ML20092G077

Proposed Tech Spec 2.7,extending Allowed Outage Time from 7 Days Per Month to 7 Days W/ Addl Once Per Cycle 10 Day Allowed Outage Time

ML20092G077
Person / Time
Site:	Fort Calhoun
Issue date:	09/06/1995
From:	OMAHA PUBLIC POWER DISTRICT
To:
Shared Package
ML20092G064	List: LIC-95-0167, Application for Amend to License DPR-40,revising TS 2.7 Extending Allowed Outage Time from 7 Days Per Month to 7 Days W/Addl Once Per Cycle 10 Day Allowed Outage Time ML20092G077
References
NUDOCS 9509190102
Download: ML20092G077 (15)

Text

..

2.0 LIMITING CONDITIONS FOR OPERATION 2.0.1 General Requirements (Continued) be followed if one pump is inoperable. Under the terms of Specification 2.

0.l(1), if more than one LPSI pump is inoperable, the unit must be placed in at least HOT SHUTDOWN within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, in at least subcritical and <

300*F within the following 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and in at least COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />, unless at least one LPSI pump were restored to operability. It is assumed that the unit is brought to the required mode within the required times by promptly initiating and carrying out the appropriate measures required by the specification.

(2)

This specification delineates what additional conditions must be satisfied to permit operation to continue, consistent with the system specinc specifications t

for power sources, when a normal or emergency power source is not OPERABLE. It specincally prohibits operation when one division is inoperable because its normal or emergency power source is inoperable and a system, subsystem, train, component, or device in another division is 4

inoperable for another reason.

The provisions of this specification permit the requirements associated with individual systems, subsystems, trains, components, or devices to be consistent with the speci6 cation of the associated electrical power source. It allows operation to be governed by the time limits of the requirements associated with the Limiting Condition for Operation for the normal or emergency power source, not the individual requirements for each system, subsystem, train, component, or device that is determined to be inoperable solely because of the inoperability of its normal or emergency power source.

For example, Speci6 cation 2.7 requires in part that two nergency diesel gEha rs be OPERABLE. The specification provide for an 7 days per i

mond ut-of-service time when one emergency diesel c r,

'n OEE BLE. If the definition of OPERABLE were applied without consideration Specification 2.0. l(2), all systems, subsystems, trains, components, and devices supplied by the inoperable emergency power source

]

would also be inoperable. This would dictate invoking the applicable corrective measures for each of the applicable Limiting Conditions for Operation. However, the pro sions of Specification 2.0.l(2) permit the time limits for continued operation to be consistent with the requirements for the inoperable emergency diesel generator instead, provided the other speci6ed conditions are satisfied. In this case, this would mean that the corresponding normal power source must be OPERABLE, and all redundant systems, subsystems, trains, components, and devices must be OPERABLE, or otherwise satisfy Speci6 cation 2.0.l(2) (i.e, be capable of performing their design 4

9509190102 950906 2-Oa Amendment No. 9 PDR ADOCK 050002B5 P

PDR

~

4 2.0 LIMITING CONDITIONS FOR OPERATION 2.1 Reactor coolant System (continudd) 1

. 2.1.7 Pressurizer Ooerability Aeolicability Applies to the status of the pressurizer and pressurizer heaters.

j Objective t

~

To specify minimum requirements pertaining to the pressurizer water volume and availability of heaters for accident conditions.

i Soecifications (1)

The pressurizer shall be operable with at least 150 KW of pressurizer heaters, and pressurizer inventory shall be maintained in a range of level 40.5% to 69.2 %.

p a.

With the pressurizer inoperable due t an noperabl er cac bli to thhe4 eaters;f.itheggstor required no rable 4

{em?rgcncy power apply pressurizefheaters tolOPERABilEiststus v7ithin 72 hotFrs or be in HOT 3HUTDOWN-wittiin tim fo!!am hours. With the pre ir'

• th ' ge inoperable, be in HOT SHUTDOWN witt n the-following W hours. This is applicable for

/

Modes 1 and 2.

b.

With the pressurizer level outside the above range, either restore the level within the speci6ed limits within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> or be in HOT urs. This is applicable for SHUTDOWN within the foll @thly te ting of the pressurizer le Modes 1 and 2, except duri g mon control circuit.

Basis

,J4waequirengLibnt-!1Q3yLo[p_gssurignlieaters_aad th <

controls be r

eapabled-being-suppiled-eleetrical powcr from an emergency !ms oppable rovides OrcscTeatersttrrTinnergi2cd duniig a loss of vff '

condition

..su.nc i.

to maintain natural circulation at HOT SHUTDOWN. Either diesel generator is equipped with 225 KW of heater capacWerJiesel will fulfill-the_ minimum uirement@isa ecification Operability of the dieselfgenergitoriis eonir~olled by;Specifibatiorf 2.7; he level s tou nairttained above tho4ewerdimit ic prevci ttoftand-the upper limit should not be exceeded to prevent going solid or reducing the effectiveness of the pressurizer sprays by immersion during an RCS swell transient.

J i

2-16a Amendment No. 54,%,

2.0 LIMITING CONDITIONS FOR OPERATION 2.7 Electrical Systems. (Contihued) d.

Either one of the 4.16kV engineered safeguards buses, I A3 or l A4 may be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided the operability of the diesel generator associated with the operable bus is demonstrated immediately and there are no inoperable required engineered safeguards components associated with the operable bus, One of each group of 4160 V/480 V Transformers (TlB-3A or 4A),

e.

(TIB-3B or 48), and (TIB-3C or 4C) may be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided there are no inoperable required engineered safeguards components which are redundant to components on the inoperable transformer.

f.

One of the 480 V distribution buses connected to bus I A3 or connected to bus l A4 may be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided there are no inoperable required safeguards components which are redundant to components on the inoperable bus.

g.

Either Group of MCC No.'s (3Al, 3BI, 3A2, 3C1, 3C2,) or (4Al, 4A2,4Cl,4C2) may be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided there are no inoperable required safeguards components which are redundant to components on the inoperable MCC. MCC 3Cl may be inoperable in excess of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> if battery chargers No. I and No. 2 are operable.

h.

One of the four 120V a-c instrument buses (A, B, C or D) may be inoperable for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided the reactor protective and engineered safeguards systems instrument channels supplied by the remaining three buses are all operable.

i.

Two battery chargers may be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided battery charger No.1 (EE-8C) or No. 2 (EE-8D) is operable.

-m X

Ny --

J.

Eithef-ofkHtf-the-etnergeney-die $ef-generators-tDC 1 or DC@nay-be inoperable-for-utHtt-Sevendlaysytotal-for4M&dt)4 luring-any-tnenth prtwidethhere-are-tut-inoperable-reepdred-engineered-safeguards comp (ment +-assoeinted-witfHhe-opentble-diesel-generator--4f-me-diesel generator-is-inoperable--within-84 tours-(regardless-of-when-the inoperable 4fiesef-generator-is-restored-to4tperability)-EFT-HER+

(+}

StarHhettther-diesel generator-ttmify-operabbityrOR (1)-----Ensure-the4thsenee4)f-eotntnen cause for-the4fieSel-generatof inoperability-for-flustther-diesel-generaR>r-X s

\\

js

[One of the emergency diesel generators (DG41'or:DG-2).'mavibe inoperable,' provided there a're nb; inoperable required engineefed.

safeguards; components associatsd with the operable diese1[generaiby

~

Wifnin 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />;of inoperablility (regardisss'of,wh.' nfthe inoperable e

diesel ~ generator is rest 6 red tb operability)fEITHER.~startTthel60iej diesel generator to verify operability,:OR ensure tlie absence;of common 'cause for thel diesel generator inoperaffililtyJforjhe 6th;er~ die'ss!

/

~

generator, LAND:

)

(i)'

' Restore the inoperable ' emergency: diesel generat'or td

~

OPERABLE status within:7 days, OR (i.i). - !On 'a'once-per-refueling-cyde[frequeiicyf;(notl6nde perTdlisd per refueling cycle)l restore the inoperable lsmergency@isssi r

generator to. OPERABLE status;within 10 days.

k.

If inventory of diesel fuel in FO-1 is less than 16,000 gallons and/or FO-10 is less than 8,000 gallons, but the combined inventory in FO-1 and FO-10 is greater than a 6 day supply (21,350 gallons), then restore the required inventory within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />.

2-34 Amendment No. 60,147,150,162 i

\\

2.0' 1,lMITING CONDITIONS FOR OPERATION 2.7 Electrical Systems-(Conti~nued) 1.

Island buses IB3A-4A,183B-4B, and IB3C-4C may be inoperable for l

up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provided there are no inoperable required safeguards components which are redundant to components on the inoperable bus (es).

m.

Either one of the 125V d-c buses No. I or 2 (Panels EE-8F or EE-8G) may be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

l n.

Either one of the 125V d-c distribution panels Al-41 A or AI-41B may l

be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

i o.

Either one of the 120V a-c instrument panels AI-42A or AI-42B may j

be inoperable for up to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

I l

Basis I

l The electrical system equipment is arranged so that no single failure can inactivate enough engineered safeguards to jeopardize the plant safety. The 480 V safeguards l

are arranged on nine bus sections. The 4.16 kV safeguards are supplied from two l

buses.

The normal source of auxiliary power with the plant at power for the safeguards j

buses is from the house service power transformers being fed from the 161 Kv i

incoming line with on-site emergency power from either one of two diesel generators

[

and off-site standby power via the unit auxiliary transformers.* The loss of the 161kV incoming line renders the house service transformers (TI A-3 and TI A-4) l inoperable in that the transformers cannot supply power to the 4.16kV safeguards i

buses I A3 and I A4. Inoperability of the house service transformer (s) or loss of the l

161kV incoming line is not reportable pursuant to 10 CFR 50.72 criteria; however, the NRC will be promptly notilled of these events via the NRC Operations Center.

bgenerators on3tteT6 notTeqiiife otintde power-forstartu The two empp@ime allowed to repair an emergency dieseljeneratofis b r o >e

'on> The t j

the findings of a deterministic and probabilistic analysis.f Ois anslysis ~also i

jtistifies.'continned power operation with one emergency diesel generator? inoperable

)

for a maximum continuous period of 10 days on a once per refueling 1cycleifreqlisncp[

~

(

Thue~ in no' lim;t to the number of times Specification l2.7(2)j.(i)"mhy;be entefed; j

how'ever, Specifica. ion 2.7(2)j.(ii) may only be entered once per refuelingjycisf(not once per diesel,per refueling cycle).

~

/

Upon loss of normal and standby power sources, the 4.16 Kv buses l A3 and 1 A4 are energized from the diesel generators. Bus load shedding, transfer to the diesel generator and pickup of critical loads are carried out automatically.*

4 3

i

?

I

When the turbine generator is out of service for an extended period, the generator can be isolated by opening m6 tor oper'ated disconnect switch DS-Tl in the bus between the generator and the main transformer, allowing the main transformer and the unit auxiliary power transformers (TI A-1 and Tl A-2) to be returned to service.0) The auxiliary power transformers are not considered inoperable during these normal plant startup/ shutdown realignments, 2-35 Amendment No. 76,147,150,162

2.0 LIMITING CONDITIONS FOR OPERATION 2.7 Electrical Systems (Continued)

One battery charger on each battery shall be operating so that the batteries will always be at full charge; this ensures that adequate d-c power will be available for all emergency uses. Each battery has one battery charger permanently connected with a third charger capable of being connected to either battery bus. The chargers are each rated for 400 amperes at 130 volts. Fallowing a DBA the batteries and the chargers will handle all required loads. Each of the reactor protective channels instrumentation channels is supplied by one of the a-c instrument buses. The removal of one of the a-c instrument buses is permitted as the 2-of-4 logic may be manually changed to a 2-of-3 logic without compromising safety.

The engineered safeguards instrument channels use a-c instrument buses (one redundant bus for each channel) and d-c buses (one redundant bus for each logic circuit). The removal of one of the a-c instrument buses is permitted as the two of four logic automatically becomes a two of three logic.

Required engineered safeguards components, as described in Specification 2.7(2),

refers to components required to be operable by other Limiting Conditions for Operation within these Technical Specifications. If no other LCO requires a particular ESF component to be operable, then its redundant component is also not required to be operable due to this specification. As an example, Specification 2.3 requires that safety injection pumps be operable prior to the reactor being made critical, and Specification 2.7 applies when the RCS is above 300 F. If the RCS is above 300 F but the reactor is not critical, then no safety injection pumps are required to be operabie.

References (1) US AR, Section 8.3.1.2 gG) US ARrSectio312r2 ~",r x_7 (2) US AR, Section 8.4.1 (4) CE NPSD-996, "CEOG Joint Applications Report for Emergency Diesel Generator AOT Extension," May 1995.

m

/

2-36a Amendment No. 4 G

\\

U.S. Nuclear Regulatory Commission LIC-95-0167 ATTACHMENT B i

J i

n J

l 2

1 l

i DISCUSSION, JUSTIFICATION AND NO SIGNIFICANT HAZARDS CONSIDERATION DISCUSSION AND JUSTIFICATION The Omaha Public Power District (0 PPD) proposes to revise the Fort Calhoun Station (FCS) Unit No. 1 Technical Specifications (TS) concerning restrictions 1

on the emergency diesel generator consistent with the Combustion Engineering Owner's Group (CE0G) report " Joint Applications Report for Emergency Diesel Generators A0T Extension," CE NPSD-996 as follows:

1.

Extend the allowed outage time (A0T) for an inoperable emergency diesel generator (EDG) from the existing limit of seven days per month (total for both diesels) to seven days.

2.

Add a once per refueling cycle (not once per diesel per refueling cycle) 10 day A0T.

In addition to the CE0G report, OPPD proposes the following:

1.

Revise TS 2.1.7 concerning pressurizer operability to delete actions to restore inoperable emergency power supplies, and state in the Basis Section that operability of emergency power supplies is controlled by TS 2.7.

2.

Revise the Basis to TS 2.0.1 to delete reference to the 7 day per month out-of-service time for one inoperable emergency diesel generator.

BACKGROUND Fort Calhoun Station Unit No.1 is equipped with two seismically qualified, class lE, diesel engine driven generators which supply backup electrical power to the 4160 volt vital AC busses.

DISCUSSION OF CHANGE The EDGs provide on-site emergency AC electric power in the event all off-site power sources are lost. The importance of this equipment to plant safety has resulted in the " Station Blackout Rule," which among other features, requires that the reliability of the EDGs meet a specified value.

Implementation of the proposed change to the EDG A0T will:

Allow increased flexibility in the scheduling and performance of preventative maintenance.

