ML20140G194

Informs Commission of Intent to Issue Amend to TS for Plant to Grant Extensions of AOTs for One Inoperable SIT & One Inoperable LPSI Sys on Basis of risked-informed Analyses

ML20140G194
Person / Time
Site:	Arkansas Nuclear
Issue date:	04/30/1997
From:	Callan L NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:
References
SECY-97-095, SECY-97-095-R, SECY-97-95, SECY-97-95-R, NUDOCS 9705080058
Download: ML20140G194 (17)

Text

fM7

/7

/7

/7

/7

/7 fM7 fMMMMMMMR

.A RELEASED TO THE PDR

/

\\

6/9/99 f,bo i

i j

date initials

%..... /a

............. e >...... e. [,

s POLICY ISSUE (NEGATIVE CONSENT)

April 30, 1997 SECY-97-095 EOB:

The Commissioners EBOM:

L. Joseph Callan Executive Director for Operations EllRJFCT:

PROBABILISTIC RISK ASSESSMENT IMPLEMENTATION PLAN PILOT APPLICATION FOR RISK-INFORMED TECHNICAL SPECIFICATIONS PilRPOSF-To inform the Commission of the intent to issue an amendment to the technical specifications (TS) for Arkansas Nuclear One, Unit 2 (ANO-2), to grant extensions of the allowed outage times (AOTs) for one inoperable safety injection tank (SIT) and one inoperable low pressure safety injection (LPSI) system on the basis of risk-informed anslues.

BACKGROt1ND:

Task 1.2 of the Probabilistic Risk Assessment (PRA) Implementation Plan addresses pilot applications for risk-informed regulatory initiatives. The task objective is to evaluate PRA methodologies and develop staff positions on emerging risk-informed initiatives. Item number six under Task 1.2 is risk-informed TS. This paper transmits the staff's proposed safety evaluation for TS amendments for ANO-2, the lead plant for the risk-informed TS pilot application.

In its staff requirements memorandum (SRM) of May 15,1996, the Commission requested that the staff prepare a policy paper, with recommendations, addressing the resolution of the four emerging policy issues identified in the quarterly status update of the PRA Implementation Plan dated March 26,1996. The Commission requested that the staff prepare the policy paper for the Commission's decision prior to the staff's issuance of any final safety evaluation, position, or guidance. The staff's recommendations concerning the four policy issues were forwarded to the Commission in SECY-96-218, dated October 11, 1996.

l o

CONTACT:

NOTE:

TO BE MADE PUBLICLY AVAILABLE WHEN Nanette Gilles, NRR THE FINAL SRM IS MADE AVAILABLE l

^

415-1180 d-y p ?x ll ouovu ykp y*

9y, WS/fF

'MMMMMMMMMMMA

o e The Commission responded to these recommendations in an SRM dated January 22,1997.

The staff believes that the review and approval of the ANO-2 risk-informed TS changes are in accordance with the Commission's positions as stated in the January 22 SRM.

DIRf'11RRION:

In August 1995, the Combustion Engineering Owners Group (CEOG) submitted several Joint Application Reports for the extension of TS AOTs for the staff's review. Two of the CEOG Joint Application Reports provide justifications for extensions of the TS AOTs for the SITS and for the LPSI system. The justifications for these extensions are based on a balance of probabilistic and traditional engineering considerations. Plant-specific risk assessments for all of the Combus, tion Engineering (CE) plants are contained in the reports. ANO-2 is the lead CE plant for the SIT and LPSI system TS changes. Nine of the ten licensees with CE plants have submitted amendment requests to adopt the changes to the SIT and LPSI system AOTs. The staff plans to use the ANO-2 review as a model for the remaining CE plants and will prepare safety evaluations for those plants with comparable results when the ANO-2 amendment has been approved for issuance. In addition, the staff is reviewing corresponding changes to NUREG-1432," Standard Technical Specifications, Combustion Engineering Plants," to adopt the revised AOTs.

The proposed changes would allow extension of the AOT for one inoperable SIT from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and for one inoperable LPSI system from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days. The purpose of these proposed changes is to obtain greater flexibility in the scheduling and implementation of maintenance on the subject equipment. Th0 safety benefits of these proposed changes are outlined in the attached safety evaluation and include avoiding plant shutdowns for non-risk-significant conditions.

