who is Vice President - Nuclear Engineering and Fleet Support of Dominion Energy Nuclear Connecticut, Inc. He has affirmed before me that he is duly authorized to execute and file the foregoing document in behalf of that Company, and that the statem<s in the document are true to the best of his knowledge and belief.
Acknowledged before me this= day of ]'rJa.,..c.J,,, 2020.
My Commission Expires: 'YY:lo..fth 31.,. 11JZZ DIANE E. AITKEN NOTARY PUBLIC
-*-REG. #n63114 VUMMUNWEALTH OF VIRGINI\\
MY COMMISSION EXPIRES MARCH 31, 2022
Attachment:
Notary Public Response to Request for Additional Information for License Amendment Request to Revise TS 3.8.1.1, "AC. Sources -
Operating," to Support Maintenance and Replacement of the Millstone Unit 3 'A' Reserve Station Service Transformer and 345 KV South Bus Switchyard Components Commitments made in this letter: None
cc:
U.S. Nuclear Regulatory Commission Region I 2100 Renaissance Blvd, Suite 100 King of Prussia, PA 19406-2713 R. V. Guzman Senior Project Manager - Millstone Power Station U.S. Nuclear Regulatory Commission One White Flint North 11555 Rockville Pike Mail Stop 08 C2 Rockville, MD 20852-2738 NRG Senior Resident Inspector Millstone Power Station Director, Radiation Division Department of Energy and Environmental Protection 79 Elm Street Hartford, CT 06106-5127 Serial No: 20-070 Docket No. 50-336 Page 3 of 3
ATTACHMENT Serial No.20-070 Docket No. 50-336 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION FOR LICENSE AMENDMENT REQUEST TO REVISE TS 3.8.1.1, "A.C. SOURCES - OPERATING,"
TO SUPPORT MAINTENANCE AND REPLACEMENT OF THE MILLSTONE UNIT 3
'A' RESERVE STATION SERVICE TRANSFORMER AND 345 KV SOUTH BUS SWITCHYARD COMPONENTS DOMINION ENERGY NUCLEAR CONNECTICUT, INC.
MILLSTONE POWER STATION UNIT 2
Serial No.20-070 Docket No. 50-336 Attachment, Page 1 of 17 By letter dated August 17, 2019 (ADAMS Accession No. ML19234A111 ), and supplemented by letter dated October 22, 2019 (ADAMS Accession No.
ML19304A294), Dominion Energy Nuclear Connecticut, Inc. (DENG) submitted a license amendment request (LAR) to revise Millstone Power Station Unit 2 (MPS2)
Technical Specifications (TS). The LAR proposes to revise TS 3.8.1.1, "AC. Sources -
Operating," to add a new Required Action a.3 that provides an option to extend the allowed outage time (AOT) from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 10 days for one inoperable offsite circuit.
The LAR also proposes a one-time allowance to the new proposed Required Action a.3 that extends the AOT to 35 days for one inoperable offsite circuit. This one-time allowance is needed for replacement of the Millstone Power Station Unit 3 (MPS3) 'A' reserve station service transformer (RSST), its associated equipment, and other 345 kV south bus switchyard components that are nearing the end of their dependable service life.
In an email dated February 13, 2020, the Nuclear Regulatory Commission (NRC) issued a draft request for additional information (RAI) related to the proposed changes to TS 3.8.1.1. The draft RAI was initially provided via e-mail dated December 23, 2019 (ADAMS Accession No. ML19361A038) in support of the NRC staff's audit using an online reference portal (as requested on January 21, 2020, ADAMS Accession No. ML20028C195). On February 6, 2020, the NRC staff conducted a conference call with the licensee staff to clarify the request. On February 17, DENG agreed to respond to the RAI by March 20, 2020. In an email dated February 19, 2020, the NRC transmitted the final version of the RAI. This attachment provides DENC's response to the RAI.
