ML20154M488

Safety Evaluation Supporting Amend 186 to License DPR-40

ML20154M488
Person / Time
Site:	Fort Calhoun
Issue date:	10/19/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20154M476	List: ML20154M472 ML20154M484 ML20154M488
References
NUDOCS 9810200309
Download: ML20154M488 (9)

Text

._ . _ _.

gs> ' tio O & UNITED STATES j 2 j NUCLEAR REGULATORY COMMISSION WASHINGTON D.C. 2066Hm01

...../

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION BELATED TO AMENDMENT NO.186 TO FACILITY OPERATING LICENSE NO. DPR-40 ,

OMAHA PUBLIC POWER DISTRICT FORT CALHOUN STATION. UNIT NO.1 DOCKET NO. 50-285

1.0 INTRODUCTION

By application dated July 11,1995, for the safety injection tanks (SITS), with additional information submitted by the licensee through the Combustion Engineering Owners Group ,

(CEOG), on June 14,1996, Omaha Public Power District (OPPD) requested changes to the Technical Specifications (Appendix A to Facility Operating License No. DPR-40 for the Fort Calhoun Station, Unit No.1 (FCS).

4 The proposed changes would modify the technical specifications (TSs) to extend the allowed outage times (AOTs) for a single inoperablo SIT from one hour to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and to add an AOT for a single SIT inoperable specifically due to boron concentration not within limits for period of no more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. ,

2.0 BACKGROUND

S' ince the mid-1980s, the NRC has been reviewing and granting improvements to TS that are based, at least in part, on probabilistic risk assessment (PRA) insights. In its final policy statement on TS improvements of July 22,1993 , the NRC stated that it:

" expects that licensees, in preparing their Technical Specification related submittals, will utilize any plant-specific PSA [probabilistic safety assessment]' or risk survey and any available literature on risk insights and PSAs . . . Similarly, the NRC staff will also employ risk insights and PSAs in evaluating Technical Specifications related submittals. Further, as a part of the Commission's ongoing program ofimproving Technical Specifications, it will continue to consider methods to make better use of risk and reliability information for defining future generic Technical Specification requirements."

9810200309 99810125 PDR ADOCK 05 P

'PSA and PRA are used interchangeably herein.

. i The NRC reiterated this point when it issued the revision to 10 CFR 50.36, " Technical Specifications,"in July 1995 (60 FR 36953). In August 1995, the NRC adopted a final policy statement on the use of PRA methods in nuclear regulatory activities that encouraged greater use of PRA to improve safety decisionmaking and regulatory efficiency (60 FR 42622). The PRA policy statement included the following points: I

1. The use of PRA technology should be increased in all regulatory matters to the extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy.

2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the j bounds of the state of the art, to reduce unnecessary conservatism associated with l

current regulatory requirements.

3. PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

In August 1995, the CEOG submitted several Joint Application Reports for the staff's review. l Two of the CEOG Joint Application Reports provided justifications for extensions of the TS l AOTs for SITS and for the low pressure safety injection (LPSI) system.2 The justifications for j these extensions are based on a balance of probabilistic considerations, traditional engineering considerations, including defense-in-depth, and operating experience. Risk assessments for all of the Combustion Engineering (CE) plants are contained in the reports. The staff first reviewed l

the Joint Application Reports and then reviewed the licensas's plant-specific amendment j request which incorporated the Joint Application Reports by reference.

' Arkansas Nuclear One, Unit 2 (ANO-2) had been the lead CE plant for the SlT and LPSI i system TS changes, The staff performed an in-depth review of the ANO-2 PRA methodology I relating to there changes, as the lead plant for all of the CEOG. Therefore, a portion of the review of the FCS amendment request was based on a comparison of the FCSPRA results with those from ANO-2. j In addition, one of the proposed changes would revise TS 2.3," Emergency Core Cooling System" to incorporate recommendations and suggestions from Generic Letter (GL) 93-05, l "Line-Item Technical Specifications improvements to Reduce Surveillance Requirements for Testing During Power Operations."

l 2

CE NPSD-994," Joint Application Report for Safety injection Tank AOT/STl Extension,* May 1995, and CE NPSD-995," Joint Application Report for Low Pressure Safety injection System AOT Extension? May 1995.

3-

3.0 PROPOSED CHANGE

S

.TS 2.3(2) - Emergency Core Cooling System (ECCS)

The licensee proposes extending the TS completion time for one SIT that is inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The licensee also proposes extending the TS completion time for one SlT that is inoperable, specifically due to boron concentration from 1 to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

)

4.0 EVALUATION The staff evaluated the licensee's proposed amendment to the TS using a combination of traditional engineering analysis, PRA methods, and a review of operating experience. The staff's traditional analysis evaluated the capabilities of the plant to mitigate design basis events with one SIT inoperable. The staff then used insights derived from the use of PRA methods to determine the risk significance of the proposed changes. The results of these evaluations were used in combination by the staff to determine the safety impact of extending the AOTs for one )

inoperable SIT.