The staff evaluated the licensee's proposed amendments to the TS using both traditional engineering analysis and PRA methods. The staff's traditional analysis evaluated the capabilities of the plant to mitigate design basis events with one SIT or one LPSI system inoperable. The staff then used insights derived from the use of PRA methods in determining the risk significance of the proposed changes. The results of these evaluations were used in combination by the staff to determine the safety impact of extending the AOTs for one inoperable SIT and for one inoperable LPSI system.

j The staff's review of the ANO-2 amendment requests and the CEOG Joint Application Reports was made in parallel with, and is generally consistent with the results of, the staff's

)

development of draft Regulatory Guide (RG) DG-1061,"An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Bases"; draft Standard Review Plan (SRP) Chapter 19, "Use of Probabilistic Risk Assessment in Plant-Specific, Risk-informed Decisionmaking: General Guidance"; draft RG DG-1065,"An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications"; and draft SRP Chapter 16.1," Risk-Informed Decisionmaking: Technical Specifications." These documents were transmitted to the Commission in SECY-97-077, dated April 8,1997. In addition, since the CEOG submitted the Joint Application Reports in August 1995, the staff has met with the CEOG on numerous occasions to discuss the j

staff's review of the Joint Application Reports and the development of the regulatory i

guidance documents. The staff believes that the evaluations described in the CEOG Joint

. Application Reports and the ANO-2 amendment requests are generally consistent with the guidance outlined in draft RGs DG-1061 and DG 1065 and that the staff's review of these submittals is generally consistent with draft SRP Chapters 16.1 and 19.

After completing its evaluation of the ANO-2 proposed changes, the staff has determined that they are acceptable. This determination is based on the following:

1.

The need to maintain reliable safety systems.

2.

Consideration of the design basis requirements for the SITS and the LPSI system.

3.

Insights gained from the quantitative evaluation of the risk associated with having one SIT or one LPSI system out of service.

4.

A three-tiered implementation strategy that ensures that the risk incurred when a SIT or LPSI system is taken out of service is minimized.

5.

Performance monitoring through the maintenance rule (10 CFR 50.65) to provide feedback as to the effectiveness of the AOT extensions.

Each of these elements is described in detail in the attached safety evaluation. In approving the proposed TS changes, the staff is relying on a commitment made by the licensee, as described in the attached safety evaluation, specifically, with respect to utsiization of a risk-informed configuration control technique to assess the risk associated with removal of equipment from service during the proposed AOT. Because this is a new commitment specific to risk-informed TS changes, the staff will ensure that the commitment is incorporated into the ANO-2 operating license. This may be done by incorporating the commitment as a license condition or in the administrative controls section of the TS.

On the basis of this information, the staff finds that, for ANO-2, the AOT for one inoperable SlT may be extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and that the AOT for one inoperable LPSI system may be extended to 7 days, with a negligible impact on risk. The staff intends to perform limited reviews of the plant specific aspects of similar amendment requests from the remaining CE plants and to grant those amendments when the results of the staff's evaluation are comparable to those for ANO-2.

COORDINATION:

The Office of the General Counsel has no legal objection to this paper.

RFCOMMFNDATION:

That the Commission:

Note that it is my intention to approve the issuance of an amendment to the ANO-2 TS as described in the attached safety evaluation. This license amendment will be issued to Entergy Operations, Inc., no sooner than 10 working days from the date of this paper unless the staff is instructed otherwise by the Commission.

-...... ~. _

- _ _ _.. -. - - _ _ - - -.. -. -. -... - _.. ~. - -. - - -. -.... - -

+

1 t Note that it is my intention to approve the issuance of similar amendments for the remaining CE plants when the results of the staff's evaluation are comparable to those for ANO-2.

i-I allan

[

Ex utive Director for Operations i

L

Attachment:

ANO-2 Safety Evaluation l

i SECY NOTE:

In the absence of instructions to the contrary, SECY will notify the staff on' Friday, May 16, 1997 that the Commission, by negative consent, assents to the action proposed in this paper.

DISTRIBUTION:

Commissioners OGC' OCAA l

- OIG I

f OPA OCA ACRS CIO i

CFO

- EDO REGIONS SECY l

I e

f i

t i

,g.,

l I

RAFFTY FVAlllATION RY THF OFFIEF OF Nt1El FAR RFACTOR RFGill ATION RFI ATFD TO AMFNDMFNT NO-To FAEllITY OPERATING t IEFNRF NO NPF R ENTFRGY OP_EBAT'ONR INC_

ARKANRAR Ntirl FAR ONF. tJNIT NO. 7 norKFT NO ROMRA i

i l

I

1.0 INTRODUCTION

By two applications dated May 19,1995, the Entergy Operations Corporation, (the licensee) requested changes to the Technical Specifications (TS) (Appendix A to Facility Operating j

License No. NPF-6) for Arkansas Nuclear One, Unit 2 (ANO 2). The proposed changes i

would allow extension of the allowed outage time (AOT) for one inoperable safety injection-

. tank (SIT) from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if the SIT is inoperable for reasons other than boron j

concentration outside of limits or the inability to verify level or pressure. A second '

)

proposed change would allow extension of the AOT for one inoperable low pressure safety

)

A injection (LPSI) system from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days. The purpose of these proposed changes is i to obtain greater flexibility in the scheduling and implementation of maintenance on the l

subject equipment.

i Additionalir. formation was submitted by the licensee on February 27 and September 30, 1996, and by the Combustion Engineering Owners Group (CEOG) on June 14,1996. These letters provided clarifying information and did not change the initial no significant hazards

)

cons'ideration determination.-

2.0 RACKGROllND Since the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22,1993, the NRC stated that it...

... expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA [probabilistic safety assessment]' or risk survey and any available literature on risk insights and PSAs... Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program of improvir.g Technical Specifications, it i

will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements.