Serial No.20-070 Docket No. 50-336 Attachment, Page 2 of 17 Regulatory Position C.2.3.2 of RG 1.177 states that the licensee should perform evaluations of core damage frequency (CDF) and large early release frequency (LERF) to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal flooding, fires, seismic events, high winds, and other external hazards) unless it can be shown the contribution from specific hazard groups does not affect the decision. In some cases, a PRA [probabilistic risk assessment] of sufficient scope may not be available. This will have to be compensated for by qualitative arguments, bounding analyses, or compensatory measures.
The licensee stated in the LAR (Attachment 1, Section 4.4.1) that the MPS2 does not have an internal fire PRA model. The licensee assessed the fire risk impact qualitatively and stated that the offsite power sources are not listed on the fire safe shutdown equipment list (SSEL), and therefore, are not considered fire safe shutdown equipment.
The licensee concluded that the conditional fire risk of unavailability [unavailable] offsite power sources associated with the LAR is considered negligible. However, the impact of fires in the transformers as well as other switchyard equipment does not appear to be considered in the assessment of the internal fire on this application. In addition, the risk management actions listed in Attachment 3 of the LAR do not include any fire watches.
Justify the exclusion of the impact of fires in the transformers and other switchyard equipment on the risk assessment supporting this application. The justification should include discussion on the lack of internal fire related risk management actions.
Otherwise, confirm that any proposed change meets the acceptance guidelines after inclusion of the relevant impacts of internal fire risk.
DENC Response to RAI 01 The MPS2 RSST is located in the MPS2 transformer yard, which is physically separated from the MPS3 'A' Normal Station Service Transformer (NSST) housed in the MPS3 transformer yard. The control panel for each transformer is located in their respective unit's control room, which are physically separated rooms. Both unit transformer yards are inside the protected area. The switchyard is located north of the protected area inside the owner-controlled area.
Therefore, a MPS2 RSST or MPS3 'A' NSST transformer or control panel fire would not impact both transformers and would also not impact any other switchyard components.
The issue of concern associated with maintaining switchyard breaker 13T closed coincident with the MPS3 'A' RSST out of service, is the loss of electrical separation between the remaining MPS2 offsite power sources (i.e., the MPS2 RSST and MPS3
'A' NSST). Consequently, if breaker 13T incurs an internal fault such that the breaker does not trip open, the fault is postulated to propagate to the MPS2 RSST and MPS3 'A' NSST rendering them both unavailable. Conversely, if breaker 13T were to trip open, electrical separation between the MPS2 offsite sources is restored.
Serial No.20-070 Docket No. 50-336 Attachment, Page 3 of 17 Based on this configuration risk perspective, a fire event is not expected to impact the 13T breaker and the MPS2 offsite sources without impacting the entire switchyard.
Thus, the primary justification for not including internal fire risk in the risk assessment is that the likelihood of a fire event only impacting the MPS2 offsite sources, but not rendering the entire switchyard unavailable, is negligible.
The following fire scenarios are postulated to impact breaker 13T and ultimately render the MPS2 RSST and MPS3 'A' NSST unavailable:
- 1. A fire that initiates within the 13T breaker causing an internal fault which propagates to the MPS2 RSST and MPS3 'A' NSST rendering them both unavailable.
NUREG/CR-6850 was used to calculate the fire frequency.
A frequency of 1.51 E-05/yr is calculated after assigning the 13T breaker to Bin 15 -
Electric Cabinets and then dividing the bin value by the number of MPS3 components assigned to the bin (Ref. Fire Ignition Frequencies, NOTEBK-PRA MPS3-FA.2). Since this value is two orders of magnitude lower than the random breaker internal fault value of 4.23E-03/yr or 4.83E-07/hr used in the increased loss of offsite power (LOOP) frequency (or LlLOOPGR) calculation, the 13T breaker fire scenario is considered a negligible contributor.
- 2. A fire that impacts the ability of the 13T breaker to perform its active function to maintain electrical separation of the MPS2 offsite sources. This could occur either due to a fire initiated in any one of the components (i.e., switchyard breakers or MPS2 RSST) directly tied to the North Bus or a fire initiated in the MPS3 'A' NSST. In both cases, the fire would disable one of the two MPS2 offsite sources and challenge the 13T breaker to perform its active function to protect the remaining MPS2 offsite source.