Reduce the number of individual entries into Limiting Conditions for Operation (LCO) action statements by providing sufficient time to perform related maintenance tasks within a single entry.

Allow better control of resource allocation. During outage maintenance windows plant personnel and resources are spread across a large number and wide variety of maintenance tasks. Allowing on-line maintenance gives the plant the flexibility to focus more quality resources on any required or elected EDG maintenance.

)

1

DISCUSSION AND JUSTIFICATION (Continued):

Avert unplanned plant shutdown and minimize potential for requests for notice of enforcement discretion (N0ED).

Risks incurred by unexpected plant shutdowns can be comparable to and often exceed those associated with continued power operation.

Improve EDG availability during shutdown modes.

The methodology used to evaluate the proposed EDG A0T extension was based in part on a draft version of the " Handbook of Methods for Risk Analyses of Technical Specifications," and related industry guidance.

In evaluating the proposed change, a risk assessment was performed with consideration of associated "at power," " transition," and " shutdown" risks.

AT POWER RISK i

An evaluation of the increased risk associated with continued operation with a single EDG out of service for the proposed A0T was performed and is documented in CE NPSD-996.

l The conditional Core Damage Frequency (CDF) and Single A0T risks were calculated based on conservative assumptions.

Specifically, the evaluation of the conditional CDF for corrective maintenance considers that the operable EDG is subject to a common cause failure for the entire duration of the A0T.

This is conservative because TS 2.7 requires either an assessment of the absence of a common cause failure mechanism or that the operable EDG be started.

For FCS the change in risk for a single A0T entry is 0.0 since FCS already has an A0T of 7 days (per month total for both diesels).

The increase in the single A0T risk contribution from a 7 day A0T to the risk based on a 10 day A0T is 2.09E-07.

{

TRANSITION RISK For any given A0T extension, there is theoretically an "at power" increase in j

risk associated with it.

This increase may be negligible or significant.

A complete approach to assessing the change in risk accounts for the effects of avoided shutdown, or " transition risk." Transition risk represents the risk associated with reducing power and going to hot or cold shutdown.

The philosophy behind the transition risk analysis is that the CDF will increase if a plant component becomes unavailable, since less equipment would be available to respond to a transient. As long as the plant remains at power this CDF is a constant. However, when the plant is shutdown the CDF increases since a " transient" (manual shutdown) has now occurred, and the equipment is still out of service.

The risk associated with transitioning the plant to lower modes is documented in CE NPSD-996.

The report concludes that the risk associated with the transition represents a significant fraction of the risk that would be incurred for a seven day "at power" EDG maintenance period.

2 i

DISCUSSION AND JUSTIFICATION (Continued):

SHUTDOWN RISK The risk of EDG maintenance at shutdown was also investigated and is documented in CE NPSD-996.

This study was directed at estimating the advantages or disadvantages of performing EDG maintenance at power by estimating the corollary impact of performing the same maintenance during shutdown.

Shutdown risks were evaluated for two shutdown configurations:

reduced inventory (i.e., mid-loop) operation which is representative of the early phase of the shutdown, and for a condition representative of a spent fuel pool operation with a complete fuel off-load.

The study shows that maintenance of the EDGs, early in the shutdown operation and while the plant is at reduced inventory (i.e., mid-loop operation),

results in an incremental risk of core damage generally equivalent to the at power risk.

SUMMARY

AND CONCLUSIONS The proposed increase in EDG A0T from 7 days per month (total for both diesels) to 7 days with a once per cycle 10 day A0T was evaluated from the perspective of various risks associated with plant operation.

The extended A0T potentially results in small increase in the "at power" risk. However, when the full scope of plant risk is considered, the risks incurred by extending the A0T for either corrective or preventative maintenance will be substantially offset by several benefits.

These benefits are associated with avoiding unnecessary plant transients and/or by reducing risks during plant shutdown operations, and improved EDG reliability upon entering shutdown.

The unavailability of one EDG was found to not significantly impact the three classes of events that give rise to large early radioactive releases.

These include containment bypass sequences, severe accidents accompanied by loss of containment isolation, and containment failure due to energetic events in the containment.

It is concluded that the proposed changes will resuit in a i

negligible impact on the large early release probability, i

CHANGES TO TS 2.1.7 In addition to changes supported by CE NPSD-996, OPPD is also proposing to delete wording from TS 2.1.7, " Pressurizer Operability." Currently this specification states that with the pressurizer inoperable due to an inoperable r

l emergency power supply to the pressurizer heaters, either restore the l

inoperable emergency power supply within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in hot shutdown within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The proposed change would delete the statements concerning restoration of the emergency power supply and add a statement to the Basis Section that the emergency power supplies are controlled by TS 2.7.

l This proposed change maintains the A0T for pressurizer heaters at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and therefore does not change the intent of the specification, but only clarifies that corrective actions for inoperable emergency power supplies are already addressed elsewhere in the TS.

The word " required" is being added to clarify that the pressurizer heaters that must be restored are those required to ensure 150 KW of heaters are operable.

The sentence stating that "With the pressurizer otherwise inoperable, be in HOT SHUTDOWN within the following 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />," is being revised to delete the words "the following."

3 l

1 f

DISCUSSION AND JUSTIFICATION (Continued):

This is being proposed to ensure that it is not misinterpreted with the requirement in the preceding sentences which allow a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> LC0 before starting a 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> shutdown. The word " monthly" is also proposed to be deleted from TS 2.1.7(1)b, as the frequency of required testing is stated in Section 3 of the TS.

CHANGES TO THE BAS!! 0F TS 2.0.1 It is proposed to revise the statement in the Basis of TS 2.0.1 that describes the 7 days per month out-of-service time allowed by TS 2.7 to be consistent with the proposed changes to TS 2.7.

ADMINISTRATIVE CHANGES Amendment 147 is being deleted from the bottom of Page 2-36a.

The initial issuance of Page 2-36a was in Amendment 162.

3 i

l f

4 i

BASIS FOR N0 SIGNIFICANT HAZARDS CONSIDERATION:

The proposed changes do not involve significant hazards consideration because operation of Fort Calhoun Station Unit No.1 in accordance with these changes would not:

i (1)

Involve a significant increase in the probability or consequences of an 4

accident previously evaluated.

The Emergency Diesel Generators (EDGs) are backup alternating current power sources designed to power essential safety systems in the event of a loss of offsite power.

EDGs are not an accident initiator in any accident previously evaluated.

Therefore, this change does not involve a significant increase in the probability of an accident previously evaluated.

The EDGs provide backup power to components that mitigate the consequences of accidents.

The proposed extension of the allowed outage time (A0T) for an inoperable EDG from the existing limit of seven days per month (total for both diesels) to seven days, and the addition of a once per cycle 10 day A0T, do not affect any of the assumptions used in the deterministic safety analyses.

In order to fully evaluate the effect of the EDG A07 extension, Probabilistic Safety Analysis (PSA) methods were utilized.

The results of these analyses show no significant increase in the core damage frequency.

As a result, there would be no significant increase in the consequences of accidents previously evaluated. These analyses are detailed in CE NPSD-996, Combustion Engineering Owners Group Joint Applications Report for Emergency Diesel Generators A0T Extension.

The proposed change to delete action statements concerning restoration of emergency power supplies from the specification on pressurizer heaters only deletes redundant requirements from within the Technical Specifications (TS). Operability requirements for emergency power supplies, and actions to be taken when an EDG is inoperable, are already addressed by TS 2.7.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of any accident previously evaluated.

(2)

Create the possibility of a new or different kind of accident from any accident previously evaluated.

There will be no physical alterations to the plant configuration, changes to setpoint values, or changes to the implementation of setpoints or limits as a result of this proposed change.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

5

BASIS FOR NO SIGNIFICANT HAZARDS CONSIDERATION (Continued):

(3)

Involve a significant reduction in a margin of safety.

The proposed changes do not affect the limiting conditions for operation or their bases that are used in the deterministic analyses to establish the margin of safety.

PSA evaluations were used to evaluate these changes. These evaluations, detailed in CE NPSD-996, demonstrate that the changes are either risk neutral or risk beneficial.

Therefore, the l,

proposed changes do not involve a significant reduction in the margin of j

safety.

Therefore based on the above considerations, it is OPPD's position that this

]

proposed amendment does not involve significant hazards considerations as defined by 10 CFR 50.92 and the proposed changes will not result in a j

condition which significantly alters the impact of the Station on the environment.

Thus, the proposed changes meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9), and pursuant to 10 CFR l

51.22(b) no environmental assessment need be prepared.

I j

k l

l s

4 e

I i

6 3

!~

l l

j U.S. Nuclear Regulatory Commission j

LIC-95-0167 l

ATTACHMENT C 1

d i

T 4

(

r boM COMBUSTION ENGINEERING OWNERS GROUP L

CE NPSD-996 r

L r

Joint Applications Report E

L for c

L E

I Emergency Diesel Generators AOT Extension c

l L

r Final Report CEOG TASK 836 EL prepared for the C-E OWNERS GROUP

[

May 1995 I

Uhd/

fI

• Copyright 1995 Combusti Engmeering, Inc. All rights reserved

[

ABB Combustion Engineering Nuclear Operations E ES I I

I

l l

g I

l LEGAL NOTICE I

This report was prepared as an account of work sponsored by the g

i Combustion Engineering Owners Group and ABB Combustion Engineering.

Neither Combustion Engineering, Inc. nor any person acting on its behalf:

A.

makes any warranty or representation, express or implied including the warranties of fitness for a particular purpose or merchantability, g

with respect to the accuracy, completeness, or usefulness of the information contained in this report, or that the use of any information, apparatus, method, or process disclosed in this report i

may not infringe privately owned rights; or l

B.

assumes any liabilities with respect to the use of, or for damages resulting from the use of, any information, apparatus, method or process disclosed in this report.

l I

i i

I Combustion Engineering, Inc.

i I

I i

Changes to EDG Joint Applications-Report 1.

Page 18,6.3.2 Assessment of "At Power" Risk, Afethodology: first paragraph: after the second sentence ("De evaluation of the "at power" risk increment resulting from the extended EDG AOT was evaluated on a plant specific basis using the most current individual plant's Probabilistic Safety Analysis (PSA) model for their respective baselines.") the following sentence should have been inserted which reads:

For consistency in comparison of results, Core Damage Frequencies (CDFs) presented represent internal events o'nly, excluding internal floods.

2.

Page 19, Increase in Core Damage Frequency definition: ne terms "always available", and

" perfect" should be "not out for Test or Maintenance (T/M)". Definition should read:

)

increase in Core Damage Frequency (6CDF): ne increase in CDF represents the difference between the CCDF evaluated for one train of equipment unavailable minus the CCDF evaluated i

for one train of equipment not out for test or maintenance (T/ML For the EDGs:

ACDF = Conditional CDFn %,,,,,

- Conditional CDFn me..,, mo where CDF = Core Damage Frequency (per year) 3.

Page 19. A paragraph should have been inserted at the end of the Afethodology subsection and prior to the Calculation of Conditional CDF, Single and Yearly AOTRisk Contributions subsection that reads-The methodology used to calculate the above risk measures is presented below. For plants with PSAs that were quantified using RISKMAN methodology, equivalent steps were taken to meet the intent of the methodology presented below.

4 Page 20: Second to the last paragraph, first sentence: The word "never" should have been "not".

he sentence should read: ne Conditional CDF given i EDG is not out for test or maintenance was obtained by setting the basic event probability for the failure mode for an EDG equal to 0.0, and requantifying the PSA cutsets, i

5.

Page 23, Last Paragraph, fifth line, the baseline CDF value should be 1.54E-05 per year rather than 1.54E-06 per year.

6.

Pages 24 - 26, Tables 6.3.2-1 through 6.3.2 3 should be replaced by attached pages. His corrects a numerical value (Table 6.3.2-1, page 24, Waterford 3 Single AOT Risk, Proposed,10 day should be 3.86E-06 rather than 1.55E-06) as well as typographical errors.

7.

Page 26, Last Footnote should refer to page 23 not page 25.

8.

Page 31, Results, first sentence: " Table 6.3.5-1" should be " Table 6.3.4.1-1".

9.

Page 32, "At Power" Risk Assessment, Last Paragraph, first sentence: " Table 6.3.4-1" should be

" Table 6.3.4.2-1".

10.

Page 33, Shutdown Risk Assessment, Last Sentence: " Table 6.3.4-2" should be " Table 6.3.4.2-2".

I1.

Page 35, First Paragraph, first sentence: " Table 6.3.4-2" should be " Table 6.3.4.2-2".

L F

L TABLE OF CONTENTS b

Section Page L

LIST OF TABLES iii 1.0 PURPOSE 1

2.0 SCOPE OF PROPOSED CHANGES TO TECHNICAL SPECIFICATIONS 1

3.0 BACKGROUND

2 1

4.0

SUMMARY

OF APPLICABLE TECHNICAL SPECIFICATIONS 4

4.1 Standard Technical Specifications 5

l 4.2

" Customized" Technical Specifications 5

l 5.0 SYSTEM DESCRIFFION AND OPERATING EXPERIENCE 6

{

5.1 System Description

6 l

{

5.2 Operating Experience 8

5.2.1 Preventive Maintenance 8

{

5.2.2 Surveillance > Testing of EDGs 11 5.2.3 Corrective Maintenance 11 5.2.4 Comments on EDG Unavailabilities 11 b

6.0 TECHNICAL JUSTIFICATION FOR AOT EXTENSION 12

[

6.1 Statement of Need 12 6.2 Assessment of Deterministic Factors 14

[

6.2.1 Station Blackout Rule 14 6.2.2 Brookhaven's Analysis of EDG Unavailability and its Risk Impacts 15 E

E 1

L

[

TABLE OF CONTENTS (cont'd)

L Section Page

[

6.3 Assessment of Risk 17 6.3.1 Overview 17 b

6.3.2 Assessment of "At Power" Risk 18 6.3.3 Assessment of Transition Risk 27 6.3.4 Assessment of Shutdown Risk 31 6.3.4.1 Aswament of Risk Trade-off 31 6.3.4.2 As-ament of FnhecM EDG Reliability 32 r

6.3.5 Assessment of Large Early Release 35 L

6.3.6 Summary of Risk Assessment 37 l

6.4 Compensatory Measures 37

{

7.0 TECHNICAL JUSTIFICATION FOR STI EXTENSION 38

{

8.0 PROPOSED MODIFICATIONS TO NUREG-1432 39 9.0

SUMMARY

AND CONCLUSIONS 39

{

10.0 REFERENCES

40 ATTACHMENT A A-1

[

" Mark-up" of NUREG-1432 SECTIONS 3.8.1 & B 3.8.1 E

E E

I I

L

[

t LIST OF TABLES Table Page 3-1

SUMMARY

OF DG MANUFACTURER AND AOTs FOR CE PWRs 3

5.1-1 CONFIGURATIONS OF EMERGENCY ELECTRICAL SYSTEMS FOR CE PWRS 6

[

5.1-2 ALTERNATE EMERGENCY POWER FOR ESSENTIAL SAFETY SYSTEMS AND SBO BATTERY POWERED COPING TIME FOR CE PWRs 7

5.2-1 EDG UNAVAILABILITY AND UNRELIABILITY 10 b

6.3.2-1 CEOG AOT CONDITIONAL CDF CONTRIBUTIONS FOR EDGs - CM 24 6.3.2-2 CEOG AOT CONDITIONAL CDF CONTRIBUTIONS FOR EDGs - PM 25

{

6.3.2-3 CEOG PROPOSED AVERAGE CDFs 26 l

6.3.3-1 TRANSITION RISK CONTRIBUTIONS FOR EDG CM 30 6.3.4.1-1 DAILY PLANT CORE DAMAGE PROBABILITY AT SHUTDOWN l

FOR A REPRESENTATIVE CE PWR 31 f

6.3.4.2-1 EDG MAINTENANCE VS. POTEhTIAL IMPROVEMENTS IN EDG RELIABILITY 33

[

6.3.4.2-2

SUMMARY

OF ANALYSIS DATA 34

[

[

I l

l iii

r L

Emergency Diesel Generator (EDG) AOT Extension 1.0 PURPOSE This report provides the results of an evaluation of the extension of the Allowed Outage Time

[

(AM) for a single Emergency Diesel Generator (EDG) from its present value to seven days.