'PSA and PRA are used interchangeably herein.

)

1

. i e

.aer.

The NRC reiterated this point when it issued the revision to 10 CFR 50.36, " Technical Specifications,"in July 1995, in August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decisionmaking and regulatory efficiency. The PRA policy statement included the following points:

1.

The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

2.

PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatism associated with current regulatory requirements.

3.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review, in August 1995, the CEOG submitted several Joint Application Reports for the staff's review. Two of the CEOG Joint Application Reports provide justifications for extensions of the TS AOTs for SITS and for the LPSI system. The justifications for these extensions are based on a balance of probabilistic and traditional engineering considerations. Risk assessments for all of the Combustion Engineering (CE) plants are contained in the reports.

ANO-2 is the lead CE plant for the SIT and LPSI system TS changes.

3.0 PROPORFD CHANGFR 3.1 TS and Bases 3.5.1 - Safety injection Tank The licensee proposes extending the TS AOT for one SIT that is inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure, from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

3.2 TS 3.5.2 - ECCS Subsystems - T., 2 300*F The licensee proposes extending the TS AOT for one inoperable LPSI system from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days.

4.0 STAFF FVAlllATION The staff evaluated the licensee's proposed amendment to the TS using both traditional engineering analysis and PRA methods. The staff's traditional analysis evaluated the capabilities of the plant to mitigate design basis events with one SIT or one LPSI system inoperable. The staff then used insights derived from the use of PRA methods to determine the risk significance of the proposed changes. The results of these evaluations were used in combination by the staff to determine the safety impact of extending the AOTs for one inoperable SIT and for one inoperable LPSI system.

2

4.1 Justification for Proposed Changes The licensee provided the following information in support of the sequested AOT extensions.

4.1.a Juntificatinn inr Prnnnend Chnnnn tn RIT AOT l

industry operating experience has demonstrated that many of the causes of SIT inoperability have been diagnosed and corrected within a relatively short period, but one that is often longer than the existing 1-hour AOT. In several cases, the diagnosis of an inoperable SlT has resulted in plant shutdowns.

If a single SIT were to be diagnosed as inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure, the current action statement in TS 3.5.1 would allow 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for operators to restore the tank to operability. Such a situation could occur because the tank level or the pressure or both are outside the limits established in the Limiting Condition for Operation (LCO), or because the associated isolation valve is in other than the full-open position, if the action were not completed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the plant would have to be placed in hot standby within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and brought to less than 700 psia within the next 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The extension of the existing SIT AOT from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should provide the licensee with sufficient time in which to diagnose and possibly repair minor SIT system malfunctions at power, thereby averting an unplanned plant shutdown. Since analyses demonstrate that the increased risk of operating with a single SIT out of service is negligible, increasing the AOT can be beneficial by possibly avoiding unplanned shutdowns associated with an inoperable SIT.

Unnecessary plant shutdowns associated with the outage of non-risk-significant equipment are undesirable because mode changes have the potential to increase the risk above that of steady state operation.

4.1.b Juctifientinn inr Prnnnend Chnnga tn LPRI Rvetem AOT l

The current ANO-2 TS address the LPSI system as a portion of the emergency core cooling system (ECCS). TS 3.5.2 requires two independent ECCS subsystems to be operable. With one ECCS subsystem inoperable, on the basis of any component inoperability, the subsystem must be returned to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or a plant shutdown is required. The proposed change will allow up to 7 days for the licensee to restore operability to an inoperable LPSI system that is the cause of ECCS subsystem inoperability.

The primary role of LPSI trains during power operation is to contribute to the mitigation of a large loss-of-coolant accident (LOCA). The frequency of a large LOCA event is on the order of 104 per year. In contrast, during shutdown, the operability of at least orse LPSI train is required at all times for reactor coolant system (RCS) heat removal. Thus, in the broad view, performing preventive and corrective maintenance at power on LPSI trains can contribute to an overall enhancement of plant safety by increasing the availability of the LPSI system for shutdown cooling (SDC) during Modes 4 through 6, when it is most needed.