If that fire also impacts the 13T breaker trip circuitry such that the breaker fails to open, both MPS2 offsite sources would be rendered unavailable.
Per MPS2 Final Safety Analysis Report (FSAR) Section 8.1.1.4 and MPS3 FSAR Section 8.1.3, the switchyard breakers are equipped with two independent protection systems (primary and backup). The cabling for each system, with limited exceptions, is separated to minimize the chance for both systems to be affected by a single event.
Thus, based on the physical separation of the switchyard breakers and their redundant protection systems, the likelihood of a fire initiated by a switchyard component that also impacts both 13T breaker protection systems is negligible.
However, both protection systems are contained in the single switchyard control house as many panels have primary and backup wiring in them. A conservative bounding analysis was performed to estimate the risk of a control house fire causing the scenario described above. The estimate is based on a fire ignition frequency calculation performed for the entire Millstone switchyard using generic frequencies provided in NUREG/CR-6850.
A calculated value of 1.63E-03/yr (Ref. Fire Ignition Frequencies, NOTEBK-PRA-MPS3-FA.2) includes all the
Serial No.20-070 Docket No. 50-336 Attachment, Page 4 of 17 components within the switchyard (i.e., not just the components within the control house) and considers fixed and transient sources. Consequently, since the value calculated for the entire switchyard remains sufficiently below the random breaker internal fault value of 4.23E-03/yr used in the LiLOOPGR calculation, the fire risk associated with a control house fire that only renders the MPS2 offsite sources unavailable is considered a negligible contributor.
RAI 02 (High Winds Risk)
Serial No.20-070 Docket No. 50-336 Attachment, Page 5 of 17 Regulatory Position C.2.3.2 of RG 1.177 states that the licensee should perform evaluations of CDF and LERF to support any risk-informed changes to TS. The scope of the analysis should include all hazard groups (i.e., internal events, internal flooding, fires, seismic events, high winds, and other external hazards) unless it can be shown the contribution from specific hazard groups does not affect the decision. In some cases, a PRA of sufficient scope may not be available.
The licensee evaluated the impacts from high wind and tornado in the LAR (Attachment 5, under Extreme Wind or Tornado, and Hurricane), and screened out high wind and tornado, based on a frequency of occurrence less than 1 E-06 per year. Further, several potential failures caused by tornado-generated missiles are also excluded based on their being bounded by the 1 E-06 frequency of occurrence. However, the basis for the frequency of occurrence cited by the licensee as well as the frequency being bounding for tornado generated missile risks is not provided. Further, the discussion does not include consideration of higher frequency high winds events.
Justify the exclusion of the high winds risk from the risk assessment for this application including the basis for (1) the cited occurrence frequency, (2) the tornado-generated missile risk being bounded by the occurrence frequency, and (3) lack of consideration of higher frequency high winds events.
DENC Response to RAI 02 The issue of concern associated with maintaining switchyard breaker 13T closed coincident with the MPS3 'A' RSST out of service, is the loss of electrical separation between the remaining MPS2 offsite power sources (i.e., the MPS2 RSST and MPS3
'A' NSST). Consequently, if breaker 13T incurs an internal fault such that the breaker does not trip open, the fault is postulated to propagate to the MPS2 RSST and MPS3 'A' NSST rendering them both unavailable. Conversely, if breaker 13T were to trip open, electrical separation between the MPS2 offsite sources is restored.
Based on this configuration risk perspective, the primary justification for not including high winds risk in the risk assessment is the low likelihood of a high winds event only causing an internal breaker 13T fault resulting in the breaker failing to trip open and no other switchyard damage occurring. The more likely scenario is an event that causes breaker 13T to open or a loss of all four offsite transmission lines. Therefore, the high winds configuration risk increase associated with maintaining switchyard breaker 13T closed coincident with the MPS3 'A' RSST out of service is considered negligible. In addition, risk is further minimized by risk management action #2 in LAR Attachment 4, which does not allow scheduling entry into the action statement when adverse or inclement weather is predicted or present.