N AOT is specified in the plant technie=1 specifications. In addition, this report provides justifications for allowing the extension of this same AM to 10 days on a "once-per-refueling

{

cycle" frequency. This AOT extension is sought to provide needed flexibility in the performance of both corrective and preventive maintenance during power operation. Furthermore, adoption of the proposed AM extension reduces the risk of unscheduled plant shutdowns. AmMeadon l

[

of this request is based on an integrated review and menment of plant operations, deterministic / design basis factors and plant risk.

[

This request for AM extension is consistent with the objectives and the intent of the 10CFR50.65, Appendix A, "The Maintenance Rule" (Reference 1) and the draft staff guidance for incorporation of EDG reliability requirements within the Maintenance Rule (Reference 2).

[

That is, the Maintenance Rule will be the vehicle which controls the actual maintenance cycle by danning unavailability and reliability performance criteria and ="aaing maintenance risk.

The requested AOT extension will allow efficient scheduling of maintenance within the F

boundaries established by implementing the Maintenance Rule. The CE plants are in the process ofimplementing the Maintenance Rule, and are presently setting targets for unavailability and reliability of systems and trains. Therefore, this effort is seen as timely, supportive and integral to the Maintenance Rule program.

[

2.0 SCOPE OF PROPOSED CHANGES TO TECHNICAL SPECIFICATIONS The proposed technical specification changes address revision of existing requirements for the b

operation of the Emergency Diesel Generator subsystems. Specifically, the proposed changes in technical specification requirements are:

(1)

In general, extend AOT for a single INOPERABLE EDG from (72] hours to 7 days.

(2)

Provide a once per fuel cycle allowance for an AOT of 10 days for a single INOPERABLE EDG.

i 1

F.

il i

3.0 BACKGROUND

In r**aane to the NRC's initiative to improve plant safety while granting relief to utilities from j

j those requirements that are marginal to safety, the CEOG has undertaken a program of obtaining i

relief from overly restrictive tehnica1 specifications. As part of this program,'several tehnical i

specification AOTs and STIs were identified for joint action.

l This report provides support for modifying the Technient Specifications for Electric Power Systems in order to extend the ACT for a single emergency diesel generator during power operation. The CE fleet of PWRs utilize one of two possible AOTs within the plant tehnical 4

i specifications (See Table 3-1). More recently dataned PWRs have a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> ACT for the

)

EDG, whereas early CE PWRs have a seven day AOr h intent of this report is to provide tehnical justification for the extension of the AOr for our more recent PWRs from a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to seven days. In addition, this dacumant provides support for a one time per cycle j

10 day AOT extension for all CE PWRs. h intent of this madification to the ACT is to l

4 j

enhnnee overall plant safety by avoiding risks -aciatad with un=cheduled plant shutdowns and j

providing for increased flexibilityin scheduling and performing ne==ry "on-line" maintenance g

and surveillance activities. In addition, adoption of the proposed AOT extension will provide E

j uniformity in this AOr for CE PWRs with a minimum of two dadicatad EDGs per Unit.

His report provides generic information supporting the proposed AOr changes, as well as, the nac~ary plant specific information to demonstrate the impact of these changes on an individual plant basis. The supporting / analytical matarial contained within the document is considered g

applicable to participating CEOG member utilities regardless of the category of their Plant 5

j Technical Specifications. Utilities participating in this task include Maine Yankee, PalindM, i

Ft. Calhoun Station, St. Lucie Units 1 and 2, Millstone Point 2, Waterford 3, ANO 2, San 3

l Onofre Units 2 and 3, and Palo Verde Units 1, 2 and 3. Baltimore Gas and Electric's Calvert E

i Cliffs Units are in the process of upgrading their EDG capacity to include enhnnead redundancy l

of their EDGs, and the addition of a station blackout diesel generator. Herefore, Baltimore Gas g

l and Electric is not participating in the plant specific aspects of this effort at this time.

E i

i l

2 i

4 I

i 4

l 1

Table 3-1 i

SUMMARY

OF DIESEL GENERATOR MANUFACTURER AND i

ALLOWED OUTAGE TIMES FOR CE PWRs j

i I

Plant Manufacturer Tech Spec Type EDG ACyr j

i (Days)

)

1 ANO-2 Fairbanks Morse Standard 3

i I

Calvert Cliffs 1 Standard 3

1 j

Calvert Cliffs 2 Standard 3

i Ft. Calhoun General Motors Customized 7

3 Station 1

j Maine Yankee General Motors Customized 7*

Millstone 2 Fairbanks Morse Standard 3

i j

PaliudM Alco Customized 7

l Palo Verde 1 Cooper Energy Services Standard 3*

Palo Verde 2 Standard 3*

3 Palo Verde 3 Standard 3*

i San Onofre 2 General Motors Standard 3

l San Onofre 3 General Motors Standard 3

i St. Lucie 1 Standard 3*

St. Lucie 2 Standard 3*

l Waterford 3 Cooper Energy Services Sundard 3*

• For these units, surveillance testing of an alternate EDG is not required when the other EDG is deliberately rendered inoperable in order to perfonn pre-planned preventive maintenance.

l i

\\

J l

3 i

l l

l

~

T l

l 4.0

SUMMARY

OF APPLICABLE TECHNICAL SPECIFICATIONS

=

There are three distinct categories of Technical Sperifimtions at CE NSSS plants.

l The first category is the Standard Technical Specifications. Through February 1995, NUREG-0212, Revision 03, ' commonly referred to as " Standard Terhnimi Specifications," has provided l

a model for the general structure and content of the approved technical pfimtions at all other domestic CE NSSS plants.

The second category corresponds to the Improved Standard Technical Specifications (ISTS) guidance that is provided in NUREG-1432, Revision 0, dated September 1992. A licensing amendment submittal to change the Technical Sperifiadons for San Onofre Nuclear Generation Station Units 2 & 3 so as to implement this guidance was submitted to the NRC in December 1993. Additionally, licensing amendment submittals are being developed that will modify the technimt specifications for Pnliede Station to implement the ISTS guidance.

1 The third category includes those technical specifications (TSs) that have structures other than 5

those that are outlined in either NUREG 0212 or NUREG-1432. These TSs are generally E

referred to as " customized" technical spacifimtions. The CE NSSS plants that currently have

" customized" technical specifications are: PatiedM Station, Maine Yankee Station, and Ft.

Calhoun Station.

Each of these three categories of Technical Specifications includes operating requirements for E

the applicable plant's emergency diesel generators (EDGs).

E Table 3-1 provides a summary of the diesel generator manufacturers and allowed outage times g

for CE PWRs.

E a

l 4

I i

I I

4 I

r L

4.1 Standard Technical Specifications I

The requirements for emergency diesel generators during power operations are emh~' iad in the requirements for Electrical Power Systems in the standard technical specifications of NUREG-0212, Revision 03 and NUREG 1432, Revision 0.

LCO 3.8.1 of NUREG-1432 provides the following definition for a fully OPERABLE set of AC sources for plant operations in Modes 1 through 4:

a.

Two qualified circuits between the offsite transmission network and the on-site Class 1E AC Electrical Power Distribution System; [and]

b.

Two diesel generators (EDGs) each capable of supplying one train of the on-site r

L Class 1E AC Flactrien1 Power Distribution System; and c.

Automatic load sequencers for Train A and Train B.

(

Both LCO 3.8.1.1 of NUREG-0212, Revision 03 and LCO 3.8.1 of NUREG-1432, Revision

[

0 (Attachment A) allow the continuation of power operation with one inoperable emergency diesel generator for a maximum of 72 continuous hours.

Additionally, LCO 3.8.1 of NUREG-1432 (Attachment A) includes a provision that allows continued power operations for a maximum of six days when a contiguous series of different degradations of the full set of AC sources occurs. (An example is the case where one of the required offsite power circuits becomes inoperable at the same time that a diesel generator that was previously inoperable is returned to an OPERABLE state.)

Following a diagnosis that an EDG is INOPERABLE, an assessment or test confirming that the OPERABLE EDG is not subject to a common cause failure would be performed. If a common

[

cause failure mode is sumactad, the OPERABLE EDG must be declared INOPERABLE and actions must be taken to restore one EDG to OPERABLE status in within a small number of hours. Inability to return one EDG to OPERABLE status results in the entry into a more restrictive LCO ACTION STATEMENT.

l 4.2

" Customized" Tachnical Specifications Customized technical specifications for the EDGs differ from the STS in the duration of the specified AOT and the details of the subsequent ACTION statements. Table 3-1 indicates which CE PWRs have customized technical specifications and lists their respective AOTs.

I

[

5 f

L

i iI I'

5.0 SYSTEM DESCRIPTION AND OPERATING EXPERIENCE This section mmmarizes EDG configurations and operating experience for CE PWRs. Data contained in this Section is derived from a combination of sources including recent plant specific data and relevant data available from a recent EDG industry survey (Reference 3).

I

5.1 System Description

The role of the EDG is to provide emergency power to essential safety systems in the event that all offsite power sources are lost. All CE PWRs with the exception of Calvert Cliffs Units 1 and 2 employ two d@ tad EDGs per plant. Calvert Cliffs is presently undergoing a plant upgrade to provide 2 class IE diesels per unit with a shared non-class 1E seismim11y robust third l

EDG. A summary of current EDG configurations for CE PWRs is presented in Table 5.1-1.

Many CE PWRs include alternate means of providing power to some, if not all, essential safety systems. In general, CE PWRs reMing on multiple unit sites are capable of being powered by some of the on-site power supplies of the other unit. In addition, in the Station Blackout Rule (10CFR50.63, Reference 4 ) implementation process, many CE PWRS have procured equipment designed to mitigate the consequences of a station blackout event. For example, at ANO, a

" swing" non-class IE full capacity station blackout diesel that can support either unit has been installed. These plant features, along with the expected plant station blackout coping times are presented in Table 5.1-2.

Table 5.1-1 CovtOURATIONS OF EMERGENCY ELECTRICAL SYSTEMS FOR CE PWRS i

Plant No. of DaAntM Diesel EDGs Total No. of Units per unit shared Diesels 1

I ANO-2 1

2 None 2

l Calvert Cliffs 1&2 2

1 1

3 Fort Calhoun Station 1

2 N/A 2

Maine Yankee 1

2 N/A 2

l Millmone 2 1

2 None 2

f Pahsades 1

2 N/A 2

Palo Verde 1,2 &3 3

2 None 6

i San Onofre 2 & 3 2

2 None 4

St. Lucie 1 & 2 2

2' None 4

Waterford 3 1

2 N/A 2

• Each generator has two engines 6

1 I

Table 5.1-2 ALTERNATE EMERGENCY POWER mR ESSENTIAL SAFETY SYSTEMS AND STATION BLACKOUT BATTERY POWERED " COPING" TIMES mR CE PWRS PLANT MULTIPLE BACKUP POWER UNIT S80 PLANT l

UNIT SITE SUPPLY CROSS TIE COPING TIME CAPABILITY (BATTERIES j

ONLY) thrs)

ANO 2 Y

• swing

• Non class 1E station yes 8

sneakout EDG oen provide power to either unite during a l

station Weekout

^

Calvert Cliffs 1&2 Y

A site EDG upgrade le in yes 8

progrees wideh wE result in 2 eledcated EDGs per unit and a

{

• ewing

• non-ciaes 1E biadteut EDG i

j Fort Calhoun Station N

FCs employs a backup eelf-N/A 4

1 powwed, AFW pump (AFW-

54) and a turbine alriven AFW pump (FW-10) to mentaan seedweter eveinabsty during i

en sao.

Maine Yankee N

Appendix A DG-2 used as N/A 4

AAc Genwater I

Millstone 2 Y

The MEstone eine includes a yes 12 1

14.4 Mw Combustion Turbine j

to supply essential safety sonde in the ewont of lees of

{

offeito power and loss of EDGs.

i Palisades N

NONE N/A 4

Palo Verde 1,2 &3 Y

The Palo Verde site includes yes 2'

Gas Turbine generators to extend sso cepens times to i

won beyond 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

I San Onofre 2 & 3 Y

Nominal credt le taken for yes 4

power from the opposite unit j

diesel.

j St. Lucie 1 & 2 Y

Cross tie between unite durias yes 4 (Unit 2) blockout. Tie capability wie

• (Unit il j

noneafety 4kw buseos Waterford 3 N

None N/A 4

' SBO coping based on availability of alternate AC source.

7 4

I 5.2 Operating Experience The Emergency Diesel Generators provide on-site emergency ac power in the event that all offsite power sources are lost. As a consequence, the reliability of these on-site power sources is an important factor in assuring the safety oflight water reactors. As a result of this concern, the NRC established the Station Blackout Rule in 1988. In the implementation of this rule, the l

NRC (via Regulatory Guide 1.155, Reference 5) required that all LWRs ensure the reliability of the EDGs to be greater than either.95 or.975 depending on the specific plant class to which the unit was considered to belong. Plant class typically reflects various factors including (1) redundancy of on-site emergency ac power systems, (2) reliability of on-site emergency power sources, (3) frequency of loss of off-site power and (4) the probable time to restore off-power.