4.1 Justification for Proposed Changes l 4.1.1 3lT Comoletion Time from 1 to 24 Hours when SIT is inocerable for Other Reasons Industry operating experience has demonstrated that many of the causes of SIT inoperability have been diagnosed and corrected within a relatively short period, but one that is often longer than the existing 1-hour completion time. In several cases, the diagnosis of an inoperable SIT l has resulted in plant shutdowns. i 1f a single SIT were to be diagnosed as inoperable for reasons other than boron concentration being outside of limits (which is already addressed under a separate Action with a 72-hour l completion time), TS 2.3(2)f, would allow 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> for operators to restore the SIT to operability.

Lif the action were not completed within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the plant would have to be placed in Mode 3 ,

within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and brought to Mode 4 within the 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The extension of the existing SIT completion time from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should provide the licensee with sufficient time in which to  ;

diagnose and possibly repair minor SIT system malfunctions at power, thereby averting an unplanned plant shutdown. Since risk analyses demonstrate that the increased risk of operating with a single SlT out of service is negligible, increasing the completion time can be beneficial by possibly avoiding unplanned shutdowns associated with an inoperable SIT.

Unnecessary plant shutdowns associated with the outage of non-risk-significant equipment are undes!rable because mode caanges have the potential to increase the risk above that of steady state operation.  ;

- - - - - , , ,m--- - -, +

. l l

l l

4.1.2 SIT Comoletion Time uo 72 Hours when SIT is inocerable Due to Boron Concentration An extension of the AOT from 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to restore boron concentration to within limits is consistent with NUREG-1432, " Standard Technical Specifications, Combustion Engineering Plants," Revision 1. The basis for this AOT includes recognition that, although ability to maintain suberiticality or minimum boron precipitation time may be reduced in this condition, the reduced concentration effects on core suberiticality during reflood are minor. In addition, the volume of the SIT is still available for injection. Since the boron requirements are based on the -

average boron concentration of the total volume of three SITS, the consequences are less severe than they would be if a SIT were not available for injection. Therefore,72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is a reasonable AOT for returning the boron concentration to within limits.

4.2 Traditional Engineering Evaluation 4.2.1 Current Traditional Analysis The performance of all of the ECCS, including SITS, is calculated in accordance with 10 CFR Part 50, Appendix K, such that the ECCS ensures that the acceptance criteria of 10 CFR 50.46 are satisfied. These criteria were established in order to define deterministic acceptance criteria that could be used to judge the acceptability of a given ECCS design. The methodology defined in Appendix K conservatively represents large break loss of coolant accident (LOCA) thermohydraulic and hydrodynamic phenomenology to calculate fuel peak clad temperature.

As a result, the methodology may well overstate the minimum equipment requirements for adequate response to an event.

4.2.2 SlT Evaluation eThe SITS are passive pressure vessels partially filled with borated water and pressurized with a cover gas (nitrogen) to facilitate injection into the reactor vessel during the blowdown phase of a large break LOCA. This action provides inventory to assist in accomplishing the refill stage following blowdown. The SITS also provide reactor coolant system (RCS) makeup for a small break LOCA.

Each SIT is piped into an associated RCS cold leg via an ECCS line also utilized by high pressure safety injection (HPSI) and LPSI. Each SlT is isolated from the RCS during full pressure operations by two series check valves. Each SIT also has a normally deenergized open motor-operated isolation valve utilized to isolate the SIT from the RCS during normal cooldown and depressurization evolutions. Each of these valves receive a safety injection actuation signal to open. The SIT gas pressure and volume, water volume, and outlet pipe size are designed to allow three of the four SITS to inject the inventory necessary to keep cladding temperature melt and zirconium-water reaction within design assumptions following a design basis LOCA. The design assumes the loss of inventory from one SIT through the LOCA break.

- . . . .- . . - - . - - . ~ _ _ . - . - . - - - - - - - - . - .

[

LCO 2.3(2) requires that all SITS he operable whenever the plant is in critical condition (Modes 1, or 2).1 The LCO is based on the assumption that when the plant is in any of these modes of

. operation, the SITS must have the same functionality that would be required for a LOCA at full  ;

rated thermal power. When the plant is in any of the applicable modes, a SIT is considered

. operable when the following conditions exist: i e

' The associated isolation valve is fully open.

1 Electric power has been interrupted to the motor for the associated isolation valve.

• - - Water inventory in the tank is within the assumed band.

.. The boric acid concentration of the water inventory of the tank is within the assumed i band.- i

• The nitrogen cover pressure within the tank is within the assumed band.