In some instances, corrective maintenance of the LPSI pump and valves and testing of valves may require taking one train of LPSI out of service for more tht.n several days. Thus, repair within the existing AOT cannot be ensured and may result in an unscheduled 3

1

l shutdown or a request for temporary relief to allow continued plant operation. To avoid these situations, the licensee is requesting a longer AOT. On the basis of the review of maintenance requirements of the LPSI system for CE pressurized water reactors (PWRs), the licensee determined that a 7-day AOT would provide sufficient margin to effect most anticipated preventive and corrective maintenance activities and LPSI system valve surveillance tests at power.

4.2 Traditional Engineering Evaluation 4.2.a Birrant Traditinnal Analysis The performance of all of the ECCS, including SITS and the LPSI system, is calculated in accordance with 10 CFR Part 50, Appendix K, such that the ECCS ensures that the acceptance criteria of 10 CFR 50.46 are satisfied. These criteria were established in order to define deterministic acceptance criteria that could be used to judge the acceptability of a given ECCS design. The methodology defined in Appendix K conservatively represents LOCA thermohydraulic and hydrodynamic phenomenology to calculate fuel peak clad temperature. As a result, the methodology may well overstate the minimum equipment requirements for adequate response to an event. Although the precise equipment set for j

any specific PWR may vary, best estimate analysis generally show that the design basis requirement for one LPSI train, one high pressure safety injection (HPSI) train, and all SITS to avert a core melt condition is generally thought to oe conservative for many PWR designs.

4.2.b SIT Fvaluatinn The SITS are passive pressure vessels partially filled with borated water and pressurized with a cover gas (nitrogen) to facilitate injection into the reactor vessel during the blowdown phase of a large break LOCA. This action provides inventory to assist in accomplishing the refill stage following blowdown. The SITS also provide RCS makeup for a small break LOCA.

Each SIT is piped into an associated RCS cold leg via an ECCS line also utilized by HPSI and LPSI. Each SIT is isolated from the RCS, during full pressure operations, by two series check valves. Each SIT also has a normally deenergized open motor-operated isolation valve utilized to isolate the SIT from the RCS during normal cooldown and depressurization evolutions. Additionally, each of these isolation valves is interlocked with the pressurizer pressure instrumentation channels to ensure that the valves will automatically open as RCS pressure increases above SIT pressure and to prevent inadvertent closure before an accident. Each of these valves also receives a safety injection actuation signal to open.

These features ensure that the SITS will be available for injection without reliance on operator action. The SIT gas pressure and volume, water volume, and outlet pipe size are designed to allow three of the four SITS to inject the inventory necessary to keep clad melt and zirconium-water reaction within design assumptions following a design basis LOCA.

The design assumes the loss of inventory from one SIT through the LOCA break.

LCO 3.5.1 requires that all SITS be operable whenever the plant is in Modes 1,2, or 3, with pressurizer pressure greater than or equal to 700 psia. The LCO is based on the assumption that when the piant is in any of these modes of operation, the SITS must have the same functionality that would be required for a LOCA at full rated thermal power. When the plant 4

l is in any of the applicable modes, a SIT is considered operable when the following conditions exist:

1.

The associated isolation valve is fully open.

2.

Electric power has been interrupted to the motor for the associated isolation valve.

3.

Water inventory in the tank is within the assumed band.

4.

The boric acid concentration of the water inventory of the tank is within the assumed band.

5.

The nitrogen cover pressure within the tank is within the assumed band.

In the past, a justification for the short AOT for one inoperable SIT has been that the perceived severity of the consequences of not having all SITS available to provide passive injection during a design basis LOCA warranted the severity of the requirement to return the SIT to operable status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or shut down the unit. However, the current SIT AOT was based solely on engineering judgment and did not take into consideration any quantitative assessment of risk.

The SIT operational parameters are set by the design basis licensing large break LOCA analysis. Since the SIT is a passive device and provides a limited function, operability has been restricted to mean that the equipment's initial conditions are within a band supported by 10 CFR Part 50, Appendix K, design basis analysis. Analytical models of Appendix K to 10 CFR Part 50 are devised so as to overestimate the amount of liquid lost from the break and to underestimate the residual inventory in the reactor vessel lower plenum.

Consequently, inventory discharge requirements are conservatively set at a high level.

~

Realistic analyses demonstrate that SIT inventory and pressure can deviate considerably from the TS requirements without compromising the ability of the plant to adequately respond to a LOCA. In addition, best estimate analyses generally show that all SITS are not needed to avert a core melt condition. Therefore, extending the AOT from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for one SIT that is inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure will allow a sufficient level of defense in depth to be maintained and sufficient safety margin to meet the design basis analysis during that period of time.