At the time of the SBO rule, unavailability of the EDGs throughout the domestic commercial nuclear industry due to "on-line" maintenance was.007. As maintenance programs were E

implemented to improve EDG reliability, the on line out-of-service (OOS) unavailability of the B

EDG has increased industry-wide. A recent survey of EDG unavailability of power operation indicates that the mean unavailability of the EDG "at power" due to preventive and corrective maintenance (PM and CM) are.0118 and.0082 respectively. Correspondingly, the unreliability of the EDGs has decreased on an industry average from about 0.020 in the early 1980's to 0.014 in the 1988 to 1991 time frame (Reference 3). Reference 3 further poe1*d that the increase in reliability in recent years and the increase in unavailability due to maintenance may be related.

Table 5.2-1 provides a comparison of the individual and mean unavailabilities and unreliabilities of CE EDGs to their industry average. As a group, the EDGs at CE PWRs involved in this g

4 i

study have an average EDG "at power" unavailability below the industry average. No individual E

CE PWR can be considered an outlier.

5.2.1 Preventive Maintenance Most plants in the United States ( 95%) routinely carry out scheduled PM on EDGs during power operation (see Reference 3). Preventive maintenance (PM) for EDGs encompasses a variety of tasks including:

-Lubrication, Oil and Filter Changes

-Replacement of switches

-Calibration of equipment l

-Component Cleaning

-Component Inspections

-Manufacturer upgmdes A survey of CE PWRs indicates that preventive maintenance tasks, such as those listed, can take from 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to more than 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> to complete. While certain PM tasks can be performed without taking an EDG out of service (such as those involved with EDG equipment calibrations),

many PM tasks cannot be performed without declaring the applicable EDG out of service. The typical frequency of diesel generator maintenance for CE PWRs varies from less than once per 8

I

year (that is, no planned preventive maintenance) to about once every m1an& quarter. The mean duration of maintenance tasks is currently less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This is generally consistent with the observed industry trends. Reference 3 indicates that the mean PM on an EDG was 24.6 1

hours with a standard deviation of 37.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. This suggests that maintenance done at power frequently eweed one-half of the AOT and in about one quarter of the occurrences exceed the typical 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT. This is particularly true, if a PM uncovers equipment degradation which would require further maintenance. At one site, the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT has been approached on nine (9) separate occasions and exceeded once. This later event occurred during a weekend and required a discretionary enforcement to continue plant operation.

4 On a yearly basis the amount of "on-line" preventive maintenance for EDGs varies from less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to a maximum of about 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> per EDG for CE PWRs with a 7 day AOT for a single EDG, with the average per EDG PM equal to 135 hours0.00156 days <br />0.0375 hours <br />2.232143e-4 weeks <br />5.13675e-5 months <br />. For CE plants with a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> 4

ACT, the average and maximum yearly PM per EDG are 100 and 140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br /> respectively. This level of "on-line" maintenance is consistent with United States industry average estimate (Reference 3) of about 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> per year.

1 I

1 i

i i

4 9

Table 5.2-1 EDG UNAVAILABILITY AND UNRELIABILITY PLANT EDG ID UNAVAILABILITY UNREUABILITY PM CM PM+CM ANO2 B

0.0

.0041

.0041 A

0.0

.00188

.00188 Pt. Caamum Sietion DG1

.0059 0.0009

.0068

.0Q13 DG-2

.0044 0.0009

.0053

<.0033 Maias Yaakse DG13

.0126

.0077

.0203 DG.1A

.0134

.0012

.0146 M-2 DG-A

.00636

.00424

.0106

<.02" DG-B

.00636

.00424

.0106

<.02*

Palisada DG11

.0105

.0109

.0214 DGl.2

.00867

.0089

.01757 Palo Wrde !

IMDGAH01

.00936"

.0051P

.0145"

<.018 1MDGBH02

.00936*

.0051P

.0145*

<.01*

Palo Wade 2 2MDGBH01

.00936"

.0051 P

.0145*

<.01*

2MDGAH02

.00936*

.0051P

.0145"

.03

• Palo Verde 3 3MDGAH01 009368

.0051P

.0145*

<.Ol*

3MDGBH02

.009368

.0051P

.0145"

.03

• Saa Onofre 2 DG3

.0046

.0Q31

.00767

<.02 i

l DG2

.0046

.0031

.00767

<.02 San Onofre 3 DG2

.0046

.0031

.00767

<.02 DG3 0.0046

.0031

.00767

<.02 St. Lucie 1 1A

.0118

.0045

.0163 IB

.00835

.0084

.0168

=

St. Laacie 2 2B

.0157

.0009

.0166 2A

.0109

.0000

.0109 Wasseford 3 3

.0038

.0038

.0076

<.01*

A

.0008

.0006

.0016

<.018 CEOG MEAN DATA PLANTS %TTH 3 DAY ACrr

.0069

.0038

.0107 l

PLANTS WTTH 7 DAY AGT

.0092

.0051

.0143 j

CEOG GROUP

.0075

.0041

.0116 INDUS'IRY NUREG/CR.5994 (MEAN)

.0118

.0082

.020

.014

)

Desa obumed fan Rafanace 6

3. Unoshabday daaa taks from Menace '

2. Average for a0 6 units 10 1

r L

5.2.2 Surveillance / Testing of EDGs L

Surveillance testing of EDGs is typically performed as required in the plant technical specifications.

Industry average data confirms that the durations of EDG tests are typically short (on the order of L

2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) and the total unavailability of an EDG is under 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> per year (See Reference 3).

5.2.3 Corrective Maintenance c

L Corrective maintenance refers to maintenance that is unscheduled and is therefore condition directed.

Such maintenance can occur when the EDG fails a surveillance test or a degradation in EDG 7

L Performance is noted. This definition of CM includes conditions where the EDG can perform its safety function, as well as, cases where the safety function is affected. In either case of CM, Ge r

EDG would typically be considered to be INOPERABLE. The analysis presented in Secdon 6 L

assumes CM is performed due to inoperability of the EDG.

p Industry survey data suggests that corrective maintenance is performed on an EDG at a mean L

frequency of 3.3 times per year with a mean duration of 23.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and a standard deviation of 46.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />. The large uncertainty Mt~i with CM clearly indicates the potential for EDG mpair to p

exceed the existing 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT. For the CEOG member utilities, the yearly unavailability due to CM is lower than 0.006 per year per EDG, regardless of the current AOT. This low value of u

CM reflects a high EDG reliability and the effectiveness of existing EDG maintenance programs.

r L

5.2.4 Comments on EDG Unavailabilities

[

The CE fleet includes plants with both 3 and 7 day AOTs. Plants with 3 day AOTs have a mean L

yearly scheduled maintenance unavailability of about 77 hours8.912037e-4 days <br />0.0214 hours <br />1.273148e-4 weeks <br />2.92985e-5 months <br /> per EDG per year compared to 132 hours0.00153 days <br />0.0367 hours <br />2.18254e-4 weeks <br />5.0226e-5 months <br /> per EDG per year for plants with a 7 day EDG AOT. Both groups of plants show similar

[

yearly repair time outages for unscheduled maintenance (46 vs. 51 hours5.902778e-4 days <br />0.0142 hours <br />8.43254e-5 weeks <br />1.94055e-5 months <br />). In the future, all plants within the CE fleet are expected to set maximum maintenance rule targets for EDG unavailability in the.025.03 range (220 to 260 hrs per EDO per year). Therefore, adoption of a 7 day AOT for

[

a single inoperable EDG is not expected to have a significant impact in overall EDG unavailability.

[

[

[

[

11

I i

l l

6.0 TECHNICAL JUSTIFICATION FOR AOT EXTENSION

=

l This section provides the tachnical bases for the request for the AOT extension. The presentation l

of this information generally follows the guidance in the Handbook of Methods of Risk Analyses i

m Technical Specifications (Reference 8 ).

i i

6.1 Statament of Need i

The EDGs provide on-site emergency alternating current (ac) electric power to a nuclear plant in 1

the event all off-site power sources are lost. The importance of this equipment to plant safety.has j

resulted in the " Station Blackout Rule", which among other features, aquired that the reliability of EDGs reliability be acceptably high. In the implementation prucss, Regulatory Guide 1.155 specified target reliability values of.95 and.975 dapandant upon a set of defined criteria. In response to meeting these reliability goals, many reactor sites implemented or extended EDG surveillances and "on-line" PM activities.

The participating CEOG utilities request that the present EDG AOT be uniformly extended as follows:

(1)

Extend A(7T for a single INOPERABLE EDG from [72] hours to [7] days.

and, (2)

Provide a once per fuel cycle allowance for an AOT of 10 days for a single INOPERABLE EDG.

Implementation of this AOT modification will:

(1)

Allow increased flexibility in the scheduling and performance of preventive maintenance (2)

Reduce the number of individual entries into LCO action statements by providing sufficient time to perform related maintenance tasks within a single entry.

I (3)

Reduce stress on plant maintenance personnel by allowing adequate time to perform the more complicated maintenance activities (including those associated with EDG manufacturer recommended surveillances and upgrades) l (4)

Enable the plant to minimize EDG operability restoration time by scheduling maintenance which de-emphati7m multiple simultaneous EDG tasks (resulting in potentially long associated restoration times). By emphatiring single or combined repairs and inspections, there will be shorter times for EDG restoration.

12

L I

L (5)

Allow the plant to better control maintenance tasks between power and shutdown y

L operation thereby increasing EDG reliability both "at power" and in the early (risk dominant) stages of shutdown, r

[

(6)

Avert unplanned plant shutdown and minimize potential for requests for Notices of Enforcement Discretion (NOEDs). Risks incurred by unerpacted plant shutdowns can be comparable to and often exceed those mociated with continued power

[

operation.

(7)

Improve EDG availability during shutdown modes.

The mean EDG PM or CM is about I day with a standard deviation of nearly 2 days. Therefore,

[

industry-wide, a large number of corrective maintenance events would be expected to challenge the L

existing 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> AOT. This difficulty has been noted at various CE sites. At one CE site, it was reported that the existing EDG AOT was nearly exceeded nine (9) times and, actually mai~i once requiring a discretionary enforcement to continue plant operation.

Plants with existing 7 day AOTs report that their present EDG AOr is adequate for most EDG

[

repairs. However, instances have occurred when a 7 day AOT is inadequate. Such an event occurred at a CEOG utility (Reference 11) which required a one time emergency change to the Technical Specifications extending the EDG AOT to 10 days to allow completion of repair of a

[

cracked cylinder head. Implementation of a 10 day AOr on a once per cycle basis will allow the plant to continue operation while repairing a non-functional EDG. The once per cycle extension is not expected to expand the level of PM or CM to be performed at any plant. It is expected to

[

provide margin to ensure that serious EDG degradations uncovered during equipment surveillance or a scheduled PM can be successfully completed without exceeding the plant LCO ACTION STATEMENT.

"At power" operation provides a resource rich environment for accident

(

management and minimizes the risk of initiating loss of power and loss of feedwater events that can accompany a forced shutdown. It is also possible that, under certain controlled conditions (such as availability of a full capacity " swing" EDG or alternate AC power source), the 10 day per cycle i

[

AOT extension may be entered following unanticipated delays encountered in performing a EDG 1

preventive maintenance activity.

(

l 13 l

I

\\

i i

f I

6.2 A==a===*=* of Determinidle Factors i

j The Emergency Diesel Generators (EDGs) provide on-site alternating current (ac) electric power j

in the event that all off-site power sources are lost in a nuclear power plant.

A dedicated diesel generator is the on-site standby ac power source for each angina ~ed safety l

feature power supply bus. In the event of an =ceidant with loss of off-site power, EDGs are da*igned to automatically connect to and power safeguards equipment. In addition, automatic load sequencing assures that EDGs are canned to the plant ESFs in sufficiant time to provide a safe i

plant shutdown. In the event of loss of preferred power EDGs are intended to provide emergency backup power for the plant essential safety feature electrical loads until such time that the preferred E

power supply is restored.

E

]

Each CEOG plant's EDG configuration satisfies the requirements of Regulatory Guide 1.9. Each of the diesel generators is capable of starting, acedaradng to rated speed and voltage, and connecting to its respective engineered safety feature bus on detection of bus undervoltage within a specified period of time (i.e.10 - 15 seconds). Each diesel generator is capable of mecapdag required loads within the laading sequence intervals==ad in the safety analyses, and continuing to operate until offsite power can be restored to the ESF buses. These capabilities exist, under a i

variety of initial conditions including the diesel generator being in standby with hot engine l

temperatures, the diesel generator being in standby with the engine at ambient conditions, or the i

diesel generator operatmg in the parallel test mode.

I 6.2.1 Station Blackout Rule 1

l The loss of off-site ac power to the essential and non essential electrical buses concurrent with i

turbine trip and the unavailability of the redundant on-site emergency power system, i.e. EDGs, is i

termed " Station Blackout". Reliability of on-site power sources is an important factor in assuring an acceptable level of plant safety. In recognition of the importance of these on-site power sources l

the Station Blackout (SBO) Rule was established in 1988. Guidance for implementation of the SBO rule was defined in Regulatory Guide 1.155. Specifically, the SBO rule required the licensees to:

i

1. Ensure the reliability of the EDG was > 0.95 (or >0.975) dependent on plant specific j

features.

l

2. Establish an EDG Reliability Program.

l and, in the event of an SBO event

3. Ensure that the plant has adequate coping capability.

The station blackout (SBO) rule addressed the need for maintaining a highly reliable ac electrical power system. At the time the rule was developed, the unavailability due to maintenance was 14 4

i

l r

L estimated at 0.007. At that time it was recommended that EDGs be reliable and that maintenance

[

unavailability be kept low by performing the maintenance at plant shutdown.

Over the past decade the utilities have begun programs to improve the reliability of the EDGs via c

L regular preventive maintenance. As a result oflengthening of the time between refuelings some of this maintenance was performed at power. Furthermore, recent shutdown risk numments suggest that shutdown risks are in general comparable to those of power operation, resulting in questions about the benefit of delaying PM on EDGs to shutdown conditions. 'Ihis increase in "on-line" PM u

has resulted in an increase in maintenance unavailability to 0.02 with a coswding industry-wide increase in EDG reliability from 0.98 to 0.986.

r I

6.2.2 Bmokhaven's Analysis ofEDG Unavailability andits Risk Impacts The safety implications of performing EDG maintenance at power was investigated by Brookhaven National I2boratory (BNL). The BNL report (Reference 3), which is dienaM below, inva*ie=W:

r L

1.