Serial No.20-070 Docket No. 50-336 Attachment, Page 6 of 17 The information provided in Attachment 5 of the LAR was extracted from "Millstone Nuclear Power Station, Unit No. 2 - Individual Plant Examination of External Events (IPEEE) (TAC No. M83642)," dated 1/12/01 (ADAMS Accession No. ML010120072).
Table 5.1-1 of the IPEEE provides the occurrence frequency based on velocity. Given MPS2 structures are designed for a maximum rotational velocity of 300 mph, the occurrence frequency is< 1 E-06 per Table 5.1-1.
RAI 03 (Key Assumptions and Sources of Uncertainty)
Serial No.20-070 Docket No. 50-336 Attachment, Page 7 of 17 Regulatory Position C of RG 1.174 states: "In implementing risk-informed decision making, LB [licensing basis] changes are expected to meet a set of key principles.... In implementing these principles, the staff expects [that]:... Appropriate consideration of uncertainty is given in the analyses and interpretation of findings.... NUREG-1855 provides further guidance." Additionally, NUREG-1855 Revision 1 identifies EPRI Topical Report (TR) 1016737 and EPRI TR 1026511 as providing guidance for identifying and characterizing key sources of uncertainty.
The licensee stated that a list of MPS2 PRA model assumptions and sources of uncertainty were reviewed to identify those significant to this application. In response to RAI 3 for the LAR to adopt 10 CFR 50.69 "Risk-informed categorization of structures, systems, and components" (ADAMS Accession No. ML19284A397), the licensee explained the process followed for identification of "key" assumptions and sources of uncertainty. It is unclear whether the same approach was followed for this application.
a)
Confirm that approach followed for identification of "key" assumptions and sources of uncertainty for this application is identical to that described in response to RAI for the LAR to adopt 10 CFR 50.69.
b)
Presumably some assumptions and sources of uncertainty required more evaluation than other assumptions and sources of uncertainty to determine whether they were "key" or not. Provide representative examples to illustrate the implementation of the process for identification of "key" assumptions and the range of evaluations performed.
DENC Response to RAI 03 a) The approach used for identifying "key" assumptions and sources of uncertainty is identical to that described in response to RAI 05a for the LAR to adopt 10 CFR 50.69.
For the TS 3.8.1.1 LAR application, the approach was limited to the parameters used in the b.LOOPGR calculation and the modeling of the LOOP/Station Blackout (SBO) accident scenario. Sensitivity Study 1 was performed to address the parameter uncertainty associated with the b.LOOPGR calculation. The approach used for identifying LOOP/SBO accident scenario modeling uncertainties is described below.
b) Since this model application is assessing LOOP/SBO scenario mitigation capability, the evaluation performed was focused on assumptions and sources of uncertainty pertaining to that event. The following table provides examples of dispositions made for model assumptions and sources of uncertainty for this application.
Examples pft CJ>el BO Scenati<> Model Assumptipns *A*h*B\\Soprces 9fCn.certainty*.
AS.3 - FLEX Strategy If the turbine driven auxiliary feedwater (TDAFW) pump is unavailable or fails, it is assumed that FLEX strategies fail.
EPRI TR-1016737 Generic Industry Source of Model Uncertainty LOOP non-recovery probabilities Industry data from NUREG/CR-INEEL-04-023261 and EPRI TR-1025749 is utilized to develop failure to recover probabilities for each LOOP category.
EPRI TR-1016737 Generic Industry Source of Model Uncertainty Operation of equipment after battery depletion No credit is taken for continued operation of any systems that require DC power following battery depletion.
EPRI TR-1016737 Generic Industry Source of Model Uncertainty Battery life calculations Battery life is an important factor in assessing a plant's ability to cope with an SBO. Many plants only have Design Basis calculations for battery life. Other plants have very plant/condition specific calculations of battery life. Failing to fully credit battery capability can overstate risks, and mask other potential contributors and insights.