' In the past, a justification for the short completion time for one inoperable SIT has been that the perceived severity of the consequences of not having all SITS available to provide passive t injection during a design basis LOCA warranted the severity of the requirement to retum the SIT to operable status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> or shut down the unit. However, the current SIT completion time was based solely on engineering judgment and did not take into consideration a quantitative assessment of risk.

The SIT operational parameters are set by the design basis licensing large break LOCA analysis. Since the SIT is a passive device and provides a limited function, operability has been .

restricted to mean that the equipment's initial conditions are within a band supported by 10 CFR Part 50, Appendix K, design basis analysis. Analytical models of Appendix K to 10 CFR Part 50 ere devised so as to overestimate the amount of liquid lost from the break and to underestimate the residual inventory in the reactor vessel lower plenum. Consequently, inventory discharge requirements are conservatively set at'a high level. Extending the completion time from 1 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for one SIT that is inoperable for reasons other than boron concentration being outside of limits or the inability to verify level or pressure will allow time for the licensee to correct minor problems with a SIT. Considering the short time frame that a SIT is allowed to be out of service, the low likelihood of a large break LOCA during this short time frame, and the potential risk associated with plant shutdowns, extending the SIT completion time will allow defense in depth to be maintained while not signi5cantly affecting overall safety margins assumed in the design basis analysis.

The current FCS TS do not differentiate between a SIT that is inoperable due to tank inventory or nitrogen gas pressure discrepancies and a SIT whose inventory or gas pressure cannot be verified due solely to malfunctioning water level instrumentation or pressure instrumentation.

Because these instruments provide no safety actuation, it is reasonable to extend the completion time to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> under these conditions since the SIT is available to perform its safety function during this time. This change is consistent with the staff's recommendations in GL 93-05.

4.3 Evaluation of the PRA Used to Suonort the Proposed TS Changes The staff used a three-tiered approach to evaluate the risk associated with the proposed TS changes. The first tier evaluated the PRA model and the impact of the completion time extensions for the SITS on plant operational risk. The second tier addressed the need to preclude potentially high risk configurations, should additional equipment outages occur during the time when one SIT is out of service. Because the SIT sequence modeling is relatively independent of that for other systems, the staff concludes that application of Tier 3 to the proposed SIT AOT is not necessary. Each tier and the associated findings are discussed below.

4.3.1 Cross Comoarison Acoroach After completing a detailed evaluation for the tentative approval of SIT and LPSI TS AOT extensions for Arkansas Nuclear One, Unit 2 (ANO-2), the original CEOG lead plant for the risk-informed TS pilot project, the staff used a cross comparison approach to consider the viability of similar AOT relaxations for other participating CEOG plants, including Fort Calhoun. The pilot technical evaluation report8used in support of the staff's draft safety evaluation for ANO-24 focused on:

the process adopted by the CEOG to assess single AOT risk, the identification of ANO-2 accident sequences in which credit was taken for SITS and LPSI, Independent verification of the single AOT risk (essentially equivalent to incremental l conditional core damage probability (ICCDP)8], and

.. determination of the significance of single AOT risk relative to an acceptance guideline value.

The objective of this cross comparison evaluation is to use insights derived from the ANO-2 technical evaluation to examine the validity of the conclusions drawn in the joint submittals.

Because a common methodology was employed by the CEOG to quantify AOT risk and because CE plants generally have similar design characteristics, the staff concludes that the findings of the lead pilot plant evaluation will be generally applicable to other CE plants. The staff confirmed that differences in the underlying PRA models are chiefly attributed to:

i 8

SCIE-NRC-318-97," Technical Evaluation of Combustion Engineering Owners Group (CEOG) Jolrit Application for Safety injection Tanks and Low Pressure Safety injection System Allowed Outage Time (AOT)

Extension," July 21,1997.

'SECY-97 095 "Probabilistic Risk Assessment implementation Plan Pilot Application for Risk-Informed Technical Specifications," April 30,1997.

8 1CCDP = [(conditional CDF with the subject equipment out of service)-(baseline CDF with nominal expected equipment unavailabilities)) X (duration of single AOT under consideration).

. minor design differences,

. - operational differences, e success criteria assumptions, and common cause failure S-factor assumptions.

The cross comparison draws on information contained in the CEOG Joint Application Reports, the licensees' responses to the staff's requests for additionalinformation, the licensees' individual plant examinations (IPEs) performed in response to Generic Letter 88-20, ." Individual Plant Examination for Severe Accident Vulnerabilities," and the corresponding IPE evaluations performed by the staff. ,

4.3.2 Imoact of SITS on Tier 1. 2. and 3 Reauirements (Risk Measures)

The following factors are chiefly responsible for the differences in SIT AOT risks among the CE

• plants:

+ modeling for success criteria for SITS, Initiating event (IE) frequency assumed for the initiators challenging the SITS, and credit for SITS in mitigating medium LOCAs.

