Text

R. E. Ginna Nuclear Power Plant, License Amendment Request for Implementation of WCAP-14333 and WCAP-15376, Reactor Trip System Instrumentation and Engineered Safety Feature Actuation System Instrumentation Test Times and Completion Times
	ML20085H900
Person / Time
Site:	Ginna
Issue date:	03/25/2020
From:	David Gudger; Exelon Generation Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	Download: ML20085H900 (104)
	v • d • e

200 Exelon Way Kennett Square, PA 19348 www.exeloncorp.com 10 CFR 50.90 March 25, 2020 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 R. E. Ginna Nuclear Power Plant Renewed Facility Operating License No. DPR-18 NRC Docket No. 50-244

Subject:

License Amendment Request for Implementation of WCAP-14333 and WCAP-15376, Reactor Trip System Instrumentation and Engineered Safety Feature Actuation System Instrumentation Test Times and Completion Times In accordance with 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, Exelon Generation Company, LLC (EGC) requests changes to the Technical Specifications (TS) of the R. E. Ginna Nuclear Power Plant (Ginna).

The proposed amendment revises TS 3.3.1, Reactor Trip System (RTS) Instrumentation, and TS 3.3.2, Engineered Safety Feature Actuation System (ESFAS) Instrumentation.

These changes are based on Westinghouse topical reports WCAP-14333-P-A, Revision 1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, and WCAP-15376-P-A, Revision 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times.

These proposed changes are consistent with the NRC-approved Technical Specification Task Force (TSTF) Travelers TSTF-411-A, Revision 1, Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-15376-P) and TSTF-418-A, Revision 2, RPS and ESFAS Test Times and Completion Times (WCAP-14333), or are supported by plant-specific analysis for those changes which are plant specific, and therefore, not evaluated in these WCAPs.

provides an evaluation supporting the proposed changes. Attachment 2 provides the existing TS pages marked up to show the proposed changes. Attachment 3 provides existing TS Bases pages marked up to show the proposed changes and are being provided for information only.

The proposed changes have been reviewed by the Ginna Plant Operations Review Committee in accordance with the requirements of the EGC Quality Assurance Program.

U.S. Nuclear Regulatory Commission License Amendment Request for Implementation of WCAP-14333 and WCAP-15376 March 25, 2020 Page2 In accordance with 10 CFR 50.91, "Notice for public comment; State consultation,"

paragraph (b), EGC is notifying the State of New York of this application for license amendment by transmitting a copy of this letter and its attachments to a designated State Official.

Should you have any questions concerning this letter, please contact Tom Loomis at 610-765:-5510.

I declare under penalty of perjury that the foregoing is true and correct. This statement was executed on the 25th day of March 2020.

Respectfully, dJ~~ -r j__Jyv--

David T. Gudger Senior Manager - Licensing Exelon Generation Company, LLC Attachments: 1. Evaluation of Proposed Changes

2. Markup of Proposed Technical Specification Pages

3. Markup of Proposed Technical Specification Bases Pages cc: NRC Regional Administrator, Region I NRC Senior Resident Inspector, Ginna NRC Project Manager, Ginna A. L. Peterson, NYSERDA Evaluation of Proposed Changes 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

3.0 BACKGROUND

4.0 DETERMINISTIC TECHNICAL ANALYSIS 5.0 PROBABILISTIC TECHNICAL ANALYSIS

6.0 REGULATORY EVALUATION

6.1 Applicable Regulatory Requirements/Criteria 6.2 Precedent 6.3 No Significant Hazards Consideration 6.4 Conclusions

7.0 ENVIRONMENTAL CONSIDERATION

S Evaluation of Proposed Changes 1

1.0

SUMMARY

DESCRIPTION In accordance with 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, Exelon Generation Company, LLC (EGC) requests changes to the Technical Specifications (TS) of the R. E. Ginna Nuclear Power Plant (Ginna).

EGC proposes to revise the TS for selected Reactor Trip System (RTS) and Engineered Safety Feature Actuation System (ESFAS) instrumentation channels. This change will allow selected RTS (Table 3.3.1-1) and ESFAS (Table 3.3.2-1) instrumentation channels to increase their Completion Times (CT) and bypass test times. In addition, this change includes adding a function to be applicable for TS Limiting Condition for Operation (LCO) 3.3.2.F and Surveillance Requirement (SR) 3.3.2.2.

These changes are based on Westinghouse topical reports WCAP-14333-P-A, Revision 1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, and WCAP-15376-P-A, Revision 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times.

These proposed changes are consistent with the NRC-approved Technical Specification Task Force (TSTF) Travelers TSTF-411-A, Revision 1, Surveillance Test Interval Extensions for Components of the Reactor Protection System (WCAP-15376-P) and TSTF-418-A, Revision 2, RPS and ESFAS Test Times and Completion Times (WCAP-14333), or are supported by plant-specific analysis where required for plant specific changes not evaluated in these WCAPs.

The addition of a function to TS LCO 3.3.2.F and SR 3.3.2.2 is consistent with the changes made to the Ginna TS under Amendment 132. contains a markup of the proposed Technical Specification pages. Attachment 3 contains a markup of proposed Technical Specification Bases pages for information only.

2.0 DETAILED DESCRIPTION The proposed changes will allow certain functions in the RTS and ESFAS instrumentation to be in bypass for increased periods of time during surveillance testing and have extended limiting condition for operation completion times. An additional change is proposed to allow bypassing of the Steam Generator (SG) Level - Low Low function during ESFAS testing.

TS 3.3.1 Reactor Trip System Instrumentation The proposed changes would revise the following functions in TS Table 3.3.1-1, consistent with the generic evaluations approved in either WCAP-14333, or WCAP-15376:

Function System Action Proposed TS Change 5

Overtemperature T D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 7b Pressurizer Pressure -

High D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 11 Undervoltage - Bus 11A and 11B K.1 Increase completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Evaluation of Proposed Changes 2

Function System Action Proposed TS Change 12 Underfrequency - Bus 11A and 11B K.1 Increase completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 17 Reactor Trip Breakers T.1 Increase bypass time from 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and completion time from 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months The proposed changes to the TS LCO Required Actions and Completion Times associated with the above functions are shown below. The changes are shown by underlined text.

LCO 3.3.1.D Required Action D.1 NOTE -

1. For Functions 2a, 2b, 5, 6, 7b, 8, and 13, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO 3.3.1.K Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO 3.3.1.T Required Action T.1 NOTE -

1. One train may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing, provided the other train is OPERABLE.

Completion Time 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months The following functions in TS Table 3.3.1-1 were not included in the generic evaluations approved in WCAP-14333. In order to apply the TS relaxations provided in these reports to specific functions not evaluated generically, the following proposed changes are supported by a plant specific evaluation described in Section 5.0.

Function System Action Proposed TS Change 2a Power Range Neutron Flux - High D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 2b Power Range Neutron Flux - Low D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 6

Overpower T D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 7a Pressurizer Pressure -

Low K.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Evaluation of Proposed Changes 3

Function System Action Proposed TS Change 8

Pressurizer Water Level - High D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 9a Reactor Coolant Flow

- Low - Single Loop M.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 9b Reactor Coolant Flow

- Low - Two Loops K.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 10b Reactor Coolant Pump (RCP) Breaker Position - Two Loops K.1 Increase completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 13 Steam Generator Water Level - Low Low D.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 16c Reactor Trip System Interlocks - Power Range Neutron Flux, P-8 S.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 16d Reactor Trip System Interlocks - Power Range Neutron Flux, P-9 S.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 16e Reactor Trip System Interlocks - Power Range Neutron Flux, P-10 S.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months The proposed changes to the TS LCO Required Actions and Completion Times associated with the above functions are shown below. The changes are shown by underlined text.

LCO 3.3.1.D Required Action D.1 NOTE -

1. For Functions 2a, 2b, 5, 6, 7b, 8, and 13, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO 3.3.1.K Required Action K.1 NOTE -

1. For Functions 7a and 9b, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

Evaluation of Proposed Changes 4

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO 3.3.1.M Required Action M.1 NOTE -

1. For Function 9a, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO 3.3.1.S Required Action S.1 NOTE -

For Functions 16c, 16d, and 16e, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

TS 3.3.2 Engineered Safety Feature Actuation System (ESFAS) Instrumentation The proposed changes would revise the following functions in TS Table 3.3.2-1, consistent with the generic evaluations approved in WCAP-14333:

Function System Action Proposed TS Change 1d Safety Injection -

Pressurizer Pressure -

Low L.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 4c Steam Line Isolation -

Containment Pressure

- High High F.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 4d Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tavg-Low F.1 Increase completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 4e Steam Line Isolation-High-High Steam Flow Coincident With Safety Injection F.1 Increase completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 5b Feedwater Isolation -

SG Water Level - High F.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 6c Auxiliary Feedwater -

SG Water Level - Low Low F.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months The proposed changes to the TS LCO Required Actions and Completion Times associated with the above functions are shown below. The changes are shown by underlined text.

Evaluation of Proposed Changes 5

LCO 3.3.2.F Required Action F.1 NOTE -

1. For Functions 4c, 5b, and 6c, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months LCO 3.3.2.L Required Action L.1 NOTE -

1. For Functions 1d and 1e, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months The following functions in TS Table 3.3.2-1 were not included in the generic evaluations approved in WCAP-14333. In order to apply the TS relaxations provided in these reports to specific functions not evaluated generically, the following proposed changes are supported by a plant specific evaluation described in Section 5.0.

Function System Action Proposed TS Change 1c Safety Injection -

Containment Pressure

- High J.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 1e Safety Injection -

Steam Line Pressure -

Low L.1 Increase bypass time from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months 2c Containment Spray, Containment Pressure-High High J.1 Increase completion time from 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months The proposed changes to the TS LCO Required Actions and Completion Times associated with the above functions are shown below. The changes are shown by underlined text.

LCO 3.3.2.J Required Action J.1 NOTE -

1. For Functions 1c, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Evaluation of Proposed Changes 6

LCO 3.3.2.L Required Action L.1 NOTE -

1. For Functions 1d and 1e, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of the other channels.

Completion Time 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months TS 3.3.2.F/SR 3.3.2.2 SG Level - Low Low The proposed changes would revise LCO 3.3.2.F and SR 3.3.2.2 to add the Auxiliary Feedwater

- Steam Generator Water Level - Low Low function to the Notes as shown below. The addition of this function to LCO 3.3.2.F would allow bypassing this function during surveillance testing.

The addition of this function to SR 3.3.2.2 would allow the input relays to be excluded from Channel Operational Testing (COT). The underlined portions show the proposed changes.

LCO 3.3.2.F Required Action F.1 NOTE -

1. For Functions 4c, 5b, and 6c, one channel may be bypassed for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing.

SR 3.3.2.2 NOTE -

The ESFAS input relays are excluded from this surveillance for Functions 1c, 1d, 1e, 4c, 5b, and 6c.

3.0 BACKGROUND

WCAP-15376-P-A, Revision 1, Risk-Informed Assessment of the RTS and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test and Completion Times, provides the justification for changes to the Improved Standard Technical Specifications for the Reactor Trip System (RTS) Instrumentation (3.3.1) and Engineered Safety Features Actuation System (ESFAS)

Instrumentation (3.3.2). These changes include an increase the Completion Time and the bypass test time for the reactor trip breakers. WCAP-15376-P considers both the Solid State Protection System and the Relay Protection System. Ginna uses a Relay Protection System for RTS and ESFAS.

WCAP-14333-P-A, Revision 1, Probabilistic Risk Analysis of the RPS and ESFAS Test Times and Completion Times, provides the justification for the following changes to the Improved Standard Technical Specifications for increasing the bypass times for testing and the Completion Times in the Reactor Protection System (RPS) Instrumentation (3.3.1) and Engineered Safety Features Actuation System (ESFAS) Instrumentation (3.3.2) Technical Specifications:

Completion times of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months for inoperable instruments Bypass times of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing Completion times of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for an inoperable logic cabinet or master and slave relays Evaluation of Proposed Changes 7

These improvements will allow additional time to perform maintenance and test activities, enhance safety, provide additional operational flexibility, and reduce the potential for forced outages related to compliance with the RPS and ESFAS instrumentation Technical Specifications. Industry information has shown that a significant number of trips that have occurred are related to instrumentation test and maintenance activities, indicating that these activities should be completed with caution and sufficient time should be available to complete these activities in an orderly and effective manner.

Ginna Amendment 132 revised TS 3.3.1 and 3.3.2 to reflect the standard Technical Specification wording for Westinghouse plants with bypass capability. This amendment allowed the bypassing of specific RTS and ESFAS instrumentation functions during surveillance testing. The inclusion of ESFAS Function 6c (Auxiliary Feedwater - SG Water Level Low Low) was inadvertently omitted from that Ginna LAR. The circuitry for the ESFAS Function 6c utilizes the same relays as the RTS instrumentation Function 13 (SG Water Level Low Low). RTS Function 13 was included in Amendment 132 and can be bypassed during surveillance testing. However, since the same relays are utilized in the RTS and ESFAS circuits, the bypassing of RTS Function 13 during RTS surveillance testing is not possible since the ESFAS Function 6c does not currently allow bypassing during testing. As such, the addition of ESFAS Function 6c to TS LCO 3.3.2.F and SR 3.3.2.2 is included in this LAR.

4.0 DETERMINISTIC TECHNICAL ANALYSIS 4.1 Deterministic Assessment for Completion and Bypass Test Times The proposed changes increase the completion times and bypass times for selected RTS and ESFAS Instrumentation functions.

The traditional engineering considerations need to be addressed. These include defense-in-depth and safety margins. The fundamental safety principles on which the plant design is based cannot be compromised. Design basis accidents are used to develop the plant design. These are a combination of postulated challenges and failure events that are used in the plant design to demonstrate safe plant response. Defense-in-depth, the single failure criterion, and adequate safety margins may be impacted by the proposed changes and consideration needs to be given to these elements.

4.1.1 Defense-in-Depth Consistency with the defense-in-depth philosophy is maintained as discussed below.

a) A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation (i.e., the proposed change in a TS has not significantly changed the balance among these principles of prevention and mitigation) to the extent that such balance is needed to meet the acceptance criteria of the specific design basis accidents and transients.

The proposed increases in the completion times and test bypass times do not affect the design or operation of the RTS or ESFAS instrumentation. The RTS and ESFAS will remain capable of performing their required functions. The proposed changes do not degrade core damage prevention and compensate with improved containment integrity, nor do these changes degrade containment integrity and compensate with improved core Evaluation of Proposed Changes 8

damage prevention. Therefore, the balance among prevention of core damage and prevention of containment failure is maintained. Consequence mitigation remains unaffected by the proposed changes.

No new accidents or transients are introduced with the proposed changes; therefore, the likelihood of accidents or transients is not impacted. No new activities on the RTS or ESFAS will be performed at power that could lead to potentially new transient events.

b) Over-reliance on programmatic activities as compensatory measures is avoided.

The plant design will not be changed with these proposed changes. All safety systems will still function in the same manner with the same signals available to trip the reactor and initiate ESFAS functions, and there will be no additional reliance on additional systems, procedures, or operator actions. The calculated risk increase to these changes is very small and additional control processes are not required to be put into place to compensate for any risk increase.

c) System redundancy, independence, and diversity are preserved commensurate with the expected frequency and consequences of challenges to the system.

There is no impact on the redundancy, independence, or diversity of the RTS and ESFAS or the ability of the plant to respond to events with diverse systems. The RTS and ESFAS are diverse and redundant systems and will remain so. There will be no change to the signals available to trip the reactor or initiate ESFAS functions. The RTS and ESFAS are reliable systems and are backed up by the plant operators who will still be available to perform actions in the event of RTS failure. In addition, the RTS is backed up by the Anticipated Transient Without Scram (ATWS) mitigating system actuation circuitry signal to start auxiliary feedwater and trip the turbine in conjunction with reactor coolant system pressure mitigation via the pressurizer safety valves and relief valves. The proposed changes have no impact on this alternate approach to ATWS mitigation.

d) Defenses against potential common cause failures are maintained, and the potential for introduction of new common cause failure mechanisms is assessed.

The extensions requested are not sufficiently long to expect new common cause failure mechanisms to arise. In addition, the operating environment for these components remains the same, so new common cause failure modes are not anticipated. Also, backup systems and operator actions are not impacted by these changes; and there are no new common cause links between primary and backup systems. Therefore, no new potential common cause failure mechanisms have been introduced.

e) Independence of physical barriers is not degraded.

The physical barriers (fuel cladding, reactor coolant system, and containment) and their independence are maintained. The proposed changes do not affect the integrity of the physical barriers to limit leakage to the environment. Increasing the completion times and bypass test times to the RTS and ESFAS systems does not affect the independence of the fuel cladding, reactor coolant system, or containment.

Evaluation of Proposed Changes 9

f) Defenses against human errors are preserved.

No new operator actions related to the completion time and bypass test time extensions are required. No additional operating, maintenance, or test procedures are required due to these changes, and no new at-power tests or maintenance activities are expected to occur as a result of these changes. The plant will continue to be operated and maintained as currently performed.

g) The intent of the plants design criteria is maintained.

The intent of the Ginna design criteria is maintained. The plant will continue to be operated and maintained as currently performed. The proposed changes do not involve any physical changes to the design of the RTS or ESFAS or supporting systems. The ability of the RTS and ESFAS to perform their required functions is maintained during the extended completion times and bypass test times.

4.1.2 Safety Margin The impact of the proposed change is consistent with the principle that sufficient safety margins are maintained, as described below.

a) Codes and Standards or alternatives approved for use by the NRC are met.

The design and operation of the RTS and ESFAS systems are not changed by the proposed increase of the completion times and bypass test times. The proposed change does not affect conformance with applicable codes and standards.

b) Safety analysis acceptance criteria in the FSAR are met or proposed revisions provide sufficient margin to account for analysis and data uncertainties.

The safety analysis acceptance criteria, as stated in the Ginna FSAR, are not impacted by these changes. Redundant RPS trains will be maintained. Diversity with regard to signals to provide reactor trip and actuation of engineered safety features will also be maintained. The proposed changes will not allow plant operation in a configuration outside the design basis. All signals credited as primary or secondary and all operator actions credited in the accident analysis will remain the same.

As demonstrated by the discussion of the deterministic issues above, increasing the completion times and bypass test times to the RTS and ESFAS systems is appropriately a risk-informed decision.

4.2 Deterministic Assessment for ESFAS Function 6c The assessment of adding ESFAS Function 6c to TS LCO 3.3.2.F and SR 3.3.2.2 is the same as provided in Ginna LAR dated November 16, 2017 (ML17321A107), which led to the issuance of TS Amendment 132 (ML18213A369). Basically, these proposed changes do not modify the trip setpoints or the ESFAS functions described in the safety analyses. Hardware modifications were made so that testing in bypass could be accomplished without lifting leads or installing jumpers.

This meets the conditions specified by the NRC in SERs issued during the review of WCAP-10271-P-A, Evaluation of Surveillance Frequencies and Out of Service Times for the Reactor Evaluation of Proposed Changes 10 Protection Instrumentation System and its supplements. The impact of testing in bypass on reactor safety was previously evaluated by the NRC during their review of WCAP-10271-P-A and determined to be acceptable.

5.0 PROBABILISTIC TECHNICAL ANALYSIS 5.1 Scope and Methodology 5.1.1 Background Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22, 1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA [probabilistic safety assessment] or risk survey and any available literature on risk insights and PSAs.... Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commissions ongoing program of improving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, Technical Specifications, in July 1995. In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decision making and regulatory efficiency. The PRA policy statement included the following points:

1. The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRCs deterministic approach and supports the NRCs traditional defense-in-depth philosophy.

2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3. PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

The movement of the NRC to more risk-informed regulation has led to the NRC identifying Regulatory Guides and associated processes by which licensees can submit changes to the plant design basis, including Technical Specifications. As examples, Regulatory Guides 1.174 and 1.177, both provide mechanisms to demonstrate valuable PRA input for Technical Specification modification.

5.1.2 Regulatory Guides The license amendment request for an extension in the ESFAS/RTS instrumentation Allowed Outage Time (AOT) (i.e., TS Completion Time) is made consistent with the NRC risk-informed Evaluation of Proposed Changes 11 process. The internal events PRA is developed and peer reviewed consistent with the ASME PRA Standard as endorsed by Regulatory Guide (RG) 1.200. The risk-informed application is developed consistent with the general guidance in RG 1.174 and the specific guidance for changes in AOTs contained in RG 1.177.

5.1.2.1 Acceptance Guidelines - RG 1.174 RG 1.174 specifies the acceptance guidelines in terms of the change in CDF and LERF as a function of the base model CDF and LERF, respectively. Figure 5-1 identifies the acceptance guidelines for RG 1.174 for the CDF risk metric and Figure 5-2 identifies the acceptance guidelines for RG 1.174 for the LERF risk metric.

Further, RG 1.174 in Section 2.5.5 identifies the following regarding the PRA calculation to be used in comparison with the acceptance guidelines:

Because of the way the acceptance guidelines were developed, the appropriate numerical measures to use in the initial comparison of the PRA results to the acceptance guidelines are mean values.

5.1.2.2 Acceptance Guidelines - RG 1.177 RG 1.177 specifies acceptance guidelines in terms of two parameters that have been developed by the NRC as follows:

ICCDP - Incremental Conditional Core Damage Probability

[(conditional CDF with the subject equipment out of service) - (baseline CDF with nominal expected equipment unavailabilitys)] x (duration of single AOT under consideration)

ICLERP - Incremental Conditional Large Early Release Probability

[(conditional LERF with the subject equipment out of service) - (baseline LERF with nominal expected equipment unavailabilitys)] x (duration of single AOT under consideration)

Further, the NRC has developed acceptance guidelines which the NRC states should not be interpreted as overly prescriptive.

Risk Metric Parameter Acceptance Guideline ICCDP 1.0E-06 ICLERP 1.0E-07 5.1.3 Scope This analysis is to address the risk impact of the proposed Allowed Outage Time (AOT) extensions for identified ESFAS/RTS instrumentation from the current time using the Ginna Probabilistic Risk Assessment (PRA) model. The analyses referenced by TSTF-411 and TSTF-418 can be applied to this license amendment for extended allowable outage times. The few remaining functions which are not covered in the TSTF documents are addressed in this risk analysis.

Evaluation of Proposed Changes 12 The following scope of the at-power PRA models is included:

Internal Events: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed.

Internal Floods: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed.

Seismic Events: Insights based on stand-alone calculations of potential risk impacts, with additional support from the Seismic Evaluation from the IPEEE (Ginna screened out of the seismic hazard per the NRC/EPRI seismic reevaluations, and thus does not require a Seismic PRA).

Internal Fires: Model developed in accordance with the ASME/ANS PRA Standard and Peer Reviewed.