4.2.c i PRI Rystam Fvahmtinn The two trains of the LPSI system, in combination with the two trains of the HPSI system, form two redundant ECCS subsystems. The two LPSI pumps are high volume, low head centrifugal pumps designed to supplement the SIT inventory in reflooding the reactor vessel to ensure core cooling during the early stages of a large break LOCA. The LPSI pumps take suction from the refueling water tank (RWT), during the injection phase of a LOCA event, and pump the water through a common discharge header. Before penetrating containment, the LPSI headers combine with HPSI and SIT discharge piping, and flow is directed through independent injection headers into each of the four RCS cold legs and into the reactor vessel. The LPSI system pumps start and valves open upon receipt of a safety injection actuation signal. When the RWT levelis drawn down by inventory transfer during the 5

l 1

injection phase, a low-low RWT level actuates a recirculation actuation signal which stops the LPSI pumps. This step is necessary to ensure adequate net positive suction head remains available for the HPSI pumps and the containment spray pumps. By design, post-LOCA long term core cooling is supplied by the HPSI pumps and containment spray pumps j

taking suction from the containment sump.

Another role of the LPSI system is defining the end state for a design basis steam generator tube rupture (SGTR) event. In this design basis event, the HPSI functions to keep the core covered at all times, and the LPSI system is required to effect SDC and thereby terminate the event. SDC is initiated after the break has been isolated and the radioactive releases have been controlled.

l In the event that one LPSI train is out of service and the second LPSI train fails, the operator can continue to control the event by steaming of the unaffected steam generator. Even though loss of both LPSI trains is beyond the design basis accident assumptions, this cooling mechanism can be maintained indefinitely, provided condensate is available to the unaffected steam generator. Without considering condensate storage tank refill, ANO-2 has sufficient inventory to steam the affected steam generator for 5% to more than 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

ANO-2 procedures provide for continued makeup to the condensate storage tank (CST) to i

prevent the depletion of the CST inventory and the ability to cross-connect condensate tanks from Unit 1. ANO-2 also has the ability to realign the containment spray pumps to provide RCS SDC capability. Therefore, having one LPSI system out of service should not affect the licensee's ability to mitigate a SGTR event.

In addition to responding to accidents, the most common use of the LPSI system is during normal shutdown operations (Modes 4, 5, and 6), when the LPSI system is used in conjunction with a portion of the containment spray system for decay heat removalin the SDC alignment.

As previously mentioned, recent best estimate analyses for a typical PWR confirmed that for large break LOCAs, the design basis requirement for one LPSI train, one HPSI train, and all SITS to avert a core melt condition is considered conservative for many PWRs. In particular, the results of these analyses demonstrated that the design basis ECCS criteria could be met with one LPSI system out of service, in addition, the fact that the LPSI system is required for decay heat removal every time the plant is placed in cold shutdown indicates that it would be prudent to perform maintenance on the LPSI system during power operations rather than during shutdown when the demand for the system is at its highest.

Therefore, extending the AOT for one inoperable LPSI system from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to 7 days should continue to ensure defense in depth is maintained and sufficient safety margin exists to meet the design basis analysis for the ANO-2 ECCS.

4.3 Evnhintinn nf thn PRA Unnd tn Sonnnrt thn Prnnnend TS Changes The staff used a three-tiered approach to evaluate the risk associated with the proposed TS changes. The first tier evaluated the PRA model and the impact of the AOT extensions for the LPSI system and SITS on plant operational risk. The second tier addressed the need to preclude potentially high risk configurations, should additional equipment outages occur during the time when one SIT or one LPSI system is out of service. The third tier evaluated the licensee's configuration risk management program to ensure that equipment removed 6

l.

from service immediately before entering into or during the proposed AOT will be appropriately assessed from a risk perspective. Each tier and the associated findings are discussed below.

l 4.3.a Tinr 1r PRA Fvnfantinn nf ant Fvtanninnn The licensee utilized traditional PRA techniques to evaluate the requested AOT extensions for the SITS and the LPSI system. The Tier 1 staff review of the licensee's probabilistic assessment involved two aspects: (1) evaluation of the PRA model and application to the proposed AOT extensions and (2) evaluation of PRA results and insights that stemmed from the application.

Evninntinn nf thn PRA Mndal nnd Annfir ntinn in thn AOT Fvtannions The staff's review focused on the ability of the licensee's PRA model to analyze the risk stemming from the modified TS AOTs for Sits and the LPSI system. The licensee indicated that both internal and external peer reviews of its PRA were performed as an integral part of its individual plant examination (IPE) performed in response to Generic Letter 88-20,

" Individual Plant Examination for Severe Accident Vulnerabilities." In addition, the NRC staff and associated contractors performed a focused review of the licensee's PRA, specifically with respect to the risk contribution associated with the proposed TS changes.2 All of the LPSI and SITS cutsets associated with the TS changes were reviewed to verify the accuracy and completeness of the ANO-2 analysis. Both sensitivity and uncertainty analyses were utilized to glean additionalinsights., The increased review effort stemmed i

from the need to fully understand the PRA limitations and ramifications associated with the first pilot plant (ANO-2) in a series of similar CE TS change applications.

j i

in addition to the NRC detailed review of the PRA cutsets associated with the TS change, 1

ANO-2 participated in a CEOG joint comparison process consisting of comparison of plant design features; PRA inputs such as models, data, and assumptions; and PRA results. The intent of the joint comparison process was to define the variability in PRA predictions for the CE plants as a group and to establish the basis and significance of these variations.