The sensitivity of the plant core damage frequency (CDF) to maintenance and the probability of failure to start and run on demand.

E 2.

The relative benefits of performing maintenance at power vs shutdown.

E L

The analysis found that the increased CDF level during maintenance, as well as the duration of the maintenance are important factors in the assessment of the risk impact of EDG unavailability due

[

to maintenance. The integrated risk impact over the duration is enWa+M as the product of the increased CDF and the maintenance duration.

I It was concluded that during power operation, changes in CDF are more sensitive to failures to start and run than to EDG maintenance unavailability. Specifically, it was concluded that EDG failure unavailability has a factor of 2.6 greater impact on the CDF than does the "at power" maintenance j

unavailability (Reference 6). Furthermore, an increase in unavailability to.02 per EDG per year had no significant impact on plant risk (i.e. CDF). If one presumes that the increase in maintenance related unavailability is offset by a decrease in the failure to start and load-run unavailability, the

[

net impact on the CDF would be beneficial.

This report also developed insights for scheduling EDG preventive maintenance items (PMs). PMs

[

were divided into three categories:

(1)

Scheduled PMs that need to be performed at an interval less than 18 months, (2)

Scheduled PMs that need to be performed at an interval of 18 months or longer, (3)

Condition-directed PMs, based on test results, as needed to correct degradations of l

equipment which may lead to failures.

I b

15

[

T 1

BNL recommended that short duration PMs be performed at power. Longer duration PMs wem recommended to be scheduled during the later portion of the refueling outage when the risk impact is relatively low. Risks nWated with EDG maintenance during the early, low inventory shutdown modes were found to be generally comparable to that of performing the maintenance at power.

For condition 4irected PMs (and cms), somewhat longer maintenance outages may be allowed during power operation since a plant shutdown, in this case, involves the additional risk of maneuvering to a safe shutdown state.

Insights obtained from this and eMataA efforts were presented in~a memorandum for Thomas E.

Murley from Eric S. Beckjord in Research Information Letter Number 173 entitled " Risk-based Methods to Evaluate Requirements in Technical Specifications" (Reference 9). The memorandum stated that scheduling DG maintenance during power operation is risk neutral for preventive maintenances of short duration and they can be scheduled during power operation.

Results of the CEOG plant specific analyses presented in Sections 6.3.2 through 6.3.5 are in general agreement with those of the BNL study. When the full scope of plant risk is considered, the risks incurred by extending the AOT for either corrective or preventive maintenance will be substantially offset by plant benefits eMated with avoiding unnecessary plant transitions and/or by reducing risks during plant shutdown operations, improved EDG reliability upon entering shutdown, and implementation of compensatory measures. The combined CEOG results indicate that the risk of performing EDG maintenance at power varies from risk beneficial to risk neutral depending upon the duration and type of maintenance.

l l

I g

16

I L

6.3 A==*===*=t of Risk 6.3.1 Overdew

(

The purpose of this section is to provide an integrat~i namennment of the overall plant risk==winted with the adoption of the proposed AM extension. 'Ihe methodology used to evaluate the EDG System AOT extension was based in part on a' draft version of the "Handhook of Methods for Risk-

{

Based Analyses of Technient Spaci&atiaa<" (Reference 8) and related industry gnidane*. As guidance for the acceptability of a Tech Spec modification, Reference 8 noted that any proposed Tachaical Spaci&adna change (and the ultimate change package) should either:

(1) be risk neutral, OR f

(2) result in a decrease in plant risk (via " risk trade-off considerations"), OR (3) result in a negligible (to small) increase in plant risk.

AND (4) be needed for utility to more efficiently and/or more safely manage plant oper= dons.

(

A statement of need has been provided in Section 6.1. This section addresses the risk aspects of the pivposed AOr extension.

L

[

In this evaluation, a risk nueament of the EDG AOT extension is performed with caa*idar=Han of nei='~1 "at power", " transition" and " shutdown". The assessment includes naneideration of risk L

increase associated with potentialincreased EDG unavailability and the==~iatad risk benefits due

[

to avoiding a forced mode transition, improvements in EDG reliability and psivuuing the same maintenance at shutdown (see below).

[

Section 6.3.2 provides an acecment of the increased risk swint~1 with continued operation with a single EDG out of service (OOS) for preventive and corrective maintenance. The evaluation of the "at power" risk increment resulting from the extended AOT was evaluated on a plant specific

(

basis using the most current individual plant PSAs as their respective baselines. Plant specific evaluations were performed by each participating utility. Results of these evaluations were then compared using appropriate risk measures as prescribed in Reference 8.

f Section 6.3.3 ="e<w the risk of transitioning the plant from Mode 1 into a lower mode with a single EDG inoperable. The "at power" risk assessment presented in Section 6.3.2 provides an evaluation of continued operation of the plant with an extended EDG AOT for the purpose of performing corrective maintenance on the EDG. A conservative lower bound estimate of this risk was evaluated by modifying the reactor trip core melt scenario for a representative CE PWR. Based f

on this analysis, a core damage probability for the plant shutdown was established and compared to the single AOT risk associated with continued operation.

l I

17 l

l l

1

.b

The relative risk of EDG PM for "at power" and "at shutdown" conditions is provided in Section 6.3.4.1.

Recent experience has shown that the risk of maintnimng the reactor in a shutdown condition can rival that of power operation.

EDG PM programs have been effective in reducing EDG unavailability due to failure to start and load-run. Section 6.3.4.2 provides a demonstration of the risk reduction possible by implementing a planned "on-line" PM program. In that analysis a parametric study is performed to demonstrate the impact of modest (10 to 30%) improvements in EDG reliability on decreased plant risk.

For completeness, the impact of the extended AOT on the plant large early release fraction is qualitatively a"eard. The assessment includes an evaluation of the events leading to large early fission product releases and the role of the EDG in the mitigation of those events. This nueument l

is presented in Section 6.3.5.

6.3.2 Assessment of "At Power" Risk Methodology This section provides an nue" ment of the increased risk associated with continued operation with a single EDG out of service (OOS). The evaluation of the "at power" risk increment resulting from the extended EDG AOT was evaluated on a plant specific basis using the most current individual plant PSAs for their respective baselines. Plant specific evaluations were performed by each participating utility. Results of these evaluations were then compared using the following risk measures (from Reference 8):

Average Core Damage Frequency (CDI): The average CDF represents the frequency of core-damage occurring. In a PSA, the CDF is obtained using mean unavailabilities for all standby-system components.

Core IAzmage Pinhability (CDP): The CDP represents the probability of core-damage occurnng. Core-damage probability is approximated by multiplying core-damage frequency by a time period.

Conditional Con-Damage Frequency (CCDF): The Conditional CDP is the Core Damage l

Frequency (CDF) conditional upon some event, such as the outage of equipment. Itis calculated by requantifying the cutsets after adjusting the unavailabilities of those basic events associated with the inoperable equipment.

I 18

I t

Increase in Core Damage Frequency (ACDF): The increase in CDP represents the

[

difference between the CCDF evaluated for one train of equipment unavailable minu.s the CCDF evaluated for one train of equipment always available. For the EDGs:

(

ACDF = Conditional CDF m

- Conditional CDF a m o

a where CDF = Core Damage Frequency (per year)

Single AOT Risk Contribution: The Single AOT Risk contribution is the increment in risk associated with a train being unavailable over a period of time (evaluated over either the full AOT, or over the actual maintenance duration). In terms of core damage, the Single t

AOT Risk Contribution is the increase in probability of core-damage occurring during the AOT, or outage time, from the baseline. The value is obtained by multiplying the increase in the CDF by the AOT or outage time, r

Single AOT Risk = ACDF x r L

where, ACDF = Increase in Com Damage Frequency (per year), and r

r = full AOT or actual maMtenance duration (years)

L

[

Yearly AOTRisk Contribution: The Yearly AOT risk contribution is the increase in average L

yearly risk from a train being unavailable accounting for the average yearly frequency of the AOT. It is the frequency of core-damage occurring per year due to the average number of i

entries into the LCO Action Statement per year. The value is estimated as the product of L

the Single AOT Risk Contribution and the average yearly frequency (f) of entering the associated LCO Action Statement. Therefore:

r Yearly AOT Risk = Single AOT Risk x f

(

where f = frequency (events / year)

Incremental changes in these parameters are assessed to establish the risk impact of the Technical

[

Specification change.

Calculation of Conditional CDF, Single and Yearly AOTRisk Contributions t

Each CEOG utility used its current PSA to assess the Conditional CDF based on the condition that ce EDG is unavailable. Each plant verified that the appropriate basic events are contained in the PSA cutsets used to determine the AOT risk contributions. This verification was performed as the first task in calculating the Conditional CDFs. If basic events had been filtered out of the PSA cutsets, one of the two methods described below were used to ensure the calculation of Conditional

,I

(

CDF was correct or conservative:

19

1.

Select the basic event for the failure mode of the component with the highest failure probability if the test / maintenance failure mode of the component had been filtered out; or 4

l 2.

Retrieve cutsets containing relevant basic events at the sequence level and merge them with the final PSA cutsets.

'Ihe Cnnditi=1 CDF given 1 EDG is unavailable was obtained by performing the following steps:

1.

Set basic event probability for the failure mode for an EDG equal to 1.0.

2.

Set any basic event probabilities for other failure modes for that train set equal to 0.0.

3.

Set basic event probability for EDG unavailable due to test and maintenance equal to j

0.0.

l 4.

For the case where the LCO Action Statement was prompted by need for Corrective Maintenance (CM) (i.e., equipment failure), adjust the other train's coiig-3nding 4

basic event common cause failure unavailability to the probability of failure given one train has failed (i.e., equal to the beta factor, S, for the Multiple Greek Letter j

Method).

f 5.

For Preventive Mainte: nance (PM) (i.e., no equipment failure), set the failure rate of the train remaining in service to the total single train failure rate (including both independent and common cause failure data).

6.

Requantify the PSA cutsets.

The Conditional CDF was therefore nua"ad for both CM and PM. The difference between the two values is a result of the aforementioned difference in treating common cause failure. It should be noted that the definition of CM for use in the PSA is considerably more stringent than the pragmatic TAGGED INOPERABLE definition of CM used in Section 5.0. In this context, CM refers to l

maintenance performed on a component that cannot otherwise perform its safety function.

The Conditional CDF given 1 EDG is never out for test or maintenance was obtained by setting the basic event probability for the failure mode for an EDG equal to 0.0, and requantifying the PSA cutsets. No adjustment was made to common cause failure from the value used in the bawline PSA.

l The Conditional CDFs were evaluated for each EDG, and the most conservative result was used.

l The Conditional CDF was then used to m1culata the increase in CDF. 'Ihe Single AOT Risk Contribution for each plant was then calenlated for the following cases:

i 20 j

- Current full AM,

[

- Proposed full AM (both 7-day and once per cycle 10-day),

- Mean downtime for CM, and

- Mean downtime for PM.

b A mean downtime of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> / event was ***nmed for CM. For PM, the mean duration per event was @da*M by dividing the proposed downtime (unavailability target, hours / year /EDG) by the

[

proposed frequency of PM. A proposed downtime of 160 hours0.00185 days <br />0.0444 hours <br />2.645503e-4 weeks <br />6.088e-5 months <br /> / year /EDG and a frequency of 2.8 per year was aanmed for PM. These values are mean values presented in Reference 3. Plants with actual data available used plant specific values.

The Single AM Risk Contributions were then used to @ data the Yearly AM Risk Contributions l

(Single AM Risk x frequency) based on each plant's actual frequency of entry into the AOT, for both CM and PM. Plant specific frequencies were used in this calentatian for CM and PM whenever available. If not available, maintenance frequencies were assumed to be 2.5 events / year I

r for CM, and 2.8 events / year for PM. If available data for downtime frequency did not distinguish L

between CM and PM, a split of 50/50 was conservatively assumed for CM/PM.

F The overall Yearly AOT Risk Contribution is assumed to be the sum of the Yearly AM Risk L

Contribution due to CM and the Yearly AOT Risk Contribution due to PM. Tables 6.3.2-1 and 6.3.2-2 provide the Conditional CDFs and the Single and Yearly AOT Risk Contributions for each plant for CM and PM, respectively.

At many plants both EDGs may power different equipment and therefore risk predictions will not r

be symmetric. In the current analyses, the risk measures presented are those of the " worst" (i.e.

L most important) EDG.

Cden1mlon ofAverage CDF In order to calculate the Average CDF for the extended EDG AOT, a new value for EDG

[

unavailability due to test / maintenance was derived. A 2.5% unavailability was assumed, which equates to a maintenance duration of 220 hours0.00255 days <br />0.0611 hours <br />3.637566e-4 weeks <br />8.371e-5 months <br /> per year per EDG. For plants with a maintenance schedule already in place or defined, then actual plant data was used in lieu of the above

[

assumptions.

The impact on the PSA was then calculated to obtain the Average CDF for this new EDG

[

unavailability. This new Average CDF was then compared to the base case value in the plant's PSA. Table 6.3.2-3 provides the proposed Average CDF and the base average CDF for each plant.

1

[

21

~

___________..____._____.______m__

I' I

m The results from each plant were auimibt~i, and the Single AOT and Yearly AOT Risks were calculated for each plant. Tables 6.3.2-1 through 6.3.2-3 present the results of these cases on a plant specific basis, and summarizes the EDG A(yr CDF contributions for each plant. These risk contributions include the Conditional CDFs, Increase in CDF, Single AOT and Yearly AOT risks for both CM and PM, based on full AM and mean downtime, and current Average CDF and proposed Average CDF.

The results for the conditional CDF and Single AOT risks presented in Table 6.3.2-1 are conservative. Specifically, the evaluation of the conditional CDF for corrective maintenance considers that the operable EDG is subject to a common cause failure for the entire duration of the AOT.

In several CEOG member plant technical speifications it is required that either an assessment of the absence of a common cause failure mechanism or an EDG start /run test be performed following discovery of the EDG inoperability. In practice, even when the technical specifications do not require a common mode failure n<eument, it is likely that such an neeument is performed upon the discovery of the cause of the EDG inoperability. Thus, plant operation with one EDG in CM, while the OPERABLE EDG has a high likelihood of common cause failure, would be restricted to a narrow time window which is considerably less than the full 7 day AOT.