Other External Event Hazards: Non-contributors based on a review of IPEEE results which quantitatively or qualitatively screened other external hazards from further analysis.

The NRC has specified in RGs the risk measures that should be calculated to provide input into the decision-making process. The risk measures chosen by the NRC in their RGs include the following:

The change in Core Damage Frequency (CDF) (RG 1.174)

The change in Large Early Release Frequency (LERF) (RG 1.174)

The Incremental Conditional Core Damage Probability (ICCDP) (RG 1.177)

The Incremental Conditional Large Early Release Probability (ICLERP) (RG 1.177)

These values are all calculated with the latest Ginna PRA model, which is known as the GN119A version of the PRA model.

Evaluation of Proposed Changes 13 Figure 5-1 Acceptance Guidelines for Core Damage Frequency (CDF)

Figure 5-2 Acceptance Guidelines for Large Early Release Frequency (LERF) 5.1.4 Risk Metric Calculational Approach To determine the effect of the proposed Allowed Outage Time for unavailability of ESFAS/RTS instrumentation, the guidance provided in RGs 1.174 and 1.177 is used. Thus, the following risk metrics are used to evaluate the risk impacts of extending the various ESFAS and RTS instrumentation AOT:

Regulatory Guide 1.174 CDFAVE =

change in the annual average CDF due to the increase in on-line maintenance unavailability for ESFAS/RTS instrumentation based on the increased Allowed Outage Time. This risk metric is used to compare against the criteria of Regulatory Guide 1.174 to determine whether a change in CDF is regarded as risk significant. These criteria are a function of the baseline annual average core damage frequency, CDFBASE.

LERFAVE = change in the annual average LERF due to the increase in on-line maintenance unavailability for ESFAS/RTS instrumentation based on the increased Allowed Outage Time. Regulatory Guide 1.174 criteria were also applied to judge the significance of changes in this risk metric.

Regulatory Guide 1.177 ICCDPINST = incremental conditional core damage probability with ESFAS/RTS instrumentation out-of-service for an interval of time equal to the proposed new Allowed Outage Time. This risk metric is used as suggested in Regulatory Guide 1.177 to determine whether a proposed increase in Allowed Outage Time has an acceptable risk impact.

Evaluation of Proposed Changes 14 ICLERPINST = incremental conditional large early release probability with ESFAS/RTS instrumentation out-of-service for an interval of time equal to the proposed new Allowed Outage Time. Regulatory Guide 1.177 criteria were also applied to judge the significance of changes in this risk metric.

The evaluation of the above risk metrics is performed as follows.

New unavailability values were applied to the ESFAS/RTS instrumentation based on the change in Allowed Outage Time. The change in unavailability is assumed proportional to the change in Allowed Outage Time. These new values can be seen in Table 5-14. The change in the annual average CDF due to the extension of the ESFAS/RTS instrumentation Allowed Outage Time for the specified unavailability, CDFAVE, is evaluated by computing the following:

=

where:

CDFNEW =

CDF evaluated from the PRA model with the new unavailability of ESFAS/RTS instrumentation and compensatory measures that include prohibiting concurrent maintenance on the remaining instrumentation channels.

CDFBASE =

Baseline annual average CDF with average unavailability of ESFAS/RTS instrumentation consistent with the current Allowed Outage Time.

CDFAVE =

Difference between CDF with current Technical Specifications and the CDF with increased unavailability of ESFAS/RTS instrumentation after the AOT has been extended.

A similar approach was used to evaluate the change in the average LERF due to the requested Allowed Outage Time, LERF:

=

where:

LERFNEW =

LERF evaluated from the PRA model with the new ESFAS/RTS instrumentation unavailability and compensatory measures that include prohibiting concurrent maintenance on the remaining instrumentation channels.

LERFBASE =

Baseline annual average LERF with average unavailability of ESFAS/RTS instrumentation consistent with the current Allowed Outage Time.

LERFAVE =

Difference between LERF with current technical specifications and the LERF with increased unavailability of ESFAS/RTS instrumentation after the AOT has been extended.

The incremental conditional core damage probability (ICCDP) and incremental conditional large early release probability (ICLERP) are computed using the definitions from RG 1.177. In terms of the above defined parameters, the definition of ICCDP for the unavailability of ESFAS/RTS instrumentation is as follows:

ICCDPINST = (CDFINST - CDFBASE)TINST

where, Evaluation of Proposed Changes 15 CDFINST =

CDF evaluated from the PRA model with ESFAS/RTS instrumentation out-of-service and compensatory measures that include prohibiting concurrent maintenance on the remaining instrumentation channels.

TINST =

Total duration of extended Allowed Outage Time under consideration.

The ICCDP values are dimensionless probabilities to evaluate the incremental probability of a core damage event over a period of time equal to the extended Allowed Outage Time.

Similarly, ICLERP is calculated using the methodology described above:

ICLERPINST = (LERFINST - LERFBASE )TINST 5.2 Analysis Inputs The inputs for this analysis include the Ginna Full Power Internal Events (FPIE) PRA Model and the Fire PRA Model (FPRA). The key model files for Ginna FPIE PRA quantification are listed in the GN119A Model Quantification Notebook, and the Fire PRA Files are listed in the Fire PRA Quantification Notebook.

5.3 Analysis Roadmap The method of compliance to demonstrate the technical adequacy of the PRA used to support the AOT Extension is provided in RG 1.200, Revision 2. The guidance in RG 1.200, Revision 2 indicates that the following steps should be followed to perform this study of the technical adequacy of the PRA:

1. Per Section 3 and 3.2 of RG 1.200, identify the pieces of the PRA used to support the application.

2. Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

3. Provide a definition of the acceptance guidelines used for the application.

4. Per Section 3.1 of RG 1.200, identify the scope of risk contributors addressed by the PRA model.

5. If not full scope (i.e., internal and external), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

6. Per Section 3.3 and 4.2 of RG 1.200, demonstrate the Technical Adequacy of the PRA.

7. Identify plant changes (design or operational practices) that have been incorporated at the site but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

8. Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the Regulatory Guide (currently, in RG 1.200, Revision 1 this is just the internal events PRA standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Evaluation of Proposed Changes 16

9. Document peer review findings that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

10. Identify key assumptions and approximations relevant to the results used in the decision-making process.

11. Per Section 4.2 of RG 1.200, summarize the risk assessment methodology used to assess the risk of the application.

12. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Table 5-1 summarizes the RG 1.200 identified actions and the corresponding location of that analysis or information in this report.

Evaluation of Proposed Changes 17 Table 5-1 RG 1.200 Analysis Actions Roadmap to Demonstrate PRA Technical Adequacy RG 1.200 Actions Report Section

1.

Identify the parts of the PRA used to support the application Section 5.6.4 1a.

Describe the SSCs, operator actions, and operational characteristics affected by the application and how these are implemented in the PRA model.

Section 5.6.4 1b.

Provide a definition of the acceptance guidelines used for the application.

Section 5.1 and Section 5.6.5

2.

Identify the scope of risk contributors addressed by the PRA model.

If not full scope (i.e., internal and external events), identify appropriate compensatory measures or provide bounding arguments to address the risk contributors not addressed by the model.

Section 5.6.4

3.

Demonstrate the Technical Adequacy of the PRA.

Section 5.4 3a.

Identify plant changes (design or operational practices) that have been incorporated at the site but are not yet in the PRA model and justify why the change does not impact the PRA results used to support the application.

Section 5.4 3b.

Document that the parts of the PRA used in the decision are consistent with applicable standards endorsed by the RG (currently, in RG 1.200 Rev. 2. RG 1.200 Rev. 2 addresses the internal events ASME PRA Standard). Provide justification to show that where specific requirements in the standard are not met, it will not unduly impact the results.

Section 5.4 3c.

Document PRA peer review findings that are applicable to the parts of the PRA required for the application, and for those that have not yet been addressed justify why the significant contributors would not be impacted.

Section 5.4 3d.

Identify key assumptions and approximations relevant to the results used in the decision-making process.

Section 5.4.4

4.

Summarize the risk assessment methodology used to assess the risk of the application. Include how the PRA model was modified to appropriately model the risk impact of the change request.

Section 5.6.4 4a.

Include how the PRA model was modified to appropriately model the risk impact of the change request.

Section 5.6.4.2 5.4 Technical Adequacy of the PRA Models The GN119A version of the Ginna PRA model is the most recent evaluation of internal event risks. The Ginna PRA modeling is highly detailed, including a wide variety of initiating events, modeled systems, operator actions, and common cause events. The PRA model quantification process used for the Ginna PRA is based on the event tree / fault tree methodology, which is a well-known methodology in the industry.

Exelon Generation Company, LLC (EGC) employs a multi-faceted approach to establishing and maintaining the technical adequacy and plant fidelity of the PRA models for all operating EGC nuclear generation sites. This approach includes both a proceduralized PRA maintenance and update process, and the use of self-assessments and independent peer reviews. Prior to joining Evaluation of Proposed Changes 18 the EGC nuclear fleet in 2014, comparable practices were in place when Ginna was owned and operated by Constellation Energy Nuclear Group (CENG). Because of the similarities between the CENG and EGC practices, no additional discussion specifically regarding the legacy CENG approach will be provided. The following information describes the EGC approach (and by extension the CENG approach) to PRA model maintenance, as it applies to the Ginna PRA.

PRA Maintenance and Update The EGC risk management process ensures that the applicable PRA model is an accurate reflection of the as-built and as-operated plants. This process is defined in the EGC Risk Management program, which consists of a governing procedure (ER-AA-600, "Risk Management") and subordinate implementation training and reference materials (T&RM's).

EGC T&RM ER-AA-600-1015, "Full Power Internal Event (FPIE) PRA Model Update,"

delineates the responsibilities and guidelines for updating the full power internal events PRA models at all operating EGC nuclear generation sites.

ER-AA-600-1061, "Fire PRA Model Update and Control," delineates the responsibilities and guidelines for updating the station fire PRA.

The overall EGC Risk Management program, including ER-AA-600-1015 and ER-AA-600-1061, define the process for: implementing regularly scheduled and interim PRA model updates; for tracking issues identified as potentially affecting the PRA models (e.g., due to changes in the plant, industry operating experience, etc.), and; for controlling the model and associated computer files. To ensure that the current PRA model remains an accurate reflection of the as-built, as-operated plants, the following activities are routinely performed:

Design changes and procedure changes are reviewed for their impact on the PRA model.

New engineering calculations and revisions to existing calculations are reviewed for their impact on the PRA model.

Maintenance unavailabilitys are captured, and their impact on CDF is trended.

Plant specific initiating event frequencies, failure rates, and maintenance unavailabilitys are updated during each model update.

In addition to these activities, EGC risk management procedures provide the guidance for particular risk management maintenance activities. This guidance includes:

Documentation of the PRA model, PRA products, and bases documents.

The approach for controlling electronic storage of Risk Management products including PRA update information, PRA models, and PRA applications.

Guidelines for updating the full power, internal events PRA models for EGC nuclear generation sites.

Guidance for use of quantitative and qualitative risk models in support of the On-Line Work Control Process Program for risk evaluations for maintenance tasks (corrective maintenance, preventive maintenance, minor maintenance, surveillance tests and Evaluation of Proposed Changes 19 modifications) on systems, structures, and components (SSCs) within the scope of the Maintenance Rule (10 CFR 50.65(a)(4)).

A Full Power Internal Events (FPIE) model update to the Ginna PRA model was completed in 2019.

As indicated previously, RG 1.200 also requires that additional information be provided as part of the LAR submittal to demonstrate the technical adequacy of the PRA model used for the risk assessment. Each of these items (plant changes not yet incorporated in to the PRA model, relevant peer review findings, consistency with applicable PRA Standards, and the identification of key assumptions) will be discussed in turn.

5.4.1 Plant Changes Not Yet Incorporated into the PRA Model Each EGC station maintains an updating requirement evaluation (URE) database to track all enhancements, corrections, and unincorporated plant changes. During the normal screening conducted as part of the plant change process, if a potential model update is identified a new URE database item is created. Depending on the potential impact of the identified change, the requirements for incorporation will vary.

A review of all open URE items was performed for both Fire and FPIE PRA models. In particular, a detailed review was performed on 57 High or Medium priority open UREs for the FPIE and/or Fire PRA models. No open items were identified that would have anything other than a negligible impact on the conclusions of TSTF delta risk analysis or the TSTF results.

5.4.2 Applicability of Peer Review Findings A PRA model update was completed in 2009, resulting in the Ginna PRA Model 6.5. The Ginna PRA model was revised to meet RG 1.200, Revision 1 guidance and comply with the ASME/ANS PRA Standard RA-Sc-2007.

This model was peer reviewed under the auspices of the PWR Owners Group (PWROG) in the 2nd quarter of 2009. This peer review was performed following NEI 05-04, Revision 2 and NEI 00-02, Revision 1. This peer review included an assessment of the PRA model maintenance and update process.

Since the 2008 peer review, an application specific PRA model update was completed in 2012 to support implementation of NFPA-805 [G1-FQ-F001]. As part of the development of this model a peer review of the fire PRA was conducted in June of 2012. This peer review used NEI-07-12, Revision 1 to evaluate the model against the ASME PRA Standard (ASME/ANS RA-Sa-2009) along with the NRC clarifications provided in RG 1.200, Revision 2.

Since the 2012 peer review, several updates to the Ginna PRA have taken place. Both a Full Power Internal Events model update and NFPA-805 application specific update were completed in 2019. The latest FPIE model is the GN119A.

A technical adequacy evaluation was performed to support a similar risk-informed license amendment change, the TSTF-425, Relocate Surveillance Frequencies to Licensee Control, Licensing Amendment Request (LAR) and subsequent NRC Requests for Additional Information (RAIs). These documents, G1-LAR-001, G1-LAR-002 and G1-LAR-003, assess the impact of the Internal Events Peer Review Findings on TSTF-425, STI extension analyses. Table 5-2 Evaluation of Proposed Changes 20 summarizes peer review items that were specifically identified in the licensing documents to be reviewed for TSTF-425 and reviews the applicability for TSTF-411/418.

TABLE 5-2 PEER REVIEW ITEMS IDENTIFIED IN TSTF-425 FOR REVIEW URE ID DESCRIPTION IMPACT ON TSTF-411/418 DELTA RISK ANALYSIS 1215 Electrical breaker basic events to recover power to the sites safety-related 480V busses are modeled in the Level 1 (CDF) accident sequences but not in the Level 2 (LERF) accident sequences.

Issue discussed in response to RAI #15.

No impact on TSTF-411/418 analysis. The model has been updated to model these breakers for LERF scenarios.

1202 Review electrical bus safety system initiating event (SSIE) fault trees for Surveillance Test Interval (STI) change evaluations.

Discussed in response to RAI #3.

The subject electrical bus initiating events were reviewed for impact on this TSTF analysis. Any potential differences in Initiating Event frequencies would not have a significant impact on this analysis.

838 Core uncovery used as surrogate for core damage instead of core-exit thermocouple (CET) temperature > 1200 deg F for 30 minutes.

Issue discussed in response to RAI #4 In most cases, core damage occurs shortly after core uncovery, and, at core uncovery, heat removal or volume control is clearly lost. For large loss-of-coolant accidents (LOCAs), core uncovery can initially occur, but success of the 1 of 2 accumulators re-covers the core to prevent immediate core damage. The probability of a large LOCA and failure of the accumulators is a very low likelihood event and would not impact this assessment.

Additionally, using a longer time to core damage would allow more time for recoveries (e.g., manual initiation or alignment of required systems) which would reduce the impact of extending these surveillance frequencies.

837 No credit in Level 2 analysis was given to equipment survivability or human actions that could be impacted by containment failure.

Issue discussed in response to RAI #16.

The reason the equipment is currently assumed to fail is due to a complete loss of containment cooling. Even if some of the equipment did survive the excessive conditions, there would be little risk reduction due to the high failure likelihood.

This change only impacts the containment cooling equipment which is a tiny fraction of the delta risk. This URE has no impact on this TSTF-411/418 analysis.

835 No credit in Level 2 analysis taken for post-CDF operator actions. Potential action is to develop a human action for late reactor coolant system depressurization.

Issue discussed in response to RAI #15.

Similar to 837; This URE has no impact on this TSTF-411/418 analysis.

Evaluation of Proposed Changes 21 URE ID DESCRIPTION IMPACT ON TSTF-411/418 DELTA RISK ANALYSIS 834 No credit in Level 2 analysis taken for scrubbing. A sensitivity for impact of scrubbing was performed and it was determined that the impact of not considering scrubbing is negligible.

Issue discussed in response to RAI #17.

Similar to 837; This URE has no impact on this TSTF-411/418 analysis.

5.4.3 Consistency with Applicable PRA Standards As indicated above there have been two relevant peer reviews conducted on the current PRA model.

The 2009 peer review for the PRA ASME model update identified 309 Supporting Requirements (SR) applicable to the Ginna PRA. Of these 29 were not met, 2 met capability category (CC) 1, 13 partially met CC 2, 31 met CC 2, 22 partially met CC 3, 14 met CC 3, and 198 fully met all capability requirements. There were 24 finding-level facts and observations (F&O's) issued to address the identified gaps to compliance with the PRA standard. Subsequent to the peer review, 13 of the findings have been addressed and 11 are still open pending the next model update. The 24 F&O's are listed in Table 5-3 which includes what, if any impact, there may be to the assessment of STIs for the TSTF Initiatives.

The 2012 fire PRA peer review for the PRA ASME model update identified 183 Supporting Requirements (SR) to be reviewed for the Ginna PRA. Of these 2 were not met, 2 met capability category (CC) 1, 8 partially met CC 2, 17 met CC 2, 13 partially met CC 3, 7 met CC 3, and 118 fully met all capability requirements and 16 were not applicable. There were 19 findings and 22 suggestions issued to address potential gaps to compliance with the PRA standard. There were 3 Best Practices. All of the findings from the fire PRA peer review have since been closed. As the result of this peer review have already been communicated to the NRC as part of the NFPA 805 LAR (ML13093A064) and subsequent requests for additional information (RAI), these will not be catalogued in this document.

All remaining gaps have been reviewed for consideration during the 2015 and 2019 model updates but are judged to have low impact on the PRA model or its ability to support a full range of PRA applications. The remaining gaps are documented in the URE database so that they can be tracked, and their potential impacts accounted for in applications where appropriate.

Evaluation of Proposed Changes 22 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 C12

[2005:

IE-C10]

URE 845 COMPARE results and EXPLAIN differences in the initiating event analysis with generic data sources to provide a reasonableness check of the results.

Open F&O IE-C10-01: The Ginna Initiating Event Notebook (G1-IE-0001, Rev. 1) Section 4.3 provides a cross-reference between the Ginna Initiating Events and the "NRC Rates of Initiating Events" in table 4-7. Table 4-7 cross-reference includes columns for NUREG/CR-5750 Category and NP-2230 EPRI/NUREG/CR-3862 PWR Category.

Table 4-8 provides a cross-reference between Ginna and similar PWR plants (Point Beach, Prairie Island, and Kewaunee).

An explanation of differences in Initiating Events between Ginna and similar PWRs is contained in the PRA Quantification (QU) Notebook (G1-QU-0001, Rev. 0) Table 4-5 "Comparison of Ginna Core Damage Results to Similar Plants". However, no explanation of differences between plant-specific initiating events and generic initiating events was located in either the Initiating Event Notebook (G1-IE-0001, Rev. 1) or QU Notebook (G1-QU-0001, Rev. 0).

Documentation only:

Provide comparison of core damage results based on generic data cross-referenced in Table 4-7.

This item is a documentation issue. No impact on TSTF-411/418 analysis.

IE-C15

[2005:

IE-C13]

URE 847 CHARACTERIZE the uncertainty in the initiating event frequencies and PROVIDE mean values for use in the quantification of the PRA results.

Open F&O IE-C13-01: G1-IE-0001, PRA INITIATING EVENT (IE) NOTEBOOK, Section 5 documents assumptions and sources of uncertainty. However, section 5 does not provide or reference the parametric uncertainty initiating event data distribution. For example, the distribution for TIGRLOSP is identified in the CAFTA model, newauto_65a-w-Fld.caf, has having an EF of 7.39.

However, no documentation for the error factor could be found. Therefore, this SR is not met.

Documentation only:

Include error factors and brief discussion about IE frequency uncertainty.

This item is a documentation issue and IE frequency distribution evaluation. Changes will not impact the TSTF-411/418 analysis SC-A2 SPECIFY the plant parameters (e.g., highest node temperature, core collapsed liquid level) and associated acceptance criteria (e.g., temperature Open F&O SC-A2-01: The definition of core damage documented in the Ginna-AS-Notebook-Rev-1 Section 2.2 is consistent with the examples of measures for core damage suitable for Capability Category I as defined in NUREG/CR-4550. For Category II Ginna could use the code-predicted core exit temperature >1,200°F for 30 min We agree with the peer reviewers that the approach taken in the Ginna PRA is overly conservative and not consistent with the Over the typical complete loss of decay heat removal timing success criteria, the delta time between core uncovery and CET temperatures Evaluation of Proposed Changes 23 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 limit) to be used in determining core damage.

Select these parameters such that determination of core damage is as realistic as practical, in a manner -

consistent with current best practice. DEFINE computer code-predicted acceptance criteria with sufficient margin on the code-calculated values to allow for limitations of the code, sophistication of the models, and uncertainties in the results, in a manner consistent with the requirements specified under HLR-SC-B.

Examples of measures for core damage suitable for Capability Category II/III, that have been used in PRAs, include (a) collapsed liquid level less than 1?3 core height or code-predicted peak core temperature >2,500°F (BWR) (b) collapsed liquid level below top of active fuel for a prolonged period, or code-pre-dicted core peak node temperature >2,200°F using a code with detailed core modeling; or code-predicted core peak node using PCTRAN (code with simplified core modeling (PWR)).

requirements of Category II. The peer reviewers suggested using a core exit temperature of 1200°F for 30 minutes as the criterion for core damage, but we would recommend using either that criterion or a peak core node temperature of 1800°F. Based on a review of the PCTRAN results, it is likely that the 1800°F peak core temperature would be reached earlier than the time at which the core exit temperature would be greater than 1200°F for 30 minutes.

reach 1200°F for 30 minutes or 1800° peak center line is fairly small.

As such, the timing benefit is not expected to be large except for the fast moving events such as large break LOCAs.

For these events, we use the UFSAR success criteria. Although this is not expected to be a significant effect, we do remain a conservative CAT I. Therefore, the model used for TSTS-411/418 analysis may be conservative.

Evaluation of Proposed Changes 24 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 temperature >1,800°F using a code with simplified (e.g., single-node core model, lumped para-meter) core modeling; or code-predicted core exit temperature >1,200°F for 30 min using a code with simplified core modeling (PWR).