The SIT single AOT risk (or essentially equivalently, ICCDP) for Fort Calhoun is 2.74E-08 and is below the acceptance guideline value of 5.0E-07 published in DG-1065, "An Approach for Plant-Specific Risk-Informed Decisionmaking: Technical Specifications,"(62 FR 34321, June 25, 1997). In addition, the change in the Fort Calhoun updated baseline core damage frequency (CDF) (as reported in the CEOG Joint Application Report) due to the SIT AOT change is very small, i.e., from 1.18E-05 per year to 1.18E-05 per year, or essentially no increase. The change in CDF of 0.0 is within the acceptance guidelines published in DG-1061,"An Approach for Using Probabilistic Risk Assessment in Risk-informed Decisions on Plant-Specific Changes to the Current Licensing Basis" (62 FR 34321, June 25,1997).

In the context of integrated decisionmaking, the acceptance guidelines should not be interpreted as being overly prescriptive. They are intended to provide an indication, in numerical terms, of what is considered acceptable. As such, the numerical acceptance guideline is an approximate value that provides an indication of the changes that are generally acceptable. Furthermore, the state of knowledge, or epistemic, uncertainties associated with PRA calculations preclude a definitive decision with respect to the acceptance of the proposed change based purely on the numerical results. The intent in making the comparison of the PRA results with the acceptance guidelines is to demonstrate with reasonable assurance that the increase in risk is small and consistent with the intent of the Commission's Safety Goal Policy Statement. The staff therefore, concludes that the proposed change to the FCS SIT TS meets this principle.

The Tier 2 evaluation did not identify the need for any additional constraints or compensatory actions that, if implemented, would avoid or reduce the probability of a risk-significant configuration. Because the SIT sequence modeling is relatively independent of that for other j

systems, the staff concludes that application of Tier 3 to the proposed SIT AOT is not l necessary.

4.4 lmolementation and Monitorina The licensee has stated through endorsement of the CEOG Joint Application Reports that the maintenance rule (10 CFR 50.65) will be the vehicle that controls the actual equipment maintenance cycle by defining unavailability performance criteria for the SITS. The AOT extensions will allow efficient scheduling of maintenance within the boundaries established by implementing the maintenance rule. The effect of the AOT extensions should be considered if any adverse trends in meeting established performance criteria are identified for the SITS. The ,

maintenance rule will thereby be the vehicle that monitors the effectiveness of the AOT extensions. Application of these implementation and monitoring strategies will help to ensure that extension of TS AOTs for SITS does not degrade operational safety over time and that the risk incurred when a SIT is taken out of service is minimized.

5.0 Summarv The staff has evaluated the licensee's proposed changes to TS 2.3(2)f and (h) for compliance with regulatory requirements as documented in this evaluation and has determined that they are acceptable. This determination is based on the following:

1. The need to maintain reliable safety systems.

l

2. Consideration of the design basis requirements for the SITS.

3. Staff recommendatioris contained in GL 93-05 regarding SIT TS requirements.

4. Interface considerations that ensure the risk incurred when a SIT is taken out of service is minimum.

5. Performance monitoring through the maintenance rule to ensure that extension of TS AOTs for SITS does not degrade operational safety over time.

The staff therefore finds that the AOT for one SIT that is inoperable for the inability to verify level or pressure may be extended to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the AOT for one SIT that is inoperable for reasons other than boron concentration not within limits or inability to verify level or pressure may be extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, with a negligible impact on risk.

The staff has reviewed the proposed basis change which references CE NPSD-994,"CEOG l Joint Applications Report for Safety injection Tank AOT/ SIT Extension," May 1995. The report provided the deterministic and probabilistic analyses to conclude that the overall risk impact l was either risk-beneficial or risk neutral.

i

i

.g.

6.0 STATE CONSULTATION

in accordance with the Commission's regulations, the Nebraska State official was notified of the proposed issuance of the amendment. The State official had no comments.

7.0 EhlVIRONMENTAL CONSIDERATION The amendments change a requirement with respect to the installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has ,

determined that the amendments involve no significant increase in the amounts, and no I significant change in the types, of any effluents that may be released offsite, and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (60 FR 39447). Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). The amendments also involve changes in l recordkeeping, reporting or administrative procedures or requirements. Accordingly, with respect to these items, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(10). Pursuant to 10 CFR 51.22(b) no environmental impact statement ,

or environmental assessment need oe prepared in connection with the issuance of the amendments. ,

8.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

PrincipF,i Contributor: N. Gilles J. Foster Date: October 10, 1998