1 Results of this CEOG comprehensive review process indicated that there were no outlier j

features associated with the design and operation of ANO-2, and that ANO-2 itself fell on i

the low risk side of the spectrum in relation to other CE plants. The staff reviewed portions i

of CEOG joint comparisons and concluded that the process was thorough, and that the comprehensive review supported the TS changes. In addition, the total updated ANO-2 Core Damage Frequency (CDF) without the TS amendment as reported in the CE Owners Group Joint Application Reports (3.28E-5/yr)is found to be consistent with the earlier licensee's IPE estimate of 3.4E-5/yr. The baseline change due to the TS changes is less than 1 % i.e., from 3.28E-5/yr to 3.29E-5/yr, which demonstrates that plant is robust with respect to the TS changes and minimizes the need to assess the baseline model in extreme detail.

l

'SCIENTECH, Inc., " Technical Evaluation of Arkansas Nuclear One, Unit 2, Analysis for Safety injection Tanks and Low Pressure Safety injection System Allowed Outage Tims (AOT) Extension," December 1996.

7

I l

1 Both the SITS and the LPSI system were desig'ned to mitigate large break LOCAs, should such an accident occur during full power operation. The function of the SITS is to flood the reactor core with borated water following a large primary system break and subsequent primary depressurization, and the function of the LPSI system is to maintain RCS inventory following SIT injection. In addition, the LPSI system is used for long-term inventory control and core cooling, specifically following SGTR events.

The PRA models SITS and the LPSI system in the following way:

1 1.

Two of four SITS are required for large LOCA mitigation.

l 2.

One of two LPSI trains in the injection mcde is required for large LOCA mitigation.

3.

No credit is taken for active components of the LPSI system to mitigate small and medium LOCAs. Depressurization of the RCS to a LPSI condition in order to use the LPSI system in the injection mode for the mitigation of small and medium LOCAs is not credited in the ANO-2 PRA. Long-term inventory control and heat removal are j

accomplished using containment spray in conjunction with SDC heat exchangers, 4.

.The LPSI system in the SDC mode is credited for the mitigation of spontaneous SGTR.

The probabilistic assessment used to support the proposed ANO-2 AOT extensions included i

a Level 1 and Level 2 PRA, and consideration of external events. The PRA utilized the small event tree /large fault tree methodplogy with fault tree linking. The staff finds the methodology acceptable and consistent with conventional PRA methods and practices.

j Data were incorporated into the PRA through a Bayesian updating process that utilized a j

Science Applications International Corporation generic database. The PRA had been quantified using the Cutset and Fault Tree Analysis (CAFTA) software. Both the data and the quantification process were found acceptable. In addition, the staff's review identified the following findings with respect to the licensee's PRA modeling:

1.

Event trees appropriately represented the plant's response'to all relevant classes of initiating events.

2.

Realistic system success criteria based on analysis and supported by engineering judgement were used.

3.

Fault trees and associated cutsets reflected modeling completeness.

4.

Common cause failures were appropriately incorporated into the fault tree logic and quantified using the beta factor method.

5.

Operator actions were appropriately modeled.

6.

Modeling assumptions were reasonable and consistent with traditional PRA practice.

7.

Quantification included both generic and plant specific sources.

8

8.

The PRA truncation level had no impact on the PRA findings.

9.

Both uncertainty and sensitivity studies were performed to assess the robustness of the PRA results.

10.

ANO-2 personnel participated in the evolution of the PRA to ensure that the model reflected the as-built, as-operated pt:.at.

On the basis of these findings, the staff concludes that the licensee's PRA can be used as a tool to evaluate the impact of the proposed SIT and the LPSI system AOT extensions on plant risk. As discussed below, the staff utilized the licensee's IPE Level 2 analysis to j

assess the impact of the AOT extensions on the large early release probability.

Evaluntinn nf PRA Romits and incinhtm The ANO-2 internal event PRA generated a point estimate core damage frequency (CDF) of 3.3E-5 per reactor year. The contrib::tions of large LOCAs and SGTRs to the total CDF were found to be 4 percent and 0.15 percent respectively. The licensee evaluated changes to the CDF and the associated increment al conditional core damage probability (ICCDP)3 for each proposed AOT extension. Typical values of ICCDP were estimated to be 2.3E-08 for SIT corrective maintenance,8.1E-08 for LPSI preventive maintenance, and 2.9E-07 for LPSI corrective maintenance, values considered low by the staff and within the normal operating risk fluctuations of the plant. The AOT extensions had essentially no impact on the risk associated with external events.