SC-A4 IDENTIFY mitigating systems that are shared between units, and the manner in which the sharing is performed should both units experience a common initiating event (e.g.,

LOOP).

Complete F&O SC-A4 Operator action RCHFDX1BAF (operator fails to align BAF given 1 of 2 PORVs and no charging) is not included in the fault tree model. It appears that this event should be added in Event Tree TIU Sequence 5 Failures under gate TL_FB.

This is an omission in the model and may affect CDF and LERF.

Add RCHFDX1BAF to the Event Tree TIU, as appropriate.

No impact to TSTF-411/418. Action placed in Event Tree TIU logic and Finding addressed.

SY-A10 [SY-A11 - 2005]

INCORPORATE the effect of variable success criteria (i.e., success criteria that change as a function of plant status) into the system modeling. Example causes of variable system success criteria are:

(a) different accident scenarios. Different success criteria are required for some systems to mitigate different Complete SY-A11 Gate TL_FBHRD1 input to gate TL_FB for failure of Bleed and Feed models success as requiring 1 SI pump and 1 PORV. The logic does not include 75 gpm charging flow which is noted in the Success Criteria notebook as required to support single PORV success.

This was confirmed through discussion with Ginna PRA personnel.

The omission of a needed mitigating system for support of the Bleed and Feed function may underestimate the importance of these sequences for applications.

Review the Bleed and Feed modeling to ensure the system failures appropriately reflect the success criteria.

No impact as the Finding has been addressed and the logic has been updated and documented in the Success Criteria Notebook.

Evaluation of Proposed Changes 25 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 accident scenarios (e.g.,

the number of pumps required to operate in some systems is dependent upon the modeled initiating event).

(b) dependence on other components. Success criteria for some systems are also dependent on the success of another component in the system (e.g., operation of additional pumps in some cooling water systems is required if noncritical loads are not isolated).

(c) time dependence.

Success criteria for some systems are time-dependent (e.g., two pumps are required to provide the needed flow early following an accident initiator, but only one is required for mitigation later following the accident).

(d) sharing of a system between units. Success criteria may be affected when both units are challenged by the same initiating event (e.g.,

LOOP).

Evaluation of Proposed Changes 26 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 SY-A14 [SY-A13 2005]

When identifying the failures in SY-A11 INCLUDE consideration of all failure modes, consistent with available data and model level of detail, except where excluded using the criteria in SY-A15.

For example:

(a) active component fails to start (b) active component fails to continue to run (c) failure of a closed component to open (d) failure of a closed component to remain closed (e) failure of an open component to close (f) failure of an open component to remain open (g) active component spurious operation (h) plugging of an active or passive component (i) leakage of an active or passive component (j) rupture of an active or passive component (k) internal leakage of a component (l) internal rupture of a component (m) failure to provide Complete SY-A13 Inconsistencies existed in the system modeling of the city water system. Where used to support the GE-Betz system, a basic event for unavailability of city water due to grid LOOP was added (basic event CDAACITYWATER). This same event was not added to the city water modeling for support of the SAFW system.

Review the need to add the unavailability event in the SAFW System.

No impact to TSTF411/418. The dependencies for SAFW have been updated in the Ginna PRA.

Evaluation of Proposed Changes 27 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 signal/operate (e.g.,

instrumentation)

(n) spurious signal/operation (o) pre-initiator human failure events (see SY-A16)

(p) other failures of a component to perform its required function 62 SY-A19 [SY-A18 2005]

In the systems model, INCLUDE out-of-service unavailability for components in the system model, unless screened, in a manner consistent with the actual practices and history of the plant for removing equipment from service.

(a) INCLUDE (1) unavailability caused by testing when a component or system train is reconfigured from its required accident mitigating position such that the component cannot function as required (2) maintenance events at the train level when procedures require isolating the entire train for maintenance Open SY-A18 Ginna PRA System Notebooks provides a list of all the modeled T&M terms in Section 3.4.C. Section 2.9 of the notebooks provide discussion of procedures and testing that result in Unavailability. The review of these sections found no instances of simultaneous unavailability that can result from planned activities. However, the PRA engineer noted in a discussion that some systems are shadowed in planned maintenance. There is not a specific discussion on plant maintenance practices within the (a)(4) program that would result in planned unavailability of multiple systems OOS (i.e., EDG outages combined with AFW motor driven pump outages to lower total risk as opposed to performing the work independently), or of planned activities resulting in multiple components OOS that do not violate technical specifications (e.g., two AFW pumps in maintenance or an AFW and SAFW pump in maintenance at the same time). If work is done in this manner, it may be appropriate to account for the unavailability of both SSCs in a single term.

Modeling of station maintenance practices that result in planned maintenance evolutions with more than a single PRA component OOS (i.e., shadowing equipment outages) can help to minimize the number of random failure sequences and ensure there is not "double counting" of unavailability in the PRA.

Determine if any maintenance practices are performed that result in overlapping unavailability of multiple systems. If it is determined that simultaneous unavailability is possible, model these occurrences as a single unavailability event in the PRA or justify why the unavailability is treated as separate events and include this as a potential source of model uncertainty.

Also, consider adding a specific question to the system engineers questionnaire for each system to determine if there are planned evolutions that If shadowed unavailability is in-fact significantly affecting the unavailability numbers, then this would conservatively affect TSTF-411/418 analysis.

The most significant unavailabilities are related to MSPI related functions which are less likely to include conservative data.

Evaluation of Proposed Changes 28 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 (3) maintenance events at a sub-train level (i.e.,

between tagout boundaries, such as a functional equipment group) when directed by procedures (b) Examples of out-of-service unavailability to be modeled are as follows:

(1) train outages during a work window for preventive/corrective maintenance (2) a functional equipment group (FEG) removed from service for preventive/corrective maintenance (3) a relief valve taken out of service represent simultaneous unavailability of multiple SSCs.

HR-G3 When estimating HEPs EVALUATE the impact of the following plant-specific and scenario-specific performance shaping factors:

(a) quality [type (classroom or simulator) and frequency] of the operator training or experience (b) quality of the written procedures and Complete F&O HR-G3-01: Details regarding certain elements of the analysis were lacking in the HRA Calculator for a sufficient number of HFEs to judge that this requirement was not met. Evidence that the relevant aspects cited in the SR are addressed for each HFE is critical to assuring that an appropriate analysis has been performed. This is particularly important in the case of HRA, for which the methods are less straightforward than they are for many other parts of the PRA.

Issue: In item (d) of CC II, III, clarify that

'clarity' refers to the meaning of the cues, etc. In item (g) of CC II, III, clarify that complexity refers to both determining the need for and executing the required response.

Resolution: Cat I, II, and III: (d) degree of clarity of the meaning No impact to TSTF 411/418. The HRAs have been reviewed to ensure the needed parameters for the evaluation have been populated. CBDM is now used as a max function of CBDT and HCR/ORE.

RCHFDMAKEUP as a specific example has a timing basis from Key Input 51. When the Evaluation of Proposed Changes 29 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 administrative controls (c) availability of instrumentation needed to take corrective actions (d) degree of clarity of the cues/indications (e) human-machine interface (f) time available and time required to complete the response (g) complexity of the required response (h) environment (e.g.,

lighting, heat, radiation) under which the operator is working (i) accessibility of the equipment requiring manipulation (j) necessity, adequacy, and availability of special tools, parts, clothing, etc.

of cues / indications (g) complexity of detection, diagnosis and decision-making, and executing the required response.

annunciator model is used, there is a clear discussion as to the applicability.

HR-I1 DOCUMENT the human reliability analysis in a manner that facilitates PRA applications, upgrades, and peer review.

Complete F&O HR-I1-01: The bulk of the documentation for the HRA is provided in the HRA Calculator. There are numerous areas in which the documentation is incomplete.

The documentation should include a fuller discussion of the cues, bases for timing, specific procedure steps, and other aspects that could affect the analyses.

Documentation only.

Same issue as for HR-G3.

No impact to TSTF 411/418. This item has been addressed. See HR-G3.

QU-B5 Fault tree linking and some other modeling approaches may result in circular logic that must be broken before the model is Open F&O QU-B5-01: In Section 3.1 of the QU Notebook, a mention is made that circular logic checks were performed on the integrated top logic model to ensure it did not exist.

An example is listed, but there is no further discussion.

System notebooks reviewed generally state in Section 3.3 Documentation only:

Provide a discussion in the Quantification Notebook Section 3.1 of the methodology The circular logic process is self-revealing when a support gate is added to the tree the CAFTA software identifies a Evaluation of Proposed Changes 30 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 solved. BREAK the circular logic appropriately.

Guidance for breaking logic loops is provided in NUREG/CR-2728 [2-13].

When resolving circular logic, DO NOT introduce unnecessary conservatisms or non-conservatisms.

what was done when circular logic was identified, but no discussion of the methodology was provided nor how conservatisms or non-conservatisms are avoided. No evidence that the required analysis was not performed.

used to address circular logic.

circular logic issue. The circular logic is broken by inserting as much of the logic clip into the tree as possible. Providing more examples of this in the documentation is not expected to affect the TSTF-411/418 evaluation.

LE-C2

[2005:

LE-C2a]

INCLUDE realistic treatment of feasible operator actions following the onset of core damage consistent with applicable procedures, e.g.,

EOPs/SAMGs, proceduralized actions, or Technical Support Center guidance.

Open F&O LE-C2a-01: It is conservative to NOT take credit for operator actions post core damage. This is a requirement of the standard to move from Category I to Category II.

There are limited operator actions that could influence LERF at Ginna, so the effect of such actions is not likely to be significant.

Moreover, it is likely that there will not be a need for a Category II rating in this area to meet the requirements for most risk-informed applications. One approach to reaching Category II would be to include post-core damage operator actions in the PRA. It is also possible that simply identifying operator actions and showing quantitatively that they will have a negligible impact on LERF will be sufficient to meet the There are limited operator actions that could influence LERF at Ginna, so the effect of such actions is not likely to be significant. If post-core-damage operator actions are credited, LERF estimates could be reduced, but the impact would be minimal. The omission of these operator actions is conservative and does not adversely impact the use of the model for TSTF-411/418 analysis.

Evaluation of Proposed Changes 31 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 requirements of Category II.

LE-C11

[2005:

LE-C9a]

JUSTIFY any credit given for equipment survivability or human actions that could be impacted by containment failure.

N/A F&O LE-C9a-01: It does not appear that credit was taken for continued operation of equipment and operator actions that could be impacted by containment failure. This is a requirement of the standard to move from Category I to Category II.

The requirement is to justify credit taken for equipment survivability or human actions that could be affected by containment failure.

Since no such credit was taken, the SR should have been judged as not applicable (N/A). This is analogous to the assessment of LE-C7 (old LE-C6) which was judged by the peer reviewers as N/A because human actions that support the accident progression analysis were not credited.

Also, note that, in the Calvert Cliffs peer review, the peer reviewers judged this SR as N/A for the same reason. Only if post-containment failure equipment operations or human actions are modeled in the future would it be necessary to provide engineering analysis As no equipment or HRA is credited post-containment failure, the PRA model remains a conservative CAT I.

Evaluation of Proposed Changes 32 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 and written justification as part of the PRA documentation.

Otherwise, no additional work is needed.

LE-C13 [2005 LE-C10]

PERFORM a containment bypass analysis in a realistic manner. JUSTIFY any credit taken for scrubbing (i.e., provide an engineering basis for the decontamination factor used).

N/A F&O LE-C10-01: Credit for scrubbing was not taken. A sensitivity for impact of scrubbing was performed and it was determined that the impact of not considering scrubbing is negligible. This is a requirement of the standard to move from Category I to Category II.

Review the possible credit for release scrubbing to reduce LERF.

No impact to TSTF 411/418. A sensitivity for impact of scrubbing was performed and it was determined that the impact of not considering scrubbing is negligible.

MU-D1 URE 816 A PRA Configuration Control Program shall be in place. It shall contain the following key elements:

(a) a process for monitoring PRA inputs and collecting new information (b) a process that maintains and upgrades the PRA to be consistent with the as-built, as operated plant (c) a process that ensures that the cumulative impact of pending changes is considered when applying the PRA (d) a process that maintains configuration Complete F&O MU-D1 PRA Configuration Control procedure (GNG-CM-1.01-3003) Step 5.13 provides guidance for updating risk-informed applications. The process described depends upon a database maintained by the Fleet PRA Services Supervisor to identify current living applications requiring change assessment other than those related to maintenance rule performance criteria.

No such database could be identified for Ginna.

Without a current list of risk-informed applications, the maintenance and update process is dependent upon the knowledge and experience of the staff to know which applications require update. This creates the possibility that an application could be missed in the update process.

The CRMP database has a placeholder for a listing of PRA applications. This portion of the database has been populated to ensure all applications requiring update following a model revision can be easily identified.

This configuration control issue has been addressed. No impact to TSTF-411/418.

Evaluation of Proposed Changes 33 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 control of computer codes used to support PRA quantification (e) documentation of the Program IFSO-A4

[2005: IF-B2]

For each potential source of flooding water, IDENTIFY the flooding mechanisms that would result in a fluid release.

INCLUDE:

(a) failure modes of components such as pipes, tanks, gaskets, expansion joints, fittings, seals, etc.

(b) human-induced mechanisms that could lead to overfilling tanks, diversion of flow through openings created to perform maintenance; inadvertent actuation of fire suppression system (c) other events releasing water into the area Complete F&O IF-B2-01: Failure mechanisms are addressed in conjunction with the calculation of flood frequencies, in Section 5.2 of document 51-9100978-000. Failures of components in piping systems other than tanks are explicitly addressed by the EPRI pipe failure data base.

This was the source employed to characterize the frequencies of floods for Ginna. There has, however, been a very limited attempt to address human-induced flood mechanisms, as required by item (b) of SR IF-B2.

Such events have been important causes of flooding in the operating experience for US nuclear power plants, and as noted above the assessment of such floods is explicitly required.

A more systematic consideration should be made of human-caused floods. This will need to include an assessment of generic data related to human-caused floods, per SR IF-D6.

Address the potential for human-caused flooding in the Internal Flooding Study (51 -

9100978 - 000).

Describe the situations where a human error could result in flooding (e.g., inadvertent valve opening, inadvertent train realignment, doors left open) and estimate the probabilities of such events. Model such floods that cannot be screened. Consistent with the Standard, utilize generic data as required by SR IFEV-A7 (IF-D6 in 2005 Standard)

No impact to TSTF 411/418. Discussion of human caused floods is discussed in detail in Section 3.3 and 5.3 of Internal Flood Notebook (G1-IF-0000-r1) for various systems. Based on the analyses performed, one maintenance induced flood was added to the model, FL-ABO-M-SW -

2,000 gpm SW flood in the Aux Building due to maintenance, isolated within 65 minutes.

IFSN-A6

[2005: IF-C3]

URE 806, 1179 For the SSCs identified in IFSN-A5 (2005 text: IF-C2c), IDENTIFY the susceptibility of each SSC in a flood area to flood-induced failure mechanisms.

Open F&O IF-C3-01: There is no discussion of failures due to jet impingement or pipe whip. There is limited consideration of failure due to humidity/high temperature due to failure of heating steam lines. There is also no discussion of criteria employed to consider the potential for spray failures.

Cat II: INCLUDE failure by submergence and spray in the identification process.

ASSESS qualitatively the impact of flood-Failures due to jet impingement and pipe whip are now discussed in Section 3.3.1 of the Internal Flood Notebook G1-IF-0000 r1. Failures due to Spray are Evaluation of Proposed Changes 34 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 INCLUDE failure by submergence and spray in the identification process.

EITHER:

a) ASSESS qualitatively the impact of flood-induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions; OR b) NOTE that these mechanisms are not included in the scope of the evaluation.

To meet Capability Category II, it is necessary either to provide at least a qualitative assessment of the potential for jet impingement and pipe whip, or to state that these failure mechanisms were not considered. It is also required that potential spray failures be evaluated. While spray failures are discussed, there are no criteria specified that would provide assurance that they had been considered in a consistent and adequately comprehensive manner.

Provide the requisite discussion of pipe whip and jet impingement to satisfy the standard. Specify appropriate criteria for spray impacts, and assure that the potential spray failures adequately reflect these criteria.

induced mechanisms that are not formally addressed (e.g., using the mechanisms listed under Capability Category III of this requirement), by using conservative assumptions.

[SAIC note: these mechanisms include submergence, spray, jet impingement, pipe whip, humidity, condensation, temperature concerns]

Revise the Internal Flooding Study (51 -

9100978 - 000) to describe the criteria used to determine the potential for failure resulting from spray.

Reference Appendix C for a listing of components impacted by spray. Describe how potential spray impact was addressed in the model. Confirm that the assignment of spray impact is consistent with the criteria used.

In addition, include a qualitative discussion of the potential impact discussed in Section 3.3.2. Impacts due to spray were assumed to exist within 10 feet of a break location (modeled).

Spray events are discussed in the IF Flood notebook Section 4.5.

Two locations were identified in the Aux Building where Fire Service Water could impact safety related busses and these are explicitly modeled (FL-ABM-FSW-BUS15 and FL-ABO-FSW-BUS14).

URE 1179 documents that IF Notebook needs Appendix C completed to complete documentation of spray impacts and modeling of additional spray floods if appropriate. This would be evaluated for any potential impacts to a surveillance frequency interval extension at the time of the evaluation but is not expected to have a significant impact.

Evaluation of Proposed Changes 35 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 of jet impingement, pipe whip, humidity, condensation, and temperature effects.

IFSN-A8

[2005:

IF-C3b]

IDENTIFY inter-area propagation through the normal flow path from one area to another via drain lines; and areas connected via back flow through drain lines involving failed check valves, pipe and cable penetrations (including cable trays), doors, stairwells, hatchways, and HVAC ducts. INCLUDE potential for structural failure (e.g., of doors or walls) due to flooding loads.

Complete F&O IF-C3b-01: The analysis does not document consideration of potential barrier failures due to flooding loads (structural failures, failures of doors, etc.) This is required to meet capability categories beyond Capability Category I.

Review flood barriers and identify and evaluate any whose failures could contribute adversely to propagation of flooding Cat II, III: IDENTIFY inter-area.

INCLUDE potential for structural failure (e.g., of doors or walls) due to flooding loads and the potential for barrier unavailability, including maintenance activities.

Include a discussion of the potential for barrier failure due to flooding, including structures and doors. For walls, a qualitative discussion would appear to be acceptable. For doors, however, specific failure criteria should be developed and described.

Flood scenarios should be reviewed and revised, if necessary, to address the potential failure of doors.

A discussion of structural failure of barriers credited as barriers has been added to the IF Notebook r1, Section 4.2.1.

IFSN-A16

[2005: IF-C8]

URE 1176 USE potential human mitigative actions as additional criteria for screening out flood sources if all the following can be shown:

Open F&O IF-C8-01: Only one flood appears to have been screened based on qualitative consideration of potential human action; for that action (2000 gpm FSW break in IBN), there doesn't appear to be any justification for the time identified (190 min). Nothing other than time available is cited as rationale for screening the event.

Characterize in greater detail those potential human actions that could terminate the event and develop an estimate of the likelihood of failing to mitigate the pipe break The screened flood added to the flood model (URE 1176). The impact is minimal.

Evaluation of Proposed Changes 36 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 (a) flood indication is available in the control room; (b) the flood source can be isolated; and (c) the mitigative action can be performed with high reliability for the worst flooding initiator (2005 text: flood from that source). High reliability is established by demonstrating, for example, that the actions are procedurally directed, that adequate time is available for response, that the area is accessible, and that there is sufficient manpower available to perform the actions.

To meet Capability Category II, it is necessary to characterize potential human actions that could terminate flooding more explicitly than was done in this case.

Address the required aspects for this and any other human actions used in justifying screening out flood scenarios.

using accepted HRA methods.

IFEV-A6

[2005: IF-D5a]

GATHER plant-specific information on plant design, operating practices, and conditions that may impact flood likelihood (i.e., material condition of fluid systems, experience with water hammer, and maintenance-induced floods). In determining the flood-initiating event frequencies for flood scenario groups, USE a combination of the Open F&O IF-D5a-01: The current analysis does not adequately address plant-specific characteristics that might affect the manner in which the frequencies of flooding are estimated.

To meet Capability Category II, it is required that plant-specific information be collected and considered on a variety of aspects (including material condition of fluid systems, experience with water hammer, and maintenance-induced floods). The current analysis is limited to the use of generic failure rates. This is consistent with Capability Category I.

Address potential issues with material condition, experience with water hammer, etc. In particular, further attention should be paid to the possibility of maintenance-induced and other human-caused flooding.

Address potential issues with material condition and water hammer using plant-specific information.

Use this information to revise, if necessary, piping failure frequencies available in industry-wide sources, consistent with the Standard.

For maintenance-induced and other human-caused Plant specific experience with internal flooding, water hammer is addressed in the IF Notebook rev 1 in Sections 3.3. A discussion of Human-induced floods is contained in Section 5.3.

Regarding any effect on flood frequency due to aging affects, a sensitivity evaluation for a particular STI evaluation would Evaluation of Proposed Changes 37 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 following (2005 text does not include "of the following")

(a) generic and plant-specific operating experience; (b) pipe, component, and tank rupture failure rates from generic data sources and plant-specific experience; (2005 text:

and)

(c) engineering judgment for consideration of the plant-specific information collected.

flooding, see IFSO-A4.

URE 1153 was written to consider updating flood frequency for aging affects based on EPRI-302000079 Rupture frequencies.

show if there was any impact.

IFEV-A7

[2005: IF-D6]

INCLUDE consideration of human-induced floods during maintenance through application of generic data.

complete F&O IF-D6-01: Initiating events that could result from human actions were considered only for a small number of possible maintenance activities. These flood contributors were not evaluated using generic data as required.

Operating experience for nuclear power plants has provided evidence that human-caused floods can be important. The SR requires that such floods be evaluated using at least generic data to meet Capability Category I or II.

Perform a more detailed assessment of potential human-caused floods, and apply at least generic data to characterize their frequencies.

See IFSO-A4.

Discussion of human caused floods is discussed in detail in Section 3.3 and 5.3 of Internal Flood Notebook (G1-IF-0000-r1) for various systems. Based on the analyses performed, one maintenance induced flood was added to the model, FL-ABO-M-SW -

2,000 gpm SW flood in the Aux Building due to maintenance, isolated within 65 minutes.

IFEV-A8

[2005: IF-D7]

SCREEN OUT flood scenario groups if complete F&O IF-D7-01: Quantitative screening of some scenarios was performed, but it is not clear what criteria were applied Update the Internal Flooding Study (51 -

No impact to TSTF 411/418. This issue has Evaluation of Proposed Changes 38 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 (a) the quantitative screening criteria in IFSN-A10 (2005 text: IE-C4), as applied to the flood scenario groups, are met; OR (b) the internal flood-initiating event affects only components in a single system, AND it can be shown that the product of the frequency of the flood and the probability of SSC failure given the flood is two orders of magnitude lower than:

the product of the non-flooding frequency for the corresponding initiating events in the PRA, AND the random (non-flood-induced) failure probability of the same SSCs that are assumed failed by the flood.