For CM, most CE PWRs indicate that repair of a non-functional EDG results in an increase in conditional core damage frequency (CCDF) from the baseline CDF by a factor ofless than 5. The increase in Single AOT Risk Contribution for all CE PWRs (from Table 6.3.2-1, Proposed Single g

AOT Risk based on a full 7 day AM - Current Single AOT Risk) varies from 0.0 (for plants that E

already have a 7 day AOT for EDGs) to 2.16E-06. The increase in Single AOT Risk Contribution for a Single AOT Risk based on a 10 day AOT varies from 3.38E-07 to 3.78E-06.

For all CE PWRs, declaring the EDG INOPERABLE and taking the EDG out of service for maintenance increases the conditional CDF by a factor of between 1.5 and 4. The increase in Single AOT Risk Contribution for all CE PWRs (from Table 6.3.2-2, Proposed Single AOT Risk based on a full 7 day AOT - Current Single AOT Risk) varies from 0.0 (for plants that already have a 7 day AOT for EDGs) to 1.38E-06. For a full 10 day AOT, the increase from Current to Proposed Single AOT Risk Contribution varies from 2.09E-07 to 2.42E-06.

As will be shown in the following sections, these risks are offset by reductions in transition and l

shutdown risks.

W Table 6.3.2-3 summarizes the impact of the proposed AOT extensions on the plant yearly core damage frequencies. The change in the Average CDF due to increasing the EDG AOT varies from a factor of 1.01 to 1.078. When interpreting Table 6.3.2-3, it is important to note that some plants evaluated their IPEs based on actual plant data and not on the full AOT, whereas the Proposed l

Average CDFs presented in the table for all plants are based on the full proposed AOT. Two plants l

(ANO-2 and FCS) that based their IPEs on actual EDG downtimes had recent plant histories with very limited EDG PM. Therefore, the change factor for these plants is overestimated. A more l

l l

l L

r t

appropriate estimate of the change factor can be established by evaluating the hawline PRA PM at

[

one full AOT per year. This value is presented in parenthesis for these plants.

Waterford Unit 3 indicates a higher impact on the CDF than other plants. This increased impact l

is primarily due a conservative treatment of the SBO event within the IPE. SpMfically, the Waterford-3 IPE assumes that all EDG failures occur at the time of loss of offsite power (i.e. all EDG failures are conservatively assumed to be start failures). Even with this conservative modeling approach, Waterford-3 has a relatively low plant haeline CDF (1.54 x 104 per year).

A preliminary evaluation of a more realistic approach to the treatment of EDG failures was performed to support this assessment. In this realistic method, the product of the EDG run failure probability

(

density function and the offsite power non-recovery function was integrated over the mission time.

This accounts for the fact that EDG run failures can occur at any time durmg the mission time, r

including late in the sequence when the probability that offsite power will be recovered is high.

L Using this realistic methodology, the expected CDF increase factor will reduce from 1.14 to 1.078 (see Table 6.3.2-3). This translates to an absolute yearly risk increase of about 1 x 104 per year.

For Waterford-3 taking the EDG out for maintenance would result in an increase in CCDFs by a factor of about 7.2 for CM and 2.9 for PM. These risks are generally comparable to those associated with the CE group as a whole.

L F

L F

L r

L

[

[

l

[

l 23

Table 6.3.2-1 CEOG AOT CONDITIONAL CDF CONTRIBUTIONS FOR EDGs - Corrective Maintenance PARAMETER ANO-2 Fort Maine Millstone Palisades Palo San St. Imcie 9t.I.mcie Waterford Calhoun Yankee 2

Verde Onofre 1

2 3

1, 2, & 3 2&3 eda succese Criteria I of 2 1 of 2 I of 2 I of 2 1 of 2 1 of 2 1 of 2 1 of 2 1 of 2 1 of 2 Present AUT, days 3

7 7

3 7

3 3

3 3

3 Proposed AUT, days 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 conditional CDP, per yr 1.26E-04 5.28E-05 1.15E44 9.43E-05 1.64E-04 2.43E.04 5.92E4 5.9E-05 6.3E4 1.56E-04 (1 EDO unavailable)

Conditional CDP, per yr 3.27E-05 1.17E-05 7.36E45 3.24E-05 5.00E-05 4.58E4 2.69E-05 2.lEM 2.3E4 1.50E 4 (1 EDO never out for T/M)

Increase in CDP per yr 9.30E-05 4.1 IE-05 4.14E-05 6.19E-05 1.14E-04 1.97E-04 3.23E-05 3.8E-05 4.08 4 1.4 IE-04 Single AOT Risk, Current 7.65E-07 7.88E-07 7.94E-07 5.09E-07 2.19E4 1.62E 4 2.65E-07 3.IE-07 3.3E-07 1.16E4 Singio ACT Risk,i L7 da[ I1,78B4L

[7.88E.07l 17,94E.b7 -

i1.19E.U6 5.19E 06 J $.78E4l 6.'19847$ h.3847f

$7.7E473

[$.70d56I 2

. Proposed

'lo day

2.558 06

)!'i3E.06} !!.855d Ij.705.06L f 3.12E 06) 6 5.40E41 [8.851NTI

$0I58

$lklE569 ill55E M Dowrdime Frequency, per yr 0.63 2.5 2.5 2.5 2.0 1.8 0.63 2.5 2.5 2.5 per diesel

• Yearly AOT Risk, Current, 4.78E-07 1.97E-06 1.98E46 1.27E4 4.37E4 2.92E4 1.66E-07 7.8E47 8.2E-07 2.90E-06 per yr/ diesel **

Yearly AUT Risk, 1.12E4 1.97E 4 1.98E4 2.97E4 4.37E-06 6.81E4 3.87E-07 1.8E4 1.9E4 6.76E4 Proposed, per yr/ diesel **

Actual Duration, hrn/ event

• 15 24 24 24 24 24 23.8 24 24 24 Single AUT Risk I.61E-07 1.13E-07 1.13E-07 1.70E-07 3.12E-07 5.40E-07 8.78E-08 1.0E47 1.lE-07 3.86E-U7 (based on actual data)

Yearly AOT Rieklyr/ diesel **

1.00E-07 2.82E-07 2.84E-07 4.24E47 6.25E.07 9.72E47 5.48E-08 2.6E47 2.7E-07 9.66E-07 (based on actual data)

• Generic data = 2.5 per yr per diesel

• • Value presented for worst ease diesel

• • • Generic data = 24 hrs / event 24 M

M M

M M

M M

M M

M M

M

.--r

Table 6.3.2-2 CEOG AOT CONDITIONAL CDF COffrRIBUTIONS FOR EDGs - Preventive Maintenance PARAMETER ANO-2 Port Maine Milletone Palisades Palo San St. Imcie St. Lucie Weserford Calhoun Yankee 2

Verde Onofre 1

2 3

I,2, & 3 2&3 EDG Success Criseria 1 of 2 1 of 2 I of 2 I of 2 1 of 2 I of 2 l of 2 I of 2 1 of 2 1 of 2 Present AOT, days 3

7 3

3 7

3 3

3 3

3 Proposed AUT, days 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 Conditional CDP, per yr 1.01E-04 3.71EE I.13E-04 8.58E-05 1.57E-04 1.72E-04 5.41EM

4. LEE 4.7EM 6.76E 05 (1 EDO unevailable)

Conditional CDP, per yr 3.27E-05 1.17E-05 7.36E-05 3.24E-05 5.00E-05 4.58E-05 2.69EE

2. LEE 2.3E4 1.50E4 (1 EDO never out for T/M)

Increase in CDP, per yr 6.86E-05 2.54E45 3.94E-05 5.34E-05 1.07E-04 1.26E-04 2.72E45 2.0E45 2.4E45 5.26E-05 Single AUT Risk, Current 5.64E-07 4.87E-07 7.56E-07 4.39E-07 2.05EE 1.04E 4 2.24E-07 1.6E-07 2.0E-07 4.32E47 9

i 1.32N.05 - i4.87E M i7.56BM II.02E46l 2.0$E-061 52N2B46? ! 5.22EMi

?3.8E-07 ^;

E4.6E-07 g

,11.01E46 ?

5 Single'ACT Risk,Ne R7 day L

...v-

.,.,..-...t.

,... g-g

'EPsoposed~ ' '

. ~.

. ~ <

.---.e w:

410 day {

l. l.88E-06 :

6.%E4!

? I.08E46 '

i t.46E4]- - - 1 93E46(

5 3.46E46.1 s7.45E-07s

$ $.4E.07.'; 76.6843 fl A4E.06'.!)

2 Downtime Frequency, per yr*

2.0 2.8 2.8 2.8 4.0 3.0 1.25 2.8 2.8 2.8 Yearly AUT Risk, Currenr, per yr/ diesel **

1.13E 4 1.36E4 2.12E4 1.23E 4 8.21E4 3.llEM 2.79E-07 4.6E-07 5.5E-07 1.2tE 4 Yearly AUT Risk, Proposed, per yr/ diesel **

2.63E5 1.36E 4 2.12E4 2.87E4 8.21E 4 7.26EM 6.52E-07 1.lE4 1.3EM 2.82E4 Proposed Downtime hrs / train /yr***

192 160 175 144 192 160 114,75 240 240 140 l

Actual Duration hrs / event **

96 57 63 51 48 53 92 86 86 50 Single AUT Risk 7.52E-07 1.66E-87 2.81E-07 3.14E-07 5.86E-07 7.68E-07 2.85E-07 2.0E47 2.4E-07 3.00E-07 (based on actual dumtion)

Yearly AOT hk/yr/ diesel **

1.50E-06 4.64E-07 7.87E-07 8.78E-07 2.35E-06 2.31E4 3.56E 07 5.5E-07 6.6E-07 8.4tE-07 (based on actual duration)

• Generic data = 2.8 per yr per diesel

• • • Duration (hre/ event) = Proposed Downtime (hrs /yr)/Prequency (evente/yr)

• • Values presented are for worut case diesel

• • • • Genene data = 220 hre/yr/ diesel 25

Table 6.3.2-3 CEOG PROPOSED AVERAGE CDFs PARAMETER ANO-2 Port Meine Milletone Pehendee Pelo San St. Imeie St. Imele Waterfoed CeDem Yankee 2

Verde Onofro 1

2 3

1. 2, & 3 2A3 EDG 6-Criterie 1 of 2 l of 2 l of 2 -

l of 2 l of 2 l of 2 l of 2 l ef 2 l ef 2 l of 2 Present AUT, doye 3

7 7

3 7

3 3

3 3

3 Propoecd AUT, days 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 7/10 Proposed Downtime, hre/yr 219 220 235 168 240 220 220 264 264 200 Average CDP (base), per yr 3.28E4 1.18E4 7.40E4 3.41EE 5.15EE 4.74EE 2.74E 4 2.14E4 2.35E4 1.54E4 Preposed Average CDP 3.50E-05" 1.27E E "

7.45E-05 3.50E4 5.2EEE 4.85EE 2.86EE 2.2EE 2.4E-05 1.75E E Cheage factor imm baseline 1.UT" 1.08*"

1.01 1.03 1.03 1.02 1.04 1.02 1.02 1.14**

CDP (1.05)

(1.02)

(1.078)

• Generie date = 220 hre/yr/ diesel

• • The Proposed Averese CDP is presented here is based on using the ibn AUT whosees the baseline IPE Average CDP was bened en acesel plant date whleh had very little PM on line (see Table 5.2 1).

s** The Numbero in parenthesis represent 5 change from baseline IPE if the baseline IPE was evaluated over the fun AUT.

ee** See page 25 for discussion of resulte 26

i f

L 6.3.3 Assessment of Tmnsition Risk l

For any given AOT extension, there is theoretically an "at power" increase in risk==aciatM with it. This increase may be negligible or significant. A complete approach to musuing the i

r l

change in risk accounts for the effects of avoided shutdown, or " transition risk". Transition Risk represents the risk naariatM with reducing power and going to hot or cold shutdown following equipment failure; in this case, one EDG unavailable. Transition risk is of interest in understanding the tradeoff between shutting down the plant and restoring the EDG to operability while the plant continues operation. The risk of transitioning from "at power" to a shutdown mode must be halaned against the risk of continued operation and performing f

corrective maintenance while the plant is at power.

To illustrate this point, a representative CE PWR has performed an analysis for transition risk l

associated with one inoperable EDG. De methodology and results obtained by this plant are I

presented below and are considered generically applicable to the other CE plants.

Afethadology ne philosophy behind the transition risk analysis is that if a plant component becomes unavailable, the CDF will increase since less equipment is now available to respond to a transient if one were to occur. However, as long as the plant remains at power, this CDF is constant. At the point in time that a decision is made to shut down, the CDF increases since a " transient" (manual shutdown) has now occurred, and the equipment is still out of service.

{

The Core Damage Probability (CDP) associated with the risk of plant transition from plant full power operation to shutdown is obtained by modifying the " uncomplicated reactor trip" core damage scenario in the PSA model. In this evaluation the incremental risk is dominated by the

[

increased likelihood of loss of main feedwater and the reliance on auxiliary (and/or emergency) feedwater to avert a core damage event. A cutset editor was used to adjust cutsets representing manual shutdown or miscellaneous plant trips to reflect the CDP associated with a forced

[

shutdown assuming one EDG is out of service and requantifying the PSA cutsets. Conservatisms that had been included in the base PSA model were deleted to reflect the greater control that the plant staff has in the shutdown process. Specifically, the baseline PSA assumed total loss of main feedwater (MFW) within 30 minutes of reactor trip. In the transition analysis, MFW was assumed to be recoverable following failure of Auxiliary Feedwater. A human error probability (value of 0.1) was added to cutsets that contained no basic events, including human actions, that would cause MFW to be unavailable. The duration of the transition process was assumed to be 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> (6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to hot standby and 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to hot shutdown), and result in a Mode 3 or Mode 4 end state with core cooling provided via the steam generators.

Additional human errors that would be associated with a detailed portrayal of the shutdown process and the entry into shutdown cooling were not included in order to establish a

{

conservative lower bound assessment of the transition risk. Errors of commission, such as diversion of RCS flow during SDC valve alignment, are also not considered in this analysis.

27 l

l I

i l

Such errors would add to the disadvantages of the shutdown alternative, and therefore, to include them would be non-conservative for the purpose of this comparison. Similarly, any trannitianni risks nunciated with the return to plant operation are conservatively napet~I.