With respect to Level 2 issues, the conditional probability of large early release given a large break LOCA is very small, that is, much less than 10 percent of the conditional CDF. Low pressure vessel failure scenarios stem from large break LOCA events, and these would yield only moderate containment pressure loading. In addition, the AOT extensions do not affect the availability of containment sprays and fan coolers, nor containment isolation, which could compromise containment performance. Likewise, the smalllikelihood of an SGTR during the AOT of approximately E-4, and the availability of the primary means of accident mitigation (LPSI required only for long-term cooling), would also result in only a negligible

(< 5.0E-8) incremental conditional early large release probability.

The staff also evaluated at cutset level the sensitivity with respect to core damage of SIT and LPSI success criteria and operator actions. For the SITS, whether the success criteria were taken to be (2/4) or (3/4) (the inventory of 1 of the 4 SITS is assumed to be lost through the break), the corresponding single AOT risks (ICCDPs) remained very small. The LPSIinjection path success criteria also has little effect on AOT-associated risk.

Automatic system response to LOCAs and recirculation minimized the introduction of, and the need to model, operator actions. Sensitivity studies were used to investigate the impact of operator action on LPSI-generated AOT risk associated with SGTR. The studies were performed by increasing the probability of failure to isolate the affected steam generator.

8lCCDP = [(conditional CDF with the subject equipment out of service)-(baseline CDF with nominal expected equipment unavailabilities)] X (single AOT duration under consideration).

9

1 When isolation of a ruptured steam generator is not successful, the RCS must be depressurized to SDC entry conditions in order to terminate the leak. As screening values were increased, the SGTR-initiated cutset contribution to the LPSI-generated AOT risk increased. However, even in the limit of postulating an operator error probability of 0.1, SGTR scenarios became equivalent to that of a large break LOCA, which itself has only a very small contribution to the total CDF.

The CEOG performed an analysis of the statistical parameters of the CDF probability density function to understand the impact of the AOT on CDF. The analysis modified the unavailability of the LPSI system from its base value (mean duration and error factor) to a l

value representative of the extended AOT and associated maintenance planning procedures.

Current values for the maintenance unavailability error factors for the LPSI components were based on plant-specific data. Error factors for the extended AOT included integrated plant experience and future plant maintenance expectations. The distribution parameters were calculated using a Latin Hypercube Sampling (LHS) procedure coupled with the Top Event Matrix Analysis Code (TEMAC), based on 2000 samples.

LHS/TEMAC calculations showed less than a 2 percent increase in the statistical parameters of the CDF probability density function as a result of the extended AOT. This is true for the point estimate, median, and mean values of the CDF distribution, as well as for the variance, skewness, and kurtosis of the distribution. This result is significant in that it confirms that j

the extended AOT has essentially little impact on the shape of the CDF probability density function.

On the basis of the Tier 1 assessment, the staff finds the application of the licensee's PRA to the AOT extensions acceptable, and the PRA findings and insights supportive of the proposed SIT and LPSI system AOT extensions.

4.3.b Tier % Avnirinne a nf Rink Sinnifir nnt Pinnt Ennfinuratinns The licensee provided reasonable assurance that risk-significant plant equipment outage configurations will not occur while the plant has a LPSI system or a SIT out of service. The licensee developed a risk matrix derived from the ANO-2 PRA to evaluate plant risk associated with various maintenance activities (see Section 4.3.c). The matrix reflects the time in days that equipment can be removed from service when another piece of equipment (or train) is unavailable and identifies high risk and unacceptable risk configurations for which additional actions are outlined in the associated plant procedures. Under Tier 2, the staff would expect the licensee to incorporate additional restrictions in the TS or plant procedures for any configurations fal!!ng into the unacceptable risk category. The association of the LPSI system and SITS with a large break LOCA, and to a lesser extent an SGTR, limits the impact of LPSI and SlT equipment unavailability on the ability of other plant equipment to mitigate accidents. This fact is reflected in the licensee's matrix in that no combinations involving a LPSI train or a SIT are identified as resulting in unacceptable risk.

This was confirmed by the staff under the Tier 1 review which did not identify the need for any additional constraints or cornpensatory actions that, if implemented, would avoid or reduce the probability of a risk-significant configuration.

10

.- -. ~

- = --

i e

4.3.c Tiar 'h Rick Ininrmed Plant r'nnfinnrntinn Onntrnl/ Management Licensees are expected to assess the overallimpact of performing maintenance activities on safety functions before the removal of equipment from service. The need for such an assessment, specifically with respect to entry into an extended AOT, stems from the difficulty in identifying all possible risk-significant configurations under Tier 2. In general, entry into an extended AOT increases the probability that other maintenance activities will overlap with the AOT and result in potential risk-significant plant configurations. Licensees, therefore, need to demonstrate that they have the ability to evaluate the risk impact of out-of-service equipment before and while performing maintenance activity associated with i

equipment being taken or found out of service.