If the flood impacts multiple systems, DO NOT screen on this basis.

in doing so. The criteria should be defined and applied in a clear and consistent manner.

SRs IF-D7 and IF-E3a provide explicit criteria for performing quantitative screening of flood scenarios. The IF Notebook documents that some scenarios were screened on low frequency, but does not invoke any particular criteria in doing so.

Provide a clear set of criteria for performing quantitative screening of flood scenarios, and apply the criteria in a clear and consistent manner.

9100978 - 000) to describe the criteria used to screen flood scenarios. If current screening criteria are not well defined, develop such criteria and apply them to scenarios addressed in the analysis.

been addressed. Internal Flood Notebook Section 4.6, Screening Scenarios and Sources, was updated to document the screening criteria used.

Figure 4.1, was added which shows the Screening Criteria and Table 4.6 was edited to show the screening criterion used for various flood scenarios.

IFQU-A5

[2005: IF-E5]

If additional human failure events are required to support quantification of flood scenarios, PERFORM any human reliability analysis in accordance with the applicable requirements Complete F&O IF-E5-01: It was not clear that the requirements were met in all cases. For example, interviews to establish aspects such as response times were apparently performed as part of the flood analysis, but the HRA was dramatically changed and new interviews/changes were not incorporated, nor were any inputs obtained from the Re-examine each HFE included in the flooding analysis. Perform operator interviews as needed or identify and document previously performed interviews.

No impact to TSTF-411/418.

Ginna Station Flooding Human Reliability Analysis (HRA) documents the flood recovery actions (Areva Evaluation of Proposed Changes 39 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 described in 2-2.5 (2005 text: Tables 4.5.5-2(e) through 4.5.5-2(h)).

HRA performed as part of the flood analysis carried forward.

It is necessary to perform the assessment of HFEs associated with internal flooding in the same manner as for other HFEs. The requirements to confirm procedure paths, timing, etc. via interviews with operators were not met for a number of events.

Re-examine the HFEs associated with internal flooding, and either perform needed operator interviews or identify and document existing inputs.

Required operator interviews should comprise the following:

1. evaluate the flooding events based on similarities to identify a select set of scenarios to review with the operators (for example, categorized by the system that generated the flood, e.g., fire protection)

2. schedule interview sessions of about 1/2 hour to an hour per each flooding scenario, conducted separately with two different operators (preferably one experienced, one novice) to get diverse opinions.

3. include questions on timing consistent with the HRA Calculator Time Window screen for time of cue, time to diagnosis, time for execution/manipulation of action (including travel time, with potential flood-related access delays). Be sure to ask about any Document No.: 51-9099406-000 located in GSN 0157). The information and HRA values in this notebook were verified to be consistent with the HRA actions being used in the internal flood model. No additional interviews were identified as being necessary.

Evaluation of Proposed Changes 40 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 differences for floods initiated in same system but in different rooms.

4. document interviews during the sessions (notes and/or tape recordings) and later in the HRA Calculator screens for Operator Interviews and Time Window.

Estimate and document internal flooding HFEs using the same approach as was used for other HFEs in the PRA.

Recalculate flood scenario frequencies based on the new HFEs.

IFQU-B1

[2005: IF-F1]

URE 813 DOCUMENT the internal flood accident sequences and quantification in a manner that facilitates PRA applications, upgrades, and peer review.

Open F&O IF-F1-01: The documentation is comprised primarily of the internal flooding notebook, supplemented heavily with information provided in a set of Excel worksheets. The notebook is annotated to provide a link to elements of the worksheets, and an "assumption" provides the formal tie between the notebook and the worksheets. Some areas in which the links were indirect or missing were noted.

In general, the manner in which important parts of the flood analysis are documented in what would usually be characterized as an informal set of worksheets is judged not to meet the requirement that the analysis be documented in a manner that facilitates applications, upgrades, and peer review.

Documentation only:

Revise the Internal Flooding Study (51 -

9100978 - 000) to meet the documentation requirements of the 2009 Standard.

Address NRC Resolutions as appropriate.

It is recommended that the Study be This documentation item will not impact the TSTF-411/418 analysis. This item has largely been addressed by adding tables in Section 5.2 that show the development of each initiating event frequency, adding an Initiating Event Summary Table (section 5.2.17),

adding a simplified set of arrangement drawings showing each flood area Evaluation of Proposed Changes 41 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 In addition to developing a single integrated set of documentation for the internal flood analysis, there were several areas in which additional documentation would make the analysis more tractable have been provided in connection to other SRs. These include the following:

Include a set of simplified arrangement drawings to explicate the definition of flood areas and help in understanding aspects such as flood propagation.

Tabulate the flood areas and identify clearly which are screened and which retained for further analysis to make the process more tractable. Specify clearly which criteria (qualitative or quantitative) are employed in screening each flood area.

Define explicitly the criteria used to perform quantitative screening as noted in Section 6.0.

Define the criteria used to determine whether a PRA component was susceptible to failure due to spray.

reformatted to be consistent with the HLRs and SRs of the Standard, integrating appropriate parts of the worksheets into the primary document.

This will provide a document that can be easily reviewed against the standard and easily followed by personnel not involved in the original analysis.

Consistent with the F&O, include the following in the revised Study:

Include a set of simplified arrangement drawings to explicate the definition of flood areas and help in understanding aspects such as flood propagation.

Tabulate the flood areas and identify clearly which are screened and which retained for further analysis to make the process more tractable. Specify clearly which criteria (qualitative or (Appendix K), defining spray modeling criteria (Section 3.3.2) and identifying for each flood area whether it was screened and the screening criterion used (Table 4.6). The remaining item is to develop the criteria used to perform quantitative screening, if applicable, in Section 6.0 (URE 1177).

Evaluation of Proposed Changes 42 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 quantitative) are employed in screening each flood area.

Define explicitly the criteria used to perform quantitative screening as noted in Section 6.0.

Define the criteria used to determine whether a PRA component was susceptible to failure due to spray.

IFQU-B3

[2005: IF-F3]

DOCUMENT sources of model uncertainty and related assumptions (as identified in QU-E1 and QU-E2) associated with the internal flood accident sequences and quantification.

(2005 text: Document the key assumptions and the key sources of uncertainty associated with the internal flooding analysis.)

Open F&O IF-F3-01: Section 7 of the IF Notebook provides a discussion of three areas considered to be major sources of uncertainty in the flood analysis. This does not constitute an adequate characterization of the sources of uncertainty associated with the flood analysis or a comprehensive discussion of the assumptions that could have an effect on the results.

A reasonably thorough investigation of sources of uncertainty is necessary for proper characterization of the flood analyses and results.

A more comprehensive characterization of sources of uncertainty, comparable to that provided for other areas of the PRA, should be developed for the internal flood analysis.

Documentation only:

Update the discussion of assumptions and uncertainty to be consistent with the 2009 Standard. The 2005 Standard required the documentation of key assumptions and key sources of uncertainty, while the 2009 Standard eliminates the term "key." The equivalent sections of other PRA technical elements provide an example of the detail that is required. In addition, the discussion of uncertainty and impact This documentation issue will not affect the TSTF-411/418 analysis. This issue has been partially addressed by the calculation of error factors for the flood initiating events. These have been added to table 5-2, flood frequencies.

Remaining action is to reference any key sources of uncertainty from the EPRI guideline on the treatment of uncertainty for ASME PRA Standard SRs related to internal flooding in Section 7 of the PRA Internal Evaluation of Proposed Changes 43 TABLE 5-3 INTERNAL EVENTS PRA PEER REVIEW - FINDINGS SR TOPIC STATUS FINDINGS DISPOSITION IMPACT TO TSTF-411/418 of assumptions in the Quantification Notebook should be revised to include treatment of flood issues (or alternately, a similar treatment should be provided in the Flood Notebook).

Flooding Analysis System Notebook (URE 1178)

Evaluation of Proposed Changes 44 5.4.4 Identification of Key Assumptions and Limitations The Ginna PRA models contain a number of modeling assumptions and limitations which may affect risk informed decision making. Section 4.3.7 of the PRA Quantification Notebook (G1-PRA-014, Revision 2) outlines these assumptions and discusses them in detail. A review of these limitations shows that the only one related to the RTS/ESFAS systems is the assumption that a failure to scram under large or medium LOCA conditions is assumed to result in core damage. This modeling assumption is conservative, but not significant due to the low probability of a large or medium LOCA coincident with a RTS failure. Based on this review, there were no identified modeling assumptions or limitations that would have an impact on this application.

5.4.5 External Events Considerations External hazards were evaluated in the Ginna Individual Plant Examination of External Events (IPEEE) submittal in response to the NRC IPEEE Program (Generic Letter 88-20, Supplement 4).

The IPEEE Program was a one-time review of external hazard risk and was limited in its purpose to the identification of potential plant vulnerabilities and the understanding of associated severe accident risks.

The primary areas of external event evaluation at Ginna were internal fires and seismic risk. The internal fire events were addressed by using a combination of the EPRI Fire Induced Vulnerability Evaluation (FIVE) methodology and fire PSA. The results of the Fire Analysis are documented in the R.E. Ginna Nuclear Power Plant IPEEE Fire Analysis transmitted to the NRC in June 1998. The seismic evaluations were performed in accordance with Generic Implementation Procedure (GIP) developed by the Seismic Qualification Utility Group (SQUG) of which Ginna was a member. The GIP provided plants a method for addressing Unresolved Safety Issue A-46 (Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors USI A-46). Beyond this, Ginna performed a reduced-scope IPEEE for seismic events to close out IPEEE for Seismic Events.

The Ginna USI A-46 Seismic Evaluation Report and the IPEEE Seismic Evaluation Report were transmitted to the NRC in January 1997. However, there are no comprehensive CDF and LERF values available from the seismic IPEEE report to support the risk assessments.

High Winds, External Floods and Transportation Accidents were reviewed against the Standard Review Plan (SRP) as Ginna was one of the eleven participants in the NRCs Systematic Evaluation Program (SEP). Following plant modifications, it was determined that the Ginna plant met the Standard Review Plan criteria. Based on the NRC Safety Evaluation Reports (SERs) for Ginnas SEP results, no further submittals for GL 88-20 Supplement 4 were warranted for high winds, external floods, or transportation accidents.

Since the performance of the IPEEE, Ginna has submitted a License Amendment Request for conversion from Appendix R compliance to NFPA 805 for fire protection. Pursuant to this change, a Fire PRA has been created and implemented at Ginna. This Fire PRA model was created under the auspices of NUREG/CR-6850 and has undergone PWROG peer review (completed August 2012).

The Ginna Fire PRA was developed using the National Institute of Standards and Technology (NIST)

Consolidated Model of Fire and Smoke Transport (CFAST) Methodology; the Fire Dynamics Simulator, also developed by NIST; NUREG-1805 Fire Dynamics Tools (FDTs) computational Spreadsheets; EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities and the associated NUREG/CR-6850 Frequently Asked Questions (FAQ) Process; Fire Events Database and plant specific data. This Fire PRA has numerous capabilities not considered in the IPEEE Fire PRA model including explicit analysis of all risk significant fire areas such as the Main Control Room (MCR) and Relay Room (RR). Multiple spurious operations (MSO) considerations are also included. The ignition frequencies for all fire areas were developed using the guidance in NUREG/CR-6850 and also Evaluation of Proposed Changes 45 incorporate revised guidance for ignition frequencies. The Ginna Fire PRA has been peer reviewed and all findings have been closed as discussed on the preceding sections. Thus, the Ginna Fire PRA will be used for quantitative evaluation of Fire Risk for this application.

5.4.6 Summary of Technical Adequacy The Ginna PRA technical capability evaluations and the maintenance and update processes described above provide a robust basis for concluding that the Ginna PRA is suitable for use in this risk-informed application.

5.5 SER Conditions and Limitations 5.5.1 WCAP-14333 NRC approval of WCAP-14333 was subject to the following conditions requiring plant-specific information.

5.5.1.1 WCAP-14333 Condition 1 Confirm the applicability of the WCAP-14333-P analyses for the plant.

The implementation guidelines for WCAP-14333 can be used to show that the analysis, results, and conclusions in WCAP-14333 are applicable to Ginna. The NRC indicated during their review of the WCAP that providing the information in the checklist will assist in their review of plant specific submittals for implementing the AOT changes in WCAP-14333.

Table 5-4 through Table 5-6 demonstrate the applicability of the generic analysis on a plant specific basis. These tables list the important parameters and assumptions made in the generic analysis that are relevant to the AOT evaluation.

TABLE 5-4 WCAP-14333 IMPLEMENTATION GUIDELINES: APPLICABILITY OF ANALYSIS GENERAL PARAMETERS Parameter WCAP-14333 Analysis Assumptions Plant Specific Parameter Logic Cabinet Type (1)

Relay and SSPS Relay Component Test Intervals (2)

Analog channels 3 months 3 months Logic cabinets (SSPS) 2 months N/A Logic cabinets (Relay) 1 month 3 months staggered Master Relays (SSPS) 2 months N/A Master Relays (Relay) 1 month 3 months staggered Slave Relays 3 months N/A Reactor trip breakers 2 months 3 months staggered Analog Channel Calibrations (3)

Done at-power yes yes Evaluation of Proposed Changes 46 Parameter WCAP-14333 Analysis Assumptions Plant Specific Parameter Interval 18 months 24 months Typical At-Power Maintenance Intervals (4)

Analog channels 24 months

>=24 months Logic cabinets (SSPS) 18 months N/A Logic cabinets (Relay) 12 months

>=24 months Master relays (SSPS) infrequent (5)

N/A Master relays (Relay) infrequent (5) infrequent Slave relays infrequent (5)

N/A Reactor trip breakers 12 months

>=18 months AMSAC (6)

Credited for AFW pump start Credited for AFW pump start Total Transient Event Frequency (7) 3.6 0.509 ATWS Contribution to CDF (current PRA model)

(8) 8.4E-06 5.15E-07 Total CDF from Internal Events (current PRA model) (9) 5.8E-05 7.54E-06 Total CDF from Internal Events (IPE) (10)

Not Applicable N/A Notes

1.

Indicate type of logic cabinet; SSPS or Relay (both are included in WCAP-14333).

2.

Fill in applicable test intervals. If the test intervals are equal to or greater than those used in WCAP-14333, the analysis is applicable to your plant.

3.

Indicate if channel calibration is done at-power and, if so, fill in the interval. If channel calibrations are not done at-power or if the calibration interval is equal to or greater than that used in WCAP-14333, the analysis is applicable to your plant.

4.

Fill in the applicable typical maintenance intervals or fill in equal to or greater than or less than. If the maintenance intervals are equal to or greater than those used in WCAP-14333, the analysis is applicable to your plant.

5.

Only corrective maintenance is done on the master and slave relays. The maintenance interval on typical relays is relatively long, that is, experience has shown they do not typically completely fail. Failure of slave relays usually involve failure of individual contacts. Fill in infrequent if this is consistent with your plant experience. If not, fill in the typical maintenance interval. If infrequent slave relay failures are the norm, then the WCAP-14333 analysis is applicable to your plant.

6.

Indicate if AMSAC will initiate AFW pump start. If yes, then the WCAP-14333 analysis is applicable to your plant.

7.

Include total frequency for initiators requiring a reactor trip signal to be generated for event mitigation. This is required to assess the importance of ATWS events to CDF. Do not include events initiated by a reactor trip.

8.

Fill in the ATWS contribution to core damage frequency (from at-power, internal events). This is required to determine if the ATWS event is a large contributor to CDF.

9.

Fill in the total CDF from internal events (including internal flooding) for the most recent PRA model update. This is required for comparison to the NRCs risk-informed CDF acceptance guidelines.

10. Fill in the total CDF from internal events from the IPE model (submitted to the NRC in response to Generic Letter 88-20). If this value differs from the most recent PRA model update CDF provide a concise list of reasons, in bulletized form, describing the differences between the models that account for the change in CDF.

11. If your analog channel test interval is 1 month, the STI increase justified and approved by the NRC in WCAP-10271 has not been implemented in your plant, even so, this analysis still remains applicable Evaluation of Proposed Changes 47 TABLE 5-5 WCAP-14333 IMPLEMENTATION GUIDELINES: APPLICABILITY OF ANALYSIS REACTOR TRIP ACTUATION SIGNALS EVENT WCAP-14333 ANALYSIS ASSUMPTION PLANT SPECIFIC PARAMETER (1)

Large LOCA Not Required Agree Medium LOCA Not Required Agree Small LOCA Non-diverse (2) w/OA (3)

Agree Steam Generator Tube Rupture Non-diverse w/OA Agree Interfacing System LOCA Not Required Agree Reactor Vessel Rupture Not Required Agree Secondary Side Breaks Non-diverse w/OA Agree Transient Events, such as:

- Positive Reactivity Insertion

- Loss of Reactor Coolant Flow

- Total or Partial Loss of Main Feedwater

- Loss of Condenser

- Turbine Trip

- Loss of DC Bus

- Loss of Vital AC Bus

- Loss of Instrument Air

- Spurious Safety Injection

- Inadvertent Opening of a Steam Valve Diverse (4) w/OA Agree Reactor Trip Generated by RTS Agree Loss of Offsite Power Not Required by RTS Agree Station Blackout Not Required by RTS Agree Loss of Service Water or Component Cooling Water Non-diverse w/OA Agree Notes

1.

Fill in agree if your plant design and operation is consistent with this analysis, that is, the noted reactor trip signals are available at a minimum. If not, explain the difference. If agree is listed for each event, then the WCAP-14333 analysis is applicable to your plant.

2.

Non-diverse means that (at least) one signal will be generated to initiate reactor trip for the event.

3.

OA indicates that an operator could take action to initiate reactor trip for the event; that is, there is sufficient time for action and procedures are in place that will instruct the operator to take action.

4.

Diverse means that (at least) two signals will be generated to initiate reactor trip for the event.

Evaluation of Proposed Changes 48 TABLE 5-6 WCAP-14333 IMPLEMENTATION GUIDELINES: APPLICABILITY OF ANALYSIS ENGINEERED SAFETY FEATURES ACTUATION SIGNALS SAFETY FUNCTION EVENT WCAP-14333 ANALYSIS ASSUMPTION PLANT SPECIFIC PARAMETER (1)

Safety Injection Large LOCA Non-diverse (2)

Agree Medium LOCA Non-diverse, OA (3) by SI switch on main control board Agree Small LOCA Non-diverse, OA by SI switch on main control board, OA of individual components Agree Interfacing Systems LOCA Non-diverse, OA by SI switch on main control board, OA of individual components Agree SG Tube Rupture Non-diverse, OA by SI switch on main control board, OA of individual components Agree Secondary Side Breaks Non-diverse, OA by SI switch on main control board, OA of individual components Agree Auxiliary Feedwater Pump Start Events generating SI signal Transient events Pump actuation on SI signal Non-diverse, AMSAC, operator action Agree Main Feedwater Isolation Secondary Side Breaks Non-diverse Agree Steamline Isolation Secondary Side Breaks Non-diverse Agree Containment Spray Actuation All events Non-diverse signal Agree Containment Isolation All events From SI signal Agree Containment Cooling All events From SI signal Agree Notes

1.

Fill in agree if your plant design and operation is consistent with this analysis, that is, the noted engineered safety features actuation signals are available at a minimum. If not, explain the difference. If agree is listed for each event, then the WCAP-14333 analysis is applicable to your plant.

2.

Non-diverse means that (at least) one signal will be generated to initiate the engineered safety feature noted for the event.

3.

OA indicates that an operator could take action to initiate the engineered safety feature for the event; that is, there is sufficient time for action and procedures are in place that will instruct the operator to take action.

Evaluation of Proposed Changes 49 5.5.1.2 WCAP-14333 Condition 2 Address the Tier 2 and 3 analyses including the Configuration Risk Management Program (CRMP) insights which confirm that these insights are incorporated into the decision-making process before taking equipment out of service.

Tier 2 is an identification of potentially high-risk configurations that could exist if equipment, in addition to that associated with the change, were to be taken out of service simultaneously or other risk-significant operational factors, such as concurrent system or equipment testing, were also involved.

Application-specific contributors are fully discussed in Section 5.6.7 via examination of resulting cutsets and delete-term cutsets. The important contributors to the delta-risk metrics were identified as increases due to a few specific initiating events that are more impacted by the potentially increased unavailabilitys. The overall increases were well below the regulatory thresholds, so no additional requirements are identified from the plant-specific evaluations.

In support of Tier 2 limitations, Westinghouse performed an evaluation of equipment according to its contribution to plant risk while the equipment covered by the proposed Completion Time changes is out of service for test or maintenance. This evaluation was documented in the response to WCAP-14333 RAI Question 18 in Westinghouse letter OG-96-110. The evaluation concluded that the risk significant systems do not change for the configurations with an analog channel, master relay or slave relay out of service, with respect to the base case (no test or maintenance activities in progress). A relatively significant change in the ordering of risk significant systems occurs only when the logic cabinet is out of service for test or maintenance activities.

The response to WCAP-14333 RAI Question 11 documented ICCDP values for the various test and maintenance configurations that the plant may enter for the subject CT extensions. The same conclusion is drawn from the information presented in the response to RAI Question 11, i.e., the only configuration that significantly impacts core damage frequency is that with a logic train inoperable.

Therefore, Tier 2 limitations are appropriate only when a logic train is inoperable. There are no Tier 2 limitations when a slave relay, master relay, or analog channel is inoperable. Consistent with the SE requirements to include Tier 2 insights into the decision-making process before taking equipment out of service, restrictions on concurrent removal of certain equipment when a logic cabinet is unavailable will be established. These restrictions do not apply when a logic train is being tested under the bypass conditions allowed by Conditions D, K, M, P, R, S, and T of TS 3.3.1 (for RTS) and Conditions F, J, and L for TS 3.3.2 (for ESFAS). Entry into these Conditions is not a typical, pre-planned evolution during power operation, other than for surveillance testing.

Since these TS Actions are typically entered due to equipment failure, it follows that some of the following Tier 2 restrictions may not be met at the time of TS Action entry. If this situation were to occur during the extended 24-hour CT, the Tier 3 CRMP will assess the emergent condition and direct activities to restore the inoperable logic train and exit the TS Action or fully implement the Tier 2 restrictions. Ginna will establish administrative controls to implement the following restrictions during the mode of applicability for the specified equipment:

To preserve ATWS mitigation capability, activities that degrade the ability of the AFW system, reactor coolant system (RCS) pressure relief systems (pressurizer power operated relief valves (PORVS) and safety valves), ATWS mitigating systems actuation circuitry (AMSAC), or turbine trip should not be scheduled when a logic train is inoperable.