Based on the above methodology the CDP associated with the lower mode trnnaitinn was calculated for the representative plant to be 1.00E-06. Results of transition risk analyses can l

l be generalized for the other CE PWRs by assuming that the ratio of the CDP for Trantitian Risk I

to the haeeline Average CDF is constant for all plants. The haeline CDFs were elected rather l

than the C*itiaani CDFs for the ratio between the other CE plants because the analysis for the l,

l representative plant indicated that transition risk was more a function of Loss of MFW rather l

than a function of the specific equipment out of service, j

That is, A CDPau = (CDFyCDF,,

• ACDPaw,g) where:

g E

ACDPn,

Incrernental risk due to mode tronaltion for plant

=

j CDF,

Rawline CDF for plant g

=

CDF,p Repreent=five plant hauline CDF 5

=

i CDPnu,,

Incremental risk due to mode transition for

=

i repreentative plant i

The transition risk may be used to evaluate the relative risks of performing EDG repair at power i

to that of performing the same repair at some lower mode. He risk of continued operation for i

the full duration of the AM is bounded by the single AOT risk for CM (if a common cause i

failure is suspected) and by the single AM risk for PM when common cause failure can be j

ruled out. He comparable risk of the alternate maintenance option involves enneideration of j

four distinct risk components:

(1) Risk of remaining at power prior to initiating the lower mode transition.

l This risk will vary depending on the ability of the staff to diagnose the EDG fault and j

the confidence of the operating staff to expeditiously complete the repair. The time l

j interval for power operation with a degraded component, prior to mode transition will i

vary from one to several days, i

I i

(2) Risk of lower mode transition.

This risk is accumulated over a short time interval (approximately 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />).

j (3) Risk of continued lower mode operation with an impaired EDG.

i 1

28 g

i

l 1

In this mode, the reactor is shutdown and the core is generating decay power only.

However, risks in this. mode remain significant. Depending on the particular operational mode, resources to cope with plant transients will typically be less than at power. These modes are characterized by decreased restrictions on system operability, longer times for operator recovery actions, lower initiating frequency for pressure driven initiators (such i

as LOCA) and a greater frequency for plant transients such as those initiated by loss of j

offsite power and loss of main feedwater.

i (4)

Risk of return to power I

The power ascension procedure is a well controlled transient. Reference 8 conceptually discusses that risks associated with this transition are greater than those associated with at power operation, but significantly below that associated with the initial lower mode transition (item 2).

The analysis of transition risk presented in this report quantifies only the risk of lower mode transition (item 2).

d I

Results Table 6.3.3-1 presents the risk associated with transitioning the plant to a lower mode for each plant. The numbers in the table represent only the lower mode transition risk component of the transition sequence (item 2). The risk associated with the transition portion represents a significant fraction of the risk that would be incurred for a seven day "at power" (Single AOT Risk from Tables 6.3.2-1 and 6.3.2-2) EDG maintenance period.

When the risk at power and the risk at the lower mode of operation are comparable, then these results indicate that performing a 7 day EDG maintenance activity "at power" would be risk beneficial.

l 1

4 4

1 I

I 29

I Table 6.3.3-1 TRANSITION RISK CONTRIBUTIONS FOR EDG CM PLANT Transition Risk Contribution (ACDP)

ANO-2 6.92E-07 l

Fort Calhoun Station 2.49E-07 Maine Yanke:

1.56E-06 Millstone 2 7.19E-07 Paliade 1.09E-06 Palo Verde 1,2 & 3 1.00E-06 l

San Onofre 2 & 3 5.78E-07 St. Lucie 1 4.5E-07 I

St. Lucie 2 5.0E-07 g

l Waterford 3 3.25E-07 4

I' I

1 I!

4 30 I

F L

6.3.4 Assessment ntf Sisutdown M 6.3.4.1 Assessment ofRisk-Tradeof The risk of EDG maintenance at shutdown was inva= tie = tad using the shutdown PSA of a CEOG participant.

This study was directed at antimating the advantage of performing EDG maintenance at power by antimating the corollary impact of performing the same PM during shutdown. Shutdown risks were evaluated for two shutdown configurations: Mode 5 mid-loop operation (representative of the early reduced inventory phase of the shutdown) and for a

=viitim representative of a spent fuel pool operation with a complete fuel off-load. 'Ihe impact of EDG PM was muse ***d by analyzing the incremental reduction in core damage probability (CDP) when two EDGs are available vs. the plant operating state when one EDG is operable and available while the second EDG is undergoing maintenance. Recovery of offsite power was

[

considered. However, recovery of failed or inoperable EDGs was aan=ad not to occur in time to avert core damage.

(

Results Results of this investigation are summarized in Table 6.3.5-1.

The tabular information is presented in terms of the daily core damage probability. The daily CDP is assumed applicable anytime while the plant is in the shutdown mode analyzed.

Maintenance of the EDGs early in the shutdown operation and while the plant is at reduced inventory (e.g. mid-loop operation), results in an incremental risk of core damage equal to about 1.2 x 104 per day while the EDG is inoperable. In this instance, the high impact of the EDG

[-

is a result of the short time erpact d to core damage. Late in the sequence the shutdown PSA f

predicts a similar trend for the EDG importance (1.7 x 10 per day). This later evaluation 4

{

further assumed that once the fuel in the spent fuel pool uncovers (about 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> into the event), efforts to refill the spent fuel pool would be unsuccessful. These events can be further complicated in that failure of fuel during shutdown can result in higher radiation exposures than

{

similar events occurring at power in a closed containment.

[

TABLE 6.3.4.1-1 DAILY PLANT CORE DAMAGE PROBABILITY AT SHUTDOWN l

{

FOR A REPRESENTATIVE CE PWR CONDITION No PM 1EDO NPM INCREMENT IN (2 EDOs AVAILABLE)

CDP REDUCED INVENTORY 1.04 X 104 2.26 X 104 1.2 X 104 (MID-LOOP)

SPENT FUEL POOL 5.1 X 104 4.36 X 104 3.8 X 104 i

l 31 b

L

\\

Eu Conclusion Early in the shutdown, risk of PM is generally equivalent to that for similar maintenance at power. At later times, incremental risks asmeinted with EDG PM may be optimi@mlly expect to be lower than what is reported in this nueument. However, these risks cannot be neglected and may be comparable to that of power operation.

l 6.3.4.2 Assessment ofEnhanced EDG Reliability Reference 2 noted that over the past several years "on-line" PM on EDGs has increased. During the same time interval, the unreliability of the EDGs has also decreased. While a precise relationship between the PM process and EDG reliability has not been established there appears to be a positive correlation between increased PM performed in recent years and the enhanced EDG reliability which has been observed. While not all PM activities will directly impact EDG g

reliability, certain PM originating from plant reliability improvement programs and including g

manufacturer suggested inspections and modifications do likely have a beneficial effect. This sectica explores the risk impact of small to modest increases in EDG reliability on risk "at g

power" and on risk during the early low inventory phases of a plant shutdown.

5 "At Power" Risk Assessment An analysis was performed to determine what increase in EDG reliability would be required in order to offset the risk increment associated with 5 days (120 hrs) of "on line" maintenance.

The five day interval generally bounds the average PM unavailability for the CE PWRs.

Assumptions employed in the analysis are as follows:

1. The nominal EDG failure probability to start and load /run for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is.09 per demand, l

l and g

2.

The reliability benefit is realized for six months out of a year.

I In this assessment the risk increment incurred by removing one EDG from service for a 5 day "at power" repair period was related to the integrated reduction in risk achieved by improving the EDG reliability (reducing the failure to start and failure to load and run values) by 10,20 l

and 30%.

Results of this assessment are summarized in Table 6.3.4-1. Companng the risks of at power l

PM with risk reductions due to reliability improvements, it is apparent that a PM program that improves the average performance of the EDG by 15% offsets the risk of EDO unavailability due to PM.

I I

3 1

1

l r

L

[

Table 6.3.4.2-1 EDG MAINTENANCE VS. POTENTIAL IMPROVEMENTS IN EDG RELIABILITY r

Yearly Risk Increase due to Risk Reduction at Power due to Rehability Improvement L

120 hrs of "at power" FM 10 %

20 %

30 %

[

3.4 X 104 2.3 X 104 4.9 X 10 7 X 10-7

[

Shutdown Risk Assessment It has been shown in Section 6.3.4.1 that a modest improvement in EDG reliability from

[

performing PM probably offsets the contribution to the "at power" risk from having an EDG out of service to perform the PM. A second benefit of performing on-line EDG Preventive r

Maintenance (PM) is that upon entering shutdown modes, the EDGs will have a greater L

reliability than if maintenance had been done at the end of a refueling outage. To assess this effect, it is assumed that "at power" PM will result in a 15% improvement in the EDG reliability. In other words, the fact that the PM is performed several months closer to the time the EDG is needed is assumed to result in a 15% lower failure probability.

Additional assumptions employed in this analysis are as follows:

1.

The only initiating event that is considered to be the EDG rehability is the loss of Offsite Power.

2.

Reduced inventory operation is assumed for 7 days 3.

No other alternate ac is credited.

[

4.

Core damage occurs 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after LOOP.

5.

Recovery of offsite power is credited based on Reference 10.

l The data used in the calculation is summarized in Table 6.3.4-2.

l l

[

[

[

33

(

f

I!

l TABLE 6.3.4.2-2 El

SUMMARY

OF ANALYSIS DATA E

l Probabihty of EDG1 to Fail to P==

.014 start and load (Bam) a

)

Probability of EDG1 to Fail to start and Load (Given FM)

Pru

.012 Probability of Loss of Offnte Power over the interval of

1. mor

.004 reduced inventory OPERATION I

Probability to Recover Off4te Power in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> E

g ncyx 0.58 E

Common cause failure of EDG2 given failure of EDG1 E

.05 I

Applying these assumptions, the impact of EDG reliability improvement on the risk reduction g

at shutdown can be approximat~i. The ACDP for a shutdown with reduced inventory operation g

i is approximated as:

l ACDPm =Pwo,(Ay(1-Py i

I

=

l Am = (Pg +Py )-(P,y)2_pru(@)

I I

I

l Substituting values from Table 6.3.4-2 into the above relation results in an estimated risk reduction benefit at shutdown of 2.6 x 104 For longer periods at reduced inventory, or if 1

h= Men are unavailable, the net risk benefit would correspondingly increase.

Assessment of hade of between PM at power and improved EDG Reliability Parametric evaluations presented in sections 6.3.4.1 and 6.3.4.2 indicate that PM that results j

in modest improvements in EDG reliability over the long term can more than offset the short term risk from having an EDG out of service to perform the PM.

i 6.3.5 Assessment ofLarge FMy Release A review oflarge early relente scenarios for the CE PWRs indicates that early releases arise as a result of one of the following class of scenarios:

1.

Containment Bypass Events These events include interfacing system LOCAs and steam generator tube ruptures (SGTRs) with a concomitant loss of SG isolation (e.g. stuck open MSSV),

i 2.

Severe Accidents accompanied by loss of containment isolation These events include any severe accident in conjunction with an initially unisolated containment.

3.

Containment Failure nwiM~i with Energetic events in the Containment.

4 i

Events causing containment failure include those associated with the High Pressure Melt Ejection (HPME) phenomena (including direct containment heating (DCH)) and hydrogen conflagrations / detonations.

8 i

Of the three release categories, Class 1 tends to represent a large early release with potentially direct, unscrubbed fission products, to the environment. Class 2 events encompass a range of releases varying from early to late that may or may not be scrubbed. Class 3 events result in l

a high pressure failure of the containment, typically immediately upon or slightly after reactor vessel failure. Detailed Level 2 analyses for the plant condition with an increased availability of the EDG are not performed. However, assessment of the expected change in the large early release fraction was made by nueuing the impact of the EDG availability on the above event i

categories.

35 l

.=

II a

I Containment Bypass Ewmts Events contained in this category are not expected to significantly rely on the EDG for event mitigation. Events included in this category are the large Interfacing System LOCA (i.e. failure of an SDC line). Testing and or maintenance of EDGs will not impact the ISLOCA frequency.

I ISLOCAs are char = arived by a continuous and unreplenished loss of RCS inventory and ma%p. In these scenarios, core damage ultimately results following the depletion of reactor coolant. Thus, provided that a continuous independent water supply is not available during the l

accident, the ISLOCA will progress into early core damage regardless of the EDG availability.

Severe Accidents accompanied by Loss of Containment Isolation Another event contributing to large early fission product releases could occur when an unmitigated severe accident occurs in conjunction with an initially unisolated containment.

Increased unavailability of the EDGs may result in a marginally greater frequency of core damage events due to station blackout. Since the probability of the loss of containment isolation g

is low, the net impact of enhnneed SBO coupled with a loss of containment isolation on the g

overall plant radiological releam is considered negligible.

Containment Failure associated with Energetic events in tlw Containment.

Class 3 events are dominated by RCS transients that occur at high pressure. These events are E

typically restricted to events that initiate as a station blackout or a loss of feedwater. An 3

increased probability of SBO induced core melts will result in a proportional increase in the SBO contribution to large early radiation releases due to direct containment heating (DCH). As a E

result of the conservative treatment of DCH issues in many PSAs there is a noticeable 5

correlation between early containment failure induced by DCH and station blackout initiators.

This reladonship exists since DCH containment failure is a result of a high pressure melt I

ejection (HPME) at reactor vessel lower head failure, and that SBO events can lead to high n

l pressure core melts. The fraction of SBO events leadmg to a high pressure core melt and subsequent HPME in practicality should be small when one considers the high propensity of hot l

leg / surge line creep failure occurring in advance oflower head failure.

)

In this assessment, the impact of increased EDG maintenance unavailability on the large early releases was established by assuming that the increase in the yearly CDF (typically on the order of 1 to 10%) was totally due to an increase in unmitigated station blackout events. Turthermore, l1 I

it can be conservatively assumed for the CE plants involved in this study that less than 20% of SBO events result in large early containment failures. Therefore, increased EDG on-line maintenance will result in a small increase in large early containment failure scenarios.

J I

I' 36 i

I

L 6.3.6 Sanmary qf Risk Assessment The proposed increase in the EDG ACyr was evaluated from the psspective of various risks

==wintul with plant operation. For the plants evaluated, incuryviidion of the extended A(7T into the technical specification can pataatially result in nagligible to small increases in the "at power" risk. However, when the full scope of plant risk is considered, the risks incurred by er*awlia: the ACYr for either corrective or preventive maintenance will be substantially offset by risk benefits newiatai with avoiding naa~-ry plant transitions and/or by reducing risks during plant shutdovm operations, and imposition of limited restrictions for performing EDG PMs.

'Ihe unavailability of one EDG was found to not significantly impact the three classes of events that give rise to large early releases. 'Ihese include containment bypass sequences, severe

[

accidents accompanied by loss of containment isolation, and contninment failure due to energetic events in the containment. It is therefore concluded that increased unavailability of one EDG r

(as requested via Section 2) results in a negligible impact on the large early release probability L

for CE PWRs.

r The impact of implementation of the proposed extended AOT will vary from being risk L

beneficial to posing a negligible increase in plant risk. 'Ihe precise impact will depend on the specific circumstances of the entry into the LCO Action Statement.