Realistically assessing battery life can be complex.
Serial No.20-070 Docket No. 50-336 Attachment, Page 8 of 17 TS 3.... $D1.1 LAR Disposition Not a key assumption since this represents a slight conservative bias.
The LOOP non-recovery probabilities used in the MPS2 PRA model are based on industry data applicable to MPS2.
This application introduces the potential for a LOOP and therefore, the LOOP non-recovery probability represents a potential key source of model uncertainty.
Sensitivity Study 2 was performed to address this model uncertainty.
Not a
key source of model uncertainty since not crediting equipment operation via operator action following battery depletion represents a slight conservative bias.
Not a
key source of model uncertainty since the 8-hour nominal battery capacity coupled with the credited extended loss of AC power (ELAP) mitigation strategy of DC bus load shedding ensures the batteries will function for the modeled mission time.
A best estimate battery capacity calculation supports this conclusion.
RAI 04 (Credit for FLEX Equipment or Actions)
Serial No.20-070 Docket No. 50-336 Attachment, Page 9 of 17 The NRC memorandum dated May 30, 2017, "Assessment of the Nuclear Energy Institute 16-06, 'Crediting Mitigating Strategies in Risk-Informed Decision Making,'
Guidance for Risk-Informed Changes to Plants Licensing Basis" (ADAMS Accession No. ML17031A269), provides the NRC's staff assessment of the challenges of incorporating diverse and flexible (FLEX) coping strategies and equipment into a PRA model in support of risk-informed decision-making in accordance with the guidance of RG 1.200, Revision 2.
In response to RAI 4 for its LAR to adopt 10 CFR 50.69, "Risk-informed categorization of structures, systems, and components" (ADAMS Accession No. ML19284A397), the licensee stated that FLEX equipment is credited in the MPS2 internal events and internal flooding PRA. The licensee also stated that the FLEX equipment failure data will be considered as a source of uncertainty. The human error probability for FLEX actions, especially related to deployment of portable equipment, can also be a source of uncertainty. However, neither of these sources of uncertainty were identified as key for this application and sensitivity studies determining the impact of these sources are not discussed.
a) Clarify whether FLEX diesel generator that was originally credited as a supplemental AC source for this application is credited in the MPS2 internal events and internal flooding PRA.
b) Justify (e.g., using sensitivity studies), that FLEX equipment failure data and human error probability for FLEX actions, especially related to deployment of portable equipment, that are credited in the MPS2 internal events and internal flooding PRA are not "key" assumptions and sources of uncertainty for this application. If FLEX equipment failure data and human error probability for FLEX actions are determined to impact this application, identify any risk management actions, or justify the lack of risk management actions, such as pre-testing and staging relevant FLEX equipment.
DENC Response to RAI 04 a) The 480 V FLEX diesel generator, originally credited as a supplemental power source in the initial submittal of the LAR (dated August 17, 2019) to repower the battery charger, is not credited in the MPS2 internal events and internal flooding PRA.
DC bus load shedding in accordance with the ELAP mitigation strategy coupled with low leakage reactor coolant pump (RCP) seal design allows for achieving a stable end state without crediting the 480 V FLEX diesel generator.
However, the PRA model does credit a portable beyond design basis (BOB) transfer pump to refill the Condensate Storage Tank (CST) via the Primary Water Storage Tank after the CST depletes 8-10 hours following the ELAP event. The portable
Serial No.20-070 Docket No. 50-336 Attachment, Page 10 of 17 transfer pump along with the associated hoses and fittings are stored in the MPS2 Turbine Building. Crediting this strategy ensures that the PRA models the as-built, as-operated response to a SBO scenario. Given the nature of the LOOP event postulated by maintaining breaker 13T closed (i.e., grid-related LOOP), offsite power is expected to be restored prior to the CST being depleted. In this case, the normal method of using fire water as the alternate auxiliary feedwater (AFW) pump suction source following CST depletion is credited.