Evaluation of Proposed Changes 50 To preserve loss-of-coolant accident (LOCA) mitigation capability, one complete emergency core cooling system (ECCS) train that can be actuated automatically must be maintained when a logic train is inoperable.

To preserve reactor trip and safeguards actuation capability, activities that cause relays in the available train to be unavailable and activities that cause analog channels to be unavailable should not be scheduled when a logic train is inoperable.

Activities in electrical systems (e.g., AC and DC power) and cooling systems (e.g., service water and component cooling water) that support the systems or functions listed in the first three bullets should not be scheduled when a logic train is inoperable. That is, one complete train of a function that supports a complete train of a function noted above must be available.

Tier 3 analysis is addressed in Section 5.9.2.

5.5.2 WCAP-15376 NRC approval of WCAP-15376 was subject to the following conditions requiring plant-specific information.

5.5.2.1 WCAP-15376 Condition 1 A licensee is expected to confirm the applicability of the tropical report to their plant, and to perform a plant-specific assessment of containment failures and address any design or performance differences that may affect the proposed changes.

This Condition is addressed in two parts. The first part confirms the applicability of the topical report to Ginna and the second part addresses the containment failure issue.

Confirm Applicability:

Two key areas need to be addressed to confirm the applicability of the WCAP results to a plant.

These are 1) the applicability of the WCAP-15376 analysis and 2) the applicability of the component failure probabilities.

1. Applicability of the WCAP-15376 Analysis: To demonstrate the applicability of the WCAP-15376 analysis on a plant specific basis, a comparison between the key generic analysis parameters and assumptions, and plant specific parameters and design is necessary. Tables 5-8 through 5-11 provide a list of the key analysis parameters and assumptions along with the input used in the generic analysis to show that the analysis is applicable. The information is related to plant specific signals that are available to actuate reactor trip and engineered safety features, and test and maintenance information for the components of the reactor protection system. Information is also provided on the plants current calculated core damage frequency (CDF), large early release frequency (LERF), and the contribution to CDF from ATWS events.

The current plant CDF and LERF values are used to show that these values meet the RG 1.174 criteria for determining that small increases in CDF and LERF are acceptable. The ATWS contribution to CDF is necessary to understand the importance of the ATWS event to the plants risk, since the proposed changes can impact reactor trip signal availability.

The comparisons in Tables 5-7 through 5-10 between the key generic analysis parameters and assumptions, and plant specific parameters and design demonstrate the applicability of the WCAP-15376 analysis to Ginna.

Evaluation of Proposed Changes 51

2. Applicability of the Component Failure Probabilities: It is necessary to indicate that component failure probabilities developed as part of WCAP-15376 are applicable to Ginna. For SSPS plants this includes the master relay and safeguards driver card failure probabilities, and for relay protection system plants this includes the input logic relays. The failure probabilities for these components are provided on Table 8.6 of the WCAP. The data that was used to develop these failure rates is provided on Tables 8.2, 8.3, and 8.4 of the WCAP. One approach for demonstrating the applicability of the failure probabilities is to collect plant specific data on the components and show that the number of failures experienced for the number of tests/actuations that have occurred would be expected. This can be done by engineering judgement, or by analysis based on binomial distribution analysis. Note that the plants that provided component failure data in support of the WCAP analysis as identified in Tables 8.2, 8.3, and 8.4, can use this information to address this Condition.

To confirm applicability of the WCAP component failure data to Ginna, a comparison of the failure data used in the WCAP is compared to the Ginna plant specific data.

TABLE 5-7 COMPARISON OF WCAP-15376 COMPONENT FAILURE RATE DATA WITH PLANT-SPECIFIC VALUES COMPONENT TYPE WCAP-15376 VALUE GINNA VALUE (1)

Relay Protection System Input Logic Relays 1.26E-04 3.00E-04 Relay Protection System Master Relays 9.48E-04 3.00E-04 Note 1: Ginna uses the generic industry data, updated with plant specific data, to calculate the value used for relay failures in the model. Only one failure event is used for all relays. This value has been adjusted from the base value of 1.00E-04 to account for STI changes at the site.

WCAP-15376 was released in March 2003, and thus the component failure rates are based on older plant performance than the current Ginna values. The similarity between these values shows that there has not been a significant change in these component failure rates over time. No relay failures were recorded during the current data period at Ginna (2014-2017). WCAP-15376 Tables 8.4 and 8.5 show the results of the survey of surveillances and failures at 7 units for input logic and master relays.

These surveys showed a low number of failures have occurred over time (the survey is dated 1996),

with some sites reporting zero failures. Therefore, it is concluded that the Ginna data is consistent with the data observed in WCAP-15376, and the WCAP-15376 analysis is considered applicable in this regard.

Containment Failure Assessment:

Containment failure modes typically considered in PRA include containment isolation failure; containment bypasses from ISLOCA, SGTR, and SG tube creep rupture; and containment failure from steam explosion, hydrogen burns, direct containment heating, and containment steam over-pressurization. The significant contributors to LERF for large dry containment and sub-atmospheric designs are typically containment isolation failure and containment bypasses.

The LERF analysis completed to support this program was based on a large dry containment with LERF contributions from containment isolation failure, and containment bypasses from ISLOCA and SGTR events, excluding SG tube creep rupture. Most large dry and sub-atmospheric containment Evaluation of Proposed Changes 52 plants (including Ginna) should be consistent with the LERF analysis, and therefore the WCAP results should be applicable to these plants. Note that SG tube creep rupture is generally a small contributor to LERF. Therefore, the signal unavailability changes will only have a small impact on LERF related to this contributor.

Plants that have not addressed their PRA peer review findings with respect to containment issues may not be consistent with this LERF analysis. For these plants, it is recommended that the PRA peer review findings related to LERF contributors be considered when demonstrating consistency with the LERF analysis and the applicability of WCAP-15376.

Ginna has a large dry containment design and has performed a PRA technical adequacy review in Section 5.4. The technical adequacy review confirms that the Ginna Level 2 analysis is technically adequate to support this application, and that WCAP-15376 is applicable to Ginna.

TABLE 5-8 WCAP-15376 IMPLEMENTATION GUIDELINES: APPLICABILITY OF THE ANALYSIS GENERAL PARAMETERS PARAMETER WCAP-15376 ANALYSIS ASSUMPTION GINNA SPECIFIC PARAMETER Logic Cabinet Type1 (SSPS or Relay)

Relay Component Bypass Test Time2 Analog channels 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 4 hours Logic cabinets (SSPS or Relay Protection System)

(4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for SSPS or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for Relay Protection System) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Master Relay (SSPS or Relay Protection System)

(4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for SSPS or 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for Relay Protection System) 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Reactor trip breakers 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 2 hours Component Test Interval3 Reactor trip breakers 2 months 3 months staggered Typical At-Power Maint. Intervals4 Reactor trip breakers 12 months equal to or greater than**

Plant procedures are in place for the following operator actions5 Reactor trip from the main control board switches Credited Yes Reactor trip by interrupting power to the motor-generator sets Credited Yes Insertion of the control rods via the rod control system Credited Yes Safety injection actuation from the main control board switches Credited Yes Evaluation of Proposed Changes 53 PARAMETER WCAP-15376 ANALYSIS ASSUMPTION GINNA SPECIFIC PARAMETER Safety injection by actuation of individual components Credited Yes Auxiliary feedwater pump start Credited Yes AMSAC6 Credited for AFW pump start Yes Total Transient Event Frequency7 3.6 0.509 ATWS Contribution to CDF (current PRA model)8 1.06E-06/yr 5.15E-07 Total CDF from Internal Events (current PRA model)9 7.54E-06 Total LERF from Internal Events (current PRA model) 9 4.18E-08/yr Notes

- No at-power maintenance is scheduled on these components, so the interval would meet or exceed that assumed in the WCAP.

1.

Indicate type of logic cabinet; SSPS or Relay (both are included in WCAP-15376).

2.

Fill in the current Tech Spec bypass test times. If the current Tech Spec bypass test times are equal to or less than those used in WCAP-15376, the analysis is applicable to your plant.

3.

Fill in the current Tech Spec test interval. If the current Tech Spec test interval is equal to or greater than that used in WCAP-15376, the analysis is applicable to your plant.

4.

Fill in the typical maintenance intervals or fill in equal to or greater than or less than. If the maintenance intervals are equal to or greater than those used in WCAP-15376, the analysis is applicable to your plant.

5.

Indicate if plant procedures are in place to perform these actions. If plant procedures are in place, the WCAP-15376 analysis is applicable to your plant.

6.

Indicate if AMSAC will initiate AFW pump start. If AMSAC will initiate AFW pump start, then the WCAP-15376 analysis is applicable to your plant.

7.

Include the total frequency for initiators requiring a reactor trip signal to be generated for event mitigation. This is required to assess the importance of ATWS events to CDF. Do not include events initiated by a reactor trip.

If the plant specific value is less than the WCAP-15376 value, then this analysis is applicable to your plant.

8.

Fill in the ATWS contribution to core damage frequency (from at-power, internal events). This is required to determine if the ATWS event is a large contributor to CDF.

9.

Fill in the total CDF and LERF from internal events (including internal flooding) for the most recent PRA model update. This is required for comparison to the NRCs risk-informed CDF and LERF acceptance guidelines in Regulatory Guide 1.174.

Evaluation of Proposed Changes 54 TABLE 5-9 WCAP-15376 IMPLEMENTATION GUIDELINES: APPLICABILITY OF ANALYSIS REACTOR TRIP SIGNALS EVENT WCAP-15376 ANALYSIS ASSUMPTION GINNA SPECIFIC PARAMETER1 Large LOCA Not Required Agree Medium LOCA Not Required Agree Small LOCA Non-diverse2 w/OA3 Agree Steam Generator Tube Rupture Non-diverse w/OA Agree Interfacing System LOCA Not Required Agree Reactor Vessel Rupture Not Required Agree Secondary Side Breaks Non-diverse w/OA Agree Transient Events, such as:

- Positive Reactivity Insertion

- Loss of Reactor Coolant Flow

- Total or Partial Loss of Main Feedwater

- Loss of Condenser

- Turbine Trip

- Loss of DC Bus

- Loss of Vital AC Bus

- Loss of Instrument Air

- Spurious Safety Injection

- Inadvertent Opening of a Steam Valve Diverse4 w/OA Agree Reactor Trip Generated by RTS Agree Loss of Offsite Power Not Required by RTS Agree Station Blackout Not Required by RTS Agree Loss of Service Water or Component Cooling Water Non-diverse w/OA Agree Notes

1.

Fill in agree if your plant design and operation is consistent with this analysis, that is, the noted reactor trip signals at a minimum, are available. If not, explain the difference. If agree is listed for each event, then the WCAP-15376 analysis is applicable to your plant.

2.

Non-diverse means that (at least) one signal will be generated to initiate a reactor trip for the event.

3.

OA indicates that an operator could take action to initiate a reactor trip for the event, that is, there is sufficient time for operator action and procedures are in place that will instruct the operator to take action.

4.

Diverse means that (at least) two signals will be generated to initiate a reactor trip for the event.

Evaluation of Proposed Changes 55 TABLE 5-10 WCAP-15376 IMPLEMENTATION GUIDELINES: APPLICABILITY OF ANALYSIS ENGINEERED SAFETY FEATURES ACTUATION SIGNALS SAFETY FUNCTION EVENT WCAP-15376 ANALYSIS ASSUMPTION GINNA SPECIFIC PARAMETER1 Safety Injection Large LOCA Non-diverse2 Agree Medium LOCA Non-diverse, OA3 by SI switch on main control board Agree Small LOCA Non-diverse, OA by SI switch on main control board, OA of individual components Agree Interfacing Systems LOCA Non-diverse, OA by SI switch on main control board, OA of individual components Agree SG Tube Rupture Non-diverse, OA by SI switch on main control board, OA of individual components Agree Secondary Side Breaks Non-diverse, OA by SI switch on main control board, OA of individual components Agree Auxiliary Feedwater Pump Start Events generating SI signal Transient events Pump actuation on SI signal Non-diverse, AMSAC, operator action Agree Main Feedwater Isolation Secondary Side Breaks Non-diverse Agree Steamline Isolation Secondary Side Breaks Non-diverse Agree Containment Spray Actuation All events Non-diverse Agree Containment Isolation All events From SI signal Agree Containment Cooling All events From SI signal Agree Notes

1.

Fill in agree if your plant design and operation is consistent with this analysis, that is, the noted engineered safety features actuation signals at a minimum, are available. If not, explain the difference. If agree is listed for each event, then the WCAP-15376 analysis is applicable to your plant.

2.

Non-diverse means that (at least) one signal will be generated to initiate the safety function noted for the event.

3.

OA indicates that an operator could take action to initiate the safety function for the event, that is, there is sufficient time for operator action and procedures are in place that will instruct the operator to take action.

Evaluation of Proposed Changes 60 5.5.2.2 WCAP-15376 Condition 2 Address the Tier 2 and Tier 3 analyses including risk significant configuration insights and confirm that these insights are incorporated into the plant-specific configuration risk management program.

Each plant implementing these Technical Specification changes will need to confirm that the Tier 2 and Tier 3 requirements have been addressed and implemented.

Application-specific contributors are fully discussed in Section 5.6.7 via examination of resulting cutsets and delete-term cutsets. The important contributors to the delta-risk metrics were identified as increases due to a few specific initiating events that are more impacted by the potentially increased unavailabilitys. The overall increases were well below the regulatory thresholds, so no additional requirements are identified from the plant-specific evaluations. Therefore, based on WCAP-15376, analyses by other similar plants, and these plant-specific evaluations, the following Tier 2 and Tier 3 requirements are recommended.

Tier 2 Requirements:

Recommended Tier 2 requirements, or restrictions, are provided in Section 8.5 of the WCAP. These restrictions do not apply when components are being tested under the 4-hour bypass as allowed by the various conditions in TS 3.3.1. Entry into these bypass conditions is not a typical, pre-planned evolution during power operation, other than for surveillance testing.

Since this Action may be entered due to equipment failure, some of the Tier 2 restrictions described below may not be met at the time of TS Action entry. In addition, it is possible that equipment failure may occur after the Reactor Trip Breaker (RTB) train is removed from service for surveillance testing or planned maintenance, such that one or more of the required Tier 2 restrictions are no longer met.

In cases of equipment failure, the Tier 3 configuration risk management program section requires assessment of the emergent condition and appropriate actions are then taken. Depending on the specific situation, these actions could include restoring the inoperable RTB train and exiting the TS Action, or fully implementing the Tier 2 restrictions.

The following Tier 2 restrictions will be implemented when an RTB train becomes inoperable when operating under the proposed allowed outage times:

The probability of failing to trip the reactor on demand will increase when a RTB is removed from service, therefore, systems designed for mitigating an ATWS event should be maintained available. RCS pressure relief, auxiliary feedwater flow (for RCS heat removal), AMSAC, and turbine trip are important to alternate ATWS mitigation. Therefore, activities that degrade the availability of the auxiliary feedwater system, RCS pressure relief system (pressurizer PORVs and safety valves), AMSAC, or turbine trip should not be scheduled when a RTB is out of service. At the time of implementation, procedures will be revised to include systems listed above to ensure required trains are protected prior to performing work.

Due to the increased dependence on the available reactor trip train when one logic cabinet is removed from service, activities that degrade other components of the RTS, including master relays or slave relays and activities that cause analog channels to be unavailable should not be scheduled when a logic cabinet is unavailable. At the time of implementation, procedures will be revised to include redundant logic cabinets, including associated AC and DC power supplies, to ensure required trains are protected prior to performing work.

Evaluation of Proposed Changes 61 Activities on electrical systems (e.g., AC and DC power) that support the systems or functions listed in the first two bullets should not be scheduled when a RTB is unavailable.

Tier 3 discussions are provided in Section 5.9.2.

5.5.2.3 WCAP-15376 Condition 3 The risk impact of concurrent testing of one logic cabinet and associated reactor trip breaker needs to be evaluated on a plant-specific basis to ensure conformance with the WCAP-15376-P, Rev. 0 evaluation, and RGs 1.174 and 1.177.

The response to NRC RAI 4 provided the ICCDP for this configuration (both the logic cabinet and associated RTB out of service) for preventive maintenance for a total time of 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months , which is comprised of a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , plus 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to reach Mode 3. The ICCDP for a duration of 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months in this configuration is 3.2E-07, which meets the RG 1.177 acceptance guideline of 5E-07. Since this ICCDP value is based on the logic cabinet and RTB being out of service for 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months at the same time, bypassing one logic cabinet and associated RTB for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for testing will also meet the RG 1.177 ICCDP guideline.

Condition 3 is addressed by demonstrating that the WCAP-15376 analysis is applicable to Ginna.

This shows that the generic analysis covers the Ginna plant and the generic risk measures calculated are a good representation of Ginna. Demonstrating the applicability of the WCAP-15376 analysis is discussed in detail in Condition 1.

5.5.2.4 WCAP-15376 Condition 4 To ensure consistency with the reference plant, the model assumptions for human reliability in WCAP-15376-P, Rev. 0 should be confirmed to be applicable to the plant-specific configuration.

The simplest approach to show consistency with the human reliability assumptions is to confirm that the key requirements for crediting the operator actions credited in the WCAP-15376 analysis are met for Ginna. Table 5-11 lists the operator actions credited in the WCAP-15376 analysis and indicates if the operators have sufficient time to perform these actions, and if plant procedures are in place that will direct the operators to take these actions. This table shows that the WCAP-15376 analysis is applicable to Ginna in this regard.

Evaluation of Proposed Changes 62 TABLE 5-11 WCAP-15376 IMPLEMENTATION GUIDELINES:

APPLICABILITY OF HUMAN RELIABILITY ANALYSIS OPERATOR ACTION IS SUFFICIENT TIME AVAILABLE FOR THE OPERATORS TO TAKE THE ACTION? (1)

ARE PLANT PROCEDURES IN PLACE FOR THE ACTION? (1)

Reactor trip from the main control board switches Yes Yes Reactor trip by interrupting power to the motor-generator sets Yes Yes Insertion of the control rods via the rod control system Yes Yes Safety injection actuation from the main control board switches Yes Yes Safety injection by actuation of individual components Yes Yes Auxiliary feedwater pump start Yes Yes Note 1: Fill in yes or no. If yes is filled in for both questions, then the analysis is applicable to your plant with respect to that operator action.

5.5.2.5 WCAP-15376 Condition 5 For future digital upgrades with increased scope, integration and architectural differences beyond that of Eagle 21, the staff finds the generic applicability of WCAP-15376-P, Rev. 0 to future digital systems not clear and should be considered on a plant-specific basis.

This Condition does not apply to Ginna.

5.5.2.6 WCAP-15376 RAI Question 18 Plant specific RTS and ESFAS setpoint uncertainty calculations and assumptions, including instrument drift, will be reviewed to determine the impact of extending the Surveillance Frequency of the Channel Operational Test (COT) from 92 days to 184 days.

The response to NRC RAI 18 requires plant specific RTS and ESFAS setpoint uncertainty calculations and assumptions to be reviewed, to determine the impact of extending the Surveillance Frequency of the Channel Operational Test (COT) from 92 days to 184 days. However, this license amendment request does not include surveillance frequency extensions, so discussion of this additional commitment is not necessary.

5.5.3 Summary of Applicability The applicability analyses shown in the preceding sections support the general applicability of those WCAPs to the Ginna plant and PRA. In addition, a plant-specific review of functions to be addressed was performed against those functions covered by those analyses. Tables 5-12 and 5-13 summarize the applicability of the components being analyzed in this analysis to those that were analyzed in the referenced in WCAP-15376 and WCAP-14333. Those that are not directly covered by those analyses Evaluation of Proposed Changes 63 (or other non-risk analyses) are highlighted and identified for inclusion in this plant-specific risk analysis.

WCAP-15376 and WCAP-14333 performed analyses on a series of representative signals for RTS and ESFAS systems. Since the Ginna model is sufficiently detailed and models the various signals for RTS and ESFAS, signals that were not listed as representative in the WCAPs are conservatively analyzed in the plant-specific analysis. This is conservative because the signals generally have similar failure rates, and more than one signal is typically generated for PRA modeled events.

TABLE 5-12 APPLICABILITY OF RTS COMPONENTS TO WCAP-15376 AND WCAP-14333 FUNCTIONAL UNIT TSTF-411 AND WCAP 15376 TSTF-418 AND WCAP 14333 1

Manual Reactor Trip 2

Power Range, Neutron Flux Analyze

a. Power Range, Neutron Flux High Analyze

b. Power Range, Neutron Flux Low Analyze 3

Intermediate Range, Neutron Flux 4

Source Range, Neutron Flux

a. Startup

b. Shutdown 5

Overtemperature T Yes 6

Overpower T Analyze 7

Pressurizer Pressure Yes

a. Pressurizer Pressure - Low Analyze

b. Pressurizer Pressure - High Yes 8

Pressurizer Water Level - High Analyze 9

Reactor Coolant Flow - Low Analyze

a. Loss of Flow - Single Loop Analyze

b. Loss of Flow - Two Loops Analyze 10 Reactor Cooling Pump (RCP) Breaker Position

a. RCP Breaker Position - Single Loop

b. RCP Breaker Position - Two Loops Analyze 11 Undervoltage - Bus 11A and 11B Yes 12 Underfrequency - Bus 11A and 11B Yes 13 Steam Generator (SG) Water Level - Low Low Yes**

14 Turbine Trip

a. Low Autostop Oil Pressure b.Turbine Stop Valve Closure Evaluation of Proposed Changes 64 FUNCTIONAL UNIT TSTF-411 AND WCAP 15376 TSTF-418 AND WCAP 14333 15 Safety Injection (SI) Input from Engineered Safety Features Actuation System (ESFAS) 16 Reactor Trip System Interlocks Yes

a. Intermediate Range Flux

b. Low Power Reactor Trips Block, P-7

c. Power Range Neutron Flux, P-8 Yes**

d. Power Range Neutron Flux, P-9 Yes**

e. Power Range Neutron Flux, P-10 Yes**

17 Reactor Trip Breakers Yes 18 Reactor Trip Breaker and Undervoltage and Shunt Trip Mechanisms 19 Automatic Trip Logic

Not included in the proposed changes.

- These functions are covered by the WCAP, but due to the detailed modeling available in the Ginna PRA, they were analyzed to ensure completeness and conservatism.