J r

To address this concern, the licensee will utilize the PRA-generated risk matrix to evaluate plant risk configurations. As submitted and reviewed by the staff, the risk matrix identifies minimal, moderate, high, and unacceptable risk configurations. For equipment that could potentially affect multiple mitigation systems (e.g., support systems), or potentially increase an initiating event frequency, the matrix would need to be supplemented with additional A

PRA insights in order to provide useful configuration management information. Notes included in the matrix direct operators to the PRA staff for such situations where additional analysis is necessary. Examples of such situations include outages of the containment spray, containment cooling, or containment isolation systems and plant configurations that would affect more than one position in the matrix (i.e., involve combinations beyond those analyzed in the matrix).

To the extent that only LPSI system and SIT AOT extensions have been proposed, the staff finds the use of a risk matrix sufficient to support risk-informed configuration control. This finding has been based on the following:

1.

The LPSI system and SITS are primarily associated with larGe break LOCA, and to a lesser extent, SGTR initiating events. Extending the LPSI system and SIT AOTs does not increase the likelihood of these or any other initiating events.

2.

Removal of one LPSI system or one SIT from service is self-limiting, does not affect the success criteria of other systems, and does not introduce synergistic risk J

increases as a result of joint outages with other system trains.

j On the basis of these findings, the staff believes that PRA insights beyond those already contained in the risk matrix willlikely not be necessary to make decisions that involve the LPSI system and SIT unavailability, and, in the unlikely event that they are needed, the licensee has procedures in place to obtain the necessary additional analyses. The staff, therefore, finds the licensee's risk matrix acceptable for meeting Tier 3.

f'nnr lucinne Renardinn thn f ir anenn'n Prnhnhilictir Rnfaty Analynic timod tn Runnnrt the Prnnnend Amendment On the basis of the three-tiered approach, the staff determined the following:

1.

The proposed TS AOT modifications have only a minimal quantitative impact on plant risk. The calculated ICCDPs are very small, primarily because of the association of 11

4 SITS and LPSI with low-probability initiating events and limited impact on the success criteria of other mitigation systems (Tier 1).

2.

The review did not identify the need for any additional constraints or compensatory actions that, if implemented, would avoid or reduce the probability of a risk.

significant configuration (Tier 2).

3.

The licensee has implemented a risk informed plant configuration control program to assess the risk associated with the removal of equipment from service during the extended AOTs. The program provides the necessary assurances that appropriate assessments of plant risk configurations using the risk matrix, augmented by additional analysis, when appropriate, are sufficient to support the present AOT extension requests for the SITS and the LPSI system (Tier 3).

4.4 Imntamantatinn_ and Mnnitnring The staff expects the licensee to implement these TS changes in accordance with the three-tiered approa'ch described above. In addition, the licensee has stated through endorsement of the CEOG Joint Application Reports that the maintenance rule (10 CFR 50.65) will be the vehicle that controls the actual e.quipment maintenance cycle by defining unavailability performance criteria for the SITS and the LPSI system. The AOT extensions will allow efficient scheduling of maintenance within the boundaries established by implementing the maintenance rule. The effect of the AOT extensions should be considered if any adverse trends in meeting established performance criteria are identified for the SITS and the LPSI system. The maintenance rule will thereby be the vehicle that monitors the effectiveness of the AOT extensions. Application of these implementation and monitoring strategies will help to ensure that the uncertainties in the analyses performed in support of the TS changes are accounted for and that the risk incurred when a SIT or a LPSI system is taken out of service is minimized.

5.0 KilMMARY The staff has evaluated the licensee's proposed changes for compliance with regulatory requirements as documented in this evaluation and has determined that they are acceptable.

This determination is based on the following:

1.

The need to maintain reliable safety systems.

2.

Consideration of the design basis requirements for the SITS and the LPSI system.

3.

Insights gained from the quantitative evaluation of the risk associated with having one SIT or one LPSI system out of service.

4.

A three-tiered implementation strategy that ensures that the risk incurred when a SIT or LPSI system is taken out of service is minimized.

5.

Performance monitoring through the maintenance rule to provide feedback as to the effectiveness of the AOT extensions.

12

4 f

- The staff therefore finds that the AOT for one SIT tisat is inoperable for reasons other than boron concentration not within limits or inability to verify level or pressure may be extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and that the AOT for one inoperable LPSI system may be extended to 7 days, with a negligible impact on risk.

l l

l i

l l

l i

l i

I s

s 4

l I

i l

13 l

r t

i

-r--

s

-r, y-y

-