b) The portable BOB transfer pump and associated hoses and fittings are stored in the MPS2 Turbine Building to ensure availability given an external flood scenario and therefore, pre-staging the equipment would be contrary to BOB program requirements. The FLEX equipment failure data and human error probability are not "key" assumptions or sources of uncertainty for this application. This is because the impact of implementing this application results in a minimal increase in LOOP frequency and negligible increase in SBO frequency, given that both MPS2 emergency diesel generators (EOGs) will be maintained available per the compensatory actions listed in Section 4.4.1 of Attachment 1 to the LAR (as well as risk management action #8 in LAR Attachment 4), and the SBO OG will be maintained available as the supplemental power source per the proposed TS requirements for the 10-day and 35-day AOTs.
Since the most likely scenario caused by breaker 13T being maintained closed is a grid-related LOOP where offsite power is restored prior to CST depletion, the normal source of alternate AFW pump suction, the MPS3 diesel-driven fire water pump, will be maintained available per the compensatory actions listed in Section 4.4.1 of Attachment 1 to the LAR.
RAI 05 (Parameter Uncertainty and Model Uncertainty)
Serial No.20-070 Docket No. 50-336 Attachment, Page 11 of 17 RG 1.174, Section C.2.5 identifies the following types of uncertainty that affect the results of PRAs: parameter uncertainty, model uncertainty, and completeness uncertainty.
In accordance with regulatory positions in RGs 1.174 and 1.177, uncertainties should be appropriately considered in the analysis and interpretation of findings. Also, RG 1.17 4 states, the results of the sensitivity studies should confirm the guidelines are still met even under the alternative assumptions.
In Attachment 5 to the LAR, the licensee addresses three types of probabilistic risk assessment uncertainty. For the parameter uncertainty, the licensee increased the failure rates by a factor of 3 for the switchyard bus failure rate, offsite power transformer failure rate, and switchyard breaker failure rate, and evaluated the conditional CDF and LERF, and calculated ICCDF and ICLERF for one-time 35-day AOT. However, the identified parameter uncertainties as well as the approach for the corresponding sensitivity appear to be similar to the model uncertainty identified by the licensee. The staff is unclear about the difference between the identification and disposition of the parameter and modeling uncertainties.
a) Discuss the approach used for identifying the three parameter uncertainties stated in Attachment 5 to the LAR.
b) Explain the difference in the basis and approach between the parameter uncertainty, in which three parameters are selected for sensitivity study, and the model uncertainty, in which one parameter is selected for sensitivity study compared to the modeling uncertainty identified in the same attachment to the LAR.
c)
If a clear distinction cannot be drawn between the modeling and parameter uncertainties stated in Attachment 5 fo the LAR provide the results of a sensitivity study which include the impact of all identified uncertainties or justify not combining them.
d) If a sensitivity is performed in response to item (c) above, discuss the impact of the sensitivity on the importance measures and resulting compensatory actions proposed by the licensee. Identify any additional compensatory actions revealed by the sensitivity or justify their exclusion from the proposed actions for the one time completion time request.
DENC Response to RAI 05 a) The three parameters chosen: switchyard bus failure rate, offsite power transformer failure rate, and switchyard breaker failure rate were selected since these are the three parameters used in the calculation that determines the LOOP frequency
Serial No.20-070 Docket No. 50-336 Attachment, Page 12 of 17 increase due to this risk-informed application. This is identified as Sensitivity Study 1 in LAR Attachment 5.
b) Sensitivity Study 2 in LAR Attachment 5 assesses PRA model uncertainty. The model uncertainty parameter, LOOP non-recovery probability, affects base case as well as application-specific risk values. Consequently, the sensitivity study factor was applied to both the base case and application-specific case (i.e., with LOOP frequency increased).