TABLE 5-13 APPLICABILITY OF ESFAS COMPONENTS TO WCAP-15376 AND WCAP-14333 FUNCTIONAL UNIT TSTF-411 AND WCAP 15376 TSTF-418 AND WCAP 14333 1

Safety Injection Partially Yes

a. Manual Initiation

b. Automatic Actuation Logic and Actuation Relays

c. Containment Pressure - High Analyze

d. Pressurizer Pressure - Low Yes

e. Steam Line Pressure - Low Analyze 2

Containment Spray

a. Manual Initiation

b. Automatic Actuation Logic and Actuation Relays

c. Containment Pressure - High High Analyze 3

Containment Isolation

a. Manual Initiation

b. Automatic Actuation Logic and Actuation Relays

c. Safety Injection 4

Steam Line Isolation Yes

a. Manual Initiation Evaluation of Proposed Changes 65 FUNCTIONAL UNIT TSTF-411 AND WCAP 15376 TSTF-418 AND WCAP 14333

b. Automatic Actuation Logic and Actuation Relays

c. Containment Pressure - High High Yes

d. High Steam Flow Coincident with Safety Injection And Coincident with Tavg - Low Yes

e. High-High Steam Flow Coincident with Safety Injection Yes 5

Feedwater Isolation Yes

a. Automatic Actuation Logic and Acutation Relays

b. SG Water Level-High Yes

c. Safety Injection 6

Auxiliary Feedwater Yes

a. Manual Initiation

b. Automatic Actuation Logic and Actuation Relays

c. SG Water Level - Low Low Yes

d. Safety Injection (Motor driven pumps only)

e. Undervoltage - Bus 11A and 11B (Turbine Driven pump only)

f. Trip of Both Main Feedwater Pumps (Motor driven pumps only)

Not included in the proposed changes.

5.6 Tier 1 Risk Assessment The justification for the use of extended Allowed Outage Times (AOTs) for ESFAS/RTS instrumentation is based upon risk-informed and deterministic evaluations consisting of three main elements:

1. Tier 1: Assessment of the impact of the proposed TS change using a valid and appropriate PRA model and compare with appropriate acceptance guidelines.

2. Tier 2: Evaluate equipment relative to the contribution to risk while specified instrumentation are in the extended AOT. Examination of out of service instrumentation can be evaluated for its risk significance to determine if additional measures may be required.

3. Tier 3: Implementation of the Configuration Risk Management Program (CRMP) while ESFAS/RTS instrumentation is in an extended AOT. The CRMP is used for all work and helps ensure that there is no significant increase in the risk due to a severe accident while instrumentation maintenance is performed. These elements provide adequate justification for approval of the requested Technical Specification change by providing a high degree of assurance that any increase in risk is acceptable during the extended AOT for all Design Basis Accidents (DBAs) and 10 CFR 50 Appendix R fire requirements during the AOT.

Evaluation of Proposed Changes 66 This section addresses the Tier 1 risk assessment for the proposed extension of the ESFAS/RTS instrumentation AOT. Tier 2 evaluations are supported by the examination of results, such as in Section 5.6.7, to determine if any specific failures dominate the results, the compensatory measures discussed in Section 5.6.3, as well as the Tier 2 issues that will be applied from Section 5.5. Plant configuration changes for planned and unplanned maintenance of the instrumentation as well as the maintenance of equipment having risk significance is managed by the Configuration Risk Management Program (CRMP). The CRMP helps ensure that these maintenance activities are carried out with no significant increase in the risk of a severe accident (Tier 3).

5.6.1 Tier 1 Evaluation Approach The proposed changes associated with the extended ESFAS/RTS instrumentation AOT are evaluated using a PRA model closely based on the Ginna PRA Model of Record (MOR) to determine that current regulations and applicable requirements continue to be met, that adequate defense-in-depth and sufficient safety margins are maintained, and that any increase in core damage frequency (CDF) and large early release frequency (LERF) is small and consistent with the acceptance guidelines in RG 1.177. The modeling approach is consistent with the NRC guidance for the calculation of the requested risk measures. RG 1.177 is followed to calculate the change in risk measures ICCDP and ICLERP. These conditional probabilities are performed to calculate the risk change during the proposed ESFAS/RTS Instrumentation AOT by setting the appropriate components as failed.

In addition, an assessment of the impact of the AOT extension on overall average risk is calculated by assigning an increased testing/maintenance probability to the ESFAS/RTS instrumentation. This increased probability is based on the factor of change of the AOT, thereby conservatively if all existing unavailability will be increased by that same factor. An additional calculation was performed to assess the impact of all instrumentation unavailable simultaneously. RG 1.174 has acceptance guidelines that act as trigger points to address concerns as to whether the proposed change provides reasonable assurance of adequate protection.

The Ginna internal events PRA is a thorough and detailed PRA model that is robust and capable of supporting the risk-informed decision to increase the ESFAS/RTS Instrumentation Allowed Outage Time. See Section 5.4 for a discussion of the PRA technical adequacy.

5.6.2 Assumptions The PRA quantitative evaluation of the extended ESFAS/RTS instrumentation AOT has a number of assumptions. This subsection lists some of the important assumptions.

The external event analysis is based on hazard-specific stand-alone calculations of potential risk impacts based on the RG 1.200 peer-reviewed FPIE PRA and Fire PRA, and a qualitative analysis using insights from the IPEEE study.

The base risk model has not increased the ESFAS/RTS instrumentation maintenance unavailabilitys to account for future potential increases in the average unavailabilitys. If this were to be included in the base risk model, it would result in improving the calculated risk metrics and showing an increase in the margin from the calculated risk metrics to their acceptance guidelines.

Corrective and preventative maintenance outages have been combined to calculate a total maintenance unavailability. This is consistent with the ASME PRA Standard.

Evaluation of Proposed Changes 67 5.6.3 Compensatory Measures Ginna maintenance practices involve protecting other equipment coincident with maintenance being performed on ESFAS/RTS instrumentation (See Section 5.9.2). This procedure specifically states that if ESFAS/RTS instrumentation channels are unavailable as permitted by technical specifications, the remaining operable channels shall be protected. The PRA MOR directly accounts for this maintenance practice and is reflected in the quantitative analysis.

In addition, Ginna Plant Procedures (See Section 5.9.2 for full details) directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using a predictive PRA software tool based on the PRA MOR, i.e., EOOS Configuration Risk Monitor program from the Electric Power Research Institute (EPRI).

5.6.4 Risk Metric Calculations for Plant-Specific Analyses 5.6.4.1 Risk Metric Calculation Approach To determine the effect of the proposed Allowed Outage Time for unavailability of ESFAS/RTS instrumentation, the method described in Section 5.1.4 is used to calculate the delta CDF and delta LERF for the proposed changes. In addition, the ICCDP and ICLERP values for the proposed unavailability windows is also calculated as described in Section 5.1.4. CAFTA flag files are created for each configuration as described in the proceeding sections.

For delta CDF and delta LERF calculations, mutually exclusive logic is not included for the newly included basic events to exclude unavailability of more than one channel simultaneously. This provides a conservative overall risk estimate and does not significantly impact the results due to the relatively small probabilities of the unavailabilitys of each channel.

For ICCDP/ICLERP calculations, a representative train is selected for the calculation. Since each train of RTS and ESFAS channels are redundant, the ICCDP/ICLERP values are considered to be representative of both trains.

5.6.4.2 Review of PRA Model Specific to Application The Ginna FPIE and Fire PRA Models were reviewed in detail, and sufficient modeling exists in the PRA to represent the changes for some of the components of interest. However, some model additions are necessary to support the application. The Ginna model has a high level of detail in both the RTS and ESFAS systems, which include signal modeling for all the signals to be analyzed.

Note that since the Fire PRA model logic is similar to the FPIE model logic, the discussion below applies to both models unless a specific difference is noted.

In order to calculate the change in CDF/LERF due to ESFAS/RTS AOT extensions, the testing and maintenance event probabilities associated with the instrumentation will be adjusted to reflect the extended AOT. Due to infrequent testing and very low unavailability, basic events representing some of the relays are not included in the GN119A PRA model. Therefore, basic events for such events noted during the review are inserted to model unavailability of these events but are set to a value of 0 in the model of record. Additional basic events are added to model unavailability of channels that did not previously have an event modeled.

Evaluation of Proposed Changes 68 The relays are currently tested quarterly on a staggered basis, but the total unavailable time is kept to a minimum (hence its non-inclusion in the PRA). Therefore, to provide a non-zero starting value for the relay unavailability, a total of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months of testing time per year is assumed based on this minimal level of testing, and the baseline unavailability for the new events is estimated as follows:

() =

=

1 365 x 24

= 1.1404 For conservatism, this baseline unavailability is not included in the base case PRA calculations. This slightly overestimates the delta CDF and delta LERF but is not expected to have a significant impact on the results due to the low probability of the baseline event. This baseline value is modified for each channel as discussed below.

1. Power Range Neutron Flux High (RTS)

a. Modify existing basic events to represent a factor of 12 increase to the completion time of TS 3.3.1 Condition D (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

b. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

2. Power Range Neutron Flux Low (RTS)

a. This signal is not expected to be received during at power operation but is sufficiently represented by the power range high condition. If the plant was in a condition in which this signal would be received, the high flux signal would not be received and thus they are mutually exclusive of each other.

3. Overpower Delta-T (RTS)

a. Modify existing basic events to represent a factor of 12 increase to the completion time of TS 3.3.1 Condition D (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

b. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

4. Pressurizer Pressure Low (RTS)

a. Modify an existing basic event to represent a factor of 12 increase to the completion time of TS 3.3.1 Condition K (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ). This basic event represents more than one channel in the model but is conservatively adjusted.

b. Add new events for channel specific events, set to value above.

c. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

5. Pressurizer Water Level High (RTS)

a. Add new events to represent a factor of 12 increase to the completion time of TS 3.3.1 Condition D (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

Evaluation of Proposed Changes 69

b. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

6. Reactor Coolant Flow Low (RTS)

a. Single Loop - Add new events to represent a factor of 12 increase to the completion time of TS 3.3.1 Condition M (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

b. The double loop requirement is not modeled because it is bounded by single loop failure (either loop failing is sufficient in this case, as opposed to both).

c. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

7. RCP Breaker Position - Two Loops (RTS)

a. Add new events to the completion time of TS 3.3.1 Condition K (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

b. The bypass condition does not apply to function 10b in Condition K.

8. Steam Generator Water Level Low-Low (RTS)

a. Add new events to represent a factor of 12 increase to the completion time of TS 3.3.1 Condition D (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

b. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

9. Permissive Functions P-8, P-9, and P-10 (Power Range, RTS)

a. No additional changes are necessary for these functions as the plant is assumed to be at power initially in the PRA model. Additionally, the power range instrument unavailability is also adjusted for this analysis, which bounds any potential impact.

10. Safety Injection - Containment Pressure High

a. Existing events are not modified. One is located under a logic gate modeling a failure of the relay to de-energize for RTS, and RTS unavailability is already modeled due to other signal failures and bound the impact of this event. The others model signal failures to containment spray initiation logic, which is addressed separately.

b. Table 2-2 of the ESFAS notebook discusses the various logic top gates in the model that contain safety injection logic. New events are inserted under these gates to represent failure of the SI signal to actuate the relays, set to represent a factor of 12 increase to the completion time of TS 3.3.2 Condition J (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ). Note that these specific gates do not model individual signal failures, and as such these events conservatively bound the impact of the change.

c. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

Evaluation of Proposed Changes 70

d. Other modeled functions of the instrument are not modeled (e.g. steam line isolation on high containment pressure) because they are already analyzed in the WCAPs.

11. Safety Injection - Steam Line Pressure Low

a. Since specific signals are not modeled under the main SI actuation logic gates, no additional basic events are added for this function. The basic events added for the high containment pressure function conservatively address this function as well, since multiple signals may be received during an event and only one is required to actuate SI.

b. The bypass condition is being modified from 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months but is bounded by the factor of increase of the completion time.

c. Other modeled functions of these instruments are not addressed in this analysis because they are already analyzed in the WCAPs.

12. Containment Spray - Containment Pressure High High

a. Modify existing basic events to represent a factor of 12 increase to the completion time of TS 3.3.2 Condition J (6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ).

b. The bypass condition does not apply to function 2c in Condition J.

5.6.4.2.1 Common Cause The model includes a common cause event, TLCCFEATWS, which represents a common cause failure of all RTS signals. The value of this event is 1.6E-7, which is derived from generic industry data sources. Since a CCF development for each individual signal modeled in RTS is not available for the Ginna model, this event is increased to 1.6E-6 for ICCDP/ICLERP calculations to account for the increased likelihood of common cause failures if one instrument channel is inoperable. WCAP-14333-P-A indicates that a sensitivity was performed to address the uncertainty in the common cause failure analysis for the risk calculations, and a factor of 2 increase was chosen (Attachment OG 110, Transmittal of Response to Request for Additional Information (RAI Regarding WCAP-14333-P Entitled "Probabilistic Risk Analysis of the RTS and ESFAS Tests Times and Completion Times, Page 43)). Based on this assessment, a factor of 10 increase is considered to bound the uncertainty regarding this value in the Ginna ICCDP/ICLERP calculations.

Ginna does not model common cause for the ESFAS functions analyzed and therefore no changes are made to the model for the ICCDP/ICLERP calculation for the ESFAS functions. This is considered acceptable since the WCAPs extensively analyzed the common cause failures modes that were critical to ESFAS and showed they were acceptable using a representative set of signals.

Analyzing all of the ESFAS signals would result in a higher reliability of the signal portion of the risk analysis, since more signals would be available to actuate the system. Therefore, the WCAP risk analyses are considered bounding for common cause failures of ESFAS.

5.6.4.2.2 Flag File Settings for Risk Calculations The delta CDF and delta LERF calculations for the extension are performed using the values for the new added events discussed in Section 5.6.4.2. For ICCDP and ICLERP calculations, a representative train is chosen and the events for each function are set to TRUE using CAFTA flag settings.

Evaluation of Proposed Changes 71 5.6.5 ESFAS/RTS AOT Extension PRA Analysis The Base PRA model of record (MOR) has been reviewed for applicability to the Ginna ESFAS/RTS Instrumentation AOT extension and the changes described in Section 5.6.4.2 were included as part of the analysis used for this risk application.

The model calculations were performed using the modified Ginna FPIE and FPRA PRA models to develop the increase in risk associated with those configurations involving concurrent unavailability of ESFAS/RTS Instrumentation for extended AOTs. These calculations were used to develop the risk metrics for comparison with RG 1.174 and RG 1.177 acceptance guidelines.

5.6.5.1 ESFAS/RTS AOT Extension PRA Analysis - FPIE Results The CDF/LERF and ICCDP/ICLERP results for unavailability of ESFAS/RTS instrumentations from the Ginna FPIE model are shown in Tables 5-14 and 5-15, respectively.

Evaluation of Proposed Changes 72 TABLE 5-14 CDF/LERF RESULTS FOR UNAVAILABILITY OF ESFAS/RTS INSTRUMENTATION (FPIE)

CASE CDFNEW

% CHANGE LERFNEW

% CHANGE Base 7.67E-06 4.14E-08 ESFAS-RTS-UA 7.72E-06 0.67%

4.25E-08 2.46%

Change 5.16E-08 1.02E-09 TABLE 5-15 ICCDP/ ICLERP RESULTS FOR UNAVAILABILITY OF ESFAS/RTS INSTRUMENTATION (FPIE)

CASE CDFINST TINST (HRS)

ICCDPINST LERFINST TINST (HRS)

ICLERPINST Base 7.67E-06 4.14E-08 PWR-RNG 7.68E-06 72 1.30E-10 4.14E-08 72 1.07E-14 OVR-TEMP 7.68E-06 72 1.30E-10 4.14E-08 72 1.07E-14 PZR-PRESS 7.68E-06 72 1.34E-10 4.14E-08 72 1.07E-14 PZR-WTR-LVL 7.83E-06 72 1.37E-09 4.15E-08 72 8.97E-13 SG-WTR-LVL-A 7.68E-06 72 1.30E-10 4.14E-08 72 1.07E-14 SG-WTR-LVL-B 7.68E-06 72 1.30E-10 4.14E-08 72 1.07E-14 RCS-FLOW-A 7.68E-06 72 1.30E-10 4.14E-08 72 1.07E-14 RCS-FLOW-B 7.68E-06 72 1.30E-10 4.14E-08 72 1.07E-14 RCP-BKR 8.99E-06 72 1.09E-08 4.32E-08 72 1.43E-11 ESFAS 2.45E-05 72 1.38E-07 7.72E-07 72 6.00E-09 CONT-PRESS 7.67E-06 72 0.00E+00 4.14E-08 72 0.00E+00 5.6.5.2 ESFAS/RTS AOT Extension PRA Analysis - FPRA Results The CDF/LERF and ICCDP/ICLERP results for unavailability of ESFAS/RTS instrumentations from the Ginna FPRA model are shown in Tables 5-16 and 5-17, respectively.

TABLE 5-16 CDF/LERF RESULTS FOR UNAVAILABILITY OF ESFAS/RTS INSTRUMENTATION (FPRA)

CASE CDFNEW

% CHANGE LERFNEW

% CHANGE Base 3.84E-05 5.31E-07 ESFAS-RTS-UA 3.84E-05 0.16%

5.31E-07 0.00%

Change 6.13E-08 0.00E+00 Evaluation of Proposed Changes 73 TABLE 5-17 ICCDP/ ICLERP RESULTS FOR UNAVAILABILITY OF ESFAS/RTS INSTRUMENTATION (FPRA)

CASE CDFINST TINST (HRS)

ICCDPINST LERFINST TINST (HRS)

ICLERPINST Base 3.84E-05 5.31E-07 PWR-RNG 3.85E-05 72 7.44E-10 5.31E-07 72 2.05E-12 OVR-TEMP 3.84E-05 72 0.00E+00 5.31E-07 72 0.00E+00 PZR-PRESS 3.84E-05 72 5.95E-10 5.31E-07 72 5.44E-13 PZR-WTR-LVL 3.85E-05 72 1.15E-09 5.31E-07 72 6.48E-13 SG-WTR-LVL-A 3.84E-05 72 0.00E+00 5.31E-07 72 0.00E+00 SG-WTR-LVL-B 3.84E-05 72 0.00E+00 5.31E-07 72 0.00E+00 RCS-FLOW-A 3.84E-05 72 0.00E+00 5.31E-07 72 0.00E+00 RCS-FLOW-B 3.84E-05 72 0.00E+00 5.31E-07 72 0.00E+00 RCP-BKR 7.45E-05 72 2.97E-07 6.38E-07 72 8.76E-10 ESFAS 4.94E-05 72 9.04E-08 6.55E-07 72 1.02E-09 CONT-PRESS 3.84E-05 72 0.00E+00 5.31E-07 72 0.00E+00 5.6.5.3 ESFAS/RTS AOT Extension PRA Results - Combined Results The CDF/LERF and ICCDP/ICLERP results for unavailability of ESFAS/RTS instrumentations from the Ginna FPIE and FPRA models combined are shown in Tables 5-18 and 5-19, respectively.

TABLE 5-18 CDF/LERF RESULTS FOR UNAVAILABILITY OF ESFAS/RTS INSTRUMENTATION (COMBINED)

CASE CDFNEW

% CHANGE LERFNEW

% CHANGE Base 4.60E-05 5.73E-07 ESFAS-RTS-UA 4.62E-05 0.25%

5.74E-07 0.18%

Change 1.13E-07 1.02E-09 Evaluation of Proposed Changes 74 TABLE 5-19 COMBINED ICCDP/ICLERP FOR UNAVAILABILITY OF ESFAS/RTS INSTRUMENTATION CASE ICCDPINST ICLERPINST Base 4.60E-05 5.73E-07 PWR-RNG 8.74E-10 2.07E-12 OVR-TEMP 1.30E-10 1.07E-14 PZR-PRESS 7.29E-10 5.54E-13 PZR-WTR-LVL 2.51E-09 1.55E-12 SG-WTR-LVL-A 1.30E-10 1.07E-14 SG-WTR-LVL-B 1.30E-10 1.07E-14 RCS-FLOW-A 1.30E-10 1.07E-14 RCS-FLOW-B 1.30E-10 1.07E-14 RCP-BKR 3.08E-07 8.91E-10 ESFAS 2.29E-07 7.02E-09 CONT-PRESS 0.00E+00 0.00E+00 5.6.6 Discussion of Risk Due to External Events Ginna does not have a separate probabilistic risk assessment for seismic events. Like most nuclear power stations, Ginna completed an Individual Plant Examination of External Events in 1997. The primary areas of external event evaluation at Ginna were internal fires and seismic risk.

Since an updated, peer-reviewed Fire PRA is available and used quantitatively, no further analysis of the IPEEE results for fires is necessary. The seismic evaluations were performed in accordance with Generic Implementation Procedure (GIP) developed by the Seismic Qualification Utility Group (SQUG) of which Ginna was a member. The GIP provided plants a method for addressing Unresolved Safety Issue A-46 (Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors (USI A-46). Beyond this, Ginna performed a reduced-scope IPEEE for seismic events to close out IPEEE for Seismic Events. The Ginna USI A-46 Seismic Evaluation Report and the IPEEE Seismic Evaluation Report were transmitted to the NRC in January 1997. However, there are no comprehensive CDF and LERF values available from the seismic IPEEE report to support this evaluation, and thus a qualitative discussion and bounding quantitative evaluation of seismic risk is provided.

High Winds, External Floods and Transportation Accidents were reviewed against the Standard Review Plan (SRP) as Ginna was one of the eleven participants in the NRC's Systematic Evaluation Program (SEP). Following plant modifications, it was determined that the Ginna plant met the Standard Review Plan criteria. Based on the NRC Safety Evaluation Reports (SERs) for Ginna's SEP results, no further submittals for GL 88-20 Supplement 4 were warranted for high winds, external floods, or transportation accidents. For this reason, external event risk due to non-seismic events are considered to be insignificant in this evaluation.

Evaluation of Proposed Changes 75 5.6.6.1 Discussion of Seismic Risk The IPEEE seismic evaluation for Ginna discusses the seismic capacity of various plant components.

This evaluation qualitatively evaluated various equipment outliers and documented the necessary resolutions for seismic safe shutdown concerns. Appendix H of the IPEEE report provides the final resolution plans to resolve any outlier concerns for the IPEEE evaluation.

Since the IPEEE was performed, new seismic hazard information has been developed. The impact of the updated hazard to this evaluation is considered negligible, since Ginna screened out of the seismic hazard per the NRC/EPRI seismic reevaluations and did not require a Seismic PRA.

However, for conservatism, a stand-alone bounding calculation for the potential seismic risk of the ESFAS/RTS AOT extension is performed.