6.4 Compensatory IWeaanres

{

As part ofimplementing the Maintenance Rule, each CE PWR utility has developed or is in the process of developing a method for configuration control during maintenance. If maintenance is performed on a system / train concurrent with other maintenance, the impact on risk will be

[

evaluated prior to performing maintenance. Some plants achieve this via procedures which require that PSA evaluation is performed prior to performing maintenance. Other plants have a matrix showing the risk nam iatai with different combinations of systems / trains unavailable

[

due to maintenance. This matrix is used in planning the rolling maintenance schedule which is part of implementing the Maintenance Rule.

l

[

The following conditions / restrictions are typical of those that will be imposed on the operator governing "at-power" maintenance procedures-1

[

1.

Do not enter the LCO Condition for voluntary inoperability of an EDG if the auxiliary systems for the diesel generator that will remain available are not fully operational (but do not require LCO entry for operability).

[

2.

Do not voluntarily enter the EDG LCO if any component that can significantly increase plant risk is simultaneously expected to be out of service.

(

37 f

L

l l

3.

When performing extended EDG maintenance ensure that existing resident plant alternate AC power sources (e.g. " swing" DGs, combustion turbines or independently powered FW pumps) are functional.

l 4.

Do not perform maintenance on components of the Electrical Distribution System (EDS)

(e.g., main transformer) that could significantly increase the likelihood of a LOOP l

initiating event while an EDG is out for maintenance. Minimim challenges to the EDG.

5.

Do not perform maintenance on a diesel generator if an auxiliary feedwater pump and l

uwinted support system and component are unavailable.

Additional operational restrictions and cautions may include the following:

1.

Schedule PM to coincide with favorable weather conditions, e.g., not during " ice" or electrical storms which may induce LOOP. Consider preservation of the grid.

2.

Put procedures or pre-planned activities defining restoration of equipment in place before PM is done.

3.

Hold briefings with appropriate plant personnel to ensure they are aware of impact I

associated with taking an EDG out of service.

E 4.

Ensure availability of replacement parts and special tools, and estaalish procedures prior g

to taking an EDG out of service.

5 5.

Check safety-related equipment in division of operable EDG for proper alignment.

6.

Restrict the removal of any equipment from service during EDG maintenance.

7.

Restrict mam switchyard activities (maintenance or re-configuration) to life-threatening or safety-threatening responses (i.e., responding to fires) while an EDG is inoperable for maintenance.

In addition to the above, when the one time 10 day AOT is to be exercised, the plant should take all reasonable efforts to not perform concurrent voluntary maintenance activities on other plant l

risk significant components and should restrict any unnecessary activities in the plant or the switchyard that can increase the risk ofloss of off-site power.

I 7.0 TECHNICAL JUSTIFICATION FOR STI EXTENSION EDG STI extensions are not within the scope of this effort.

l g

38 I

l 8.0 PROPOSED MODIFICATIONS '1V NURECr1432 Attachment A includes ymposed changes to NUREG-1432 Sections 3.8.1 and B 3.8.1 that correspond to the findings of this report.

9.0

SUMMARY

AND CONCLUSIONS This report provides the results of an evaluation of the extension of the Allowed Outage Time 7

(AOT) for one emergency diesel generator (EDG) contained within the current CE plant t

technical whtions, from its present value, to seven days. In addition, a once per cycle AOT of 10 days for corrective maintenance is also requested. This AOT extension is sought to provide needed flexibility in the performance of both corrective and preventive maintenance during power operation. Justification of this request was based on an integrated review and muenment of plant operations, determinide/ design basis factors, plant risk and EDG reliability.

Results of this study demonstrate that the proposed AOT extension provides plant operational

(

flexibility while simultaneously adequately controlling overall plant risk.

[

The proposed increase in the EDG AOT to 7 days with a once per cycle 10 day AOT was evaluated from the perspective of various risks eMe~i with plant operation. For the plants evaluated, incorporation of the extended AOT into the technical specifications potentially results

{

in small increases in the "at power" risk. However, when the full scope of plant risk is considered, the risks incurred by extending the AOT for either corrective or preventive maintenance will be substantially offset by plant benefits nWe~1 with avoiding unn-ry

[

plant transitions and/or by reducing risks during plant shutdown operations, improved EDG reliability upon entering shutdown, and implementation of compensatory measures.

[

The unavailability of one EDG was found to not significantly impact the three classes of events that give rise to large early releases. These include containment bypass sequences, severe accidents accompanied by loss of containment isolation, and containment failure due to energetic events in the containment. It is concluded that increased unavailability of an EDG (as requested via Section 2) will result in a negligible impact on the large early release probability for CE PWRs.

39

I

10.0 REFERENCES

1.

10 CFR 50.65, Appendix A, "The Maintenance Rule".

2.

SECY-93-044, " Resolution of Generic Safety Issue B-56, " Diesel Generator Reliability",

l letter to ACRS from J. Taylor (NRC), Enclosure 8 l

3.

NUREG/CR-5944,

" Emergency Diesel Generator:

Maintenance and Failure Unavailability, and Their Risk Impacts", P. Samanta, et. al., BNL, November,1994.

4.

10 CFR 50.63 " Loss of all Alternating Current Power".

I 5.

Regulatory Guide 1.155, " Station Blackout", August,1988.

6.

SECY-93-044, " Resolution of Generic Safety Issue B-56, " Diesel Generator Reliability",

letter to ACRS from J. Taylor (NRC) 7.

Letter C. Shirake (NRC) to Cooper-Bessemer ~ Working Group,

Subject:

Summary of Nov. 22,1994, Meeting", December 15, 1994.

8.

NUREG/CR-6141, BNL NUREG-52398, " Handbook of Methods for Risk-Based Analyses of Technical Specifications", P. K. Samanta, L S. Kim, T. Manhmo, and W.

E. Vesely, Published December 1994.

9.

Memorandum for Thomas E. Murley from Eric S. Beckjord in Research Information Letter Number 173 entitled " Risk-based Methods to Evaluate Requirements in Technical g

Specifications", January 6,1994.

E i

10.

Advanced Light Water Reactor Utility Requirements Document, Volume II "ALWR Evolutionary Plant", Chapter 1, Appendix A, PRA Key Assumptions and Groundrules (KAG), prepared for EPRI, Rev. 3,11/91.

i 11.

Letter Zwolinski, J. A. (NRC) to Vandewalle, D. J., Re: Emergency Diesel Generator-Limiting Condition for Operation,1305-85-06-006, June 5,1985 I

I I

l f

I I

i 1

i ATTACHMENT A l

l

" Mark-up" of NUREG-1432 SECTIONS 3.8.1 & B 3.8.1 l

l l

t l

l t

l i

l A-1

7 AC Sources-Operating 3.8.1 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A.

(continued)

A.3 Restore [ required]

72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> offsite circuit to

.AND N

OPERABLE status.

days from

(

discovery of failure to meet LCO B.

---

NOTE---------

B.1 Perform SR 3.8.1.1 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Required Action B.3.1 for the OPERABLE or B.3.2 shall be

[ required] offsite AND completed if this circuit (s).

(

Condition is entered.

Once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> thereafter

(

One [ required] DG AND inoperable.

B.2 Declare required 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from feature (s) supported discovery of

(

(

by the inoperable DG Condition B inoperable when its concurrent with redundant required inoperability of

(

feature (s) is redundant l

inoperable.

required feature (s)

AND B.3.1 Determine OPERABLE

[24] hours DG(s) is not inoperable due to conson cause failure.

1 B.3.2 Perform SR 3.8.1.2

[24] hours for OPERABLE DG(s).

AND l

(continued) f CEOG STS 3.8-2 Rev.

O, 09/28/92

AC Sources-Operating 3.8.1 I

ACTIONS E

CONDITION REQUIRED ACTION COMPLETION TIME Ssstf' B.

(continued)

B.4 Restore [ required] DG to OPERABLE status.

7 do.y5 AND days from discovery of failure to meet LCO I

C.

Two [ required] offsite C.1 Declare required 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from circuits inoperable.

feature (s) inoperable discovery of when its redundant Condition C i

required feature (s) concurrent with 2

is inoperable.

inoperability of j

redundant required feature (s)

AND C.2 Restore one 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

[ required] offsite g

circuit to OPERABLE E

status.

(continued) l I

I l

I I

I CEOG STS 3.8-3 Rev.

O, 09/28/92 I

L r

L INSERT A

[

-NOTE On a once-per-refueling cycle frequency, the Completion Tune for REQUIRED ACTION B.4 can be extended to "10 days AND 10 days from discovery of failure to meet LCO."

L c

r L

F L

L I

L F

[

l

[

[

[

[

[

L -_-_-

AC Sources-Operating B 3.8.1 I

BASES ACTIONS A.3 (continued) during any single contiguous occurrence of failing to meet the LCO.

If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 0

~/dox5

. Zb6^M This could lead to a total of.'i3Dheufs7 since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional h. 2 (for a total oOKdays) allowed prior to complete OG --

restoration of'the LCO. The%dayCompletionTimeprovides a limit on the time allowed in'a specified condition af ter discovery of failure to meet the LCO.

This. limit is considered reasonable for situations in which Conditions A l

and B are entered concurrently. The " AND" connector between the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> and X day Completion Time means that both completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action A.2, the Completion Time allows for an exception to the normal " time zero" for beginning the allowed outage time " clock."

This will result in i

establishing the " time zero" at the time that the LCO was

'iriitially not met, instead of at the time Condition A was entered.

B.1 To ensure a highly reliable power source remains with an inoperable OG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the l

Required Action only specifies "perfom," a failure of l

SR 3.8.1.1 acceptance criteria does not result in a Required l

Action being not met. However, if a circuit fails to pass l

SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

I B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that. a DG is I

inoperable, does not result in a complete loss of safety l

(continued)

CEOG STS B 3.8-7 Rev. O,09/28/92 1

I

AC Sources-Operating

(

B 3.8.1

[

BASES r

ACTIONS B.3.1 and B.3.2 L

(continued)

The Note in Condition B requires that Required Action B.3.1 or B.3.2 must be completed if Condition B is entered.

The

(

intent is that all DG inoperabilities must be investigated for common cause failures regardless of how long the DG inoperability persists.

Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs.

If it can be F

determined that the cause of the inoperable DG does not L

exist on the OPERABLE DG, SR 3.8.1.2 does not have to be performed.

If the cause of inoperability exists on other DG(s), the other DG(s) would be declared inoperable upon

(

discovery and Condition E of LCO 3.8.1 would be entered.

Once the failure is repaired, the common cause failure no longer exists and Required Action B.3.1 is satisfied.

If

[

the cause of the initial inoperable DG cannot be confinned

.not to exist on the remaining DG(s), perforinance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.

According to Generic Letter 84-15 (Ref. 7), [24] hours is reasonable to confirm that the OPERABLE DG(s) is not I

%ffected by the same problem as the inoperable DG.

I B.d L

Referu ce JN According to ;

-i o ^. a 1.

L '. '); operation may continue in Condition B for a period that should not exceed L

M dO-y S g

I'n Condition B, the remaining OPERABLE DG and offsite

{

circuits are adequate to supply electrical power,to theThe 22=hssc temp onsite Class 1E Distribution System.

Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO.

If Condition B is entered while, for instance, an

[

offsite circuit is inoperable and that circuit is

{

(continued)

CEOG STS B 3.8-9 Rev.

O, 09/28/92

[

I I

E

)

l l

1 l

INSERT AA ll Additionally, Reference 14 states that operation may continue in Condition B for a maximum continuous period of 10 days on a once per refueling cycle frequency.

t Reference 14 provides a series of deterministic and probabilistic justifications for l

j the Completion Times corresponding to the periods in which continued power operations are allowed with Condition B.

1 i

i 5

t 1

j l

I t

i 1

I I

AC Sourcea-Operating B 3.8.1 l

BASES ACTIONS B.4 (continued) subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

This could lead to a total m

af.13t=hevac, since initial failure to meet the LCO, to 10 h restore the DG. At this time, an offsite circuit could again become inoperable, the DG restor,ed OPERABLE. and an additional 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (for a total o ays) allowed prior to complete restoration of the LCO.

The av Comoletion Time provides a limit on time allowed in a'siiecified condition after discovery of failure to meet the LCO.

This limit is considered reasonable for situations in which Conditions A and B are entered concurrently.

The 'AND" connector between Q

thg 22::hescandMay Completion Times means that both

.s 7a codipletion Times a'pply simultaneously, ano tne more

-j restrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exception to the nonnal ' time zero" for beginning the allowed time " clock." This will result in establishing the

" time zero" at the time that the LCO was initially not met, instead of at the time Condition B was entered.

a <

C.1 and C.2 Required Action C.1, which applies when two offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions.

The Completion Time for this failure of redundant required l

features is reduced to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from that allowed for one train without offsite power (Required Action A.2).

The rationale for the reduction to 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE.

When a concurrent redundant required feature failure exists, l

this assumption is not the case, and a shorter Completion

)

Time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is appropriate.

These features are powered from redundant AC safety trains.

This includes motor driven auxiliary feedwater pumps. Single train features, such as turbine driven auxiliary pumps, are not included in the list.

(continued)

CEOG 55 8 3.8-10 Rev.

O, 09/28/92

AC Sources-OpGratir.a 8 3.8.1 BASES REFERENCES 3.

Regulatory Guide 1.9, Rev. [3], [date].

(continued) 3 4.

FSAR, Chapter [6].

E' 5.

FSAR, Chapter [15].

I 6.

Regulatory Guide 1.93, Rev. [ ], [date].

7.

Generic Letter 84-l5.

8.

10 CFR 50, Appendix A, GDC 18.

9.

Regulatory Guide 1.108, Rev. [1], [ August 1977].

10.

Regulatory Guide 1.137, Rev. [ ], [date].

11.

ANSI C84.1-1982.

12Property "ANSI code" (as page type) with input value "ANSI C84.1-1982.</br></br>12" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process..

ASME, Boiler and Pressure Vessel Code,Section XI.

2H5E]T 13.

IEEE Standard 308-[1978].

0(bj i

I I

i I

I I

j CEOG STS B 3.8-33 Rev. O,09/28/92

r L

E INSERT AB L

14.

CE NPSD 996, "CEOG Joint Applications Report for Emergency Diesel

[

Generator AOT Extension," April 1995 F

L

[

c L

r b

[

[

E rL E

E

[

[

[

r

__