c) A sensitivity study was performed that combines the parameter and model uncertainties into one study. The results for Incremental Conditional Core Damage Probability (ICCDP) and Incremental Conditional Large Early Release Probability (ICLERP) are provided below:
CDFsASE = 2.009595E-05/yr LERFsAsE = 1.402934E-06/yr CDFsENs1T1v1TY = 2.055889E-05/yr LERFsENS1T1v1TY = 1.464782E-06/yr The one-time TS change risk metrics are calculated to be:
ICCDP = (2.055889E-05/yr - 2.009595E-05/yr)
d) A Tier 2 assessment was completed using the approach described in response to RAI Question 7. Risk importance measures were calculated based on the sensitivity study results obtained for the response to item (c) above. The assessment did not identify additional Tier 2 restrictions or require any additional compensatory actions beyond those identified in the LAR.
Serial No.20-070 Docket No. 50-336 Attachment, Page 13 of 17 RAI 06 (Considerations of Common Cause Failures for LOOPGR)
The guidance in RG 1.177, Section 2.3.3.1, states that, "CCF modeling of components is not only dependent on the number of remaining in-service components but is also dependent on the reason components were removed from service (i.e. whether for preventative or corrective maintenance)."
The licensee's determination of the increased grid LOOP occurrence frequency (b.LOOPGR) does not appear to include common cause failures. The staff notes that there is a potential for common cause failures for the breakers on the "north bus" as well as the transformers considered in determination of b.LOOPGR.
Justify the exclusion of common cause failures for breakers and transformers in the determination of the increased grid LOOP occurrence frequency or include such failures in the calculation and provide an updated risk assessment. Include an explanation of the changes to the PRA model (e.g., relevant fault tree) for this application as part of the justification. If an updated risk assessment is provided, 'include the basis for the common cause failure probabilities.
DENC Response to RAI 06 The issue of concern associated with maintaining switchyard breaker 13T closed coincident with the MPS3 'A' RSST out of service, is the loss of electrical separation between the remaining MPS2 offsite power sources (i.e., the MPS2 RSST and MPS3
'A' NSST). Consequently, if breaker 13T incurs an internal fault such that the breaker does not trip open, the fault is postulated to propagate to the MPS2 RSST and MPS3 'A' NSST rendering them both unavailable. Conversely, if breaker 13T were to trip open, electrical separation between the MPS2 offsite sources is restored.
Based on this configuration risk perspective, common cause failure of the two transformers, MPS2 RSST and MPS3 'A' NSST, is independent of 13T breaker position and therefore, is not considered within the b.LOOPGR calculation. The following two scenarios are postulated in the b.LOOPGR calculation.
- 1. The first scenario involves a breaker 13T passive failure which is postulated to render both MPS2 offsite sources unavailable and therefore, a common cause failure is not necessary for the LOOP to occur. This scenario contributes roughly 90% to the b.LOOPGR frequency.
- 2. The second scenario involves a passive failure (e.g., switchyard breakers, MPS2 RSST, MPS3 'A' NSST) that requires breaker 13T to perform its active function which ensures electrical separation of the MPS2 offsite sources. In this case, there are several passive and active fault combinations that would disable one of the two MPS2 offsite sources and challenge the 13T breaker to perform its active function. There are scenarios involving a passive fault and a common cause failure combination that includes breaker 13T. For example, a passive failure of
Serial No.20-070 Docket No. 50-336 Attachment, Page 14 of 17 breaker ST coupled with common cause failure of breakers 7T and 13T to open would render both MPS2 offsite sources unavailable. However, the scenarios involving breaker common cause failure are minor contributors to the t:.LOOPGR calculation since there are more likely scenarios involving a passive fault and single failure of breaker 13T that would render both MPS2 offsite sources unavailable.
For example, a passive MPS2 RSST fault and single failure of breaker 13T results in loss of both MPS2 offsite sources.
Therefore, the t:.LOOPGR calculation did not include scenarios involving common cause failure of breaker 13T since they are insignificant contributors.