Because damage to equipment during seismic events is often correlated across trains, as shown with failures described above, extension of AOTs for ESFAS/RTS components will have a negligible impact on seismic risk estimates. If a component is failed during a particular seismic event, its corresponding opposite train component is also likely to fail. Therefore, whether it was out-of-service or not is irrelevant. If a component is not failed during a particular seismic event, it will then only contribute to seismic risk when its corresponding opposite train component is out-of-service due to random failures, which are very low and bounded by the internal events analysis. As such, it can qualitatively be inferred that there would be no significant impact on seismic risk due to extending the AOT for these ESFAS/RTS components.

As an additional set of stand-alone calculations, the potential impact of seismic events on the risk assessment is considered using inputs from the full-power internal events which has been shown to be technically adequate per peer review in accordance RG 1.200. The steps to determine the potential impact of seismic events for proposed extensions are:

1. Determine the accidents that can result from a seismic event

2. Determine the systems of interest

3. Determine how the system of interest is used to mitigate the seismically induced event

4. Determine the impact on risk metrics The primary seismic events of interest for this assessment are a loss of offsite power (LOOP) or an induced Small LOCA. The largest seismic events are expected to cause larger LOCAs and additional failures, making small changes in the availability of actuation signals a negligible impact as discussed above.

For a seismically-induced LOOP event, emergency diesel generators (EDGs) are required to start and run, auxiliary feedwater (AFW) is required to provide secondary side heat removal, and RCP seal cooling (injection or thermal barrier cooling) must continue to prevent an RCP seal LOCA, if the shutdown seals do not actuate. The only related signal for these functions that may be impacted by the AOT changes is the need to start AFW. AFW may also be started by operator action. Upon failure to start AFW, feed-and-bleed may also be possible as well, but that is also neglected here for conservatism.

Based on this expected sequence of events for a seismically-induced LOOP, the risk impact related to the change in signal unavailability can be calculated as:

Evaluation of Proposed Changes 76 CDF = f(Seismic LOOP) x change in signal unavailability x HEP(AFW start)

The values used for each term are:

f(Seismic LOOP) = Assume 1E-2 /yr since hazard information is not available for Ginna. This estimate is conservative and is reflective of the estimated frequency of the lowest ground acceleration seismic bin from a site in a significantly higher earthquake hazard area than Ginna (Table 5-1 of the EPRI Seismic Probabilistic Risk Assessment Implementation Guidance).

Change in signal unavailability = 2.73E-4 for two trains impacted (from WCAP-15376-P-A, Rev. 1, Table 8.10)

HEP(AFW Start) = (5.10E-05 from event XXHFDNOAFW (Operators fail to diagnose compelling signal indicating a loss of AFW) + 5.9E-04 from event AFHFDSTART (Op Fails to Manually Start MDAFW Pp w/ No Auto Start Signal) = 6.41E-04 Therefore, CDF (Seismic LOOP) = 1.75E-09 /yr For a Seismically-induced Small LOCA, ECCS is required to provide injection to restore inventory and recirculation capability to maintain inventory and allow decay heat removal. A Small LOCA is more severe than a Seismically-induced LOOP, so a LOOP is assumed to also occur during a Seismically-induced Small LOCA, and it is common practice to assume a Very Small LOCA occurs in any Seismic event. However, in order for the AOT extensions to impact the Seismic risk, the event needs to be severe enough to create the Small LOCA but not so severe as to impact the ECCS.

The risk impact would be calculated similar to that for Seismic LOOP, except a different operator action would be required to back up a failed actuation (SI) signal, with no additional backup actuation system.

Assuming that all Seismic events that cause a LOOP would also cause a Small LOCA, a similar approach is used:

CDF = f(Seismic LOCA) x change in signal unavailability x HEP(ECCS start)

The values used for each term are:

f(Seismic LOCA) = Assume 1E-02 from the section above.

change in signal unavailability = 2.73E-4 for two trains impacted (from WCAP-15376-P-A, Rev. 1, Table 8.10)

HEP(ECCS Start) = 5.2E-3 (from event SIHFDSTRTP, Operators fail to start an SI pump if auto-start fails)

Therefore, CDF (Seismic LOCA) = 1.42E-08 /yr Since the CDF increase is negligible for both of these cases, the LERF impact will also be negligible and the CDF and LERF changes meet the acceptance criteria in RG 1.174.

Evaluation of Proposed Changes 77 In summary, for scenarios that would damage both trains of ESFAS equipment, the status of a component being out-of-service would have a negligible impact since it would have been damaged anyway. Where a seismic scenario only damages one component, the impact would be seen with the opposite train component out-of-service, and those impacts are estimated to be very low based on these stand-alone calculations.

5.6.7 Summary of Results Examining the results with all the cases combined via examination of resulting internal events cutsets and delete-term cutsets, the small increase in average CDF and LERF is mainly due to various internal flooding induced transient scenarios where AFW fails to start automatically (one train is failed by the flood), with the operators failing to start AFW manually. In general, the ESFAS failures were more important, in part due to the conservative modeling which assumes loss of a train of signals due to modeled unavailability. RTS failures are much less significant due to the significant diversity in the signals. A review of RTS ICCDP calculations shows that the primary contributors are loss of various instrument buses (thus failing the remaining signal train).

A review of the Fire PRA cutsets shows a similar result. Various fire scenarios result in transients with a failure of AFW to start automatically (one train of signals is fire failed), followed by operators failing to start the pumps manually. The RCP breaker position trip signal has a notably larger impact on the Ginna FPRA than other RTS signals due to sequences with a large seal LOCA, which can result from failure to trip the RCPs. While the impact of this signal is higher than other RTS-related cases, it remains well below the RG 1.174 acceptance criteria.

Based on the results discussed above for internal events, fire, seismic, and external flood hazards, it was determined that any perceived risk increase would be negligible.

The results presented in Section 5.6.5 are well below the regulatory guidelines for a license amendment request:

The CDF and LERF risk metrics are well below the RG 1.174 acceptance guidelines for Region III, i.e., very small risk change.

The ICCDP for each ESFAS/RTS instrumentation AOT is well below the RG 1.177 acceptance guideline.

The ICLERP for each ESFAS/RTS instrumentation AOT is well below the RG 1.177 acceptance guideline.

5.7 Parametric Uncertainty Evaluation The evaluation of the CDF for the ESFAS/RTS instrumentation extended AOT assessment has been supported by a detailed qualitative and quantitative uncertainty evaluation. The parametric uncertainty evaluation is developed in the FPIE model quantification notebook.

The mean results for each case show similar differences from the point estimates. In addition, the cutset results for the delta CDF/LERF assessments were reviewed to determine if an epistemic correlation could influence the mean value determination. From the review of the cutsets, it was determined that the dominant contributors do not involve basic events with epistemic correlations (i.e.,

the probabilities of multiple basic events within the same cutset for the dominant contributors are not determined from a common parameter value). Per Guideline 2b of EPRI 1016737, Treatment of Parameter and Model Uncertainty for PRAs, it is acceptable to use the point estimate directly in the Evaluation of Proposed Changes 78 risk assessment. Therefore, the parameter uncertainty assessment indicates that the use of the point estimate results directly for this assessment is acceptable.

Figures 5-3, 5-4, and 5-5 show the CDF uncertainty distribution, LERF uncertainty distribution, and CDF and LERF results from the parametric uncertainty for the Ginna FPIE model, respectively.

FIGURE 5-3 GINNA CDF UNCERTAINTY DISTRIBUTION FIGURE 5-4 GINNA LERF UNCERTAINTY DISTRIBUTIONS Evaluation of Proposed Changes 79 FIGURE 5-5 PARAMETRIC UNCERTAINTY FOR GINNA FPIE MODEL 5.8 Model Uncertainty The assessment of model uncertainty utilizes the guidance provided in EPRI 1016737 and in NUREG-1855 and considers the following:

1. Characterize the manner in which the PRA model is used in the application.

2. Characterize modifications to the PRA model.

3. Identify application-specific contributors.

4. Assess sources of model uncertainty in the context of important contributors.

Evaluation of Proposed Changes 80

a. Also consider other sources of model uncertainty from the base PRA model assessment for the identification of candidate key sources of uncertainty.

b. Screen based on relevance to parts of PRA needed or based on relevance to the results.

5. Identify sources of model uncertainty and related assumptions relevant to the application.

a. This involves the formulation of sensitivity studies for those sources of uncertainty that may challenge the acceptance guidelines and an interpretation of the results.

5.8.1 Characterize the Manner in which the PRA Model is Used in the Application The manner in which the PRA model is used in this application is fully described above and is not reproduced here.

5.8.2 Characterize Modifications to the PRA Model The minor changes made to the PRA model of record (MOR) are described in Section 5.6.4.2. These changes made to the model do not introduce any application-specific sources of model uncertainty for this analysis.

5.8.3 Identify Application-Specific Contributors Application-specific contributors are fully discussed in Section 5.6.7 via examination of resulting cutsets and delete-term cutsets. The important contributors to the delta-risk metrics were identified as increases due to a few specific initiating events that are more impacted by the potentially increased unavailabilitys. These initiating events are based on industry and plant-specific data and calculated using accepted realistic methods. Therefore, these application-specific contributors do not introduce any new sources of model uncertainty.

5.8.4 Assess Sources of Model Uncertainty in Context of Important Contributors to the Base Model A review of the identified sources of model uncertainty from the base model assessment as identified by implementing the process outlined in EPRI 1016737 for Ginna was then performed. This review determined which of those items are potentially applicable for this assessment even though they did not appear as a dominant contributor in the base assessment for the application. Based on this review, some of the items were already identified and many do not warrant further analysis, but the following items were added for investigation since they were judged to be potentially applicable for this application.

Treatment of CCFs when one component is failed Equipment in Test & Maintenance Based on the identified important contributors and the addition of applicable base PRA model sources of uncertainty identified above, the next step was to perform an assessment to determine if sources of uncertainty have been addressed in the PRA that affect the important contributors for the application.

For the ICCDP/ICLERP calculations where selected components are set as failed, the approach conservatively adjusts the CCF failure probabilities for corresponding events for the RTS signal failure common cause event. This is considered conservative since not all failures would be subject to Evaluation of Proposed Changes 81 common cause failure modes. Therefore, this is not identified as a model uncertainty that could impact the decision.

The test and maintenance events in the model for ESFAS/RTS components are set based on plant data or on historical values that are considered realistic or conservative. In these risk evaluations, these unavailability terms are conservatively increased, and the results are below the acceptance criteria. Therefore, there is no unique model uncertainty related to these event probabilities that would impact the model to the extent to impact the decision.

As identified in Section 5.6.7, the main contributors are related to a few specific scenarios that require the ESFAS components. These initiating events are based on industry data sources, and because the risk results are well below the acceptance criteria, there is no unique model uncertainty related to the main contributors that would impact the model to the extent to impact the decision.

5.8.5 Identify Sources of Model Uncertainty and Related Assumptions Relevant to the Application Based on the evaluation of important contributors above, no items were identified as key sources of uncertainty that would impact the risk results to an extent to affect the decision.

5.8.6 Completeness Uncertainty As discussed in Section 5.6.6, external hazards from seismic and external flooding events were addressed using conservative quantitative and qualitative analyses as not having a significant contribution to any risk increases associated with these AOT extensions. Other external hazards, as discussed in the IPEEE, were screened out as being insignificant. Therefore, only three hazard groups (internal events, internal floods, and internal fire) were explicitly calculated for this risk assessment.

Therefore, there is no major form of completeness uncertainty that would impact the results of this assessment.

5.9 Tier 2 and Tier 3 Risk Assessments 5.9.1 Tier 2. Avoidance of Risk Significant Plant Configurations The purpose of this section is to demonstrate that there are appropriate restrictions on dominant risk-significant configurations associated with the proposed changes. The Tier 1 evaluations show that ICCDP and ICLERP are far below acceptance criteria, thus it is unlikely that the plant will enter a risk-significant configuration while in the equipment covered in this LAR is out of service. Based on examination of results (such as described in Section 5.6.7) to determine if any specific failures dominate the results, the compensatory measures discussed in Section 5.5 are adequate to cover equipment addressed in this LAR.

5.9.2 Tier 3. Risk-Informed Configuration Management Implementation of the Ginna Configuration Risk Management Program, which meets the requirements in RG 1.177 Section 2.3.7.2, helps to ensure there is no significant risk increase while instrument maintenance is being performed. This tier is important because all possible risk-significant configurations under Tier 2 cannot be predicted. Ginna implements the applicable portions of the Maintenance Rule by using the endorsed guidance (RG 1.160) of Section 11.0 of NUMARC 93-01.

Evaluation of Proposed Changes 82 Ginna uses the PARAGON Configuration Risk Monitor program to implement 10 CFR 50.65(a)(4).

For quantitative results, PARAGON links to the same fault trees and database as the internal events PRA model, so it is fully capable of evaluating CDF and LERF for internal events. The loading and use of PARAGON is procedurally controlled by the EGC PRA and Work Control procedures.

When maintenance or testing is scheduled, the Operations, Work Week Management and Site Risk Management staff perform and review weekly risk analyses using the PARAGON program. For unplanned or emergent equipment failures, control room personnel will enter the configuration into PARAGON. In either case, the configuration will be evaluated to assess and manage the risk.

Ginna procedures recognize there are limitations in PARAGON and specifically direct consideration of external events and site activities that can result in significant plant events. High Risk Evolutions (HRE), site activities and external events such as lightning, high winds, and solar magnetic disturbances, are addressed qualitatively in the PARAGON model based on the Ginnas redundancy to mitigate the effected transient. WC-AA-101 Attachment 6 provides guidance on the declaration of a High-Risk Evolution. Fire Risk management actions are governed by WC-AA-101-1006 and OP-AA-201-012-1001. High Risk Fire Equipment and Risk Management Actions are developed when a new model becomes available, prior to use in the (a)(4) process. During a work week the PARAGON program has been coded to identify if any of these High Fire Risk Components are included in the work schedule. If that window is then determined to be an (a)(4) Fire Risk Window further actions are taken in accordance with OP-AA-201-012-1001.

Risk associated with unavailable plant equipment is assessed at Ginna as required by 10 CFR 50.65(a)(4). The EGC work management administrative procedure, WC-AA-101, ON-LINE WORK CONTROL PROCESS, governs on-line risk assessments. The on-line risk assessment is a blended approach using qualitative or defense-in-depth considerations and quantifiable PRA risk insights.

Ginna communicates on-line plant risk using four risk tiers (GREEN, YELLOW, ORANGE and RED).

The on-line risk level for Ginna will remain GREEN for an outage of any single instrument scoped into this proposed change. At this level, risk is considered close to baseline, and compliance with technical specification requirements would be considered adequate risk management.

Protecting equipment requires the posting of signs and robust barriers to alert personnel not to approach the protected equipment. Work on protected equipment is generally disallowed. Minor exceptions exist for activities such as inspections, security patrols, or emergency operations. Other exceptions may be authorized by the station shift manager in writing. If additional unplanned equipment unavailability occurs, station procedures direct that the risk be re-evaluated, and if found to be unacceptable, compensatory actions are taken until such a time that the risk is reduced to an acceptable level.

In addition, OP-AA-108-117, PROTECTED EQUIPMENT PROGRAM, directs the Operations and Work Management personnel to routinely monitor various maintenance configurations and protect redundant equipment that could lead to an elevated risk condition (e.g., red risk condition) if it were to become unavailable due to unplanned or emergent conditions. This is normally accomplished using the PARAGON PRA software tool, supplemented by operations and work management procedures.

Evaluation of Proposed Changes 83

6.0 REGULATORY EVALUATION

6.1 Applicable Regulatory Requirements/Criteria The proposed changes to the Ginna TS will allow an increase in completion times and bypass test times for selected RTS and ESFAS instruments. There are no physical changes to these systems nor are any instrument setpoints affected by the proposed changes. As such, the following regulatory requirements/criteria apply to the proposed changes.

1) General Design Criteria (GDC) 13, Instrument and Control, requires that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems.

The proposed changes do not impact Ginnas compliance with this criterion since the RTS and ESFAS instrumentation remain unchanged.

2) GDC 20, Protection System Functions, requires that the protection system(s) shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

The proposed changes do not impact Ginnas compliance with this criterion since the design and functions of the applicable instruments remain unchanged.

3) GDC 21, Protection System Reliability and Testability, requires that the protection system(s) shall be designed for high functional reliability and testability.

The proposed changes do not impact Ginnas compliance with this criterion since they do not make any physical changes to the RTS or ESFAS systems and, therefore, do not impact the reliability or testability of these systems.

4) GDC 22 through GDC 25 and GDC 29 require various design attributes for the protection system(s), including independence, safe failure modes, separation from control systems, requirements for reactivity control malfunctions, and protection against anticipated operational occurrences.

The proposed changes do not impact Ginnas compliance with these criteria since there are no design changes to the RTS or ESFAS systems associated with increasing the completion times and bypass test times.

5) Regulatory Guide (RG) 1.22 discusses the periodic testing of protection system actuation functions. These periodic tests should duplicate, as closely as possible, the performance that is required of the actuation devices in the event of an accident.

The proposed changes do not impact how Ginna addresses this RG since there is no change to how the periodic testing of the RTS and ESFAS functions are performed.

Evaluation of Proposed Changes 84

6) 10 CFR 50.55a(h) requires that the protection systems meet IEEE 279-1971. Section 4.2 of IEEE 279-1971 discusses the general functional requirement for protection systems to assure they satisfy the single failure criterion.

The proposed changes do not impact how Ginna meets this regulation in that there are no physical changes that would affect how the single failure criterion is met.

The proposed changes also allow ESFAS Function 6c to be bypassed during surveillance testing and a completion time to be applied prior to placing it in a trip condition as well as excluding the input relays from COT requirements. The regulatory evaluation for these changes is the same as presented in Ginna LAR dated November 16, 2017 (ML17321A107).

6.2 Precedent The NRC has approved similar submittals for completion and bypass test times as indicated below.

1) Letter from J. S. Kim (U. S. Nuclear Regulatory Commission) to P. P. Sena (PSEG Nuclear, LLC), Salem Nuclear Generating Station, Unit Nos. 1 and 2 - Issuance of Amendment Nos.

325 and 306 RE: Revise Technical Specification Reactor Trip System Instrumentation and Engineered Safety Features Actuation System Instrumentation Test Times and Completion Times (EPID L-2017-LLA-0442), dated December 19, 2018 [ML18318A266]

2) Letter from R. V. Guzman (U. S. Nuclear Regulatory Commission) to D. A. Heacock (Dominion Nuclear), Millstone Power Station, Unit No. 3 - Issuance of Amendment RE: Implementation of WCAP-14333 and WCAP-15376, Reactor Trip System and Engineered Safety Features Actuation System Instrumentation Test Times and Completion Times (CAC No. MF4131),

dated November 30, 2015 [ML15288A004]

3) Letter from N. S. Morgan (U. S. Nuclear Regulatory Commission) to P. P. Sena (FirstEnergy Nuclear Operating Company), Beaver Valley Power Station, Unit Nos. 1 and 2 - Issuance of Amendments RE: Technical Specification Task Force 411 and 418 (TAC Nos. MD7531 and MD7532), dated December 29, 2008 [ML083380061]

4) Letter from J. Donohew (U. S. Nuclear Regulatory Commission) to C. D. Naslund (Union Electric Company), Callaway Plant, Unit 1 - Issuance of Amendment RE: Plant Protection Test Times, Completion Times, and Surveillance Test Intervals (TAC No. MC1756), dated January 31, 2005 [ML050320484]

5) Letter from J. Donohew (U. S. Nuclear Regulatory Commission) to M. R. Blevins (TXU Energy), Comanche Peak Steam Electric Station (CPSES), Units 1 and 2 - Issuance of Amendment RE: Plant Protection Test Times, Completion Times, and Surveillance Test Intervals (TAC Nos. MC1845 and MC1846), dated January 31, 2005 [ML050460331]

6) Letter from J. Donohew (U. S. Nuclear Regulatory Commission) to G. M. Rueger (Pacific Gas and Electric Company), Diablo Canyon Power Plant, Unit No. 1 (TAC No. MC2024) and Unit No. 2 (TAC No. MC2025) - Issuance of Amendment RE: Plant Protection Test Times, Completion Times, and Surveillance Test Intervals, dated January 31, 2005 [ML050330315]

7) Letter from J. Donohew (U. S. Nuclear Regulatory Commission) to R. A. Muench (Wolf Creek Nuclear Operating Corporation), Wolf Creek Generating Station - Issuance of Amendment RE: Plant Protection Test Times, Completion Times, and Surveillance Test Intervals (TAC Nos. MC1656), dated January 31, 2005 [ML050320254]

Evaluation of Proposed Changes 85 The NRC has approved a similar submittal for ESFAS Function 6c in the following letter:

1) Letter from V. Sreenivas (U. S, Nuclear Regulatory Commission) to B. C. Hanson (Exelon Generation Company, LLC), R. E. Ginna Nuclear Power Plant - Issuance of Amendment No.

132 to Revise Technical Specifications 3.3.1, Reactor Trip System Instrumentation, and 3.3.2, Engineered Safety Feature Actuation System Instrumentation (EPID L-2017-LLA-0388), dated November 13, 2018 [ML18213A369]

6.3 No Significant Hazards Consideration Exelon Generation Company, LLC (EGC) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, Issuance of amendment, as discussed below.

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed changes to the completion times and bypass test times reduce the potential for inadvertent reactor trips and spurious actuations, and therefore do not increase the probability of any accident previously evaluated. The proposed changes also do not change the response of the plant to any accidents and have an insignificant impact on the reliability of the RTS and ESFAS signals. The RTS and ESFAS will remain highly reliable and the proposed changes will not result in a significant increase in the risk of plant operation. This is demonstrated by showing that the impact on plant safety as measured by Core Damage Frequency (CDF) is less than 1.0E-06 per year and the impact on Large Early Release Frequency (LERF) is less than 1.0E-07 per year. In addition, for the completion time changes, the Incremental Conditional Core Damage Probabilities (ICCDP) and Incremental Conditional Large Early Release Probabilities (ICLERP) are less than 5.0E-07 and 5.0E-08, respectively. These changes meet the acceptance criteria in Regulatory Guides 1.174 and 1.177. Therefore, since the RTS and ESFAS will continue to perform their functions with high reliability as originally assumed, and the increase in risk as measured by CDF, LERF, ICCDP, and ICLERP is within the acceptance criteria of existing regulatory guidance, there will not be a significant increase in the consequences of any accidents.

The proposed changes do not adversely affect accident initiators or precursors nor alter the design assumptions, conditions, or configurations of the facility or the manner in which the plant is operated and maintained. The proposed changes do not alter or prevent the ability of structures, systems, and components (SSCs) from performing their intended function to mitigate the consequences on an initiating event within the assumed acceptance limits. The proposed changes do not affect the source term, containment isolation, or radiological release assumptions used in evaluating the radiological consequences of an accident previously evaluated. The proposed changes are consistent with safety analysis assumptions and resultant consequences.