The fault tree developed to calculate the.LiLOOPGR frequency is provided below:
BREAKER 13T-2 SPURIOOSLYOPENS BREAKER 13T-2 FAILS TO OPEN NORTH BUS FAULT MPS2 LOCP FREQUENCY INCREASE MPS2-LOOP-INCREASE BREAKER 7T-2 SPURIOUSLY OPENS TT-SO 4.23E-03/Y 13T-2 FAILS TO !SQ.ATE FAULT ISOLATION-FAILS BREAKER4T-2 SPURIOUSLY OPENS 4T-SO 423E-031Y FAULTOCOJRS REQUIRING 13T-2 TO ISOLATE 4.23E-03/Y MPS3NSSTOR ASSOOATB) BREAKER FAULT MPS3NSST FAULT BREAKER 3583-35A-2 SPURIOUSLY OPENS 4 23E-03/Y 4.23E-03/Y 34B-SO 35CSO 4 23E-03/Y Serial No.20-070 Docket No. 50-336 Attachment, Page 15 of 17 MPS3MAIN lRANSFCRMER FAULT 15G-3XA FAULT 15G-3XC FAULT 15G-3XA 15G-3XC 0 2 53E-02M MPS2 13T LAR.caf I 5/10/2019
RAI 07 (Avoidance of Risk-Significant Plant Configurations)
Serial No.20-070 Docket No. 50-336 Attachment, Page 16 of 17 Section C.2.3 of RG 1.177 discusses Tier 2 of the three-tiered approach for evaluating risk associated with proposed changes to TS CT. According to Tier 2, the avoidance of risk-significant plant configurations limits potentially high-risk configurations that could exist if equipment, in addition to that associated with the proposed change, are simultaneously removed from service or other risk-significant operational factors, such as concurrent system or equipment testing, are involved.
Based on configuration-specific insights provided in the LAR (Attachment 1, Section 4.4.1), the licensee performed analyses to identify risk-significant combinations of equipment out-of-service during the extended time and identified further compensatory actions and restrictions for entry into the extended CT to avoid high risk equipment out-of service combinations during that time. In addition, the licensee provided a list of systems, structures and components (SSCs) whose unavailability should be minimized during the CT, based upon a review of the quantification results to identify significant equipment outage contributors to CDF an LERF. However, the approach used by the licensee to identify the compensatory actions is not provided.
Discuss the approach and the parameters used (e.g., importance measures or dominant sequences) to identify the compensatory actions listed in Section 4.4.1 of Attachment 1 to the LAR. The discussion should include examples of the correspondence between the compensatory actions and the parameters used for identification.
DENC Response to RAI 07 The Tier 2 approach consists of generating risk importance measures based on the result files used to calculate the ICCDP and ICLERP risk metrics. Components are selected as Tier 2 restrictions if the following criteria are met:
Fussell-Vesely valueD 1 E-03 On-line maintenance candidate (e.g., components periodically removed from service during power operation)
The following table correlates the components which are subject to the compensatory actions listed in Section 4.4.1 of attachment 1 to the LAR with their corresponding Fussell-Vesely values that meet our criteria for identification as such.
- Component Fusll-Vesely Value MPS2 Emergency Diesel Generator H7A 1.84E-02 MPS2 Emergency Diesel Generator H7B 1.58E-02 MPS2 Auxiliary Feedwater Pump P4.
8.85E-03 MPS2 Auxiliary Feedwater Pump P9A 8.62E-03 MPS2 High Pressure Safety Injection (HPSI} Pump P41A 6.35E-03
Componelit
- ii.>:
MPS2 HPSI Pump P41C MPS2 Auxiliary Feedwater Pump P9B MPS2 Service Water Pump PSB MPS3 Diesel-driven Fire Water Pump M7-7 MPS2 HPSI Pump P41B MPS3 Station Blackout Diesel Generator 3BGS-EG1 MPS2 Service Water Pump PSA MPS2 Service Water Pump PSC Serial No.20-070 Docket No. 50-336 Attachment, Page 17 of 17 Fussell,-Vesly Value *.:.
6.lSE-03 4.20E-03 3.40E-03 2.92E-03 2.76E-03 2.64E-03 l.00E-03 9.20E-04