Therefore, the proposed changes do not significantly increase the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

Evaluation of Proposed Changes 86 The proposed changes do not result in a change in the manner in which the RTS and ESFAS provide plant operation. The RTS and ESFAS will continue to have the same setpoints after the proposed changes are implemented. There are no design changes associated with this License Amendment Request. The changes to completion times and bypass test times do not change any existing accident scenarios, nor create any new or different accident scenarios.

The proposed changes do not involve a modification to the physical configuration of the plant or changes in the methods governing normal plant operation. The proposed changes will not impose any new or different requirements or introduce a new accident initiator, accident precursor, or malfunction mechanism.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Do the proposed changes involve a significant reduction in a margin of safety?

Response: No.

The proposed changes do not alter the manner in which safety limits, limiting safety system settings, or limiting conditions for operation are determined. The safety analysis acceptance criteria are not impacted by these changes. Redundant RTS and ESFAS trains are maintained, and diversity with regard to the signals that provide reactor trip and engineered safety features actuation is also maintained. All signals credited as primary or secondary, and all operator actions credited in the accident analyses will remain the same. The proposed changes will not result in plant operation in a configuration outside the design basis. The calculated impact on risk is insignificant and meets the acceptance criteria contained in Regulatory Guides 1.174 and 1.177.

Therefore, since the proposed changes do not impact the response of the plant to a design basis accident, the proposed changes do not involve a significant reduction in a margin of safety.

6.4 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commissions regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

7.0 ENVIRONMENTAL CONSIDERATION

A review has determined that the proposed amendment would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed amendment does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluent that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

Markup of Proposed Technical Specification Pages Revised Technical Specification Pages 3.3.1-2 3.3.1-4 3.3.1-5 3.3.1-6 3.3.1-7 3.3.2-2 3.3.2-3 3.3.2-4

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME D.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

D.1

- NOTE -

1. For Functions 2a, 2b, 5, 6, 7b, 8, and 13, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months E.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

E.1 Reduce THERMAL POWER to < 5E-11 amps.

OR E.2

- NOTE -

Required Action E.2 is not applicable when:

a.

Two channels are inoperable, or

b.

THERMAL POWER is

< 5E-11 amps.

Increase THERMAL POWER to 8% RTP.

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months 2 hours F.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

F.1 Open RTBs and RTBBs upon discovery of two inoperable channels.

AND Immediately upon discovery of two inoperable channels R.E. Ginna Nuclear Power Plant 3.3.1-2 Amendment 132 12 72 12

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME H.3 Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months I.

Required Action and associated Completion Time of Condition H not met.

I.1 Initiate action to fully insert all rods.

AND I.2 Place the Control Rod Drive System in a condition incapable of rod withdrawal.

Immediately 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months J.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

J.1

- NOTE -

Plant temperature changes are allowed provided the temperature change is accounted for in the calculated SDM.

Suspend operations involving positive reactivity additions.

AND J.2 Perform SR 3.1.1.1.

Immediately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months AND Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter K.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

K.1

- NOTE -

1. For Functions 7a and 9b, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months R.E. Ginna Nuclear Power Plant 3.3.1-4 Amendment 132 12 12 72

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME L.

Required Action and associated Completion Time of Condition K not met.

L.1 Reduce THERMAL POWER to < 8.5% RTP.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months M.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

M.1

- NOTE -

1. For Function 9a, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months N.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

N.1 Restore channel to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months O.

Required Action and associated Completion Time of Condition M or N not met.

O.1 Reduce THERMAL POWER to < 30% RTP.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months P.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

P.1

- NOTE -

The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Q.

Required Action and Associated Completion Time of Condition P not met.

Q.1 Reduce THERMAL POWER to < 50% RTP.

AND 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months R.E. Ginna Nuclear Power Plant 3.3.1-5 Amendment 132 12 12 72

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME Q.2.1 Verify Steam Dump System is OPERABLE.

OR Q.2.2 Reduce THERMAL POWER to < 8% RTP.

7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months 7 hours R.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

R.1

- NOTE -

One train may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing provided the other train is OPERABLE.

Restore train to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months S.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

S.1

-NOTE-For Functions 16c, 16d, and 16e, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

Verify interlock is in required state for existing plant conditions.

OR S.2 Declare associated RTS Function channel(s) inoperable.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months 1 hour R.E. Ginna Nuclear Power Plant 3.3.1-6 Amendment 132 12

RTS Instrumentation 3.3.1 CONDITION REQUIRED ACTION COMPLETION TIME T.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

T.1

- NOTE -

1.

One train may be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing, provided the other train is OPERABLE.

2.

One RTB may be bypassed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance on undervoltage or shunt trip mechanisms, provided the other train is OPERABLE.

Restore train to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months U.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

U.1 Restore at least one trip mechanism to OPERABLE status upon discovery of two RTBs with inoperable trip mechanisms.

AND U.2 Restore trip mechanism to OPERABLE status.

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of two inoperable trip mechanisms 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months V.

Required Action and associated Completion Time of Condition R, S, T, or U not met.

V.1 Be in MODE 3.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months W.

As required by Required Action A.1 and referenced by Table 3.3.1-1.

W.1 Restore at least one trip mechanism to OPERABLE status upon discovery of two RTBs with inoperable trip mechanisms.

AND 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of two inoperable trip mechanisms R.E. Ginna Nuclear Power Plant 3.3.1-7 Amendment 112 4

24

ESFAS Instrumentation 3.3.2 CONDITION REQUIRED ACTION COMPLETION TIME F.

As required by Required Action A.1 and referenced by Table 3.3.2-1.

F.1

- NOTE -

1. For Functions 4c and 5b, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months G.

Required Action and associated Completion Time of Condition D, E, or F not met.

G.1 Be in MODE 3.

AND G.2 Be in MODE 4.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours H.

As required by Required Action A.1 and referenced by Table 3.3.2-1.

H.1 Restore channel to OPERABLE status.

48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months I.

As required by Required Action A.1 and referenced by Table 3.3.2-1.

I.1 Restore train to OPERABLE status.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months J.

As required by Required Action A.1 and referenced by Table 3.3.2-1.

J.1

- NOTE -

1. For Functions 1c, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months R.E. Ginna Nuclear Power Plant 3.3.2-2 Amendment 132

, 5b, and 6c, 12 12 72 12 12 72

ESFAS Instrumentation 3.3.2 CONDITION REQUIRED ACTION COMPLETION TIME K.

Required Action and associated Completion Time of Condition H, I, or J not met.

K.1 Be in MODE 3.

K.2 K.3 AND Be in MODE 5.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 36 hours L.

As required by Required Action A.1 and referenced by Table 3.3.2-1.

L.1

- NOTE -

1. For Functions 1d and 1e, one channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing.

2. The inoperable channel may be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of the other channels.

Place channel in trip.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months M.

Required Action and associated Completion Time of Condition L not met.

M.1 Be in MODE 3.

AND M.2 Reduce pressurizer pressure to < 2000 psig.

6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months 12 hours N.

As required by Required Action A.1 and referenced by Table 3.3.2-1.

N.1 Declare associated Auxiliary Feedwater pump inoperable and enter applicable condition(s) of LCO 3.7.5, "Auxiliary Feedwater (AFW)

System."

Immediately SURVEILLANCE REQUIREMENTS

- NOTE -

Refer to Table 3.3.2-1 to determine which SRs apply for each ESFAS Function.

SURVEILLANCE FREQUENCY SR 3.3.2.1 Perform CHANNEL CHECK In accordance with the surveillance Frequency Control Program R.E. Ginna Nuclear Power Plant 3.3.2-3 Amendment 132 12 12 72

ESFAS Instrumentation 3.3.2 SURVEILLANCE FREQUENCY SR 3.3.2.2

- NOTE-The ESFAS input relays are excluded from this surveillance for Functions 1c, 1d, 1e, 4c, and 5b.

Perform COT.

In accordance with the Surveillance Frequency Control Program SR 3.3.2.3

- NOTE -

Verification of relay setpoints not required.

Perform TADOT.

In accordance with the Surveillance Frequency Control Program SR 3.3.2.4

- NOTE -

Verification of relay setpoints not required.

Perform TADOT.

In accordance with the Surveillance Frequency Control Program SR 3.3.2.5 Perform CHANNEL CALIBRATION In accordance with the Surveillance Frequency Control Program SR 3.3.2.6 Verify the Pressurizer Pressure-Low and Steam Line Pressure-Low Functions are not bypassed when pressurizer pressure > 2000 psig.

In accordance with the Surveillance Frequency Control Program SR 3.3.2.7 Perform ACTUATION LOGIC TEST.

In accordance with the Surveillance Frequency Control Program R.E. Ginna Nuclear Power Plant 3.3.2-4 Amendment 132 5b, and 6c.

Markup of Proposed Technical Specification Bases Pages Revised Technical Specification Bases Pages B 3.3.1-31 B 3.3.1-34 B 3.3.1-35 B 3.3.1-37 B 3.3.1-47 B 3.3.2-27 B 3.3.2-29 B 3.3.2-30 B 3.3.2-35

B 3.3.1-31 Revision 61 R.E. Ginna Nuclear Power Plant RTS Instrumentation B 3.3.1 Overtemperature 'T; Overpower 'T; Pressurizer Pressure-High; Pressurizer Water Level-High; and SG Water Level-Low Low.

With one channel inoperable, the channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Placing the channel in the tripped condition results in a partial trip condition. For the Power Range Neutron Flux-High, Power Range Neutron Flux-Low, Overtemperature 'T, and Overpower 'T functions, this results in a one-out-of-three logic for actuation. For the Pressurizer Pressure-High and Pressurizer Water Level-High Functions, this results in a one-out-of two logic for actuation. For the SG Water Level-Low Low Function, this results in a one-out-of-two logic per each affected SG for actuation. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the inoperable channel in the tripped condition is consistent with Reference 9.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypass condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of other channels. This includes placing the inoperable channel in the bypass condition to allow setpoint adjustments of other channels when required to reduce the setpoint in accordance with other Technical Specifications. This 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the remaining OPERABLE channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

E.1 and E.2 Condition E applies to the Intermediate Range Neutron Flux trip Function when THERMAL POWER is below 6% RTP and one channel is inoperable. Below the P-10 setpoint, the NIS intermediate range detector performs a monitoring and protection function. With one NIS intermediate range channel inoperable, 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is allowed to either reduce THERMAL POWER below 5E-11amps or increase THERMAL POWER above 8% RTP. If THERMAL POWER is greater than the P-10 setpoint, the NIS power range detectors perform the monitoring and protection functions and the intermediate range is not required. The Completion Times allow for a slow and controlled power adjustment above 8% RTP or below 5E-11amps and take into account the redundant capability afforded by the redundant OPERABLE channel, and the low probability of its failure during this period. This action does not require the inoperable channel to be tripped because the Function uses one-out-of-two logic. Tripping one channel would trip the reactor. Thus, the Required Actions specified in this Condition are only applicable when channel inoperability does not result in reactor trip.

72 72 References 11 and 13 12 References 11 and 13 12 12 Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time specified for functions with installed bypass capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass.

two Notes. Note 1 allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Functions 2a, 2b, 5, 6, 7b, 8, and 13. Note 2

B 3.3.1-34 Revision 61 R.E. Ginna Nuclear Power Plant RTS Instrumentation B 3.3.1 K.1 Condition K applies to the following reactor trip Functions:

Pressurizer Pressure-Low; Reactor Coolant Flow-Low (Two Loops);

RCP Breaker Position (Two Loops);

Undervoltage-Bus 11A and 11B; and Underfrequency-Bus 11A and 11B.

With one channel inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

Placing the channel in the tripped condition results in a partial trip condition requiring only one additional channel to initiate a reactor trip.

The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to place the channel in the tripped condition is consistent with Reference 9 if the inoperable channel cannot be restored to OPERABLE status.

Allowance of this time interval takes into consideration the redundant capability provided by the remaining redundant OPERABLE channel(s),

and the low probability of occurrence of an event during this period that may require the protection afforded by the Functions associated with Condition K.

For the Reactor Coolant Flow-Low (Two Loops) Function, Condition K applies on a per loop basis. For the RCP Breaker Position (Two Loops)

Function, Condition K applies on a per RCP basis. For Undervoltage-Bus 11A and 11B and underfrequency-Bus 11A and 11B, Condition K applies on a per bus basis. This allows one inoperable channel from each loop, RCP, or bus to be considered on a separate condition entry basis.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the remaining OPERABLE channels.

72 72 12 12 12 Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time specified for functions with installed bypass capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass.

two Notes. Note 1 allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Functions 7a and 9b. Note 2 References 11 and 13 References 11 and 13

B 3.3.1-35 Revision 61 R.E. Ginna Nuclear Power Plant RTS Instrumentation B 3.3.1 L.1 If the Required Action and Completion Time of Condition K is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in MODE 1 < 8.5% RTP at which point the Function is no longer required. An alternative is not provided for increasing THERMAL POWER above the P-8 setpoint for the Reactor Coolant Flow-Low (Two Loops) and RCP Breaker Position (Two Loops) trip Functions since this places the plant in Condition M.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 1 < 8.5% RTP from full power conditions in an orderly manner and without challenging plant systems.

M.1 Condition M applies to the Reactor Coolant Flow-Low (Single Loop) reactor trip Function. Condition M applies on a per loop basis. With one channel per loop inoperable, the inoperable channel must be restored to OPERABLE status or placed in the tripped condition within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or place in trip is consistent with Reference 9.

The Required Actions have been modified by a Note that allows placing the inoperable channel in the bypassed condition for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months while performing surveillance testing of the other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is applied to each of the two OPERABLE channels. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months time limit is consistent with Reference 9.

N.1 Condition N applies to the RCP Breaker Position (Single Loop) trip Function. Condition N applies on a per loop basis. There is one breaker position device per RCP breaker. With one channel per RCP inoperable, the inoperable channel must be restored to OPERABLE status within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status is consistent with Reference 9.

O.1 If the Required Action and associated Completion Time of Condition M or N is not met, the plant must be placed in a MODE where the Functions are not required to be OPERABLE. To achieve this status, THERMAL POWER must be reduced to < 30% RTP within the next 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 9.

72 72 12 12 12 Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time specified for functions with installed bypass capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass.

two Notes. Note 1 allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Function 9a. Note 2 References 11 and 13 References 11 and 13

B 3.3.1-37 Revision 61 R.E. Ginna Nuclear Power Plant RTS Instrumentation B 3.3.1 S.1 and S.2 Condition S applies to the P-6, P-7, P-8, P-9, and P-10 permissives. With one channel inoperable, the associated interlock must be verified to be in its required state for the existing plant condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the associated RTS channel(s) must be declared inoperable. These actions are conservative for the case where power level is being raised. Verifying the interlock status manually accomplishes the interlock's Function. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on operating experience and the minimum amount of time allowed for manual operator actions.

T.1 Condition T applies to the RTBs in MODES 1 and 2. With one train inoperable, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the train to OPERABLE status.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on operating experience and the minimum amount of time allowed for manual operator actions.

The Required Action has been modified by two Notes. Note 1 allows one train to be bypassed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing, provided the other train is OPERABLE. Note 2 allows one RTB to be bypassed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance on undervoltage or shunt trip mechanisms if the other RTB train is OPERABLE. The 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for maintenance is in addition to the 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for surveillance testing (e.g., if a RTB fails 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months into its testing window, it must be restored within 6 additional hours (or 7 hours8.101852e-5 days 0.00194 hours 1.157407e-5 weeks 2.6635e-6 months from start of test)).

U.1 and U.2 Condition U applies to the RTB Undervoltage and Shunt Trip Mechanisms (i.e., diverse trip features) in MODES 1 and 2. Condition U applies on a RTB basis. This allows one diverse trip feature to be inoperable on each RTB. However, with two diverse trip features inoperable (i.e., one on each of two different RTBs), at least one diverse trip feature must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable considering the low probability of an event occurring during this time interval.

With one trip mechanism for one RTB inoperable, it must be restored to an OPERABLE status within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The affected RTB shall not be bypassed while one of the diverse trip features is inoperable except for the time required to perform maintenance to one of the diverse trip features. The allowable time for performing maintenance of the diverse trip features is 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for the reasons stated under Condition T. The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months for Required Action U.2 is reasonable considering that in this Condition there is one remaining diverse trip feature for the affected RTB, and one OPERABLE RTB capable of performing the safety function and given the low probability of an event occurring during this interval.

4 4

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months completion time is consistent with WCAP-15376-P-A (Reference 12).

Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time specified for functions with installed bypass capability. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass. The Required Actions have been modified by a Note that allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Functions 16c, 16d, and 16e. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months bypass time is consistent with Reference 13.

24 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months

RTS Instrumentation B 3.3.1 R.E. Ginna Nuclear Power Plant B 3.3.1-47 Revision 89 REFERENCES

1.

Atomic Industry Forum (AIF) GDC 14, Issued for comment July 10, 1967.

2.

10 CFR 50.67.

3.

American National Standard, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants," N18.2-1973.

4.

UFSAR, Chapter 7.

5.

UFSAR, Chapter 6.

6.

UFSAR, Chapter 15.

7.

IEEE-279-1971.

8.

EP-3-S-0505, "Instrument Setpoint/Loop Accuracy Calculation Methodology".

9.

WCAP-10271-P-A, Supplement 2, Revision 1, June 1990.

10 "Power Range Nuclear Instrumentation System Bypass Test Instrumentation for R. E. Ginna," WCAP-18298-P, September 2017.

11. WCAP-14333-P-A, Revision 1, October 1998.

12. WCAP-15376-P-A, Revision 1, March 2003.

13. Ginna PRA Analysis for ESFAS/RTS AOT Extension, G1-LAR-005.

B 3.3.2-27 Revision 42 R.E. Ginna Nuclear Power Plant ESFAS Instrumentation B 3.3.2 Condition E addresses the train orientation of the protection system and the master and slave relays. If one train is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the train to OPERABLE status. This Completion Time is reasonable considering that there is another train OPERABLE, and the low probability of an event occurring during this time interval. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is consistent with Reference 7.

F.1 Condition F applies to the following Functions:

Steam Line Isolation-Containment Pressure-High High; Steam Line Isolation-High Steam Flow Coincident With Safety Injection and Coincident With Tavg -Low; Steam Line Isolation-High-High Steam Flow Coincident With Safety Injection; Feedwater Isolation-SG Water Level-High; and AFW-SG Water Level-Low Low.

Condition F applies to Functions that typically operate on two-out-of-three logic. Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or to place it in the tripped condition. Placing the channel in the Tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Actions are modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. This 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowed to restore the channel to OPERABLE status or to place the inoperable channel in the tripped condition, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for testing, are justified in Reference 7.

72 72 12 9

12 12 Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time specified for functions with installed bypass capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass.

two Notes. Note 1 allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Functions 4c, 5b, and 6c. Note 2

B 3.3.2-29 Revision 42 R.E. Ginna Nuclear Power Plant ESFAS Instrumentation B 3.3.2 J.1 Condition J applies to the following Functions:

SI-Containment Pressure-High; and CS-Containment Pressure-High High.

Condition J applies to Functions that operate on a two-out-of-three logic (for CS-Containment Pressure-High High there are two sets of this logic).

Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the inoperable channel or place it in trip, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for surveillance testing is justified in Reference 7.

K.1 If the Required Actions and Completion Times of Conditions H, I, or J are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

L.1 Condition L applies to the following Functions:

SI-Pressurizer Pressure-Low; and SI-Steam Line Pressure-Low.

12 12 12 72 72 Reference 10 Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time specified for functions with installed bypass capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass.

two Notes. Note 1 allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Function 1c. Note 2

ESFAS Instrumentation B 3.3.2 B 3.3.2-30 Revision 42 R.E. Ginna Nuclear Power Plant Condition L applies to Functions that operate on a two-out-of-three logic.

Therefore, failure of one channel places the Function in a two-out-of-two configuration. One channel must be tripped to place the Function in a one-out-of-two configuration that satisfies redundancy requirements.

If one channel is inoperable, a Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is allowed to restore the channel to OPERABLE status or place it in the tripped condition. Placing the channel in the tripped condition conservatively compensates for the inoperability, restores capability to accommodate a single failure, and allows operation to continue.

The Required Action is modified by a Note that allows the inoperable channel to be bypassed for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for surveillance testing of other channels. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months applies to each of the remaining OPERABLE channels.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to restore the inoperable channel or place it in trip, and the 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allowed for surveillance testing is justified in Reference 7.

M.1 If the Required Actions and Completion Times of Condition L are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and pressurizer pressure reduced to < 2000 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

N.1 Condition N applies if an AFW Manual Initiation channel is inoperable. If a manual initiation switch is inoperable, the associated AFW or SAFW pump must be declared inoperable and the applicable Conditions of LCO 3.7.5, "Auxiliary Feedwater (AFW) System" must be entered immediately.

Each AFW manual initiation switch controls one AFW or SAFW pump.

Declaring the associated pump inoperable ensures that appropriate action is taken in LCO 3.7.5 based on the number and type of pumps involved.

72 72 12 12 12 Troubleshooting, corrective maintenance, and post maintenance re-testing can be performed in bypass within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time specified for functions with installed bypass capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months clock starts as soon as the action statement is entered and does not include the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for surveillance testing in bypass.

two Notes. Note 1 allows bypassing a channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing for Functions 1d and 1e. Note 2 References 9 and 10

ESFAS Instrumentation B 3.3.2 B 3.3.2-35 Revision 89 R.E. Ginna Nuclear Power Plant REFERENCES

1.

Atomic Industrial Forum (AIF) GDC 15, Issued for Comment July 10, 1967.

2.

UFSAR, Chapter 7.

3.

UFSAR, Chapter 6.

4.

UFSAR, Chapter 15.

5.

IEEE-279-1971.

6.

EP-3-S-0505, "Instrument Setpoint/Loop Accuracy Calculation Methodology".

7.

WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

8 "Power Range Nuclear Instrumentation System Bypass Test Instrumentation for R. E. Ginna," WCAP-18298-P, September 2017.

9. WCAP-14333-P-A, Revision 1, October 1998.

10. Ginna PRA Analysis for ESFAS/RTS AOT Extension, G1-LAR-005.

v t e Letter Sequence Request
EPID:L-2020-LLA-0055, TSTF-418 (Approved, Closed)
Initiation Request Acceptance Administration Questions 5 August 2020 Answers 4 September 2020 Results Approval Other:
MONTHYEAR2020-08-05 [Table View]

ML20085H900

Text

Subject:

SUMMARY

3.0 BACKGROUND

6.0 REGULATORY EVALUATION

7.0 ENVIRONMENTAL CONSIDERATION

SUMMARY

3.0 BACKGROUND

6.0 REGULATORY EVALUATION

7.0 ENVIRONMENTAL CONSIDERATION

Navigation menu

Search